@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/dist/schema/auth-schema.d.ts

@@ -427,6 +427,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            aal: import("drizzle-orm/pg-core").PgColumn<{
+                name: "aal";
+                tableName: "refresh_tokens";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             userAgent: import("drizzle-orm/pg-core").PgColumn<{
                 name: "user_agent";
                 tableName: "refresh_tokens";
@@ -880,6 +897,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            lastUsedCounter: import("drizzle-orm/pg-core").PgColumn<{
+                name: "last_used_counter";
+                tableName: "mfa_factors";
+                dataType: "number";
+                columnType: "PgBigInt53";
+                data: number;
+                driverParam: string | number;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             createdAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "created_at";
                 tableName: "mfa_factors";
@@ -1006,6 +1040,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            attempts: import("drizzle-orm/pg-core").PgColumn<{
+                name: "attempts";
+                tableName: "mfa_challenges";
+                dataType: "number";
+                columnType: "PgInteger";
+                data: number;
+                driverParam: string | number;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             expiresAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "expires_at";
                 tableName: "mfa_challenges";
@@ -1642,6 +1693,23 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        aal: import("drizzle-orm/pg-core").PgColumn<{
+            name: "aal";
+            tableName: "refresh_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         userAgent: import("drizzle-orm/pg-core").PgColumn<{
             name: "user_agent";
             tableName: "refresh_tokens";
@@ -2095,6 +2163,23 @@ export declare const mfaFactors: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        lastUsedCounter: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_used_counter";
+            tableName: "mfa_factors";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "mfa_factors";
@@ -2221,6 +2306,23 @@ export declare const mfaChallenges: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        attempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempts";
+            tableName: "mfa_challenges";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         expiresAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "expires_at";
             tableName: "mfa_challenges";

package/dist/schema/doctor-policy-checks.d.ts

@@ -0,0 +1,28 @@
+/**
+ * What the RLS checks concluded.
+ *
+ * `unchecked` exists because "we could not look" and "we looked and it is fine"
+ * used to be reported identically: a collections path that did not resolve made
+ * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`
+ * early-returned an empty diff, and the gate printed
+ * `✓ RLS policies match your collections` having compared zero policies against
+ * zero collections. Any exception at all — a collection file that throws on
+ * import, a `pg_policies` read the CI role is not granted, a connection reset —
+ * did the same thing through a `warn`, and exited 0.
+ */
+export type PolicyCheckStatus = "ok" | "problems" | "unchecked";
+/**
+ * The exit code for `rebase doctor --policies`.
+ *
+ * A gate that could not run has not passed. Only a completed, clean check
+ * exits 0 — anything else, including "we never opened a connection", is a
+ * failure, or the flag certifies a database nobody looked at.
+ */
+export declare function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1;
+/**
+ * Policies actually deployed vs the ones the collections describe, plus policy
+ * roles this server could never satisfy.
+ *
+ * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.
+ */
+export declare function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus>;

