@starci/hfs 4.9.9 → 4.10.0

package/src/main.mjs

@@ -49,7 +49,7 @@
 //   starci app ci secret set <NAME> [--env E | --dependabot] [--repo owner/name]  reads the value from stdin only.
 //   starci app ci var set <NAME> [--env E] [--value v] | var sync [--execute] | verify [--json]
 //                                            declared GitHub CI custody; verify compares names, scopes and public values.
-//   starci app db baseline | restamp --map <restamp.yaml> | plan
+//   starci app db new <name> | baseline | restamp --map <restamp.yaml> | plan | migrate | post-cutover | dump
 //                                            preview the database cutover or compare its state with the repo; baseline and restamp mutate only with --apply.
 //   starci app add <api|webhook|realtime|saga|job|reactor|queue|projection> <name> [--event <event> --from <service> --service <Class>=<module>] [--owner <service> --failed <event> --done <event>] [--connection <name>] [--cwd <dir>]
 //                                            exactly that kind's file tree, generated FROM the files: tree of its pattern topic (knowledge/patterns/be) with the
@@ -79,7 +79,6 @@ import { main as syncMain } from '../sync/cli.mjs';
 import { SyncError, bundledPresets } from '../sync/index.mjs';
 import { managedFindings } from '../sync/managed.mjs';
 import { emitContracts } from '../emit/contracts.mjs';
-import { dbTypesEmitter } from '../emit/db-types.mjs';
 import { ScaffoldError, newService, newSpec } from '../scaffold/service.mjs';
 import { EditionRefusal } from '../scaffold/edition-gate.mjs';
 import { addKind } from '../scaffold/add.mjs';
@@ -95,30 +94,33 @@ import { releaseMain } from '../release/index.mjs';
 import { dbMigrateMain } from '../db/migrate.mjs';
 import { dbPostCutoverMain } from '../db/post-cutover.mjs';
 import { dbDumpMain } from '../db/dump.mjs';
-import { dbResetMain } from '../db/reset.mjs';
+import { dbNewMain } from '../db/new.mjs';
+import { dbDriftMain } from '../db/drift.mjs';
 import { codemodMain } from '../codemod/button-intent.mjs';
 
 export const VERBS = Object.freeze(['scaffold', 'add', 'lint', 'sync', 'check', 'upgrade', 'stack', 'release', 'explain', 'emit', 'new', 'secret', 'ci', 'db', 'hygiene', 'coverage', 'codemod']);
-const DATABASE_VERBS = new Map([['baseline', dbBaselineMain], ['restamp', dbRestampMain], ['plan', dbPlanMain], ['migrate', dbMigrateMain], ['post-cutover', dbPostCutoverMain], ['dump', dbDumpMain], ['reset', dbResetMain]]);
+const DATABASE_VERBS = new Map([['baseline', dbBaselineMain], ['restamp', dbRestampMain], ['plan', dbPlanMain], ['migrate', dbMigrateMain], ['post-cutover', dbPostCutoverMain], ['dump', dbDumpMain], ['new', dbNewMain], ['drift', dbDriftMain]]);
 
 const USAGE = `starci app scaffold <name> [--into <dir>] [--edition full|lite] [--registry-visibility public|private] [--cwd <dir>]
 starci app add <api|webhook|realtime|saga|job|reactor|queue|projection|cli|table|app|block|composite|branch|leaf|page|overlay|layout> <name> [options] [--cwd <dir>]
 starci app lint [--cwd <dir>] [--changed <file>...] [--workspace <dir>] [--side be|fe] [--fix] [--format text|json] [--sonar <file>]
 starci app codemod button-intent [--write] [--format json|markdown] [--report <file.json|file.md>] [--cwd <dir>]
 starci app sync (--check | --write) [--cwd <dir>]
-starci app check [--cwd <dir>] [--json] [--fast] [--base <ref>] [--db-types] [--wiring] [--coverage-from <lcov>]
-starci app db baseline [--stamp <version>] [--local] [--apply] [--cwd <dir>]
-starci app db restamp --map <restamp.yaml> [--local] [--apply] [--cwd <dir>]
-starci app db plan [--local] [--json] [--cwd <dir>]
-starci app db dump (--linked | --local | --url-env <NAME>) --out <dir> [--schema-only] [--json] [--cwd <dir>]
-starci app db reset --linked --auth keep|drop --storage keep|drop --backup <receipt.json> [--execute] [--json] [--cwd <dir>]
-starci app db migrate [--execute] [--local | --linked | --url-env <NAME>] [--json] [--cwd <dir>]
-starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--linked | --url-env <NAME>] [--json] [--cwd <dir>]
-starci app release gate [--execute] [--source <ref>] [--tag-prefix <prefix>] [--json] [--cwd <dir>]
-starci app release push [--execute] [--remote <name>] [--json] [--cwd <dir>]
+starci app check [--cwd <dir>] [--json] [--fast] [--base <ref>] [--wiring] [--coverage-from <lcov>]
+starci app db new <kebab-name> [--json] [--cwd <dir>]
+starci app db baseline [--stamp <version>] [--url-env <NAME>] [--apply] [--cwd <dir>]
+starci app db restamp --map <restamp.yaml> [--url-env <NAME>] [--apply] [--cwd <dir>]
+starci app db plan [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app db dump [--url-env <NAME>] --out <dir> [--schema-only] [--json] [--cwd <dir>]
+starci app db migrate [--execute] [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app db drift [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app release gate [--execute] [--source <ref>] [--tag-prefix <prefix>] [--backfill <tag>] [--json] [--cwd <dir>]
+starci app release push [--execute] [--remote <name>] [--urgent --reason <text>] [--json] [--cwd <dir>]
 starci app upgrade [--plan] [--cwd <dir>]
 starci app stack <up|down|status> [--stack <dir>] [--services <list>] [--k3d] [--force] [--json] [--cwd <dir>]
 starci app stack <prepare|doctor|connect|disconnect|build-args|render|deploy|converge|verify|rollback|prune|backup|jobs> --env <env> [--execute] [--json] [--cwd <dir>]
+starci app stack deploy --env <env> --source-sha <sha> --urgent [--db-url-env <NAME>] [--backup-out <dir>] [--execute] [--json] [--cwd <dir>]
 starci app explain <path> [--cwd <dir>] [--json]
 starci app emit [--cwd <dir>]
 starci app new service <dir> <name> [--inject <binding>...] [--cwd <dir>]
@@ -144,7 +146,7 @@ const PER_CODE_LIMIT = 25;
 const VALUE_FLAGS = new Set(['--base', '--inject', '--into', '--event', '--from', '--service', '--connection', '--owner', '--failed', '--done', '--coverage-from', '--registry-visibility', '--shapes', '--read', '--app', '--kind', '--blocks', '--tabs']);
 /** Flags that may repeat: their values are collected in order. */
 const LIST_FLAGS = new Set(['--inject']);
-const BOOL_FLAGS = new Set(['--json', '--fast', '--fe', '--no-types', '--db-types', '--wiring', '--form']);
+const BOOL_FLAGS = new Set(['--json', '--fast', '--fe', '--wiring', '--form']);
 
