@rebasepro/server-postgres 0.15.0 → 0.16.0

package/src/PostgresBootstrapper.ts

@@ -238,6 +238,16 @@ export function isScaffoldedLocalDatabase(connectionString: string | undefined):
  * });
  * ```
  */
+/**
+ * Where the collections schema stamp lives.
+ *
+ * The runtime's own internal schema, always — unlike the auth stamp, which
+ * follows the users collection. `rebase` and `auth` sit outside
+ * `introspectionSchema` by construction, so nothing here is ever served as a
+ * collection.
+ */
+const SCHEMA_META_SCHEMA = "rebase";
+
 export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): BackendBootstrapper {
     // Applied at construction rather than threaded through every read: the
     // condition builder's static methods are reached from call sites that
@@ -262,6 +272,19 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
      * builder, not to `execute(sql.raw(...))` — and every statement these hooks
      * emit is schema-qualified DDL, so neither depends on `search_path`.
      */
+    /**
+     * The drizzle handle itself, for the statements that want parameters.
+     *
+     * `provisioningQueryable` below hands back a `query(text)` shim because the
+     * DDL it serves is built as text. The schema stamp writes a *value*, so it
+     * wants the parameterised form — building that string by hand would be one
+     * more place a quoted literal has to be got right for no benefit.
+     */
+    const provisioningDb = (driverResult?: InitializedDriver) => {
+        const internals = driverResult?.internals as PostgresDriverInternals | undefined;
+        return internals?.db ?? (pgConfig.connection as PostgresDriverInternals["db"] | undefined);
+    };
+
     const provisioningQueryable = (driverResult?: InitializedDriver) => {
         const internals = driverResult?.internals as PostgresDriverInternals | undefined;
         const db = internals?.db ?? (pgConfig.connection as PostgresDriverInternals["db"] | undefined);
@@ -287,13 +310,20 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
         async initializeDriver(config: unknown): Promise<InitializedDriver> {
             // config is passed from coordinator, we merge it with our internal pgConfig if needed
             // Currently config from init.ts is `{ collections, collectionRegistry, mode }`
-            const { collections, collectionRegistry, introspectCollections, baas, schemaProvisioning } = config as {
+            const { collections, collectionRegistry, introspectCollections, baas, schemaProvisioning, realtime } = config as {
                 collections?: CollectionConfig[];
                 collectionRegistry?: unknown;
                 introspectCollections?: boolean;
                 baas?: { unprotectedTables?: "exclude" | "serve" };
                 schemaProvisioning?: { attempted: boolean; reason?: string };
+                realtime?: { subscribe: boolean; provision: boolean };
             };
+            // Absent means a caller that predates the field, and every one of
+            // those is a single process that both serves websockets and owns the
+            // schema. Defaulting to false here would silently disable realtime
+            // for them — the failure this whole area is prone to.
+            const realtimeSubscribes = realtime?.subscribe ?? true;
+            const realtimeProvisions = realtime?.provision ?? true;
             // Secure by default: a table with no RLS is not served.
             const unprotectedTables = baas?.unprotectedTables ?? "exclude";
 
@@ -570,7 +600,10 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             // and leaves broadcast on its original fire-and-forget path, so
             // presence-only apps pay nothing for it.
             try {
-                await realtimeService.configureChannelHistory(pgConfig.realtime?.channels);
+                await realtimeService.configureChannelHistory(
+                    pgConfig.realtime?.channels,
+                    { provision: realtimeProvisions }
+                );
             } catch (err) {
                 logger.warn("⚠️ Could not initialize channel history tables — retained channels will not replay", { error: err });
             }
@@ -622,7 +655,11 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
 
             // `auto` tries CDC but treats "can't" as a normal outcome (info log);
             // explicit trigger/wal was asked for, so a failure is worth a warning.
