@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/src/auth/services.ts

@@ -25,6 +25,7 @@ import {
     RoleData as Role
 } from "@rebasepro/server";
 import { toSnakeCase, camelCase } from "@rebasepro/utils";
+import { escapeLikePattern } from "../utils/drizzle-conditions";
 
 export type { Role };
 
@@ -368,7 +369,11 @@ export class UserService implements UserRepository {
             conditions.push(sql`${roleId} = ANY(${sql.raw(usersTableName)}.roles)`);
         }
         if (search) {
-            const pattern = `%${search}%`;
+            // `search` is a substring search over the admin user list, not a
+            // pattern the caller writes: the same reasoning as the collection
+            // search path, so it shares that path's helper rather than growing
+            // a second copy that can drift. See `escapeLikePattern`.
+            const pattern = `%${escapeLikePattern(search)}%`;
             conditions.push(sql`(${sql.raw(usersTableName)}.${sql.raw(emailColumn)} ILIKE ${pattern} OR ${sql.raw(usersTableName)}.${sql.raw(displayNameColumn)} ILIKE ${pattern})`);
         }
 
@@ -591,7 +596,7 @@ export class RefreshTokenService {
             userAgent: this.refreshTokensTable.userAgent,
             ipAddress: this.refreshTokensTable.ipAddress
         } as unknown as Record<string, never>;
-        for (const optional of ["sessionId", "rotatedAt", "revoked", "sessionStartedAt"]) {
+        for (const optional of ["sessionId", "rotatedAt", "revoked", "sessionStartedAt", "aal"]) {
             if (this.has(optional)) selection[optional] = this.col(optional);
         }
         return selection;
@@ -624,6 +629,11 @@ export class RefreshTokenService {
         };
         if (session && this.has("sessionId")) values.sessionId = session.id;
         if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+        // Written on every token of the session, including the ones rotation
+        // mints, because refresh reads the level off whichever row was
+        // presented. A table without the column degrades to `aal1` on read,
+        // which is the restrictive answer rather than a bypass.
+        if (session?.aal && this.has("aal")) values.aal = session.aal;
 
         await this.db.insert(this.refreshTokensTable).values(values);
     }
@@ -1262,6 +1272,10 @@ collectionPermissions: null }
         return this.getMfaService().verifyMfaFactor(factorId);
     }
 
+    async updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void> {
+        return this.getMfaService().updateMfaFactorSecret(factorId, secretEncrypted);
+    }
+
     async deleteMfaFactor(factorId: string, uid: string): Promise<void> {
         return this.getMfaService().deleteMfaFactor(factorId, uid);
     }
@@ -1297,6 +1311,14 @@ collectionPermissions: null }
     async hasVerifiedMfaFactors(uid: string): Promise<boolean> {
         return this.getMfaService().hasVerifiedMfaFactors(uid);
     }
+
+    async claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean> {
+        return this.getMfaService().claimMfaFactorCounter(factorId, counter);
+    }
+
+    async recordMfaChallengeAttempt(challengeId: string): Promise<number> {
+        return this.getMfaService().recordMfaChallengeAttempt(challengeId);
+    }
 }
 
 // =============================================================================
@@ -1362,7 +1384,7 @@ export class MfaService implements MfaRepository {
     async getMfaFactorById(factorId: string): Promise<(MfaFactor & { secretEncrypted: string }) | null> {
         const tableName = this.qualify("mfa_factors");
         const result = await this.db.execute(sql`
-            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, created_at, updated_at
+            SELECT id, uid, factor_type, secret_encrypted, friendly_name, verified, last_used_counter, created_at, updated_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${factorId}
         `);
@@ -1377,11 +1399,36 @@ export class MfaService implements MfaRepository {
             secretEncrypted: row.secret_encrypted as string,
             friendlyName: (row.friendly_name as string | null) ?? undefined,
             verified: row.verified as boolean,
+            // BIGINT comes back as a string from node-postgres.
+            lastUsedCounter: row.last_used_counter === null || row.last_used_counter === undefined
+                ? null
+                : Number(row.last_used_counter),
             createdAt: new Date(row.created_at as string),
             updatedAt: new Date(row.updated_at as string)
         };
     }
 
