@happyvertical/smrt-cli 0.45.3 → 0.46.0

package/AGENTS.md

@@ -15,6 +15,8 @@ smrt db:migrate --postgres-safe # PostgreSQL concurrent-index mode (see below)
 smrt db:migrate --force-migration <exact-id> [--force-migration <exact-id>...] # Force exact generated migrations in one atomic batch
 smrt db:migrate-uuid         # Convert schema-declared UUID text columns after data remap
 smrt db:migrate-int8         # Explicitly widen pre-#2373 int4 columns after preflight
+smrt db:drop-framework-base-tables # One-time drop of the five #2644-orphaned framework-base tables
+smrt db:drop-framework-base-tables --dry-run # Print the drop plan without executing
 smrt db:diff                 # Show schema differences without generating migration files
 smrt db:rollback             # Roll back migrations by executing their recorded DOWN
 smrt db:rollback --mark-only # Record-only flip; schema deliberately untouched
@@ -154,6 +156,12 @@ to run a build.
 
 ## Live-schema parity (#2368)
 
+PostgreSQL role contracts also surface through read-only `doctor --db` and
+`db:validate`. Explicit repair uses `db:permissions` with a reviewed fingerprint;
+ordinary migrations never change ACLs. See the
+[permission guide](../../docs/content/postgres-permissions.md) for configuration,
+authority boundaries, and recovery.
+
 `doctor --db` and `db:status --parity` share `src/commands/db-parity.ts`, which
 runs core's `checkLiveSchemaParity()`. This answers a different question than
 `db:status`/`db:diff`: those compare the live database to the **manifest**, i.e.
@@ -257,6 +265,64 @@ sessions/magic-link tokens/CLI-auth requests from `smrt-users`).
 - Deployments running a jobs `TaskRunner` already get the same sweep every six
   hours; this command is for those that do not, and for one-off operator runs.
 
+## `db:drop-framework-base-tables` is a one-time remediation (#2647)
+
+`db:migrate` no longer plans `smrt_objects`/`smrt_classes`/`smrt_collections`/
+`smrt_hierarchicals`/`smrt_polymorphic_associations` (#2644), but any
+deployment that ran `db:migrate` before that fix still has all five. This
+command, backed by `planFrameworkBaseTableDrop()` /
+`dropFrameworkBaseTables()` in `@happyvertical/smrt-core/migrations`, drops
+exactly those five hardcoded names and nothing else — **never** derived from
+`SchemaDiff.orphan_tables`, which would recreate the dangerous global orphan
+drop `includeDroppedTables` (default `false`, both call sites explicit —
+`differ.ts:450`, `db-diff.ts:210`) deliberately refuses to be.
+
+- Execute-or-refuse, like `db:rollback`: it refuses (non-zero exit, nothing
+  dropped) if any target table has rows, has anything but that table's own
+  expected columns and types, or is referenced by a foreign key anywhere in
+  the live database. A consumer's own unrelated table sharing one of these
+  five names is exactly what the shape check protects.
+- The expected shape is **per table, not one universal baseline**:
+  `smrt_objects`/`smrt_classes`/`smrt_collections` are exactly `id`/`slug`/
+  `context`/`created_at`/`updated_at`, but `smrt_hierarchicals` also
+  requires `parent_id` and `smrt_polymorphic_associations` also requires
+  `meta_type`/`meta_id`/`role`/`sort_order` — `SmrtHierarchical`'s and
+  `SmrtPolymorphicAssociation`'s own real fields, confirmed against a
+  genuine pre-#2644 `db:migrate` run. A table under either of those two
+  names with *only* the plain five columns is refused as unexpected shape,
+  not treated as safe.
+- Companion indexes are enumerated from each table's live schema (never
+  guessed). `smrt_hierarchicals`/`smrt_polymorphic_associations` do not
+  carry the `created_at` list-ordering index the other three do (also
+  empirically confirmed, not assumed).
+- Bounded PostgreSQL execution reuses the same `SET LOCAL lock_timeout` /
+  `statement_timeout` pattern as every other DDL path (#2362). Every target
+  is locked `IN ACCESS EXCLUSIVE MODE` before re-checking it — a plain
+  `SELECT COUNT(*)` alone would not block a concurrent writer — and shape,
+  type, and emptiness are all re-verified inside that transaction
+  immediately before dropping anything, via raw `information_schema.columns`
+  / `PRAGMA table_info` (`getTableSchema()` is not available on the
+  transaction-scoped connection). Only `DROP TABLE` is ever executed —
+  never a `DROP INDEX` by name — so `DROP TABLE`'s own cascade removes the
+  table's indexes identity-safely instead of trusting a possibly-stale
+  planned index name.
+- `--dry-run` prints the exact plan (which tables exist, their companion
+  indexes, and the DROP statements) without executing.
+- Skipping it is safe: a table left behind is inert and permanently orphaned,
+  never written to or read from again. Documented, narrow residual risk, all
+  schema-integrity (never data loss — the target is always verified empty
+  first): DuckDB's adapter does not report foreign keys through
+  `getTableSchema()` at all; this module's reverse-FK scan (like every other
+  PostgreSQL schema tool in this package) only looks at the `public` schema;
+  and foreign keys are checked at planning time only, not re-scanned inside
+  the execution transaction. On PostgreSQL a foreign key that appeared after
+  planning is still caught there — `DROP TABLE` refuses when a real
+  dependent exists, dependency-based, empty parent or not. **This does not
+  hold on SQLite**: its FK enforcement on `DROP TABLE` is row-based, so an
+  empty parent (this command's precondition) drops cleanly past a real
+  foreign key, verified directly. The plan-time scan is the only gate on
+  SQLite/DuckDB, narrower than PostgreSQL's.
+
 ## Architecture
 
