@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g18cfeb7

package/src/schema/doctor.ts

@@ -15,7 +15,7 @@ import chalk from "chalk";
 import { CollectionConfig, isPostgresCollectionConfig, Property, NumberProperty, StringProperty, DateProperty, ArrayProperty, MapProperty, RelationProperty, type ResolvedManyToMany, type ResolvedBelongsTo, isManyToMany } from "@rebasepro/types";
 import { generateSchema } from "./generate-drizzle-schema-logic";
 import { generateTypedefs } from "@rebasepro/codegen";
-import { getTableName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
+import { getTableName, resolveCollectionRelations, findRelation, relationalCollections } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 import { logger, loadCollectionsFromDirectory } from "@rebasepro/server";
 
@@ -164,8 +164,10 @@ export async function checkCollectionsVsSchema(
 issues };
     }
 
-    // Re-generate schema in-memory and compare with file on disk
-    const postgresCollections = collections.filter(isPostgresCollectionConfig);
+    // Re-generate schema in-memory and compare with file on disk. Only the
+    // collections the generator itself will emit — a Firestore collection has
+    // no table in the generated file and must not be reported as missing one.
+    const postgresCollections = relationalCollections(collections);
     if (postgresCollections.length === 0) {
         return { passed: true,
 issues };
@@ -292,7 +294,7 @@ export async function checkCollectionsVsDatabase(
     const schemas = Array.from(new Set([
         "public",
         "rebase",
-        ...collections
+        ...relationalCollections(collections)
             .filter(isPostgresCollectionConfig)
             .map(c => c.schema)
             .filter((s): s is string => !!s)
@@ -383,7 +385,7 @@ export async function checkCollectionsVsDatabase(
 
         // ── Compare each collection against the database ─────────────────
 
-        const postgresCollections = collections.filter(isPostgresCollectionConfig);
+        const postgresCollections = relationalCollections(collections);
 
         for (const collection of postgresCollections) {
             const tableName = getTableName(collection);

package/src/schema/ensure-collection-tables.ts

@@ -26,7 +26,7 @@
  * no-op.
  */
 import { type CollectionConfig, type Property, isPostgresCollectionConfig } from "@rebasepro/types";
-import { getTableName } from "@rebasepro/common";
+import { getTableName, relationalCollections } from "@rebasepro/common";
 import { logger } from "@rebasepro/server";
 import {
     getSqlColumnType,
@@ -36,6 +36,12 @@ import {
     planJunctionTables,
     quoteSqlLiteral
 } from "./generate-postgres-ddl-logic";
+import {
+    AUTH_USERS_COLUMNS,
+    authUsersColumnDefinition,
+    authUsersColumnSql,
+    isAuthCollection
+} from "./auth-users-columns";
 
 /**
  * The subset of a database handle this needs: run a statement, get rows back.
@@ -167,9 +173,15 @@ function requiredEnums(collection: CollectionConfig): { name: string; values: st
  * table may be the target of a relation), and nothing is emitted twice.
  */
 export function planCollectionSchemaEnsure(
-    collections: CollectionConfig[],
+    allCollections: CollectionConfig[],
     existing: ExistingSchema
 ): EnsurePlan {
+    // Boot receives every collection the bundle declares, including the ones
+    // served by another engine entirely. Creating a Postgres table for a
+    // Firestore collection is not a harmless extra: the app keeps reading
+    // documents from Firestore while an empty table with the same name accretes
+    // policies and shows up in every drift report.
+    const collections = relationalCollections(allCollections);
     const actions: EnsureAction[] = [];
     const plannedEnums = new Set<string>();
 