-            const wantsCdc = cdcMode !== "off";
+            // A process that consumes nothing needs no capture *started*, and a
+            // process that does not own the schema installs no triggers. They
+            // come apart: the `api` in a split with an external migration Job
+            // subscribes without provisioning, and both answers are correct.
+            const wantsCdc = cdcMode !== "off" && (realtimeSubscribes || realtimeProvisions);
             const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
             let cdcEnabled = false;
             let provisionCdcForTables: PostgresDriverInternals["provisionCdcForTables"];
@@ -664,17 +701,29 @@ table: link.table });
                     // Provisioning throws only when the connection can't create the
                     // trigger function (insufficient privilege); enableCdc throws when
                     // the LISTEN connection can't be established. Either → fall back.
-                    await provisionTriggerCdc(cdcRunSql, cdcTables);
-                    await realtimeService.enableCdc(directUrl);
+                    if (realtimeProvisions) await provisionTriggerCdc(cdcRunSql, cdcTables);
+                    if (realtimeSubscribes) await realtimeService.enableCdc(directUrl);
                     cdcEnabled = true;
                     // Boot steps that create their own tables (auth) run after
                     // this one and use it to instrument what they just created.
-                    provisionCdcForTables = async (tables) => {
-                        await provisionTriggerCdc(cdcRunSql, tables);
-                    };
+                    // Left undefined where this process installs nothing, so a
+                    // later boot step cannot re-enter the DDL path by the side
+                    // door — the callers already treat it as optional, because a
+                    // driver without CDC never sets it either.
+                    if (realtimeProvisions) {
+                        provisionCdcForTables = async (tables) => {
+                            await provisionTriggerCdc(cdcRunSql, tables);
+                        };
+                    }
+                    // Say which half ran. "All writes now emit realtime events"
+                    // is a claim about the database and stays true for a process
+                    // that only installed the triggers; what changes is whether
+                    // *this* process is listening, and an operator reading one
+                    // pod's log should not have to infer that from its role.
                     logger.info(
                         `📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). ` +
-                        `All writes now emit realtime events regardless of origin.`
+                        `All writes now emit realtime events regardless of origin.` +
+                        (realtimeSubscribes ? "" : " This process installs the capture but does not consume it.")
                     );
                 } catch (err) {
                     if (explicitCdc) {
@@ -691,7 +740,7 @@ table: link.table });
 
             // Legacy cross-instance realtime (app-level). Skipped when CDC is
             // active because CDC already spans instances.
-            if (!cdcEnabled && directUrl) {
+            if (!cdcEnabled && directUrl && realtimeSubscribes) {
                 try {
                     await realtimeService.startListening(directUrl);
                 } catch (err) {
@@ -981,8 +1030,8 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
          *
          * The companion to {@link ensureCollectionSchema}: that creates the
          * tables, this makes them servable. Boot runs it *after* auth
-         * initialization, because the generated policies call `auth.uid()` /
-         * `auth.roles()`, and `CREATE POLICY` validates those functions exist.
+         * initialization, because the generated policies call `rebase.uid()` /
+         * `rebase.roles()`, and `CREATE POLICY` validates those functions exist.
          *
          * Runs through the same drizzle handle, one statement at a time (that
          * handle speaks the extended query protocol, which rejects multi-command
@@ -1062,6 +1111,27 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
             return { applied: outcome.policiesApplied };
         },
 
+        /**
+         * Read what the last provisioning boot recorded, or `null`.
+         *
+         * The meta schema is `rebase` rather than the auth stamp's — see
+         * `schema/collections-schema-version.ts` for why the two can differ.