 function coverageArgument(arg, args, opts) {
   const inline = arg.startsWith('--coverage-from=');
@@ -247,11 +249,11 @@ function printExplain(e, out) {
  * The app pass: slots, managed files, formatter, contract snapshots and the architecture machine's check surface, root and sides.
  * `only` limits the formatter to those (app-relative) files.
  */
-async function runCheck({ repoRoot, harness, fast = false, base, only, presets, prettier, dbTypes = false }) {
+async function runCheck({ repoRoot, harness, fast = false, base, only, presets, prettier }) {
   const tracked = trackedFiles(repoRoot);
   // Managed files of the root and both sides, the .gitignore block and sonar against their render (R04, R05, R11, ...), and prettier
   // through the app's own install (R19, never under --fast).
-  const extraFindings = [...await managedFindings({ repoRoot, tracked, presets }), ...await checkDatabase({ repoRoot, files: tracked, base, ...(dbTypes ? { emitTypes: dbTypesEmitter() } : {}) }), ...(fast ? [] : await formatFindings({ repoRoot, files: only ?? tracked, prettier }))];
+  const extraFindings = [...await managedFindings({ repoRoot, tracked, presets }), ...await checkDatabase({ repoRoot, files: tracked, base }), ...(fast ? [] : await formatFindings({ repoRoot, files: only ?? tracked, prettier }))];
   // R23 against the be side itself (full pass only): committed snapshots equal what `starci app emit` writes now.
   let contracts = null;
   let be = null;
@@ -342,7 +344,7 @@ async function installedStackMain(cwd) {
 function databaseMain(argv, io) {
   const [verb, ...rest] = argv;
   const dispatch = DATABASE_VERBS.get(verb);
-  if (!dispatch) throw new Error('starci app db takes baseline, restamp, plan, migrate, post-cutover, dump or reset');
+  if (!dispatch) throw new Error('starci app db takes new, baseline, restamp, plan, migrate, post-cutover, dump or drift');
   return dispatch(rest, io);
 }
 
@@ -354,7 +356,7 @@ function printCheckProofs(result, out) {
 async function checkMain(opts, { cwd: repoRoot, harness, edition, stdout: out, presets, prettier, checkApp = runCheck, runLinter }) {
   if (opts.positional.length) throw new Error('starci app check takes no path');
   if (opts.base !== undefined && opts.fast !== true) throw new Error('--base names the ref --fast compares with; it needs --fast');
-  const checked = await checkEdition({ repoRoot, edition, normal: () => checkApp({ repoRoot, harness, fast: opts.fast === true, base: opts.base, presets, prettier, dbTypes: opts['db-types'] === true }), presets, prettier });
+  const checked = await checkEdition({ repoRoot, edition, normal: () => checkApp({ repoRoot, harness, fast: opts.fast === true, base: opts.base, presets, prettier }), presets, prettier });
   const proof = withCheckProofs(checked, { repoRoot, edition, wiring: opts.wiring === true, coverageFrom: opts['coverage-from'] });
   const changed = opts.fast === true ? changedSince(repoRoot, proof.fast?.base ?? opts.base).files : null;
   const existing = changed ? changed.filter(file => fs.existsSync(path.join(repoRoot, file))) : [];
@@ -395,7 +397,7 @@ function newMain(opts, { cwd: repoRoot, stdout: out }) {
 function addMain(opts, { cwd: repoRoot, stdout: out }) {
   const [noun, name, ...extra] = opts.positional;
   if (!noun || !name || extra.length) throw new Error('starci app add takes `<noun> <name>` and the options of the noun');
-  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, noTypes: opts['no-types'], shapes: opts.shapes, read: opts.read, app: opts.app, kind: opts.kind, form: opts.form, blocks: opts.blocks, tabs: opts.tabs } });
+  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, shapes: opts.shapes, read: opts.read, app: opts.app, kind: opts.kind, form: opts.form, blocks: opts.blocks, tabs: opts.tabs } });
   for (const file of created) out(`created ${file}\n`);
   const kinds = registered.kinds.length ? `; kinds ${registered.kinds.join(', ')}` : '';
   // A noun that registers nothing in hfs.json (a table, an app, a front-end unit) ends with what it wrote.
@@ -434,7 +436,7 @@ function declaredEdition(cwd) {
  */
 async function stackAppMain(argv, { cwd, edition, stackMain, stdout: out, stderr: err, env, sops, stackIo }) {
   if (STACK_ACTIONS.includes(argv[0])) return deployStackMain(argv, { ...stackIo, cwd, stdout: out, stderr: err, env, ...(sops ? { sops } : {}) });
-  if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local infrastructure with the Supabase CLI');
+  if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local database with npm run db:start');
   const run = stackMain ?? await installedStackMain(cwd);
   return run(argv, { cwd, out, err });
 }
@@ -457,7 +459,7 @@ function errorMessage(error) {
 
