@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/src/collections/buildRegistry.ts

@@ -34,7 +34,9 @@ export function buildCollectionRegistry(schema: RegistrySchema): PostgresCollect
 
     if (schema.collections) {
         registry.registerMultiple(schema.collections);
-        logger.info(
+        // `Auto-discovered collections` already reports the count and the
+        // directory they came from; this is the same fact with the names.
+        logger.debug(
             `📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: ` +
             `[${registry.getCollections().map(c => c.slug).join(", ")}]`
         );

package/src/data-transformer.ts

@@ -2,12 +2,12 @@ import { eq, SQL } from "drizzle-orm";
 import { AnyPgColumn } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { CollectionConfig, Properties, Property, ResolvedRelation, RelationProperty, Vector, BinaryProperty, hasForeignKeyOnTarget, type ResolvedBelongsTo, type ResolvedForeignKeyOnTarget, type ResolvedVia } from "@rebasepro/types";
-import { getTableName, resolveCollectionRelations, findRelation, createRelationRef, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE } from "@rebasepro/common";
+import { getTableName, resolveCollectionRelations, findRelation, fieldKeyForColumn, createRelationRef, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE } from "@rebasepro/common";
 import { isPrototypePollutingKey } from "@rebasepro/utils";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { DrizzleConditionBuilder } from "./utils/drizzle-conditions";
 import { getPrimaryKeys, buildCompositeId } from "./services/collection-helpers";
-import { logger } from "@rebasepro/server";
+import { ApiError, logger } from "@rebasepro/server";
 
 /**
  * Data transformation utilities for converting between frontend and database formats.
@@ -126,16 +126,30 @@ joinPathRelationUpdates: [] };
         newTargetId: string | number | null;
     }> = [];
 
-    // Pre-calculate all local keys used as foreign keys
+    // Pre-calculate all local keys used as foreign keys.
+    //
+    // Keyed by the *wire* name: the payload arrives from a client, which knows
+    // the field as `authorId`, never as the `author_id` column behind it.
     const foreignKeys = new Set<string>();
     Object.values(resolvedRelations).forEach(relation => {
-        if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
+        if (relation.kind === "belongsTo") foreignKeys.add(fieldKeyForColumn(collection, relation.localKey));
     });
 
     for (const [key, value] of Object.entries(row)) {
         // Same reasoning as `sanitizeAndConvertDates`: these keys come from the
         // request body, and no column answers to them.
         if (isPrototypePollutingKey(key)) continue;
+
+        // `{ subtitle: undefined }` means "I have no value for this", not "set
+        // this column to NULL" — it is what spreading an optional field
+        // produces, and what Drizzle itself skips. The key used to survive with
+        // `undefined` and `sanitizeAndConvertDates` then turned it into `null`,
+        // so `update(id, { title, subtitle: payload.subtitle })` wiped
+        // `subtitle` whenever the payload happened not to carry one. Unreachable
+        // over HTTP (JSON has no `undefined`); the in-process data API passes
+        // the caller's object straight through, so it is reachable there.
+        if (value === undefined) continue;
+
         const property = properties[key as keyof M] as Property;
 
