@rebasepro/server-postgres 0.9.1-canary.a57c262 → 0.9.1-canary.a639738

package/dist/schema/doctor.d.ts

@@ -2,7 +2,7 @@ import { CollectionConfig, Property } from "@rebasepro/types";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
     table?: string;
     column?: string;
     expected?: string;

package/dist/security/policy-drift.d.ts

@@ -63,6 +63,36 @@ export declare function parseExpectedPolicies(ddl: string): PolicyRef[];
  * of reads. The same blindness would hide a policy that fails open.
  */
 export declare function checkPolicyDrift(client: Queryable, collections: CollectionConfig[]): Promise<PolicyDrift>;
+/**
+ * Does this name look like one the generator produced for this table?
+ *
+ * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
+ * rule spans several operations), and the hash covers the rule's semantics — so
+ * *editing* a rule renames its policy. The policy under the old name is left
+ * behind by `db push`, which only DROPs the names it is about to CREATE, and
+ * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
+ * granting everything no matter how tight its replacement is.
+ *
+ * Matching the shape is what makes dropping them safe. A hand-written policy
+ * would have to collide with a 7-hex digest to be mistaken for generated one;
+ * a policy named anything else is left alone and merely reported, because a
+ * custom name is indistinguishable from one someone wrote in SQL on purpose.
+ */
+export declare function isGeneratedPolicyName(name: string, table: string): boolean;
+export interface OrphanCleanup {
+    /** Superseded generated policies that were dropped. */
+    dropped: PolicyRef[];
+    /** Orphans left in place because their names are not generator-shaped. */
+    kept: PolicyRef[];
+}
+/**
+ * Drop the policies an earlier push superseded but never removed.
+ *
+ * Only touches tables the collections describe — a table with no expected
+ * policy is not ours to reconcile, and scanning by schema alone would sweep up
+ * policies belonging to something else sharing the database.
+ */
+export declare function dropOrphanedPolicies(client: Queryable, drift: PolicyDrift, collections: CollectionConfig[]): Promise<OrphanCleanup>;
 export declare const hasDrift: (d: PolicyDrift) => boolean;
 /** Human-readable report; empty string when the database matches the config. */
 export declare function formatPolicyDrift(drift: PolicyDrift): string;

package/dist/services/row-pipeline.d.ts

@@ -50,8 +50,11 @@ export declare function toCmsRow(row: Record<string, unknown>, collection: Colle
  * The row REST serves: every column under its own name, with the value Postgres
  * returned, and relations inlined as the target's columns.
  *
- * Deliberately not normalized: REST serves what the database holds, and JSON
- * has its own opinions about dates that the admin's view-model does not share.
+ * Values are the ones the database returned, except where that contradicts the
+ * declared type: a `number` property is served as a number (see
+ * {@link coerceDeclaredNumber}). Dates stay as the database returned them —
+ * JSON has its own opinions about dates that the admin's view-model does not
+ * share.
  *
  * Keyed by the row rather than by the relation list — a REST fetch only loads
  * the relations `include` asked for, so the row is the authority on which are

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.a57c262",
+  "version": "0.9.1-canary.a639738",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -71,14 +71,15 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.9.1-canary.a57c262",
-    "@rebasepro/common": "0.9.1-canary.a57c262",
-    "@rebasepro/utils": "0.9.1-canary.a57c262",
-    "@rebasepro/server": "0.9.1-canary.a57c262",
-    "@rebasepro/types": "0.9.1-canary.a57c262"
+    "@rebasepro/codegen": "0.9.1-canary.a639738",
+    "@rebasepro/common": "0.9.1-canary.a639738",
+    "@rebasepro/types": "0.9.1-canary.a639738",
+    "@rebasepro/utils": "0.9.1-canary.a639738",
+    "@rebasepro/server": "0.9.1-canary.a639738"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",
+    "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.20.0",

package/src/PostgresBackendDriver.ts

@@ -548,13 +548,26 @@ export class PostgresBackendDriver implements DataDriver {
         let updatedValues = values;
         const contextForCallback = this.buildCallContext();
 
