@everystack/cli 0.4.89 → 0.4.91

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.89",
+  "version": "0.4.91",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db-apply.ts

@@ -266,7 +266,22 @@ async function runCatchUp(
       onStart: () => step('Catching the functions, views and triggers up to the checkout...'),
       onRefusal,
     });
-    if (verbose && outcome.run) for (const text of buildReconcileReport(outcome.run.plan)) info(text);
+    if (outcome.run) {
+      if (verbose) {
+        for (const text of buildReconcileReport(outcome.run.plan)) info(text);
+      } else if (outcome.run.plan.needsBaseline.length > 0) {
+        // NOT gated behind --verbose. A first-contact match (an object that predates Models
+        // tracking) is silently SKIPPED here — the reconciler will not guess whether live
+        // matches source — so a catch-up that only ever prints its full report under --verbose
+        // reads as "nothing to do" while real brownfield objects are left permanently
+        // unverified. This is the exact silence a consumer's derived-layer incident traced back
+        // to: db:apply reported success on every deploy while these objects sat unreconciled.
+        warn(
+          `${outcome.run.plan.needsBaseline.length} derived object(s) skipped (never reconciled, so this catch-up cannot tell whether live matches source): ${outcome.run.plan.needsBaseline.join(', ')} — ` +
+          'run `everystack db:reconcile --baseline` to record trust once you have verified it matches, or `--rebuild` to force it from source. Does not fail this apply.',
+        );
+      }
+    }
     return { ok: true, statements: outcome.statements };
   } catch (err: any) {
     const cause = String(err?.message ?? err);

package/src/cli/commands/db-plan.ts

@@ -64,7 +64,10 @@ import { resolveConfig, opsFunction } from '../config';
 import { resolveOperatorUrlViaStage } from '../direct-venue';
 import { lambdaQueryRunner, lambdaSessionRunner } from '../aws';
 import { loadModels } from './db-generate';
-import { loadDeclaredDerived } from '../declared-derived';
+import { loadDeclaredDerived, type DeclaredDerived } from '../declared-derived';
+import { introspectDerived } from '../derived-introspect';
+import { planReconcile } from '../derived-plan';
+import { checkFails, buildReconcileReport } from './db-reconcile';
 import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
 import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
 import { alterTypeStatementTargets, findAlterTypeDependents, renderAlterTypeRefusal } from '../alter-type-dependents';
@@ -269,10 +272,13 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
     // The modules' extensions ride the same read. Without them the plan omits every
     // CREATE EXTENSION the target lacks, and the apply fails on a type the plan promised.
     let declaredExtensions: string[] = [];
+    // Kept for the derived-layer visibility check below — this IS the declared derived layer
+    // (functions/views/matviews/triggers), read once and reused rather than loaded twice.
+    let declaredDerived: DeclaredDerived | null = null;
     try {
-      const declared = await loadDeclaredDerived(flags.models);
-      declaredGovernedRoles = declared?.governedRoles ?? [];
-      declaredExtensions = declared?.extensions ?? [];
+      declaredDerived = await loadDeclaredDerived(flags.models);
+      declaredGovernedRoles = declaredDerived?.governedRoles ?? [];
+      declaredExtensions = declaredDerived?.extensions ?? [];
     } catch {
       // The barrel's own compose errors surface on the paths that need the derived layer;
       // a plan must not fail to mint because a module could not be read for this one field.
@@ -456,6 +462,33 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
       }
     }
 
+    // DERIVED-LAYER VISIBILITY — db:apply ALWAYS reconciles functions/views/matviews/triggers
+    // against the models, whether or not a --plan is passed; the edge this command mints never
+    // covers that layer. Without this, an empty table/column/grant edge reads as "the target
+    // matches the checkout" even when a function body changed underneath it — an operator who
+    // trusts an empty plan never learns db:apply still has work to do. Read-only: the same pure
+    // planReconcile() that backs `db:reconcile --check`, applied to nothing here — advisory
+    // only, like the FK-orphan and backfill checks above, so it can go stale between mint and
+    // apply without corrupting the plan file (see the file header's rationale for why nothing
+    // read-time-only belongs in the artifact).
+    if (declaredDerived) {
+      try {
+        const liveDerived = await introspectDerived(session);
+        const derivedPlan = planReconcile(
+          { objects: declaredDerived.objects, warnings: [] },
+          liveDerived,
+          { renamedTables: declaredDerived.renamedTables },
+        );
+        if (checkFails(derivedPlan)) {
+          warn('derived layer out of sync (functions/views/matviews/triggers) — this plan does not preview these, only tables/columns/grants:');
+          for (const line of buildReconcileReport(derivedPlan)) warn(`  ${line}`);
+          warn('db:apply always catches up the derived layer, --plan or not — run it to reconcile the above.');
+        }
+      } catch (err: any) {
+        warn(`derived-layer check could not run against this target (${err?.message ?? err}) — db:plan cannot say whether functions/views/matviews/triggers are in sync.`);
+      }
+    }
+
     await reportPipelineLastRun(runner);
 