 /**
  * `harness` ({ version }) is the CLI that runs this package in-process: its version is the starci-harness an app is judged and
- * scaffolded at (runtime/scripts/hfs/canon-pins.mjs). `run` injects the Supabase runner, `runLinter` the linter transport, `checkApp`
+ * scaffolded at (runtime/scripts/hfs/canon-pins.mjs). `run` injects the database runner, `runLinter` the linter transport, `checkApp`
  * the HFS check and `stackIo` Swarm tools; production defaults execute every check.
  */
 export async function main(argv, {

package/stack/cli.mjs

@@ -14,8 +14,8 @@ const DOCKER_ACTIONS = new Set(['deploy', 'accept', 'converge', 'verify', 'rollb
 
 export const ACTIONS = Object.freeze(['prepare', 'doctor', 'connect', 'disconnect', 'build-args', 'render', 'deploy', 'converge', 'verify', 'rollback', 'prune', 'backup', 'jobs', 'task', 'ingress', 'retire', 'build', 'accept']);
 
-const BOOLEAN = new Set(['--execute', '--json', '--swarm-state', '--init-swarm', '--owner-approved', '--fix-live-restore', '--skip-public', '--skip-internal', '--allow-unpinned', '--push']);
-const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project', '--target-binding']);
+const BOOLEAN = new Set(['--execute', '--json', '--swarm-state', '--init-swarm', '--owner-approved', '--fix-live-restore', '--skip-public', '--skip-internal', '--allow-unpinned', '--push', '--urgent']);
+const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project', '--target-binding', '--db-url-env', '--backup-out']);
 const REPEAT = new Set(['--image', '--keep', '--extra-compose', '--project']);
 
 /** Splits argv into { flags, positional }; an unknown flag or a flag without its value is a refusal. */
@@ -71,6 +71,7 @@ const OPTIONS = {
   deploy: ({ flags, cwd }) => ({
     images: parseImages(flags.image), sourceSha: flags['source-sha'], execute: flags.execute === true,
     out: flags.out ? path.resolve(cwd, flags.out) : null, timeoutSeconds: number(flags, 'timeout'), retrySeconds: number(flags, 'retry'), skipPublic: flags['skip-public'] === true,
+    urgent: flags.urgent === true, dbUrlEnv: flags['db-url-env'], backupOut: flags['backup-out'] ? path.resolve(cwd, flags['backup-out']) : undefined,
   }),
   converge: ({ flags }) => ({ since: flags.since, timeoutSeconds: number(flags, 'timeout') }),
   verify: ({ flags }) => ({ retrySeconds: number(flags, 'retry'), skipPublic: flags['skip-public'] === true, skipInternal: flags['skip-internal'] === true }),
@@ -125,6 +126,8 @@ export async function stackMain(argv, io = {}) {
     if (binding && (!['deploy', 'verify'].includes(action) || flags['ssh-cmd'] || flags['skip-public'] || flags['skip-internal']))
       throw refusal('STACK_USAGE', 'the bound native consumer supports only complete deploy or verify');
     const config = bindStackTarget(ctx, loadDeployConfig({ repoRoot: ctx.cwd, env: flags.env ?? 'production' }), binding);
+    if (action !== 'deploy' && (flags.urgent || flags['db-url-env'] || flags['backup-out'])) throw refusal('STACK_USAGE', '--urgent, --db-url-env and --backup-out belong to deploy');
+    if (action === 'deploy' && !flags.urgent && (flags['db-url-env'] || flags['backup-out'])) throw refusal('STACK_USAGE', '--db-url-env and --backup-out choose the urgent floor\'s database and backup folder: add --urgent');
     const options = OPTIONS[action]({ flags, positional, cwd: ctx.cwd });
     const handler = await handlerOf(action, io.importer ?? ((file) => import(file)));
     const sshCmd = flags['ssh-cmd'] ?? null;
@@ -132,6 +135,11 @@ export async function stackMain(argv, io = {}) {
     const toolContext = nativeToolContext(ctx, binding);
     const result = DOCKER_ACTIONS.has(action) ? await withDockerTransport(toolContext, config, { sshCmd }, call) : await call(toolContext);
     print(ctx, action, flags, result);
+    // A floor step of an urgent deploy that failed is a refusal with its own code (urgent-floor.mjs), printed after the lines that led to it.
+    if (result.refused) {
+      ctx.stderr(`starci app stack: ${result.refused.code}: ${result.refused.message}\n`);
+      return EXIT.refused;
+    }
     return result.ok ? EXIT.ok : EXIT.failed;
   } catch (error) {
     if (!(error instanceof StackError)) throw error;

package/stack/deploy.mjs

@@ -2,6 +2,8 @@
 // deploy: render, provision, store the release record, pre-pull, `docker stack deploy`, converge, post-deploy tasks (deploy.postDeploy, when declared), verify, accept, prune. A failure at or
 // after the stack deploy redeploys the previous accepted release from its STORED bytes; a failure before it leaves the services untouched.
 // Without `execute` a deploy renders locally and prints the plan: NO remote call at all. A rollback cannot undo data effects.
+// An urgent deploy (`urgent`, owner ruling urgent-release 2026-10-29) runs the safety floor of urgent-floor.mjs first (fresh verified encrypted
+// backup with a test decrypt, rollback target, migrate preview then execute) and refuses with the floor's own code when a step of it fails.
 //
 // `deps` are the collaborators, all factories or functions with the signature of their module, defaulting to lazy dynamic imports so this
 // module never needs render.mjs / provision.mjs / remote.mjs at load time (the specs inject stubs):
@@ -21,6 +23,7 @@ import { postDeployStack } from './post-deploy.mjs';
 import { pruneStack } from './prune.mjs';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
 import { createReleaseStore } from './release-store.mjs';
+import { urgentDeploy } from './urgent-floor.mjs';
 import { verifyStack } from './verify.mjs';
 
 /** Loads `file` (relative to this module). Split out so a spec can load a real sibling module through `lazy`. */
@@ -39,8 +42,11 @@ export const DEFAULT_DEPS = Object.freeze({
   pruneStack,
   releaseStore: createReleaseStore,
   ssh: lazy('./remote.mjs', 'ownerSshRunner'),
+  floor: {},
 });
 
