@everystack/cli 0.3.31 → 0.4.1

package/src/cli/derived-lint.ts

@@ -0,0 +1,261 @@
+/**
+ * derived-lint — the B2 gates over the declared derived layer
+ * (docs/plans/read-model-everywhere.md, "Rejection rules and gates").
+ *
+ * The table gate (authz-lint's findReadAuthzGaps) has a derived mirror: a declared
+ * relation nobody can read exists superuser-only from the moment it is created. Two more
+ * gates close the function surface (SECURITY DEFINER with undeclared callers) and the
+ * matview trap (a snapshot taken with the refresher's eyes over row-scoped sources), and
+ * one closes the invoker-view gap: `securityInvoker: true` means the CALLER's rights are
+ * checked against every relation the body touches — a view can be granted and still
+ * unreadable, one property over.
+ *
+ * Reachability walks DECLARED deps only — the declared graph paying for itself
+ * (`dependsOn`: declared, then verified; reconcile checks the declaration against the
+ * live catalog). An empty `dependsOn` is an empty closure, not a pass on a technicality:
+ * the drift report names the missing declaration.
+ *
+ * Audience semantics mirror the table grant compiler (authz-compile), and the mirroring
+ * is PINNED by a differential test against compileTableContract (derived-lint.test.ts) —
+ * asserted-in-parallel implementations drift exactly where the examples don't look. The
+ * shapes: bare read → anon + authenticated; owner/via-scoped read → authenticated only;
+ * column-scoped self read (`owner` + `columns`) → its role (or authenticated); `{ role }`
+ * narrows to that role; manage → its role (or authenticated); model-private does NOT
+ * zero the audience (private models still compile grants — the auth.users pattern). Row
+ * scoping (RLS) filters rows, not reach — a grant that returns only your rows is still a
+ * grant.
+ */
+
+import type {
+  ModelDescriptor, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor,
+  FunctionDescriptor, DependsOnRef, Ability,
+} from '@everystack/model';
+import { parseQualified } from './derived-source.js';
+
+export interface DerivedAuthzGap {
+  /** `schema.name` of the descriptor that fails the gate. */
+  identity: string;
+  message: string;
+}
+
+function identityOf(d: DerivedDescriptor): string {
+  const { schema, name } = parseQualified(d.name);
+  return `${schema}.${name}`;
+}
+
+function isModelRef(ref: DependsOnRef): ref is ModelDescriptor {
+  return 'table' in ref;
+}
+
+/** The column-scoped self read — same predicate as the table grant compiler. */
+function isColumnRead(a: Ability): boolean {
+  return a.action === 'read' && Boolean(a.condition.owner) && Boolean(a.condition.columns?.length);
+}
+
+/**
+ * Does the table's grant compile give `role` SELECT (full or column-scoped)?
+ *
+ * Exported for the differential pin against compileTableContract — this math must agree
+ * with the ACTUAL grant compiler for every ability shape, or the gate refuses views the
+ * database would serve (or worse, passes ones it won't). Note `private` on a MODEL is
+ * deliberately not consulted: private means "not exposed via the generic API", and its
+ * authz still compiles into real grants (the auth.users pattern — private + admin
+ * manage + column-scoped self read). The red team caught the gate treating model-private
+ * as zero-reach, which bricked every invoker view over a private table.
+ */
+export function tableReaches(m: ModelDescriptor, role: string): boolean {
+  for (const a of m.abilities) {
+    if (isColumnRead(a)) {
+      if ((a.condition.role ?? 'authenticated') === role) return true;
+      continue;
+    }
+    if (a.action !== 'read' && a.action !== 'manage') continue;
+    if (a.condition.role) {
+      if (a.condition.role === role) return true;
+      continue;
+    }
+    if (role === 'authenticated') return true;
+    if (role === 'anon' && a.action === 'read' && !a.condition.owner && !a.condition.via) return true;
+  }
+  return false;
+}
+