-        // Fetch previous values for callbacks AND history recording
+        // Fetch previous values for callbacks AND history recording. Same walk
+        // as the saved row the callbacks receive (`fetchOneForRest`), so
+        // `values` and `previousValues` compare like with like — a Date on one
+        // side and its ISO string on the other reads as a change that never
+        // happened.
         let previousValuesForHistory: Partial<M> | undefined;
         if (status === "existing" && id) {
-            const existing = await this.dataService.fetchOne<M>(path, id, resolvedCollection?.databaseId);
-            if (existing) {
-                const { id: _existingId, ...existingValues } = existing;
-                previousValuesForHistory = existingValues as Partial<M>;
+            try {
+                const existing = await this.dataService.getFetchService()
+                    .fetchOneForRest(path, id, undefined, resolvedCollection?.databaseId);
+                if (existing) {
+                    const { id: _existingId, ...existingValues } = existing;
+                    previousValuesForHistory = existingValues as Partial<M>;
+                }
+            } catch (err) {
+                // Best-effort enrichment: callbacks and history run without
+                // previous values rather than the save failing on a read the
+                // write itself does not need (e.g. a collection whose key the
+                // registry cannot resolve).
+                logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
             }
         }
 

package/src/PostgresBootstrapper.ts

@@ -65,6 +65,15 @@ export interface PostgresDriverInternals {
     realtimeService: RealtimeService;
     driver: PostgresBackendDriver;
     poolManager?: DatabasePoolManager;
+    /**
+     * Attach CDC triggers to tables that did not exist when the driver
+     * bootstrapped. Only set when database-level capture is actually active.
+     *
+     * Auth owns its own tables and creates them later in boot, so at driver
+     * bootstrap they are legitimately missing and get skipped; without this
+     * they would stay uninstrumented until the next restart.
+     */
+    provisionCdcForTables?: (tables: CdcTableRef[]) => Promise<void>;
 }
 
 // Re-export from shared CLI error utilities
@@ -334,6 +343,7 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             const wantsCdc = cdcMode !== "off";
             const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
             let cdcEnabled = false;
+            let provisionCdcForTables: PostgresDriverInternals["provisionCdcForTables"];
 
             if (wantsCdc && !directUrl) {
                 const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
@@ -367,6 +377,11 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                     await provisionTriggerCdc(cdcRunSql, cdcTables);
                     await realtimeService.enableCdc(directUrl);
                     cdcEnabled = true;
+                    // Boot steps that create their own tables (auth) run after
+                    // this one and use it to instrument what they just created.
+                    provisionCdcForTables = async (tables) => {
+                        await provisionTriggerCdc(cdcRunSql, tables);
+                    };
                     logger.info(
                         `📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). ` +
                         `All writes now emit realtime events regardless of origin.`
@@ -417,6 +432,14 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                     );
                     const missing: Array<{ slug: string; table: string }> = [];
                     for (const col of registeredCollections) {
+                        // Auth owns its table and creates it later in this same
+                        // boot (initializeAuth → ensureAuthTablesExist), so it is
+                        // legitimately absent right now. Reporting it as drift
+                        // tells the user to `db:push` a table that is about to
+                        // exist — and on an introspected database, one that the
+                        // database was never supposed to hold.
+                        if ((col as { auth?: { enabled?: boolean } }).auth?.enabled) continue;
+
                         const schemaName = "schema" in col && col.schema ? col.schema : "public";
                         const tableName = registry.hasTableForCollection(
                             col.table ?? col.slug
@@ -431,8 +454,10 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                         const checkName = resolvedTable ?? tableName;
                         const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
                         if (!dbTables.has(fullCheckName)) {
+                            // Report what was actually looked up: an unqualified
+                            // "users" sends people hunting for public.users.
                             missing.push({ slug: col.slug,
-table: checkName });
+table: fullCheckName });
                         }
                     }
                     if (missing.length > 0) {
@@ -466,7 +491,8 @@ table: checkName });
                 registry,
                 realtimeService,
                 driver,
-                poolManager
+                poolManager,
+                provisionCdcForTables
             };
 
             return {
@@ -495,6 +521,29 @@ table: checkName });
             // ensureAuthTablesExist works with the collection abstraction — no Drizzle leakage.
             await ensureAuthTablesExist(db, authCollection);
 
+            // The driver bootstrapped before these tables existed, so CDC skipped
+            // them. Instrument them now, or writes to the user table emit no
+            // realtime events until the next restart.
+            if (authCollection && internals.provisionCdcForTables) {
+                const authSchema = "schema" in authCollection && typeof authCollection.schema === "string"
+                    ? authCollection.schema
+                    : "rebase";
+                const authTable = "table" in authCollection && typeof authCollection.table === "string"
+                    ? authCollection.table
+                    : authCollection.slug;
+                if (authTable) {
+                    try {
+                        await internals.provisionCdcForTables([{ schema: authSchema, table: authTable }]);
+                    } catch (err) {
+                        logger.warn(
+                            `⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — ` +
+                            "writes to it won't emit database-level events.",
+                            { detail: err instanceof Error ? err.message : String(err) }
+                        );
+                    }
+                }
+            }
+
             let emailService: EmailService | undefined;
             if (authConfig.email) {
                 emailService = createEmailService(authConfig.email as EmailConfig);

package/src/auth/ensure-tables.ts

@@ -251,17 +251,32 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Seed default roles if none exist
         // (no-op: roles are now stored inline on the users table)
 