+const fileSha256 = (file) => createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+
 const IMAGE_LINE = /^[ \t]+image:[ \t]*(\S+)[ \t]*$/gmu;
 const QUOTE = /^["']|["']$/gu;
 const IMAGE_REF = /^[A-Za-z0-9][A-Za-z0-9./_:@-]*$/u;
@@ -212,7 +218,7 @@ async function deployExecute(ctx, config, options, d, out, cleanups) {
 }
 
 /**
- * Deploys a release: `options` = { images, sourceSha, execute, out, timeoutSeconds, retrySeconds, skipPublic, sshCmd }.
+ * Deploys a release: `options` = { images, sourceSha, execute, out, timeoutSeconds, retrySeconds, skipPublic, sshCmd, urgent, dbUrlEnv, backupOut }.
  * skipPublic (the first deploy into a shared ingress, whose public routes exist only after `ingress publish`): the verification checks only what runs
  * inside the stack, and the release stays PENDING (stored and deployed, pointer not moved) until `acceptRelease` has verified it in full.
  * Returns { ok, lines, data: { releaseId, previous, steps: [{ step, ok }], rolledBack } }.
@@ -224,15 +230,26 @@ export async function deployRelease(ctx, config, options = {}, deps = {}) {
   const out = options.out ?? made;
   const cleanups = [];
   try {
-    const rendered = await d.renderRelease(ctx, config, renderOptions(options, out, null));
-    const { releaseId } = inspectRendered(out, config);
-    if (options.execute !== true) {
+    // The local render and its inspection: a release that cannot render is refused before anything remote happens.
+    const render = async () => {
+      const rendered = await d.renderRelease(ctx, config, renderOptions(options, out, null));
+      return { rendered, releaseId: inspectRendered(out, config).releaseId };
+    };
+    const dryRun = async () => {
+      const { rendered, releaseId } = await render();
       const post = config.postDeploy.length > 0 ? ` post-deploy tasks (${config.postDeploy.join(', ')}),` : '';
       const plan = options.skipPublic
         ? `dry run: release ${releaseId} would be provisioned, stored, pre-pulled, deployed, converged,${post} and verified inside the stack (public hosts skipped); it would stay pending until ingress publish and stack accept`
         : `dry run: release ${releaseId} would be provisioned, stored, pre-pulled, deployed, converged,${post} verified, accepted`;
       return { ok: true, lines: [...(rendered.lines ?? []), plan], data: { releaseId, steps: [{ step: 'render', ok: true }], executed: false } };
+    };
+    if (options.urgent === true) {
+      return await urgentDeploy(ctx, config, options, {
+        render, dryRun, openStore: () => openStore(ctx, config, options, d, cleanups), deployExecute: () => deployExecute(ctx, config, options, d, out, cleanups), sha256: fileSha256,
+      }, d.floor);
     }
+    if (options.execute !== true) return await dryRun();
+    await render();
     return await deployExecute(ctx, config, options, d, out, cleanups);
   } finally {
     cleanups.forEach((close) => close());

package/stack/target-binding.mjs

@@ -6,7 +6,6 @@ import { refusal } from './errors.mjs';
 const slug = value => typeof value === 'string' && /^[a-z][a-z0-9-]*$/.test(value);
 const label = value => typeof value === 'string' && /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/.test(value);
 const host = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(value);
-const port = value => Number.isInteger(value) && value > 0 && value <= 65535;
 const denied = () => { throw refusal('STACKS_DEPLOY_CONFIG_INVALID', 'the native endpoint binding is invalid or differs from the selected owner target'); };
 const exact = (value, fields) => value && typeof value === 'object' && !Array.isArray(value)
   && Object.keys(value).length === fields.length && fields.every(key => Object.hasOwn(value, key));
@@ -28,44 +27,11 @@ function ordinaryInput(root, file) {
 /** A bound native owner opens only an ordinary envelope below its actual app, without ancestor links. */
 export const assertBoundCustody = (root, file) => ordinaryInput(root, file);
 
-/** Bound database commands require the app-local launcher; they cannot discover a global replacement. */
-export function boundSupabaseLauncher(root) {
-  const launcher = path.join(root, 'node_modules', 'supabase', 'dist', 'supabase.js');
-  ordinaryInput(root, launcher);
-  return launcher;
-}
-
 /** Native custody can use AGE; tools that do not decrypt custody must not inherit that identity. */
 export function nativeToolEnvironment(env) {
   return Object.fromEntries(Object.entries(env).filter(([key]) => !/^SOPS_/i.test(key)));
 }
 