     // THE DEFAULT REPORT — the only thing a reader sees when nothing is wrong.

package/src/cli/commands/db-reconcile.ts

@@ -476,6 +476,7 @@ export function buildReconcileReport(plan: ReconcilePlan): string[] {
   for (const a of plan.actions) {
     const cost = a.bytes !== undefined ? `; ${formatBytes(a.bytes)}${a.rows ? `, ~${a.rows} rows` : ''}` : '';
     lines.push(`${VERB_GLYPH[a.action] ?? '?'} ${a.action} ${a.identity} (${a.reason}${cost})`);
+    for (const r of a.revokes ?? []) lines.push(`    - ${r} (no longer declared)`);
   }
   // Pending identity migrations. Bookkeeping only — no DDL, no object changed — but they ARE a
   // write, and they were invisible here while also being excluded from `checkFails`. Silence in

package/src/cli/derived-apply.ts

@@ -140,9 +140,11 @@ export type OwnerApplyMode = 'set-role' | 'alter-owner';
  * carry pg_dump's WITH NO DATA ordering.)
  *
  * A declared owner is enacted one of two ways; see {@link OwnerApplyMode} for which and why.
+ * `revokes` (a replace's REVOKEs of dropped grantees) trail the attachments, inside the owner
+ * block for the same reason the attachments are.
  */
-function objectSql(obj: SourceObject, ownerMode: OwnerApplyMode = 'set-role'): string[] {
-  const statements = [obj.sql, ...obj.attachments.map((a) => a.sql)];
+function objectSql(obj: SourceObject, ownerMode: OwnerApplyMode = 'set-role', revokes: readonly string[] = []): string[] {
+  const statements = [obj.sql, ...obj.attachments.map((a) => a.sql), ...revokes];
   if (obj.kind === 'materialized view' && WITH_NO_DATA_RE.test(normalizeSql(obj.sql))) {
     statements.push(`REFRESH MATERIALIZED VIEW ${quoteQualified(obj.identity)}`);
   }
@@ -457,7 +459,7 @@ export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[],
       case 'replace': {
         const obj = srcById.get(action.identity);
         if (!obj) throw new Error(`replace action for ${action.identity} has no source object`);
-        statements.push(...objectSql(obj, ownerMode).map(ensureOrReplace));
+        statements.push(...objectSql(obj, ownerMode, action.revokes).map(ensureOrReplace));
         record.push(action.identity);
         break;
       }

package/src/cli/derived-grants.ts

@@ -62,6 +62,12 @@ export function isPlainGrantAttachment(a: Attachment): boolean {
   return g !== null && !g[2]; // g[2] is the (columns) group — present => column-scoped => not plain
 }
 
+/** Whether the attachments run a `REVOKE ALL … FROM PUBLIC` — PUBLIC holds nothing after them
+ *  beyond what a later attachment grants it back. */
+export function revokesPublic(attachments: readonly Attachment[]): boolean {
+  return attachments.some((a) => a.kind === 'grant' && REVOKE_PUBLIC_RE.test(a.sql));
+}
+
 /** The declared grant contract, read back from an object's own grant attachments. */
 export function parseGrantAttachments(attachments: readonly Attachment[]): ParsedGrants {
   const grants: Record<string, Set<string>> = {};
@@ -86,7 +92,12 @@ export function parseGrantAttachments(attachments: readonly Attachment[]): Parse
     target ??= onTarget.trim();
     const privileges = privilegeList.split(',').map((p) => p.trim().toUpperCase()).filter(Boolean);
     for (const role of roleList.split(',').map((r) => r.trim()).filter(Boolean)) {
-      for (const privilege of privileges) (grants[role] ??= new Set()).add(privilege);
+      // PUBLIC is a keyword, not a role: `TO public` and `TO PUBLIC` are one grantee, and the live
+      // read spells it `PUBLIC` (the table path's granteeKey, same rule). Keyed as written, a
+      // lowercase declaration read as a REVOKE from PUBLIC plus a GRANT to `public` — a replace,
+      // which keeps only the REVOKE, removed every caller's access.
+      const grantee = role.toLowerCase() === 'public' ? 'PUBLIC' : role;
+      for (const privilege of privileges) (grants[grantee] ??= new Set()).add(privilege);
     }
   }
 