-        // ── Migration: Add is_anonymous column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-
-        // ── Migration: Add inline roles column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+        // ── Migration: reconcile the full users column set (safe for existing tables) ──
+        // CREATE TABLE IF NOT EXISTS never revisits an existing table, so a
+        // database provisioned by an older framework era is missing every
+        // column added since. Each column the auth services read or write must
+        // be back-filled here, or upgraded deployments break on the first
+        // statement that references it. `email` is deliberately absent: it has
+        // existed since the first era and cannot be added NOT NULL safely.
+        const userColumnBackfills = [
+            "display_name VARCHAR(255)",
+            "photo_url VARCHAR(500)",
+            "roles TEXT[] DEFAULT '{}' NOT NULL",
+            "password_hash VARCHAR(255)",
+            "email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+            "email_verification_token VARCHAR(255)",
+            "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+            "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+            "metadata JSONB DEFAULT '{}' NOT NULL",
+            "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+            "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+        ];
+        for (const columnDef of userColumnBackfills) {
+            await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
+        }
 
         // ── Migration: Copy roles from legacy junction table to inline column ──
         // If the old rebase.user_roles and rebase.roles tables exist, migrate
@@ -358,6 +373,53 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
 
+        // ── Migration: clear stale FORCE ROW LEVEL SECURITY (older RLS model) ──
+        // The current model never emits FORCE: privileged auth writes run as
+        // the table owner and rely on the owner bypassing plain ENABLE RLS
+        // (see generate-postgres-ddl-logic). A table still carrying FORCE from
+        // an older framework era binds the owner too, so the first user
+        // registration after an upgrade fails with SQLSTATE 42501. Reconcile
+        // on boot; only tables actually flagged get the ALTER (and its lock).
+        try {
+            const authTablePairs: [string, string][] = [
+                [usersSchema, resolvedTable],
+                [authSchema, "user_identities"],
+                [authSchema, "refresh_tokens"],
+                [authSchema, "password_reset_tokens"],
+                [authSchema, "app_config"],
+                [authSchema, "mfa_factors"],
+                [authSchema, "mfa_challenges"],
+                [authSchema, "recovery_codes"]
+            ];
+            for (const [schemaName, tableName] of authTablePairs) {
+                const forced = await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `);
+                if (forced.rows.length > 0) {
+                    await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+                    logger.warn(
+                        `🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" ` +
+                        "(legacy RLS model — it binds the owner connection and breaks privileged auth writes)"
+                    );
+                }
+            }
+        } catch (rlsReconcileError: unknown) {
+            // Non-fatal: the connection may lack ownership on a pre-provisioned
+            // table; registration will still fail loudly (42501) if FORCE remains.
+            logger.warn(
+                `⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ` +
+                `${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`
+            );
+        }
+
         logger.info("✅ Auth tables ready");
     } catch (error) {
         logger.error("❌ Failed to create auth tables", { error });

package/src/auth/services.ts

@@ -82,6 +82,32 @@ export class UserService implements UserRepository {
         return `"${schema}"."${name}"`;
     }
 
+    /**
+     * Run a privileged auth write with an explicitly cleared RLS context.
+     *
+     * The auth services run on the base/owner connection, which by design
+     * carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+     * in the default policies applies. That NULL is normally guaranteed by
+     * `set_config(..., is_local = true)` resetting at transaction end — but a
+     * GUC that survives on a pooled connection (or a connection role that
+     * doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+     * turns the trusted write into an RLS-scoped one and denies it with
+     * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+     * single chokepoint, makes the server context deterministic instead of
+     * trusting whatever state the pool hands us. `auth.uid()` reads '' as
+     * NULL via NULLIF, so '' is the server context.
+     */
+    private async withServerContext<T>(fn: (db: NodePgDatabase) => Promise<T>): Promise<T> {
+        return await this.db.transaction(async (tx) => {
+            await tx.execute(sql`
+                SELECT set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+            return await fn(tx as unknown as NodePgDatabase);
+        });
+    }
+
     private mapRowToUser(row: Record<string, unknown>): UserData {
         if (!row) return row as UserData;
 