+    /**
+     * Spend a TOTP time step, once and only once.
+     *
+     * One statement: the `WHERE` is the check, the `UPDATE` is the act, and
+     * `RETURNING` reports which of two concurrent requests carrying the same
+     * six digits won. Reading the counter and then writing it would let both
+     * pass — the exact replay this closes.
+     */
+    async claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean> {
+        const tableName = this.qualify("mfa_factors");
+        const result = await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET last_used_counter = ${counter}, updated_at = NOW()
+            WHERE id = ${factorId}
+              AND (last_used_counter IS NULL OR last_used_counter < ${counter})
+            RETURNING id
+        `);
+
+        return result.rows.length > 0;
+    }
+
     async verifyMfaFactor(factorId: string): Promise<void> {
         const tableName = this.qualify("mfa_factors");
         await this.db.execute(sql`
@@ -1391,6 +1438,15 @@ export class MfaService implements MfaRepository {
         `);
     }
 
+    async updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void> {
+        const tableName = this.qualify("mfa_factors");
+        await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET secret_encrypted = ${secretEncrypted}, updated_at = NOW()
+            WHERE id = ${factorId}
+        `);
+    }
+
     async deleteMfaFactor(factorId: string, uid: string): Promise<void> {
         const tableName = this.qualify("mfa_factors");
         await this.db.execute(sql`
@@ -1422,7 +1478,7 @@ export class MfaService implements MfaRepository {
     async getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null> {
         const tableName = this.qualify("mfa_challenges");
         const result = await this.db.execute(sql`
-            SELECT id, factor_id, created_at, verified_at, ip_address, expires_at
+            SELECT id, factor_id, created_at, verified_at, ip_address, attempts, expires_at
             FROM ${sql.raw(tableName)}
             WHERE id = ${challengeId} AND expires_at > NOW() AND verified_at IS NULL
         `);
@@ -1435,10 +1491,31 @@ export class MfaService implements MfaRepository {
             factorId: row.factor_id as string,
             createdAt: new Date(row.created_at as string),
             verifiedAt: row.verified_at ? new Date(row.verified_at as string) : undefined,
-            ipAddress: (row.ip_address as string | null) ?? undefined
+            ipAddress: (row.ip_address as string | null) ?? undefined,
+            attempts: Number(row.attempts ?? 0)
         };
     }
 
+    /**
+     * Count one failed guess against a challenge and report the new total.
+     *
+     * Incremented in the database rather than in the route so that guesses
+     * arriving in parallel — the shape any real brute-force takes — cannot
+     * share a single increment.
+     */
+    async recordMfaChallengeAttempt(challengeId: string): Promise<number> {
+        const tableName = this.qualify("mfa_challenges");
+        const result = await this.db.execute(sql`
+            UPDATE ${sql.raw(tableName)}
+            SET attempts = attempts + 1
+            WHERE id = ${challengeId}
+            RETURNING attempts
+        `);
+
+        if (result.rows.length === 0) return 0;
+        return Number((result.rows[0] as { attempts: number | string }).attempts);
+    }
+
     async verifyMfaChallenge(challengeId: string): Promise<void> {
         const tableName = this.qualify("mfa_challenges");
         await this.db.execute(sql`

package/src/backup/backup-cli.ts

@@ -9,7 +9,9 @@ import fs from "fs";
 import os from "os";
 import readline from "readline";
 import chalk from "chalk";
-import { logger } from "@rebasepro/server";
+// Aliased: `out` is already a local in two of the commands below (the `--out`
+// backup destination).
+import { out as print, outWarn, outError } from "../cli-output";
 import type { StorageController } from "@rebasepro/server";
 import {
     BackupDestination,
@@ -73,7 +75,7 @@ async function resolveStorageForDestination(
 function requireConnection(): string {
     const conn = resolveConnectionString(process.env);
     if (!conn) {
-        logger.error(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
+        outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
         process.exit(1);
     }
     return conn;
@@ -117,19 +119,19 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
     const out = args["--out"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), "backups");
     const dest = parseBackupDestination(out);
 
