@everystack/cli 0.4.103 → 0.4.105

package/src/cli/lifecycle-pull.ts

@@ -2,9 +2,9 @@
  * db:pull's lifecycle fold — reads a lifecycle table back as `lifecycle: true`.
  *
  * `lifecycle: true` generates, per table: four columns, the reserved role's grants and policies,
- * a `deleted_at IS NULL` guard on every other role's SELECT policy, and two functions, a restore
- * function and two triggers. A pull that transcribed them would render the reserved role as an
- * authored ability and the columns as authored fields (defineModel refuses both), and the five
+ * a `deleted_at IS NULL` guard on every other role's SELECT policy, generated functions,
+ * and triggers. A pull that transcribed them would render the reserved role as an
+ * authored ability and the columns as authored fields (defineModel refuses both), and the generated
  * objects as derived descriptors (they would be generated twice).
  *
  * So the fold removes all of it from the pull's inputs, and the renderer writes `lifecycle: true`.
@@ -23,6 +23,7 @@ import type { AuthzContract, PolicyContract, TableContract } from './authz-contr
 import type { DerivedCatalog } from './derived-introspect';
 import { compileTableContract } from './authz-compile';
 import { lifecycleFkIndexName } from './schema-compile';
+import { functionIdentity } from './pg-argtypes';
 
 /** The generated columns as the catalog reports them (`format_type`), nullable, no default. */
 const GENERATED_COLUMNS: Record<string, string> = {
@@ -169,7 +170,7 @@ function foldContract(live: TableContract, table: TableSchema): TableContract |
 }
 
 /**
- * The five generated objects of one lifecycle table, exactly as the derived catalog keys them. The
+ * The generated objects of one lifecycle table, and the older CLI's retired restrict pair, exactly as the derived catalog keys them. The
  * restore takes the primary key, and a function signature carries no type modifier
  * (`character varying(255)` is `character varying` there). An author's own overload stays.
  */
@@ -180,11 +181,17 @@ function generatedIdentities(table: TableSchema): string[] {
   return [
     `${schema}.${name}_lifecycle_transition()`,
     `${schema}.${name}_lifecycle_guard()`,
+    `${schema}.${name}_lifecycle_destroy_before()`,
+    functionIdentity(schema, `${name}_lifecycle_destroy`, [`${arg}[]`, 'timestamptz', 'integer']),
     `${schema}.${name}_restore(${arg})`,
     `${table.table}.${name}_lifecycle_transition`,
     `${table.table}.${name}_lifecycle_guard`,
     `${schema}.${name}_lifecycle_delete_when()`,
     `${table.table}.${name}_lifecycle_delete_when`,
+    // CLI 0.4.101 also generated a per-row restrict pair. The transition carries that check now and
+    // db:apply removes the pair, so a stage built by 0.4.101 must not pull it back as authored code.
+    `${schema}.${name}_lifecycle_restrict()`,
+    `${table.table}.${name}_lifecycle_restrict`,
   ];
 }
 
@@ -203,6 +210,26 @@ function withoutGeneratedFkIndexes(t: TableSchema, lifecycleTables: ReadonlySet<
   return indexes.length === t.indexes.length ? t : { ...t, indexes };
 }
 
+/** Fold only the exact read capability generated for a plain restricting child. */
+function foldReferenceContract(live: TableContract, table: TableSchema, lifecycleTables: ReadonlySet<string>): TableContract | undefined {
+  const columns = [...new Set(table.foreignKeys.filter(fk =>
+    lifecycleTables.has(fk.refTable.includes('.') ? fk.refTable : `public.${fk.refTable}`)
+    && (!fk.onDelete || fk.onDelete === 'no action' || fk.onDelete === 'restrict')).flatMap(fk => fk.columns))].sort();
+  if (!columns.length) return undefined;
+  const role = LIFECYCLE_OWNER_ROLE;
+  const grants = live.columnGrants?.[role] ?? {};
+  if ((live.grants[role]?.length ?? 0) !== 0 || sorted(Object.keys(grants)) !== sorted(['SELECT']) || sorted(grants.SELECT) !== sorted(columns)) return undefined;
+  const expected: PolicyContract = { name: `${split(table.table).name}_select_${role}`, command: 'SELECT', roles: [role], permissive: true, using: 'true', check: null };
+  const ownPolicies = live.policies.filter(p => p.roles.includes(role));
+  if (ownPolicies.length !== 1 || policyKey(ownPolicies[0]) !== policyKey(expected)) return undefined;
+  if (live.effectivePrivileges && sorted(live.effectivePrivileges[role]) !== sorted(['SELECT'])) return undefined;
+  const { [role]: _grant, ...tableGrants } = live.grants;
+  const { [role]: _cols, ...columnGrants } = live.columnGrants ?? {};
+  const { [role]: _effective, ...effectivePrivileges } = live.effectivePrivileges ?? {};
+  return { ...live, grants: tableGrants, columnGrants, policies: live.policies.filter(p => p !== ownPolicies[0]),
+    ...(live.effectivePrivileges ? { effectivePrivileges } : {}) };
+}
+
 export function foldLifecycle(snapshot: SchemaSnapshot, contract: AuthzContract, catalog: DerivedCatalog): LifecycleFold {
   const tables = new Set<string>();
   const foldedContracts = new Map<string, TableContract>();
@@ -215,6 +242,12 @@ export function foldLifecycle(snapshot: SchemaSnapshot, contract: AuthzContract,
     foldedContracts.set(table.table, folded);
   }
   if (tables.size === 0) return { snapshot, contract, catalog, tables, deleteWhen: new Map() };
+  for (const table of snapshot.tables) {
+    if (tables.has(table.table)) continue;
+    const live = contract.tables.find(t => t.table === table.table);
+    const folded = live && foldReferenceContract(live, table, tables);
+    if (folded) foldedContracts.set(table.table, folded);
+  }
 