package/dist/schema/doctor.d.ts

@@ -2,7 +2,7 @@ import { CollectionConfig, Property } from "@rebasepro/types";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated" | "sdk_ungeneratable";
     table?: string;
     column?: string;
     expected?: string;
@@ -10,21 +10,46 @@ export interface DoctorIssue {
     message: string;
     fix: string;
 }
+export interface DoctorPhase {
+    passed: boolean;
+    issues: DoctorIssue[];
+    /**
+     * Why this phase never ran, when it did not.
+     *
+     * A check that did not happen is a third state, not a passing one. While a
+     * skipped phase initialised to `{ passed: true, issues: [] }` it rendered as
+     * `✅ Collections → Database: In sync` and counted towards
+     * `✓ All schemas are in sync!` — so a project whose connection string was
+     * spelled `POSTGRES_URL`, or a CI job that never exported one, got two green
+     * ticks and exit 0 against a database with no tables in it.
+     */
+    skipped?: string;
+    /**
+     * Why this phase had nothing to compare against, when it had nothing.
+     *
+     * Distinct from `skipped`, which means "the check could not run, and that
+     * is probably worth fixing". This one means "the artifact is optional and
+     * you have not asked for it": no drift is possible, so the run is still a
+     * clean bill of health.
+     *
+     * It exists because the alternative was a contradiction. The typed-SDK
+     * phase returned `{ passed: true }` when `generated/sdk/database.types.ts`
+     * did not exist, so a fresh project's report read
+     * `✅ Collections → SDK Types: In sync` directly above
+     * `ℹ Typed SDK not generated (optional).` — one line calling a file
+     * synchronised and the next saying it is absent. "In sync" is a claim about
+     * a comparison, and no comparison happened.
+     */
+    notApplicable?: string;
+}
 export interface DoctorReport {
-    collectionsToSchema: {
-        passed: boolean;
-        issues: DoctorIssue[];
-    };
-    collectionsToSdk: {
-        passed: boolean;
-        issues: DoctorIssue[];
-    };
-    schemaToDatabase: {
-        passed: boolean;
-        issues: DoctorIssue[];
-    };
+    collectionsToSchema: DoctorPhase;
+    collectionsToSdk: DoctorPhase;
+    schemaToDatabase: DoctorPhase;
     summary: {
         passed: number;
+        skipped: number;
+        notApplicable: number;
         warnings: number;
         errors: number;
     };
@@ -37,18 +62,9 @@ export declare function getExpectedColumnType(prop: Property): string | null;
  * wrong thing.
  */
 export declare function loadCollections(collectionsPath: string): Promise<CollectionConfig[]>;
-export declare function checkCollectionsVsSchema(collections: CollectionConfig[], schemaFilePath: string): Promise<{
-    passed: boolean;
-    issues: DoctorIssue[];
-}>;
-export declare function checkCollectionsVsSdk(collections: CollectionConfig[], sdkFilePath: string): Promise<{
-    passed: boolean;
-    issues: DoctorIssue[];
-}>;
-export declare function checkCollectionsVsDatabase(collections: CollectionConfig[], databaseUrl: string): Promise<{
-    passed: boolean;
-    issues: DoctorIssue[];
-}>;
+export declare function checkCollectionsVsSchema(collections: CollectionConfig[], schemaFilePath: string): Promise<DoctorPhase>;
+export declare function checkCollectionsVsSdk(collections: CollectionConfig[], sdkFilePath: string): Promise<DoctorPhase>;
+export declare function checkCollectionsVsDatabase(collections: CollectionConfig[], databaseUrl: string): Promise<DoctorPhase>;
 export declare function renderReport(report: DoctorReport): void;
 export declare function runDoctor(options: {
     collectionsPath: string;

package/dist/schema/ensure-collection-policies.d.ts

@@ -43,18 +43,42 @@ export interface PolicyEnsureResult {
         table: string;
         reason: string;
     }[];
-    /** Tables whose RLS could not be fully applied (fail closed). */
+    /**
+     * Tables that have RLS on but did not get every policy. They deny — RLS
+     * with no matching policy is deny-all — so they are safe but not servable.
+     */
     failures: {
         table: string;
         error: string;
     }[];
+    /**
+     * Tables RLS could not be enabled on, whose DML grant was withdrawn instead.
+     *
+     * This state had no name, and that was the bug: `ENABLE ROW LEVEL SECURITY`
+     * failing was recorded as a `failure` and reported with the same "it stays
+     * locked (denies)" wording as a failed policy — but the two are opposites.
+     * A policy statement failing leaves RLS on and the table denying. `enableRls`
+     * failing leaves RLS *off*, and the schema-wide grant to the user role has
+     * already been made by `ensureRlsEnforcement`, so the table is readable and
+     * writable by every authenticated request with no row filtering at all.
+     */
+    unsecured: {
+        table: string;
+        error: string;
+        grantWithdrawn: boolean;
+    }[];
+    /**
+     * Generated policies removed because no current rule produces them.
+     *
+     * A policy's name embeds a hash of the rule's semantics, so editing a rule
+     * does not update a policy — it creates a new one and abandons the old.
+     * Postgres ORs permissive policies, so the abandoned one keeps granting:
+     * a `USING (true)` tightened to an owner check went on admitting everyone,
+     * forever, while the deploy logged success.
+     *
+     * `db push` reconciles this, and cannot reach a managed tenant's in-cluster
+     * database — which is the reason this module exists. So boot has to do it.
+     */
+    orphansDropped: number;
 }
-/**
- * Bring the declared collections' RLS policies up to date. Returns what it did.
- *
- * Only tables that already exist are touched: the boot-time table creator runs
- * first, so anything still missing is a table this additive path is not allowed
- * to create (a junction, or a relation left to a migration). Enabling RLS on a
- * non-existent table would error, so those are recorded as skipped, not failed.
- */
 export declare function ensureCollectionPolicies(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<PolicyEnsureResult>;