-    logger.info("");
-    logger.info(chalk.bold("  💾 Rebase DB Backup"));
-    logger.info(chalk.gray(`  Database:    ${dbName}`));
-    logger.info(chalk.gray(`  Destination: ${out}`));
-    logger.info("");
+    print("");
+    print(chalk.bold("  💾 Rebase DB Backup"));
+    print(chalk.gray(`  Database:    ${dbName}`));
+    print(chalk.gray(`  Destination: ${out}`));
+    print("");
 
     // Version pre-flight (doctor-style).
     const pf = await preflight("pg_dump", connectionString);
     if (!pf.compatible) {
-        logger.error(chalk.red(`  ✗ ${pf.reason}`));
+        outError(chalk.red(`  ✗ ${pf.reason}`));
         process.exit(1);
     }
-    logger.info(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));
+    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));
 
     // Opt-in, and loud. With row security on, pg_dump stops refusing to read
     // rows it cannot see and starts leaving them out — an exit-0 backup that
@@ -139,13 +141,13 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
         : undefined;
 
     if (rowSecurity) {
-        logger.warn("");
-        logger.warn(chalk.yellow("  ⚠  Dumping with row-level security ON."));
-        logger.warn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(", ")}], which satisfies the generated`));
-        logger.warn(chalk.gray("     `admin_full_access` policy. This backup contains exactly the rows those"));
-        logger.warn(chalk.gray("     policies admit — a table whose policies have no admin rule comes out short,"));
-        logger.warn(chalk.gray("     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS."));
-        logger.warn("");
+        outWarn("");
+        outWarn(chalk.yellow("  ⚠  Dumping with row-level security ON."));
+        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(", ")}], which satisfies the generated`));
+        outWarn(chalk.gray("     `admin_full_access` policy. This backup contains exactly the rows those"));
+        outWarn(chalk.gray("     policies admit — a table whose policies have no admin rule comes out short,"));
+        outWarn(chalk.gray("     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS."));
+        outWarn("");
     }
 
     try {
@@ -164,10 +166,10 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
                 rowSecurity
             });
             await assertDumpValid(dump.localFile);
-            logger.info("");
-            logger.info(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));
+            print("");
+            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));
             if (dump.globalsFile) {
-                logger.info(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));
+                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));
             }
         } else {
             const storage = await resolveStorageForDestination(dest, process.env);
@@ -182,21 +184,21 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
             try {
                 await assertDumpValid(dump.localFile);
                 const uploaded = await uploadBackup(storage!, dump.localFile, dest);
-                logger.info("");
-                logger.info(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));
+                print("");
+                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));
                 // Upload the roles sidecar next to the dump so a restore can
                 // recreate roles the dump's GRANT/RLS statements depend on.
                 if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {
                     const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);
-                    logger.info(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));
+                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));
                 }
-                logger.info(chalk.gray("    Ensure this bucket is private — backups may contain secrets and PII."));
+                print(chalk.gray("    Ensure this bucket is private — backups may contain secrets and PII."));
             } finally {
                 if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);
                 if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);
             }
         }
-        logger.info("");
+        print("");
     } catch (err) {
         reportError(err);
         process.exit(1);
@@ -236,11 +238,11 @@ export async function restoreCommand(rawArgs: string[]): Promise<void> {
         ? withDatabaseName(baseConnection, args["--target-db"])
         : baseConnection;
 
-    logger.info("");
-    logger.info(chalk.bold("  ♻️  Rebase DB Restore"));
-    logger.info(chalk.gray(`  Source:  ${backupArg}`));
-    logger.info(chalk.gray(`  Target:  ${targetDb ?? "(from DATABASE_URL)"}`));
-    logger.info("");
+    print("");
+    print(chalk.bold("  ♻️  Rebase DB Restore"));
+    print(chalk.gray(`  Source:  ${backupArg}`));
+    print(chalk.gray(`  Target:  ${targetDb ?? "(from DATABASE_URL)"}`));
+    print("");
 