   // A guarded table's predicate is the delete_when function's manifest input. The pull must render
   // exactly that text, or the next plan would rebuild the guard; without it, refuse rather than drop

package/src/cli/model-render.ts

@@ -112,6 +112,8 @@ export interface RenderOptions {
   externalDerived?: ExternalDerived;
   /** Tables db:pull folded to `lifecycle: true` (lifecycle-pull.ts): rendered with that key, no softDelete line. */
   lifecycleTables?: ReadonlySet<string>;
+  /** Lifecycle children detected even when the default pull leaves their columns unfolded. */
+  lifecycleForeignKeyTables?: ReadonlySet<string>;
   /** lifecycle: { deleteWhen }'s predicate per folded table (lifecycle-pull.ts), rendered verbatim. */
   lifecycleDeleteWhen?: ReadonlyMap<string, string>;
 }
@@ -393,6 +395,48 @@ function knownSet(tables: Iterable<string>): Set<string> {
   return new Set([...tables].map(qualifiedName));
 }
 
+/** A key into a rendered lifecycle parent, declared on that parent as a hasMany dependent. */
+interface RenderedDependent { child: string; column: string; dependent: 'cascade' | 'restrict' | 'nullify' }
+const DEPENDENT_OF: Record<string, RenderedDependent['dependent']> = { cascade: 'cascade', 'set null': 'nullify', restrict: 'restrict' };
+
+/**
+ * Every one-column foreign key from a table rendered `lifecycle: true` into another, grouped by the
+ * parent: the parent declares each one as a dependent (a key into a lifecycle table with none is
+ * refused), read from the live ON DELETE: CASCADE -> 'cascade', SET NULL -> 'nullify', RESTRICT or
+ * NO ACTION -> 'restrict'. A plain table's key into one has no dependent (only a lifecycle table may
+ * hold one): it renders as it is, with a comment, and the model's own refusal names it. So do SET
+ * DEFAULT and composite keys.
+ */
+function lifecycleDependentsOf(tables: readonly TableSchema[], lifecycleTables: ReadonlySet<string> | undefined): Map<string, RenderedDependent[]> {
+  const out = new Map<string, RenderedDependent[]>();
+  const rendered = new Set([...(lifecycleTables ?? [])].map(qualifiedName));
+  const known = knownSet(tables.map((t) => t.table));
+  for (const table of tables) {
+    for (const fk of table.foreignKeys) {
+      const parent = qualifiedName(fk.refTable);
+      const dependent = DEPENDENT_OF[fk.onDelete ?? 'restrict'];
+      if (fk.columns.length !== 1 || !dependent || !rendered.has(parent) || !known.has(parent) || !rendered.has(qualifiedName(table.table))) continue;
+      out.set(parent, [...(out.get(parent) ?? []), { child: qualifiedName(table.table), column: fk.columns[0], dependent }]);
+    }
+  }
+  return out;
+}
+
+/** The parent's `relations: { … }` stanza for its dependents ('' when none). Thunks, like `.references()`: a pulled barrel is not linked. */
+function dependentsStanza(table: TableSchema, dependents: readonly RenderedDependent[]): string {
+  if (dependents.length === 0) return '';
+  const fieldKeys = new Set(table.columns.map((c) => toCamelCase(c.name)));
+  const base = (d: RenderedDependent): string => toCamelCase(schemaOf(d.child) === 'public' ? bareName(d.child) : `${schemaOf(d.child)}_${bareName(d.child)}`);
+  const lines = [...dependents].sort((a, b) => (`${a.child}\u0000${a.column}` < `${b.child}\u0000${b.column}` ? -1 : 1)).map((d) => {
+    const field = toCamelCase(d.column);
+    const plain = base(d);
+    const shared = dependents.filter((o) => base(o) === plain).length > 1 || fieldKeys.has(plain);
+    const key = shared ? `${plain}By${field[0].toUpperCase()}${field.slice(1)}` : plain;
+    return `    ${safeKey(key, `the relation for ${liveObject('table', d.child)}`)}: hasMany(() => ${modelVarName(d.child)}, ${tsLiteral(field)}, { dependent: ${tsLiteral(d.dependent)} }),`;
+  });
+  return `\n  relations: {\n${lines.join('\n')}\n  },`;
+}
+
 /**
  * A table name → its model variable: PascalCase, naively singularized (one trailing
  * `s` strips, whatever the word). `image_variants` → `ImageVariant`.
@@ -425,7 +469,7 @@ export function modelVarName(table: string): string {
  * phantom rename for every digit-boundary column and COLLIDED distinct columns
  * (`a_1` and `a1`) onto one key.
  */
-function toCamelCase(name: string): string {
+export function toCamelCase(name: string): string {
   return name.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
 }
 
@@ -794,7 +838,17 @@ function renderConstraintsBlock(table: TableSchema, checks: CheckConstraint[], k
 }
 