package/dist/schema/ensure-collection-tables.d.ts

@@ -54,9 +54,17 @@ export interface ExistingSchema {
      * constraint that then fails harmlessly as a duplicate.
      */
     constraints?: Set<string>;
+    /**
+     * `schema.table.column` → that column's comment, for the columns that have
+     * one. This is where a generated search column's fingerprint lives, so it
+     * is the only evidence that a `search` block has changed since the column
+     * was built. Absent is read as "no column is stamped", which plans a stamp
+     * and reports nothing as drifted.
+     */
+    columnComments?: Map<string, string>;
 }
 export interface EnsureAction {
-    kind: "create-enum" | "create-table" | "add-column" | "add-constraint" | "rename-column" | "create-extension" | "create-function" | "create-index";
+    kind: "create-enum" | "create-table" | "add-column" | "add-constraint" | "rename-column" | "create-extension" | "create-function" | "create-index" | "comment-column";
     /** Qualified target, for logging: `public.posts` or `public.posts.title`. */
     target: string;
     sql: string;
@@ -76,6 +84,49 @@ export interface EnsurePlan {
      * resolving to nothing — which is indistinguishable from having no data.
      */
     legacyForeignKeys: LegacyForeignKey[];
+    /**
+     * Generated search columns whose `search` block has changed since they were
+     * built. Reported, never planned into `actions` — see
+     * {@link SearchColumnDrift} for why applying it is not this path's call.
+     */
+    searchDrift: SearchColumnDrift[];
+    /**
+     * Generated search columns that exist but carry no fingerprint — created
+     * before this check existed, or by `search.sql` on an older CLI. The plan
+     * stamps them so the *next* change is detectable; whether they match the
+     * current block cannot be known, which is what the caller reports.
+     */
+    searchAdopted: {
+        table: string;
+        column: string;
+    }[];
+}
+/**
+ * A generated search column built from a `search` block that has since changed.
+ *
+ * Reported instead of applied because the two ways to apply it are both worse
+ * than stopping. `ALTER COLUMN … SET EXPRESSION` exists only on PG17+ and
+ * rewrites the table either way; `DROP COLUMN` + `ADD COLUMN` rewrites it under
+ * an ACCESS EXCLUSIVE lock and rebuilds the GIN index. This module runs
+ * unattended against live customer data with nobody reading a diff — the same
+ * reason it withholds `SET NOT NULL` from an adopted table — so a multi-minute
+ * outage is not a decision it may take on its own.
+ *
+ * Not applying it silently is not an option either: that is the bug this
+ * detection exists for. A collection that added a field, flipped `unaccent` or
+ * raised a weight kept indexing the *old* set forever, and the only symptom was
+ * searches returning nothing for content plainly in the row.
+ */
+export interface SearchColumnDrift {
+    /** `schema.table`. */
+    table: string;
+    column: string;
+    /** The fingerprint recorded on the column. */
+    found: string;
+    /** The fingerprint the current `search` block computes. */
+    expected: string;
+    /** The statements that would rebuild the column, for the operator to run. */
+    rebuild: string[];
 }
 /** A relation column whose old and new spellings both plausibly apply. */
 export interface LegacyForeignKey {
@@ -88,14 +139,17 @@ export interface LegacyForeignKey {
 }
 export interface EnsureOutcome extends EnsurePlan {
     /**
-     * Constraints that could not be added — always non-fatal.
+     * Actions that could not be applied and are non-fatal by nature.
      *
-     * A foreign key can only fail on data that already violates it, and the
-     * column it would police exists either way, so the collection still serves.
-     * Refusing to boot over one would turn a pre-existing data problem into an
-     * outage. Reported loudly instead.
+     * Two kinds qualify. A foreign key can only fail on data that already
+     * violates it, and the column it would police exists either way, so the
+     * collection still serves; refusing to boot over one would turn a
+     * pre-existing data problem into an outage. A column comment is the search
+     * fingerprint, which needs table ownership — losing it costs drift
+     * detection on the next boot, not the deployment. Both are reported loudly.
      */
     failures: {
+        kind: EnsureAction["kind"];
         target: string;
         error: string;
     }[];

