@everystack/cli 0.4.105 → 0.4.107

package/src/cli/lifecycle-preflight.ts

@@ -6,6 +6,8 @@ import { compileTableContract } from './authz-compile';
 import { reconcileOwner, triggerFunctionOf } from './derived-apply';
 import { isSessionError, type SessionRunner } from './session';
 import { parseQualified, type SourceObject } from './derived-source';
+import { quoteQualified } from './pg-ident';
+import { ALWAYS_GOVERNED } from './authz-reconcile';
 import { lifecycleDerived, lifecycleManifestOf, lifecycleRole } from './lifecycle-derived';
 
 export const LIFECYCLE_LOG_REFUSAL = 'everystack.destroy_log is missing; run db:provision before db:apply';
@@ -32,14 +34,127 @@ export function lifecycleLogRowRefusal(log: { present?: unknown; current?: unkno
 /**
  * The log's shape first (its refusals are unchanged), then the live catalog facts the soft delete
  * rests on (lifecycleCatalogRefusal). Pure SELECTs: the --stage lane runs them over db:query.
+ *
+ * `planStatements`: the reviewed plan this check runs before. A finding the plan resolves is not
+ * a refusal (see planRevokedGrants). The plan's state transaction commits before the derived
+ * catch-up creates any lifecycle function, and the post-check reads the catalog again after it.
  */
-export async function lifecycleApplyRefusal(runner: QueryRunner, models: readonly ModelDescriptor[]): Promise<string | null> {
-  if (!models.some(model => model.lifecycle === true)) return null;
+export async function lifecycleApplyRefusal(
+  runner: QueryRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+  planStatements: readonly string[] = [],
+): Promise<string | null> {
+  return (await lifecycleApplyReport(runner, models, roles, planStatements)).refusal;
+}
+
+/** lifecycleApplyRefusal, plus the findings the plan resolves (one line, or null when none). */
+export async function lifecycleApplyReport(
+  runner: QueryRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+  planStatements: readonly string[] = [],
+): Promise<{ refusal: string | null; resolved: string | null }> {
+  if (!models.some(model => model.lifecycle === true)) return { refusal: null, resolved: null };
   const [log] = await runner(LIFECYCLE_LOG_SQL);
+  const shape = lifecycleLogRowRefusal(log);
+  if (shape) return { refusal: shape, resolved: null };
   // Before the plan: a modeled table's keys are the plan's to converge (the models declare each
   // one, or refuse to compile), so rule 6 reports only keys from tables the models do not have.
   const modeledTables = [...new Set(models.map(model => `${model.schema}.${model.table}`))];
-  return lifecycleLogRowRefusal(log) ?? lifecycleCatalogRefusal(runner, { ...catalogInputsFromModels(models), modeledTables });
+  const report = await lifecycleCatalogFindings(runner, { ...catalogInputsFromModels(models, roles), modeledTables },
+    { planRevokes: planRevokedGrants(planStatements) });
+  return { refusal: catalogRefusalText(report), resolved: resolvedLine(report.resolved) };
+}
+
+/**
+ * What `db:provision` must do before a lifecycle plan can apply, as one line naming the command,
+ * or null. The same reads the apply refuses on: everystack.destroy_log missing or out of date
+ * (lifecycleLogRowRefusal), and the lifecycle role missing or holding LOGIN or BYPASSRLS (the
+ * attributes db:provision resets). `command` is the db:provision invocation for this target.
+ */
+export async function lifecycleProvisionFirst(
+  runner: QueryRunner,
+  models: readonly ModelDescriptor[],
+  command: string,
+  options: { lifecycleRole?: string } = {},
+): Promise<string | null> {
+  if (!models.some(model => model.lifecycle === true)) return null;
+  const lc = options.lifecycleRole ?? LIFECYCLE_OWNER_ROLE;
+  const reasons: string[] = [];
+  const [log] = await runner(LIFECYCLE_LOG_SQL);
+  if (log?.present !== true) reasons.push('everystack.destroy_log is missing');
+  else if (log.current !== true) reasons.push('everystack.destroy_log is out of date');
+  const [role] = await runner(roleSql(lc));
+  if (!truthy(role?.present)) reasons.push(`role ${lc} is missing`);
+  else {
+    const wrong = (['login', 'bypassrls'] as const).filter(key => truthy(role[key])).map(key => key.toUpperCase());
+    if (wrong.length > 0) reasons.push(`role ${lc} has ${wrong.join(', ')}`);
+  }
+  if (reasons.length === 0) return null;
+  return `run db:provision first: ${reasons.join('; ')}. Run: ${command}`;
+}
+
+/**
+ * The grants a reviewed plan revokes, one key per (table, grantee, privilege, column) — the exact
+ * statements the reconciler emits (authz-reconcile.ts reconcileGrants, reconcileColumnGrants):
+ *
+ *   REVOKE REFERENCES, TRIGGER, TRUNCATE ON public.t FROM admin;
+ *   REVOKE REFERENCES (a, b) ON public.t FROM admin;
+ *
+ * Anything else (a sequence, a statement this does not recognise) resolves nothing, so an
+ * unrecognised form can only leave a finding standing, never hide one.
+ */
+export function planRevokedGrants(statements: readonly string[]): ReadonlySet<string> {
+  const keys = new Set<string>();
+  for (const statement of statements) {
+    const column = /^REVOKE ([A-Z]+) \(([^()]+)\) ON (.+) FROM ([^;]+);$/.exec(statement);
+    if (column) {
+      for (const name of column[2].split(', ')) keys.add(revokeKey(column[3], column[4], column[1], name));
+      continue;
+    }
+    const table = /^REVOKE ([A-Z]+(?:, [A-Z]+)*) ON (.+) FROM ([^;]+);$/.exec(statement);
+    if (!table || table[2].startsWith('SEQUENCE ')) continue;
+    for (const privilege of table[1].split(', ')) keys.add(revokeKey(table[2], table[3], privilege));
+  }
+  return keys;
+}
+
+/** `table` as the reconciler emits it (quoteQualified of the contract's `schema.table`). */
+const revokeKey = (table: string, grantee: string, privilege: string, column?: string): string =>
+  JSON.stringify([table, grantee, privilege, column ?? null]);
+
+/**
+ * What the modules declare about the roles, beside the models (DeclaredDerived). The catalog check
+ * reads it to tell a definer role the models grant to apart from a role a request can become.
+ *
+ *   requestRoles    `roles: { request }`, the union across modules. Undefined = not declared, and
+ *                   the check runs exactly as before: every grantee counts as a request role.
+ *   declaredOwners  every `owner` a declared derived object names.
+ */
+export interface LifecycleRoleDeclaration {
+  requestRoles?: string[];
+  declaredOwners?: string[];
+}
+
+/** The role declaration from a loaded declared layer; empty (not declared) when there is none. */
+export function lifecycleRolesOf(declared: { requestRoles?: string[]; declaredOwners?: string[] } | null | undefined): LifecycleRoleDeclaration {
+  return declared?.requestRoles === undefined ? {} : { requestRoles: declared.requestRoles, declaredOwners: declared.declaredOwners ?? [] };
+}
+
+/**
+ * The grantees the declaration does not classify: each counts as a request role, so the lifecycle
+ * check treats it as application-side. A warning, never a refusal. Null when the request roles are
+ * not declared (nothing is classified), when no model is a lifecycle model, or when none is left.
+ */
+export function unclassifiedGranteesWarning(models: readonly ModelDescriptor[], roles: LifecycleRoleDeclaration): string | null {
+  if (roles.requestRoles === undefined || !models.some(model => model.lifecycle === true)) return null;
+  const classified = new Set([...roles.requestRoles, ...(roles.declaredOwners ?? [])]);
+  const unclassified = catalogInputsFromModels(models).applicationRoles.filter(role => !classified.has(role));
+  if (unclassified.length === 0) return null;
+  return `the models grant privileges to ${unclassified.join(', ')}, which ${unclassified.length === 1 ? 'is' : 'are'} neither a declared request role `
+    + `(roles: { request }) nor a declared owner, so the lifecycle check counts ${unclassified.length === 1 ? 'it' : 'them'} as a role a request can become. `
+    + 'Add each to roles.request, or name it as the owner of the derived objects it owns.';
 }
 