 /** One `export const X = defineModel(...)` block for a table. */
-export function renderModelBlock(table: TableSchema, known: Set<string>, enums: Map<string, string[]> = new Map(), abilities = 'commented', liveAuthz?: Map<string, TableContract>, governRoles?: ReadonlySet<string>, fkTargets?: FkTargets, lifecycle: boolean | string = false): string {
+export function renderModelBlock(table: TableSchema, known: Set<string>, enums: Map<string, string[]> = new Map(), abilities = 'commented', liveAuthz?: Map<string, TableContract>, governRoles?: ReadonlySet<string>, fkTargets?: FkTargets, lifecycle: boolean | string = false, lifecycleForeignKeys = Boolean(lifecycle), dependents: ReadonlyMap<string, readonly RenderedDependent[]> = new Map(), lifecycleTables: ReadonlySet<string> = new Set()): string {
+  const self = qualifiedName(table.table);
+  const asParent = dependents.get(self) ?? [];
+  // A key a lifecycle parent declares as a dependent carries no onDelete of its own: the dependent derives it.
+  const declared = new Set([...dependents.values()].flat().filter((d) => d.child === self).map((d) => d.column));
+  // Copy for rendering only; the raw catalog still owns the adoption fingerprint.
+  if (declared.size) table = { ...table, foreignKeys: table.foreignKeys.map(fk =>
+    fk.columns.length === 1 && declared.has(fk.columns[0]) ? { ...fk, onDelete: undefined } : fk) };
+  // A pull cannot infer the parent relation that makes any other lifecycle cascade legal.
+  if (lifecycleForeignKeys) table = { ...table, foreignKeys: table.foreignKeys.map(fk =>
+    fk.onDelete === 'cascade' ? { ...fk, onDelete: 'restrict' } : fk) };
   // A CHECK that reverses to a single field's .validate() is rendered on the field (ergonomic);
   // the rest stay table-level check(). Both round-trip — this only chooses the nicer form.
   const validates = new Map<string, string>();
@@ -813,7 +867,13 @@ export function renderModelBlock(table: TableSchema, known: Set<string>, enums:
   }
 
   const pulled = knownSet(known);
-  const fields = table.columns.map((c) => renderField(table, c, pulled, enums, validates, fkTargets)).join('\n');
+  // A plain table's key into a table rendered lifecycle: the models refuse it; say why and the fix.
+  const intoLifecycle = new Set(lifecycle ? [] : table.foreignKeys
+    .filter((fk) => fk.columns.length === 1 && lifecycleTables.has(qualifiedName(fk.refTable)))
+    .map((fk) => fk.columns[0]));
+  const fields = table.columns.map((c) => (intoLifecycle.has(c.name)
+    ? `    // ${commentText(`${c.name} references a lifecycle table, and only a lifecycle table may hold a key into one: make this model lifecycle: true (and declare the dependent on the parent), or refer to it by value (drop .references())`)}\n`
+    : '') + renderField(table, c, pulled, enums, validates, fkTargets)).join('\n');
   const constraints = renderConstraintsBlock(table, tableChecks, pulled, fkTargets);
   // The authz decision renders FIRST — before fields — because it is the first thing a
   // reviewer must resolve about a model (and where the field-report consumer's codemod
@@ -834,7 +894,7 @@ export function renderModelBlock(table: TableSchema, known: Set<string>, enums:
   // already uses for defineMaterializedTable.
   const owner = schemaOf(table.table);
   const schemaProp = owner === 'public' ? '' : `  schema: ${tsLiteral(owner)},\n`;
-  return `export const ${modelVarName(table.table)} = defineModel(${tsLiteral(bareName(table.table))}, {\n${stanza.text}\n${schemaProp}${writtenBy}${softDelete}  fields: {\n${fields}\n  },${constraints}\n});`;
+  return `export const ${modelVarName(table.table)} = defineModel(${tsLiteral(bareName(table.table))}, {\n${stanza.text}\n${schemaProp}${writtenBy}${softDelete}  fields: {\n${fields}\n  },${constraints}${dependentsStanza(table, asParent)}\n});`;
 }
 
 /** The `import` lines a rendered body needs — only what it actually uses, so the file reads clean. */
@@ -847,6 +907,7 @@ function importHeader(body: string, extra: string[] = []): string {
   if (/\bcheck\(/.test(body)) symbols.push('check');
   if (/\bindex\(/.test(body)) symbols.push('index');
   if (/\bforeignKey\(/.test(body)) symbols.push('foreignKey');
+  if (/\bhasMany\(/.test(body)) symbols.push('hasMany');
   if (/\bdefineModule\(/.test(body)) symbols.push('defineModule');
   if (/\bsql`/.test(body)) symbols.push('sql');
   for (const s of extra) if (!symbols.includes(s)) symbols.push(s);
@@ -951,7 +1012,9 @@ export function renderModelSource(snapshot: SchemaSnapshot, opts: RenderOptions
   const known = knownSet(tables.map((t) => t.table));
   const enums = new Map((snapshot.enums ?? []).map((e) => [e.name, e.values]));
 
-  const blocks = tables.map((t) => renderModelBlock(t, known, enums, opts.abilities ?? 'commented', opts.liveAuthz, opts.governRoles && new Set(opts.governRoles), opts.fkTargets, opts.lifecycleDeleteWhen?.get(t.table) ?? opts.lifecycleTables?.has(t.table)));
+  const dependents = lifecycleDependentsOf(tables, opts.lifecycleTables);
+  const rendered = new Set([...(opts.lifecycleTables ?? [])].map(qualifiedName));
+  const blocks = tables.map((t) => renderModelBlock(t, known, enums, opts.abilities ?? 'commented', opts.liveAuthz, opts.governRoles && new Set(opts.governRoles), opts.fkTargets, opts.lifecycleDeleteWhen?.get(t.table) ?? opts.lifecycleTables?.has(t.table), opts.lifecycleForeignKeyTables?.has(t.table) || opts.lifecycleTables?.has(t.table), dependents, rendered));
   // The derived layer (B5): sequences + views/matviews/functions, after the models they
   // reference, before the module wrapper that composes all three.
   if (opts.derived?.block) blocks.push(opts.derived.block);
@@ -1027,9 +1090,12 @@ export function renderModelFiles(snapshot: SchemaSnapshot, opts: RenderOptions =
   const known = knownSet(tables.map((t) => t.table));
   const enums = new Map((snapshot.enums ?? []).map((e) => [e.name, e.values]));
 
