@everystack/cli 0.4.99 → 0.4.102

package/src/cli/commands/db-reconcile.ts

@@ -32,9 +32,10 @@
 import type { QueryRunner } from '../authz-contract';
 import type { SourceObject } from '../derived-source';
 import { introspectDerived } from '../derived-introspect';
-import { planReconcile, objectGrantDelta, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
+import { planReconcile, objectGrantDelta, TRIGGER_ENABLED_STATE, type ReconcilePlan, type ReconcileOptions } from '../derived-plan';
 import {
   renderReconcileSql,
+  triggerEnableSql,
   renderProvenanceUpsert,
   renderProvenanceMigrate,
   triggerDropSql,
@@ -47,6 +48,8 @@ import {
   ownerPreflightSql,
   ownerPreflightRefusal,
   builderOwnerMode,
+  transientExecuteGrantee,
+  triggerFunctionOf,
   type OwnerApplyMode,
   ENSURE_RECONCILER_SQL,
 } from '../derived-apply';
@@ -170,7 +173,8 @@ export async function executeReconcile(
     const refusal = ownerPreflightRefusal(rows);
     if (refusal) return { plan, applied: false, statements: rendered.statements, refusal };
     ownerMode = builderOwnerMode(rows);
-    if (ownerMode !== 'set-role') rendered = renderReconcileSql(plan, parsed.objects, ownerMode);
+    const executeGrantee = transientExecuteGrantee(rows);
+    if (ownerMode !== 'set-role' || executeGrantee) rendered = renderReconcileSql(plan, parsed.objects, ownerMode, executeGrantee);
   }
 
   const now = options.now ?? Date.now;
@@ -364,7 +368,15 @@ export async function executeReconcile(
       liveById = new Map(after.objects.map((o) => [o.identity, o]));
     }
 
-    const grantTouched = new Set([...built, ...plan.regrants.map((r) => r.identity)]);
+    // A built trigger on an owned function had EXECUTE lent to the builder for its CREATE
+    // (withTransientExecute). The function may not be in `built` (a trigger-only rebuild), so it
+    // joins the ruler here: the post-DDL catalog proves the lend was taken back, or the batch rolls back.
+    const lentFunctions = built
+      .map((identity) => srcById.get(identity))
+      .map((trigger) => (trigger ? triggerFunctionOf(trigger, parsed.objects) : undefined))
+      .filter((fn): fn is SourceObject => Boolean(fn?.owner))
+      .map((fn) => fn.identity);
+    const grantTouched = new Set([...built, ...plan.regrants.map((r) => r.identity), ...lentFunctions]);
     const unconverged: string[] = [];
     for (const identity of [...grantTouched].sort()) {
       const src = srcById.get(identity);
@@ -573,6 +585,12 @@ export function buildReconcileReport(plan: ReconcilePlan): string[] {
   for (const r of plan.regrants) {
     lines.push(`≠ regrant ${r.identity} — live grants differ from source (${r.statements.join('; ')})`);
   }
+  for (const r of plan.reenables ?? []) {
+    lines.push(
+      `! trigger ${r.identity} — ${TRIGGER_ENABLED_STATE[r.state] ?? 'not enabled as declared'} `
+      + `(tgenabled '${r.state}', declared 'O'); --apply runs ${triggerEnableSql(r.name, r.table)}`,
+    );
+  }
   for (const d of plan.dependencyDrift) {
     const parts = [
       ...(d.missing.length ? [`reads ${d.missing.join(', ')} undeclared`] : []),
@@ -612,6 +630,7 @@ export function checkFails(plan: ReconcilePlan): boolean {
     || plan.needsBaseline.length > 0
     || plan.blocked.length > 0
     || plan.regrants.length > 0
+    || (plan.reenables?.length ?? 0) > 0
     || plan.dependencyDrift.length > 0;
 }
 

