@everystack/cli 0.4.102 → 0.4.104

package/src/cli/schema-fingerprint.ts

@@ -53,7 +53,7 @@
 import { createHash } from 'node:crypto';
 import { canonicalAuthz } from './authz-canonical';
 import type { ModelDescriptor, SequenceDescriptor } from '@everystack/model';
-import { assertExternalTargets, relationDeleteActions } from '@everystack/model';
+import { assertExternalTargets, lifecycleDependentIndexes, relationDeleteActions } from '@everystack/model';
 import type { EnumType, SchemaSnapshot, TableSchema } from './schema-introspect';
 import type { AuthzContract, TableContract, SequenceGrantContract } from './authz-contract';
 import { compileTableSchema, compileEnums, compileSequences } from './schema-compile';
@@ -498,9 +498,10 @@ export function fingerprintModels(
   assertExternalTargets(models);
   // Also over the whole set: a parent's hasMany `dependent` sets the ON DELETE of a child's FK.
   const dependents = relationDeleteActions(models);
+  const dependentIndexes = lifecycleDependentIndexes(models);
   const scoped = opts.schemas ? models.filter((m) => opts.schemas!.includes(m.schema)) : models;
   const snapshot: SchemaSnapshot = {
-    tables: scoped.map((m) => compileTableSchema(m, { schema: opts.schema, dependents })),
+    tables: scoped.map((m) => compileTableSchema(m, { schema: opts.schema, dependents, dependentIndexes })),
     enums: compileEnums(scoped),
     ...(opts.sequences?.length ? { sequences: compileSequences(opts.sequences) } : {}),
   };

package/src/cli/schema-introspect.ts

@@ -166,12 +166,35 @@ export interface SchemaSnapshot {
   sequences?: SequenceSchema[];
   /** Installed extensions, `plpgsql` excluded. Absent when the read predates this. */
   extensions?: string[];
+  /**
+   * The catalog's row estimate per table (`pg_class.reltuples`): > 0 an estimate, 0 empty, -1 a
+   * table with data that was never analyzed. For the plan's ⚠ LOCK line only. Beside the tables,
+   * never inside one, so no fingerprint or diff reads it. Absent when the read predates it.
+   */
+  rowEstimates?: Record<string, number>;
 }
 
 // ---------------------------------------------------------------------------
 // Introspection SQL.
 // ---------------------------------------------------------------------------
 
+/**
+ * Row estimates for the plan's ⚠ LOCK line — catalog statistics, no table scan. reltuples is -1
+ * before the first VACUUM/ANALYZE; a table that has pages then is reported -1 (data, unknown count).
+ */
+export const ROW_ESTIMATES_SQL = `
+SELECT n.nspname AS schema, c.relname AS "table",
+  CASE WHEN c.reltuples > 0 THEN c.reltuples::bigint
+       WHEN pg_catalog.pg_relation_size(c.oid) > 0 THEN -1
+       ELSE 0 END AS estimate
+FROM pg_class c
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE c.relkind = 'r'
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND n.nspname NOT LIKE 'pg_%'
+ORDER BY 1, 2;
+`.trim();
+
 /**
  * Every column of every base table, with its precise type (`format_type`),
  * nullability, and default. Extension-owned tables are excluded via pg_depend,
@@ -711,6 +734,8 @@ export interface SchemaRows {
   indexes?: IndexRow[];
   sequences?: SequenceRow[];
   extensions?: ExtensionRow[];
+  /** Absent on a read that predates ROW_ESTIMATES_SQL (an older ops Lambda reply). */
+  estimates?: Array<{ schema: string; table: string; estimate: unknown }>;
 }
 
 /**
@@ -804,6 +829,9 @@ export function assembleSchema(rows: SchemaRows): SchemaSnapshot {
     enums,
     ...(sequences.length ? { sequences } : {}),
     ...(extensions !== undefined ? { extensions } : {}),
+    ...(rows.estimates !== undefined
+      ? { rowEstimates: Object.fromEntries(rows.estimates.map((r) => [`${r.schema}.${r.table}`, Number(r.estimate)])) }
+      : {}),
   };
 }
 
@@ -820,8 +848,10 @@ export async function introspectSchema(session: SessionRunner): Promise<SchemaSn
   // search_path. Column defaults, CHECK constraints and index expressions all deparse
   // relative to that path — spread across separate connections these five rows can render
   // the same schema two ways, and a fingerprint minted from the mix describes nothing.
