@rebasepro/server-postgres 0.9.1-canary.f2f61da → 0.9.1-canary.faee831

package/dist/schema/introspect-db-logic.d.ts

@@ -32,11 +32,6 @@ export interface TableMeta {
     fks: ForeignKeyRow[];
 }
 export declare function singularize(word: string): string;
-/**
- * Convert a snake_case name to a human-readable Title Case label.
- * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
- */
-export declare function humanize(snakeName: string): string;
 /**
  * Convert a snake_case table name to a camelCase + "Collection" variable name.
  * e.g. "company_token" -> "companyTokenCollection"

package/dist/schema/introspect-db-naming.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Naming helpers shared by the introspection modules. These live apart from
+ * `introspect-db-logic.ts` because the inference pass needs them too, and
+ * importing them from there would close a cycle back through this module.
+ */
+/**
+ * Convert a snake_case name to a human-readable Title Case label.
+ * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+ */
+export declare function humanize(snakeName: string): string;

package/dist/security/policy-drift.d.ts

@@ -63,6 +63,36 @@ export declare function parseExpectedPolicies(ddl: string): PolicyRef[];
  * of reads. The same blindness would hide a policy that fails open.
  */
 export declare function checkPolicyDrift(client: Queryable, collections: CollectionConfig[]): Promise<PolicyDrift>;
+/**
+ * Does this name look like one the generator produced for this table?
+ *
+ * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
+ * rule spans several operations), and the hash covers the rule's semantics — so
+ * *editing* a rule renames its policy. The policy under the old name is left
+ * behind by `db push`, which only DROPs the names it is about to CREATE, and
+ * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
+ * granting everything no matter how tight its replacement is.
+ *
+ * Matching the shape is what makes dropping them safe. A hand-written policy
+ * would have to collide with a 7-hex digest to be mistaken for generated one;
+ * a policy named anything else is left alone and merely reported, because a
+ * custom name is indistinguishable from one someone wrote in SQL on purpose.
+ */
+export declare function isGeneratedPolicyName(name: string, table: string): boolean;
+export interface OrphanCleanup {
+    /** Superseded generated policies that were dropped. */
+    dropped: PolicyRef[];
+    /** Orphans left in place because their names are not generator-shaped. */
+    kept: PolicyRef[];
+}
+/**
+ * Drop the policies an earlier push superseded but never removed.
+ *
+ * Only touches tables the collections describe — a table with no expected
+ * policy is not ours to reconcile, and scanning by schema alone would sweep up
+ * policies belonging to something else sharing the database.
+ */
+export declare function dropOrphanedPolicies(client: Queryable, drift: PolicyDrift, collections: CollectionConfig[]): Promise<OrphanCleanup>;
 export declare const hasDrift: (d: PolicyDrift) => boolean;
 /** Human-readable report; empty string when the database matches the config. */
 export declare function formatPolicyDrift(drift: PolicyDrift): string;

package/dist/security/rls-enforcement.d.ts

@@ -51,7 +51,7 @@ export interface ConnectionPosture {
     privileged: boolean;
 }
 export interface AuthContext {
-    userId: string;
+    uid: string;
     /** Raw roles as carried on the user (strings or `{ id }` objects). */
     roles: unknown[];
 }