-/** Bound database tools receive only their selected private password and native routing, without ambient libpq or provider credentials. */
-export function nativeDatabaseEnvironment(env, binding, selected = {}, omit = []) {
-  const omitted = new Set(omit.filter(value => typeof value === 'string').map(value => value.toUpperCase()));
-  return { ...Object.fromEntries(Object.entries(nativeToolEnvironment(env)).filter(([key]) => !/^(?:PG[A-Z_]*|SUPABASE_)/i.test(key) && !omitted.has(key.toUpperCase()))),
-    'SUPABASE_ENV': binding.environment, ...selected };
-}
-
-/** Preserve a logical linked project while selecting a fixed native SQL endpoint without the CLI's linked Management finalizer. */
-export function boundLinkedDatabaseUrl(binding, savedPooler = null) {
-  if (!binding || binding.mode !== 'linked' || !/^[a-z0-9]{20}$/.test(binding.projectRef)) denied();
-  if (savedPooler === null) return `postgresql://postgres@db.${binding.projectRef}.supabase.co:5432/postgres?sslmode=require`;
-  let url;
-  try {
-    if (typeof savedPooler !== 'string' || savedPooler.length > 8192) denied();
-    url = new URL(savedPooler.trim());
-    if (!['postgres:', 'postgresql:'].includes(url.protocol) || !/^[A-Za-z0-9.-]+\.pooler\.supabase\.com$/.test(url.hostname)
-      || decodeURIComponent(url.username) !== `postgres.${binding.projectRef}` || url.pathname !== '/postgres'
-      || url.port && !['5432', '6543'].includes(url.port) || url.hash
-      || [...url.searchParams].some(([key, value]) => key !== 'sslmode' || !['require', 'verify-full'].includes(value))) denied();
-  } catch { denied(); }
-  url.password = '';
-  url.port = '5432';
-  if (!url.searchParams.has('sslmode')) url.searchParams.set('sslmode', 'require');
-  return url.toString();
-}
-
 /** Parse the internal public binding; ordinary commands without this flag retain their native behavior. */
 export function parseTargetBinding(text, kind) {
   if (text === undefined) return null;
@@ -75,16 +41,6 @@ export function parseTargetBinding(text, kind) {
   if (kind === 'docker-swarm') {
     if (!exact(binding, ['kind', 'environment', 'stack', 'host', 'user', 'port']) || !slug(binding.stack)
       || !host(binding.host) || !label(binding.user) || binding.port !== 22) denied();
-  } else if (kind === 'supabase-db') {
-    if (binding.mode === 'local') {
-      if (!exact(binding, ['kind', 'mode', 'environment', 'localProject', 'port']) || !label(binding.localProject) || !port(binding.port)) denied();
-    } else if (binding.mode === 'linked') {
-      if (!exact(binding, ['kind', 'mode', 'environment', 'projectRef']) || !/^[a-z0-9]{20}$/.test(binding.projectRef ?? '')) denied();
-    } else if (binding.mode === 'url-env') {
-      if (!exact(binding, ['kind', 'mode', 'environment', 'urlEnv', 'host', 'port', 'database', 'user'])
-        || !/^[A-Z][A-Z0-9_]*$/.test(binding.urlEnv ?? '') || !host(binding.host) || !port(binding.port)
-        || !label(binding.database) || !label(binding.user)) denied();
-    } else denied();
   } else denied();
   return Object.freeze(binding);
 }
@@ -107,19 +63,3 @@ export function assertStackAccount(binding, account, knownHosts) {
   if (!binding) return;
   if (account !== `${binding.user}@${binding.host}` || binding.port !== 22 || !knownHosts.trim()) denied();
 }
-
-/** Compare the effective local Supabase identity after its existing config/environment resolver. */
-export function assertLocalDatabase(binding, target) {
-  if (binding && (binding.mode !== 'local' || binding.localProject !== target.project || binding.port !== target.port)) denied();
-}
-
-/** Refuse a selected URL unless its non-secret endpoint exactly matches the accepted target. */
-export function assertUrlDatabase(binding, value) {
-  if (!binding) return;
-  let url;
-  try { url = new URL(value); } catch { denied(); }
-  if (binding.mode !== 'url-env' || !['postgres:', 'postgresql:'].includes(url.protocol)
-    || url.hostname !== binding.host || Number(url.port || '5432') !== binding.port
-    || decodeURIComponent(url.username) !== binding.user || decodeURIComponent(url.pathname.slice(1)) !== binding.database
-    || url.search || url.hash || !url.password) denied();
-}