@@ -200,7 +226,9 @@ export class UserService implements UserRepository {
 
     async createUser(data: CreateUserData): Promise<UserData> {
         const payload = this.mapPayload(data);
-        const [row] = (await this.db.insert(this.usersTable).values(payload).returning()) as Record<string, unknown>[];
+        const [row] = await this.withServerContext(async (db) =>
+            (await db.insert(this.usersTable).values(payload).returning()) as Record<string, unknown>[]
+        );
         return this.mapRowToUser(row);
     }
 
@@ -255,12 +283,12 @@ export class UserService implements UserRepository {
     }
 
     async linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void> {
-        await this.db.insert(this.userIdentitiesTable).values({
+        await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
             userId,
             provider,
             providerId,
             profileData: profileData || null
-        }).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+        }).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
     }
 
     async updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null> {
@@ -270,18 +298,20 @@ export class UserService implements UserRepository {
         const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
         payload[updatedAtKey] = new Date();
 
-        const [row] = (await this.db
-            .update(this.usersTable)
-            .set(payload)
-            .where(eq(idCol, id))
-            .returning()) as Record<string, unknown>[];
+        const [row] = await this.withServerContext(async (db) =>
+            (await db
+                .update(this.usersTable)
+                .set(payload)
+                .where(eq(idCol, id))
+                .returning()) as Record<string, unknown>[]
+        );
         return row ? this.mapRowToUser(row) : null;
     }
 
     async deleteUser(id: string): Promise<void> {
         const idCol = getColumn(this.usersTable, "id");
         if (!idCol) return;
-        await this.db.delete(this.usersTable).where(eq(idCol, id));
+        await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
     }
 
     async listUsers(): Promise<UserData[]> {
@@ -357,13 +387,13 @@ export class UserService implements UserRepository {
         const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [passwordHashColKey]: passwordHash,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -376,14 +406,14 @@ export class UserService implements UserRepository {
         const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [emailVerifiedColKey]: verified,
                 [emailVerificationTokenColKey]: null,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -396,14 +426,14 @@ export class UserService implements UserRepository {
         const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [emailVerificationTokenColKey]: token,
                 [emailVerificationSentAtColKey]: token ? new Date() : null,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -463,11 +493,11 @@ export class UserService implements UserRepository {
     async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
         const usersTableName = this.getQualifiedUsersTableName();
         const rolesArray = `{${roleIds.join(",")}}`;
-        await this.db.execute(sql`
+        await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `);
+        `));
     }
 
     /**
@@ -475,11 +505,11 @@ export class UserService implements UserRepository {
      */
     async assignDefaultRole(userId: string, roleId: string): Promise<void> {
         const usersTableName = this.getQualifiedUsersTableName();
-        await this.db.execute(sql`
+        await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+        `));
     }
 
     /**

package/src/cli.ts

@@ -176,6 +176,7 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             
             if (databaseUrl) {
                 await applyPolicies(databaseUrl);
+                await reconcilePolicies(databaseUrl, collectionsPath);
                 await ensureRlsUserRole(databaseUrl);
             } else {
                 logger.warn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
@@ -269,6 +270,65 @@ async function applyPolicies(databaseUrl: string): Promise<void> {
     }
 }
 
+/**
+ * Remove the policies an earlier push superseded but never dropped.
+ *
+ * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
+ * generated name contains a hash of its own semantics — so editing a rule
+ * writes a *new* policy and abandons the old one. Postgres ORs PERMISSIVE
+ * policies together, which makes an abandoned grant outrank every tightening
+ * that replaced it, and push reported success the whole time.
+ *
+ * Runs after `applyPolicies` so the current policies are already in place: the
+ * drift check then sees exactly the set that should survive, and anything else
+ * on a managed table is by definition left over.
+ */
+async function reconcilePolicies(databaseUrl: string, collectionsPath: string): Promise<void> {
+    try {
+        const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } =
+            await import("./security/policy-drift");
+        const { loadCollections } = await import("./schema/doctor");
+
+        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+        const { Client } = await import("pg");
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            const drift = await checkPolicyDrift(client as never, collections);
+            const { dropped, kept } = await dropOrphanedPolicies(client as never, drift, collections);
+
+            for (const p of dropped) {
+                logger.info(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
+            }
+            if (dropped.length > 0) {
+                logger.info(chalk.green(`  ✓ Removed ${dropped.length} superseded RLS ${dropped.length === 1 ? "policy" : "policies"}.`));
+            }
+
+            // Custom-named orphans are indistinguishable from policies someone
+            // wrote in SQL deliberately, so they are reported, never dropped.
+            if (kept.length > 0) {
+                logger.warn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
+                for (const p of kept) {
+                    logger.warn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
+                }
+                logger.warn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
+            }
+
+            // Missing/diverged are not push's to fix, but staying silent about
+            // them is how a database ends up not matching its config.
+            const remaining = { ...drift, orphaned: kept };
+            if (hasDrift(remaining) && (remaining.missing.length > 0 || remaining.diverged.length > 0)) {
+                logger.warn(chalk.yellow("  ⚠️  RLS policies do not match your collections:"));
+                logger.warn(formatPolicyDrift({ ...remaining, orphaned: [] }));
+            }
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+
 async function branchCommand(rawArgs: string[]): Promise<void> {
     const branchAction = rawArgs[2]; // create, list, delete, info
 