package/dist/services/channel-history.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Ordered, replayable per-channel message history.
+ *
+ * Broadcast on its own is fire-and-forget to whoever is connected at the
+ * instant it is sent: fine for presence and for "someone saved" notifications,
+ * not enough for op-based collaborative editing, where a client that blinks
+ * out for two seconds has to resync a whole document rather than catch up on
+ * the four operations it missed. This adds the missing half — every retained
+ * broadcast gets a per-channel sequence number, and a client can ask for
+ * everything after the last one it saw.
+ *
+ * Three decisions worth stating, because each rules out a simpler-looking one:
+ *
+ *  - **Retention is server-side and opt-in.** A channel is created by whoever
+ *    names it, so a client-supplied history depth would let any visitor commit
+ *    the backend to unbounded storage. And presence channels — the common case
+ *    — must not pay for this: with no rules configured nothing is written, no
+ *    table is created, and `broadcast` runs exactly the code it ran before.
+ *
+ *  - **Sequence numbers come from the database, not from a counter in this
+ *    process.** They have to survive a restart and be shared across instances;
+ *    an in-memory counter would restart at 1 after a deploy and hand a
+ *    reconnecting client a replay from the wrong era, silently.
+ *
+ *  - **The cursor row outlives the messages it numbered.** Pruning is what
+ *    makes retention affordable, but pruning the cursor along with the messages
+ *    would restart the sequence and make `sinceSeq` mean something different
+ *    before and after — the worst kind of bug, because replay would still
+ *    return rows and they would look plausible. Cursors are tiny and are kept
+ *    forever; see {@link prune}, which touches only `channel_messages`.
+ */
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { ChannelHistoryEntry, ChannelRetentionRule } from "@rebasepro/types";
+/**
+ * Parse a retention TTL into milliseconds.
+ *
+ * Accepts a raw millisecond count or a short duration string (`"30s"`, `"15m"`,
+ * `"24h"`, `"7d"`). Returns undefined for anything unparseable, which the
+ * caller treats as "no TTL" — a misspelt duration must not silently become an
+ * aggressive one.
+ */
+export declare function parseTtlMs(ttl: number | string | undefined): number | undefined;
+/**
+ * Whether `channel` is covered by `rule`.
+ *
+ * Exact match, or a trailing `*` acting as a prefix. Not a general glob: this
+ * decides what reaches disk, and a pattern language whose reach is not obvious
+ * at a glance is the wrong tool for that job.
+ */
+export declare function channelMatchesRule(channel: string, rule: ChannelRetentionRule): boolean;
+/** A rule with its TTL already resolved to milliseconds. */
+export interface ResolvedRetention {
+    limit?: number;
+    ttlMs?: number;
+}
+/**
+ * Persistence and replay for retained channels.
+ *
+ * Inert unless constructed with at least one rule: {@link enabled} is false,
+ * {@link ensureTables} does nothing, and {@link retentionFor} answers undefined
+ * for every channel, so the realtime service never reaches the SQL below.
+ */
+export declare class ChannelHistoryStore {
+    private db;
+    private rules;
+    /** Resolved rule per channel name, so the match runs once per channel. */
+    private resolved;
+    /** Channel → timestamp of its last prune, for {@link PRUNE_THROTTLE_MS}. */
+    private lastPruned;
+    private tablesReady;
+    constructor(db: NodePgDatabase<Record<string, unknown>>, rules?: ChannelRetentionRule[]);
+    /** Whether any channel retains anything at all. */
+    get enabled(): boolean;
+    /**
+     * The retention that applies to `channel`, or undefined when none does.
+     *
+     * First matching rule wins, so callers order them most-specific first.
+     */
+    retentionFor(channel: string): ResolvedRetention | undefined;
+    /**
+     * Create the history tables. Idempotent, and a no-op when no rule is set —
+     * a deployment that never retains anything gets no schema for it.
+     */
+    ensureTables(): Promise<void>;
+    /**
+     * Append a broadcast and return the sequence number it was given.
+     *
+     * The sequence is allocated by the same statement that stores the message,
+     * so a crash between the two is not a possibility. `ON CONFLICT DO UPDATE`
+     * takes a row lock on the channel's cursor, which is what makes concurrent
+     * broadcasts to one channel line up in a single order — and what keeps
+     * different channels from contending with each other at all.
+     */
+    append(channel: string, event: string, payload: unknown, senderId?: string): Promise<{
+        seq: number;
+        at: string;
+    }>;
+    /**
+     * Everything retained for `channel` after `sinceSeq`, oldest first.
+     *
+     * `latestSeq` is reported whether or not the messages were capped, so a
+     * client that is further behind than one page can tell.
+     */
+    replay(channel: string, sinceSeq?: number, limit?: number): Promise<{
+        messages: ChannelHistoryEntry[];
+        latestSeq: number;
+    }>;
+    /**
+     * Enforce a channel's retention bounds.
+     *
+     * Throttled per channel, so a burst of operations prunes once rather than
+     * once per message — the cost then tracks elapsed time instead of write
+     * volume, which is what makes retention affordable on a hot channel.
+     */
+    prune(channel: string, retention: ResolvedRetention): Promise<number>;
+    /** Forget throttle and match caches. Called on shutdown. */
+    clear(): void;
+}