+  const dependents = lifecycleDependentsOf(tables, opts.lifecycleTables);
+  const rendered = new Set([...(opts.lifecycleTables ?? [])].map(qualifiedName));
   const files: RenderedModelFile[] = tables.map((t) => {
-    const block = renderModelBlock(t, known, enums, opts.abilities ?? 'commented', opts.liveAuthz, opts.governRoles && new Set(opts.governRoles), opts.fkTargets, opts.lifecycleDeleteWhen?.get(t.table) ?? opts.lifecycleTables?.has(t.table));
-    const crossImports = referencedTables(t, known).map(
+    const block = renderModelBlock(t, known, enums, opts.abilities ?? 'commented', opts.liveAuthz, opts.governRoles && new Set(opts.governRoles), opts.fkTargets, opts.lifecycleDeleteWhen?.get(t.table) ?? opts.lifecycleTables?.has(t.table), opts.lifecycleForeignKeyTables?.has(t.table) || opts.lifecycleTables?.has(t.table), dependents, rendered);
+    const children = (dependents.get(qualifiedName(t.table)) ?? []).map((d) => d.child).filter((c) => c !== qualifiedName(t.table));
+    const crossImports = [...new Set([...referencedTables(t, known), ...children])].sort().map(
       (target) => `import { ${modelVarName(target)} } from '${modelImportPath(target)}';`,
     );
     const header = [importHeader(block), ...crossImports].join('\n');

package/src/cli/schema-compile.ts

@@ -21,7 +21,7 @@
 
 import { createHash } from 'node:crypto';
 import type { ModelDescriptor, FieldSpec, SequenceDescriptor, DependentActions, DependentIndexes } from '@everystack/model';
-import { positionalCheckName } from '@everystack/model';
+import { pgType, positionalCheckName } from '@everystack/model';
 import type { TableSchema, EnumType, SequenceSchema, UniqueConstraint, CheckConstraint, IndexSchema, ForeignKey } from './schema-introspect';
 import { nextvalSequence, identityClause, primaryKeyConstraintName, type RenameMap } from './schema-diff';
 import { normalizeDeparsedExpr } from './deparse-normal';
@@ -154,69 +154,8 @@ export function modelConstraintSpecs(model: ModelDescriptor): { uniques: UniqueC
   return { uniques, checks, indexes };
 }
 
-/**
- * Postgres type for a field, with the precision drizzle-kit would emit — in
- * `format_type`'s vocabulary, because this feeds the IR that diffs against
- * introspection. A serial field's *column type* is integer/bigint (`serial` is
- * DDL shorthand, not a type — `format_type` never reports it); the sequence
- * default is carried separately (see compileTableSchema), and the DDL renderers
- * spell the shorthand (see SERIAL_DDL).
- */
-const PG_TYPE: Record<string, string> = {
-  text: 'text',
-  uuid: 'uuid',
-  integer: 'integer',
-  boolean: 'boolean',
-  json: 'json',
-  jsonb: 'jsonb',
-  bigint: 'bigint',
-  serial: 'integer',
-  bigserial: 'bigint',
-  real: 'real',
-  doublePrecision: 'double precision',
-  timestamptz: 'timestamp with time zone',
-  // `format_type` canonicalizes a bare `timestamp` column to this spelling, and
-  // introspection compares against it — so the compiler must emit the same, or an
-  // unchanged `timestamp` column round-trips to a spurious ALTER COLUMN TYPE.
-  timestamp: 'timestamp without time zone',
-  date: 'date',
-};
-
-export function pgType(spec: FieldSpec): string {
-  // An array is the base type with `[]` appended — `text` → `text[]`, exactly as
-  // `format_type` spells it.
-  return spec.isArray ? `${scalarPgType(spec)}[]` : scalarPgType(spec);
-}
-
-function scalarPgType(spec: FieldSpec): string {
-  // Parameterized types build their own canonical string — exactly as `format_type`
-  // spells it (no space after the comma; `varchar` is `character varying`; a
-  // precision-only numeric carries scale 0), so an unchanged column round-trips clean.
-  if (spec.type === 'numeric') {
-    if (spec.precision != null) return `numeric(${spec.precision},${spec.scale ?? 0})`;
-    return 'numeric';
-  }
-  if (spec.type === 'varchar') {
-    return spec.length != null ? `character varying(${spec.length})` : 'character varying';
-  }
-  if (spec.type === 'enum') {
-    // The column's type is the enum's own type name; `format_type` reports the same bare
-    // name, so it round-trips. The `CREATE TYPE` is emitted separately, before the table.
-    if (!spec.enumName) throw new Error('field bridge: an enum field needs a type name — field.enum(name, values)');
-    return spec.enumName;
-  }
-  if (spec.type === 'pgType') {
-    // A verbatim type: the declared string IS the canonical `format_type` spelling
-    // (the factory refused anything else), so it round-trips byte-for-byte.
-    if (!spec.pgTypeName) throw new Error('field bridge: a pgType field needs its type name — field.pgType(name)');
-    return spec.pgTypeName;
-  }
-  const t = PG_TYPE[spec.type];
-  if (!t) {
-    throw new Error(`field bridge: no DDL mapping for field type '${spec.type}' yet`);
-  }
-  return t;
-}
+// Shared with the runtime destroy wrapper: casts and generated signatures must agree.
+export { pgType } from '@everystack/model';
 