package/src/cli/derived-plan.ts

@@ -27,7 +27,7 @@
 import { type ParsedSources, type SourceObject, type DerivedKind } from './derived-source';
 import type { DerivedCatalog, LiveObject } from './derived-introspect';
 import { triggerDropSql } from './derived-apply';
-import { parseGrantAttachments, diffObjectGrants } from './derived-grants';
+import { parseGrantAttachments, diffObjectGrants, revokesPublic } from './derived-grants';
 import { legacyFunctionIdentity, splitFunctionIdentity } from './pg-argtypes';
 
 export type ReconcileVerb = 'create' | 'replace' | 'refresh' | 'drop' | 'baseline' | 'rebaseline' | 'prune' | 'backfill';
@@ -43,6 +43,10 @@ export interface ReconcileAction {
   /** Drops for the structural kinds — a trigger's `DROP TRIGGER … ON table`, a 'sql'
    *  object's recorded/declared drop. Legacy kinds keep the keyword rendering. */
   dropSql?: string;
+  /** A replace's REVOKEs of grantees the source no longer declares. CREATE OR REPLACE keeps the
+   *  live ACL and the attachments only add, so without these a dropped role keeps its privilege.
+   *  They run with the replace, inside its owner block — REVOKE on a function needs its owner. */
+  revokes?: string[];
 }
 
 export interface DriftFinding {
@@ -461,6 +465,10 @@ export function planReconcile(
 
   const regrants: RegrantFinding[] = [];
   const dependencyDrift: DependencyDriftFinding[] = [];
+  const ownerContext = (src: SourceObject, liveObj: LiveObject): { declared?: string; live?: string } => ({
+    ...(src.owner !== undefined ? { declared: src.owner } : {}),
+    ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}),
+  });
   // Rebaselined objects join the lens: their live catalog rows are as real as a skip's,
   // and running the checks NOW means a migration converges (grants ride the same apply)
   // instead of surfacing on the next plan.
@@ -493,11 +501,7 @@ export function planReconcile(
         // KNOWN LIMIT: a privilege an owner has deliberately self-revoked is not restored — that
         // is a failure to ADD access (availability), never to remove it, and unnormalized code did
         // not converge on it either.
-        const owners = {
-          ...(src.owner !== undefined ? { declared: src.owner } : {}),
-          ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}),
-        };
-        const { statements, suppressed } = diffObjectGrants(target, parsed.grants, liveObj.grants, owners);
+        const { statements, suppressed } = diffObjectGrants(target, parsed.grants, liveObj.grants, ownerContext(src, liveObj));
         if (statements.length > 0) regrants.push({ identity: src.identity, statements });
         // Never silent: a withheld revoke is reported every run until the owner is declared.
         for (const note of suppressed) extraWarnings.push(note);
@@ -631,6 +635,34 @@ export function planReconcile(
     return { action, identity: id, kind, reason, ...cost, ...structural };
   };
 