package/stack/urgent-floor.mjs

@@ -0,0 +1,147 @@
+// urgent-floor.mjs - the safety floor of an urgent deploy (`starci app stack deploy --urgent`, owner ruling urgent-release 2026-10-29). An urgent
+// release skips CI and the full gate, never this floor; each step that fails is a refusal with its own code, never a warning:
+//   record     the commit carries a pushed URGENT record (release/urgent.mjs)                     STACK_URGENT_NO_RECORD, STACK_URGENT_NOT_PUSHED
+//   backup     a fresh full database backup, encrypted to the app's age recipients (db dump)       STACK_URGENT_BACKUP_FAILED
+//   verified   its receipt names this run, its size, age header and sha256 match the archive        STACK_URGENT_BACKUP_UNVERIFIED
+//   decrypt    a test decrypt with the operator's age identity (SOPS_AGE_KEY_FILE) lists every part STACK_URGENT_DECRYPT_UNAVAILABLE, STACK_URGENT_DECRYPT_FAILED
+//   render     the release renders locally (deploy.mjs inspectRendered)                           its own STACKS_/STACK_DEPLOY_ refusal
+//   rollback   an accepted previous release exists, so a red deploy has somewhere to go back to    STACK_URGENT_NO_ROLLBACK_TARGET
+//   migrate    db migrate previews the plan, then executes it                                     STACK_URGENT_MIGRATE_PREVIEW_RED, STACK_URGENT_MIGRATE_FAILED
+//   deploy     the release with its readiness verify (deploy.verify); red rolls back by itself    STACK_URGENT_RED_ROLLED_BACK, STACK_URGENT_ROLLBACK_FAILED,
+//                                                                                                 STACK_URGENT_DEPLOY_NOT_STARTED (red before the stack deploy)
+// The public-host checks are never skipped (STACK_URGENT_SKIP_PUBLIC). A rollback cannot undo the migrations: the backup above is their way back.
+// `deps` are the collaborators (backup, decrypt, migrate), each defaulting to the app's own db verbs; a spec injects stubs.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readDeclaration } from '../release/index.mjs';
+import { releaseDir } from '../release/gate.mjs';
+import { readUrgent } from '../release/records.mjs';
+import { refusal } from './errors.mjs';
+
+const AGE_HEADER = 'age-encryption.org/v1\n';
+const SHA = /^[a-f0-9]{64}$/u;
+
+/** The database a floor step reaches: the connection named by --db-url-env (default DATABASE_URL). */
+const targetOf = (options) => (options.dbUrlEnv ? { urlEnv: options.dbUrlEnv } : {});
+
+/** The backups of an urgent deploy live outside every repository: --backup-out, else ~/.starci-backups/<project>. */
+const backupDir = (config, options) => options.backupOut ?? path.join(os.homedir(), '.starci-backups', config.project);
+
+async function defaultBackup(ctx, { target, out }) {
+  const { dumpDatabase } = await import('../db/dump.mjs');
+  return dumpDatabase(ctx, { ...target, out }).data;
+}
+
+async function defaultDecrypt(ctx, { archive, identity, parts }) {
+  const { backupTool } = await import('../db/backup-receipt.mjs');
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'starci-decrypt-'));
+  try {
+    backupTool(ctx, 'age', ['-d', '-i', identity, '-o', path.join(scratch, 'backup.tar'), archive]);
+    const listed = String(backupTool(ctx, 'tar', ['-tf', 'backup.tar'], { cwd: scratch }).stdout ?? '').split(/\r?\n/u).map((line) => line.replace(/^\.\//u, '').trim());
+    const missing = parts.filter((part) => !listed.includes(part));
+    if (missing.length > 0) throw new Error(`the decrypted archive lacks ${missing.join(', ')}`);
+    return { parts: listed.filter(Boolean) };
+  } finally {
+    fs.rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
+async function defaultMigrate(ctx, { target, execute }) {
+  const { loadDatabase, migrateDatabase } = await import('../db/migrate.mjs');
+  // The urgent deploy's --execute is the arming of this one migration: the floor runs it, it never waits for a second switch.
+  const armed = Object.create(ctx, { env: { value: { ...ctx.env, STARCI_DB_ARMED: '1' } } });
+  return migrateDatabase(armed, loadDatabase(ctx.cwd), { ...target, execute });
+}
+
+export const FLOOR_DEPS = Object.freeze({ backup: defaultBackup, decrypt: defaultDecrypt, migrate: defaultMigrate });
+
+/** A refused floor step: the lines so far and the code; the CLI prints both and exits 2. */
+const refused = (lines, code, message, data = {}) => ({ ok: false, refused: { code, message }, lines, data: { ...data, refused: code } });
+
+/** Problems of the backup receipt against its archive: written by this run, a full backup, its size, age header and sha256 equal to the file's. */
+function receiptProblems(receipt, archive, startedMs, sha256) {
+  const problems = [];
+  if (!receipt || typeof receipt !== 'object') return ['no receipt'];
+  if (receipt.schemaOnly !== false) problems.push('the backup is not a full (data) backup');
+  if (!Number.isFinite(Date.parse(receipt.at)) || Date.parse(receipt.at) < startedMs - 1000) problems.push('the receipt is not from this run');
+  if (!fs.existsSync(archive)) return [...problems, 'the archive is missing'];
+  const size = fs.statSync(archive).size;
+  const header = Buffer.alloc(AGE_HEADER.length);
+  const fd = fs.openSync(archive, 'r');
+  try { fs.readSync(fd, header, 0, header.length, 0); } finally { fs.closeSync(fd); }
+  if (header.toString('ascii') !== AGE_HEADER) problems.push('the archive has no age header');
+  if (size !== receipt.bytes) problems.push(`the archive is ${size} bytes, the receipt says ${receipt.bytes}`);
+  if (!SHA.test(String(receipt.sha256 ?? '')) || sha256(archive) !== receipt.sha256) problems.push('the archive sha256 differs from the receipt');
+  return problems;
+}
+
+/** What the floor needs before anything runs: the pushed urgent record, a declared database, the identity of the test decrypt, the full public verify. */
+function preconditions(ctx, config, options) {
+  if (options.skipPublic) throw refusal('STACK_URGENT_SKIP_PUBLIC', 'an urgent deploy verifies the public hosts and accepts the release: drop --skip-public');
+  const record = readUrgent(releaseDir(ctx), options.sourceSha);
+  if (!record) throw refusal('STACK_URGENT_NO_RECORD', `${options.sourceSha} has no urgent record: push it with starci app release push --urgent --reason "<text>" --execute first`);
+  if (record.pushed !== true) throw refusal('STACK_URGENT_NOT_PUSHED', `the urgent release ${record.tag} of ${options.sourceSha.slice(0, 10)} was never pushed`);
+  if (!readDeclaration(config.repoRoot ?? ctx.cwd).database) throw refusal('STACK_URGENT_NO_DATABASE', 'the floor backs up and migrates the database the `database:` block declares, and this app declares none');
+  const identity = ctx.env.SOPS_AGE_KEY_FILE;
+  if (!identity || !fs.existsSync(identity)) throw refusal('STACK_URGENT_DECRYPT_UNAVAILABLE', 'the test decrypt of the backup reads the age identity named by SOPS_AGE_KEY_FILE, which is not set or not a file');
+  return { record, identity };
+}
+
+/**
+ * The floor's steps before the deploy: backup, verify and test decrypt (before anything remote), the local render, the rollback target, migrate
+ * preview and execute. Returns null when all passed, else the refused result.
+ */
+async function guard(ctx, config, options, { f, run, identity, lines }) {
+  const target = targetOf(options);
+  const started = ctx.now();
+  let backup;
+  try { backup = await f.backup(ctx, { target, out: backupDir(config, options) }); } catch (error) {
+    return refused(lines, 'STACK_URGENT_BACKUP_FAILED', `the fresh database backup failed (${String(error?.code ?? error?.message ?? error)}); nothing was migrated or deployed`);
+  }
+  const archive = path.join(path.dirname(backup.receiptPath), backup.receipt?.file ?? '');
+  const problems = receiptProblems(backup.receipt, archive, started, run.sha256);
+  if (problems.length > 0) return refused(lines, 'STACK_URGENT_BACKUP_UNVERIFIED', `${problems.join('; ')}; nothing was migrated or deployed`);
+  lines.push(`floor: backup ${path.basename(archive)} (${backup.receipt.bytes} bytes, sha256 ${backup.receipt.sha256.slice(0, 12)}) receipt ${backup.receiptPath}`);
+  try { await f.decrypt(ctx, { archive, identity, parts: backup.receipt.parts }); } catch (error) {
+    return refused(lines, 'STACK_URGENT_DECRYPT_FAILED', `the test decrypt of the backup failed (${String(error?.code ?? error?.message ?? error)}); nothing was migrated or deployed`);
+  }
+  lines.push(`floor: test decrypt listed ${backup.receipt.parts.length} part(s)`);
+  const { releaseId } = await run.render();
+  lines.push(`floor: release ${releaseId} rendered`);
+  const store = await run.openStore();
+  if (!(await store.current())) return refused(lines, 'STACK_URGENT_NO_ROLLBACK_TARGET', 'no accepted previous release is stored on the manager, so a red urgent deploy could not roll back; nothing was migrated or deployed');
+  let preview;
+  try { preview = await f.migrate(ctx, { target, execute: false }); } catch (error) { preview = { ok: false, lines: [String(error?.message ?? error)] }; }
+  lines.push(...(preview.lines ?? []).map((line) => `floor: migrate preview: ${line}`));
+  if (!preview.ok) return refused(lines, 'STACK_URGENT_MIGRATE_PREVIEW_RED', 'the migration preview is red; nothing was migrated or deployed');
+  let applied;
+  try { applied = await f.migrate(ctx, { target, execute: true }); } catch (error) { applied = { ok: false, lines: [String(error?.message ?? error)] }; }
+  lines.push(...(applied.lines ?? []).map((line) => `floor: migrate: ${line}`));
+  if (!applied.ok) return refused(lines, 'STACK_URGENT_MIGRATE_FAILED', `the migration failed; nothing was deployed (restore from ${backup.receiptPath} if the database is half migrated)`);
+  return null;
+}
+
+/**
+ * An urgent deploy: the floor's preconditions, then (with execute) its guard steps, then `deployExecute` (the release, its readiness verify and the
+ * automatic rollback). `run` = { render(), openStore(), deployExecute(), dryRun(), sha256 }. Returns { ok, lines, data } or a refused result whose
+ * data names the urgent release.
+ */
+export async function urgentDeploy(ctx, config, options, run, deps = {}) {
+  const f = { ...FLOOR_DEPS, ...deps };
+  const { record, identity } = preconditions(ctx, config, options);
+  const lines = [`urgent         ${record.tag} (${options.sourceSha.slice(0, 10)}) by ${record.role}: ${record.reason}`];
+  if (options.execute !== true) {
+    const plan = await run.dryRun();
+    return { ...plan, lines: [...lines, 'floor (never skipped): fresh encrypted database backup, receipt verify, test decrypt, rollback target, migrate preview then execute, deploy with readiness verify and automatic rollback', ...plan.lines] };
+  }
+  const stop = await guard(ctx, config, options, { f, run, identity, lines });
+  if (stop) return { ...stop, data: { ...stop.data, urgent: record.tag } };
+  const deployed = await run.deployExecute();
+  const all = [...lines, ...deployed.lines];
+  if (deployed.ok) return { ...deployed, lines: all, data: { ...deployed.data, urgent: record.tag } };
+  const data = { ...deployed.data, urgent: record.tag };
+  if (!(deployed.data?.steps ?? []).some((step) => step.step === 'deploy')) return refused(all, 'STACK_URGENT_DEPLOY_NOT_STARTED', 'the release failed before the stack deploy, so the services are untouched; the migrations stay (backup above)', data);
+  if (deployed.data?.rolledBack) return refused(all, 'STACK_URGENT_RED_ROLLED_BACK', `the release failed its deploy or readiness verify and was rolled back to ${deployed.data.previous}; the migrations stay (backup above)`, data);
+  return refused(all, 'STACK_URGENT_ROLLBACK_FAILED', 'the release is red and the automatic rollback did not converge: follow the stack runbook, Rollback', data);
+}

