@everystack/cli 0.4.81 → 0.4.83

package/src/cli/commands/db-check.ts

@@ -49,7 +49,8 @@ import {
   findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings, findPublicExecutableSecdef,
   findUnpinnedDefiners,
 } from '../derived-lint';
-import { step, success, fail, info, warn } from '../output';
+import { renderCheckVerdict } from '../plain-output';
+import { step, success, fail, info, warn, line as printLine } from '../output';
 
 // The role derivation moved to the shared builder (db-build) with brick
 // 5-remainder; re-exported here because db:check is where it grew up.
@@ -347,6 +348,10 @@ export async function executeEphemeralCompose(
 const MARK: Record<CheckFinding['level'], string> = { ok: '=', note: '·', warn: '~', fail: '!' };
 
 export async function dbCheckCommand(flags: Record<string, string>): Promise<void> {
+  // Default output is ONE line: `Up to date.` or `N changes pending. Run db:plan to review.`
+  // --verbose is every finding, the ephemeral compose report and the explanatory notes,
+  // exactly as they were. --json is unchanged either way: it is the machine channel.
+  const verbose = flags.verbose === 'true';
   const modelsPath = resolveModelsPath(flags.models);
   let models: ModelDescriptor[] | null = null;
   let modelsError: string | undefined;
@@ -378,7 +383,7 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
   const journal = await readJournal(path.resolve(flags.dir || DEFAULT_MIGRATIONS));
   const artifactRes = resolveSchemaOut(flags['schema-out'], journal, DEFAULT_SCHEMA_OUT);
   const artifactPath = artifactRes.path;
-  if (artifactRes.source === 'recorded') {
+  if (artifactRes.source === 'recorded' && verbose) {
     info(`schema-out: ${artifactPath} (recorded in the journal; override with --schema-out)`);
   }
   let artifactSource: string | null = null;
@@ -419,8 +424,12 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
     moduleModels: declaredDb?.models ?? null,
     baselineSource,
   });
-  for (const f of findings) {
-    (f.level === 'fail' || f.level === 'warn' ? warn : info)(`${MARK[f.level]} ${f.area}: ${f.message}`);
+  // Per-finding detail is the --verbose report. The quiet default answers the one question a
+  // human asked — is anything pending? — and names the verb that shows it.
+  if (verbose) {
+    for (const f of findings) {
+      (f.level === 'fail' || f.level === 'warn' ? warn : info)(`${MARK[f.level]} ${f.area}: ${f.message}`);
+    }
   }
 
   let ephemeral: EphemeralComposeResult | null = null;
@@ -428,9 +437,9 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
   const url = flags['database-url'] || process.env.DATABASE_URL;
   const staticFailed = checkFailed(findings);
   if (staticFailed) {
-    warn('ephemeral compose skipped — fix the static failures first.');
+    if (verbose) warn('ephemeral compose skipped — fix the static failures first.');
   } else if (!url) {
-    warn('ephemeral compose SKIPPED — no --database-url / DATABASE_URL. Point db:check at a scratch PostgreSQL for the full gate (it creates and drops an ephemeral database).');
+    if (verbose) warn('ephemeral compose SKIPPED — no --database-url / DATABASE_URL. Point db:check at a scratch PostgreSQL for the full gate (it creates and drops an ephemeral database).');
   } else {
     step('Composing the declared state from scratch on an ephemeral database...');
     try {
@@ -441,10 +450,10 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
         sequences: declaredDb?.sequences,
         extensions,
       });
-      for (const line of ephemeral.report) info(`  ${line}`);
+      if (verbose) for (const line of ephemeral.report) info(`  ${line}`);
     } catch (err: any) {
       ephemeralError = err.message;
-      warn(`! compose: the declared state does NOT build from scratch: ${ephemeralError}`);
+      if (verbose) warn(`! compose: the declared state does NOT build from scratch: ${ephemeralError}`);
     }
   }
 