+  /**
+   * The REVOKEs a function replace needs to converge its ACL in the same apply.
+   *
+   * CREATE OR REPLACE keeps the live ACL, and the compiled attachments only ADD: a REVOKE ALL
+   * FROM PUBLIC (unless PUBLIC is declared), then one GRANT per declared role. So a role dropped
+   * from the abilities in the same change as a body edit kept its EXECUTE until a second apply
+   * found it as grant drift. The ACL after the replace is the live one minus PUBLIC (when the
+   * attachments revoke it) plus the declared grants, so only the REVOKEs of the diff are left
+   * to do. They ride the replace itself rather than the regrant pass, because the replace runs
+   * inside its owner's SET ROLE block and a REVOKE on a function needs its owner.
+   *
+   * Read after the dependency cascade: a function it promoted to drop+create is recreated with a
+   * fresh ACL from its attachments alone, and is no longer in fnReplace.
+   */
+  const replaceRevokes = (id: string): string[] => {
+    const src = srcById.get(id);
+    const liveObj = liveById.get(id);
+    if (!src || !liveObj || liveObj.grants === undefined) return [];
+    const parsed = parseGrantAttachments(src.attachments);
+    if (parsed.hasColumnGrants) return [];
+    const target = parsed.target ?? `FUNCTION ${src.identity}`;
+    const afterReplace = { ...liveObj.grants };
+    if (revokesPublic(src.attachments)) delete afterReplace.PUBLIC;
+    const { statements, suppressed } = diffObjectGrants(target, parsed.grants, afterReplace, ownerContext(src, liveObj));
+    for (const note of suppressed) extraWarnings.push(note);
+    return statements.filter((st) => /^REVOKE\b/i.test(st));
+  };
+
   const actions: ReconcileAction[] = [
     ...orderDrops(dropSet).map((id) => actionFor(id, 'drop', rebuild.get(id) ?? drop.get(id) ?? '')),
     // 'sql'-kind drops (rebuilds + removals) — invisible to the live catalog, so they
@@ -638,7 +670,10 @@ export function planReconcile(
     ...[...sqlDrops.entries()].sort((a, b) => a[0].localeCompare(b[0]))
       .map(([id, d]) => ({ action: 'drop' as const, identity: id, kind: 'sql' as DerivedKind, reason: d.reason, dropSql: d.dropSql })),
     ...[...fnReplace.entries()].sort((a, b) => seqOf(a[0]) - seqOf(b[0]))
-      .map(([id, reason]) => actionFor(id, 'replace', reason)),
+      .map(([id, reason]) => {
+        const revokes = replaceRevokes(id);
+        return { ...actionFor(id, 'replace', reason), ...(revokes.length ? { revokes } : {}) };
+      }),
     ...createSet.sort((a, b) => seqOf(a) - seqOf(b))
       .map((id) => actionFor(id, 'create', rebuild.get(id) ?? create.get(id) ?? '')),
     ...[...refresh.entries()].sort((a, b) => seqOf(a[0]) - seqOf(b[0]))