 const literal = (s: string): string => `'${s.replace(/'/g, "''")}'`;
@@ -85,6 +200,19 @@ export interface LifecycleCatalogInputs {
    * rule 6 leaves to the plan. Absent after the state apply: every key is checked.
    */
   modeledTables?: readonly string[];
+  /**
+   * The declared request roles (LifecycleRoleDeclaration). Absent = not declared: the
+   * application roles are the grantees, exactly as before. Present: see applicationRoleSet.
+   */
+  requestRoles?: readonly string[];
+  /** Every declared derived-object owner. Read only when `requestRoles` is present. */
+  declaredOwners?: readonly string[];
+  /**
+   * The roles a fresh plan governs (ALWAYS_GOVERNED and every grantee of the models): the plan
+   * revokes any REFERENCES, TRIGGER or TRUNCATE such a role holds on a lifecycle table, since a
+   * lifecycle model cannot declare one. Absent (a db:reconcile payload): every rule-3 fix is SQL.
+   */
+  governedRoles?: readonly string[];
 }
 
 /** A declared dependent: the child's `schema.table`, its foreign-key column (SQL name), the lifecycle parent's `schema.table`. */
@@ -127,19 +255,25 @@ export function nullifyUnrecordedFromDeclared(declared: readonly Parameters<type
 
 const notApplicationRole = (lc: string) => (role: string): boolean => role !== 'PUBLIC' && role !== 'public' && role !== lc;
 
-/** The catalog check's inputs, read from the models. */
-export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[] } {
+/** The catalog check's inputs, read from the models (and the role declaration, when there is one). */
+export function catalogInputsFromModels(
+  models: readonly ModelDescriptor[],
+  declaration: LifecycleRoleDeclaration = {},
+): { lifecycleTables: string[]; applicationRoles: string[]; dependentKeys: LifecycleDependentKey[]; requestRoles?: string[]; declaredOwners?: string[]; governedRoles: string[] } {
   const roles = new Set<string>();
+  const governed = new Set<string>(ALWAYS_GOVERNED);
   for (const model of models) {
     const contract = compileTableContract(model);
-    for (const role of Object.keys(contract.grants)) roles.add(role);
-    for (const role of Object.keys(contract.columnGrants ?? {})) roles.add(role);
+    for (const role of Object.keys(contract.grants)) { roles.add(role); governed.add(role); }
+    for (const role of Object.keys(contract.columnGrants ?? {})) { roles.add(role); governed.add(role); }
     for (const policy of contract.policies) for (const role of policy.roles) roles.add(role);
   }
   return {
+    governedRoles: [...governed].sort(),
     lifecycleTables: [...new Set(models.filter(model => model.lifecycle === true).map(model => `${model.schema}.${model.table}`))].sort(),
     applicationRoles: [...roles].filter(notApplicationRole(LIFECYCLE_OWNER_ROLE)).sort(),
     dependentKeys: models.some(model => model.lifecycle === true) ? dependentKeysFromDeclared(lifecycleDerived(models)) : [],
+    ...(declaration.requestRoles === undefined ? {} : { requestRoles: [...declaration.requestRoles], declaredOwners: [...(declaration.declaredOwners ?? [])] }),
   };
 }
 
@@ -153,9 +287,16 @@ export function catalogInputsFromModels(models: readonly ModelDescriptor[]): { l
 const assumes = (x: string, y: string): string => `(pg_catalog.pg_has_role(${x}, ${y}, 'USAGE') OR CASE
     WHEN pg_catalog.current_setting('server_version_num')::int >= 160000 THEN pg_catalog.pg_has_role(${x}, ${y}, 'SET')
     ELSE pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER') END)`;
-/** `x` can act as `y`, or hold ADMIN on it: an ADMIN holder can grant `y` to itself WITH SET. */
+/**
+ * `x` can act as `y`, or hold ADMIN on it (an ADMIN holder can grant `y` to itself WITH SET), or
+ * reach it through a chain of grants whose options differ link to link. MEMBER counts any chain:
+ * ADMIN-only on `i`, then `i` a member of `y` (grant `i` to itself WITH SET, SET ROLE `i`, then
+ * `y`); or SET-only on `i`, then `i` an INHERIT-only member of `y` (SET ROLE `i` holds `y`'s
+ * privileges). USAGE, SET and MEMBER WITH ADMIN OPTION are each false for both. Never in `assumes`:
+ * the side set must still leave out the RDS master's ADMIN-only membership.
+ */
 const reaches = (x: string, y: string): string =>
-  `(${assumes(x, y)} OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION'))`;
+  `(${assumes(x, y)} OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION') OR pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER'))`;
 