 - **Lazy command loading**: commands loaded on-demand via dynamic import (~100ms overhead on first use)

package/README.md

@@ -47,10 +47,20 @@ The four snapshot options are atomic: supplying any one requires all four.
 | `smrt db:migrate` | Apply pending migrations |
 | `smrt db:migrate --force-migration <exact-id> [--force-migration <exact-id>...]` | Force one or more exact generated migrations in one atomic batch while preserving every other guard |
 | `smrt db:migrate-uuid` | Convert schema-declared UUID text columns to native PostgreSQL uuid after data has been remapped |
+| `smrt db:migrate-int8` | Widen legacy pre-#2373 int4 columns to BIGINT after reviewing the maintenance-window preflight |
+| `smrt db:drop-framework-base-tables` | One-time removal of the five framework-base tables (`smrt_objects`, `smrt_classes`, `smrt_collections`, `smrt_hierarchicals`, `smrt_polymorphic_associations`) orphaned by #2644; refuses if any target table has rows, an unexpected shape, or an inbound foreign key |
+| `smrt db:drop-framework-base-tables --dry-run` | Print the drop plan (tables and companion indexes) without executing |
 | `smrt db:diff` | Show schema differences without generating migration files |
 | `smrt db:rollback` | Roll back the last migration by executing its recorded DOWN script; refuses when no DOWN script exists |
 | `smrt db:rollback --mark-only` | Record-only: mark migrations rolled back without running any DOWN script (schema untouched) |
 | `smrt db:history` | Show migration history with active-vs-superseded failure classification |
+| `smrt db:permissions --dry-run` | Plan the declared PostgreSQL role permission contract |
+| `smrt db:permissions --apply --expected-fingerprint <hash>` | Explicitly apply a reviewed permission plan |
+| `smrt db:validate` | Validate configured PostgreSQL permissions or JSON database integrity |
+
+For separate migration-owner, runtime, and monitoring roles, see the
+[PostgreSQL permissions guide](../../docs/content/postgres-permissions.md).
+`doctor --db` includes read-only permission diagnostics when configured.
 
 File-backed SQL/TypeScript migration generation is not supported. s-m-r-t schema
 migrations are manifest-driven; model schema with s-m-r-t objects and apply changes