-  const [columns, constraints, enums, indexes, sequences, extensions] = await session(
-    [COLUMNS_SQL, CONSTRAINTS_SQL, ENUMS_SQL, INDEXES_SQL, SEQUENCES_SQL, EXTENSIONS_SQL],
+  // The row estimates ride the same session and snapshot; a reply without them (fewer result
+  // sets) assembles without `rowEstimates`, and the plan then warns without a count.
+  const [columns, constraints, enums, indexes, sequences, extensions, estimates] = await session(
+    [COLUMNS_SQL, CONSTRAINTS_SQL, ENUMS_SQL, INDEXES_SQL, SEQUENCES_SQL, EXTENSIONS_SQL, ROW_ESTIMATES_SQL],
     INTROSPECTION_SESSION,
   );
   return assembleSchema({
@@ -831,5 +861,6 @@ export async function introspectSchema(session: SessionRunner): Promise<SchemaSn
     indexes: indexes as IndexRow[],
     sequences: sequences as SequenceRow[],
     extensions: extensions as ExtensionRow[],
+    ...(Array.isArray(estimates) ? { estimates: estimates as SchemaRows['estimates'] } : {}),
   });
 }

package/src/cli/state-function-deps.ts

@@ -158,7 +158,7 @@ export async function createStateReferencedFunctions(
   session: SessionRunner,
   statements: readonly string[],
   declared: readonly SourceObject[],
-  options: { actor?: string | null; gitRef?: string | null; now?: () => number } = {},
+  options: { actor?: string | null; gitRef?: string | null; now?: () => number; lifecyclePreflighted?: boolean } = {},
 ): Promise<string[]> {
   const referenced = stateReferencedFunctions(statements, declared);
   if (referenced.length === 0) return [];
@@ -184,6 +184,7 @@ export async function createStateReferencedFunctions(
     actor: options.actor ?? null,
     gitRef: options.gitRef ?? null,
     now: options.now,
+    lifecyclePreflighted: options.lifecyclePreflighted,
   });
   if (run.refusal) {
     throw new Error(`could not create the functions the state batch calls (${missing.map((o) => o.identity).join(', ')}) before it: ${run.refusal}`);

package/src/cli/lifecycle-verify.ts

@@ -1,232 +0,0 @@
-/** Fail-closed verification of generated lifecycle definitions before db:pull writes. */
-import { LIFECYCLE_OWNER_ROLE, parseQualified, type FunctionDescriptor } from '@everystack/model';
-import { canonHash, canonOfFunction, type FunctionCanon } from './lifecycle-canon';
-import { regenerateLifecycle, lifecycleRole, MANIFEST_VERSION, LIFECYCLE_ROLES, type LifecycleDeclaration, type LifecycleManifest, type LifecycleTrigger } from './lifecycle-derived';
-import { normalizeArgType } from './pg-argtypes';
-import { parseTriggerType } from './derived-introspect';
-import { normalizeDeparsedExpr } from './deparse-normal';
-import { INTROSPECTION_SESSION, type SessionRunner } from './session';
-
-const FUNCTIONS = `SELECT n.nspname AS schema, p.proname AS name,
- n.nspname || '.' || p.proname || '(' || coalesce((SELECT string_agg(format_type(t, NULL), ', ' ORDER BY o) FROM unnest(p.proargtypes::oid[]) WITH ORDINALITY x(t,o)), '') || ')' AS identity,
- ARRAY(SELECT format_type(t,NULL) FROM unnest(p.proargtypes::oid[]) WITH ORDINALITY x(t,o) ORDER BY o) AS arg_types,