package/dist/services/realtimeService.d.ts

@@ -4,12 +4,13 @@ import { DataDriver, WebSocketMessage } from "@rebasepro/types";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { RealtimeProvider, CollectionSubscriptionConfig, SingleSubscriptionConfig } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
+import type { ChannelRetentionRule } from "@rebasepro/types";
 /**
  * Auth context stored per-subscription so real-time refetches respect RLS.
  * Mirrors the session variables set by PostgresBackendDriver.withAuth().
  */
 export interface SubscriptionAuthContext {
-    userId: string;
+    uid: string;
     roles: string[];
 }
 /**
@@ -24,6 +25,26 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     private clients;
     private channels;
     private presence;
+    /**
+     * Ordered, replayable history for channels that opt into it.
+     *
+     * Undefined until {@link configureChannelHistory} is called, and inert even
+     * then unless retention rules were supplied — so presence and ephemeral
+     * notification channels never touch it. See `channel-history.ts`.
+     */
+    private channelHistory?;
+    /**
+     * One promise chain per retained channel, so that assigning a sequence
+     * number and fanning the message out happen in the same order for every
+     * message on that channel.
+     *
+     * Without it, two concurrent broadcasts can be numbered 4 and 5 by the
+     * database and still reach subscribers as 5 then 4 — live order and replay
+     * order would disagree, which is exactly the divergence sequence numbers
+     * are supposed to rule out. Keyed by channel, so unrelated channels never
+     * wait on each other.
+     */
+    private channelSendQueues;
     private presenceInterval?;
     private static readonly PRESENCE_TIMEOUT_MS;
     private dataService;
@@ -197,8 +218,54 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     joinChannel(clientId: string, channel: string): void;
     /** Leave a broadcast channel */
     leaveChannel(clientId: string, channel: string): void;
-    /** Broadcast a message to all clients in a channel except sender */
+    /**
+     * Broadcast a message to all clients in a channel except the sender.
+     *
+     * On a channel with no retention rule this is what it always was: a
+     * synchronous fan-out to whoever is connected, with no sequence number, no
+     * SQL and no await — the body below runs to completion before returning.
+     *
+     * On a retained channel the message is durably numbered first and only then
+     * delivered, through a per-channel queue so that delivery order matches
+     * sequence order. That ordering is the whole point: a client that catches up
+     * with `sinceSeq` has to arrive at the same state as one that never
+     * disconnected.
+     */
     broadcastToChannel(clientId: string, channel: string, event: string, payload: unknown): void;
+    /**
+     * Number a broadcast, store it, then deliver it.
+     *
+     * A message that cannot be stored is **not** delivered. Delivering it would
+     * put it in front of live subscribers while leaving it absent from every
+     * future replay — the two views of the channel would disagree permanently,
+     * and no later message could repair the gap. Failing loudly to the sender
+     * instead lets it retry, which for an operation stream is the only outcome
+     * that keeps clients convergent.
+     */
+    private persistAndFanOut;
+    /** Deliver a broadcast frame to every member of a channel but the sender. */
+    private fanOutBroadcast;
+    /**
+     * Install retention rules and create the tables they need.
+     *
+     * Safe to call with no rules (and safe not to call at all): the store stays
+     * inert, no schema is created, and broadcast keeps its original
+     * fire-and-forget path.
+     */
+    configureChannelHistory(rules: ChannelRetentionRule[] | undefined): Promise<void>;
+    /** Whether any channel is configured to retain messages. */
+    isChannelHistoryEnabled(): boolean;
+    /**
+     * Answer a client's catch-up request.
+     *
+     * A channel with no retention rule is answered with `retained: false`
+     * rather than an empty list, so the client can tell "you missed nothing"
+     * apart from "this channel never keeps anything" — the second means its
+     * reconnect strategy has to be a full resync, and silence would leave it
+     * guessing.
+     */
+    private handleChannelHistoryRequest;
+    private sendChannelHistory;
     /** Track presence in a channel */
     trackPresence(clientId: string, channel: string, state: Record<string, unknown>): void;
     /** Remove presence from a channel */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.f2f61da",
+  "version": "0.9.1-canary.faee831",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -29,30 +29,6 @@
     "backend",
     "rebase"
   ],
-  "jest": {
-    "transform": {
-      "^.+\\.tsx?$": "ts-jest"
-    },
-    "testRegex": "(/__tests__/.*|(\\.|/)(test|spec))\\.tsx?$",
-    "testPathIgnorePatterns": [
-      "/node_modules/",
-      "test/e2e/"
-    ],
-    "moduleFileExtensions": [
-      "ts",
-      "tsx",
-      "js",
-      "jsx",
-      "json",
-      "node"
-    ],
-    "moduleNameMapper": {
-      "^chalk$": "<rootDir>/test/mocks/chalk.cjs",
-      "^\\.{1,2}/module-dir$": "<rootDir>/test/mocks/module-dir.cjs",
-      "^@rebasepro/([a-z0-9-]+)$": "<rootDir>/../$1/src/index.ts",
-      "^(\\.{1,2}/.*)\\.js$": "$1"
-    }
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -71,14 +47,15 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.9.1-canary.f2f61da",
-    "@rebasepro/server": "0.9.1-canary.f2f61da",
-    "@rebasepro/types": "0.9.1-canary.f2f61da",
-    "@rebasepro/common": "0.9.1-canary.f2f61da",
-    "@rebasepro/utils": "0.9.1-canary.f2f61da"
+    "@rebasepro/codegen": "0.9.1-canary.faee831",
+    "@rebasepro/server": "0.9.1-canary.faee831",
+    "@rebasepro/types": "0.9.1-canary.faee831",
+    "@rebasepro/common": "0.9.1-canary.faee831",
+    "@rebasepro/utils": "0.9.1-canary.faee831"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",
+    "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.20.0",
@@ -103,7 +80,7 @@
     "watch": "vite build --watch",
     "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
     "test:lint": "eslint \"src/**\" --quiet",
-    "test": "jest --passWithNoTests",
+    "test": "jest",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f",
     "smoke:baas": "tsx scripts/smoke-baas.ts"