package/src/cli/commands/db-sync.ts

@@ -45,7 +45,8 @@ import {
   type StateSyncOutcome,
 } from '../state-apply';
 import { fingerprintModels } from '../schema-fingerprint';
-import { compileDrizzleSource } from '../schema-source';
+import { writeGeneratedArtifacts } from '../generated-artifacts';
+import { modelMapPath } from '../model-map';
 import type { SourceFile } from '../derived-source';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source';
 import { borrowedSessionRunner, type SessionRunner } from '../session';
@@ -378,10 +379,10 @@ export async function dbSyncCommand(flags: Record<string, string>): Promise<void
     models = await loadModels(modelsPath);
     declaredDb = await loadDeclaredDerived(flags.models);
     info(`${models.length} model(s).`);
-    // Same contract as db:generate: the drizzle runtime schema is a derived
-    // artifact, refreshed from the models on every run.
-    step(`Writing the drizzle schema → ${path.relative(process.cwd(), schemaOut)}...`);
-    await fs.writeFile(schemaOut, compileDrizzleSource(models, { derived: declaredDb?.derived }), 'utf8');
+    // Same contract as db:generate: the drizzle runtime schema and the model map are
+    // derived artifacts, refreshed from the models on every run.
+    step(`Writing the drizzle schema → ${path.relative(process.cwd(), schemaOut)} and the model map → ${path.relative(process.cwd(), modelMapPath(schemaOut))}...`);
+    await writeGeneratedArtifacts(schemaOut, models, declaredDb?.derived);
   } catch (err: any) {
     fail(err.message);
     process.exit(1);

package/src/cli/commands/db.ts

@@ -346,6 +346,8 @@ export interface ServerProvision {
       declaredOwners?: DeclaredOwner[];
       declaredObjects?: Adoptee[];
       confirm?: boolean;
+      /** The Models declare a lifecycle model: provision the reserved everystack_lifecycle role. */
+      lifecycleRole?: boolean;
     },
     deps: {
       execute: (sql: string) => Promise<unknown>;
@@ -955,10 +957,14 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // function/view/matview objects to ADOPT, read from the same barrel as the schema set.
   let declaredOwners: DeclaredOwner[] = [];
   let declaredObjects: Adoptee[] = [];
+  // A `lifecycle: true` model compiles to the reserved role everystack_lifecycle, which nothing
+  // else on a stage creates (db:apply never makes roles). Provision makes it, NOLOGIN, no members.
+  let lifecycleRole = false;
   try {
     const { resolveModelsPath } = await import('../models-path');
     const { loadModels } = await import('./db-generate');
     const models = await loadModels(resolveModelsPath(flags.models));
+    lifecycleRole = Array.isArray(models) && models.some((m) => m.lifecycle === true);
     let derivedObjects: Array<{ schema: string }> = [];
     try {
       const { loadDeclaredDerived } = await import('../declared-derived');
@@ -1023,14 +1029,16 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     const { runner, end } = await createUrlRunner(url);
     try {
       // Credentials ONLY — ownership convergence runs separately, AFTER the secret is written.
-      return await runProvision(credentials, {
+      // Rows from either driver shape, as the ops Lambda's adapter reads them (plugin.ts).
+      const rowsOf = (res: any): any[] => (Array.isArray(res) ? res : (res?.rows ?? []));
+      return await runProvision({ ...credentials, lifecycleRole }, {
         execute: async (statement) => runner(statement),
+        query: async (statement) => rowsOf(await runner(statement)),
         connection: parseUrlConnection(url),
         // Additive-only: an already-live login role keeps its password (never reset on re-provision).
         roleHasLogin: async (role) => {
           if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(role)) return false;
-          const rows = await runner(`SELECT 1 FROM pg_roles WHERE rolname = '${role}' AND rolcanlogin`);
-          return Array.isArray(rows) && rows.length > 0;
+          return rowsOf(await runner(`SELECT 1 FROM pg_roles WHERE rolname = '${role}' AND rolcanlogin`)).length > 0;
         },
         // Same probe as the ops-Lambda venue: a real login as the new role, DDL-capable.
         connectProbe: async (probeUrl) => {
@@ -1068,6 +1076,7 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
       // The credentials half is generated locally and is not part of the wire contract.
       const provisionWire = {
         searchPath,
+        lifecycleRole,
         modelContract: MODEL_WIRE_CONTRACT,
       } satisfies ProvisionWirePayload;
       result = await invokeAction(config.region, opsFunction(config), 'db:provision', {
@@ -1113,6 +1122,35 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
       : (result.adminVerified === true ? 'connectivity verified' : 'connectivity NOT verified');
     success(`Operator login ready: ${result.adminRole} (LOGIN, INHERIT owner) — ${adminMsg}`);
   }
+  if (result.lifecycleRole) {
+    const lc = result.lifecycleRole as {
+      role: string; created: boolean | null; attributes?: string[] | null;
+      members: Array<{ role: string; admin: boolean; inherit: boolean; set: boolean }> | null;
+    };
+    const membersMsg = lc.members === null ? 'members not checked' : (lc.members.length ? `${lc.members.length} member(s)` : 'no members');
+    success(`Lifecycle role ${lc.created ? 'created' : 're-asserted'}: ${lc.role} (NOLOGIN, NOINHERIT, no BYPASSRLS, ${membersMsg})`);
+    // The operator is a member by design: ownership convergence grants it SET on the role so it can
+    // create the role's owned functions. It (without ADMIN), and its rotation pair when this provision
+    // configures one, are expected; anyone else is not.
+    const operator = result.adminRole as string | undefined;
+    const operatorRoles = operator ? [operator, ...(credentials.rotationPairs ? [`${operator}_a`, `${operator}_b`] : [])] : [];
+    const isExpected = (m: { role: string; admin: boolean }): boolean => !m.admin && operatorRoles.includes(m.role);
+    const expected = (lc.members ?? []).filter(isExpected);
+    const unexpected = (lc.members ?? []).filter((m) => !isExpected(m));
+    if (expected.length) info(`  ${lc.role} members, expected (operator): ${expected.map((m) => m.role).join(', ')}`);
+    if (unexpected.length) {
+      const named = unexpected.map((m) => {
+        const opts = [m.set && 'SET', m.inherit && 'INHERIT', m.admin && 'ADMIN'].filter(Boolean).join(', ');
+        return `${m.role}${opts ? ` (${opts})` : ''}`;
+      }).join(', ');
+      warn(`${lc.role} has unexpected direct member(s): ${named}. A member with SET can SET ROLE ${lc.role} and pass the lifecycle guard. Nothing was revoked; review each.`);
+    }
+    if (lc.attributes?.length) {
+      warn(`${lc.role} carries ${lc.attributes.join(', ')}. The lifecycle role needs none of them, and db:provision does not strip them; remove each with ALTER ROLE ${lc.role} NO<attribute>.`);
+    }
+  } else if (lifecycleRole) {
+    warn('This @everystack/server did not create the lifecycle role everystack_lifecycle the models need. Upgrade the server pin and re-run.');
+  }
   if (result.readerRole) {
     const readerMsg = result.readerPasswordSet === false ? 'existing login preserved' : 'password set';
     success(`Read-only login ready: ${result.readerRole} (LOGIN, NOINHERIT, no BYPASSRLS, SELECT only) — ${readerMsg}`);
@@ -1343,6 +1381,30 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   }
 }
 