 /**
  * The FK referential actions declared on a field or a table-level `foreignKey(...)`, dropping

package/src/cli/state-function-deps.ts

@@ -158,7 +158,7 @@ export async function createStateReferencedFunctions(
   session: SessionRunner,
   statements: readonly string[],
   declared: readonly SourceObject[],
-  options: { actor?: string | null; gitRef?: string | null; now?: () => number } = {},
+  options: { actor?: string | null; gitRef?: string | null; now?: () => number; lifecyclePreflighted?: boolean } = {},
 ): Promise<string[]> {
   const referenced = stateReferencedFunctions(statements, declared);
   if (referenced.length === 0) return [];
@@ -184,6 +184,7 @@ export async function createStateReferencedFunctions(
     actor: options.actor ?? null,
     gitRef: options.gitRef ?? null,
     now: options.now,
+    lifecyclePreflighted: options.lifecyclePreflighted,
   });
   if (run.refusal) {
     throw new Error(`could not create the functions the state batch calls (${missing.map((o) => o.identity).join(', ')}) before it: ${run.refusal}`);

package/src/cli/lifecycle-verify.ts

@@ -1,238 +0,0 @@
-/** Fail-closed verification of generated lifecycle definitions before db:pull writes. */
-import { LIFECYCLE_OWNER_ROLE, parseQualified, type FunctionDescriptor } from '@everystack/model';
-import { canonHash, canonOfFunction, type FunctionCanon } from './lifecycle-canon';
-import { regenerateLifecycle, lifecycleRole, MANIFEST_VERSION, LIFECYCLE_ROLES, type LifecycleDeclaration, type LifecycleManifest, type LifecycleTrigger } from './lifecycle-derived';
-import { normalizeArgType } from './pg-argtypes';
-import { parseTriggerType } from './derived-introspect';
-import { normalizeDeparsedExpr } from './deparse-normal';
-import { INTROSPECTION_SESSION, type SessionRunner } from './session';
-
-const FUNCTIONS = `SELECT n.nspname AS schema, p.proname AS name,
- n.nspname || '.' || p.proname || '(' || coalesce((SELECT string_agg(format_type(t, NULL), ', ' ORDER BY o) FROM unnest(p.proargtypes::oid[]) WITH ORDINALITY x(t,o)), '') || ')' AS identity,
- ARRAY(SELECT format_type(t,NULL) FROM unnest(p.proargtypes::oid[]) WITH ORDINALITY x(t,o) ORDER BY o) AS arg_types,
- pg_get_function_arguments(p.oid) AS args, pg_get_function_result(p.oid) AS returns,
- l.lanname AS language,p.prosecdef AS secdef,p.provolatile::text AS volatility,p.proisstrict AS strict,p.proleakproof AS leakproof,
- coalesce(p.proconfig,'{}'::text[]) AS config,pg_get_userbyid(p.proowner) AS owner,p.prosrc AS body,obj_description(p.oid,'pg_proc') AS comment,
- coalesce((SELECT array_agg(DISTINCT coalesce(g.rolname,'PUBLIC') ORDER BY coalesce(g.rolname,'PUBLIC'))
-  FROM aclexplode(coalesce(p.proacl,acldefault('f',p.proowner))) a LEFT JOIN pg_roles g ON g.oid=a.grantee
-  WHERE a.grantee<>p.proowner AND a.privilege_type='EXECUTE'),'{}'::name[])::text[] AS execute
- FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace JOIN pg_language l ON l.oid=p.prolang
- WHERE p.prokind IN ('f','p') AND n.nspname NOT IN ('pg_catalog','information_schema') AND n.nspname NOT LIKE 'pg_%'
- AND NOT EXISTS(SELECT 1 FROM pg_depend d WHERE d.objid=p.oid AND d.deptype='e')`;
-const TRIGGERS = `SELECT n.nspname||'.'||c.relname AS "table",t.tgname AS name,t.tgtype::int AS type,t.tgenabled::text AS enabled,
- t.tgconstraint<>0 AS is_constraint,t.tgdeferrable AS deferrable,t.tginitdeferred AS initially_deferred,
- fn.nspname||'.'||p.proname AS fn,substring(pg_get_triggerdef(t.oid) from ' WHEN [(](.*)[)] EXECUTE ') AS when_expr,
- coalesce((SELECT array_agg(a.attname::text ORDER BY x.ord) FROM unnest(t.tgattr::int2[]) WITH ORDINALITY x(attnum,ord)
- JOIN pg_attribute a ON a.attrelid=t.tgrelid AND a.attnum=x.attnum),'{}'::text[]) AS update_of,encode(t.tgargs,'hex') AS args
- FROM pg_trigger t JOIN pg_class c ON c.oid=t.tgrelid JOIN pg_namespace n ON n.oid=c.relnamespace
- JOIN pg_proc p ON p.oid=t.tgfoid JOIN pg_namespace fn ON fn.oid=p.pronamespace
- WHERE NOT t.tgisinternal AND n.nspname NOT IN ('pg_catalog','information_schema') AND n.nspname NOT LIKE 'pg_%'`;
-const TABLES = `SELECT n.nspname||'.'||c.relname AS identity,
- coalesce((SELECT jsonb_agg(jsonb_build_object('role',coalesce(r.rolname,'PUBLIC'),
- 'predicate',coalesce(pg_get_expr(p.polqual,p.polrelid),'true'),'permissive',p.polpermissive) ORDER BY p.polname,r.rolname)
- FROM pg_policy p CROSS JOIN LATERAL unnest(p.polroles) role(oid) LEFT JOIN pg_roles r ON r.oid=role.oid
- WHERE p.polrelid=c.oid AND p.polcmd IN ('d','*') AND r.rolname IS DISTINCT FROM 'everystack_lifecycle'),'[]'::jsonb) AS delete_policies,
- ARRAY(SELECT a.attname::text FROM unnest(k.conkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=x.num ORDER BY x.ord) AS pk_columns,
- ARRAY(SELECT format_type(a.atttypid,a.atttypmod) FROM unnest(k.conkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=x.num ORDER BY x.ord) AS pk_types,
- EXISTS(SELECT 1 FROM pg_index i WHERE i.indrelid=c.oid AND i.indisunique AND NOT i.indisprimary) AS unique,
- ((SELECT count(*)=4 FROM pg_attribute a WHERE a.attrelid=c.oid AND NOT a.attisdropped AND a.attname IN ('deleted_at','deleted_by','deleted_batch','deleted_xid'))