package/src/PostgresBackendDriver.ts

@@ -111,6 +111,7 @@ export class PostgresBackendDriver implements DataDriver {
             executeSql: (...args: Parameters<NonNullable<DatabaseAdmin["executeSql"]>>) => this.executeSql(...args),
             fetchAvailableDatabases: () => this.fetchAvailableDatabases(),
             fetchAvailableRoles: () => this.fetchAvailableRoles(),
+            fetchApplicationRoles: () => this.fetchApplicationRoles(),
             fetchCurrentDatabase: () => this.fetchCurrentDatabase(),
             fetchUnmappedTables: (...args: Parameters<NonNullable<DatabaseAdmin["fetchUnmappedTables"]>>) => this.fetchUnmappedTables(...args),
             fetchTableMetadata: (...args: Parameters<NonNullable<DatabaseAdmin["fetchTableMetadata"]>>) => this.fetchTableMetadata(...args),
@@ -1171,6 +1172,56 @@ export class PostgresBackendDriver implements DataDriver {
         return result.map((r: Record<string, unknown>) => r.rolname as string);
     }
 
+    /**
+     * Application-level roles actually in use in this project.
+     *
+     * Distinct from {@link fetchAvailableRoles}, which returns native
+     * PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
+     * are the roles the SQL editor can `SET ROLE` to. *These* are the strings
+     * held in the users table's `roles` column, injected per-transaction as
+     * `auth.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
+     * into a `SecurityRule.roles` field produces a condition no user can ever
+     * satisfy, so the two must not be conflated.
+     *
+     * Roles have no registry table — they were migrated out of
+     * `rebase.user_roles` onto an inline `roles TEXT[]` column — so the live
+     * set is derived from what is assigned. A role that is declared in a policy
+     * but held by nobody yet cannot be discovered here; callers that need it
+     * should union in the roles they already know about.
+     */
+    async fetchApplicationRoles(): Promise<string[]> {
+        // The users table lives in `rebase` for a default (public) setup, but
+        // follows the configured schema otherwise — locate it rather than
+        // assuming. The `roles` ARRAY column is what makes it the auth table.
+        const located = await this.executeSql(`
+            SELECT table_schema, table_name
+            FROM information_schema.columns
+            WHERE column_name = 'roles'
+              AND data_type = 'ARRAY'
+              AND table_name = 'users'
+              AND table_schema NOT IN ('information_schema', 'pg_catalog')
+            ORDER BY (table_schema = 'rebase') DESC, table_schema
+            LIMIT 1;
+        `);
+        if (located.length === 0) return [];
+
+        const schema = located[0].table_schema as string;
+        const table = located[0].table_name as string;
+        // Identifiers come from information_schema, not user input, but they
+        // are still interpolated — quote them so odd-but-legal names survive.
+        const qualified = `"${schema.replace(/"/g, "\"\"")}"."${table.replace(/"/g, "\"\"")}"`;
+
+        const rows = await this.executeSql(`
+            SELECT DISTINCT unnest(roles) AS role
+            FROM ${qualified}
+            WHERE roles IS NOT NULL
+            ORDER BY role;
+        `);
+        return rows
+            .map((r) => r.role as string)
+            .filter((r): r is string => typeof r === "string" && r.length > 0);
+    }
+
     async fetchCurrentDatabase(): Promise<string | undefined> {
         return this.poolManager?.defaultDatabaseName;
     }
@@ -1374,10 +1425,10 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
         const pendingNotifications: PostgresBackendDriver["_pendingNotifications"] = [];
 