package/sync/ci-commands.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
 import { refusal } from '../stack/errors.mjs';
 import { byCodeUnit } from '../report/order.mjs';
+import { ENTITY_LIST } from '../db/entity-list.mjs';
 
 // One command vocabulary for managed CI rendering and the runtime coverage gate.
 const exampleCommand = (source, command) => source?.runtimeExample
@@ -195,7 +196,8 @@ export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info',
     ciLintSonar: exampleCommand(source, 'npm run lint -- --sonar reports/lint.sonar.json'),
     // The coverage judgement alone over the merged report: the fast and lint jobs already ran every other rule of the app check.
     ciCoverageProof: exampleCommand(source, 'npx starci app coverage verify ' + lcovReport),
-    ciDatabaseLint: exampleCommand(source, 'npm run db:lint'),
+    // An app with an entity list also checks its entities against the schema its migrations build, in the build job (a runner with Docker).
+    ciDatabaseLint: exampleCommand(source, (source?.files ?? []).includes(ENTITY_LIST.slice('be/'.length)) ? 'npm run db:lint && npx starci app db drift' : 'npm run db:lint'),
     auditCommand: `npm audit${audit.omitDev ? ' --omit=dev' : ''} --audit-level=${audit.level}`,
     sonarTokenSecret: sonar?.token ?? 'SONAR_TOKEN',
     sonarHostVar: sonar?.hostVar ?? 'SONAR_HOST_URL',

package/sync/index.mjs

@@ -157,6 +157,8 @@ function trailingNewline(text) {
 }
 
 /** The digest-pinned image of a lite app's declared Redis, in every environment that runs it (ruling:R212/case-10). */
+/** The pinned image of a lite app's db service (contexts/stack/pins.yaml images): PostgreSQL with pg_cron, pg_net, pgmq and pgvector. */
+export const DB_IMAGE = 'supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2';
 export const REDIS_IMAGE = 'redis:7@sha256:c6eabf748fc7a61dbb5a705c78bcf3d6377b1127a97d0ce965c11c44ba46896f';
 