+/** Parse the explicit day window once, before choosing a connection venue. */
+export function purgeAfterMilliseconds(days: string | undefined): number | undefined {
+  if (days === undefined) return undefined;
+  const milliseconds = Number(days) * 86400000;
+  if (!Number.isFinite(milliseconds) || milliseconds <= 0) throw new Error('--purge-after needs a positive number of days');
+  return milliseconds;
+}
+
+async function doctorOverdueRows(
+  after: number | undefined,
+  modelsPath: string | undefined,
+  runner: (query: string) => Promise<any[]>,
+): Promise<Record<string, number> | undefined> {
+  if (after === undefined) return undefined;
+  const { loadModels } = await import('./db-generate');
+  const { resolveModelsPath } = await import('../models-path');
+  const spec = '@everystack/server/purge';
+  const { overdueLifecycleRows } = await import(spec) as typeof import('@everystack/server/purge');
+  const { PgDialect } = await import('drizzle-orm/pg-core');
+  const dialect = new PgDialect();
+  const models = await loadModels(resolveModelsPath(modelsPath));
+  return overdueLifecycleRows({ execute: query => runner(dialect.sqlToQuery(query.inlineParams()).sql) }, models, { after });
+}
+
 /** Render a doctor report — identical output whichever venue produced it. */
 export function printDoctorReport(report: any): void {
   console.log('');
@@ -1357,6 +1419,12 @@ export function printDoctorReport(report: any): void {
     if (c.status === 'fail' && c.remediation) info(`    fix: ${c.remediation}`);
   }
 