         // Coerce empty strings to null for any field that acts as a foreign key
@@ -153,15 +167,17 @@ joinPathRelationUpdates: [] };
             if (relation) {
                 if (relation.kind === "belongsTo") {
                     // Owning relation: Map relation object to FK column on current table
-                    const serializedValue = serializePropertyToServer(effectiveValue, property);
+                    const serializedValue = serializePropertyToServer(effectiveValue, property, key);
                     if (serializedValue !== undefined) {
-                        result[relation.localKey] = serializedValue;
+                        // The Drizzle key, not the column: Drizzle maps it back
+                        // to `author_id` when it builds the statement.
+                        result[fieldKeyForColumn(collection, relation.localKey)] = serializedValue;
                     }
                     // Don't add the original relation property to the result
                     continue;
                 } else if (hasForeignKeyOnTarget(relation)) {
                     // Inverse relation: Need to update the target table's FK
-                    const serializedValue = serializePropertyToServer(effectiveValue, property);
+                    const serializedValue = serializePropertyToServer(effectiveValue, property, key);
                     inverseRelationUpdates.push({
                         relationKey: key,
                         relation,
@@ -175,7 +191,7 @@ joinPathRelationUpdates: [] };
                     // There used to be two arms here — "owning" and "inverse"
                     // joinPath — but a join chain has no owning side, so they
                     // only ever differed by which list they pushed to.
-                    const serializedValue = serializePropertyToServer(effectiveValue, property);
+                    const serializedValue = serializePropertyToServer(effectiveValue, property, key);
                     if (relation.cardinality === "one") {
                         // Ordering matters: PersistService applies these BEFORE
                         // the main UPDATE, so the mapping reads the pre-update
@@ -197,7 +213,7 @@ joinPathRelationUpdates: [] };
             }
         }
 
-        result[key] = serializePropertyToServer(effectiveValue, property);
+        result[key] = serializePropertyToServer(effectiveValue, property, key);
     }
 
     return {
@@ -208,19 +224,41 @@ joinPathRelationUpdates: [] };
 }
 
 /**
- * Serialize a single property value for database storage
+ * How to name a rejected value in an error, without quoting it back.
+ *
+ * The value may be anything the caller sent, including a secret in the wrong
+ * field, so the message describes its shape rather than echoing it — an echoed
+ * value ends up in logs and in error-reporting services.
+ */
+function describeValue(value: unknown): string {
+    if (value === null) return "null";
+    if (Array.isArray(value)) return "an array";
+    if (value instanceof Date) return "a date";
+    const type = typeof value;
+    return type === "object" ? "an object" : `a ${type}`;
+}
+
+/**
+ * Serialize a single property value for database storage.
+ *
+ * `propertyKey` is only ever used to phrase errors and warnings. Without it the
+ * one trace a bad value left was `Expected array value for array property, got
+ * string` — no collection, no property, no value, which in the log of a
+ * thousand-row import names nothing at all.
  */
-export function serializePropertyToServer(value: unknown, property: Property): unknown {
+export function serializePropertyToServer(value: unknown, property: Property, propertyKey?: string): unknown {
     if (value === null || value === undefined) {
         return value;
     }
 
+    const fieldLabel = propertyKey ? `'${propertyKey}'` : `a '${property.type}' field`;
+
     const propertyType = property.type;
 