- pg_get_function_arguments(p.oid) AS args, pg_get_function_result(p.oid) AS returns,
- l.lanname AS language,p.prosecdef AS secdef,p.provolatile::text AS volatility,p.proisstrict AS strict,p.proleakproof AS leakproof,
- coalesce(p.proconfig,'{}'::text[]) AS config,pg_get_userbyid(p.proowner) AS owner,p.prosrc AS body,obj_description(p.oid,'pg_proc') AS comment,
- coalesce((SELECT array_agg(DISTINCT coalesce(g.rolname,'PUBLIC') ORDER BY coalesce(g.rolname,'PUBLIC'))
-  FROM aclexplode(coalesce(p.proacl,acldefault('f',p.proowner))) a LEFT JOIN pg_roles g ON g.oid=a.grantee
-  WHERE a.grantee<>p.proowner AND a.privilege_type='EXECUTE'),'{}'::name[])::text[] AS execute
- FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace JOIN pg_language l ON l.oid=p.prolang
- WHERE p.prokind IN ('f','p') AND n.nspname NOT IN ('pg_catalog','information_schema') AND n.nspname NOT LIKE 'pg_%'
- AND NOT EXISTS(SELECT 1 FROM pg_depend d WHERE d.objid=p.oid AND d.deptype='e')`;
-const TRIGGERS = `SELECT n.nspname||'.'||c.relname AS "table",t.tgname AS name,t.tgtype::int AS type,t.tgenabled::text AS enabled,
- t.tgconstraint<>0 AS is_constraint,t.tgdeferrable AS deferrable,t.tginitdeferred AS initially_deferred,
- fn.nspname||'.'||p.proname AS fn,substring(pg_get_triggerdef(t.oid) from ' WHEN [(](.*)[)] EXECUTE ') AS when_expr,
- coalesce((SELECT array_agg(a.attname::text ORDER BY x.ord) FROM unnest(t.tgattr::int2[]) WITH ORDINALITY x(attnum,ord)
- JOIN pg_attribute a ON a.attrelid=t.tgrelid AND a.attnum=x.attnum),'{}'::text[]) AS update_of,encode(t.tgargs,'hex') AS args
- FROM pg_trigger t JOIN pg_class c ON c.oid=t.tgrelid JOIN pg_namespace n ON n.oid=c.relnamespace
- JOIN pg_proc p ON p.oid=t.tgfoid JOIN pg_namespace fn ON fn.oid=p.pronamespace
- WHERE NOT t.tgisinternal AND n.nspname NOT IN ('pg_catalog','information_schema') AND n.nspname NOT LIKE 'pg_%'`;
-const TABLES = `SELECT n.nspname||'.'||c.relname AS identity,
- coalesce((SELECT jsonb_agg(jsonb_build_object('role',coalesce(r.rolname,'PUBLIC'),
- 'predicate',coalesce(pg_get_expr(p.polqual,p.polrelid),'true'),'permissive',p.polpermissive) ORDER BY p.polname,r.rolname)
- FROM pg_policy p CROSS JOIN LATERAL unnest(p.polroles) role(oid) LEFT JOIN pg_roles r ON r.oid=role.oid
- WHERE p.polrelid=c.oid AND p.polcmd IN ('d','*') AND r.rolname IS DISTINCT FROM 'everystack_lifecycle'),'[]'::jsonb) AS delete_policies,
- ARRAY(SELECT a.attname::text FROM unnest(k.conkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=x.num ORDER BY x.ord) AS pk_columns,
- ARRAY(SELECT format_type(a.atttypid,a.atttypmod) FROM unnest(k.conkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=x.num ORDER BY x.ord) AS pk_types,
- EXISTS(SELECT 1 FROM pg_index i WHERE i.indrelid=c.oid AND i.indisunique AND NOT i.indisprimary) AS unique,
- ((SELECT count(*)=4 FROM pg_attribute a WHERE a.attrelid=c.oid AND NOT a.attisdropped AND a.attname IN ('deleted_at','deleted_by','deleted_batch','deleted_xid'))
- AND EXISTS(SELECT 1 FROM aclexplode(coalesce(c.relacl,acldefault('r',c.relowner))) a JOIN pg_roles r ON r.oid=a.grantee