package/src/cli/index.ts

@@ -331,8 +331,8 @@ Usage:
   everystack db:refresh        [--stage <name> | --database-url <url> | --direct] [--only a,b] [--verify-nonempty] [--list]  Refresh the declared materialized views in dependency order, credential-free. --stage runs the whole refresh in the ops Lambda on the operator connection (no URL on the operator's machine — the data-lane twin of the reconcile lane); --database-url refreshes over a local connection (dev); --stage <name> --direct resolves the stage's operator connection from its ops Lambda (credential never on argv) and refreshes CLI-side on an UNBOUNDED clock, for a matview set that exceeds the ops-Lambda 900s limit; --only refreshes a named subset (full identity or bare name); --verify-nonempty gates on populated-but-zero-rows matviews (the dark-panel check — a scoped EXISTS on just what was refreshed, so a promotion script gets the gate with no read authority) and FAILS naming any empty; --list previews the order without connecting. Plain REFRESH (ACCESS EXCLUSIVE); fail-fast, idempotent to re-run.
   everystack db:sync           [--database-url <url>] [--models <barrel>] [--schema-out <file.ts>] [--allow-drops] [--overwrite-drift] [--baseline] [--json]  Make the database match your checkout — one verb, both layers: apply the state diff (tables+authz, one transaction, verified by re-diff), reconcile the derived layer against the declared descriptors, report the resulting fingerprint vs the models' declared one. Dev databases only (direct connection required); DROPs held back unless --allow-drops; derived drift refuses unless --overwrite-drift; exit 1 when not converged
   everystack db:diff           --from-models <barrel> [--to-models db/models/index.ts] [--allow-drops] [--check] [--json]  The state edge between two declared states, NO database: the SQL db:generate would produce, computed purely — CI plan previews (--check exits 1 on a non-empty edge) and computed rollbacks (swap the flags)
-  everystack db:plan           [--stage <name> [--direct] | --database-url <url>] [--models <barrel>] [--allow-drops] [--out db.plan.json | --out -] [--verbose]  Mint a verified edge against a target: asks the TARGET its fingerprint, diffs the models, writes ONE reviewable plan (edge + both endpoint fingerprints). Held drops refuse the mint (--allow-drops carries destruction explicitly). Read-only; plans are ephemeral, never committed. VENUES: --stage runs via the ops Lambda, which reads TWICE and refuses on disagreement — agreement there is a DETECTOR, not a verification. --stage --direct resolves the stage's operator connection from its IAM-gated ops Lambda, holds it in memory only, and reads ONCE over one session: the lane for a fingerprint you intend to trust, with the credential never on argv. --database-url is the local-dev venue (same read guarantee, but against a deployed stage it puts a privileged DSN on the command line) DEFAULT OUTPUT is the plain change list: '+' something is now true, '-' something is no longer true, and a '⚠ DESTRUCTIVE' line of its own when real data can be lost. Nothing else. --verbose restores the full internal report (edge summary, kind histogram, adoption and ownership reports, plan ref)
-  everystack db:apply          [--plan <file.plan.json>] [--database-url <url>] [--stage <name>] [--models <barrel>] [--confirm] [--state-only] [--snapshot-ref <ref>] [--attest-lineage-lost <sha>] [--verbose]  THE deploy verb — it does the WHOLE job: the reviewed plan (tables, columns, grants), then ALWAYS the functions, views, matviews and triggers, against the same target, reported as one receipt. With NO --plan it does the catch-up alone (this is what replaces running db:reconcile --apply by hand). --state-only skips the catch-up for the narrow case that wants the tables alone. If the plan lands and the catch-up then fails, the exit is non-zero and the message says the table/column changes are committed and safe and gives the rerun, which retries only the catch-up. Run a reviewed plan: verify the target is EXACTLY where the plan started (live fingerprint == plan.from, else refuse — the concurrency lock), verify the checkout DESCENDS from the commit declaring the target's state (the fast-forward rule — it protects MERGED work: a commit on any ref that declares the live state and is not an ancestor of HEAD refuses by name, escaped git-natively by fetch + merge/rebase + re-plan; --attest-lineage-lost <sha> waives it ONLY for a declaring commit proven gone from every ref. When NO commit on ANY ref declares the live state — a database everystack never wrote, or one hand-edited since its last apply — the rule has nothing to protect: over a full, current clone that is PROVEN DRIFT, the reviewed plan is the ORIGIN, it applies with a loud warning, and the origin is recorded in schema_log so every later apply descends from it. A shallow, partial, or behind-remote clone, or a models tree that will not compile, is UNVERIFIABLE and refuses with a fetch/prune runbook), and for DESTRUCTIVE plans require --confirm always + a confirmed rollback point + the stage's approver set when declared (STS identity-verified). The STAGE lane (--stage without --direct) runs every catalog query in its own ops-Lambda invoke, so one read can be assembled from several containers: it reads the target TWICE and REFUSES when the two disagree (inconsistent containers), reports agreement as a NON-DETECTION (it cannot verify read consistency), and REFUSES a DESTRUCTIVE plan outright — destructive applies go over --database-url (direct) with the full ceremony. Every refusal that reaches the ops Lambda is recorded in schema_log. Apply as one transaction (plan_ref stamped), verify it landed exactly on plan.to; idempotent when already there DEFAULT OUTPUT is the receipt: the same change lines back, then 'Applied N changes.'. --verbose restores the endpoint and plan-ref line