@@ -204,17 +216,22 @@ export function planCollectionSchemaEnsure(
         );
         const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1] as Property) : "id";
         const idProp = idEntry?.[1] as Property | undefined;
-        let idDef: string;
-        if (idProp?.type === "number") {
-            idDef = `"${idName}" BIGSERIAL PRIMARY KEY`;
-        } else if (
-            idProp &&
-            idProp.type === "string" &&
-            (idProp as { isId?: unknown }).isId === "uuid"
-        ) {
-            idDef = `"${idName}" UUID PRIMARY KEY DEFAULT gen_random_uuid()`;
-        } else {
-            idDef = `"${idName}" TEXT PRIMARY KEY`;
+        // Derived through the generator's own type mapping, not re-decided here.
+        // This branch used to emit BIGSERIAL for a numeric id while `db push`
+        // emitted INTEGER GENERATED BY DEFAULT AS IDENTITY, so the same project
+        // got an int8 key when the runtime brought the schema up and an int4 key
+        // when a human pushed it. Two consequences, both real: node-postgres
+        // hands back int8 as a *string*, so a collection declaring
+        // `type: "number"` served `"1"` instead of `1` on the managed path only;
+        // and every foreign key and junction column pointing at it stayed
+        // INTEGER on both paths, which is a truncation waiting for the sequence
+        // to pass 2^31. The agreement test now pins this.
+        const idType = idProp
+            ? getSqlColumnType(idEntry![0], idProp, collection, collections)
+            : "TEXT";
+        let idDef = `"${idName}" ${idType} PRIMARY KEY`;
+        if (idProp?.type === "string" && (idProp as { isId?: unknown }).isId === "uuid") {
+            idDef += " DEFAULT gen_random_uuid()";
         }
         actions.push({
             kind: "create-table",
@@ -276,17 +293,14 @@ export function planCollectionSchemaEnsure(
         schema: string,
         table: string,
         column: string,
-        type: string
+        definition: string
     ): void => {
         const present = existing.tables.get(key);
         if (present?.has(column)) return;
         actions.push({
             kind: "add-column",
             target: `${key}.${column}`,
-            // Never NOT NULL: an existing table with rows cannot take a
-            // non-null column without a default, and inventing one would be
-            // guessing at the customer's data.
-            sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${type};`
+            sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${definition};`
         });
     };
 
@@ -294,6 +308,16 @@ export function planCollectionSchemaEnsure(
         const key = qualified(collection);
         const schema = schemaOf(collection);
         const table = getTableName(collection);
+        // A table this run is creating has no rows yet, so the constraints
+        // `db push` writes are free to apply. On a table that already exists
+        // they are not: `SET NOT NULL` is checked against live rows and a UNIQUE
+        // would fail on existing duplicates, and this module runs unattended
+        // against customer data with nobody reading a diff. So the constraints
+        // are emitted for the fresh case — which is the whole managed-runtime
+        // path, and the one that diverged from `db push` — and withheld for the
+        // adopted one. `rebase db push` remains how an existing table gets them.
+        const fresh = created.has(key);
+        const auth = isAuthCollection(collection);
         for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
             const p = prop as Property;
             if (isIdProperty(propName, p, collection)) continue;
@@ -302,7 +326,52 @@ export function planCollectionSchemaEnsure(
             // foreign key the same way `db push` does. Deriving them here as
             // plain columns is what once produced a column with no constraint.
             if (p.type === "reference" || p.type === "relation") continue;
-            addColumn(key, schema, table, resolveColumnName(propName, p), getSqlColumnType(propName, p, collection, collections));
+
+            const column = resolveColumnName(propName, p);
+            // On an auth collection, the columns auth itself reads and writes
+            // have exactly one definition, wherever the table is created from —
+            // see `auth-users-columns`. Anything else on that collection is an
+            // ordinary user-declared field and is generated like any other.
+            const authDefinition = auth ? authUsersColumnDefinition(column) : undefined;
+            if (authDefinition) {
+                addColumn(key, schema, table, column, authDefinition);
+                continue;
+            }
+
+            // Assembled in the generator's order — type, UNIQUE, DEFAULT,
+            // NOT NULL — so the two produce byte-identical column definitions
+            // and the agreement test can compare them directly instead of
+            // checking that a column merely exists, which is how BIGSERIAL-vs-
+            // INTEGER and every missing constraint went unnoticed.
+            let definition = getSqlColumnType(propName, p, collection, collections);
+            if (fresh && p.validation?.unique) definition += " UNIQUE";
+            // Not gated on `fresh`: a default binds future writes only, so it is
+            // safe on a live table, and a column added without it would take the
+            // value the application forgot to send rather than `now()`.
+            const autoValue = (p as { autoValue?: string }).autoValue;
+            if (p.type === "date" && (autoValue === "on_create" || autoValue === "on_update")) {
+                definition += " DEFAULT now()";
+            }
+            if (fresh && p.validation?.required) definition += " NOT NULL";
+            addColumn(key, schema, table, column, definition);
+        }
+
+        // The auth columns the collection never mentions. The scaffold's users
+        // collection describes 12 of the 14 auth reads and writes, so planning
+        // only from properties left `is_anonymous` and `tokens_valid_after` to
+        // `ensureAuthTablesExist` — which does create them, but only because
+        // that function happens to run later in the same boot. Planning them
+        // here makes this path self-contained and identical to `db push`, so
+        // neither depends on the other having run.
+        if (auth) {
+            const declared = new Set(
+                Object.entries(collection.properties ?? {})
+                    .map(([name, prop]) => resolveColumnName(name, prop as Property))
+            );
+            for (const spec of AUTH_USERS_COLUMNS) {
+                if (declared.has(spec.column)) continue;
+                addColumn(key, schema, table, spec.column, authUsersColumnSql(spec));
+            }
         }
     }
 