@@ -465,19 +474,29 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
       ephemeralRan: ephemeral !== null,
       failed,
     }, null, 2));
-  } else if (failed) {
-    fail('db:check FAILED — the merged declared state is not shippable as-is (findings above).');
-  } else if (ephemeral !== null) {
-    success(`db:check passed — the declared state composes from scratch and lands on its own fingerprint (${ephemeral.fingerprint.slice(0, 12)}).`);
-    // Named because it kept being read as the stronger claim (a consumer, 2026-08-07): this
-    // ring proves the checkout against ITSELF, on an empty database. Whether an existing
-    // database IS this state is a different question with a different verb.
-    info('This proves the checkout is self-consistent and buildable — not that any existing database matches it. For that claim, run db:fingerprint against the database.');
-    // The ephemeral database is DROPPED. Saying so here is what stops this line being read
-    // as "you now have a database" — a consumer read exactly that into it, from our own docs.
-    info('The database this composed on was ephemeral and has been dropped. To build one you KEEP: everystack db:build --database-url <url>.');
+  } else if (verbose) {
+    if (failed) {
+      fail('db:check FAILED — the merged declared state is not shippable as-is (findings above).');
+    } else if (ephemeral !== null) {
+      success(`db:check passed — the declared state composes from scratch and lands on its own fingerprint (${ephemeral.fingerprint.slice(0, 12)}).`);
+      // Named because it kept being read as the stronger claim (a consumer, 2026-08-07): this
+      // ring proves the checkout against ITSELF, on an empty database. Whether an existing
+      // database IS this state is a different question with a different verb.
+      info('This proves the checkout is self-consistent and buildable — not that any existing database matches it. For that claim, run db:fingerprint against the database.');
+      // The ephemeral database is DROPPED. Saying so here is what stops this line being read
+      // as "you now have a database" — a consumer read exactly that into it, from our own docs.
+      info('The database this composed on was ephemeral and has been dropped. To build one you KEEP: everystack db:build --database-url <url>.');
+    } else {
+      success('db:check passed (static ring only — no database provided for the ephemeral compose).');
+    }
   } else {
-    success('db:check passed (static ring only — no database provided for the ephemeral compose).');
+    // THE QUIET DEFAULT — one line, always. What is "pending" is what this gate found wrong:
+    // every failing finding, plus the from-scratch build when it did not land where the models
+    // say it should. `db:plan` is the verb that shows each one against a real target, so it is
+    // the only command the line names. Re-run with --verbose to read the findings themselves.
+    for (const text of renderCheckVerdict(
+      findings.filter((f) => f.level === 'fail').length + (ephemeralFailed ? 1 : 0),
+    )) printLine(text);
   }
 
   if (failed) process.exit(1);

package/src/cli/commands/db-plan.ts

@@ -49,14 +49,14 @@ import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport } fr
 import { introspectSchema, type SchemaSnapshot } from '../schema-introspect';
 import { readStageStateTwice } from '../stage-read-consistency';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
-import { mintEdgePlan, planHash, buildPlanSummary, explainCarriedBy } from '../edge-plan';
+import { mintEdgePlan, planHash, buildPlanSummary, explainCarriedBy, declaredGranteesOf } from '../edge-plan';
 import { proveDescent, describeDriftOrigin, proveLineageLost, realLineageProbe, type ProveVerdict, type LineageProof } from '../git-descent';
 import { fingerprintLive, divergentSurfaces } from '../schema-fingerprint';
 import { predictLiveState } from '../edge-plan';
 import { readDescentLedger } from '../apply-execute';
 import { planBackfills, readBackfillLog } from '../backfill';
 import { readSqlDirIfPresent } from './db-sync';
-import { currentGitRef } from '../state-apply';
+import { currentGitRef, classifyGeneratedStatements, classifyDestructive } from '../state-apply';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
 import { borrowedSessionRunner, type SessionRunner } from '../session';
 import { resolveModelsPath } from '../models-path';
@@ -70,7 +70,8 @@ import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../auth
 import { alterTypeStatementTargets, findAlterTypeDependents, renderAlterTypeRefusal } from '../alter-type-dependents';
 import { compileTableContract } from '../authz-compile';
 import { reportPipelineLastRun } from './pipeline-run';
-import { step, success, fail, info, warn, reserveStdoutForData } from '../output';
+import { renderPlanReport } from '../plain-output';
+import { step, success, fail, info, warn, line as printLine, reserveStdoutForData } from '../output';
 