     // Resolve the local file to restore from (download object-storage keys).
     // Also resolve the `.globals.sql` roles sidecar so cluster roles can be
@@ -267,7 +269,7 @@ export async function restoreCommand(rawArgs: string[]): Promise<void> {
         } else {
             localFile = path.resolve(backupArg);
             if (!fs.existsSync(localFile)) {
-                logger.error(chalk.red(`  ✗ Backup file not found: ${localFile}`));
+                outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));
                 process.exit(1);
             }
             const globalsPath = globalsFileForDump(localFile);
@@ -279,29 +281,29 @@ export async function restoreCommand(rawArgs: string[]): Promise<void> {
         // exist yet when --create-db is used.
         const pf = await preflight("pg_restore", baseConnection);
         if (!pf.compatible) {
-            logger.error(chalk.red(`  ✗ ${pf.reason}`));
+            outError(chalk.red(`  ✗ ${pf.reason}`));
             process.exit(1);
         }
 
         // Create the target database when requested.
         if (args["--create-db"]) {
             if (!targetDb) {
-                logger.error(chalk.red("  ✗ --create-db requires a resolvable target database name (use --target-db)."));
+                outError(chalk.red("  ✗ --create-db requires a resolvable target database name (use --target-db)."));
                 process.exit(1);
             }
             const created = await ensureDatabaseExists(baseConnection, targetDb);
-            logger.info(chalk.gray(created ? `  ✓ Created database "${targetDb}".` : `  • Database "${targetDb}" already exists.`));
+            print(chalk.gray(created ? `  ✓ Created database "${targetDb}".` : `  • Database "${targetDb}" already exists.`));
         }
 
         // Destructive-action gate. Restores overwrite data; never run without
         // an explicit yes (interactive confirmation or --yes).
         if (!args["--yes"]) {
-            logger.warn(chalk.yellow(
+            outWarn(chalk.yellow(
                 `  ⚠️  This will restore into "${targetDb ?? "the target database"}" and may overwrite existing data.`
             ));
             const confirmed = await promptConfirm(chalk.yellow("     Type 'yes' to continue: "));
             if (!confirmed) {
-                logger.info(chalk.gray("  Aborted. No changes were made."));
+                print(chalk.gray("  Aborted. No changes were made."));
                 process.exit(1);
             }
         }
@@ -309,17 +311,17 @@ export async function restoreCommand(rawArgs: string[]): Promise<void> {
         // Recreate cluster roles before restoring so GRANT/RLS statements in
         // the dump apply. Best-effort and idempotent (see applyGlobals).
         if (globalsSql) {
-            logger.info(chalk.gray("  Recreating cluster roles from the backup's roles sidecar…"));
+            print(chalk.gray("  Recreating cluster roles from the backup's roles sidecar…"));
             const { applied, skipped } = await applyGlobals(
                 targetConnection,
                 globalsSql,
-                (m) => logger.info(chalk.gray(m))
+                (m) => print(chalk.gray(m))
             );
-            logger.info(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));
+            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));
         } else {
-            logger.warn(chalk.yellow("  ⚠️  No roles sidecar (.globals.sql) accompanies this backup."));
-            logger.warn(chalk.yellow("     If the dump grants to roles that don't exist (e.g. rebase_user), the restore"));
-            logger.warn(chalk.yellow("     will fail — recreate those roles first, or use a backup that includes its globals."));
+            outWarn(chalk.yellow("  ⚠️  No roles sidecar (.globals.sql) accompanies this backup."));
+            outWarn(chalk.yellow("     If the dump grants to roles that don't exist (e.g. rebase_user), the restore"));
+            outWarn(chalk.yellow("     will fail — recreate those roles first, or use a backup that includes its globals."));
         }
 
         await restoreDump({
@@ -332,9 +334,9 @@ export async function restoreCommand(rawArgs: string[]): Promise<void> {
             inheritStdio: true
         });
 