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,6 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo, type ResolvedForeignKeyOnTarget, hasForeignKeyOnTarget } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from "@rebasepro/common";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength, relationalCollections } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
 // --- Helper Functions ---
@@ -451,7 +451,13 @@ const computeSharedRelationName = (
 };
 
 // --- Main Schema Generation Logic ---
-export const generateSchema = async (collections: CollectionConfig[], stripPolicies = false): Promise<string> => {
+export const generateSchema = async (allCollections: CollectionConfig[], stripPolicies = false): Promise<string> => {
+    // A Firestore or MongoDB collection has no table to generate, and generating
+    // one for it is not merely wasted output: `db push` would create it, and
+    // `rebase doctor` would then report the store the collection actually reads
+    // from as drift. Non-SQL collections leave the toolchain here, once, rather
+    // than being filtered again in each stage below.
+    const collections = relationalCollections(allCollections);
     let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
 
 

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,6 +1,8 @@
 import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength, relationalCollections } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule, generateForeignKeyName, legacyForeignKeyName } from "@rebasepro/utils";
+import { AUTH_USERS_COLUMNS, authUsersColumnDefinition, authUsersColumnSql, isAuthCollection } from "./auth-users-columns";
+import { REBASE_SCHEMA } from "@rebasepro/types";
 
 // --- Helper Functions ---
 
@@ -236,14 +238,24 @@ export const getSqlColumnType = (propName: string, prop: Property, collection: C
 };
 
 export const generatePostgresDdl = async (
-    collections: CollectionConfig[],
+    allCollections: CollectionConfig[],
     options: { includePolicies?: boolean } = { includePolicies: true }
 ): Promise<string> => {
+    // Only the collections this engine stores. See `relationalCollections`.
+    const collections = relationalCollections(allCollections);
     let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n\n";
 