 /**
  * What db:plan says about descent at mint — SYMMETRIC with what db:apply will do, because a mint
@@ -181,6 +182,10 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
   // the adoption report and the ownership report land on stderr and the plan JSON is the
   // only thing on stdout — otherwise `db:plan --out - | jq` reads a report as its input.
   if (out === '-') reserveStdoutForData();
+  // --verbose is where the FULL internal report lives, unchanged: the edge summary, the kind
+  // histogram, the adoption and ownership reports, the plan ref. Default output is the plain
+  // change list (plain-output.ts) and nothing else — see that module for why.
+  const verbose = flags.verbose === 'true';
 
   let dbSource: DbSource;
   try {
@@ -345,36 +350,43 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
     //    divergence. The foreign grants are ABSORBED into `to`, so they are NOT the cause; naming
     //    them would misdirect. Name the divergent surface of the FULL prediction vs live instead.
     const emptyEdge = plan.statements.length === 0;
-    const carriedBy = !emptyEdge
-      ? undefined
-      : plan.fromFingerprint === plan.toFingerprint
-        ? explainCarriedBy(exemptions, [])
-        : divergentSurfaces(
-          predictLiveState(models, snapshot, contract, { governedRoles: governedRoleSet(declaredAuthz, declaredGovernedRoles), carryUngoverned: true }).canonical,
-          fingerprintLive(snapshot, contract).canonical,
-        );
-    for (const line of buildPlanSummary(plan, carriedBy ? { carriedBy } : {})) info(line);
-    info(`plan_ref: ${planHash(plan).slice(0, 12)}`);
+    if (verbose) {
+      const carriedBy = !emptyEdge
+        ? undefined
+        : plan.fromFingerprint === plan.toFingerprint
+          ? explainCarriedBy(exemptions, [])
+          : divergentSurfaces(
+            predictLiveState(models, snapshot, contract, { governedRoles: governedRoleSet(declaredAuthz, declaredGovernedRoles), carryUngoverned: true }).canonical,
+            fingerprintLive(snapshot, contract).canonical,
+          );
+      for (const line of buildPlanSummary(plan, carriedBy ? { carriedBy } : {})) info(line);
+      info(`plan_ref: ${planHash(plan).slice(0, 12)}`);
+
+      // WHY does each authorization statement exist? — the same report db:generate prints,
+      // on the artifact a human actually reviews before applying.
+      //
+      // Re-DERIVED from live every mint, never stored: a recorded claim about what the models
+      // fail to capture goes stale the moment someone closes the gap, and a stale note is worse
+      // than none. `capability` is the count that says "this plan removes something the model
+      // cannot express" — the operator reading this is the last one who can catch it.
+      const adoptionTotal = Object.values(adoption.counts).reduce((a, b) => a + b, 0);
+      if (adoptionTotal > 0) {
+        info(`${adoptionTotal} authorization statement(s), by why they exist:`);
+        for (const line of renderAdoptionReport(adoption.counts, adoption.statements)) info(line);
+      }
 
-    // WHY does each authorization statement exist? — the same report db:generate prints,
-    // on the artifact a human actually reviews before applying.
-    //
-    // Re-DERIVED from live every mint, never stored: a recorded claim about what the models
-    // fail to capture goes stale the moment someone closes the gap, and a stale note is worse
-    // than none. `capability` is the count that says "this plan removes something the model
-    // cannot express" — the operator reading this is the last one who can catch it.
-    const adoptionTotal = Object.values(adoption.counts).reduce((a, b) => a + b, 0);
-    if (adoptionTotal > 0) {
-      info(`${adoptionTotal} authorization statement(s), by why they exist:`);
-      for (const line of renderAdoptionReport(adoption.counts, adoption.statements)) info(line);
     }
 
     // WHO owns the tables this plan authorizes, and does that owner obey the policies it
     // is about to write? Re-derived live every mint, never stored — the owner is a fact
     // about THIS target, and the target is the one thing a committed artifact cannot carry.
+    //
+    // Its `!` lines are PROBLEMS (an owner that bypasses the policies this plan writes), so they
+    // survive the quiet default — "show only problems" is the rule, not "show only the list".
+    // The rest of the report is description and moves behind --verbose.
     for (const line of renderOwnershipReport(buildOwnershipReport(owners, contract, { models }))) {
       if (line.trimStart().startsWith('!')) warn(line.trim());
-      else info(line);
+      else if (verbose) info(line);
     }
 