+         */
+        async readCollectionsSchemaVersion(driverResult?: InitializedDriver): Promise<string | null> {
+            const db = provisioningDb(driverResult);
+            if (!db) return null;
+            const { readCollectionsSchemaVersion } = await import("./schema/collections-schema-version");
+            return readCollectionsSchemaVersion(db as never, SCHEMA_META_SCHEMA);
+        },
+
+        /** Record what this process just applied. Only the provisioning process calls this. */
+        async stampCollectionsSchemaVersion(version: string, driverResult?: InitializedDriver): Promise<void> {
+            const db = provisioningDb(driverResult);
+            if (!db) return;
+            const { stampCollectionsSchemaVersion } = await import("./schema/collections-schema-version");
+            await stampCollectionsSchemaVersion(db as never, SCHEMA_META_SCHEMA, version);
+        },
+
         getAdmin(driverResult: InitializedDriver): DatabaseAdmin | undefined {
             const internals = driverResult.internals as PostgresDriverInternals;
             return internals.driver.admin;

package/src/auth/services.ts

@@ -112,7 +112,7 @@ export class UserService implements UserRepository {
      * Run a privileged auth write with an explicitly cleared RLS context.
      *
      * The auth services run on the base/owner connection, which by design
-     * carries a NULL `app.uid` so the `auth.uid() IS NULL` server-escape
+     * carries a NULL `app.uid` so the `rebase.uid() IS NULL` server-escape
      * in the default policies applies. That NULL is normally guaranteed by
      * `set_config(..., is_local = true)` resetting at transaction end — but a
      * GUC that survives on a pooled connection (or a connection role that
@@ -120,7 +120,7 @@ export class UserService implements UserRepository {
      * turns the trusted write into an RLS-scoped one and denies it with
      * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
      * single chokepoint, makes the server context deterministic instead of
-     * trusting whatever state the pool hands us. `auth.uid()` reads '' as
+     * trusting whatever state the pool hands us. `rebase.uid()` reads '' as
      * NULL via NULLIF, so '' is the server context.
      */
     private async withServerContext<T>(fn: (db: NodePgDatabase) => Promise<T>): Promise<T> {

package/src/backup/backup-cli.ts

@@ -25,6 +25,7 @@ import {
     applyGlobals,
     BackupToolError,
     createDump,
+    discardPartialDump,
     ensureDatabaseExists,
     listBackups,
     preflight,
@@ -285,18 +286,21 @@ export async function restoreCommand(rawArgs: string[]): Promise<void> {
             process.exit(1);
         }
 
-        // Create the target database when requested.
-        if (args["--create-db"]) {
-            if (!targetDb) {
-                outError(chalk.red("  ✗ --create-db requires a resolvable target database name (use --target-db)."));
-                process.exit(1);
-            }
-            const created = await ensureDatabaseExists(baseConnection, targetDb);
-            print(chalk.gray(created ? `  ✓ Created database "${targetDb}".` : `  • Database "${targetDb}" already exists.`));
+        // `--create-db` needs a name before anything else can be decided.
+        if (args["--create-db"] && !targetDb) {
+            outError(chalk.red("  ✗ --create-db requires a resolvable target database name (use --target-db)."));
+            process.exit(1);
         }
 
         // Destructive-action gate. Restores overwrite data; never run without
         // an explicit yes (interactive confirmation or --yes).
+        //
+        // Ahead of `--create-db`, not after it. Creating the database first
+        // meant an aborted run had already changed the cluster, while printing
+        // "No changes were made" — and it left an empty database behind that a
+        // second, confirmed run then reported as "already exists". The gate is
+        // now the first thing that can stop the command, so its own message is
+        // true whichever way the answer goes.
         if (!args["--yes"]) {
             outWarn(chalk.yellow(
                 `  ⚠️  This will restore into "${targetDb ?? "the target database"}" and may overwrite existing data.`
@@ -308,6 +312,12 @@ export async function restoreCommand(rawArgs: string[]): Promise<void> {
             }
         }
 
+        // Create the target database when requested.