package/dist/{commands-COd77prj.js → commands-C4xB-FxS.js}

@@ -1,3 +1,4 @@
+import { t as DEFAULT_CLI_CONFIG } from "./config-DfBo4hHU.js";
 import { t as resolveManifestEntryPackageName } from "./index.js";
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
@@ -11,6 +12,7 @@ import { access, cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { createLogger } from "@happyvertical/logger";
 import glob from "fast-glob";
 import { createHash } from "node:crypto";
+import { getPackageConfig } from "@happyvertical/smrt-config";
 import { toSnakeCase } from "@happyvertical/smrt-core/utils";
 import { discoverScopedPackageDirectories, readAgentModuleDocs, readPackageAgentDoc, resolveAgentModuleDocPaths } from "@happyvertical/smrt-core/knowledge";
 import { MCPGenerator } from "@happyvertical/smrt-core/generators";
@@ -20,7 +22,7 @@ import https from "node:https";
 import { homedir, tmpdir } from "node:os";
 import { extract } from "tar";
 import { importWorkspaceModule } from "@happyvertical/smrt-core/utils/import-workspace-module";
-import { buildIntegerWidthTableStatements, collectIntegerWidthTargets, parsePostgresTimeoutMs, preflightIntegerWidthWidening, widenIntegerColumnsToBigInt } from "@happyvertical/smrt-core/migrations";
+import { FRAMEWORK_BASE_TABLE_NAMES, buildIntegerWidthTableStatements, collectIntegerWidthTargets, dropFrameworkBaseTables, parsePostgresTimeoutMs, planFrameworkBaseTableDrop, preflightIntegerWidthWidening, widenIntegerColumnsToBigInt } from "@happyvertical/smrt-core/migrations";
 import { buildArchitectureContext, buildKnowledgeIndex, buildReviewContext, checkKnowledgeFreshness, compactContextResult, diffKnowledgeIndex, renderFreshnessResult, renderKnowledgeIndexMarkdown } from "@happyvertical/smrt-dev-mcp/knowledge";
 //#region src/commands/db-command-utils.ts
 var SENSITIVE_QUERY_PARAMS = /* @__PURE__ */ new Set([
@@ -123,7 +125,7 @@ var configExportCommand = {
 				process.exit(1);
 			}
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url || config.database.url === ":memory:") {
 				if (options.json) console.log(JSON.stringify({ error: "Database not configured" }));
@@ -962,7 +964,7 @@ var dbDiffCommand = {
 				return;
 			}
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url || config.database.url === ":memory:") {
 				if (options.json) console.log(JSON.stringify({ error: "Database not configured" }));
@@ -1285,7 +1287,7 @@ var dbHistoryCommand = {
 		let db;
 		try {
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url || config.database.url === ":memory:") {
 				if (options.json) console.log(JSON.stringify({ error: "Database not configured" }));
@@ -1456,6 +1458,109 @@ function formatDateTime(date) {
 	return date.toISOString().replace("T", " ").substring(0, 19);
 }
 //#endregion
+//#region src/commands/db-permissions.ts
+/** The only mutating caller is the explicit permissions command. */
+async function runPostgresPermissions(options = {}, optional = false) {
+	const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
+	const configured = config.postgresPermissions;
+	const failure = (error) => ({
+		skipped: false,
+		plan: null,
+		error
+	});
+	if (!configured && optional) return {
+		skipped: true,
+		plan: null,
+		error: null
+	};
+	if (!configured) return failure("Configure postgresPermissions before inspecting or applying database permissions.");
+	if (config.database?.type !== "postgres" || !config.database.url) return failure("PostgreSQL permissions require a configured PostgreSQL database.");
+	if (options.apply && (options["dry-run"] || !options["expected-fingerprint"])) return failure("--apply requires --expected-fingerprint from a reviewed plan and cannot be combined with --dry-run.");
+	let db;
+	try {
+		await autoDiscoverAndLoad();
+		const { getDatabase } = await import("@happyvertical/sql");
+		const { ObjectRegistry, getSystemTableShapes, planPostgresPermissions, applyPostgresPermissions } = await import("@happyvertical/smrt-core");
+		db = await getDatabase({
+			type: "postgres",
+			url: config.database.url
+		});
+		const { rows } = await db.query("SELECT tablename FROM pg_catalog.pg_tables WHERE schemaname = $1", [configured.schema]);
+		const present = new Set(rows.map((row) => row.tablename));
+		const managedTables = [.../* @__PURE__ */ new Set([
+			...Object.keys(ObjectRegistry.getAllSchemasAsDefinitions()),
+			...[...getSystemTableShapes("postgres").keys()].filter((table) => present.has(table)),
+			...configured.managedTables ?? []
+		])].sort();
+		const contract = {
+			...configured,
+			managedTables
+		};
+		return {
+			skipped: false,
+			plan: options.apply ? await applyPostgresPermissions(db, contract, { expectedFingerprint: options["expected-fingerprint"] ?? "" }) : await planPostgresPermissions(db, contract),
+			error: null
+		};
+	} catch {
+		return failure("PostgreSQL permissions could not be verified or applied. Check connectivity, contract validity, administrator authority, and the reviewed fingerprint.");
+	} finally {
+		try {
+			await closeDatabaseConnection(db);
+		} catch {}
+	}
+}
+function formatPermissionsOutcome(outcome) {
+	if (outcome.skipped) return [];
+	if (outcome.error) return [`PostgreSQL permissions: ${outcome.error}`];