+  console.log('');
+  if (report.overdueLifecycleRows === undefined) info('Lifecycle purge: skipped; pass --purge-after <days> to count overdue rows');
+  else {
+    info('Lifecycle purge: overdue rows');
+    for (const [table, count] of Object.entries(report.overdueLifecycleRows)) info(`  ${table}: ${count}`);
+  }
   console.log('');
   if (report.ok) {
     success('db:doctor — database is least-privilege and RLS-subject');
@@ -1385,7 +1453,7 @@ export function printDoctorReport(report: any): void {
  * forceRlsCarveouts/functionSchemas are unknown to the CLI, so the functions teeth run at
  * their safe default (unpinned SECDEF warns rather than fails). Returns report.ok.
  */
-async function runDoctorDirect(apiUrl: string, adminUrl: string, sourceLabel: string): Promise<boolean> {
+async function runDoctorDirect(apiUrl: string, adminUrl: string, sourceLabel: string, purgeAfter: number | undefined, modelsPath: string | undefined): Promise<boolean> {
   const { runDoctorProbe } = await loadServerDoctor();
   const { createUrlRunner } = await import('../db-source');
   step('Probing database connections (api + operator)...');
@@ -1396,7 +1464,8 @@ async function runDoctorDirect(apiUrl: string, adminUrl: string, sourceLabel: st
       { api: apiConn.runner, ops: opsConn.runner },
       { apiSourceLabel: sourceLabel },
     );
-    printDoctorReport(report);
+    const overdueLifecycleRows = await doctorOverdueRows(purgeAfter, modelsPath, opsConn.runner);
+    printDoctorReport({ ...report, overdueLifecycleRows });
     return report.ok;
   } finally {
     await apiConn.end().catch(() => {});
@@ -1405,6 +1474,13 @@ async function runDoctorDirect(apiUrl: string, adminUrl: string, sourceLabel: st
 }
 
 export async function dbDoctorCommand(flags: Record<string, string>): Promise<void> {
+  let purgeAfter: number | undefined;
+  try {
+    purgeAfter = purgeAfterMilliseconds(flags['purge-after']);
+  } catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
   // Explicit --database-url / --admin-database-url is a fully LOCAL venue — no AWS, no
   // stage, no secrets. Resolve and run before touching config (mirrors db:apply's
   // local-dev --database-url path).
@@ -1419,7 +1495,7 @@ export async function dbDoctorCommand(flags: Record<string, string>): Promise<vo
     info('venue: direct connection (explicit --database-url)');
     let ok = false;
     try {
-      ok = await runDoctorDirect(venue!.apiUrl, venue!.adminUrl, '--database-url');
+      ok = await runDoctorDirect(venue!.apiUrl, venue!.adminUrl, '--database-url', purgeAfter, flags.models);
     } catch (err: any) {
       fail(`db:doctor failed: ${err.message}`);
       process.exit(1);
@@ -1459,7 +1535,7 @@ export async function dbDoctorCommand(flags: Record<string, string>): Promise<vo
     info(`Region: ${config.region}, venue: direct connection (stage secrets)`);
     let ok = false;
     try {
-      ok = await runDoctorDirect(venue!.apiUrl, venue!.adminUrl, 'DATABASE_URL secret');
+      ok = await runDoctorDirect(venue!.apiUrl, venue!.adminUrl, 'DATABASE_URL secret', purgeAfter, flags.models);
     } catch (err: any) {
       fail(`db:doctor failed: ${err.message}`);
       process.exit(1);
@@ -1484,7 +1560,7 @@ export async function dbDoctorCommand(flags: Record<string, string>): Promise<vo
       info('No Ops Lambda (the deployed handler has no dbPlugin) — verifying directly over the stage secrets.');
       let ok = false;
       try {
-        ok = await runDoctorDirect(venue.apiUrl, venue.adminUrl, 'DATABASE_URL secret');
+        ok = await runDoctorDirect(venue.apiUrl, venue.adminUrl, 'DATABASE_URL secret', purgeAfter, flags.models);
       } catch (err: any) {
         fail(`db:doctor failed: ${err.message}`);
         process.exit(1);
@@ -1512,6 +1588,13 @@ export async function dbDoctorCommand(flags: Record<string, string>): Promise<vo
     process.exit(1);
   }
 
+  const { lambdaSessionRunner } = await import('../aws');
+  const session = lambdaSessionRunner(config.region, opsFunction(config));
+  report.overdueLifecycleRows = await doctorOverdueRows(purgeAfter, flags.models, async query => {
+    const [rows] = await session([query], { readOnly: true, searchPath: 'pg_catalog' });
+    if (!Array.isArray(rows)) throw new Error('overdue lifecycle count failed');
+    return rows;
+  });
   printDoctorReport(report);
   process.exit(report.ok ? 0 : 1);
 }

package/src/cli/commands/update.ts

@@ -6,7 +6,7 @@ import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { resolveConfig, probeUrl, type CliConfig } from '../config';
-import { missingHostUrlError } from '../host-url';
+import { loadSstOutputs, missingHostUrlError } from '../host-url';
 import { uploadToS3, headS3, invokeAction, rollingRestart } from '../aws';
 import { step, success, warn, fail, info } from '../output';
 import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
@@ -135,7 +135,8 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   // published channel's bundle) is the same either way, and the documented day-to-day flow is
   // `update --channel production` with no --stage at all. A secret loaded above may supply
   // HOST_URL, which is why this runs after that step rather than before it.
-  const noHostUrl = await missingHostUrlError(flags.stage, { siteUrl: resolvedConfig?.siteUrl });
+  const trace = await loadSstOutputs(flags.stage);
+  const noHostUrl = await missingHostUrlError(flags.stage, { siteUrl: resolvedConfig?.siteUrl, trace });
   if (noHostUrl) {
     fail(noHostUrl);
     process.exit(1);