+        if (args["--create-db"]) {
+            const created = await ensureDatabaseExists(baseConnection, targetDb!);
+            print(chalk.gray(created ? `  ✓ Created database "${targetDb}".` : `  • Database "${targetDb}" already exists.`));
+        }
+
         // Recreate cluster roles before restoring so GRANT/RLS statements in
         // the dump apply. Best-effort and idempotent (see applyGlobals).
         if (globalsSql) {
@@ -377,7 +387,23 @@ export async function backupsCommand(rawArgs: string[]): Promise<void> {
             for (const b of backups) {
                 const when = b.createdAt ? b.createdAt.toISOString() : "unknown date";
                 const name = dest.kind === "local" ? path.basename(b.key) : b.key;
-                print(`  ${chalk.green("●")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}`);
+                // An empty file is called out rather than listed as a peer of
+                // the real ones. Older failures could leave a 0-byte dump here
+                // (fixed at the source now), and retention protects the newest
+                // by date whatever they contain — so a corpse left in place can
+                // hold a `keepMinimum` slot against a backup that matters.
+                const empty = b.sizeBytes === 0;
+                const size = b.sizeBytes === undefined ? "" : ` — ${formatBytes(b.sizeBytes)}`;
+                if (empty) {
+                    print(`  ${chalk.red("○")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(" — EMPTY, not restorable")}`);
+                } else {
+                    print(`  ${chalk.green("●")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);
+                }
+            }
+            if (backups.some(b => b.sizeBytes === 0)) {
+                print("");
+                print(chalk.yellow("  ⚠  Empty files above are leftovers from a failed backup. Delete them:"));
+                print(chalk.gray("     they count as recent backups for retention but restore nothing."));
             }
         }
         print("");
@@ -387,13 +413,24 @@ export async function backupsCommand(rawArgs: string[]): Promise<void> {
     }
 }
 
-/** Verify a freshly written dump; abort the command if it looks corrupt. */
+/**
+ * Verify a freshly written dump; abort the command if it looks corrupt.
+ *
+ * Discards the artifact on the way out. Refusing to *report* success was never
+ * enough on its own: the file stayed on disk, `rebase db backups list` showed
+ * it as an ordinary entry, and retention — which ranks by timestamp and never
+ * looks at size — would protect it as one of the `keepMinimum` newest while
+ * pruning a real backup underneath it. The roles sidecar goes too; the two are
+ * uploaded and pruned as a pair, so half a pair is not a backup either.
+ */
 async function assertDumpValid(localFile: string): Promise<void> {
     const check = await validateDump(localFile);
     if (!check.ok) {
+        discardPartialDump(globalsFileForDump(localFile));
+        discardPartialDump(localFile);
         throw new BackupToolError(
-            `The backup failed validation and was not trusted: ${check.reason}`,
-            "The dump may be corrupt or truncated. Investigate before relying on it."
+            `The backup failed validation and was discarded: ${check.reason}`,
+            "The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination."
         );
     }
 }

package/src/backup/backup-logic.ts

@@ -60,3 +60,34 @@ export async function pruneWith(
         }
     }
 }
+
+/**
+ * Remove a dump artifact abandoned by a failed tool run.
+ *
+ * `pg_dump` creates its `--file=` target before it finishes connecting, so any
+ * failure — a URL libpq rejects, a dropped connection, a full disk — leaves a
+ * 0-byte file behind. That corpse is not inert: `rebase db backups list` used
+ * to show it as an ordinary entry, and `selectBackupsToPrune` ranks by
+ * timestamp alone, so it occupies a protected `keepMinimum` slot and can push
+ * a real backup out of retention.
+ *
+ * Best-effort on purpose: the caller is already throwing, and a failed unlink
+ * must not replace the real diagnosis with an ENOENT/EPERM from the cleanup.
+ *
+ * Lives here rather than in `backup-service.ts` for the reason at the top of
+ * this file — that module's top-level `execa` import makes it unloadable under
+ * jest, so anything placed there cannot be unit-tested.
+ *
+ * `remove` deletes one file and throws if it cannot; `exists` reports presence.