         const result = await this.delegate.db.transaction(async (tx) => {
-            let userId = this.user?.uid;
-            if (!userId) {
+            let uid = this.user?.uid;
+            if (!uid) {
                 logger.warn("[DataDriver] User ID (uid) is missing for authenticated delegate. Using 'anonymous'. User object", { detail: this.user });
-                userId = "anonymous";
+                uid = "anonymous";
             }
 
             const userRoles = this.user?.roles ?? [];
@@ -1396,7 +1447,7 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
             //
             // Fails closed: if the switch cannot be performed, the transaction
             // aborts rather than falling back to an RLS-bypassing connection.
-            await applyAuthContext(tx, { userId, roles: userRoles }, this.delegate.rlsUserRole);
+            await applyAuthContext(tx, { uid, roles: userRoles }, this.delegate.rlsUserRole);
 
             const txEntityService = new DataService(tx, this.delegate.registry);
             const txDelegate = new PostgresBackendDriver(tx, this.delegate.realtimeService, this.delegate.registry, this.user, this.delegate.poolManager, this.delegate.historyService);
@@ -1435,7 +1486,7 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
      */
     private injectAuthContext(unsubscribe: () => void): () => void {
         const authContext = {
-            userId: this.user?.uid || "anonymous",
+            uid: this.user?.uid || "anonymous",
             roles: this.user?.roles ?? []
         };
         const entries = Array.from(this.delegate.realtimeService.subscriptions.entries());

package/src/PostgresBootstrapper.ts

@@ -17,7 +17,8 @@ import {
     CollectionConfig,
     type HistoryConfig,
     InitializedDriver,
-    RealtimeProvider
+    RealtimeProvider,
+    type RealtimeChannelsConfig
 } from "@rebasepro/types";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import { RealtimeService } from "./services/realtimeService";
@@ -52,6 +53,12 @@ export interface PostgresDriverConfig {
      * (BaaS mode). Defaults to `public`.
      */
     introspectionSchema?: string;
+    /**
+     * Realtime options. Currently only channel retention, which is opt-in:
+     * without rules here no channel keeps any history and broadcast stays
+     * fire-and-forget. See {@link ChannelRetentionRule}.
+     */
+    realtime?: RealtimeChannelsConfig;
 }
 
 /**
@@ -316,6 +323,16 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                 }
             }
 
+            // ── Channel history ──────────────────────────────────────────────
+            // Opt-in per channel pattern. With no rules this creates no tables
+            // and leaves broadcast on its original fire-and-forget path, so
+            // presence-only apps pay nothing for it.
+            try {
+                await realtimeService.configureChannelHistory(pgConfig.realtime?.channels);
+            } catch (err) {
+                logger.warn("⚠️ Could not initialize channel history tables — retained channels will not replay", { error: err });
+            }
+
             // ── Realtime change source ───────────────────────────────────────
             // Prefer DATABASE_DIRECT_URL to bypass PgBouncer for LISTEN/NOTIFY.
             const directUrl = process.env.DATABASE_DIRECT_URL || pgConfig.connectionString;

package/src/cli.ts

@@ -176,6 +176,7 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             
             if (databaseUrl) {
                 await applyPolicies(databaseUrl);
+                await reconcilePolicies(databaseUrl, collectionsPath);
                 await ensureRlsUserRole(databaseUrl);
             } else {
                 logger.warn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
@@ -269,6 +270,65 @@ async function applyPolicies(databaseUrl: string): Promise<void> {
     }
 }
 