-        logger.info("");
-        logger.info(chalk.green(`  ✓ Restore completed into "${targetDb ?? "the target database"}".`));
-        logger.info("");
+        print("");
+        print(chalk.green(`  ✓ Restore completed into "${targetDb ?? "the target database"}".`));
+        print("");
     } catch (err) {
         reportError(err);
         process.exit(1);
@@ -355,7 +357,7 @@ export async function backupsCommand(rawArgs: string[]): Promise<void> {
         return;
     }
     if (action !== "list") {
-        logger.error(chalk.red(`Unknown backups action: "${action}". Valid: list`));
+        outError(chalk.red(`Unknown backups action: "${action}". Valid: list`));
         process.exit(1);
     }
 
@@ -366,19 +368,19 @@ export async function backupsCommand(rawArgs: string[]): Promise<void> {
     try {
         const storage = await resolveStorageForDestination(dest, process.env);
         const backups = await listBackups(dest, storage ?? undefined);
-        logger.info("");
+        print("");
         if (backups.length === 0) {
-            logger.info(chalk.gray(`  No backups found at ${out}.`));
+            print(chalk.gray(`  No backups found at ${out}.`));
         } else {
-            logger.info(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));
-            logger.info("");
+            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));
+            print("");
             for (const b of backups) {
                 const when = b.createdAt ? b.createdAt.toISOString() : "unknown date";
                 const name = dest.kind === "local" ? path.basename(b.key) : b.key;
-                logger.info(`  ${chalk.green("●")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}`);
+                print(`  ${chalk.green("●")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}`);
             }
         }
-        logger.info("");
+        print("");
     } catch (err) {
         reportError(err);
         process.exit(1);
@@ -398,15 +400,15 @@ async function assertDumpValid(localFile: string): Promise<void> {
 
 function reportError(err: unknown): void {
     if (err instanceof BackupToolError) {
-        logger.error(chalk.red(`  ✗ ${err.message}`));
-        if (err.hint) logger.error(chalk.gray(`    ${err.hint}`));
+        outError(chalk.red(`  ✗ ${err.message}`));
+        if (err.hint) outError(chalk.gray(`    ${err.hint}`));
     } else {
-        logger.error(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));
+        outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));
     }
 }
 
 function printBackupHelp(): void {
-    logger.info(`
+    print(`
 ${chalk.bold("rebase db backup")} — Create a database backup (pg_dump, custom format)
 
 ${chalk.green.bold("Usage")}
@@ -442,7 +444,7 @@ ${chalk.green.bold("Notes")}
 }
 
 function printRestoreHelp(): void {
-    logger.info(`
+    print(`
 ${chalk.bold("rebase db restore")} — Restore a database from a backup (pg_restore)
 
 ${chalk.green.bold("Usage")}
@@ -472,7 +474,7 @@ ${chalk.red.bold("Warning")}
 }
 
 function printBackupsHelp(): void {
-    logger.info(`
+    print(`
 ${chalk.bold("rebase db backups")} — Manage stored backups
 
 ${chalk.green.bold("Usage")}

package/src/cli-errors.ts

@@ -1,5 +1,5 @@
 import chalk from "chalk";
-import { logger } from "@rebasepro/server";
+import { outWarn, outError } from "./cli-output";
 
 /**
  * Detect whether an error (or AggregateError wrapping multiple attempts)
@@ -220,20 +220,20 @@ export async function checkDatabaseConnectivity(databaseUrl: string): Promise<vo
         await client.query("SELECT 1");
     } catch (err: unknown) {
         if (isEconnrefused(err)) {
-            logger.error(formatConnectionRefusedBanner(databaseUrl));
+            outError(formatConnectionRefusedBanner(databaseUrl));
             process.exit(1);
         }
         if (isAuthFailure(err)) {
-            logger.error(formatAuthFailureBanner(databaseUrl));
+            outError(formatAuthFailureBanner(databaseUrl));
             process.exit(1);
         }
         if (isSslNotEnabled(err)) {
-            logger.error(formatSslNotEnabledBanner(databaseUrl));
+            outError(formatSslNotEnabledBanner(databaseUrl));
             process.exit(1);
         }
         // Unknown error — warn but don't block; let the downstream tool surface details
-        logger.warn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));
-        logger.warn(chalk.gray("    Proceeding anyway — the command may fail if the database is unreachable."));
+        outWarn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));
+        outWarn(chalk.gray("    Proceeding anyway — the command may fail if the database is unreachable."));
     } finally {
         try {
             await client?.end();