+ */
+export function discardPartialDumpWith(
+    exists: (file: string) => boolean,
+    remove: (file: string) => void,
+    file: string
+): void {
+    try {
+        if (exists(file)) remove(file);
+    } catch {
+        // Ignored: see above.
+    }
+}

package/src/backup/backup-service.ts

@@ -32,7 +32,20 @@ import {
     VersionCompatibility
 } from "./pg-tools";
 import { BackupObject, RetentionOptions, selectBackupsToPrune } from "./retention";
-import { applyGlobalsWith, pruneWith } from "./backup-logic";
+import { applyGlobalsWith, discardPartialDumpWith, pruneWith } from "./backup-logic";
+
+/**
+ * Remove a dump artifact abandoned by a failed tool run. See
+ * {@link discardPartialDumpWith} for why this exists and why the logic lives
+ * in the execa-free module.
+ */
+export function discardPartialDump(file: string): void {
+    discardPartialDumpWith(
+        (f) => fs.existsSync(f),
+        (f) => fs.unlinkSync(f),
+        file
+    );
+}
 
 export class BackupToolError extends Error {
     constructor(message: string, readonly hint?: string) {
@@ -190,6 +203,15 @@ export async function createDump(opts: {
             env: dumpEnv
         });
     } catch (error) {
+        // pg_dump creates its `--file=` target before it finishes connecting,
+        // so any failure here — a URL libpq rejects, a dropped connection, a
+        // full disk — leaves a 0-byte file behind that nothing else removed.
+        // That corpse is not inert: `rebase db backups list` shows it as an
+        // ordinary entry, and `selectBackupsToPrune` ranks by timestamp alone,
+        // so it occupies a protected `keepMinimum` slot and can push a real
+        // backup out of retention. A missing backup is honest; an empty file
+        // that reads as a backup is not.
+        discardPartialDump(localFile);
         // The RLS failure names a table and no cause. Replace it with the
         // cause and the two ways out; anything else is re-thrown untouched.
         const diagnosis = diagnoseRowSecurityDumpFailure(error);
@@ -214,11 +236,22 @@ export async function createDump(opts: {
             );
         }
         const globalsFile = globalsFileForDump(localFile);
-        await execa(
-            dumpallBin,
-            buildPgDumpallGlobalsArgs({ connectionString: opts.connectionString, outFile: globalsFile }),
-            { stdio: opts.inheritStdio ? "inherit" : "pipe", env: { ...(env as Record<string, string>) } }
-        );
+        try {
+            await execa(
+                dumpallBin,
+                buildPgDumpallGlobalsArgs({ connectionString: opts.connectionString, outFile: globalsFile }),
+                { stdio: opts.inheritStdio ? "inherit" : "pipe", env: { ...(env as Record<string, string>) } }
+            );
+        } catch (error) {
+            // Same reasoning as the pg_dump catch above, and the dump goes with
+            // it: the pair is uploaded and pruned together, so a dump whose
+            // roles sidecar is missing restores without the roles its GRANT and
+            // RLS statements need — the exact failure the sidecar exists to
+            // prevent. Leaving half a pair on disk would look like a backup.
+            discardPartialDump(globalsFile);
+            discardPartialDump(localFile);
+            throw error;
+        }
         result.globalsFile = globalsFile;
         result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;
     }
@@ -398,8 +431,9 @@ export async function listBackups(
             .filter((f) => f.endsWith(".dump"))
             .map((f) => {
                 const full = path.join(dir, f);
-                const createdAt = parseBackupTimestamp(f) ?? fs.statSync(full).mtime;
-                return { key: full, createdAt };
+                const stats = fs.statSync(full);
+                const createdAt = parseBackupTimestamp(f) ?? stats.mtime;
+                return { key: full, createdAt, sizeBytes: stats.size };
             })
             .sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
     }

package/src/backup/pg-tools.ts

@@ -373,7 +373,18 @@ export function globalsFileForDump(dumpPath: string): string {
 export function splitGlobalsStatements(sql: string): string[] {
     const withoutComments = sql
         .split("\n")
-        .filter((line) => !line.trim().startsWith("--"))
+        // `--` comments, and psql meta-commands. pg_dumpall 15+ wraps its output
+        // in `\restrict <token>` / `\unrestrict <token>`, which are instructions
+        // to psql, not SQL. This replay sends statements over a connection
+        // instead, so they arrived at the server as `\restrict …` and came back
+        // as `syntax error at or near "\"` — reported to the user as two skipped
+        // globals per restore, which reads like roles failed to apply when
+        // nothing did. They carry no state worth replaying: dropping them is
+        // exactly what a SQL-level consumer should do.