- AND EXISTS(SELECT 1 FROM aclexplode(coalesce(c.relacl,acldefault('r',c.relowner))) a JOIN pg_roles r ON r.oid=a.grantee
- WHERE r.rolname='everystack_lifecycle' AND a.privilege_type='DELETE')) AS lifecycle
- FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace LEFT JOIN pg_constraint k ON k.conrelid=c.oid AND k.contype='p'
- WHERE c.relkind IN ('r','p') AND n.nspname NOT IN ('pg_catalog','information_schema') AND n.nspname NOT LIKE 'pg_%'`;
-const EDGES = `SELECT pn.nspname||'.'||p.relname AS parent,cn.nspname||'.'||c.relname AS child,
- ARRAY(SELECT a.attname::text FROM unnest(f.conkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=x.num ORDER BY x.ord) AS columns,
- ARRAY(SELECT a.attname::text FROM unnest(f.confkey) WITH ORDINALITY x(num,ord) JOIN pg_attribute a ON a.attrelid=p.oid AND a.attnum=x.num ORDER BY x.ord) AS references,
- f.confdeltype::text AS action FROM pg_constraint f JOIN pg_class c ON c.oid=f.conrelid JOIN pg_namespace cn ON cn.oid=c.relnamespace
- JOIN pg_class p ON p.oid=f.confrelid JOIN pg_namespace pn ON pn.oid=p.relnamespace WHERE f.contype='f'`;
-
-type Row = Record<string, unknown>;
-const record = (value: unknown): value is Row => value !== null && typeof value === 'object' && !Array.isArray(value);
-const strings = (value: unknown): string[] => Array.isArray(value) ? value.map(String) : [];
-const same = (a: unknown, b: unknown): boolean => canonHash(a) === canonHash(b);
-const hint = 'missing lifecycle manifest; db:apply for a managed install; db:reconcile --baseline for a brownfield object with no provenance (use --apply to persist)';
-
-interface TriggerCanon { kind: 'trigger'; identity: string; table: string; timing: string; events: string[]; forEach: string; fn: string; when: string | null; updateOf: string[]; args: string; enabled: string; constraint: boolean; deferrable: boolean; initiallyDeferred: boolean; }
-interface LiveFunction { name: string; argTypes: string[]; canon: FunctionCanon; comment: unknown; }
-export interface LifecycleVerdict { failures: string[]; notes: string[]; }
-export class LifecycleDriftError extends Error {
-  constructor(readonly lines: string[]) { super('lifecycle verification failed'); }
-}
-
-/** Only the two fixed generated WHEN expressions need catalog spelling normalization. */
-/** A trigger WHEN, normalised so the generated text and PostgreSQL's deparse compare equal. Exported for tests. */
-export function whenExpression(value: string | null): string | null {
-  if (value === null) return null;
-  const text = value.replace(new RegExp(`'${LIFECYCLE_OWNER_ROLE}'::name`, 'g'), `'${LIFECYCLE_OWNER_ROLE}'`);
-  const tokens = text.match(/'(?:[^']|'')*'|"(?:[^"]|"")*"|[^'"]+/g) ?? [];
-  return tokens.map(token => {
-    if (token.startsWith("'")) return token;
-    if (token.startsWith('"')) return token === '"deleted_at"' ? 'deleted_at' : token;
-    // PostgreSQL deparses a pg_catalog function unqualified; the generator writes it qualified.
-    // Drop only a WHOLE `pg_catalog.` qualifier, on the raw token (before spaces go, or `OR pg_catalog.`
-    // would fuse into `orpg_catalog.`): not after a name character, a dot or a quote, so
-    // `ppg_catalog.g_trigger_depth` and `x.pg_catalog.f` keep their text and show as drift.
-    return token.replace(/(?<![A-Za-z0-9_$."])pg_catalog\./gi, '').replace(/[()\s]/g, '').toLowerCase();
-  }).join('');
-}
-function canonOfTrigger(trigger: LifecycleTrigger): TriggerCanon {
-  return { kind: 'trigger', identity: `${trigger.on.schema}.${trigger.on.table}.${trigger.name}`, table: `${trigger.on.schema}.${trigger.on.table}`, timing: trigger.timing,
-    events: trigger.events, forEach: trigger.forEach, fn: trigger.execute.name, when: whenExpression(trigger.condition ?? null),
-    updateOf: trigger.of ?? [], args: '', enabled: 'O', constraint: false, deferrable: false, initiallyDeferred: false };
-}
-function typeIdentity(type: string): string {
-  return normalizeArgType(type) + '|' + (type.match(/\([^)]*\)/g) ?? []).join('').replace(/\s+/g, '');
-}
-function declaration(value: unknown): value is LifecycleDeclaration {
-  if (!record(value) || !record(value.tables) || !Array.isArray(value.edges)) return false;
-  for (const [id, table] of Object.entries(value.tables)) {
-    if (!record(table) || typeof table.schema !== 'string' || typeof table.table !== 'string' || id !== `${table.schema}.${table.table}`
-      || !record(table.pk) || typeof table.pk.column !== 'string' || typeof table.pk.type !== 'string'
-      || typeof table.unique !== 'boolean' || !record(table.auth) || Object.values(table.auth).some(p => typeof p !== 'string')) return false;
-  }
-  return value.edges.every(edge => record(edge) && typeof edge.parent === 'string' && typeof edge.child === 'string'
-    && typeof edge.column === 'string' && (edge.dependent === 'cascade' || edge.dependent === 'restrict'));
-}
-
-/** Fold catalog policies by role exactly as the compiler records DELETE/ALL rules. */
-function sameDeleteRules(auth: Record<string, string>, policies: unknown): boolean {
-  if (!Array.isArray(policies)) return false;
-  const byRole = new Map<string, string[]>();
-  for (const policy of policies) {