 const redisDevText = project => render(readBundled('app/package-scripts/redis-dev.json'), { project, redisImage: REDIS_IMAGE });
@@ -286,7 +288,7 @@ export function appScripts(app, source) {
   const watch = entry => `cd be && ts-node-dev --respawn -r tsconfig-paths/register apps/${entry.name}/src/main.ts`;
   const built = entry => `node be/dist/apps/${entry.name}/src/main.js`;
   const workspace = entry => feAppPackageName(app.project, entry.name);
-  // Both editions generate before they run (owner ruling 2026-10-13): the fe's GraphQL wire types, and under lite the Supabase types check.
+  // Both editions generate before they run (owner ruling 2026-10-13): the fe's GraphQL wire types, and under lite the database types check.
   const dev = entry => `npm run codegen --silent && turbo run dev --filter=${workspace(entry)}`;
   const images = imageEntries(app, source);
   const imageCommand = ({ side, entry }) => `docker build -f ${dockerfilePath(side, entry.name)} -t ${app.project}/${entry.name}:dev .`;
@@ -347,7 +349,7 @@ export function imageFiles(app, source) {
   const side = app.sides.fe;
   const inputs = [...(opensPackages(side) ? ['fe/packages'] : []), ...((side.reads ?? []).includes('be/contracts/') ? ['be/contracts'] : [])];
   const copyInputs = inputs.map(folder => `COPY ${folder} ${folder}\n`).join('');
-  // The folders outside be/ that the back end declares it reads (the generated Supabase types of a lite back end, which an upgraded app keeps reading) are in every one of its images.
+  // The folders outside be/ that the back end declares it reads (the generated database types of a lite back end, db/types/) are in every one of its images.
   const beFolders = (app.sides.be.reads ?? []).map(folder => folder.replace(/\/$/, ''));
   const copyBeInputs = beFolders.map(folder => `COPY ${folder} ${folder}\n`).join('');
   const entries = imageEntries(app, source).map(({ side: which, entry: item }) => ({ side: which, item }));
@@ -373,8 +375,8 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     project: app.project,
     appBinary: APP_BINARY,
     appScripts: appScripts(app, source),
-    // A full upgrade keeps the app's declared Supabase connection and its local database commands.
-    supabaseScripts: providers.includes('supabase') ? render(readBundled('app/package-scripts/supabase.json'), { appBinary: APP_BINARY }) : '',
+    // A lite app's own database runs in development as one container of the pinned db image (ruling:lite-self-hosted-postgres-passport-minio).
+    dbImage: DB_IMAGE,
     // A lite app's declared Redis (sides.be.backing, ruling:R212/case-10) runs in development as one container of its pinned image.
     backingScripts: lite && (app.sides.be.backing ?? []).includes('redis') ? redisDevText(app.project) : '',
     // turbo builds every fe app workspace; ^build (turbo.json) builds the packages each app imports first, and caches both.
@@ -555,6 +557,24 @@ export async function renderRepo(root, { presets, parseYaml, notices, manifest =
   return { hfs, targets: renderTargets(hfs, presets ?? await loadPresets(root), { sonarKey, manifest, source: appSource(root, { parseYaml, notices }) }) };
 }
 
+/** The folders a lite app's sync retires (ruling lite-self-hosted-postgres-passport-minio): the generated Supabase row types nothing reads any more. */
+const LITE_RETIRED_DIRS = Object.freeze(['supabase/types']);
+
+/** The app-relative files of the retired folders that still exist under `root` of a lite app; sync --write deletes them, --check reports them. */
+export function retiredFiles(root, hfs) {
+  if (hfs?.edition !== 'lite') return [];
+  const found = [];
+  const walk = (rel) => {
+    const full = path.join(root, rel);
+    const stat = fs.lstatSync(full, { throwIfNoEntry: false });
+    if (!stat) return;
+    if (stat.isDirectory()) for (const name of fs.readdirSync(full).sort(byCodeUnit)) walk(`${rel}/${name}`);
+    else found.push(rel);
+  };
+  for (const dir of LITE_RETIRED_DIRS) walk(dir);
+  return found;
+}
+
 /** `starci app sync --check | --write [--cwd <dir>]` at the app root; returns 0 clean, 1 drift, 2 usage. */
 function syncOptions(argv) {
   const check = argv.includes('--check'), write = argv.includes('--write');
@@ -567,16 +587,17 @@ function syncOptions(argv) {
   return { write, cwdAt };
 }
 
-function reportSyncCheck(root, targets, out) {
+function reportSyncCheck(root, targets, out, retired = []) {
   const results = checkTargets(root, targets);
   const bad = results.filter(item => item.status !== 'ok');
+  for (const file of retired) out(`HFS_SYNC_DRIFT ${file}: retired, the lite edition generates no database types; run "npx starci app sync --write" to delete it`);
   for (const result of bad) {
     const found = result.actualHash ? `, found ${result.actualHash.slice(0, 12)}` : '';
     const where = result.difference ? ` (line ${result.difference.line}: expected ${JSON.stringify(result.difference.expected)}, found ${JSON.stringify(result.difference.actual)})` : '';
     out(`HFS_SYNC_DRIFT ${result.path}: ${result.status}, expected sha256 ${result.expectedHash.slice(0, 12)}${found}${where}`);
   }
   out(`starci app sync --check: ${results.length - bad.length} of ${results.length} in sync${bad.length ? '; run "npx starci app sync --write"' : ''}`);
-  return bad.length ? 1 : 0;
+  return bad.length || retired.length ? 1 : 0;
 }
 
 export async function runSync(argv, { cwd = process.cwd(), out = line => process.stdout.write(`${line}\n`), presets, parseYaml } = {}) {
@@ -589,15 +610,18 @@ export async function runSync(argv, { cwd = process.cwd(), out = line => process
   const root = cwdAt >= 0 ? path.resolve(cwd, argv[cwdAt + 1]) : cwd;
   try {
     const notices = [];
-    const { targets } = await renderRepo(root, { presets, parseYaml, notices });
+    const { hfs, targets } = await renderRepo(root, { presets, parseYaml, notices });
+    const retired = retiredFiles(root, hfs);
     if (targets.some(target => target.path === 'README.md')) for (const notice of new Set(notices)) out(notice);
     if (write) {
       const written = writeTargets(root, targets);
       for (const file of written) out(`wrote ${file}`);
+      for (const file of retired) { fs.rmSync(path.join(root, file)); out(`removed ${file} (retired)`); }
+      for (const dir of LITE_RETIRED_DIRS) if (retired.length && fs.existsSync(path.join(root, dir)) && !fs.readdirSync(path.join(root, dir)).length) fs.rmdirSync(path.join(root, dir));
       out(`starci app sync: ${written.length} written, ${targets.length - written.length} already in sync`);
       return 0;
     }
-    return reportSyncCheck(root, targets, out);
+    return reportSyncCheck(root, targets, out, retired);
   } catch (error) {
     if (!(error instanceof SyncError)) throw error;
     out(error.message);