 /**
  * The application-side roles, as a CTE `side(oid, rolname)`: non-superusers that are, or can act
@@ -166,6 +307,115 @@ const sideCte = (apps: string[]): string => `side AS (SELECT r.oid, r.rolname::t
     WHERE NOT r.rolsuper AND EXISTS (SELECT 1 FROM pg_catalog.pg_roles a
       WHERE a.rolname = ANY(${textArray(apps)}) AND (a.oid = r.oid OR ${assumes('r.oid', 'a.oid')})))`;
 
+/** How `x` reaches `y`, for a finding: INHERIT, SET, ADMIN or a chain of grants (the first that holds; see assumes and reaches). */
+const reachHow = (x: string, y: string): string => `CASE WHEN pg_catalog.pg_has_role(${x}, ${y}, 'USAGE') THEN 'INHERIT'
+    WHEN (CASE WHEN pg_catalog.current_setting('server_version_num')::int >= 160000 THEN pg_catalog.pg_has_role(${x}, ${y}, 'SET')
+      ELSE pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER') END) THEN 'SET'
+    WHEN pg_catalog.pg_has_role(${x}, ${y}, 'MEMBER WITH ADMIN OPTION') THEN 'ADMIN' ELSE 'a chain of grants' END`;
+
+/**
+ * The live facts the declaration rests on. Per declared request role: does it exist, is it a
+ * superuser, is it BYPASSRLS. Per declared owner that is a grantee or a request role: does it exist,
+ * can it log in, and which request roles reach it (reaches: INHERIT, SET or ADMIN, transitively).
+ */
+const requestRoleSql = (request: string[], owners: string[]): string => `SELECT 'request' AS kind, d.name, o.oid IS NOT NULL AS present,
+    COALESCE(o.rolsuper, false) AS super, COALESCE(o.rolbypassrls, false) AS bypassrls, COALESCE(o.rolcanlogin, false) AS login,
+    ARRAY[]::text[] AS reached_by
+  FROM pg_catalog.unnest(${textArray(request)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name
+  UNION ALL
+  SELECT 'owner', d.name, o.oid IS NOT NULL, COALESCE(o.rolsuper, false), COALESCE(o.rolbypassrls, false), COALESCE(o.rolcanlogin, false),
+    ARRAY(SELECT 'request role ' || r.rolname::text || ' can act as ' || d.name || ' (' || ${reachHow('r.oid', 'o.oid')} || ')'
+      FROM pg_catalog.pg_roles r WHERE r.rolname = ANY(${textArray(request)}) AND r.oid <> o.oid AND ${reaches('r.oid', 'o.oid')} ORDER BY 1)
+  FROM pg_catalog.unnest(${textArray(owners)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name
+  ORDER BY 1, 2`;
+
+/** The application roles every rule reads (sideCte's input), and why each counts where the declaration can say. */
+interface ApplicationRoleSet {
+  apps: string[];
+  /** A role in `apps` → one sentence saying why it is there. Empty when nothing is declared. */
+  why: Map<string, string>;
+  /** Live findings on the declared request roles. */
+  findings: string[];
+  /** The models' grantees (applicationRoles), PUBLIC and the lifecycle role left out. */
+  grantees: ReadonlySet<string>;
+  /** The request roles are declared. */
+  declared: boolean;
+}
+
+/**
+ * THE one place the application-role set is computed. Rules 1, 2 and 5, the pre-exposure gate, the
+ * post-check and the reconcile path all read it.
+ *
+ * Not declared (`requestRoles` absent): the grantees, exactly as before, and no query runs.
+ *
+ * Declared: the request roles and the grantees, minus each declared owner D that holds every guard,
+ * read live: D is not a request role, D is not the lifecycle role (never in the set: PUBLIC and it are
+ * filtered out), D exists and cannot log in, and no request role reaches D. A declared owner that
+ * fails a guard stays, and `why` names the guard. A grantee in neither list stays as well. Each
+ * request role must exist, and be neither a superuser nor BYPASSRLS: either is a finding.
+ */
+async function applicationRoleSet(runner: QueryRunner, inputs: LifecycleCatalogInputs, lc: string): Promise<ApplicationRoleSet> {
+  const grantees = [...new Set(inputs.applicationRoles)].filter(notApplicationRole(lc)).sort();
+  if (inputs.requestRoles === undefined) return { apps: grantees, why: new Map(), findings: [], grantees: new Set(grantees), declared: false };
+  const request = new Set([...inputs.requestRoles].filter(notApplicationRole(lc)));
+  const owners = new Set(inputs.declaredOwners ?? []);
+  const set = new Set([...request, ...grantees]);
+  const candidates = [...set].filter(role => owners.has(role)).sort();
+  const findings: string[] = [];
+  const why = new Map<string, string>();
+  for (const row of await runner(requestRoleSql([...request].sort(), candidates))) {
+    const name = String(row.name);
+    if (row.kind === 'request') {
+      if (!truthy(row.present)) {
+        findings.push(`request role ${name} does not exist. Fix: create it, or remove it from roles.request.`);
+        continue;
+      }
+      if (truthy(row.super)) findings.push(`request role ${name} is a superuser: a request that becomes it passes every check. Fix: ALTER ROLE ${ident(name)} NOSUPERUSER;`);
+      if (truthy(row.bypassrls)) findings.push(`request role ${name} has BYPASSRLS: a request that becomes it skips every row-level policy. Fix: ALTER ROLE ${ident(name)} NOBYPASSRLS;`);
+      continue;
+    }
+    const failed: string[] = [];
+    if (request.has(name)) failed.push(`declared owner ${name} is a request role`);
+    if (!truthy(row.present)) failed.push(`declared owner ${name} does not exist`);
+    else if (truthy(row.login)) failed.push(`declared owner ${name} can log in`);
+    failed.push(...textList(row.reached_by));
+    if (failed.length === 0) set.delete(name);
+    else why.set(name, `${name} counts as an application role: ${failed.join('; ')}.`);
+  }
+  for (const role of grantees) {
+    if (!request.has(role) && !owners.has(role)) {
+      why.set(role, `${role} counts as an application role because the models grant it privileges, and it is neither a declared request role nor a declared owner.`);
+    }
+  }
+  return { apps: [...set].sort(), why, findings, grantees: new Set(grantees), declared: true };
+}
+
+/**
+ * Why `owner`, itself an application-side role, counts: for a rule-5 finding. The declaration's
+ * reason when it has one. Undeclared, and the owner counts only because the models grant to it (it
+ * acts as no other application role, and no other application role reaches it), the finding says
+ * so and names the declaration that tells a definer role apart. Reached, the REVOKE fix stands alone.
+ */
+function ownerCause(set: ApplicationRoleSet, owner: string, actsAs: readonly string[], appReach: readonly string[]): string | undefined {
+  const known = set.why.get(owner);
+  if (known) return known;
+  if (set.declared) return actsAs.length > 0 ? `${owner} can act as the application role${actsAs.length === 1 ? '' : 's'} ${actsAs.join(', ')}.` : undefined;
+  const granted = set.grantees.has(owner) && actsAs.length === 0 && appReach.length === 0;
+  return granted ? grantedCause(owner) : undefined;
+}
+
+const grantedCause = (owner: string): string => `${owner} counts as an application role because the models grant it privileges. `
+  + 'If it is a definer role that no request role reaches, declare the request roles with roles: { request: [...] } in a module.';
+
+/**
+ * Two columns for the rule-5 queries: the application roles `owner` can act as (acts_as), and the
+ * other application roles that reach `owner` (app_reach). Neither counts `owner` itself.
+ */
+const ownerReachColumns = (apps: string[], owner: string): string => `ARRAY(SELECT a.rolname::text FROM pg_catalog.pg_roles a
+      WHERE a.rolname = ANY(${textArray(apps)}) AND a.oid <> ${owner} AND ${assumes(owner, 'a.oid')} ORDER BY 1) AS acts_as,
+    ARRAY(SELECT a.rolname::text FROM pg_catalog.pg_roles a
+      WHERE a.rolname = ANY(${textArray(apps)}) AND a.oid <> ${owner} AND ${reaches('a.oid', owner)} ORDER BY 1) AS app_reach`;
+
 /** Rule 1, attributes. */
 const roleSql = (lc: string): string => `SELECT lc.oid IS NOT NULL AS present,
     COALESCE(lc.rolcanlogin, false) AS login, COALESCE(lc.rolsuper, false) AS super,
@@ -184,11 +434,17 @@ const memberSql = (apps: string[], lc: string): string => `WITH ${sideCte(apps)}
   WHERE s.oid <> lc.oid AND ${reaches('s.oid', 'lc.oid')}
   ORDER BY 1`;
 