     switch (propertyType) {
         case "relation":
             if (Array.isArray(value)) {
-                return value.map(v => serializePropertyToServer(v, property));
+                return value.map(v => serializePropertyToServer(v, property, propertyKey));
             } else if (typeof value === "object" && value !== null && "id" in value) {
                 return (value as Record<string, unknown>).id;
             }
@@ -230,7 +268,7 @@ export function serializePropertyToServer(value: unknown, property: Property): u
         case "array":
             if (Array.isArray(value)) {
                 if (property.of) {
-                    return value.map(item => serializePropertyToServer(item, property.of as Property));
+                    return value.map(item => serializePropertyToServer(item, property.of as Property, propertyKey));
                 } else if (property.oneOf) {
                     const typeField = property.oneOf.typeField ?? DEFAULT_ONE_OF_TYPE;
                     const valueField = property.oneOf.valueField ?? DEFAULT_ONE_OF_VALUE;
@@ -243,15 +281,50 @@ export function serializePropertyToServer(value: unknown, property: Property): u
                         if (!type || !childProperty) return e;
                         return {
                             [typeField]: type,
-                            [valueField]: serializePropertyToServer(rec[valueField], childProperty)
+                            [valueField]: serializePropertyToServer(rec[valueField], childProperty, propertyKey)
                         };
                     });
                 }
                 return value;
             }
-            // Non-array value for an array property — coerce to avoid .map() crashes downstream
-            logger.warn(`Expected array value for array property, got ${typeof value}. Coercing to empty array.`);
-            return [];
+            // A non-array value used to become `[]` here — the caller's value
+            // destroyed, answered 200/201, and the row reading back as an empty
+            // list on every later fetch. `POST /posts {"tags":"news"}` from a
+            // client that sent a single tag as a scalar, or a CSV import that
+            // did not split a column, was unrecoverable data loss on a `text[]`
+            // column. The stated reason for coercing — "avoid .map() crashes
+            // downstream" — is better served by refusing the value at the
+            // boundary, which is what a 400 does.
+            //
+            // The read-side twin (`parsePropertyFromServer`) still coerces, and
+            // should: a row already in the database is not this caller's fault.
+            throw ApiError.badRequest(
+                `${fieldLabel} expects an array, but received ${describeValue(value)}.`,
+                "VALIDATION_INVALID_VALUE"
+            );
+
+        case "geopoint": {
+            // Stored as `jsonb`, in the `{ latitude, longitude }` shape the
+            // OpenAPI schema and the generated TS type both promise. Nothing
+            // used to handle `geopoint` on either side, which is why the type
+            // was documented, code-generated, admin-editable — and dropped.
+            if (typeof value !== "object" || Array.isArray(value)) {
+                throw ApiError.badRequest(
+                    `${fieldLabel} expects a geopoint object with \`latitude\` and \`longitude\`, ` +
+                    `but received ${describeValue(value)}.`,
+                    "VALIDATION_INVALID_VALUE"
+                );
+            }
+            const point = value as Record<string, unknown>;
+            if (typeof point.latitude !== "number" || typeof point.longitude !== "number") {
+                throw ApiError.badRequest(
+                    `${fieldLabel} expects a geopoint object with numeric \`latitude\` and \`longitude\`.`,
+                    "VALIDATION_INVALID_VALUE"
+                );
+            }
+            return { latitude: point.latitude,
+longitude: point.longitude };
+        }
 
 
         case "map":
@@ -260,7 +333,7 @@ export function serializePropertyToServer(value: unknown, property: Property): u
                 for (const [subKey, subValue] of Object.entries(value)) {
                     const subProperty = (property.properties as Properties)[subKey];
                     if (subProperty) {
-                        result[subKey] = serializePropertyToServer(subValue, subProperty);
+                        result[subKey] = serializePropertyToServer(subValue, subProperty, propertyKey ? `${propertyKey}.${subKey}` : subKey);
                     } else {
                         result[subKey] = subValue;
                     }
@@ -321,9 +394,12 @@ export async function parseDataFromServer<M extends Record<string, unknown>>(
             // Find the normalized relation for this property
             const relation = findRelation(resolvedRelations, propKey);
             if (relation) {
-                if (relation.kind === "belongsTo" && relation.localKey in data) {
-                    // Owning relation: FK is in current table
-                    const fkValue = data[relation.localKey as keyof M];
+                const localField = relation.kind === "belongsTo"
+                    ? fieldKeyForColumn(collection, relation.localKey)
+                    : "";
+                if (relation.kind === "belongsTo" && localField in data) {
+                    // Owning relation: FK is in current table, under its wire name
+                    const fkValue = data[localField as keyof M];
                     if (fkValue !== null && fkValue !== undefined) {
                         try {
                             const targetCollection = relation.target();
@@ -347,7 +423,8 @@ export async function parseDataFromServer<M extends Record<string, unknown>>(
                             : buildCompositeId(data, pks);
 
                         if (targetTable && currentId !== undefined && currentId !== null && currentId !== "") {
-                            const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget as keyof typeof targetTable] as AnyPgColumn;
+                            const fkFieldKey = fieldKeyForColumn(targetCollection, relation.foreignKeyOnTarget);
+                            const foreignKeyColumn = targetTable[fkFieldKey as keyof typeof targetTable] as AnyPgColumn;
                             if (foreignKeyColumn) {
                                 // Query the target table to find row that references this row
                                 const relatedRows = await db
@@ -626,6 +703,13 @@ export function parsePropertyFromServer(value: unknown, property: Property, coll
             }
             return value;
 