+	const plan = outcome.plan;
+	if (!plan) return ["PostgreSQL permissions could not be verified."];
+	return [
+		`PostgreSQL permissions: ${plan.diagnostics.length} finding(s)`,
+		...plan.diagnostics.map((finding) => `  ${finding.severity}: ${finding.role ? `${finding.role} · ` : ""}${finding.resource}: ${finding.message}`),
+		`Plan fingerprint: ${plan.fingerprint}`,
+		...plan.limitations.map((limitation) => `Scope: ${limitation}`),
+		...plan.canApply ? [] : ["Automatic application refused; resolve unsupported conditions first."]
+	];
+}
+function outputPermissionsOutcome(outcome, json = false) {
+	if (json) console.log(JSON.stringify(outcome, null, 2));
+	else for (const line of formatPermissionsOutcome(outcome)) console.log(line);
+	if (outcome.error || outcome.plan?.diagnostics.length) process.exitCode = 1;
+}
+var dbPermissionsCommand = {
+	name: "db:permissions",
+	description: "Inspect PostgreSQL role permissions; explicitly apply a reviewed plan",
+	args: [],
+	options: {
+		"dry-run": {
+			type: "boolean",
+			description: "Read-only plan (the default)"
+		},
+		apply: {
+			type: "boolean",
+			description: "Apply the reviewed plan explicitly",
+			default: false
+		},
+		"expected-fingerprint": {
+			type: "string",
+			description: "Fingerprint from the reviewed read-only plan"
+		},
+		json: {
+			type: "boolean",
+			description: "Output plan and diagnostics as JSON",
+			default: false
+		}
+	},
+	handler: async (_args, options) => {
+		const outcome = await runPostgresPermissions(options);
+		outputPermissionsOutcome(outcome, options.json);
+		if (!options.json && outcome.plan && !options.apply) {
+			console.log("Read-only plan SQL:");
+			for (const sql of outcome.plan.statements) console.log(sql);
+		}
+	}
+};
+//#endregion
 //#region src/commands/db-prune.ts
 /**
 * Packages that contribute retention tasks by registering them on import.
@@ -1595,7 +1700,7 @@ var dbPruneCommand = {
 		let db;
 		try {
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url) {
 				const message = "Database not configured. Set database.url in smrt.config.ts.";
@@ -1755,7 +1860,7 @@ var dbRollbackCommand = {
 		const markOnly = options["mark-only"] ?? options.markOnly;
 		try {
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url || config.database.url === ":memory:") {
 				if (options.json) console.log(JSON.stringify({ error: "Database not configured" }));
@@ -2013,7 +2118,7 @@ async function runLiveSchemaParity(options = {}) {
 	let db;
 	try {
 		const { getPackageConfig } = await import("@happyvertical/smrt-config");
-		const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+		const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 		const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 		if (!config.database?.url || config.database.url === ":memory:") return {
 			report: null,
@@ -2552,7 +2657,7 @@ var dbStatusCommand = {
 		let db;
 		try {
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url || config.database.url === ":memory:") {
 				if (options.json) console.log(JSON.stringify({ error: "Database not configured" }));
@@ -2814,7 +2919,7 @@ async function getDispatchBus() {
 	const { createDispatchBus } = await import("@happyvertical/smrt-core");
 	const { getPackageConfig } = await import("@happyvertical/smrt-config");
 	const { getDatabase } = await import("@happyvertical/sql");
-	const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+	const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 	const dbConfig = getPackageConfig("cli", DEFAULT_CLI_CONFIG).database;
 	if (!dbConfig?.url) throw new Error("Database not configured. Set database.url in smrt.config.ts or use --db option.");
 	let db;
@@ -3732,7 +3837,7 @@ var exportCommand = {
 		let db;
 		try {
 			const { getConfig, getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const smrtConfig = getConfig();
 			const cliConfig = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!smrtConfig) {
@@ -6140,6 +6245,122 @@ var playgroundCommands = {
 	}
 };
 //#endregion
+//#region src/commands/db-drop-framework-base-tables.ts
+/**
+* db:drop-framework-base-tables Command
+*
+* One-time remediation for the five orphaned framework-base tables
+* (`smrt_objects`, `smrt_classes`, `smrt_collections`, `smrt_hierarchicals`,
+* `smrt_polymorphic_associations`) that a pre-#2644 `db:migrate` planned for
+* SMRT's abstract framework-base classes. #2644 stopped planning them; this
+* command drops the ones a deployment already created.
+*
+* Deliberately separate from `db:migrate` and from `db:diff`'s orphan-table
+* reporting: `SchemaDiff.includeDroppedTables` stays `false` so an ordinary
+* migration never drops a table just because it is absent from the manifest.
+* This command drops **only** the five hardcoded names above, and only after
+* verifying each one is empty, has no foreign keys pointing at it, and has
+* exactly that table's own expected columns — the universal `id`/`slug`/
+* `context`/`created_at`/`updated_at` base for `smrt_objects`/`smrt_classes`/
+* `smrt_collections`, extended with `parent_id` for `smrt_hierarchicals` and
+* `meta_type`/`meta_id`/`role`/`sort_order` for
+* `smrt_polymorphic_associations` (their own real fields, not the plain