package/src/cli/db-build.ts

@@ -184,6 +184,7 @@ export async function buildIntoDatabase(
       try {
         const pre = await executeReconcile(runner, session, {
           declared: declaredFunctions,
+          only: declaredFunctions.map(object => object.identity),
           apply: true,
           actor: options.actor ?? 'db-build',
           gitRef: options.gitRef ?? null,

package/src/cli/declared-derived.ts

@@ -14,6 +14,7 @@ import { pathToFileURL } from 'node:url';
 import type { Module, ModelDescriptor, SequenceDescriptor, DerivedDescriptor } from '@everystack/model';
 import { linkModels, ModelLinkError, moduleGovernedRoles } from '@everystack/model';
 import { compileDerived } from './derived-compile';
+import { lifecycleDerived } from './lifecycle-derived';
 import { compileTableRenames, compileTableMoves } from './schema-compile';
 import type { SourceObject } from './derived-source';
 import { resolveModelsPath } from './models-path';
@@ -181,7 +182,8 @@ export async function loadDeclaredDerived(modelsFlag?: string): Promise<Declared
 export function composeDeclaredDerived(modules: Module[], modelsPath: string): DeclaredDerived {
   try {
     const models = modules.flatMap((m) => m.models);
-    const derived = modules.flatMap((m) => m.derived);
+    // The lifecycle triggers are generated from the models, never declared on a module.
+    const derived = [...modules.flatMap((m) => m.derived), ...lifecycleDerived(models)];
     return {
       objects: compileDerived(models, derived),
       derived,

package/src/cli/declared-diff.ts

@@ -27,6 +27,7 @@
  */
 
 import type { ModelDescriptor } from '@everystack/model';
+import { assertExternalTargets, relationDeleteActions } from '@everystack/model';
 import type { SchemaSnapshot } from './schema-introspect';
 import type { AuthzContract } from './authz-contract';
 import { compileTableSchema, compileEnums } from './schema-compile';
@@ -54,10 +55,12 @@ export function compileDeclaredState(
   models: ModelDescriptor[],
   opts: { schema?: string } = {},
 ): DeclaredState {
+  assertExternalTargets(models);
+  const dependents = relationDeleteActions(models);
   const schema = opts.schema ?? 'public';
   return {
     snapshot: {
-      tables: models.map((m) => compileTableSchema(m, { schema })),
+      tables: models.map((m) => compileTableSchema(m, { schema, dependents })),
       enums: compileEnums(models),
     },
     contract: {

package/src/cli/derived-apply.ts

@@ -13,6 +13,7 @@
  * the reconciler writes it and never reads it.
  */
 
+import { LIFECYCLE_OWNER_ROLE } from '@everystack/model';
 import { normalizeSql, parseQualified, type SourceObject } from './derived-source';
 import type { ReconcilePlan } from './derived-plan';
 import { parseGrantAttachments } from './derived-grants';
@@ -88,6 +89,12 @@ export function triggerDropSql(name: string, table: string): string {
   return `DROP TRIGGER IF EXISTS "${name}" ON ${table}`;
 }
 
+/** Restore a managed trigger to the declared `tgenabled = 'O'`. `table` is the qualified
+ *  `schema.table` (the live ownerIdentity), so no search_path decides which table it hits. */
+export function triggerEnableSql(name: string, table: string): string {
+  return `ALTER TABLE ${quoteQualified(table)} ENABLE TRIGGER "${name.replace(/"/g, '""')}"`;
+}
+
 const DROP_KEYWORD: Record<string, string> = {
   'materialized view': 'MATERIALIZED VIEW',
   view: 'VIEW',
@@ -185,6 +192,54 @@ function ownerTarget(obj: SourceObject): string {
   return obj.kind === 'function' ? dropTarget('function', obj.identity) : quoteQualified(obj.identity);
 }
 