+/** The roles a relation's grants reach — bare read is anon + authenticated (the table precedent). */
+function relationRoles(d: ViewDescriptor | MaterializedViewDescriptor): Set<string> {
+  const roles = new Set<string>();
+  for (const a of d.abilities) {
+    if (a.condition.role) roles.add(a.condition.role);
+    else {
+      roles.add('anon');
+      roles.add('authenticated');
+    }
+  }
+  return roles;
+}
+
+function functionRoles(fn: FunctionDescriptor): Set<string> {
+  // define-time already rejected bare can('execute') — every ability carries a role.
+  return new Set(fn.abilities.map((a) => a.condition.role!));
+}
+
+// ---------------------------------------------------------------------------
+// Gate: derived read-gap (db:check fail)
+// ---------------------------------------------------------------------------
+
+/**
+ * Every declared relation makes its read decision or fails: an exposed view/matview with
+ * no read ability and no `private: true` is superuser-only from birth — the derived
+ * mirror of the table landmine findReadAuthzGaps catches.
+ */
+export function findDerivedReadGaps(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
+  const gaps: DerivedAuthzGap[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'view' && d.kind !== 'materialized view') continue;
+    if (d.private || d.abilities.length > 0) continue;
+    const identity = identityOf(d);
+    gaps.push({
+      identity,
+      message:
+        `${identity} is a declared ${d.kind} with no read ability and no private: true — no app role can ` +
+        `read it, so it exists superuser-only. Declare can('read') for public data, can('read', { columns }) ` +
+        `to scope fields, or private: true if it is not part of the data API.`,
+    });
+  }
+  return gaps;
+}
+
+// ---------------------------------------------------------------------------
+// Gate: SECURITY DEFINER with no declared caller (db:check fail)
+// ---------------------------------------------------------------------------
+
+/**
+ * A definer function runs with its owner's rights; compiling one with no `can('execute')`
+ * is privileged code with an undeclared audience — callable by nobody today (PUBLIC is
+ * revoked unconditionally) and by whoever gets a grant tomorrow, with no declaration to
+ * review. Invoker functions may stay dark: unprivileged, owner-callable, honest.
+ */
+export function findSecdefExecuteGaps(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
+  const gaps: DerivedAuthzGap[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'function' || d.security !== 'definer' || d.abilities.length > 0) continue;
+    const identity = identityOf(d);
+    gaps.push({
+      identity,
+      message:
+        `${identity} is SECURITY DEFINER with no declared caller — privileged code whose audience nobody ` +
+        `reviewed. Declare who calls it with can('execute', { role: '…' }), or make it security: 'invoker'.`,
+    });
+  }
+  return gaps;
+}
+
+// ---------------------------------------------------------------------------
+// Gate: matview snapshot over row-scoped sources (db:check warn)
+// ---------------------------------------------------------------------------
+
+/** Walk the declared closure through views (a matview's own snapshot is its own decision). */
+function closureModels(refs: readonly DependsOnRef[], seen = new Set<DependsOnRef>()): ModelDescriptor[] {
+  const models: ModelDescriptor[] = [];
+  for (const ref of refs) {
+    if (seen.has(ref)) continue;
+    seen.add(ref);
+    if (isModelRef(ref)) models.push(ref);
+    else if (ref.kind === 'view') models.push(...closureModels(ref.dependsOn, seen));
+  }
+  return models;
+}
+
+function rowScoped(m: ModelDescriptor): boolean {
+  return m.abilities.some((a) => a.condition.owner || a.condition.via);
+}
+
+/**
+ * A matview's rows are whatever its refresher could see, served flat to every granted
+ * role: over a row-scoped source, a superuser refresher snapshots EVERYTHING (broad), and