+* baseline — see `@happyvertical/smrt-core/migrations`'
+* `planFrameworkBaseTableDrop()` for the full per-table safety model).
+*
+* Skipping this command is safe: a table left behind here is inert and
+* permanently orphaned, never written to or read from again.
+*/
+var DEFAULT_POSTGRES_LOCK_TIMEOUT_MS$1 = 3e4;
+var DEFAULT_POSTGRES_STATEMENT_TIMEOUT_MS$1 = 6e4;
+function describeRefusal(refusal) {
+	switch (refusal.kind) {
+		case "not-empty": return `has ${refusal.rowCount} row(s) — nothing should ever have written to this table`;
+		case "unexpected-shape": {
+			const parts = [];
+			if (refusal.extraColumns.length > 0) parts.push(`unexpected column(s) [${refusal.extraColumns.join(", ")}]`);
+			if (refusal.missingColumns.length > 0) parts.push(`missing baseline column(s) [${refusal.missingColumns.join(", ")}]`);
+			return `has an unexpected shape: ${parts.join("; ")} (actual columns: ${refusal.actualColumns.join(", ")})`;
+		}
+		case "unexpected-column-type": return `has an unexpected column type: ${refusal.mismatches.map((mismatch) => `${mismatch.column} is "${mismatch.actualType}" (expected ${mismatch.expectedBuckets.join(" or ")})`).join(", ")}`;
+		case "referenced-by-foreign-key": return `is referenced by foreign key(s) from: ${refusal.references.map((reference) => `${reference.table}.${reference.column}`).join(", ")}`;
+		case "introspection-unavailable": return refusal.reason;
+		default: return "is unsafe to drop for an unrecognized reason";
+	}
+}
+var dbDropFrameworkBaseTablesCommand = {
+	name: "db:drop-framework-base-tables",
+	description: "One-time removal of the five framework-base tables orphaned by #2644 (smrt_objects, smrt_classes, smrt_collections, smrt_hierarchicals, smrt_polymorphic_associations). Refuses if any target table has rows, an unexpected shape, or an inbound foreign key.",
+	aliases: ["drop-framework-base-tables", "db-drop-framework-base-tables"],
+	args: [],
+	options: {
+		"dry-run": {
+			type: "boolean",
+			description: "Print the plan without dropping anything.",
+			default: false
+		},
+		verbose: {
+			type: "boolean",
+			description: "Print a per-table report, including tables that are not present.",
+			default: false,
+			short: "v"
+		}
+	},
+	handler: async (_args, options) => {
+		let db;
+		const dryRun = Boolean(options["dry-run"]);
+		try {
+			const { getPackageConfig } = await import("@happyvertical/smrt-config");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
+			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
+			if (!config.database?.url || config.database.url === ":memory:") throw new Error("Database configuration required for db:drop-framework-base-tables. Configure database.url in smrt.config.ts (or DATABASE_URL).");
+			const dbType = config.database.type || "sqlite";
+			const dbUrl = config.database.url;
+			const { getDatabase } = await import("@happyvertical/sql");
+			db = await getDatabase({
+				type: dbType,
+				url: dbUrl
+			});
+			console.log("\n🗑️  Framework base-table remediation (#2647)\n");
+			console.log(`✓ Connected to ${formatDatabaseDisplayUrl(dbType, dbUrl)}\n`);
+			const plan = await planFrameworkBaseTableDrop(db, { engineHint: dbType });
+			const present = plan.tables.filter((table) => table.exists);
+			const absent = plan.tables.filter((table) => !table.exists);
+			if (options.verbose || present.length === 0) for (const table of absent) console.log(`  - ${table.table}: not present, nothing to do`);
+			for (const table of present) {
+				if (table.refusals.length === 0) {
+					console.log(`  - ${table.table}: safe to drop (${table.indexNames.length} companion index(es))`);
+					continue;
+				}
+				console.log(`  - ${table.table}: UNSAFE`);
+				for (const refusal of table.refusals) console.log(`      ${describeRefusal(refusal)}`);
+			}
+			if (!plan.safe) throw new Error(`Refusing to drop framework base tables — ${FRAMEWORK_BASE_TABLE_NAMES.length} target name(s) checked, at least one is unsafe (see above). Nothing was dropped.`);
+			if (present.length === 0) {
+				console.log("\nNone of the five framework-base tables are present. Nothing to do.\n");
+				return;
+			}
+			console.log(`\n${dryRun ? "DRY RUN — would execute" : "Applying"} ${plan.statements.length} statement(s):`);
+			for (const statement of plan.statements) console.log(`  ${statement};`);
+			if (dryRun) {
+				console.log("\nDry run complete — no changes applied.\n");
+				return;
+			}
+			const postgresMigrationConfig = config.migrations?.postgres;
+			const result = await dropFrameworkBaseTables(db, plan, {
+				lockTimeout: parsePostgresTimeoutMs(postgresMigrationConfig?.lockTimeout, DEFAULT_POSTGRES_LOCK_TIMEOUT_MS$1),
+				statementTimeout: parsePostgresTimeoutMs(postgresMigrationConfig?.statementTimeout, DEFAULT_POSTGRES_STATEMENT_TIMEOUT_MS$1)
+			});
+			console.log(`\n✓ Dropped ${result.droppedTables.length} table(s) and ${result.droppedIndexes.length} companion index(es): ${result.droppedTables.map((table) => quoteIdentifier(table)).join(", ")}\n`);
+		} catch (error) {
+			console.error(`\n❌ Framework base-table remediation failed: ${error instanceof Error ? error.message : String(error)}\n`);