-    // 1. Create custom schemas
+    // 1. Create custom schemas.
+    //
+    // `rebase` is unconditional and load-bearing. The RLS helper functions live
+    // in it, so the migration preamble creates it — which puts it in Atlas's
+    // replayed state, and anything in that state but absent from this desired
+    // schema gets a `DROP SCHEMA … CASCADE` planned against it. That would take
+    // the auth tables. It used to appear here only when some collection
+    // happened to declare `schema: "rebase"`; the scaffold's users collection
+    // does, which is why nobody hit it, but nothing guaranteed it.
     const uniqueSchemas = Array.from(new Set([
-        "auth",
+        REBASE_SCHEMA,
         ...collections.map(c => isPostgresCollectionConfig(c) ? c.schema : undefined).filter(Boolean)
     ]));
     uniqueSchemas.forEach(schema => {
@@ -355,8 +367,8 @@ export const generatePostgresDdl = async (
             ddl += `  PRIMARY KEY ("${sourceColumn}", "${targetColumn}")\n`;
             ddl += `);\n\n`;
 
-            fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
-            fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+            fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${sourceColumn}_fkey`)}" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
+            fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${targetColumn}_fkey`)}" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
 
             if (options.includePolicies) {
                 // Junction tables are generated tables like any other: locked by
@@ -414,7 +426,7 @@ export const generatePostgresDdl = async (
                     if (required) colDef += " NOT NULL";
                     columns.push(colDef);
 
-                    fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${relInfo.localKey}_fkey" FOREIGN KEY ("${relInfo.localKey}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);
+                    fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${relInfo.localKey}_fkey`)}" FOREIGN KEY ("${relInfo.localKey}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);
                 } else if (prop.type === "reference") {
                     const refProp = prop as ReferenceProperty;
                     const targetCollection = collections.find(c => c.slug === refProp.path || getTableName(c) === refProp.path);
@@ -436,10 +448,27 @@ export const generatePostgresDdl = async (
                         if (required) colDef += " NOT NULL";
                         columns.push(colDef);
 
-                        fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${colName}_fkey" FOREIGN KEY ("${colName}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+                        fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${colName}_fkey`)}" FOREIGN KEY ("${colName}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
                     }
                 } else {
                     const colName = resolveColumnName(propName, prop);
+
+                    // On an auth collection, the columns auth reads and writes
+                    // are defined once, in `auth-users-columns`, and every
+                    // creator of this table emits that definition. Before this,
+                    // the desired state here was built from the collection file
+                    // alone — which knows nothing of `is_anonymous` or
+                    // `tokens_valid_after` — so `db push` and the runtime
+                    // disagreed about `email`'s nullability and about which
+                    // columns exist at all.
+                    const authDefinition = isAuthCollection(collection)
+                        ? authUsersColumnDefinition(colName)
+                        : undefined;
+                    if (authDefinition && !isIdProperty(propName, prop, collection)) {
+                        columns.push(`  "${colName}" ${authDefinition}`);
+                        return;
+                    }
+
                     const colType = getSqlColumnType(propName, prop, collection, collections);
                     let colDef = `  "${colName}" ${colType}`;
 
@@ -476,6 +505,27 @@ export const generatePostgresDdl = async (
                 }
             });
 
+            // ── Auth columns the collection file never mentions ──────────────
+            // `db push` is declarative: Atlas diffs the database against exactly
+            // what is emitted here and drops anything else. The scaffold's users
+            // collection describes 12 columns while auth needs 14, so
+            // `is_anonymous` and `tokens_valid_after` — created at boot by
+            // `ensureAuthTablesExist` — read as unmanaged drift, and a push run
+            // after the server had started once planned to DROP them. The
+            // destructive gate catches it, which makes it a data-loss prompt on
+            // the auth table rather than silent damage; either way the desired
+            // state was wrong. Emit the full contract so the two agree.
+            if (isAuthCollection(collection)) {
+                const declared = new Set(
+                    Object.entries(collection.properties ?? {})
+                        .map(([name, prop]) => resolveColumnName(name, prop))
+                );
+                for (const spec of AUTH_USERS_COLUMNS) {
+                    if (declared.has(spec.column)) continue;
+                    columns.push(`  "${spec.column}" ${authUsersColumnSql(spec)}`);
+                }
+            }
+
             // Backwards compatibility: add default id primary key if missing
             const hasPk = columns.some(c => c.includes("PRIMARY KEY"));
             if (!hasPk) {
@@ -575,10 +625,35 @@ const schemaOfCollection = (collection: CollectionConfig): string =>
 
 const bareTableName = (name: string): string => (name.includes(".") ? name.split(".").pop()! : name);
 