+        .filter((line) => {
+            const trimmed = line.trim();
+            return !trimmed.startsWith("--") && !trimmed.startsWith("\\");
+        })
         .join("\n");
     return withoutComments
         .split(";")

package/src/backup/retention.ts

@@ -12,6 +12,17 @@ export interface BackupObject {
      * timestamp encoded in the key by `buildBackupFilename`.
      */
     createdAt?: Date;
+    /**
+     * Size on disk, when the lister knows it (local destinations always do).
+     *
+     * Reported so an empty artifact cannot masquerade as a backup in
+     * `rebase db backups list`. Deliberately NOT consulted by
+     * {@link selectBackupsToPrune}: retention decides by age, and a rule that
+     * silently skipped small files would make a genuinely tiny dump immortal.
+     * Visibility is the fix here; the artifacts themselves are now removed at
+     * the point of failure by `discardPartialDump`.
+     */
+    sizeBytes?: number;
 }
 
 export interface RetentionOptions {

package/src/schema/collections-schema-version.ts

@@ -0,0 +1,103 @@
+/**
+ * The collections schema version, stamped into the database.
+ *
+ * Deliberately the same table shape, the same key/value convention and the same
+ * "unstamped is null, and null is not an error" rule as `auth/schema-version.ts`.
+ * They answer the same kind of question — "was this database provisioned by
+ * something that agrees with me" — and inventing a second convention for the
+ * second one would be a second thing to find, back up and reason about.
+ *
+ * It does *not* follow the auth stamp's schema. `resolveAuthSchema` tracks the
+ * users collection, so a project that puts its users in a custom schema moves
+ * the auth stamp with them — correct there, because that stamp describes those
+ * tables. This one describes the collections as a whole and belongs with the
+ * runtime's own internal state, which is always `rebase`. Usually they land in
+ * the same table anyway; when they do not, that is the reason.
+ *
+ * The value is opaque here on purpose. It is a hash produced by
+ * `computeSchemaVersion` in `@rebasepro/types`, and this module's only job is to
+ * put a string in and take the same string out. Comparing them, and deciding
+ * what a difference means, is `boot/schema-stamp.ts` in the runtime — where it
+ * can be tested without a database.
+ *
+ * Unlike the auth version, this is **not** ordered. The auth stamp is an integer
+ * whose comparison direction carries meaning (a database newer than the runtime
+ * is unrecoverable, older is the ordinary upgrade path). A schema hash has no
+ * order at all: it can say the two disagree and never which is ahead. That is a
+ * deliberate limit, and the reason the runtime's response to a mismatch is to
+ * describe it rather than to decide who is wrong.
+ */
+import { sql } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+
+/** Key under which the version is stored in the meta table. */
+const VERSION_KEY = "collections_schema_version";
+
+/**
+ * Anything that can run SQL for us.
+ *
+ * Narrower than `NodePgDatabase` so the provisioning handle — which is what the
+ * boot path actually has in hand — satisfies it without a cast at every call
+ * site.
+ */
+export interface SchemaMetaQueryable {
+    execute(query: unknown): Promise<{ rows: Record<string, unknown>[] }>;
+}
+
+/**
+ * Read the stamped version, or `null` when this database has never been stamped.