+			process.exitCode = 1;
+		} finally {
+			await closeDatabaseConnection(db);
+		}
+	}
+};
+//#endregion
 //#region src/commands/db-migrate-int8.ts
 /**
 * db:migrate-int8 Command
@@ -6175,7 +6396,7 @@ var dbMigrateInt8Command = {
 		const dryRun = Boolean(options["dry-run"]);
 		try {
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url || config.database.url === ":memory:") throw new Error("Database configuration required for db:migrate-int8. Configure database.url in smrt.config.ts (or DATABASE_URL).");
 			await autoDiscoverAndLoad();
@@ -6429,7 +6650,7 @@ var dbMigrateUuidCommand = {
 		let db;
 		try {
 			const { getPackageConfig } = await import("@happyvertical/smrt-config");
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			if (!config.database?.url || config.database.url === ":memory:") {
 				console.error("\n❌ Database configuration required for db:migrate-uuid");
@@ -7916,7 +8137,7 @@ export default testManifest;
 			let db;
 			try {
 				const { getPackageConfig } = await import("@happyvertical/smrt-config");
-				const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+				const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 				const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 				if (!config.database?.url || config.database.url === ":memory:") {
 					console.error("❌ Database configuration required for db:setup");
@@ -8124,7 +8345,7 @@ export default testManifest;
 	},
 	"db:validate": {
 		name: "db:validate",
-		description: "Validate JSON database integrity against manifest schema",
+		description: "Validate JSON database integrity or configured PostgreSQL permissions",
 		aliases: ["json:validate", "validate-db"],
 		args: [],
 		options: {
@@ -8159,8 +8380,18 @@ export default testManifest;
 		},
 		handler: async (_args, options) => {
 			const startTime = Date.now();
+			const { getPackageConfig } = await import("@happyvertical/smrt-config");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
+			const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
+			if (!options.data && config.database?.type === "postgres") {
+				const permissions = await runPostgresPermissions({}, true);
+				if (!permissions.skipped) {
+					outputPermissionsOutcome(permissions, options.json);
+					return;
+				}
+			}
 			try {
-				const { resolveDataPath, discoverJsonFiles, JsonDatabaseValidator, displayValidationResults } = await import("./json-validator-D5hN4DGj.js");
+				const { resolveDataPath, discoverJsonFiles, JsonDatabaseValidator, displayValidationResults } = await import("./json-validator-CjX8fHx9.js");
 				const dataPath = await resolveDataPath(options.data);
 				if (!dataPath) {
 					console.error("\n❌ Could not find data directory");
@@ -8332,7 +8563,7 @@ export default testManifest;
 				const postgresTimestampMigration = resolvePostgresTimestampMigration(options["postgres-timestamp-legacy-timezone"]);
 				const isDryRun = options["dry-run"] ?? false;
 				const { getPackageConfig } = await import("@happyvertical/smrt-config");
-				const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+				const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 				const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 				if (!config.database?.url || config.database.url === ":memory:") {
 					console.error("❌ Database configuration required for db:migrate");
@@ -9049,7 +9280,7 @@ export default testManifest;
 			check("src/lib/server/smrt.ts exists", existsSync(resolve(cwd, "src/lib/server/smrt.ts")), "Missing server config - run: smrt init");
 			try {
 				const { getPackageConfig } = await import("@happyvertical/smrt-config");
-				const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+				const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 				const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 				if (config.database?.url && config.database.url !== ":memory:") check(`Database configured (${config.database.type || "sqlite"})`, true);
 				else check("Database configured", false, void 0, "Using in-memory database - set DATABASE_URL for persistence");
@@ -9075,6 +9306,9 @@ export default testManifest;
 					for (const finding of parityWarnings) warnings.push(`live schema: ${finding.table}${finding.target ? `.${finding.target}` : ""} (${finding.kind})`);
 					if (parityErrors.length === 0 && parityWarnings.length === 0) passed.push("Live schema parity");
 				}
+				const permissions = await runPostgresPermissions({}, true);
+				for (const line of formatPermissionsOutcome(permissions)) console.log(line);
+				if (!permissions.skipped) check("PostgreSQL role permissions", !permissions.error && permissions.plan?.diagnostics.length === 0, permissions.error ?? "PostgreSQL role permissions differ from the configured contract");
 				console.log();
 			}
 			console.log("━".repeat(50));
@@ -9109,7 +9343,9 @@ export default testManifest;
 	"db:generate": dbGenerateCommand,
 	"db:migrate-uuid": dbMigrateUuidCommand,
 	"db:migrate-int8": dbMigrateInt8Command,
+	"db:drop-framework-base-tables": dbDropFrameworkBaseTablesCommand,
 	"db:prune": dbPruneCommand,
+	"db:permissions": dbPermissionsCommand,
 	"config:export": configExportCommand,
 	export: exportCommand
 };