+/**
+ * Truncate a derived identifier the way Postgres does: to 63 bytes, silently.
+ *
+ * This is not cosmetic, and not really a naming choice at all — it is agreeing
+ * with the name the database ALREADY stored. `ADD CONSTRAINT` on a longer name
+ * succeeds and records the truncated form, so the untruncated name this used to
+ * derive matched nothing in the catalogue. Boot-ensure compares its planned
+ * constraints against `readExistingSchema`, which reads catalogue names, so the
+ * comparison could never hit: every boot re-issued `ADD CONSTRAINT` for the same
+ * constraint, forever, and got "already exists" every time. Non-fatal (foreign
+ * keys are the one action allowed to fail) and therefore permanent — an error in
+ * the log on every restart of a project whose table and column names happened to
+ * be long.
+ *
+ * Byte length, not string length: NAMEDATALEN is 64 bytes, and a multi-byte
+ * character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
+ */
+const toPostgresIdentifier = (name: string): string => {
+    const bytes = Buffer.from(name, "utf8");
+    if (bytes.byteLength <= 63) return name;
+    // `toString` on a slice that ends mid-character yields U+FFFD; dropping it
+    // lands on the last whole character that fits, which is what Postgres does.
+    return bytes.subarray(0, 63).toString("utf8").replace(/�+$/, "");
+};
+
 const foreignKeyPlan = (
     args: Omit<ForeignKeyPlan, "constraintName" | "sql"> & { onDelete: string; onUpdate?: string }
 ): ForeignKeyPlan => {
-    const constraintName = `${args.table}_${args.column}_fkey`;
+    const constraintName = toPostgresIdentifier(`${args.table}_${args.column}_fkey`);
     const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
     return {
         constraintName,
@@ -610,7 +685,8 @@ const foreignKeyPlan = (
  * is unknown yields the column without a constraint. Both mirror the generator
  * exactly — a divergence here is a schema fork between boot and `db push`.
  */
-export const planRelationalColumns = (collections: CollectionConfig[]): RelationalColumnPlan[] => {
+export const planRelationalColumns = (allCollections: CollectionConfig[]): RelationalColumnPlan[] => {
+    const collections = relationalCollections(allCollections);
     const plans: RelationalColumnPlan[] = [];
 
     for (const collection of collections) {
@@ -703,7 +779,8 @@ export const planRelationalColumns = (collections: CollectionConfig[]): Relation
  * junction with row-level security left off is readable and writable by every
  * signed-in user, which is why the two must ship together.
  */
-export const planJunctionTables = (collections: CollectionConfig[]): JunctionTablePlan[] => {
+export const planJunctionTables = (allCollections: CollectionConfig[]): JunctionTablePlan[] => {
+    const collections = relationalCollections(allCollections);
     const plans: JunctionTablePlan[] = [];
 
     for (const spec of resolveJunctionSpecs(collections).values()) {
@@ -780,7 +857,10 @@ export interface CollectionPolicyPlan {
  * writable by every signed-in user. A junction whose table is still absent is
  * skipped by the applier, not planned away here.
  */
-export const planCollectionPolicies = (collections: CollectionConfig[]): CollectionPolicyPlan[] => {
+export const planCollectionPolicies = (allCollections: CollectionConfig[]): CollectionPolicyPlan[] => {
+    // A store with no RLS gets no policies planned for it — `supportsRLS` is
+    // false for exactly the engines `relationalCollections` filters out.
+    const collections = relationalCollections(allCollections);
     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
     const plans: CollectionPolicyPlan[] = [];
     const seen = new Set<string>();
@@ -833,7 +913,11 @@ export const planCollectionPolicies = (collections: CollectionConfig[]): Collect
     return plans;
 };
 