+ * a FORCE-RLS-subject owner silently snapshots a SUBSET (filtered) — both wrong in a
+ * different direction, neither visible in the schema. Warn, don't fail: an aggregating
+ * body (counts, sums) is the legitimate case, and only the author knows.
+ */
+export function findMatviewSnapshotWarnings(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
+  const warnings: DerivedAuthzGap[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'materialized view' || d.private || d.abilities.length === 0) continue;
+    const scoped = closureModels(d.dependsOn).filter(rowScoped);
+    if (scoped.length === 0) continue;
+    const identity = identityOf(d);
+    const sources = scoped.map((m) => `${m.schema}.${m.table}`).join(', ');
+    warnings.push({
+      identity,
+      message:
+        `${identity} snapshots row-scoped source(s) ${sources} with the refresher's eyes — a superuser ` +
+        `refresh serves EVERY row flat to every granted role; a FORCE-RLS-subject owner silently snapshots ` +
+        `a subset. Confirm the body aggregates/filters away the per-row data, or declare private: true.`,
+    });
+  }
+  return warnings;
+}
+
+// ---------------------------------------------------------------------------
+// Gate: invoker-view grant reachability (compile fail)
+// ---------------------------------------------------------------------------
+
+/** The first ref in the closure `role` cannot reach, or null. */
+function findUnreachable(role: string, refs: readonly DependsOnRef[], seen: Set<DependsOnRef>): string | null {
+  for (const ref of refs) {
+    if (seen.has(ref)) continue;
+    seen.add(ref);
+    if (isModelRef(ref)) {
+      if (!tableReaches(ref, role)) return `${ref.schema}.${ref.table}`;
+      continue;
+    }
+    switch (ref.kind) {
+      case 'view': {
+        if (ref.private || !relationRoles(ref).has(role)) return identityOf(ref);
+        // An invoker dep re-checks the caller one level down; a definer dep reads as its owner.
+        if (ref.securityInvoker) {
+          const deeper = findUnreachable(role, ref.dependsOn, seen);
+          if (deeper) return deeper;
+        }
+        break;
+      }
+      case 'materialized view':
+        // A matview is its own snapshot: SELECT on the matview is the whole requirement.
+        if (ref.private || !relationRoles(ref).has(role)) return identityOf(ref);
+        break;
+      case 'function':
+        // The body calls it with the caller's rights — EXECUTE is part of reach.
+        if (!functionRoles(ref).has(role)) return identityOf(ref);
+        break;
+      case 'sql':
+        break; // opaque — never a false positive
+    }
+  }
+  return null;
+}
+
+/**
+ * `securityInvoker: true` + a grant to role R is a PROMISE that R can read the body's
+ * relations — PostgreSQL checks R, not the owner, against every one of them. This gate
+ * makes the promise static: every granted role must have reach through the declared
+ * `dependsOn` closure, or the view is granted-but-unreadable and the compile refuses.
+ */
+export function findInvokerReachabilityGaps(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
+  const gaps: DerivedAuthzGap[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'view' || !d.securityInvoker || d.private || d.abilities.length === 0) continue;
+    const identity = identityOf(d);
+    for (const role of [...relationRoles(d)].sort()) {
+      const unreachable = findUnreachable(role, d.dependsOn, new Set());
+      if (unreachable) {
+        gaps.push({
+          identity,
+          message:
+            `view '${identity}' grants ${role} but its dependency '${unreachable}' gives ${role} no reach — ` +
+            `granted-but-unreadable (an invoker view reads with the caller's rights). Grant '${unreachable}' ` +
+            `to ${role}, seal the view with securityInvoker: false, or narrow the view's roles.`,
+        });
+      }
+    }
+  }
+  return gaps;
+}