-    if (!record(policy) || typeof policy.role !== 'string' || typeof policy.predicate !== 'string' || policy.permissive !== true) return false;
-    const predicates = byRole.get(policy.role) ?? [];
-    predicates.push(normalizeDeparsedExpr(policy.predicate));
-    byRole.set(policy.role, predicates);
-  }
-  const live = Object.fromEntries([...byRole].map(([role, predicates]) => [role,
-    predicates.length === 1 ? predicates[0] : predicates.map(p => `(${p})`).join(' OR ')]));
-  const declared = Object.fromEntries(Object.entries(auth).map(([role, predicate]) => [role, normalizeDeparsedExpr(predicate)]));
-  return same(declared, live);
-}
-
-/**
- * An older CLI generated a per-row `<t>_lifecycle_restrict` function (manifest role 'restrict') and
- * BEFORE DELETE trigger; the restrict check now lives in the transition. That pair is stale output,
- * not a malformed manifest or an author trigger: say so, and name the remedy.
- */
-const OLD_RESTRICT = 'stale, generated by an older CLI: run db:apply to remove the old restrict function and trigger';
-const oldRestrictName = (table: string): string => `${table}_lifecycle_restrict`;
-
-/** Four catalog reads share one read-only snapshot. No function bodies or generated SQL execute. */
-export async function verifyLifecycle(session: SessionRunner, governedRoles: readonly string[] = ['anon', 'authenticated', 'admin', LIFECYCLE_OWNER_ROLE]): Promise<LifecycleVerdict> {
-  const results = await session([FUNCTIONS, TRIGGERS, TABLES, EDGES], INTROSPECTION_SESSION);
-  if (results.length !== 4 || results.some(rows => !Array.isArray(rows))) throw new Error('lifecycle catalog could not be read completely');
-  const [functions, triggers, tables, edges] = results as Row[][];
-  const problems = new Map<string, string>();
-  const add = (id: string, reason: string): void => { if (!problems.has(id)) problems.set(id, `drift: ${id}: ${reason}`); };
-  const notes = new Set<string>();
-  const tableById = new Map(tables.map(t => [String(t.identity), t]));
-  const lifecycleTables = new Set(tables.filter(t => t.lifecycle === true).map(t => String(t.identity)));
-  const liveFunctions = new Map<string, LiveFunction>();
-  for (const row of functions) {
-    const canon: FunctionCanon = { kind: 'function', identity: String(row.identity), args: String(row.args), returns: String(row.returns),
-      language: String(row.language), secdef: row.secdef === true, volatility: String(row.volatility), strict: row.strict === true, leakproof: row.leakproof === true,
-      config: strings(row.config), owner: String(row.owner), execute: strings(row.execute).sort(), body: String(row.body) };
-    liveFunctions.set(canon.identity, { name: `${row.schema}.${row.name}`, canon, argTypes: strings(row.arg_types), comment: row.comment });
-  }
-  const liveTriggers = new Map<string, TriggerCanon>();
-  const triggerTypes = new Map<string, number>();
-  for (const row of triggers) {
-    const shape = parseTriggerType(Number(row.type));
-    const canon: TriggerCanon = { kind: 'trigger', identity: `${row.table}.${row.name}`, table: String(row.table), timing: shape.timing, events: shape.events, forEach: shape.forEach,
-      fn: String(row.fn), when: whenExpression(row.when_expr == null ? null : String(row.when_expr)), updateOf: strings(row.update_of), args: String(row.args), enabled: String(row.enabled),
-      constraint: row.is_constraint === true, deferrable: row.deferrable === true, initiallyDeferred: row.initially_deferred === true };
-    liveTriggers.set(canon.identity, canon);
-    triggerTypes.set(canon.identity, Number(row.type));
-  }
-  const familyByName = (live: LiveFunction): boolean => [...lifecycleTables].some(model => {
-    if (live.name.startsWith(`${model}_lifecycle_`)) return true;
-    const pkTypes = strings(tableById.get(model)?.pk_types);
-    return live.name === `${model}_restore` && live.argTypes.length === 1 && pkTypes.length === 1
-      && normalizeArgType(live.argTypes[0]) === normalizeArgType(pkTypes[0]);
-  });
-  const manifests = new Map<string, LifecycleManifest>();
-  /** lifecycle: { deleteWhen }'s predicate per model, from its delete_when function's own manifest. */
-  const deleteWhenOf = new Map<string, string>();
-  const groups = new Map<string, { decl: LifecycleDeclaration; from: string }>();
-  for (const [id, live] of liveFunctions) {
-    let raw: unknown;
-    try { raw = typeof live.comment === 'string' ? JSON.parse(live.comment) : undefined; } catch {
-      if (live.canon.owner === LIFECYCLE_OWNER_ROLE || familyByName(live)) add(id, 'malformed lifecycle manifest');
-      continue;
-    }
-    const family = live.canon.owner === LIFECYCLE_OWNER_ROLE || (record(raw) && raw.everystack === 'lifecycle')
-      || familyByName(live);
-    if (!family) continue;
-    if (!record(raw) || raw.everystack !== 'lifecycle') { add(id, hint); continue; }
-    if (raw.v !== MANIFEST_VERSION) { add(id, `unsupported lifecycle manifest v${String(raw.v)}; this CLI emits v${MANIFEST_VERSION}; re-apply`); continue; }
-    if (raw.role === 'restrict' && typeof raw.model === 'string' && lifecycleTables.has(raw.model) && live.name === oldRestrictName(raw.model)) { add(id, OLD_RESTRICT); continue; }