- WHERE r.rolname='everystack_lifecycle' AND a.privilege_type='DELETE')) AS lifecycle
- FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace LEFT JOIN pg_constraint k ON k.conrelid=c.oid AND k.contype='p'
- WHERE c.relkind IN ('r','p') AND n.nspname NOT IN ('pg_catalog','information_schema') AND n.nspname NOT LIKE 'pg_%'`;
-const EDGES = `SELECT pn.nspname||'.'||p.relname AS parent,cn.nspname||'.'||c.relname AS child,
- ARRAY(SELECT a.attname::text FROM unnest(f.conkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=x.num ORDER BY x.ord) AS columns,
- ARRAY(SELECT a.attname::text FROM unnest(f.confkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=p.oid AND a.attnum=x.num ORDER BY x.ord) AS references,
- f.confdeltype::text AS action FROM pg_constraint f JOIN pg_class c ON c.oid=f.conrelid JOIN pg_namespace cn ON cn.oid=c.relnamespace
- JOIN pg_class p ON p.oid=f.confrelid JOIN pg_namespace pn ON pn.oid=p.relnamespace WHERE f.contype='f'`;
-
-type Row = Record<string, unknown>;
-const record = (value: unknown): value is Row => value !== null && typeof value === 'object' && !Array.isArray(value);
-const strings = (value: unknown): string[] => Array.isArray(value) ? value.map(String) : [];
-const same = (a: unknown, b: unknown): boolean => canonHash(a) === canonHash(b);
-const hint = 'missing lifecycle manifest; db:apply for a managed install; db:reconcile --baseline for a brownfield object with no provenance (use --apply to persist)';
-
-interface TriggerCanon { kind: 'trigger'; identity: string; table: string; timing: string; events: string[]; forEach: string; fn: string; when: string | null; updateOf: string[]; args: string; enabled: string; constraint: boolean; deferrable: boolean; initiallyDeferred: boolean; }
-interface LiveFunction { name: string; argTypes: string[]; canon: FunctionCanon; comment: unknown; }
-export interface LifecycleVerdict { failures: string[]; notes: string[]; }
-export class LifecycleDriftError extends Error {
-  constructor(readonly lines: string[]) { super('lifecycle verification failed'); }
-}
-
-/** Only the two fixed generated WHEN expressions need catalog spelling normalization. */
-/** A trigger WHEN, normalised so the generated text and PostgreSQL's deparse compare equal. Exported for tests. */
-export function whenExpression(value: string | null): string | null {
-  if (value === null) return null;
-  const text = value.replace(new RegExp(`'${LIFECYCLE_OWNER_ROLE}'::name`, 'g'), `'${LIFECYCLE_OWNER_ROLE}'`);
-  const tokens = text.match(/'(?:[^']|'')*'|"(?:[^"]|"")*"|[^'"]+/g) ?? [];
-  return tokens.map(token => {
-    if (token.startsWith("'")) return token;
-    if (token.startsWith('"')) return token === '"deleted_at"' ? 'deleted_at' : token;
-    // PostgreSQL deparses a pg_catalog function unqualified; the generator writes it qualified.
-    // Drop only a WHOLE `pg_catalog.` qualifier, on the raw token (before spaces go, or `OR pg_catalog.`
-    // would fuse into `orpg_catalog.`): not after a name character, a dot or a quote, so
-    // `ppg_catalog.g_trigger_depth` and `x.pg_catalog.f` keep their text and show as drift.