+/** The deploy history: who owns one can rewrite what was applied, run and reconciled. */
+const HISTORY_TABLES = ['everystack.schema_log', 'everystack.exec_log', 'everystack.derived_provenance'];
+
 /**
  * Rule 2. The owner of a lifecycle table can disable its triggers; the owner of destroy_log can
- * write the marker; the owner of a marker function can replace it. Each such object is a finding
- * when its owner is the lifecycle role, or when an application-side role is that owner, can act
- * as it, or holds ADMIN on it. The operator owning all of them is the documented setup and passes.
+ * write the marker; the owner of a marker function can replace it; the owner of a schema holding
+ * any of them can drop what is in it (DROP ... CASCADE takes the delete-path trigger along); the
+ * owner of schema_log, exec_log or derived_provenance can forge the deploy history. Each such
+ * object is a finding when its owner is the lifecycle role, or when an application-side role is
+ * that owner, can act as it, or holds ADMIN on it. The operator owning all of them is the
+ * documented setup and passes. A table that does not exist is not judged.
  */
 const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH ${sideCte(apps)},
   owned AS (
@@ -200,8 +456,19 @@ const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH
     WHERE c.oid = pg_catalog.to_regclass('everystack.destroy_log')
     UNION ALL
     SELECT 'function', m.sig, p.proowner FROM pg_catalog.unnest(${textArray(MARKERS)}) AS m(sig)
-    JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig))
+    JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig)
+    UNION ALL
+    SELECT 'table', n.nspname::text || '.' || c.relname::text, c.relowner
+    FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.oid IN (SELECT pg_catalog.to_regclass(t) FROM pg_catalog.unnest(${textArray(HISTORY_TABLES)}) AS t)
+    UNION ALL
+    SELECT 'schema', n.nspname::text, n.nspowner FROM pg_catalog.pg_namespace n
+    WHERE n.nspname = ANY(${textArray([...new Set(tables.map(table => table.slice(0, table.indexOf('.'))))])})
+      OR n.oid IN (SELECT c.relnamespace FROM pg_catalog.pg_class c WHERE c.oid = pg_catalog.to_regclass('everystack.destroy_log'))
+      OR n.oid IN (SELECT p.pronamespace FROM pg_catalog.unnest(${textArray(MARKERS)}) AS m(sig)
+        JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(m.sig)))
   SELECT o.kind, o.name, pg_catalog.pg_get_userbyid(o.owner)::text AS owner, o.owner = lc.oid AS lifecycle_owned,
+    pg_catalog.current_database()::text AS database,
     ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.owner OR ${reaches('s.oid', 'o.owner')} ORDER BY 1) AS via
   FROM owned o LEFT JOIN pg_catalog.pg_roles lc ON lc.rolname = ${literal(lc)}
   WHERE o.owner = lc.oid OR EXISTS (SELECT 1 FROM side s WHERE s.oid = o.owner OR ${reaches('s.oid', 'o.owner')})
@@ -211,23 +478,27 @@ const ownerSql = (tables: string[], apps: string[], lc: string): string => `WITH
  * Rule 3. TRIGGER, REFERENCES or TRUNCATE on a lifecycle table, or REFERENCES on one of its
  * columns, held by anyone but its owner. On everystack.destroy_log, any privilege but SELECT
  * (table or column) held by anyone but its owner: a writer could forge or remove a marker.
+ * One row per grantor: PostgreSQL revokes only the grants made by the role REVOKE runs as, and
+ * runs a member's (or a superuser's) REVOKE as the owner, so who granted it decides what removes it.
  */
 const aclSql = (tables: string[]): string => `SELECT n.nspname::text || '.' || c.relname::text AS "table", ${granteeName('a.grantee')} AS grantee,
-    a.privilege_type AS privilege, NULL::text AS "column"
+    a.privilege_type AS privilege, NULL::text AS "column", a.grantor = c.relowner AS owner_granted,
+    pg_catalog.pg_get_userbyid(a.grantor)::text AS grantor
   FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
   CROSS JOIN LATERAL pg_catalog.aclexplode(c.relacl) a
   WHERE c.relkind IN ('r', 'p') AND a.grantee <> c.relowner AND (
     ((n.nspname::text || '.' || c.relname::text) = ANY(${textArray(tables)}) AND a.privilege_type IN ('TRIGGER', 'REFERENCES', 'TRUNCATE'))
     OR (c.oid = pg_catalog.to_regclass('everystack.destroy_log') AND a.privilege_type <> 'SELECT'))
   UNION ALL
-  SELECT n.nspname::text || '.' || c.relname::text, ${granteeName('a.grantee')}, a.privilege_type, t.attname::text
+  SELECT n.nspname::text || '.' || c.relname::text, ${granteeName('a.grantee')}, a.privilege_type, t.attname::text,
+    a.grantor = c.relowner, pg_catalog.pg_get_userbyid(a.grantor)::text
   FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
   JOIN pg_catalog.pg_attribute t ON t.attrelid = c.oid AND t.attnum > 0 AND NOT t.attisdropped
   CROSS JOIN LATERAL pg_catalog.aclexplode(t.attacl) a
   WHERE c.relkind IN ('r', 'p') AND a.grantee <> c.relowner AND (
     ((n.nspname::text || '.' || c.relname::text) = ANY(${textArray(tables)}) AND a.privilege_type = 'REFERENCES')
     OR (c.oid = pg_catalog.to_regclass('everystack.destroy_log') AND a.privilege_type <> 'SELECT'))
-  ORDER BY 1, 4 NULLS FIRST, 3, 2`;
+  ORDER BY 1, 4 NULLS FIRST, 3, 2, 6`;
 