-    if (typeof raw.model !== 'string' || !declaration(raw.decl) || typeof raw.role !== 'string' || !(LIFECYCLE_ROLES as readonly string[]).includes(raw.role)
-      || typeof raw.defHash !== 'string' || !/^[a-f0-9]{64}$/.test(raw.defHash) || !raw.decl.tables[raw.model]) { add(id, 'malformed lifecycle manifest'); continue; }
-    if (lifecycleRole(live.name, raw.model) !== raw.role) { add(id, 'manifest role does not match function name'); continue; }
-    const manifest = raw as unknown as LifecycleManifest;
-    if (manifest.role === 'delete_when') {
-      if (typeof manifest.deleteWhen !== 'string' || manifest.deleteWhen.trim() === '') { add(id, 'malformed lifecycle manifest'); continue; }
-      deleteWhenOf.set(manifest.model, manifest.deleteWhen);
-    }
-    manifests.set(id, manifest);
-    const prev = groups.get(manifest.model);
-    if (prev && JSON.stringify(prev.decl) !== JSON.stringify(manifest.decl)) add(id, `conflicting declarations for ${manifest.model}`);
-    else if (!prev) groups.set(manifest.model, { decl: manifest.decl, from: id });
-  }
-  for (const table of lifecycleTables) if (!groups.has(table)) add(table, hint);
-
-  const expectedFunctions = new Map<string, FunctionDescriptor>();
-  const expectedTriggers = new Map<string, TriggerCanon>();
-  for (const [model, { decl, from }] of groups) {
-    // The catalog is an independent input: a self-consistent comment and body cannot erase a unique index.
-    for (const [id, input] of Object.entries(decl.tables)) {
-      const actual = tableById.get(id);
-      if (!actual) { add(id, 'declared table missing from catalog'); continue; }
-      if (!same(strings(actual.pk_columns), [input.pk.column]) || !same(strings(actual.pk_types).map(typeIdentity), [typeIdentity(input.pk.type)])) add(id, 'primary key differs from catalog');
-      if (actual.unique !== input.unique) add(id, 'unique flag differs from catalog');
-      if (!sameDeleteRules(input.auth, actual.delete_policies)) add(id, 'delete rule in the manifest does not match the live policies');
-      for (const role of Object.keys(input.auth)) if (!governedRoles.includes(role)) notes.add(`ungoverned role ${role} in lifecycle manifest ${model}`);
-    }
-    for (const edge of decl.edges) {
-      const parent = tableById.get(edge.parent);
-      const child = decl.tables[edge.child] ?? (() => { const { schema, name: table } = parseQualified(edge.child); return { schema, table }; })();
-      if (!edges.some(actual => actual.parent === edge.parent && actual.child === `${child.schema}.${child.table}` && same(strings(actual.columns), [edge.column])
-        && same(strings(actual.references), strings(parent?.pk_columns)) && actual.action === 'r')) add(`${edge.child}.${edge.column}`, 'foreign key differs from catalog');
-    }
-    let objects;
-    try { objects = regenerateLifecycle(model, decl, deleteWhenOf.get(model)); } catch { add(from, 'malformed declaration cannot regenerate'); continue; }
-    for (const object of objects) {
-      if (object.kind === 'function') expectedFunctions.set(canonOfFunction(object).identity, object);
-      else { const canon = canonOfTrigger(object); expectedTriggers.set(canon.identity, canon); }
-    }
-  }
-  for (const [id, expected] of expectedFunctions) {
-    const actual = liveFunctions.get(id);
-    if (!actual) { add(id, 'missing generated function'); continue; }
-    const manifest = manifests.get(id);
-    if (!manifest) { add(id, hint); continue; }
-    const liveHash = canonHash(actual.canon);
-    if (manifest.defHash !== liveHash) { add(id, 'drifted, live definition differs from its recorded hash'); continue; }
-    if (canonHash(canonOfFunction(expected)) !== liveHash) add(id, 'stale, re-apply');
-  }
-  for (const [id] of manifests) if (!expectedFunctions.has(id)) add(id, 'unlisted function in lifecycle family');
-  for (const [id, expected] of expectedTriggers) {
-    const actual = liveTriggers.get(id);
-    if (!actual) add(id, 'missing generated trigger');
-    else if (!same(expected, actual)) add(id, 'generated trigger differs from regeneration (a hand edit, or an older CLI): run db:apply to re-create it');
-  }
-  const functionNames = new Set([...expectedFunctions.values()].map(fn => fn.name));
-  for (const [id, actual] of liveTriggers) {
-    if (expectedTriggers.has(id)) continue;
-    const bare = actual.table.slice(actual.table.lastIndexOf('.') + 1);
-    if (lifecycleTables.has(actual.table) && id === `${actual.table}.${bare}_lifecycle_restrict` && actual.fn === oldRestrictName(actual.table)) { add(id, OLD_RESTRICT); continue; }
-    if (functionNames.has(actual.fn)) add(id, 'unmanaged lifecycle trigger binding');
-    else if (lifecycleTables.has(actual.table)) {
-      const type = triggerTypes.get(id)!;
-      if ((type & 32) !== 0) add(id, 'author TRUNCATE trigger refused: bypasses lifecycle row removal');
-      else if ((type & (2 | 8)) === (2 | 8)) add(id, 'author BEFORE DELETE trigger refused: can suppress purge DELETE');
-    }
-  }
-  return { failures: [...problems.values()].sort(), notes: [...notes].sort() };
-}