+        case "geopoint":
+            // A `jsonb` column, so node-postgres hands back the object already.
+            // Named explicitly rather than left to `default:`, which would run
+            // it past the Buffer probe — and because a type with a write
+            // serializer and no read counterpart is how this one went missing.
+            return value;
+
         case "vector": {
             let nums: number[] = [];
             if (typeof value === "string") {
@@ -706,9 +790,11 @@ function normalizeScalarValues<M extends Record<string, unknown>>(
     // Identify FK columns used only for relations and not exposed as properties
     const internalFKColumns = new Set<string>();
     Object.values(resolvedRelations).forEach(relation => {
-        if (relation.kind === "belongsTo" && !properties[relation.localKey]) {
-            internalFKColumns.add(relation.localKey);
-        }
+        if (relation.kind !== "belongsTo") return;
+        // The key a row carries this foreign key under, which is the wire name
+        // — `authorId`, not the `author_id` column.
+        const localField = fieldKeyForColumn(collection, relation.localKey);
+        if (!properties[localField]) internalFKColumns.add(localField);
     });
 
     for (const [key, value] of Object.entries(data)) {

package/src/history/ensure-history-table.ts

@@ -9,7 +9,7 @@ import { revokeInternalTableSql } from "@rebasepro/common";
  * pattern as `ensureAuthTablesExist`.
  */
 export async function ensureHistoryTableExists(db: NodePgDatabase): Promise<void> {
-    logger.info("🔍 Checking row history table...");
+    logger.debug("🔍 Checking row history table...");
 
     try {
         // Create the rebase schema (idempotent — may already exist from auth init)
@@ -45,7 +45,7 @@ export async function ensureHistoryTableExists(db: NodePgDatabase): Promise<void
         // (created here, after that grant ran), so take it back.
         await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
 
-        logger.info("✅ Entity history table ready");
+        logger.debug("✅ Entity history table ready");
     } catch (error) {
         logger.error("❌ Failed to create row history table", { error: error });
         logger.warn("⚠️ Continuing without creating history table.");

package/src/schema/auth-schema.ts

@@ -1,4 +1,4 @@
-import { pgSchema, pgTable, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
+import { pgSchema, pgTable, uuid, timestamp, boolean, jsonb, text, unique, index, integer, bigint } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
 
 /**
@@ -87,6 +87,13 @@ export function createAuthSchema(usersSchemaName = "rebase") {
          * that rotates immediately after it.
          */
         sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
+        /**
+         * The assurance level the sign-in was established at — `aal2` only
+         * where a second factor was actually presented. Carried across
+         * rotations, because refresh is not a new authentication and has
+         * nothing else to read the level from.
+         */
+        aal: text("aal"),
         userAgent: text("user_agent"),
         ipAddress: text("ip_address"),
         createdAt: timestamp("created_at").defaultNow().notNull()
@@ -140,6 +147,13 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         secretEncrypted: text("secret_encrypted").notNull(),
         friendlyName: text("friendly_name"),
         verified: boolean("verified").default(false).notNull(),
+        /**
+         * The highest TOTP time step ever accepted for this factor. RFC 6238
+         * §5.2 forbids accepting an OTP twice, and the ±1 step window that
+         * exists for clock drift is also a 90-second replay window: without
+         * this, one observed code buys a fresh session for a minute and a half.
+         */
+        lastUsedCounter: bigint("last_used_counter", { mode: "number" }),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
     });
@@ -153,6 +167,8 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         createdAt: timestamp("created_at").defaultNow().notNull(),
         verifiedAt: timestamp("verified_at"),
         ipAddress: text("ip_address"),
+        /** Failed guesses recorded against this challenge; bounded by the route. */
+        attempts: integer("attempts").default(0).notNull(),
         expiresAt: timestamp("expires_at").notNull()
     });
 