package/src/cli-helpers.ts

@@ -6,7 +6,7 @@ import { createRequire } from "module";
 import readline from "readline";
 import { pathToFileURL } from "url";
 import chalk from "chalk";
-import { logger } from "@rebasepro/server";
+import { out, outWarn } from "./cli-output";
 import type { CollectionConfig, ResolvedRelation } from "@rebasepro/types";
 import { moduleDir as __helpersDirname } from "./module-dir";
 
@@ -140,7 +140,7 @@ export async function loadCollectionsForCli(collectionsPath: string): Promise<Co
     const resolvedPath = path.resolve(collectionsPath);
     const collections: CollectionConfig[] = [];
     if (!fs.existsSync(resolvedPath)) {
-        logger.warn(chalk.yellow(
+        outWarn(chalk.yellow(
             `  ⚠  Collections path not found: "${collectionsPath}"\n` +
             `     Resolved to: ${resolvedPath}\n` +
             `     (relative to cwd: ${process.cwd()})\n` +
@@ -198,7 +198,7 @@ export async function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUr
             const res = await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [devDbName]);
             if (res.rowCount === 0) {
                 await client.query(`CREATE DATABASE "${devDbName}"`);
-                logger.info(chalk.gray(`  ✓ Created validation database "${devDbName}"`));
+                out(chalk.gray(`  ✓ Created validation database "${devDbName}"`));
             }
         } finally {
             await client.end();
@@ -248,7 +248,7 @@ export async function applySearchDdl(
     } finally {
         await client.end();
     }
-    logger.info(chalk.gray("  ✓ Applied full-text search columns and indexes"));
+    out(chalk.gray("  ✓ Applied full-text search columns and indexes"));
 }
 
 /**

package/src/cli-output.ts

@@ -0,0 +1,43 @@
+/**
+ * Terminal output for the `rebase db|schema|doctor` commands.
+ *
+ * These commands used to write every line through `logger`, and that is a
+ * category error with three separate consequences:
+ *
+ *  - `logger` prefixes each line with its own level, so a box-drawn report
+ *    arrived as `ℹ️ [INFO]   ┌─ ✗ Missing Column ───` and the frame no longer
+ *    lined up with anything;
+ *  - `logger` is gated by `LOG_LEVEL`, which ships in the scaffold's own
+ *    `.env.example` — a developer who quietened their dev server with
+ *    `LOG_LEVEL=warn` got a `rebase db push` that printed almost nothing and
+ *    still exited non-zero, indistinguishable from a crash;
+ *  - under `NODE_ENV=production` `logger` emits JSON, so the whole report
+ *    became log records with the chalk escape codes embedded in them.
+ *
+ * A CLI's report *is* its return value. It goes to the terminal unconditionally
+ * and unadorned. `packages/cli` has always written its output this way; this is
+ * the same three functions for the plugin CLI that `rebase` delegates to.
+ *
+ * `logger` still belongs in this package's *runtime* — a request handler has no
+ * terminal and its lines want levels, timestamps and redaction. The rule is the
+ * caller, not the severity: anything a developer reads because they typed a
+ * command goes here, anything a server emits while running goes to `logger`.
+ *
+ * Errors and warnings go to stderr so `rebase db push > plan.txt` keeps the
+ * diagnosis on the terminal where it is readable.
+ */
+
+/** One line of human-facing output on stdout. */
+export const out = (line = ""): void => {
+    console.log(line);
+};
+
+/** One line of human-facing warning output on stderr. */
+export const outWarn = (line = ""): void => {
+    console.warn(line);
+};
+
+/** One line of human-facing error output on stderr. */
+export const outError = (line = ""): void => {
+    console.error(line);
+};