-export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): string => {
+export const generatePostgresPoliciesDdl = (allCollections: CollectionConfig[]): string => {
+    // Also the expectation `checkPolicyDrift` reconciles the database against,
+    // so a non-SQL collection filtered out here is one the drift report cannot
+    // invent a missing policy for.
+    const collections = relationalCollections(allCollections);
     let ddl = "-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\n\n";
 
     const allTablesToGenerate = new Map<string, {

package/src/schema/generated-schema-staleness.ts

@@ -0,0 +1,169 @@
+import { CollectionConfig } from "@rebasepro/types";
+import { getTableName, resolveCollectionRelations, relationalCollections } from "@rebasepro/common";
+import { generateForeignKeyName, legacyForeignKeyName } from "@rebasepro/utils";
+
+/**
+ * Notice a generated Drizzle schema that a *library upgrade* invalidated.
+ *
+ * `rebase dev` already watches `config/collections` and warns when a collection
+ * file changes. That covers drift the developer caused. It cannot cover this one,
+ * because nothing the developer owns changed: 0.13 derives `category_id` where
+ * 0.12 derived `categorie_id`, from the same unedited collection. The watcher
+ * never fires, and `backend/src/schema.generated.ts` quietly stops describing the
+ * schema the runtime expects.
+ *
+ * The consequence is not cosmetic. Boot-ensure renames the column in the
+ * database, then relation validation reads the stale module and refuses to
+ * start — on that boot and every boot after it, because the rename is already
+ * applied and will not be attempted again.
+ *
+ * Deliberately narrow: this answers "does the generated schema name a foreign key
+ * the way the previous rule did", not "is this file what we would generate now".
+ * The wide question would report every whitespace change in the generator as a
+ * fatal staleness, and a check that cries wolf gets switched off.
+ */
+
+/** One column the generated schema names under the pre-0.13 rule. */
+export interface LegacyForeignKeyName {
+    /** Table whose column declaration is stale. */
+    table: string;
+    /** The name the generated schema declares. */
+    legacy: string;
+    /** The name this release derives, and which the database now carries. */
+    current: string;
+    /** `<collection>.<relation>` that derives it, for the message. */
+    relation: string;
+}
+
+/**
+ * The slice of the generated source declaring one table.
+ *
+ * Scoping matters: two junctions in one file can carry columns of the same name,
+ * and a whole-file match would attribute a stale column to whichever table the
+ * reader looks at first. Returns "" when the table is not in the file at all,
+ * which is not staleness — it is a table the generator has not been asked about.
+ */
+function tableBlock(source: string, table: string): string {
+    const start = source.indexOf(`pgTable("${table}"`);
+    if (start === -1) return "";
+    // Generated files put every table in its own `export const`, so the next one
+    // is the end of this block. No brace counting, nothing to get wrong.
+    const next = source.indexOf("\nexport ", start);
+    return next === -1 ? source.slice(start) : source.slice(start, next);
+}
+
+/**
+ * Whether a block *declares* the column, rather than merely mentioning it.
+ *
+ * A comment explaining the rename, or a policy expression naming the old column,
+ * must not read as a declaration — otherwise regenerating the file would not
+ * clear the finding and the check would be permanently red.
+ */
+function declaresColumn(block: string, column: string): boolean {
+    // `categorie_id: integer("categorie_id")` — the Drizzle column shape. The key
+    // and the string argument agree in generated output, so requiring both is
+    // both precise and cheap.
+    const key = column.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|[\\s,{])${key}\\s*:\\s*\\w+\\(\\s*["']${key}["']`, "m").test(block);
+}
+
+/**
+ * @param generatedSource contents of `backend/src/schema.generated.ts`
+ * @param collections     the project's collections, as this release reads them
+ */
+export function findLegacyForeignKeyNames(
+    generatedSource: string,
+    collections: CollectionConfig[]
+): LegacyForeignKeyName[] {