package/dist/schema/generate-drizzle-schema-logic.d.ts

@@ -1,2 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { CollectionConfig, Property } from "@rebasepro/types";
+/**
+ * The Drizzle column declaration a property compiles to, or `null` when the
+ * property puts no column on *this* table (an inverse relation, whose column
+ * lives on the target). Exported so it can be checked against its DDL twin
+ * `getSqlColumnType` directly — the two disagreeing is what left `geopoint`
+ * with a database column and no Drizzle key.
+ */
+export declare const getDrizzleColumn: (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]) => string | null;
 export declare const generateSchema: (allCollections: CollectionConfig[], stripPolicies?: boolean) => Promise<string>;

package/dist/schema/introspect-db-inference.d.ts

@@ -2,4 +2,11 @@ export interface InferenceResult {
     propType?: string;
     extra?: string;
 }
-export declare function inferPropertyFromData(columnName: string, pgDataType: string, currentPropType: string, sampleValues: unknown[], isPk: boolean): InferenceResult;
+export declare function inferPropertyFromData(columnName: string, pgDataType: string, currentPropType: string, sampleValues: unknown[], isPk: boolean, 
+/**
+ * False when generating for a project without `@rebasepro/admin-types`, where
+ * `BaseProperty` declares no `admin` field and the block below would not
+ * compile. The type-level inferences (`propType`, `url`, `storage`) are
+ * unaffected — only the form-widget hints are dropped.
+ */
+emitAdmin?: boolean): InferenceResult;

package/dist/schema/introspect-db-logic.d.ts

@@ -177,10 +177,59 @@ export interface GeneratedFile {
  * have no database to read constraints or row counts from, and they must keep
  * producing a valid collection.
  */
+/**
+ * Which `defineCollection` — if any — the project being generated into can import.
+ *
+ * A bare `const x: PostgresCollectionConfig = { … }` annotation widens `properties`
+ * to `Record<string, …>`, and every key-shaped field in the admin block —
+ * `titleProperty`, `sort`, `propertiesOrder`, `listProperties`, `fixedFilter` — is
+ * derived from those keys. Annotated, they accept any string: introspection was
+ * emitting a `propertiesOrder` array that nothing checked, so renaming a column and
+ * re-introspecting left a stale key that compiled silently. `defineCollection` is
+ * the identity function whose `const P` type parameter keeps the keys literal, which
+ * is what turns that checking on.
+ *
+ * There are two of them and they are not interchangeable:
+ *
+ * - `admin-types` — `@rebasepro/admin-types`. Its index side-effect-imports
+ *   `augment.ts`, so importing it is also what *declares* the `admin` block. Only a
+ *   project that depends on the package can resolve it.
+ * - `common` — `@rebasepro/common`. Same key inference, no admin surface, no React
+ *   anywhere in its graph (`scripts/headless-guard` lists it as core). This is the
+ *   headless flavour.
+ * - `annotation` — neither package is declared, so neither import would resolve and
+ *   the old annotation is the only honest thing to emit. Projects scaffolded before
+ *   `@rebasepro/common` joined the headless config package land here.
+ *
+ * The last two emit **no admin block, on the collection or on any property**. That is
+ * not a downgrade: `@rebasepro/types` declares no `admin` field at all, so the block
+ * introspection used to emit was a type error in every headless project it was
+ * written into. See `packages/admin-types/src/augment.ts`.
+ */
+export type CollectionBuilder = "admin-types" | "common" | "annotation";
+/**
+ * The package specifiers the generated files name, spelled once.
+ *
+ * Written as constants rather than inline in the import templates below because
+ * `scripts/headless-guard/check-types.mjs` scans core sources for `from
+ * "@rebasepro/admin-types"` and cannot tell a real import from one this module
+ * *writes*. It is right to be that blunt — the guard's whole value is that it
+ * cannot be reasoned around — so the string simply never appears in that shape
+ * here. Inlining them back into the templates re-breaks `check:types-headless`.
+ */
+export declare const ADMIN_TYPES_PACKAGE = "@rebasepro/admin-types";
+export declare const COMMON_PACKAGE = "@rebasepro/common";
+export declare const TYPES_PACKAGE = "@rebasepro/types";
 export interface GenerationContext {
     metadata?: SchemaMetadata;
     classifications?: Map<string, TableClassification>;
     checkFacts?: CheckFactsByTable;
+    /**
+     * Defaults to `admin-types`, which is what the generator has always emitted.
+     * The CLI never relies on the default — `introspect-db.ts` detects the flavour
+     * from the target project and passes it. See `detectCollectionBuilder`.
+     */
+    builder?: CollectionBuilder;
 }
 /**
  * Generate the full TypeScript file content for a single collection.