package/src/connection.ts

@@ -27,11 +27,68 @@ const DEFAULT_POOL: Required<PostgresPoolConfig> = {
     max: 20,
     idleTimeoutMillis: 30_000,
     connectionTimeoutMillis: 10_000,
-    queryTimeout: 30_000,
+    // The client-side read timeout MUST be comfortably above the server-side
+    // statement_timeout. When the client timer fires first, node-postgres
+    // abandons the in-flight statement but keeps the connection — inside a
+    // transaction that leaves the tx open (and any pending ROLLBACK is
+    // spliced out of the client queue before it ever reaches the wire), so
+    // the pooled connection is returned still in-transaction with its RLS
+    // GUCs set. The server abort (SQLSTATE 57014) is the clean path; the
+    // client timeout is only a backstop for a dead network.
+    queryTimeout: 60_000,
     statementTimeout: 30_000,
     keepAlive: true
 };
 
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+const TX_IDLE = "I";
+
+/**
+ * Destroy pool clients that are released while still inside a transaction.
+ *
+ * pg-pool returns a client to the idle list whenever `release()` is called
+ * without an error — even if the connection is still mid-transaction (status
+ * `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+ * a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+ * (e.g. it was queued behind a statement that hit the client-side
+ * query_timeout), the client goes back dirty. The next checkout then runs
+ * its statements inside the zombie transaction — with the previous request's
+ * `app.*` RLS GUCs still applied, which turns unrelated queries into
+ * RLS-scoped ones (observed in production as registration failing with
+ * SQLSTATE 42501 under a leaked anonymous context).
+ *
+ * pg-pool emits `release` before it consults its private `_expired` set, so
+ * marking the client expired here makes `_release()` destroy it instead of
+ * pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+ * private APIs — feature-detect and fall back to loud logging so an upstream
+ * change degrades to observability, never to silent corruption.
+ */
+export function guardPoolAgainstDirtyRelease(pool: Pool, label: string): void {
+    pool.on("release", (err: Error | undefined, client: unknown) => {
+        if (err) return; // errored clients are already destroyed by pg-pool
+        const txStatus = (client as { _txStatus?: string | null })?._txStatus;
+        if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+
+        // pg-pool keeps expired clients in a WeakSet (a plain object works too
+        // if upstream ever changes it — duck-type on add/has).
+        const expired = (pool as unknown as { _expired?: { add(c: object): unknown; has(c: object): boolean } })._expired;
+        if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+            expired.add(client);
+            logger.error(
+                `[${label}] Client released back to the pool while still in a transaction ` +
+                `(status '${txStatus}') — destroying it so the open transaction and its ` +
+                `session state (RLS GUCs) cannot leak into the next request.`
+            );
+        } else {
+            logger.error(
+                `[${label}] Client released mid-transaction (status '${txStatus}') but the ` +
+                `pool's internal expiry set is unavailable (pg-pool internals changed?). ` +
+                `The connection may leak its open transaction into subsequent requests.`
+            );
+        }
+    });
+}
+
 /**
  * Create a Drizzle-backed Postgres connection with a production-grade
  * connection pool.
@@ -75,6 +132,7 @@ export function createPostgresDatabaseConnection(
             logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
         }
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-pool");
 
     // Create drizzle instance — pass schema when available to enable db.query relational API
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
@@ -118,6 +176,7 @@ export function createDirectDatabaseConnection(
     pool.on("error", (err) => {
         logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 
@@ -157,6 +216,7 @@ export function createReadReplicaConnection(
     pool.on("error", (err) => {
         logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);