package/dist/{config-BwrFRL8L.js → config-DfBo4hHU.js}

@@ -1,4 +1,18 @@
+import "node:module";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
 //#region src/config.ts
+var config_exports = /* @__PURE__ */ __exportAll({ DEFAULT_CLI_CONFIG: () => DEFAULT_CLI_CONFIG });
 /**
 * Default CLI configuration values
 */
@@ -29,4 +43,4 @@ var DEFAULT_CLI_CONFIG = {
 	interactive: !process.env.CI
 };
 //#endregion
-export { DEFAULT_CLI_CONFIG };
+export { config_exports as n, DEFAULT_CLI_CONFIG as t };

package/dist/index.js

@@ -49,63 +49,63 @@ var _playgroundCommands = null;
 var _workbenchCommands = null;
 async function getGnodeCommands() {
 	if (!_gnodeCommands) {
-		const { gnodeCommands } = await import("./commands-COd77prj.js");
+		const { gnodeCommands } = await import("./commands-C4xB-FxS.js");
 		_gnodeCommands = gnodeCommands;
 	}
 	return _gnodeCommands;
 }
 async function getGitCommands() {
 	if (!_gitCommands) {
-		const { gitCommands } = await import("./commands-COd77prj.js");
+		const { gitCommands } = await import("./commands-C4xB-FxS.js");
 		_gitCommands = gitCommands;
 	}
 	return _gitCommands;
 }
 async function getGenerateCommands() {
 	if (!_generateCommands) {
-		const { generateCommands } = await import("./commands-COd77prj.js");
+		const { generateCommands } = await import("./commands-C4xB-FxS.js");
 		_generateCommands = generateCommands;
 	}
 	return _generateCommands;
 }
 async function getInitCommands() {
 	if (!_initCommands) {
-		const { initCommands } = await import("./commands-COd77prj.js");
+		const { initCommands } = await import("./commands-C4xB-FxS.js");
 		_initCommands = initCommands;
 	}
 	return _initCommands;
 }
 async function getUtilityCommands() {
 	if (!_utilityCommands) {
-		const { utilityCommands } = await import("./commands-COd77prj.js");
+		const { utilityCommands } = await import("./commands-C4xB-FxS.js");
 		_utilityCommands = utilityCommands;
 	}
 	return _utilityCommands;
 }
 async function getDispatchCommands() {
 	if (!_dispatchCommands) {
-		const { dispatchCommands } = await import("./commands-COd77prj.js");
+		const { dispatchCommands } = await import("./commands-C4xB-FxS.js");
 		_dispatchCommands = dispatchCommands;
 	}
 	return _dispatchCommands;
 }
 async function getDocsCommands() {
 	if (!_docsCommands) {
-		const { docsCommands } = await import("./commands-COd77prj.js");
+		const { docsCommands } = await import("./commands-C4xB-FxS.js");
 		_docsCommands = docsCommands;
 	}
 	return _docsCommands;
 }
 async function getPlaygroundCommands() {
 	if (!_playgroundCommands) {
-		const { playgroundCommands } = await import("./commands-COd77prj.js");
+		const { playgroundCommands } = await import("./commands-C4xB-FxS.js");
 		_playgroundCommands = playgroundCommands;
 	}
 	return _playgroundCommands;
 }
 async function getWorkbenchCommands() {
 	if (!_workbenchCommands) {
-		const { workbenchCommands } = await import("./commands-COd77prj.js");
+		const { workbenchCommands } = await import("./commands-C4xB-FxS.js");
 		_workbenchCommands = workbenchCommands;
 	}
 	return _workbenchCommands;
@@ -322,7 +322,7 @@ var CLIGenerator = class {
 		if (verbose) console.log("[CLI] Loading external classes...");
 		await this.loadExternalClasses();
 		const { getPackageConfig } = await import("@happyvertical/smrt-config");
-		const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+		const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 		const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 		const registeredCount = ObjectRegistry.getAllClasses().size;