package/dist/schema/introspect-db-project.d.ts

@@ -0,0 +1,21 @@
+import { type CollectionBuilder } from "./introspect-db-logic";
+/**
+ * Which `defineCollection` to generate against, for collections written to `outDir`.
+ *
+ * **The detection is the package manifests above the output directory**, unioned from
+ * `outDir` up to and including the project root — the first ancestor holding a
+ * `rebase.json`, or `MAX_LEVELS` up if there is none.
+ *
+ * That is the rule Node itself applies: a file in `config/collections` resolves a bare
+ * specifier through `config/node_modules`, then `<project>/node_modules`, and so on up.
+ * Reading the manifests along that same path answers the only question that matters —
+ * *will this import resolve in the project I am writing into* — from the state on disk
+ * at the moment of generation. The alternatives are all proxies for it: `rebase.json`'s
+ * `apps` block says a CMS scaffold declared an admin app, and a `frontend/` directory
+ * says one was scaffolded, but neither is what the compiler consults, and either can be
+ * true of a project whose `config` package does not depend on `@rebasepro/admin-types`.
+ *
+ * Ambiguity resolves towards the admin panel: a project that declares both packages has
+ * a panel, and `@rebasepro/admin-types` is the flavour that keeps the `admin` block.
+ */
+export declare function detectCollectionBuilder(outDir: string): CollectionBuilder;

package/dist/schema/search-column.d.ts

@@ -154,6 +154,55 @@ export declare const fuzzyColumnDefinition: (spec: SearchColumnSpec) => string |
  * concurrent form instead; see `ensureSearchColumns`.
  */
 export declare const searchIndexStatements: (spec: SearchColumnSpec) => string[];
+/**
+ * Marker on the comment of every generated search column this module creates.
+ *
+ * Versioned because the fingerprint below is only comparable against itself: a
+ * future change to how it is computed has to read as "not stamped by this
+ * version" rather than as drift on every existing column.
+ */
+export declare const SEARCH_STAMP_PREFIX = "rebase:search:v1:";
+/**
+ * A stable fingerprint of one generated column's expression.
+ *
+ * Why a stamp rather than reading the expression back: Postgres stores a
+ * generated column's expression *parsed*, and hands it back deparsed — casts
+ * made explicit, identifiers requoted, schema qualifications added or dropped
+ * according to `search_path`. Comparing that text to the text we generated
+ * would report drift on wording, and this comparison decides whether a boot
+ * refuses, so a false positive is an outage. The stamp is written by the same
+ * code that writes the column, so equality means what it says.
+ */
+export declare const searchExpressionFingerprint: (expression: string) => string;
+/** One generated column, with the fingerprint that identifies its expression. */
+export interface SearchColumnStamp {
+    column: string;
+    /** The expression the column is generated from. */
+    expression: string;
+    fingerprint: string;
+    /** `COMMENT ON COLUMN …`, which is where the fingerprint is recorded. */
+    sql: string;
+}
+/**
+ * The stamps for a spec's generated columns — one per column, never shared.
+ *
+ * Per column on purpose: turning `fuzzy` on adds a second column and changes
+ * nothing about the first, and a spec-wide fingerprint would report the
+ * untouched `tsvector` column as drifted and refuse a boot over a change that
+ * is purely additive.
+ */
+export declare const searchColumnStamps: (spec: SearchColumnSpec) => SearchColumnStamp[];
+/**
+ * The same drift check as the boot ensure, for the SQL file.
+ *
+ * Needed because {@link searchColumnStamps} would otherwise *launder* drift on
+ * the migration path: `ADD COLUMN IF NOT EXISTS` does nothing to a column that
+ * exists, so a re-generated `search.sql` would stamp a stale column with the
+ * new block's fingerprint and the next boot would find them in agreement.
+ * Guarding first means the file refuses instead — `rebase db push` is attended,
+ * and the operator reading the failure is the person who changed the block.
+ */
+export declare const searchStampGuards: (spec: SearchColumnSpec) => string[];
 /**
  * The index names the spec creates.
  *