     // The fast-forward rule, warn-only at mint time (db:apply enforces it):
@@ -416,12 +428,34 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
     }
 
     await reportPipelineLastRun(runner);
+
+    // THE DEFAULT REPORT — the only thing a reader sees when nothing is wrong.
+    //
+    // `executable` is what the apply will really run (notices and held drops are comments by
+    // construction). The destructive subset is recomputed with the SAME classifier and the SAME
+    // declared-grantee set the mint used for `plan.destructive`, so the ⚠ lines and the --confirm
+    // gate cannot disagree about what destroys. Nothing here decides anything; it only prints.
+    const executable = classifyGeneratedStatements(plan.statements).executable;
+    const { drops, narrowings, strips } = classifyDestructive(executable, {
+      declaredGrantees: declaredGranteesOf(models),
+    });
+    for (const text of renderPlanReport({
+      executable,
+      destructive: [...drops, ...narrowings, ...strips],
+      target: stageName,
+      stage: flags.stage ?? null,
+      planPath: out === '-' ? null : out,
+    })) printLine(text);
+
     if (out !== '-') {
-      success(`Wrote ${out} — review it, then \`everystack db:apply --plan ${out}\`.`);
-      warn('Plans are ephemeral release artifacts — attach to the run, do NOT commit.');
+      if (verbose) {
+        success(`Wrote ${out} — review it, then \`everystack db:apply --plan ${out}\`.`);
+        warn('Plans are ephemeral release artifacts — attach to the run, do NOT commit.');
+      }
       // "Do NOT commit" is advice; git is what enforces it. The default lands in the app
       // root, so an adopter following the happy path gets an untracked, unignored artifact
       // sitting next to their source with only a log line between it and a `git add .`.
+      // A problem, so it stays in the quiet default.
       if (!isGitIgnored(out)) {
         warn(`${out} is NOT gitignored — add it, or the next \`git add .\` commits the plan: echo '${out}' >> .gitignore`);
       }

package/src/cli/commands/db-pull.ts

@@ -2,7 +2,7 @@
  * `everystack db:pull` — generate `field()` Models from a live database (the brownfield on-ramp).
  *
  *   db:pull [--stage <name>] [--database-url <url>] [--schema public] [--out <dir | file.ts>]
- *           [--derived-out <file.ts>] [--abilities live|public-read]
+ *           [--derived-out <file.ts | dir>] [--abilities live|public-read]
  *
  * `--stage` and `--database-url` COMPOSE: the URL picks the connection, the stage names the
  * baseline entry (`db/authz-baseline.json` is per-stage — a local adoption pulls with
@@ -29,6 +29,16 @@
  * the contract kebab files, `export const derived/sequences` arrays — instead of riding
  * the models render. Alone, it leaves the models untouched (the hand-maintained-barrel
  * case); with `--out`, the models render omits the now-external derived layer.
+ *
+ * `--derived-out <dir>` (anything not ending in `.ts`) splits that same layer by kind and
+ * schema instead of one module: `views.ts`, one `functions-<schema>.ts` per schema, `triggers.ts`,
+ * and an `index.ts` barrel that imports every split file plus the model files and re-exports
+ * exactly what the single-file form exports. Model files are assumed to sit in the PARENT of
+ * the derived directory — the same co-location the single-file form already relies on
+ * (`db/models/derived.ts` beside `db/models/*.ts` becomes `db/models/derived/` inside it).
+ * The import graph between split files is the RENDERED-ref graph, not the catalog graph — a
+ * cycle there is fatal at import time (TDZ), so it is detected and refused before anything is
+ * written, never shipped as a barrel nobody can import.
  */
 
 import fs from 'node:fs/promises';
@@ -71,7 +81,7 @@ export function pullOnRampRunbook(opts: { stage?: string; out?: string; abilitie
 import { introspectContract, type TableContract, type AuthzContract } from '../authz-contract';
 import { introspectTableOwners, buildOwnershipReport, renderOwnershipReport, type TableOwner } from '../authz-ownership';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog';
-import { renderDerivedSource, renderDerivedFile, type DerivedRenderResult } from '../derived-render';
+import { renderDerivedSource, renderDerivedFile, renderDerivedDirectory, type DerivedRenderResult } from '../derived-render';
 import { renderModelSource, renderModelFiles, pullableTables, skippedInfrastructureTables, modelVarName, ABILITY_PRESETS } from '../model-render';
 import { deriveAbilities } from '../authz-derive';
 import type { QueryRunner } from '../authz-contract';
@@ -148,12 +158,32 @@ export async function dbPullCommand(flags: Record<string, string>): Promise<void
 