-    return token.replace(/(?<![A-Za-z0-9_$."])pg_catalog\./gi, '').replace(/[()\s]/g, '').toLowerCase();
-  }).join('');
-}
-function canonOfTrigger(trigger: LifecycleTrigger): TriggerCanon {
-  return { kind: 'trigger', identity: `${trigger.on.schema}.${trigger.on.table}.${trigger.name}`, table: `${trigger.on.schema}.${trigger.on.table}`, timing: trigger.timing,
-    events: trigger.events, forEach: trigger.forEach, fn: trigger.execute.name, when: whenExpression(trigger.condition ?? null),
-    updateOf: trigger.of ?? [], args: '', enabled: 'O', constraint: false, deferrable: false, initiallyDeferred: false };
-}
-function typeIdentity(type: string): string {
-  return normalizeArgType(type) + '|' + (type.match(/\([^)]*\)/g) ?? []).join('').replace(/\s+/g, '');
-}
-function declaration(value: unknown): value is LifecycleDeclaration {
-  if (!record(value) || !record(value.tables) || !Array.isArray(value.edges)) return false;
-  for (const [id, table] of Object.entries(value.tables)) {
-    if (!record(table) || typeof table.schema !== 'string' || typeof table.table !== 'string' || id !== `${table.schema}.${table.table}`
-      || !record(table.pk) || typeof table.pk.column !== 'string' || typeof table.pk.type !== 'string'
-      || typeof table.unique !== 'boolean' || !record(table.auth) || Object.values(table.auth).some(p => typeof p !== 'string')) return false;
-  }
-  return value.edges.every(edge => record(edge) && typeof edge.parent === 'string' && typeof edge.child === 'string'
-    && typeof edge.column === 'string' && (edge.dependent === 'cascade' || edge.dependent === 'restrict'));
-}
-
-/** Fold catalog policies by role exactly as the compiler records DELETE/ALL rules. */
-function sameDeleteRules(auth: Record<string, string>, policies: unknown): boolean {
-  if (!Array.isArray(policies)) return false;
-  const byRole = new Map<string, string[]>();
-  for (const policy of policies) {
-    if (!record(policy) || typeof policy.role !== 'string' || typeof policy.predicate !== 'string' || policy.permissive !== true) return false;
-    const predicates = byRole.get(policy.role) ?? [];
-    predicates.push(normalizeDeparsedExpr(policy.predicate));
-    byRole.set(policy.role, predicates);
-  }
-  const live = Object.fromEntries([...byRole].map(([role, predicates]) => [role,
-    predicates.length === 1 ? predicates[0] : predicates.map(p => `(${p})`).join(' OR ')]));
-  const declared = Object.fromEntries(Object.entries(auth).map(([role, predicate]) => [role, normalizeDeparsedExpr(predicate)]));
-  return same(declared, live);
-}
-
-/**
- * An older CLI generated a per-row `<t>_lifecycle_restrict` function (manifest role 'restrict') and
- * BEFORE DELETE trigger; the restrict check now lives in the transition. That pair is stale output,
- * not a malformed manifest or an author trigger: say so, and name the remedy.
- */
-const OLD_RESTRICT = 'stale, generated by an older CLI: run db:apply to remove the old restrict function and trigger';
-const oldRestrictName = (table: string): string => `${table}_lifecycle_restrict`;
-
-/** Four catalog reads share one read-only snapshot. No function bodies or generated SQL execute. */
-export async function verifyLifecycle(session: SessionRunner, governedRoles: readonly string[] = ['anon', 'authenticated', 'admin', LIFECYCLE_OWNER_ROLE]): Promise<LifecycleVerdict> {
-  const results = await session([FUNCTIONS, TRIGGERS, TABLES, EDGES], INTROSPECTION_SESSION);
-  if (results.length !== 4 || results.some(rows => !Array.isArray(rows))) throw new Error('lifecycle catalog could not be read completely');
-  const [functions, triggers, tables, edges] = results as Row[][];
-  const problems = new Map<string, string>();
-  const add = (id: string, reason: string): void => { if (!problems.has(id)) problems.set(id, `drift: ${id}: ${reason}`); };
-  const notes = new Set<string>();
-  const tableById = new Map(tables.map(t => [String(t.identity), t]));
-  const lifecycleTables = new Set(tables.filter(t => t.lifecycle === true).map(t => String(t.identity)));
-  const liveFunctions = new Map<string, LiveFunction>();