 /**
  * Rule 4. Each marker function: SECURITY DEFINER, owned by destroy_log's owner, EXECUTE for the
@@ -260,7 +531,8 @@ const triggerOwnerSql = (tables: string[], apps: string[]): string => `WITH ${si
   SELECT n.nspname::text || '.' || c.relname::text AS "table", g.tgname::text AS trigger,
     pg_catalog.quote_ident(fn.nspname) || '.' || pg_catalog.quote_ident(p.proname) || '(' || pg_catalog.pg_get_function_identity_arguments(p.oid) || ')' AS function,
     pg_catalog.pg_get_userbyid(p.proowner)::text AS owner,
-    ARRAY(SELECT s.rolname FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')} ORDER BY 1) AS via
+    ARRAY(SELECT s.rolname FROM side s WHERE s.oid = p.proowner OR ${reaches('s.oid', 'p.proowner')} ORDER BY 1) AS via,
+    ${ownerReachColumns(apps, 'p.proowner')}
   FROM pg_catalog.pg_trigger g JOIN pg_catalog.pg_class c ON c.oid = g.tgrelid
   JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace JOIN pg_catalog.pg_proc p ON p.oid = g.tgfoid
   JOIN pg_catalog.pg_namespace fn ON fn.oid = p.pronamespace
@@ -272,8 +544,12 @@ const triggerOwnerSql = (tables: string[], apps: string[]): string => `WITH ${si
  * One rule-5 finding. `via` holds the application-side roles that are, or reach, `owner`. When the
  * owner is one of them the fix is a new owner; otherwise it is to revoke the path to the owner.
  * `would`: the pre-exposure gate, which judges a declared trigger before the reconcile creates it.
+ * `cause`: why the owner counts as an application role (ownerCause), when there is more to say.
  */
-export function triggerOwnerFinding(row: { trigger: string; table: string; function: string; owner: string; via: readonly string[] }, would = false): string {
+export function triggerOwnerFinding(
+  row: { trigger: string; table: string; function: string; owner: string; via: readonly string[]; cause?: string },
+  would = false,
+): string {
   const { owner, via } = row;
   const sideOwned = via.includes(owner);
   const who = sideOwned ? `${owner}, an application-side role`
@@ -284,7 +560,8 @@ export function triggerOwnerFinding(row: { trigger: string; table: string; funct
       + `for a function not declared in db/models: ALTER FUNCTION ${row.function} OWNER TO <that role>;`
     : `${via.map(r => `REVOKE ${ident(owner)} FROM ${ident(r)};`).join(' ')} (or from the role each reaches ${owner} through)`;
   return `trigger ${row.trigger} on ${row.table} ${would ? 'would run' : 'runs'} ${row.function}, owned by ${who}; `
-    + `${via.join(', ')} can replace its body, and it runs inside every soft delete and destroy. Fix: ${fix}`;
+    + `${via.join(', ')} can replace its body, and it runs inside every soft delete and destroy. Fix: ${fix}`
+    + (sideOwned && row.cause ? ` ${row.cause}` : '');
 }
 
 /**
@@ -307,6 +584,8 @@ const OWNER_HAZARD = {
   table: 'an owner can disable its triggers',
   log: 'an owner can write the marker',
   function: 'an owner can replace the function',
+  schema: 'an owner can DROP ... CASCADE the delete-path trigger',
+  history: 'an owner can forge the deploy history',
 };
 