+ *
+ * `to_regclass` rather than a plain `SELECT` so a missing schema or table is a
+ * `null` instead of a thrown 42P01 — the overwhelmingly common case on a fresh
+ * database is that neither exists yet, and that is not news.
+ */
+export async function readCollectionsSchemaVersion(
+    db: SchemaMetaQueryable | NodePgDatabase,
+    metaSchema: string
+): Promise<string | null> {
+    const qualified = `"${metaSchema}"."schema_meta"`;
+    const exists = await (db as SchemaMetaQueryable).execute(
+        sql`SELECT to_regclass(${qualified}) IS NOT NULL AS present`
+    );
+    if (!(exists.rows[0] as { present: boolean } | undefined)?.present) return null;
+
+    const result = await (db as SchemaMetaQueryable).execute(sql`
+        SELECT value FROM ${sql.raw(qualified)} WHERE key = ${VERSION_KEY}
+    `);
+    const raw = (result.rows[0] as { value: string } | undefined)?.value;
+
+    // An empty string is not a version anybody computed, and treating it as one
+    // would make every process disagree with the database forever. Unstamped.
+    return raw === undefined || raw.trim() === "" ? null : raw;
+}
+
+/**
+ * Record the version this runtime just applied.
+ *
+ * Creates the meta table if the auth stamp has not already — the two are
+ * independent halves of one boot and either may run first, so neither can assume
+ * the table is there. `CREATE TABLE IF NOT EXISTS` is not atomic against a
+ * concurrent identical statement, which is exactly the race a split deployment
+ * arranges; it is tolerated here for the same reason it is elsewhere in the boot
+ * path, and the caller treats any failure as a warning rather than a fatal.
+ */
+export async function stampCollectionsSchemaVersion(
+    db: SchemaMetaQueryable | NodePgDatabase,
+    metaSchema: string,
+    version: string
+): Promise<void> {
+    const qualified = `"${metaSchema}"."schema_meta"`;
+    await (db as SchemaMetaQueryable).execute(sql`CREATE SCHEMA IF NOT EXISTS ${sql.identifier(metaSchema)}`);
+    await (db as SchemaMetaQueryable).execute(sql`
+        CREATE TABLE IF NOT EXISTS ${sql.raw(qualified)} (
+            key TEXT PRIMARY KEY,
+            value TEXT NOT NULL,
+            updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+        )
+    `);
+    await (db as SchemaMetaQueryable).execute(sql`
+        INSERT INTO ${sql.raw(qualified)} (key, value)
+        VALUES (${VERSION_KEY}, ${version})
+        ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()
+    `);
+}

package/src/security/policy-drift.test.ts

@@ -244,15 +244,34 @@ describe("checkPolicyDrift", () => {
         expect(formatPolicyDrift(drift)).toContain("db push");
     });
 
+    it("flags the tautology under the post-1.0 schema name too", async () => {
+        // The helpers moved from `auth` to `rebase` in 1.0, and the compiler
+        // rewrites raw `securityRules` SQL on the way in — so `rebase.uid() IS
+        // NOT NULL` is the only spelling a current release can store. A checker
+        // anchored on the pre-1.0 name saw none of it.
+        const cols = [collection("posts")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p, {
+            qual: p.hasUsing ? "(rebase.uid() IS NOT NULL)" : null
+        }));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.insecure.length).toBeGreaterThan(0);
+        expect(drift.diverged).toHaveLength(0);
+    });
+
     it("clears the corrected expression, in either literal spelling", async () => {
         const cols = [collection("posts")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        for (const guard of ["<> 'anonymous'::text", "<> 'anonymous'", "!= 'anonymous'"]) {
-            const live = expected.map((p) => liveRow(p, {
-                qual: p.hasUsing ? `((auth.uid() IS NOT NULL) AND ((auth.uid())::text ${guard}))` : null
-            }));
-            const drift = await checkPolicyDrift(dbWith(live), cols);
-            expect(drift.insecure).toHaveLength(0);
+        for (const fn of ["auth.uid()", "rebase.uid()"]) {
+            for (const guard of ["<> 'anonymous'::text", "<> 'anonymous'", "!= 'anonymous'"]) {
+                const live = expected.map((p) => liveRow(p, {
+                    qual: p.hasUsing ? `((${fn} IS NOT NULL) AND ((${fn})::text ${guard}))` : null
+                }));
+                const drift = await checkPolicyDrift(dbWith(live), cols);
+                expect(drift.insecure).toHaveLength(0);
+            }
         }
     });
 

package/src/security/policy-drift.ts

@@ -13,7 +13,7 @@
  * function `db push` uses to write `drizzle/policies.sql`, so this compares
  * against exactly what would be applied rather than a reimplementation.