-  for (const row of functions) {
-    const canon: FunctionCanon = { kind: 'function', identity: String(row.identity), args: String(row.args), returns: String(row.returns),
-      language: String(row.language), secdef: row.secdef === true, volatility: String(row.volatility), strict: row.strict === true, leakproof: row.leakproof === true,
-      config: strings(row.config), owner: String(row.owner), execute: strings(row.execute).sort(), body: String(row.body) };
-    liveFunctions.set(canon.identity, { name: `${row.schema}.${row.name}`, canon, argTypes: strings(row.arg_types), comment: row.comment });
-  }
-  const liveTriggers = new Map<string, TriggerCanon>();
-  const triggerTypes = new Map<string, number>();
-  for (const row of triggers) {
-    const shape = parseTriggerType(Number(row.type));
-    const canon: TriggerCanon = { kind: 'trigger', identity: `${row.table}.${row.name}`, table: String(row.table), timing: shape.timing, events: shape.events, forEach: shape.forEach,
-      fn: String(row.fn), when: whenExpression(row.when_expr == null ? null : String(row.when_expr)), updateOf: strings(row.update_of), args: String(row.args), enabled: String(row.enabled),
-      constraint: row.is_constraint === true, deferrable: row.deferrable === true, initiallyDeferred: row.initially_deferred === true };
-    liveTriggers.set(canon.identity, canon);
-    triggerTypes.set(canon.identity, Number(row.type));
-  }
-  const familyByName = (live: LiveFunction): boolean => [...lifecycleTables].some(model => {
-    if (live.name.startsWith(`${model}_lifecycle_`)) return true;
-    const pkTypes = strings(tableById.get(model)?.pk_types);
-    return live.name === `${model}_restore` && live.argTypes.length === 1 && pkTypes.length === 1
-      && normalizeArgType(live.argTypes[0]) === normalizeArgType(pkTypes[0]);
-  });
-  const manifests = new Map<string, LifecycleManifest>();
-  const groups = new Map<string, { decl: LifecycleDeclaration; from: string }>();
-  for (const [id, live] of liveFunctions) {
-    let raw: unknown;
-    try { raw = typeof live.comment === 'string' ? JSON.parse(live.comment) : undefined; } catch {
-      if (live.canon.owner === LIFECYCLE_OWNER_ROLE || familyByName(live)) add(id, 'malformed lifecycle manifest');
-      continue;
-    }
-    const family = live.canon.owner === LIFECYCLE_OWNER_ROLE || (record(raw) && raw.everystack === 'lifecycle')
-      || familyByName(live);
-    if (!family) continue;
-    if (!record(raw) || raw.everystack !== 'lifecycle') { add(id, hint); continue; }
-    if (raw.v !== MANIFEST_VERSION) { add(id, `unsupported lifecycle manifest v${String(raw.v)}; this CLI emits v${MANIFEST_VERSION}; re-apply`); continue; }
-    if (raw.role === 'restrict' && typeof raw.model === 'string' && lifecycleTables.has(raw.model) && live.name === oldRestrictName(raw.model)) { add(id, OLD_RESTRICT); continue; }
-    if (typeof raw.model !== 'string' || !declaration(raw.decl) || typeof raw.role !== 'string' || !(LIFECYCLE_ROLES as readonly string[]).includes(raw.role)
-      || typeof raw.defHash !== 'string' || !/^[a-f0-9]{64}$/.test(raw.defHash) || !raw.decl.tables[raw.model]) { add(id, 'malformed lifecycle manifest'); continue; }
-    if (lifecycleRole(live.name, raw.model) !== raw.role) { add(id, 'manifest role does not match function name'); continue; }
-    const manifest = raw as unknown as LifecycleManifest;
-    manifests.set(id, manifest);
-    const prev = groups.get(manifest.model);
-    if (prev && JSON.stringify(prev.decl) !== JSON.stringify(manifest.decl)) add(id, `conflicting declarations for ${manifest.model}`);
-    else if (!prev) groups.set(manifest.model, { decl: manifest.decl, from: id });
-  }
-  for (const table of lifecycleTables) if (!groups.has(table)) add(table, hint);
-
-  const expectedFunctions = new Map<string, FunctionDescriptor>();
-  const expectedTriggers = new Map<string, TriggerCanon>();
-  for (const [model, { decl, from }] of groups) {
-    // The catalog is an independent input: a self-consistent comment and body cannot erase a unique index.