+/** Parse the SQL spelling, then compare stored identifiers rather than quoted text. */
+const TRIGGER_IDENT = String.raw`(?:"(?:[^"]|"")*"|[a-z_\u0080-\uffff][a-z0-9_$\u0080-\uffff]*)`;
+const TRIGGER_EXECUTE_RE = new RegExp(
+  String.raw`\bEXECUTE\s+(?:FUNCTION|PROCEDURE)\s+(${TRIGGER_IDENT})(?:\s*\.\s*(${TRIGGER_IDENT}))?\s*\(\s*\)\s*;?\s*$`, 'i',
+);
+const storedIdentifier = (token: string): string => token.startsWith('"')
+  ? token.slice(1, -1).replace(/""/g, '"') : token.toLowerCase();
+
+/** The declared function a trigger executes, or undefined when the source set does not declare it. */
+export function triggerFunctionOf(trigger: SourceObject, source: readonly SourceObject[]): SourceObject | undefined {
+  if (trigger.kind !== 'trigger') return undefined;
+  const target = TRIGGER_EXECUTE_RE.exec(trigger.sql);
+  if (!target) return undefined;
+  const schema = target[2] ? storedIdentifier(target[1]) : 'public';
+  const name = storedIdentifier(target[2] ?? target[1]);
+  return source.find((o) => o.kind === 'function' && o.schema === schema && o.name === name
+    && splitFunctionIdentity(o.identity).args === '');
+}
+
+/**
+ * CREATE TRIGGER needs EXECUTE on the trigger function, and a trigger has no owner: the builder
+ * creates it as itself. When the function belongs to a declared owner with PUBLIC revoked, the
+ * builder holds no EXECUTE — in set-role mode it is a member WITH INHERIT FALSE, and in alter-owner
+ * mode it gave the function away before the trigger. So the owner lends EXECUTE for the one
+ * statement and takes it back, in the same transaction: nothing persists, nothing drifts.
+ *
+ * `grantee` is the builder, and only when it is not a true superuser (a superuser needs no EXECUTE).
+ * Skipped when the function's own declaration grants the builder EXECUTE — the REVOKE would strip
+ * a declared grant.
+ *
+ * On a non-atomic batch (CONCURRENTLY/VACUUM) a failure between the GRANT and the REVOKE leaves the
+ * grant behind; the builder already holds SET on the owner, so that is drift, not escalation.
+ */
+function withTransientExecute(obj: SourceObject, statements: string[], source: readonly SourceObject[], grantee?: string): string[] {
+  if (!grantee || obj.kind !== 'trigger') return statements;
+  const fn = triggerFunctionOf(obj, source);
+  if (!fn?.owner) return statements;
+  const declared = parseGrantAttachments(fn.attachments).grants[grantee] ?? [];
+  if (declared.includes('EXECUTE') || declared.includes('ALL')) return statements;
+  const target = dropTarget('function', fn.identity);
+  const to = quoteIdent(grantee);
+  return [
+    `SET ROLE ${fn.owner}`, `GRANT EXECUTE ON FUNCTION ${target} TO ${to}`, 'RESET ROLE',
+    ...statements,
+    `SET ROLE ${fn.owner}`, `REVOKE EXECUTE ON FUNCTION ${target} FROM ${to}`, 'RESET ROLE',
+  ];
+}
+
 /**
  * The schemas a from-scratch derived apply must put on the search_path before it
  * creates anything. Derived bodies carry BARE table refs — db:pull deparsed them
@@ -266,7 +321,7 @@ export function renderEnsureObjectSchemas(objects: SourceObject[]): string[] {
  * backup's authz manifest — reads the SAME answer instead of re-deriving it.
  */
 export function declaredObjectSchemaUsage(objects: SourceObject[]): Record<string, string[]> {
-  const usage: Record<string, string[]> = {};
+  const usage: Record<string, string[]> = Object.create(null); // keyed by schema name, which may be '__proto__'
   const schemas = [...new Set(objects.map((o) => o.schema))].filter((s) => s !== 'public').sort();
   for (const schema of schemas) {
     const roles = new Set<string>();
@@ -305,6 +360,12 @@ export interface OwnerRequirement {
  * owner be assumable would refuse work the batch was never going to attempt. On a from-scratch
  * build every object is created, so this set is every declared owner anyway.
  */
+/** A baseline may stamp the generated manifest, never rewrite an adopted function body. */
+function lifecycleBaselineComments(object: SourceObject | undefined): string[] {
+  if (object?.kind !== 'function' || object.owner !== LIFECYCLE_OWNER_ROLE) return [];
+  return object.attachments.filter(a => a.kind === 'comment' && a.sql.includes('"everystack":"lifecycle"')).map(a => a.sql);
+}
+
 export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]): OwnerRequirement[] {
   const srcById = new Map(source.map((o) => [o.identity, o]));
   const byOwner = new Map<string, Set<string>>();
@@ -315,6 +376,20 @@ export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]):
     (byOwner.get(obj.owner) ?? byOwner.set(obj.owner, new Set()).get(obj.owner)!).add(obj.schema);
   }
   const grantOnly = new Map<string, Set<string>>();
+  for (const action of plan.actions) {
+    // A trigger on an owned function: the owner lends the builder EXECUTE for the CREATE TRIGGER
+    // (withTransientExecute), so the owner must be assumable and must USE the function's schema.
+    if (action.action !== 'create' && action.action !== 'replace') continue;
+    const trigger = srcById.get(action.identity);
+    const fn = trigger ? triggerFunctionOf(trigger, source) : undefined;
+    if (!fn?.owner) continue;
+    (grantOnly.get(fn.owner) ?? grantOnly.set(fn.owner, new Set()).get(fn.owner)!).add(fn.schema);
+  }
+  for (const action of plan.actions) {
+    const object = srcById.get(action.identity);
+    if (action.action !== 'baseline' || !object?.owner || !lifecycleBaselineComments(object).length) continue;
+    (grantOnly.get(object.owner) ?? grantOnly.set(object.owner, new Set()).get(object.owner)!).add(object.schema);
+  }
   for (const r of plan.regrants) {
     const schema = srcById.get(r.identity)?.schema;
     if (!r.owner || !schema) continue;
@@ -357,6 +432,8 @@ SELECT
     )
     FROM pg_roles b WHERE b.rolname = CURRENT_USER
   ) AS builder_is_superuser,
+  -- A TRUE superuser only. It needs no EXECUTE to create a trigger; an rds_superuser member does.
+  (SELECT b.rolsuper FROM pg_roles b WHERE b.rolname = CURRENT_USER) AS builder_rolsuper,
   d.owner_name,
   d.schema_name,
   d.needs_create,
@@ -378,6 +455,7 @@ ORDER BY d.owner_name, d.schema_name
 export interface OwnerPreflightRow {
   builder?: unknown;
   builder_is_superuser?: unknown;
+  builder_rolsuper?: unknown;
   owner_name: string;
   schema_name: string;
   /** False for a schema the owner only GRANTs/REVOKEs in — USAGE is checked, CREATE is not. */
@@ -403,6 +481,17 @@ export function builderOwnerMode(rows: OwnerPreflightRow[]): OwnerApplyMode {
   return rows.some((r) => truthy(r.builder_is_superuser)) ? 'alter-owner' : 'set-role';
 }
 