+/**
+ * Remove the policies an earlier push superseded but never dropped.
+ *
+ * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
+ * generated name contains a hash of its own semantics — so editing a rule
+ * writes a *new* policy and abandons the old one. Postgres ORs PERMISSIVE
+ * policies together, which makes an abandoned grant outrank every tightening
+ * that replaced it, and push reported success the whole time.
+ *
+ * Runs after `applyPolicies` so the current policies are already in place: the
+ * drift check then sees exactly the set that should survive, and anything else
+ * on a managed table is by definition left over.
+ */
+async function reconcilePolicies(databaseUrl: string, collectionsPath: string): Promise<void> {
+    try {
+        const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } =
+            await import("./security/policy-drift");
+        const { loadCollections } = await import("./schema/doctor");
+
+        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+        const { Client } = await import("pg");
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            const drift = await checkPolicyDrift(client as never, collections);
+            const { dropped, kept } = await dropOrphanedPolicies(client as never, drift, collections);
+
+            for (const p of dropped) {
+                logger.info(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
+            }
+            if (dropped.length > 0) {
+                logger.info(chalk.green(`  ✓ Removed ${dropped.length} superseded RLS ${dropped.length === 1 ? "policy" : "policies"}.`));
+            }
+
+            // Custom-named orphans are indistinguishable from policies someone
+            // wrote in SQL deliberately, so they are reported, never dropped.
+            if (kept.length > 0) {
+                logger.warn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
+                for (const p of kept) {
+                    logger.warn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
+                }
+                logger.warn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
+            }
+
+            // Missing/diverged are not push's to fix, but staying silent about
+            // them is how a database ends up not matching its config.
+            const remaining = { ...drift, orphaned: kept };
+            if (hasDrift(remaining) && (remaining.missing.length > 0 || remaining.diverged.length > 0)) {
+                logger.warn(chalk.yellow("  ⚠️  RLS policies do not match your collections:"));
+                logger.warn(formatPolicyDrift({ ...remaining, orphaned: [] }));
+            }
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+
 async function branchCommand(rawArgs: string[]): Promise<void> {
     const branchAction = rawArgs[2]; // create, list, delete, info
 

package/src/schema/introspect-db-inference.ts

@@ -1,4 +1,4 @@
-import { humanize } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface InferenceResult {
     propType?: string; // If the inference changes the base type

package/src/schema/introspect-db-logic.ts

@@ -7,6 +7,7 @@
  * and consumed directly by tests.
  */
 import { inferPropertyFromData } from "./introspect-db-inference";
+import { humanize } from "./introspect-db-naming";
 
 // ── Typed interfaces for SQL query results ────────────────────────────
 
@@ -117,16 +118,6 @@ export function singularize(word: string): string {
     return word;
 }
 
-/**
- * Convert a snake_case name to a human-readable Title Case label.
- * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
- */
-export function humanize(snakeName: string): string {
-    return snakeName
-        .replace(/_/g, " ")
-        .replace(/\b\w/g, (c) => c.toUpperCase());
-}
-
 /**
  * Convert a snake_case table name to a camelCase + "Collection" variable name.
  * e.g. "company_token" -> "companyTokenCollection"

package/src/schema/introspect-db-naming.ts

@@ -0,0 +1,15 @@
+/**
+ * Naming helpers shared by the introspection modules. These live apart from
+ * `introspect-db-logic.ts` because the inference pass needs them too, and
+ * importing them from there would close a cycle back through this module.
+ */
+
+/**
+ * Convert a snake_case name to a human-readable Title Case label.
+ * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+ */
+export function humanize(snakeName: string): string {
+    return snakeName
+        .replace(/_/g, " ")
+        .replace(/\b\w/g, (c) => c.toUpperCase());
+}

package/src/schema/introspect-runtime.ts

@@ -23,11 +23,11 @@ import {
     buildTablesMap,
     buildEnumMap,
     identifyJoinTables,
-    humanize,
     singularize,
     mapPgType,
     getIconForTable
 } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface IntrospectedSchema {
     tablesMap: Map<string, TableMeta>;