package/src/schema/doctor-cli.ts

@@ -5,62 +5,8 @@
  */
 import path from "path";
 import chalk from "chalk";
-import fs from "fs";
-import { runDoctor, loadCollections } from "./doctor";
-import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
-import { validatePolicyPgRoles, warnOnAnonymousGrants } from "../security/rls-enforcement";
-import { logger } from "@rebasepro/server";
-
-/**
- * The RLS half of the doctor: policies actually deployed vs the ones the
- * collections describe, plus policy roles this server could never satisfy.
- *
- * Returns true when something is wrong, so callers can set the exit code.
- */
-async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<boolean> {
-    if (!databaseUrl) {
-        logger.warn(chalk.yellow("  ⚠ No DATABASE_URL — skipping RLS policy checks"));
-        return false;
-    }
-
-    let problems = false;
-    const { Pool } = await import("pg");
-    const pool = new Pool({ connectionString: databaseUrl });
-    try {
-        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
-        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];
-
-        // A policy naming a role the server never runs as filters every row, so
-        // the collection reads as empty. Report it without booting a server.
-        try {
-            await validatePolicyPgRoles(runSql, collections as never);
-            logger.info(chalk.green("  ✓ Policy roles are usable by this server"));
-        } catch (err) {
-            problems = true;
-            logger.info("");
-            logger.error(chalk.red(err instanceof Error ? err.message : String(err)));
-        }
-
-        // A rule that reads as a lockdown but is true for every caller compiles
-        // to a grant. Report it without booting a server.
-        warnOnAnonymousGrants(collections as never);
-
-        const drift = await checkPolicyDrift(pool as never, collections);
-        logger.info("");
-        if (hasDrift(drift)) {
-            problems = true;
-            logger.info(chalk.yellow("  RLS policies: database does not match your collections"));
-            logger.info(formatPolicyDrift(drift));
-        } else {
-            logger.info(chalk.green("  ✓ RLS policies match your collections"));
-        }
-    } catch (err) {
-        logger.warn(chalk.yellow("  ⚠ Could not check RLS policies"), { error: err });
-    } finally {
-        await pool.end();
-    }
-    return problems;
-}
+import { runDoctor } from "./doctor";
+import { exitCodeForPolicyGate, runPolicyChecks } from "./doctor-policy-checks";
 
 async function main() {
     const collectionsArg = process.argv.find((a) => a.startsWith("--collections="));
@@ -80,9 +26,9 @@ async function main() {
         const dotenv = await import("dotenv");
         const envPath = process.env.DOTENV_CONFIG_PATH;
         if (envPath) {
-            dotenv.config({ path: envPath });
+            dotenv.config({ path: envPath, quiet: true });
         } else {
-            dotenv.config();
+            dotenv.config({ quiet: true });
         }
     } catch {
         // dotenv may not be installed
@@ -91,9 +37,9 @@ async function main() {
     const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;
 
     if (policiesOnly) {
-        // Non-zero so this can gate CI — the whole point of the flag.
-        if (await runPolicyChecks(collectionsPath, databaseUrl)) process.exit(1);
-        return;
+        // Non-zero so this can gate CI — the whole point of the flag, and a
+        // check that could not run has not passed. See exitCodeForPolicyGate.
+        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));
     }
 
     const report = await runDoctor({
@@ -103,15 +49,18 @@ async function main() {
         databaseUrl: databaseUrl ?? undefined
     });
 
-    const policiesDrifted = await runPolicyChecks(collectionsPath, databaseUrl);
+    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);
 
-    // Exit with non-zero code if there are errors
-    if (report.summary.errors > 0 || policiesDrifted) {
+    // Exit non-zero if there are errors. A policy run that could not happen is
+    // reported loudly above but does not fail the interactive command — the
+    // same treatment the skipped database phase gets. `--policies` is the gate,
+    // and that one fails closed.
+    if (report.summary.errors > 0 || policyStatus === "problems") {
         process.exit(1);
     }
 }
 
 main().catch((err) => {
-    logger.error(chalk.red("  ✗ Doctor failed"), { error: err });
+    console.error(chalk.red("  ✗ Doctor failed"), err instanceof Error ? (err.stack ?? err.message) : String(err));
     process.exit(1);
 });