package/src/cli/derived-plan.ts

@@ -1,9 +1,9 @@
 /**
  * derived-plan — the reconciler's pure decision core.
  *
- * Joins the three inputs on identity — source objects (db/sql), the live
+ * Joins the three inputs on identity — source objects (descriptor-compiled), the live
  * catalog, and the provenance claims — and decides, per object: skip, create,
- * replace, refresh, drop, baseline, or prune. Hand-edited live objects are
+ * replace, refresh, drop, baseline, rebaseline, or prune. Hand-edited live objects are
  * DRIFT: reported, never silently overwritten (`overwriteDrift` makes the
  * overwrite explicit, and the drift stays in the report so the operator sees
  * what they overwrote). Never-reconciled matches are `needsBaseline`: the
@@ -24,10 +24,12 @@
  * drift report, not a silent skip.
  */
 
-import type { ParsedSources, SourceObject, DerivedKind } from './derived-source.js';
+import { type ParsedSources, type SourceObject, type DerivedKind } from './derived-source.js';
 import type { DerivedCatalog, LiveObject } from './derived-introspect.js';
+import { triggerDropSql } from './derived-apply.js';
+import { parseGrantAttachments, diffObjectGrants } from './derived-grants.js';
 
-export type ReconcileVerb = 'create' | 'replace' | 'refresh' | 'drop' | 'baseline' | 'prune';
+export type ReconcileVerb = 'create' | 'replace' | 'refresh' | 'drop' | 'baseline' | 'rebaseline' | 'prune';
 
 export interface ReconcileAction {
   action: ReconcileVerb;
@@ -37,6 +39,9 @@ export interface ReconcileAction {
   /** Rebuild-cost signal from the live catalog (matviews). */
   bytes?: number;
   rows?: number;
+  /** Drops for the structural kinds — a trigger's `DROP TRIGGER … ON table`, a 'sql'
+   *  object's recorded/declared drop. Legacy kinds keep the keyword rendering. */
+  dropSql?: string;
 }
 
 export interface DriftFinding {
@@ -44,6 +49,21 @@ export interface DriftFinding {
   detail: string;
 }
 
+/** Grant drift on an up-to-date object — the idempotent REVOKE/GRANT delta that converges it. */
+export interface RegrantFinding {
+  identity: string;
+  statements: string[];
+}
+
+/** Declared `dependsOn` vs the live catalog's actual edges (B4: declared, then verified). */
+export interface DependencyDriftFinding {
+  identity: string;
+  /** Live edges the source never declared — the reachability gate walked past these. */
+  missing: string[];
+  /** Declared refs with no live edge — stale declarations. */
+  stale: string[];
+}
+
 export interface BlockedFinding {
   identity: string;
   reason: string;
@@ -66,6 +86,15 @@ export interface ReconcilePlan {
   warnings: string[];
   /** Sum of live bytes over rebuilt + refreshed matviews — the headline cost estimate. */
   totalRebuildBytes: number;
+  /** Provenance identity migrations — a table rename carried its triggers (same object,
+   *  new identity); the bookkeeping follows instead of drop+create-ing a live trigger. */
+  migrations: Array<{ from: string; to: string }>;
+  /** Grant drift on up-to-date objects: a hand-run GRANT/REVOKE touches no content hash,
+   *  so this is the only place it surfaces. Applied without ceremony — declared authz is
+   *  authoritative, and REVOKE/GRANT loses nothing but the drift itself. */
+  regrants: RegrantFinding[];
+  /** Declared-vs-actual dependency drift — check-fails (fix the declaration), never blocks apply. */
+  dependencyDrift: DependencyDriftFinding[];
 }
 