+/**
+ * The role an owned trigger function lends EXECUTE to for its CREATE TRIGGER (see
+ * withTransientExecute): the builder, unless it is a true superuser. Undefined when the rows do
+ * not name the builder — an older caller or a fixture — which renders no transient grant.
+ */
+export function transientExecuteGrantee(rows: OwnerPreflightRow[]): string | undefined {
+  const builder = rows.find((r) => r.builder != null)?.builder;
+  if (builder == null || rows.some((r) => truthy(r.builder_rolsuper))) return undefined;
+  return String(builder);
+}
+
 /**
  * The refusal text, or null when every declared owner is usable.
  *
@@ -430,16 +519,22 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   const noCreate: Array<{ owner: string; schema: string; exists: boolean }> = [];
   const noUsage: Array<{ owner: string; schema: string }> = [];
 
-  // A superuser builder creates as itself and ALTERs the owner, so it needs neither membership in
-  // the owner nor CREATE on the owner's behalf. Refusing on either would be a false refusal that
-  // demands a privilege expansion onto a role designed to hold none. Only "the role must exist"
-  // survives, because no mechanism can hand an object to a principal that is not there.
+  // A TRUE superuser builder creates as itself and ALTERs the owner, and PostgreSQL checks nothing
+  // of the owner for it. Refusing on CREATE or USAGE would be a false refusal that demands a
+  // privilege expansion onto a role designed to hold none. "The role must exist" survives, because
+  // no mechanism can hand an object to a principal that is not there.
+  //
+  // An rds_superuser member also takes alter-owner, but it is not a superuser to PostgreSQL 16:
+  // its ALTER … OWNER TO needs SET on the new owner and CREATE for that owner on the schema, and
+  // an owned trigger function's transient EXECUTE grant runs as the owner and needs its USAGE. So
+  // it is checked exactly as a set-role builder is.
   const alterOwner = builderOwnerMode(rows) === 'alter-owner';
+  const trueSuperuser = rows.some((r) => truthy(r.builder_rolsuper));
 