  */
-import type { CollectionConfig } from "@rebasepro/types";
+import { RLS_UID_SQL, type CollectionConfig } from "@rebasepro/types";
 
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
@@ -62,7 +62,7 @@ export interface PolicyDrift {
     diverged: { expected: PolicyRef; actual: PolicyRef; differences: string[] }[];
     /**
      * A live policy whose expression is the known-permissive tautology
-     * `auth.uid() IS NOT NULL` — true for anonymous visitors too, because the
+     * `rebase.uid() IS NOT NULL` — true for anonymous visitors too, because the
      * user path coerces a blank id to the `'anonymous'` sentinel. This is what
      * `policy.authenticated()` used to compile to, so a database pushed before
      * that fix carries it, and neither the name, roles, command nor clause
@@ -243,18 +243,26 @@ async function readTablesWithRlsOff(
 }
 
 /**
- * The permissive tautology `auth.uid() IS NOT NULL`, without the
+ * The permissive tautology `rebase.uid() IS NOT NULL`, without the
  * `<> 'anonymous'` guard that makes it mean "signed in".
  *
  * Whitespace varies with Postgres's rewrite, so match on a collapsed form. The
  * guard clause (`<> 'anonymous'`, in any spelling) is what distinguishes the
  * corrected policy from the stale one, so its presence clears the text.
+ *
+ * Both schema spellings are matched. The helpers moved from `auth` to `rebase`
+ * in 1.0, and this check reads policies *as the database stored them*: a
+ * database pushed before the move still holds `auth.uid()` until it is
+ * recompiled, while everything written since — including raw `securityRules`
+ * SQL, which the compiler rewrites on the way in — stores `rebase.uid()`.
+ * Matching only the pre-1.0 name made the check blind to every policy a current
+ * release could write, which is precisely the set still worth scanning.
  */
 function isPermissiveAuthTautology(clause: string | null | undefined): boolean {
     if (!clause) return false;
     const flat = clause.toLowerCase().replace(/\s+/g, " ");
-    if (!/auth\.uid\(\)\s*is not null/.test(flat)) return false;
-    // The fix appends `AND auth.uid() <> 'anonymous'`; Postgres may store the
+    if (!/\b(?:rebase|auth)\.uid\s*\(\s*\)\s*is not null/.test(flat)) return false;
+    // The fix appends `AND rebase.uid() <> 'anonymous'`; Postgres may store the
     // literal as `'anonymous'::text`. Either spelling means it is the corrected
     // policy, not the tautology.
     return !/<>\s*'anonymous'/.test(flat) && !/!=\s*'anonymous'/.test(flat);
@@ -315,7 +323,7 @@ export async function checkPolicyDrift(
         if (clause) {
             drift.insecure.push({
                 policy: p,
-                reason: `${clause} is \`auth.uid() IS NOT NULL\`, which is true for anonymous ` +
+                reason: `${clause} is \`${RLS_UID_SQL} IS NOT NULL\`, which is true for anonymous ` +
                     `visitors too — this grants access to signed-out requests. It predates the ` +
                     `\`policy.authenticated()\` fix; re-run \`rebase db push\` to tighten it.`
             });