package/src/schema/doctor-policy-checks.ts

@@ -0,0 +1,105 @@
+/**
+ * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.
+ *
+ * Lives beside `doctor-cli.ts` rather than inside it because that file runs
+ * `main()` on import: a gate whose failure modes cannot be unit-tested is how
+ * this one shipped reporting success for work it never did.
+ */
+import path from "path";
+import chalk from "chalk";
+import { CollectionConfig } from "@rebasepro/types";
+import { loadCollections } from "./doctor";
+import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
+import { validatePolicyPgRoles, warnOnAnonymousGrants } from "../security/rls-enforcement";
+
+/**
+ * What the RLS checks concluded.
+ *
+ * `unchecked` exists because "we could not look" and "we looked and it is fine"
+ * used to be reported identically: a collections path that did not resolve made
+ * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`
+ * early-returned an empty diff, and the gate printed
+ * `✓ RLS policies match your collections` having compared zero policies against
+ * zero collections. Any exception at all — a collection file that throws on
+ * import, a `pg_policies` read the CI role is not granted, a connection reset —
+ * did the same thing through a `warn`, and exited 0.
+ */
+export type PolicyCheckStatus = "ok" | "problems" | "unchecked";
+
+/**
+ * The exit code for `rebase doctor --policies`.
+ *
+ * A gate that could not run has not passed. Only a completed, clean check
+ * exits 0 — anything else, including "we never opened a connection", is a
+ * failure, or the flag certifies a database nobody looked at.
+ */
+export function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {
+    return status === "ok" ? 0 : 1;
+}
+
+/**
+ * Policies actually deployed vs the ones the collections describe, plus policy
+ * roles this server could never satisfy.
+ *
+ * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.
+ */
+export async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {
+    if (!databaseUrl) {
+        console.error(chalk.yellow("  ⚠ No DATABASE_URL — RLS policies were NOT checked"));
+        return "unchecked";
+    }
+
+    const resolvedPath = path.resolve(process.cwd(), collectionsPath);
+    let problems = false;
+    const { Pool } = await import("pg");
+    const pool = new Pool({ connectionString: databaseUrl });
+    try {
+        const collections: CollectionConfig[] = await loadCollections(resolvedPath);
+
+        // Zero collections is not "no drift", it is nothing to compare. The
+        // loader returns `[]` for a path that does not exist, so the commonest
+        // way to get here is a `--collections` path resolved against the wrong
+        // directory — which used to render as a green tick.
+        if (collections.length === 0) {
+            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));
+            console.error(chalk.gray("    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere."));
+            return "unchecked";
+        }
+
+        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];
+
+        // A policy naming a role the server never runs as filters every row, so
+        // the collection reads as empty. Report it without booting a server.
+        try {
+            await validatePolicyPgRoles(runSql, collections as never);
+            console.log(chalk.green("  ✓ Policy roles are usable by this server"));
+        } catch (err) {
+            problems = true;
+            console.log("");
+            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        }
+
+        // A rule that reads as a lockdown but is true for every caller compiles
+        // to a grant. Report it without booting a server.
+        warnOnAnonymousGrants(collections as never);
+
+        const drift = await checkPolicyDrift(pool as never, collections);
+        console.log("");
+        if (hasDrift(drift)) {
+            problems = true;
+            console.log(chalk.yellow("  RLS policies: database does not match your collections"));
+            console.log(formatPolicyDrift(drift));
+        } else {
+            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));
+        }
+    } catch (err) {
+        // Fail closed. This catch covers every query and every collection import
+        // above, so returning the pre-catch verdict made the documented CI gate
+        // green on exactly the runs it exists to catch.
+        console.error(chalk.red("  ✗ Could not check RLS policies:"), err instanceof Error ? err.message : String(err));
+        return "unchecked";
+    } finally {
+        await pool.end();
+    }
+    return problems ? "problems" : "ok";
+}