 		if (verbose || config.verbose) console.log(`[CLI] Successfully loaded ${registeredCount} SMRT objects`);
@@ -337,7 +337,7 @@ var CLIGenerator = class {
 	*/
 	async loadLocalClasses() {
 		const { getPackageConfig } = await import("@happyvertical/smrt-config");
-		const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+		const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 		const fs = await import("node:fs");
 		const path = await import("node:path");
 		const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
@@ -382,7 +382,7 @@ var CLIGenerator = class {
 	*/
 	async loadExternalClasses() {
 		const { getPackageConfig } = await import("@happyvertical/smrt-config");
-		const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+		const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 		const { loadLocalTestManifestSync } = await import("@happyvertical/smrt-core/manifest");
 		const fs = await import("node:fs");
 		const path = await import("node:path");
@@ -1359,7 +1359,7 @@ var CLIGenerator = class {
 			const { getConfig, getPackageConfig, getModuleConfig } = await import("@happyvertical/smrt-config");
 			const smrtConfig = getConfig() || {};
 			const moduleConfig = getModuleConfig(objectName.toLowerCase(), {});
-			const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+			const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 			const cliConfig = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 			let db = this.context.db;
 			if (!db && cliConfig?.database?.url) {
@@ -1462,7 +1462,7 @@ var CLIGenerator = class {
 			let db = this.context.db;
 			if (!db) {
 				const { getPackageConfig } = await import("@happyvertical/smrt-config");
-				const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");
+				const { DEFAULT_CLI_CONFIG } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 				const config = getPackageConfig("cli", DEFAULT_CLI_CONFIG);
 				const { getDatabase } = await import("@happyvertical/sql");
 				db = await getDatabase({

package/dist/{json-validator-D5hN4DGj.js → json-validator-CjX8fHx9.js}

@@ -85,7 +85,7 @@ async function resolveDataPath(explicitPath) {
 		return resolved;
 	}
 	try {
-		const { DEFAULT_CLI_CONFIG: defaultConfig } = await import("./config-BwrFRL8L.js");
+		const { DEFAULT_CLI_CONFIG: defaultConfig } = await import("./config-DfBo4hHU.js").then((n) => n.n);
 		const config = getPackageConfig("cli", defaultConfig);
 		if (config.database?.url) {
 			const dbUrl = config.database.url;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-cli",
-  "version": "0.45.3",
+  "version": "0.46.0",
   "description": "Developer CLI for SMRT framework - introspection, testing, and project management",
   "type": "module",
   "main": "./dist/index.js",
@@ -32,12 +32,12 @@
     "acorn": "^8.17.0",
     "fast-glob": "3.3.3",
     "tar": "^7.5.19",
-    "@happyvertical/smrt-agents": "0.45.3",
-    "@happyvertical/smrt-config": "0.45.3",
-    "@happyvertical/smrt-core": "0.45.3",
-    "@happyvertical/smrt-dev-mcp": "0.45.3",
-    "@happyvertical/smrt-types": "0.45.3",
-    "@happyvertical/smrt-playground": "0.45.3"
+    "@happyvertical/smrt-core": "0.46.0",
+    "@happyvertical/smrt-playground": "0.46.0",
+    "@happyvertical/smrt-agents": "0.46.0",
+    "@happyvertical/smrt-types": "0.46.0",
+    "@happyvertical/smrt-config": "0.46.0",
+    "@happyvertical/smrt-dev-mcp": "0.46.0"
   },
   "devDependencies": {
     "@types/node": "24.13.2",