 export interface ReconcileOptions {
@@ -75,9 +104,28 @@ export interface ReconcileOptions {
   overwriteDrift?: boolean;
   /**
    * Rebuild never-reconciled source↔live matches from source (drop+create) instead of trusting
-   * them via baseline — the guarantee that live == db/sql when first contact can't verify it.
+   * them via baseline — the guarantee that live == source when first contact can't verify it.
    */
   rebuild?: boolean;
+  /**
+   * Re-record provenance for objects whose SOURCE hash changed while the LIVE object is
+   * verifiably untouched (live defHash == provenance defHash) — bookkeeping instead of a
+   * rebuild. The migration verb for a source re-render that produces the same object:
+   * the db/sql-era → descriptor move re-renders every object in the compiler's dialect
+   * (grant attachments on functions, pinned dollar-tags, plain CREATE), so the source
+   * hash changes even when the SQL is semantically identical. The live side is VERIFIED
+   * (defHash proves the object is exactly what the reconciler last applied); the source
+   * side is TRUSTED (a descriptor that actually differs will never deploy — its change
+   * is recorded as applied). Catalog-invisible 'sql'-kind objects are excluded: with no
+   * defHash to verify, they keep their recorded-drop rebuild.
+   */
+  rebaseline?: boolean;
+  /**
+   * Pending table renames (new qualified table → old qualified table, from the models'
+   * `renamedFrom` markers). PostgreSQL carries triggers through ALTER TABLE RENAME, so
+   * their provenance identity migrates with them.
+   */
+  renamedTables?: Record<string, string>;
 }
 
 const isRelation = (kind: DerivedKind): boolean => kind !== 'function';
@@ -91,6 +139,23 @@ export function planReconcile(
   const liveById = new Map(live.objects.map((o) => [o.identity, o]));
   const provById = new Map(live.provenance.map((p) => [p.identity, p]));
 
+  // Rename pre-pass: a pending table rename (renamedFrom) carried its triggers along in
+  // PostgreSQL, so a provenance row recorded under the OLD table is the SAME object as
+  // the source trigger under the NEW one — the bookkeeping migrates; nothing drops.
+  const migrations: Array<{ from: string; to: string }> = [];
+  for (const [newTable, oldTable] of Object.entries(options.renamedTables ?? {})) {
+    for (const prov of [...provById.values()]) {
+      if (prov.kind !== 'trigger' || !prov.identity.startsWith(`${oldTable}.`)) continue;
+      const to = `${newTable}.${prov.identity.slice(oldTable.length + 1)}`;
+      if (!srcById.has(to) || provById.has(to)) continue;
+      provById.delete(prov.identity);
+      provById.set(to, { ...prov, identity: to });
+      migrations.push({ from: prov.identity, to });
+    }
+  }
+  // Every provenance consumer below reads the POST-MIGRATION view.
+  const provRows = [...provById.values()];
+
   const skipped: string[] = [];
   const drift: DriftFinding[] = [];
   const needsBaseline: string[] = [];
@@ -106,16 +171,37 @@ export function planReconcile(
   /** Managed objects the source removed. */
   const drop = new Map<string, string>();
   const baseline: string[] = [];
+  const rebaseline: string[] = [];
   const prune: string[] = [];
 
   // -------------------------------------------------------------------------
   // The decision table.
   // -------------------------------------------------------------------------
 
+  /** identity → { statement, reason } for the provenance-tracked ('sql') kinds — these
+   *  never pass the live-existence filter, so they assemble their own drop actions. */
+  const sqlDrops = new Map<string, { dropSql: string; reason: string }>();
+  const extraWarnings: string[] = [];
+
   for (const src of source.objects) {
     const liveObj = liveById.get(src.identity);
     const prov = provById.get(src.identity);
 