-    for (const [id, input] of Object.entries(decl.tables)) {
-      const actual = tableById.get(id);
-      if (!actual) { add(id, 'declared table missing from catalog'); continue; }
-      if (!same(strings(actual.pk_columns), [input.pk.column]) || !same(strings(actual.pk_types).map(typeIdentity), [typeIdentity(input.pk.type)])) add(id, 'primary key differs from catalog');
-      if (actual.unique !== input.unique) add(id, 'unique flag differs from catalog');
-      if (!sameDeleteRules(input.auth, actual.delete_policies)) add(id, 'delete rule in the manifest does not match the live policies');
-      for (const role of Object.keys(input.auth)) if (!governedRoles.includes(role)) notes.add(`ungoverned role ${role} in lifecycle manifest ${model}`);
-    }
-    for (const edge of decl.edges) {
-      const parent = tableById.get(edge.parent);
-      const child = decl.tables[edge.child] ?? (() => { const { schema, name: table } = parseQualified(edge.child); return { schema, table }; })();
-      if (!edges.some(actual => actual.parent === edge.parent && actual.child === `${child.schema}.${child.table}` && same(strings(actual.columns), [edge.column])
-        && same(strings(actual.references), strings(parent?.pk_columns)) && actual.action === 'r')) add(`${edge.child}.${edge.column}`, 'foreign key differs from catalog');
-    }
-    let objects;
-    try { objects = regenerateLifecycle(model, decl); } catch { add(from, 'malformed declaration cannot regenerate'); continue; }
-    for (const object of objects) {
-      if (object.kind === 'function') expectedFunctions.set(canonOfFunction(object).identity, object);
-      else { const canon = canonOfTrigger(object); expectedTriggers.set(canon.identity, canon); }
-    }
-  }
-  for (const [id, expected] of expectedFunctions) {
-    const actual = liveFunctions.get(id);
-    if (!actual) { add(id, 'missing generated function'); continue; }
-    const manifest = manifests.get(id);
-    if (!manifest) { add(id, hint); continue; }
-    const liveHash = canonHash(actual.canon);
-    if (manifest.defHash !== liveHash) { add(id, 'drifted, live definition differs from its recorded hash'); continue; }
-    if (canonHash(canonOfFunction(expected)) !== liveHash) add(id, 'stale, re-apply');
-  }
-  for (const [id] of manifests) if (!expectedFunctions.has(id)) add(id, 'unlisted function in lifecycle family');
-  for (const [id, expected] of expectedTriggers) {
-    const actual = liveTriggers.get(id);
-    if (!actual) add(id, 'missing generated trigger');
-    else if (!same(expected, actual)) add(id, 'generated trigger differs from regeneration (a hand edit, or an older CLI): run db:apply to re-create it');
-  }
-  const functionNames = new Set([...expectedFunctions.values()].map(fn => fn.name));
-  for (const [id, actual] of liveTriggers) {
-    if (expectedTriggers.has(id)) continue;
-    const bare = actual.table.slice(actual.table.lastIndexOf('.') + 1);
-    if (lifecycleTables.has(actual.table) && id === `${actual.table}.${bare}_lifecycle_restrict` && actual.fn === oldRestrictName(actual.table)) { add(id, OLD_RESTRICT); continue; }
-    if (functionNames.has(actual.fn)) add(id, 'unmanaged lifecycle trigger binding');
-    else if (lifecycleTables.has(actual.table)) {
-      const type = triggerTypes.get(id)!;
-      if ((type & 32) !== 0) add(id, 'author TRUNCATE trigger refused: bypasses lifecycle row removal');
-      else if ((type & (2 | 8)) === (2 | 8)) add(id, 'author BEFORE DELETE trigger refused: can suppress purge DELETE');
-    }
-  }
-  return { failures: [...problems.values()].sort(), notes: [...notes].sort() };
-}