 /**
@@ -331,26 +610,55 @@ export async function lifecycleCatalogRefusal(
   inputs: LifecycleCatalogInputs,
   options: { lifecycleRole?: string } = {},
 ): Promise<string | null> {
-  const findings = await lifecycleCatalogFindings(runner, inputs, options);
+  return catalogRefusalText(await lifecycleCatalogFindings(runner, inputs, options));
+}
+
+const catalogRefusalText = ({ findings, resolved }: CatalogFindings): string | null => {
   if (findings.length === 0) return null;
-  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'}); `
+  const also = resolved.length === 0 ? '' : ` (the plan resolves ${resolved.length} more)`;
+  return `the live catalog breaks the lifecycle soft delete (${findings.length} finding${findings.length === 1 ? '' : 's'})${also}; `
     + `fix each, then re-run:\n${findingLines(findings)}`;
-}
+};
+
+/**
+ * The resolved rule-3 findings as one line: per grantee and privilege, the tables the plan
+ * revokes it on. Null when the plan resolves none.
+ */
+const resolvedLine = (resolved: readonly ResolvedGrant[]): string | null => {
+  if (resolved.length === 0) return null;
+  const byGrant = new Map<string, string[]>();
+  for (const r of resolved) {
+    const grant = `${r.privilege}${r.column ? ` (${r.column})` : ''} from ${r.grantee}`;
+    byGrant.set(grant, [...(byGrant.get(grant) ?? []), r.table]);
+  }
+  const parts = [...byGrant].map(([grant, tables]) => `${grant} on ${[...new Set(tables)].sort().join(', ')}`);
+  return `the plan resolves ${countFindings(resolved.length)}: it revokes ${parts.join('; ')}, before any lifecycle function is created.`;
+};
 
 const findingLines = (findings: readonly string[]): string => findings.map(finding => `  - ${finding}`).join('\n');
 const countFindings = (n: number): string => `${n} lifecycle finding${n === 1 ? '' : 's'}`;
 
-/** lifecycleCatalogRefusal's findings, one string each, without the heading. */
+/** A rule-3 finding the reviewed plan's own REVOKE removes. */
+interface ResolvedGrant { table: string; grantee: string; privilege: string; column: string | null }
+interface CatalogFindings { findings: string[]; resolved: ResolvedGrant[] }
+
+/**
+ * lifecycleCatalogRefusal's findings, one string each, without the heading. `planRevokes`
+ * (planRevokedGrants): a rule-3 grant on a lifecycle table that the plan revokes, exactly that
+ * privilege from that grantee on that table (and column), moves to `resolved`. Nothing else does.
+ */
 async function lifecycleCatalogFindings(
   runner: QueryRunner,
   inputs: LifecycleCatalogInputs,
-  options: { lifecycleRole?: string } = {},
-): Promise<string[]> {
+  options: { lifecycleRole?: string; planRevokes?: ReadonlySet<string> } = {},
+): Promise<CatalogFindings> {
   const lc = options.lifecycleRole ?? LIFECYCLE_OWNER_ROLE;
   const tables = [...new Set(inputs.lifecycleTables)].sort();
-  if (tables.length === 0) return [];
-  const apps = [...new Set(inputs.applicationRoles)].filter(notApplicationRole(lc)).sort();
-  const findings: string[] = [];
+  const resolved: ResolvedGrant[] = [];
+  if (tables.length === 0) return { findings: [], resolved };
+  const set = await applicationRoleSet(runner, inputs, lc);
+  const apps = set.apps;
+  const findings: string[] = [...set.findings];
 
   const [role] = await runner(roleSql(lc));
   if (!truthy(role?.present)) {
@@ -369,24 +677,55 @@ async function lifecycleCatalogFindings(
   }
 
   for (const row of await runner(ownerSql(tables, apps, lc))) {
-    const kind = row.kind === 'function' ? 'function' : 'table';
-    const hazard = row.name === 'everystack.destroy_log' ? OWNER_HAZARD.log : OWNER_HAZARD[kind];
+    const kind: 'function' | 'schema' | 'table' = row.kind === 'function' || row.kind === 'schema' ? row.kind : 'table';
+    const hazard = row.name === 'everystack.destroy_log' ? OWNER_HAZARD.log
+      : HISTORY_TABLES.includes(String(row.name)) ? OWNER_HAZARD.history : OWNER_HAZARD[kind];
     const via = textList(row.via);
     const who = truthy(row.lifecycle_owned) ? `${row.owner}, the lifecycle role`
       : via.includes(String(row.owner)) ? `${row.owner}, an application-side role`
         : `${row.owner}, which the application-side role${via.length === 1 ? '' : 's'} ${via.join(', ')} can assume`;
-    const name = kind === 'function' ? String(row.name) : quoteLabel(String(row.name));
+    const name = kind === 'function' ? String(row.name) : kind === 'schema' ? ident(String(row.name)) : quoteLabel(String(row.name));
+    // pg_database_owner (public's owner on PostgreSQL 15 and later) has one implicit member, the owner
+    // of the database, and REVOKE cannot remove it: the database itself has to move.
     const fix = truthy(row.lifecycle_owned) || via.includes(String(row.owner))
       ? `ALTER ${kind.toUpperCase()} ${name} OWNER TO <your operator role>;`
-      : `${via.map(r => `REVOKE ${ident(String(row.owner))} FROM ${ident(r)};`).join(' ')} (or from the role each reaches it through)`;
-    findings.push(`${kind} ${row.name} is owned by ${who}; ${hazard}. Fix: ${fix}`);
+      : row.owner === 'pg_database_owner'
+        ? `ALTER DATABASE ${ident(String(row.database))} OWNER TO <your operator role>; (the owner of the database is pg_database_owner's only member)`
+        : `${via.map(r => `REVOKE ${ident(String(row.owner))} FROM ${ident(r)};`).join(' ')} (or from the role each reaches it through)`;
+    const cause = via.includes(String(row.owner)) ? set.why.get(String(row.owner)) : undefined;
+    findings.push(`${kind} ${row.name} is owned by ${who}; ${hazard}. Fix: ${fix}${cause ? ` ${cause}` : ''}`);
   }
 