+    // 'sql' objects (aggregates, domains, …) never join the live catalog — PROVENANCE is
+    // the live proxy. The documented contract of the escape hatch: provenance-tracked,
+    // no live drift detection; a change rebuilds through the recorded drop.
+    if (src.kind === 'sql') {
+      if (!prov) {
+        create.set(src.identity, 'new in source (provenance-tracked kind — invisible to the catalog)');
+      } else if (src.hash !== prov.srcHash) {
+        sqlDrops.set(src.identity, { dropSql: prov.dropSql ?? src.drop ?? '', reason: 'source changed' });
+        create.set(src.identity, 'source changed (rebuilt through the recorded drop)');
+      } else {
+        skipped.push(src.identity);
+      }
+      continue;
+    }
+
     if (!liveObj) {
       create.set(src.identity, prov
         ? 'missing from the database (recorded as applied — dropped by hand?)'
@@ -155,7 +241,11 @@ export function planReconcile(
       continue;
     }
     if (srcChanged) {
-      if (isRelation(src.kind)) rebuild.set(src.identity, 'source changed');
+      // The live object is verifiably untouched here (liveChanged was handled above), so
+      // under rebaseline a source re-render is bookkeeping: re-record the source hash,
+      // rebuild nothing, cascade nothing.
+      if (options.rebaseline) rebaseline.push(src.identity);
+      else if (isRelation(src.kind)) rebuild.set(src.identity, 'source changed');
       else fnReplace.set(src.identity, 'source changed');
       continue;
     }
@@ -168,8 +258,68 @@ export function planReconcile(
     else unmanaged.push(liveObj.identity);
   }
 
-  for (const prov of live.provenance) {
-    if (!srcById.has(prov.identity) && !liveById.has(prov.identity)) prune.push(prov.identity);
+  for (const prov of provRows) {
+    if (srcById.has(prov.identity) || liveById.has(prov.identity)) continue;
+    // A removed 'sql' object is invisible to the catalog — pruning would silently orphan
+    // it in the database. The recorded drop_sql removes it (the C1 closure); only a
+    // legacy row with no recorded drop falls back to prune, and says so.
+    if (prov.kind === 'sql') {
+      if (prov.dropSql) {
+        sqlDrops.set(prov.identity, { dropSql: prov.dropSql, reason: 'removed from source (dropped via the recorded drop_sql)' });
+      } else {
+        prune.push(prov.identity);
+        extraWarnings.push(`${prov.identity}: a 'sql'-kind object recorded without drop_sql (legacy row) — bookkeeping pruned; drop the object by hand if it still exists.`);
+      }
+      continue;
+    }
+    prune.push(prov.identity);
+  }
+
+  // -------------------------------------------------------------------------
+  // B4 — live drift the content hashes can't see, over the UP-TO-DATE objects
+  // only: created/replaced objects re-run their attachments, drifted objects
+  // are owned by the drift refusal.
+  // -------------------------------------------------------------------------
+
+  const regrants: RegrantFinding[] = [];
+  const dependencyDrift: DependencyDriftFinding[] = [];
+  // Rebaselined objects join the lens: their live catalog rows are as real as a skip's,
+  // and running the checks NOW means a migration converges (grants ride the same apply)
+  // instead of surfacing on the next plan.
+  const lensSet = new Set([...skipped, ...rebaseline]);
+  for (const src of source.objects) {
+    if (!lensSet.has(src.identity)) continue;
+    if (src.kind === 'trigger' || src.kind === 'sql') continue; // no grants, no rewrite edges
+    const liveObj = liveById.get(src.identity);
+
+    // Grant drift — only when the catalog actually reported ACLs (absent ≠ empty).
+    // Every object is descriptor-compiled (db/sql retired, B7), and the compiler
+    // ALWAYS declares authz — a private relation is declared-empty, not undeclared —
+    // so every up-to-date object is grant-checked.
+    if (liveObj?.grants !== undefined) {
+      const parsed = parseGrantAttachments(src.attachments);
+      if (parsed.hasColumnGrants) {
+        extraWarnings.push(
+          `${src.identity}: column-scoped grants are applied at create but not drift-checked (attacl introspection is future work) — hand edits to them are invisible here.`,
+        );
+      } else {
+        const target = parsed.target ?? (src.kind === 'function' ? `FUNCTION ${src.identity}` : src.identity);
+        const statements = diffObjectGrants(target, parsed.grants, liveObj.grants);
+        if (statements.length > 0) regrants.push({ identity: src.identity, statements });
+      }
+    }
+
+    // Dependency drift — declared, then verified. Only descriptor-home relations carry a
+    // declaration, and only relations have rewrite-rule edges for the catalog to answer with.
+    if (src.declaredDeps !== undefined && (src.kind === 'view' || src.kind === 'materialized view')) {
+      const liveDeps = new Set(live.edges.filter((e) => e.dependent === src.identity).map((e) => e.referenced));
+      const declaredSet = new Set(src.declaredDeps);
+      const missing = [...liveDeps].filter((d) => !declaredSet.has(d)).sort();
+      const stale = [...declaredSet].filter((d) => !liveDeps.has(d)).sort();
+      if (missing.length > 0 || stale.length > 0) {
+        dependencyDrift.push({ identity: src.identity, missing, stale });
+      }
+    }
   }
 