   // --derived-out: the brownfield splice, first-class. A consumer with an existing
   // hand-maintained barrel wants the derived layer as its own file — not codemodded
-  // out of a rendered monolith. Validated before any introspection.
+  // out of a rendered monolith. `--derived-out <file.ts>` is the single module (unchanged);
+  // anything not ending in `.ts` is a DIRECTORY — split by kind and schema (views.ts,
+  // functions-<schema>.ts, triggers.ts, index.ts barrel) for a real schema's derived layer,
+  // which otherwise renders as one unreviewable multi-thousand-line file.
+  //
+  // TWO shapes, and only two: a `.ts` file, or a directory (no extension, trailing slash
+  // optional). A name carrying any OTHER extension is a typo, never a directory anyone
+  // meant — `--derived-out db/models/derived.tsx` used to fail loudly under the old
+  // `.ts`-only check and would otherwise now create a directory literally called
+  // `derived.tsx/`, silently, with the whole derived layer inside it.
   const derivedOut = flags['derived-out'];
-  if (derivedOut && !derivedOut.endsWith('.ts')) {
-    fail(`--derived-out must name a .ts file (got '${derivedOut}') — e.g. --derived-out db/models/derived.ts.`);
-    process.exit(1);
+  if (derivedOut) {
+    // A trailing separator is the operator SAYING directory — it settles the shape on its
+    // own, so the extension question never arises.
+    const saysDirectory = /[\\/]$/.test(derivedOut);
+    const base = path.basename(derivedOut);
+    if (!saysDirectory && /\.[a-zA-Z0-9]+$/.test(base) && !base.endsWith('.ts')) {
+      fail(
+        `--derived-out ${derivedOut}: '${base}' carries a file extension that is not .ts. `
+        + `Name a .ts file for the single-module form (--derived-out db/models/derived.ts), or a directory `
+        + `for the split form (--derived-out db/models/derived) — nothing else is a shape this writes.`,
+      );
+      process.exit(1);
+    }
   }
+  const derivedOutIsDir = Boolean(derivedOut) && !derivedOut.endsWith('.ts');
 
   // The read-model scaffold: default 'commented' surfaces the authz decision in every
   // model; a preset stamps it. Validated up front so a typo fails before introspection.
@@ -375,19 +405,45 @@ export async function dbPullCommand(flags: Record<string, string>): Promise<void
     caution('Matviews carry no PK/NOT NULL — the rendered fields are nullable and unkeyed; tighten (.primaryKey()/.notNull()) as you review. Unique matview indexes render as index().unique() constraints.');
   }
 