+  everystack db:plan           [--stage <name> [--direct] | --database-url <url>] [--models <barrel>] [--allow-drops] [--out db.plan.json | --out -] [--verbose]  Mint a verified edge against a target: asks the TARGET its fingerprint, diffs the models, writes ONE reviewable plan (edge + both endpoint fingerprints). Held drops refuse the mint (--allow-drops carries destruction explicitly). Read-only; plans are ephemeral, never committed. VENUES: --stage runs via the ops Lambda, which reads TWICE and refuses on disagreement — agreement there is a DETECTOR, not a verification. --stage --direct resolves the stage's operator connection from its IAM-gated ops Lambda, holds it in memory only, and reads ONCE over one session: the lane for a fingerprint you intend to trust, with the credential never on argv. --database-url is the local-dev venue (same read guarantee, but against a deployed stage it puts a privileged DSN on the command line) DEFAULT OUTPUT is the plain change list: '+' something is now true, '-' something is no longer true, and a '⚠ DESTRUCTIVE' line of its own when real data can be lost. Nothing else. --verbose restores the full internal report (edge summary, kind histogram, adoption and ownership reports, plan ref). The edge covers tables/columns/grants ONLY — it also reads (never mints) whether the DERIVED layer (functions/views/matviews/triggers) is out of sync with the target and warns if so, since db:apply always reconciles that layer regardless of --plan: an empty edge here does not mean the target fully matches the checkout
+  everystack db:apply          [--plan <file.plan.json>] [--database-url <url>] [--stage <name>] [--models <barrel>] [--confirm] [--state-only] [--snapshot-ref <ref>] [--attest-lineage-lost <sha>] [--verbose]  THE deploy verb — it does the WHOLE job: the reviewed plan (tables, columns, grants), then ALWAYS the functions, views, matviews and triggers, against the same target, reported as one receipt. With NO --plan it does the catch-up alone (this is what replaces running db:reconcile --apply by hand). --state-only skips the catch-up for the narrow case that wants the tables alone. A brownfield derived object the reconciler has never touched before (no provenance row) is SKIPPED, never guessed at, and that skip prints by default (not only under --verbose): 'N derived object(s) skipped ... db:reconcile --baseline' — a plain apply that only showed this under --verbose read as full success while such objects sat permanently unreconciled. If the plan lands and the catch-up then fails, the exit is non-zero and the message says the table/column changes are committed and safe and gives the rerun, which retries only the catch-up. Run a reviewed plan: verify the target is EXACTLY where the plan started (live fingerprint == plan.from, else refuse — the concurrency lock), verify the checkout DESCENDS from the commit declaring the target's state (the fast-forward rule — it protects MERGED work: a commit on any ref that declares the live state and is not an ancestor of HEAD refuses by name, escaped git-natively by fetch + merge/rebase + re-plan; --attest-lineage-lost <sha> waives it ONLY for a declaring commit proven gone from every ref. When NO commit on ANY ref declares the live state — a database everystack never wrote, or one hand-edited since its last apply — the rule has nothing to protect: over a full, current clone that is PROVEN DRIFT, the reviewed plan is the ORIGIN, it applies with a loud warning, and the origin is recorded in schema_log so every later apply descends from it. A shallow, partial, or behind-remote clone, or a models tree that will not compile, is UNVERIFIABLE and refuses with a fetch/prune runbook), and for DESTRUCTIVE plans require --confirm always + a confirmed rollback point + the stage's approver set when declared (STS identity-verified). The STAGE lane (--stage without --direct) runs every catalog query in its own ops-Lambda invoke, so one read can be assembled from several containers: it reads the target TWICE and REFUSES when the two disagree (inconsistent containers), reports agreement as a NON-DETECTION (it cannot verify read consistency), and REFUSES a DESTRUCTIVE plan outright — destructive applies go over --database-url (direct) with the full ceremony. Every refusal that reaches the ops Lambda is recorded in schema_log. Apply as one transaction (plan_ref stamped), verify it landed exactly on plan.to; idempotent when already there DEFAULT OUTPUT is the receipt: the same change lines back, then 'Applied N changes.'. --verbose restores the endpoint and plan-ref line
   everystack db:build          --database-url <url> [--models <barrel>]  Build a database FROM the models and KEEP it — the fresh-database bootstrap a deleted migration folder is replaced BY. Runs the same compose db:check proves buildability with (extensions -> schemas -> contract roles -> declared functions -> state -> derived layer), against a real target, then reports MATCH. Venue is EXPLICIT: --database-url only, never the ambient environment, because this writes a whole schema. REFUSES a database that already holds objects — evolving an existing one is db:sync (dev) or db:plan -> db:apply (a stage). Contract roles are created NOLOGIN if absent, and roles are cluster-level
   everystack db:check          [--models <barrel>] [--schema-out <file.ts>] [--database-url <url>] [--json] [--verbose]  The CI gate, per PR: the merged declared state must COMPOSE (models load, no duplicate tables, descriptors compile), every exposed RLS-enabled table must declare a read path (no force-RLS-with-no-read landmine that goes dark on the superuser drop), and generated artifacts must MATCH regeneration byte-for-byte; with a scratch PostgreSQL it builds the state from scratch on an ephemeral database (created + dropped) and requires fingerprint MATCH. Exit 1 on any failure; never touches a real target DEFAULT OUTPUT is ONE line: 'Up to date.' or 'N changes pending. Run db:plan to review.'. --verbose restores every finding and the from-scratch build report
   everystack db:approvers      --stage <name> [--set "cto,arn:..."] [--remove]  Declare who can DESTROY: the stage's destructive-approver set (SSM parameter, admin-writable). Destructive db:apply runs are then identity-verified (STS) against it; --set '' disables destructive applies; --remove returns the stage to ceremony-only