+  const governed = new Set(inputs.governedRoles ?? []);
   for (const row of await runner(aclSql(tables))) {
+    const column = row.column == null ? null : String(row.column);
     const on = row.column == null ? '' : ` (${ident(String(row.column))})`;
+    // Granted by another role WITH GRANT OPTION: the plan's REVOKE (run as the owner) and a fresh
+    // plan both leave it, so it is never resolved. No verb removes it today (item U6).
+    if (!truthy(row.owner_granted)) {
+      const table = quoteLabel(String(row.table));
+      const grantor = ident(String(row.grantor));
+      const who = row.grantee === 'PUBLIC' ? 'PUBLIC' : ident(String(row.grantee));
+      // On destroy_log the revoke comes from db:provision, not from a plan.
+      const revoker = row.table === 'everystack.destroy_log' ? "db:provision's REVOKE" : "the plan's REVOKE";
+      findings.push(`${row.grantee} holds ${row.privilege}${on} on ${row.table}, granted by ${row.grantor} with grant option; `
+        + `${revoker} runs as the owner and cannot remove it. Fix: REVOKE ${row.privilege}${on} ON TABLE ${table} FROM ${who} GRANTED BY ${grantor}; `
+        + `(as ${row.grantor}, a member of it, or a superuser), or REVOKE GRANT OPTION FOR ${row.privilege}${on} ON TABLE ${table} FROM ${grantor} CASCADE;`);
+      continue;
+    }
+    if (options.planRevokes && tables.includes(String(row.table))
+      && options.planRevokes.has(revokeKey(quoteQualified(String(row.table)), String(row.grantee), String(row.privilege), column ?? undefined))) {
+      resolved.push({ table: String(row.table), grantee: String(row.grantee), privilege: String(row.privilege), column });
+      continue;
+    }
     const who = row.grantee === 'PUBLIC' ? 'PUBLIC' : ident(String(row.grantee));
-    findings.push(`${row.grantee} holds ${row.privilege}${on} on ${row.table}. `
-      + `Fix: REVOKE ${row.privilege}${on} ON TABLE ${quoteLabel(String(row.table))} FROM ${who};`);
+    // A verb where one exists: db:provision revokes every grant on destroy_log but its owner's
+    // (ENSURE_DESTROY_LOG_SQL); a fresh plan revokes a governed role's grant on a lifecycle table.
+    // SQL only for a role no plan governs, which the plan leaves alone by design.
+    const fix = row.table === 'everystack.destroy_log' ? 'run db:provision.'
+      : governed.has(String(row.grantee)) ? 'mint a plan (db:plan) and db:apply it; the plan revokes this grant.'
+        : `REVOKE ${row.privilege}${on} ON TABLE ${quoteLabel(String(row.table))} FROM ${who};`;
+    findings.push(`${row.grantee} holds ${row.privilege}${on} on ${row.table}. Fix: ${fix}`);
   }
 
   for (const row of await runner(markerSql(lc))) {
@@ -413,8 +752,10 @@ async function lifecycleCatalogFindings(
   }
 
   for (const row of await runner(triggerOwnerSql(tables, apps))) {
+    const owner = String(row.owner);
+    const via = textList(row.via);
     findings.push(triggerOwnerFinding({ trigger: String(row.trigger), table: String(row.table), function: String(row.function),
-      owner: String(row.owner), via: textList(row.via) }));
+      owner, via, cause: ownerCause(set, owner, textList(row.acts_as), textList(row.app_reach)) }));
   }
 
   const declared = new Set(inputs.dependentKeys.map(key => JSON.stringify([key.child, key.column, key.parent])));
@@ -443,7 +784,7 @@ async function lifecycleCatalogFindings(
         + 'if the models declare this key nullify, upgrade the CLI (@everystack/cli) and re-run.' : ''));
   }
 
-  return findings;
+  return { findings, resolved };
 }
 
 /**
@@ -472,10 +813,10 @@ export async function lifecycleDeclaredOwnerRefusal(
   session: SessionRunner,
   declared: readonly SourceObject[],
   models: readonly ModelDescriptor[],
-  options: { stateApplied: boolean },
+  options: { stateApplied: boolean; roles?: LifecycleRoleDeclaration },
 ): Promise<string | null> {
-  const { lifecycleTables, applicationRoles } = catalogInputsFromModels(models);
-  const tables = new Set(lifecycleTables);
+  const inputs = catalogInputsFromModels(models, options.roles);
+  const tables = new Set(inputs.lifecycleTables);
   const triggers = declared.flatMap((object) => {
     if (object.kind !== 'trigger' || !object.table) return [];
     const { schema, name } = parseQualified(object.table);
@@ -488,20 +829,24 @@ export async function lifecycleDeclaredOwnerRefusal(
   const builder = String(slot[0].builder);
   const judged = triggers.map(t => ({ ...t, owner: reconcileOwner(t.fn, builder) }));
   const owners = [...new Set(judged.map(t => t.owner))].sort();
-  const rows = await runner(`WITH ${sideCte(applicationRoles)}
+  const set = await applicationRoleSet(runner, inputs, LIFECYCLE_OWNER_ROLE);
+  const rows = await runner(`WITH ${sideCte(set.apps)}
     SELECT d.name AS owner, o.oid IS NOT NULL AS present,
-      ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.oid OR ${reaches('s.oid', 'o.oid')} ORDER BY 1) AS via
+      ARRAY(SELECT s.rolname FROM side s WHERE s.oid = o.oid OR ${reaches('s.oid', 'o.oid')} ORDER BY 1) AS via,
+      ${ownerReachColumns(set.apps, 'o.oid')}
     FROM pg_catalog.unnest(${textArray(owners)}) AS d(name) LEFT JOIN pg_catalog.pg_roles o ON o.rolname = d.name`);
-  const byOwner = new Map(rows.map(row => [String(row.owner), { present: truthy(row.present), via: textList(row.via) }]));
-  const findings = judged.flatMap((t) => {
+  const byOwner = new Map(rows.map(row => [String(row.owner),
+    { present: truthy(row.present), via: textList(row.via), actsAs: textList(row.acts_as), appReach: textList(row.app_reach) }]));
+  const findings = [...set.findings, ...judged.flatMap((t) => {
     const owner = byOwner.get(t.owner);
     if (!owner?.present) {
       return [`trigger ${t.trigger} on ${t.table} would run ${t.fn.identity}, owned by ${t.owner}, which does not exist. `
         + `Fix: create ${t.owner} as a role no application role can act as, or declare an existing such role as ${t.fn.identity}'s owner in db/models.`];
     }
     if (owner.via.length === 0) return [];
-    return [triggerOwnerFinding({ trigger: t.trigger, table: t.table, function: t.fn.identity, owner: t.owner, via: owner.via }, true)];
-  });
+    return [triggerOwnerFinding({ trigger: t.trigger, table: t.table, function: t.fn.identity, owner: t.owner, via: owner.via,
+      cause: ownerCause(set, t.owner, owner.actsAs, owner.appReach) }, true)];
+  })];
   if (findings.length === 0) return null;
   return `${options.stateApplied ? 'tables and columns applied; ' : ''}derived layer NOT applied: ${countFindings(findings.length)}; `
     + `fix each, then re-run:\n${findingLines(findings)}`;
@@ -515,14 +860,18 @@ export async function lifecycleDeclaredOwnerRefusal(
  * It reads on `session`, the reconcile's own connection: on a stage, db:session (the operator
  * connection). db:query may read a replica the reconcile's commit has not reached yet, and pass.
  */
-export async function lifecyclePostApplyRefusal(session: SessionRunner, models: readonly ModelDescriptor[]): Promise<string | null> {
+export async function lifecyclePostApplyRefusal(
+  session: SessionRunner,
+  models: readonly ModelDescriptor[],
+  roles: LifecycleRoleDeclaration = {},
+): Promise<string | null> {
   if (!models.some(model => model.lifecycle === true)) return null;
   const read: QueryRunner = async (q) => {
     const [slot] = await session([q]);
     if (isSessionError(slot)) throw new Error(slot.message);
     return slot ?? [];
   };
-  const findings = await lifecycleCatalogFindings(read, catalogInputsFromModels(models));
+  const { findings } = await lifecycleCatalogFindings(read, catalogInputsFromModels(models, roles));
   if (findings.length === 0) return null;
   return `${countFindings(findings.length)} after reconcile; the objects are live; the next apply refuses until fixed:\n${findingLines(findings)}`;
 }
@@ -536,6 +885,20 @@ export const LIFECYCLE_MANIFEST_ABSENT_REFUSAL = (functions: readonly string[]):
   + `function${functions.length === 1 ? '' : 's'} ${functions.join(', ')} carr${functions.length === 1 ? 'ies' : 'y'} no manifest, so the declared dependents `
   + 'cannot be read and the lifecycle catalog check cannot run. Compile the declared layer from the models with this CLI and re-run.';
 