   // -------------------------------------------------------------------------
@@ -260,11 +410,23 @@ export function planReconcile(
     const cost = liveObj?.kind === 'materialized view'
       ? { ...(liveObj.bytes !== undefined ? { bytes: liveObj.bytes } : {}), ...(liveObj.rows !== undefined ? { rows: liveObj.rows } : {}) }
       : {};
-    return { action, identity: id, kind, reason, ...cost };
+    // A trigger's drop needs its table — composed from structure (source or live), never
+    // from the identity string (the red-team's C4: quoting a compound identity mangles it).
+    const structural = action === 'drop' && kind === 'trigger'
+      ? (() => {
+          const o = src ?? liveObj;
+          return o?.table ? { dropSql: triggerDropSql(o.name, o.table) } : {};
+        })()
+      : {};
+    return { action, identity: id, kind, reason, ...cost, ...structural };
   };
 
   const actions: ReconcileAction[] = [
     ...orderDrops(dropSet).map((id) => actionFor(id, 'drop', rebuild.get(id) ?? drop.get(id) ?? '')),
+    // 'sql'-kind drops (rebuilds + removals) — invisible to the live catalog, so they
+    // carry their own statement; ordered with the other drops, before every create.
+    ...[...sqlDrops.entries()].sort((a, b) => a[0].localeCompare(b[0]))
+      .map(([id, d]) => ({ action: 'drop' as const, identity: id, kind: 'sql' as DerivedKind, reason: d.reason, dropSql: d.dropSql })),
     ...[...fnReplace.entries()].sort((a, b) => seqOf(a[0]) - seqOf(b[0]))
       .map(([id, reason]) => actionFor(id, 'replace', reason)),
     ...createSet.sort((a, b) => seqOf(a) - seqOf(b))
@@ -272,6 +434,7 @@ export function planReconcile(
     ...[...refresh.entries()].sort((a, b) => seqOf(a[0]) - seqOf(b[0]))
       .map(([id, reason]) => actionFor(id, 'refresh', reason)),
     ...baseline.sort().map((id) => actionFor(id, 'baseline', 'recording provenance for an existing match (trusted once, explicitly)')),
+    ...rebaseline.sort().map((id) => actionFor(id, 'rebaseline', 'source re-rendered — live verified untouched (defHash match); provenance re-recorded, no rebuild')),
     ...prune.sort().map((id) => ({
       action: 'prune' as const, identity: id, kind: 'view' as DerivedKind,
       reason: 'stale provenance — object gone from both source and database',
@@ -289,7 +452,10 @@ export function planReconcile(
     needsBaseline: needsBaseline.sort(),
     unmanaged: unmanaged.sort(),
     blocked,
-    warnings: [...source.warnings],
+    warnings: [...source.warnings, ...extraWarnings],
     totalRebuildBytes,
+    migrations,
+    regrants: regrants.sort((a, b) => a.identity.localeCompare(b.identity)),
+    dependencyDrift: dependencyDrift.sort((a, b) => a.identity.localeCompare(b.identity)),
   };
 }