   for (const row of rows) {
     const owner = String(row.owner_name);
     if (!truthy(row.role_exists)) { missing.add(owner); continue; }
-    if (alterOwner) continue;
+    if (trueSuperuser) continue;
     if (!truthy(row.can_set_role)) unassumable.add(owner);
     // A superuser owner holds CREATE everywhere, including in a schema this build is about to
     // make — there is nothing to refuse.
@@ -478,7 +573,9 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   }
   for (const owner of [...unassumable].sort()) {
     lines.push(
-      `  CANNOT SET ROLE  '${builderName}' cannot assume '${owner}'. The CREATE and every GRANT/REVOKE on its objects run as the owner:`,
+      alterOwner
+        ? `  CANNOT SET ROLE  '${builderName}' cannot assume '${owner}'. ALTER … OWNER TO it and a trigger's transient EXECUTE grant on its functions run as the owner:`
+        : `  CANNOT SET ROLE  '${builderName}' cannot assume '${owner}'. The CREATE and every GRANT/REVOKE on its objects run as the owner:`,
       `      GRANT ${owner} TO ${builderName} WITH INHERIT FALSE, SET TRUE;`,
     );
   }
@@ -497,7 +594,8 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   return lines.join('\n');
 }
 
-export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[], ownerMode: OwnerApplyMode = 'set-role'): RenderedReconcile {
+/** `executeGrantee`: the builder an owned trigger function lends EXECUTE to ({@link transientExecuteGrantee}). */
+export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[], ownerMode: OwnerApplyMode = 'set-role', executeGrantee?: string): RenderedReconcile {
   const srcById = new Map(source.map((o) => [o.identity, o]));
   const statements: string[] = [];
   const record: string[] = [];
@@ -519,14 +617,14 @@ export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[],
       case 'replace': {
         const obj = srcById.get(action.identity);
         if (!obj) throw new Error(`replace action for ${action.identity} has no source object`);
-        statements.push(...objectSql(obj, ownerMode, action.revokes).map(ensureOrReplace));
+        statements.push(...withTransientExecute(obj, objectSql(obj, ownerMode, action.revokes).map(ensureOrReplace), source, executeGrantee));
         record.push(action.identity);
         break;
       }
       case 'create': {
         const obj = srcById.get(action.identity);
         if (!obj) throw new Error(`create action for ${action.identity} has no source object`);
-        statements.push(...objectSql(obj, ownerMode));
+        statements.push(...withTransientExecute(obj, objectSql(obj, ownerMode), source, executeGrantee));
         record.push(action.identity);
         break;
       }
@@ -535,6 +633,10 @@ export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[],
         break;
       }
       case 'baseline': {
+        const object = srcById.get(action.identity);
+        const comments = lifecycleBaselineComments(object);
+        if (comments.length && object?.owner && ownerMode === 'set-role') statements.push(`SET ROLE ${object.owner}`, ...comments, 'RESET ROLE');
+        else statements.push(...comments);
         record.push(action.identity);
         break;
       }
@@ -567,6 +669,10 @@ export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[],
     else statements.push(...r.statements);
   }
 
+  // A managed trigger that is disabled (or replica/always) goes back to the declared 'O' in the
+  // same batch. No provenance to record: tgenabled is in no hash.
+  for (const r of plan.reenables ?? []) statements.push(triggerEnableSql(r.name, r.table));
+
   // NOTE — a `remove` entry that is also a migration's TARGET is CORRECT, not a contradiction.
   // A legacy-keyed function the source has removed migrates onto its signature identity and is
   // then dropped through it: re-key, drop the object, delete the row. That is the documented path

package/src/cli/derived-grants.ts

@@ -70,7 +70,9 @@ export function revokesPublic(attachments: readonly Attachment[]): boolean {
 
 /** The declared grant contract, read back from an object's own grant attachments. */
 export function parseGrantAttachments(attachments: readonly Attachment[]): ParsedGrants {
-  const grants: Record<string, Set<string>> = {};
+  // Null-prototype: a grantee is a role name and '__proto__' is a legal one. The live side
+  // (derived-introspect) keys it the same way, so the two sides diff on equal terms.
+  const grants: Record<string, Set<string>> = Object.create(null);
   let target: string | null = null;
   let hasColumnGrants = false;
 
@@ -101,7 +103,7 @@ export function parseGrantAttachments(attachments: readonly Attachment[]): Parse
     }
   }
 
-  const out: Record<string, string[]> = {};
+  const out: Record<string, string[]> = Object.create(null);
   for (const role of Object.keys(grants).sort()) out[role] = [...grants[role]].sort();
   return { grants: out, target, hasColumnGrants };
 }