-  // The standalone derived file. The models output (below) then omits the derived
-  // layer — it lives here, and the module wires both: defineModule({ models, sequences, derived }).
+  // The standalone derived file (or directory). The models output (below) then omits the
+  // derived layer — it lives here, and the module wires both:
+  // defineModule({ models, sequences, derived }).
   if (derivedOut) {
     const outPath = path.resolve(derivedOut);
+    let fileCount = 1;
     try {
-      await fs.mkdir(path.dirname(outPath), { recursive: true });
-      await fs.writeFile(outPath, renderDerivedFile(derived, knownTables), 'utf8');
+      if (derivedOutIsDir) {
+        // A cycle between split files is fatal at import time (TDZ) — refused here, before
+        // anything is written, rather than shipping a barrel nobody can import.
+        const files = renderDerivedDirectory(derived, knownTables, outPath);
+        await fs.mkdir(outPath, { recursive: true });
+        // The split set SHRINKS: drop the last function in `auth` and this pull no longer
+        // writes functions-auth.ts, but the previous pull's copy is still on disk declaring
+        // objects the database no longer has — and the regenerated index.ts no longer imports
+        // it, so nothing else will ever mention it again. Named, never deleted: same posture
+        // as the --out <dir> model writer below, which leaves stray files alone and says so.
+        const written = new Set(files.map((f) => f.file));
+        const stale = (await fs.readdir(outPath)).filter((f) => f.endsWith('.ts') && !written.has(f));
+        for (const f of files) await fs.writeFile(path.join(outPath, f.file), f.source, 'utf8');
+        fileCount = files.length;
+        if (stale.length) {
+          caution(
+            `${stale.length} existing .ts file(s) in ${path.relative(process.cwd(), outPath)} were not part of this pull `
+            + `and were left untouched: ${stale.join(', ')}. The new index.ts does not import them — delete them, or they `
+            + `stay as a declaration of objects this pull did not find.`,
+          );
+        }
+      } else {
+        await fs.mkdir(path.dirname(outPath), { recursive: true });
+        await fs.writeFile(outPath, renderDerivedFile(derived, knownTables), 'utf8');
+      }
     } catch (err: any) {
       fail(`Could not write ${derivedOut}: ${err.message}`);
       process.exit(1);
     }
     const mtPart = derived.materializedTableNames.length ? ` + ${derived.materializedTableNames.length} materialized table(s)` : '';
-    ok(`Wrote ${path.relative(process.cwd(), outPath)} — ${derived.names.length} descriptor(s) + ${derived.sequenceNames.length} sequence(s)${mtPart}, self-contained.`);
+    const shape = derivedOutIsDir ? `${fileCount} file(s)` : 'self-contained';
+    ok(`Wrote ${path.relative(process.cwd(), outPath)} — ${derived.names.length} descriptor(s) + ${derived.sequenceNames.length} sequence(s)${mtPart}, ${shape}.`);
     note(`Wire it on your module — defineModule({ models${derived.materializedTableNames.length ? ': [...models, ...materializedTables]' : ''}${derived.sequenceNames.length ? ', sequences' : ''}, derived }) — then adopt with db:reconcile --apply --baseline (--rebaseline over db/sql-era provenance).`);
     if (!flags.out) {
       // The brownfield case: the barrel is hand-maintained; leave the models alone.

package/src/cli/commands/db-reconcile.ts

@@ -58,6 +58,8 @@ import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, t
 import { currentGitRef } from '../state-apply';
 import { resolveConfig, opsFunction } from '../config';
 import { invokeAction, lambdaQueryRunner, lambdaSessionRunner } from '../aws';
+import { modelContractPreflight } from '../model-wire-lane';
+import { MODEL_WIRE_CONTRACT, type ReconcileWirePayload } from '../../wire';
 import { step, success, fail, info, warn } from '../output';
 
 // ---------------------------------------------------------------------------
@@ -661,7 +663,26 @@ export async function dbReconcileCommand(flags: Record<string, string>): Promise
     if (apply && dbSource.kind !== 'url') {
       step('Resolving deployed config...');
       const config = await resolveConfig(flags.stage);
-      const result: any = await invokeAction(config.region, opsFunction(config), 'db:reconcile', reconcileOptions);
+
+      // The CLI half of the Model-derived wire handshake — same runner, same wording as
+      // db:provision's. `declared` is the derived layer this checkout compiled, and the ops Lambda
+      // CREATES AND REPLACES database objects from it, so verify the stage understands the
+      // descriptor shape BEFORE sending it.
+      await modelContractPreflight({
+        region: config.region,
+        fn: opsFunction(config),
+        directCommand: `everystack db:reconcile --apply --stage ${flags.stage ?? '<stage>'} --direct`,
+        // Nothing has been written at this point, so the refusal is the whole story: it names
+        // the skew, says nothing was sent, and offers --direct. Print it and exit.
+        onRefusal: 'exit',
+      })('db:reconcile');
+
+      const result: any = await invokeAction(
+        config.region,
+        opsFunction(config),
+        'db:reconcile',
+        { ...reconcileOptions, modelContract: MODEL_WIRE_CONTRACT } satisfies ReconcileWirePayload,
+      );
       if (result?.error) {
         fail(`db:reconcile failed: ${result.error}`);
         if (/Unknown action/i.test(String(result.error))) {