package/dist/security/policy-drift.d.ts

@@ -26,6 +26,20 @@ export interface PolicyRef {
     hasUsing: boolean;
     /** Whether a WITH CHECK clause is present at all (not what it says). */
     hasWithCheck: boolean;
+    /**
+     * PERMISSIVE or RESTRICTIVE — the `AS` clause.
+     *
+     * An exact catalogue value on both sides, so it belongs with roles and
+     * command rather than with the expression text. It matters more than either:
+     * permissive policies are ORed together and restrictive ones ANDed, so a rule
+     * declared `mode: "restrictive"` whose live policy is PERMISSIVE has had its
+     * gate turned from a requirement into an alternative — the maximally
+     * permissive way for this to be wrong.
+     *
+     * The DDL regex captured this from the start and the destructuring threw it
+     * away; `pg_policies.permissive` was never selected.
+     */
+    mode?: "PERMISSIVE" | "RESTRICTIVE";
     /**
      * The live clause text, when read from `pg_policies`. Present only for live
      * policies (the expected side is parsed from DDL and does not carry it).
@@ -62,6 +76,26 @@ export interface PolicyDrift {
         policy: PolicyRef;
         reason: string;
     }[];
+    /**
+     * A table the collections describe whose RLS switch is off.
+     *
+     * `ALTER TABLE posts DISABLE ROW LEVEL SECURITY` leaves every row in
+     * `pg_policies` untouched, so before this category every expected policy
+     * still matched on name, roles, command and clause presence and the checker
+     * reported clean — on a table Postgres was applying no filter to at all.
+     * Requests run as `rebase_user`, which holds full DML, so the table is wide
+     * open while `doctor` certifies it.
+     *
+     * `forced` reports `relforcerowsecurity`, which is what also subjects the
+     * table's *owner* to its policies. Its absence is not drift on its own —
+     * Rebase does not connect as the owner in the request path — so it is
+     * reported for context rather than raised as a failure.
+     */
+    rlsDisabled: {
+        schema: string;
+        table: string;
+        forced: boolean;
+    }[];
 }
 export interface Queryable {
     query<R>(text: string, values?: unknown[]): Promise<{

package/dist/security/rls-enforcement.d.ts

@@ -14,9 +14,14 @@ import { REBASE_USER_ROLE } from "@rebasepro/common";
  *    are validation/side-effects, not a security boundary.
  *
  *  - **Server context** — the base (owner) connection: auth flows, migrations,
- *    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
- *    owner it bypasses RLS. This is the trusted plane, equivalent to
- *    Supabase's `service_role`.
+ *    and raw `rebase.sql`. As table owner it bypasses RLS. This is the trusted
+ *    plane, equivalent to Supabase's `service_role`.
+ *
+ *    `rebase.dataAsAdmin` is **not** in it, despite the name. `init.ts` scopes
+ *    that driver with `withAuth(SERVICE_IDENTITY)`, so it arrives as user
+ *    context above — `rebase_user`, `app.uid = 'service'`, policies evaluated —
+ *    and clears the default policies through their admin arm rather than the
+ *    `auth.uid() IS NULL` one.
  *
  * This module provides the three pieces:
  *

package/dist/services/FetchService.d.ts

@@ -190,6 +190,15 @@ export declare class FetchService {
      */
     searchRows<M extends Record<string, unknown>>(collectionPath: string, searchString: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /**
+         * An `or(...)`/`and(...)` group, applied alongside `filter`.
+         *
+         * `fetchRowsWithConditions` has always applied one; it was missing
+         * from this signature, so a realtime search subscription carrying a
+         * group could not pass it on and served every row matching the text
+         * that RLS allowed.
+         */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;