+/**
+ * The role declaration is optional on the wire: absent, the check runs as before (every grantee
+ * counts). Present but not a list of role names, the check cannot tell what was declared: fail closed.
+ */
+export const LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL = (field: 'request roles' | 'declared owners'): string => `this db:reconcile payload `
+  + `carries ${field} that are not a list of role names, so the lifecycle catalog check cannot run. `
+  + 'Compile the declared layer from the models with this CLI and re-run.';
+
+/** An empty list treats no role as a request role, so no request role could reach a declared owner. */
+export const LIFECYCLE_REQUEST_ROLES_EMPTY_REFUSAL = 'this db:reconcile payload declares an empty list of request roles, so every declared owner '
+  + 'would pass the request-role guard. defineModule refuses that list; compile the declared layer from the models with this CLI and re-run.';
+
+const isRoleList = (value: unknown): value is string[] => Array.isArray(value) && value.every(role => typeof role === 'string');
+
 /** Generated by an older CLI (0.4.101's per-row restrict pair); a payload may still carry one it is replacing. */
 const RETIRED_LIFECYCLE_ROLES = ['restrict'] as const;
 
@@ -570,13 +933,15 @@ export function lifecycleTablesFromDeclared(declared: readonly SourceObject[]):
 /**
  * db:reconcile's lifecycle gate, local and in the ops Lambda alike: the destroy_log shape, the
  * declared layer's own consistency, the application roles' presence (fail closed), then the
- * catalog check. Null when nothing declared is lifecycle-owned. `applicationRoles` is `unknown`
- * because the ops Lambda reads it off the wire.
+ * catalog check. Null when nothing declared is lifecycle-owned. `applicationRoles`, `requestRoles`
+ * and `declaredOwners` are `unknown` because the ops Lambda reads them off the wire. The last two are
+ * optional: an older CLI sends neither, and the check runs as before. An older server ignores them:
+ * it refuses more, and it skips the live checks on the request roles (see ReconcileWirePayload).
  */
 export async function lifecycleReconcileRefusal(
   runner: QueryRunner,
   declared: readonly SourceObject[],
-  options: { applicationRoles?: unknown; lifecycleRole?: string } = {},
+  options: { applicationRoles?: unknown; requestRoles?: unknown; declaredOwners?: unknown; lifecycleRole?: string } = {},
 ): Promise<string | null> {
   if (!declared.some(object => object.owner === LIFECYCLE_OWNER_ROLE)) return null;
   const [log] = await runner(LIFECYCLE_LOG_SQL);
@@ -586,11 +951,16 @@ export async function lifecycleReconcileRefusal(
   if ('refusal' in derived) return derived.refusal;
   const roles = options.applicationRoles;
   if (!Array.isArray(roles) || roles.some(role => typeof role !== 'string')) return LIFECYCLE_ROLES_ABSENT_REFUSAL;
+  const { requestRoles, declaredOwners } = options;
+  if (requestRoles != null && !isRoleList(requestRoles)) return LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL('request roles');
+  if (declaredOwners != null && !isRoleList(declaredOwners)) return LIFECYCLE_ROLE_DECLARATION_MALFORMED_REFUSAL('declared owners');
+  if (Array.isArray(requestRoles) && requestRoles.length === 0) return LIFECYCLE_REQUEST_ROLES_EMPTY_REFUSAL;
   const unreadable = declared.filter(object => object.owner === LIFECYCLE_OWNER_ROLE && object.name.endsWith('_lifecycle_transition')
     && !lifecycleManifestOf(object)).map(object => object.identity).sort();
   if (unreadable.length > 0) return LIFECYCLE_MANIFEST_ABSENT_REFUSAL(unreadable);
   return lifecycleCatalogRefusal(runner, { lifecycleTables: derived.tables, applicationRoles: roles, dependentKeys: dependentKeysFromDeclared(declared),
-    nullifyUnrecorded: nullifyUnrecordedFromDeclared(declared) },
+    nullifyUnrecorded: nullifyUnrecordedFromDeclared(declared),
+    ...(requestRoles == null ? {} : { requestRoles, declaredOwners: isRoleList(declaredOwners) ? declaredOwners : [] }) },
     { lifecycleRole: options.lifecycleRole });
 }