+    const found: LegacyForeignKeyName[] = [];
+    const seen = new Set<string>();
+
+    /**
+     * Report `wanted` as stale when the generated schema declares what the
+     * previous rule would have derived from `source` instead.
+     *
+     * The `wanted !== current` guard is what honours an explicitly named column.
+     * An author who pinned `categorie_id` has said so on the relation, so the
+     * generated file agreeing with them is correct, not stale — and the rename
+     * note documents exactly that opt-out.
+     */
+    const consider = (
+        table: string,
+        wanted: string,
+        sourceName: string | undefined,
+        relation: string
+    ): void => {
+        if (!table || !wanted || !sourceName) return;
+
+        const current = generateForeignKeyName(sourceName);
+        const legacy = legacyForeignKeyName(sourceName);
+        if (legacy === current) return;   // this name never moved
+        if (wanted !== current) return;   // pinned by the author, or unrelated
+
+        const block = tableBlock(generatedSource, table);
+        if (!block) return;
+        if (!declaresColumn(block, legacy)) return;
+        if (declaresColumn(block, current)) return;   // already regenerated
+
+        const key = `${table}.${legacy}`;
+        if (seen.has(key)) return;
+        seen.add(key);
+        found.push({ table, legacy, current, relation });
+    };
+
+    // Same rule as the generator whose output this reads: a collection that
+    // gets no table cannot have named a column in it. Inert in practice today —
+    // the finding also requires the generated file to declare the table — but
+    // the guard is what keeps that true when a non-SQL collection's slug happens
+    // to match a SQL one's table.
+    for (const collection of relationalCollections(collections)) {
+        const sourceTable = getTableName(collection);
+
+        for (const [name, relation] of Object.entries(resolveCollectionRelations(collection))) {
+            const at = `${collection.slug}.${name}`;
+
+            let target: CollectionConfig | undefined;
+            try {
+                target = relation.target?.();
+            } catch {
+                // A throwing target thunk is its own defect, reported at boot by
+                // `validate-relations`. Nothing to say about its column names.
+                continue;
+            }
+
+            switch (relation.kind) {
+                case "belongsTo":
+                    consider(sourceTable, relation.localKey, relation.relationName, at);
+                    break;
+
+                case "hasOne":
+                case "hasMany":
+                    if (target) {
+                        consider(getTableName(target), relation.foreignKeyOnTarget, collection.slug, at);
+                    }
+                    break;
+
+                case "manyToMany":
+                    consider(relation.through.table, relation.through.sourceColumn, collection.slug, at);
+                    if (target) {
+                        consider(relation.through.table, relation.through.targetColumn, target.slug, at);
+                    }
+                    break;
+
+                default:
+                    // `via` joins are written by hand — there is no derived name
+                    // for the rule change to have moved.
+                    break;
+            }
+        }
+    }
+
+    return found;
+}
+
+/** One-line summary for a log or a CLI notice. */
+export function describeLegacyForeignKeyNames(found: LegacyForeignKeyName[]): string {
+    return found
+        .map(f => `  • ${f.table}.${f.legacy} → ${f.current}  (${f.relation})`)
+        .join("\n");
+}

package/src/schema/introspect-db-logic.ts

@@ -1089,7 +1089,7 @@ export function generateCollectionFile(
 
         if (derivedFacts) {
             const titleProperty = deriveTitleProperty(derivedFacts);
-            if (titleProperty) adminEntries.push(`titleProperty: ${quote(titleProperty)}`);
+            if (titleProperty) adminEntries.push(`display: { title: ${quote(titleProperty)} }`);
 
             const kanbanProperty = deriveKanbanProperty(derivedFacts);
             if (kanbanProperty) adminEntries.push(`kanban: {\n            columnProperty: ${quote(kanbanProperty)}\n        }`);