@rebasepro/server-postgres 0.9.1-canary.16c42e9 → 0.9.1-canary.26fe4b2

package/src/cli.ts

@@ -176,6 +176,7 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             
             if (databaseUrl) {
                 await applyPolicies(databaseUrl);
+                await reconcilePolicies(databaseUrl, collectionsPath);
                 await ensureRlsUserRole(databaseUrl);
             } else {
                 logger.warn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
@@ -269,6 +270,65 @@ async function applyPolicies(databaseUrl: string): Promise<void> {
     }
 }
 
+/**
+ * Remove the policies an earlier push superseded but never dropped.
+ *
+ * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
+ * generated name contains a hash of its own semantics — so editing a rule
+ * writes a *new* policy and abandons the old one. Postgres ORs PERMISSIVE
+ * policies together, which makes an abandoned grant outrank every tightening
+ * that replaced it, and push reported success the whole time.
+ *
+ * Runs after `applyPolicies` so the current policies are already in place: the
+ * drift check then sees exactly the set that should survive, and anything else
+ * on a managed table is by definition left over.
+ */
+async function reconcilePolicies(databaseUrl: string, collectionsPath: string): Promise<void> {
+    try {
+        const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } =
+            await import("./security/policy-drift");
+        const { loadCollections } = await import("./schema/doctor");
+
+        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+        const { Client } = await import("pg");
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            const drift = await checkPolicyDrift(client as never, collections);
+            const { dropped, kept } = await dropOrphanedPolicies(client as never, drift, collections);
+
+            for (const p of dropped) {
+                logger.info(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
+            }
+            if (dropped.length > 0) {
+                logger.info(chalk.green(`  ✓ Removed ${dropped.length} superseded RLS ${dropped.length === 1 ? "policy" : "policies"}.`));
+            }
+
+            // Custom-named orphans are indistinguishable from policies someone
+            // wrote in SQL deliberately, so they are reported, never dropped.
+            if (kept.length > 0) {
+                logger.warn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
+                for (const p of kept) {
+                    logger.warn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
+                }
+                logger.warn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
+            }
+
+            // Missing/diverged are not push's to fix, but staying silent about
+            // them is how a database ends up not matching its config.
+            const remaining = { ...drift, orphaned: kept };
+            if (hasDrift(remaining) && (remaining.missing.length > 0 || remaining.diverged.length > 0)) {
+                logger.warn(chalk.yellow("  ⚠️  RLS policies do not match your collections:"));
+                logger.warn(formatPolicyDrift({ ...remaining, orphaned: [] }));
+            }
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+
 async function branchCommand(rawArgs: string[]): Promise<void> {
     const branchAction = rawArgs[2]; // create, list, delete, info
 

package/src/schema/auth-bootstrap-sql.ts

@@ -24,8 +24,14 @@
 export const AUTH_BOOTSTRAP_SQL = `-- Auth schema + RLS helper functions (required by the policies below)
 CREATE SCHEMA IF NOT EXISTS auth;
 
+-- Falls back to the pre-rename \`app.user_id\` so a database that has taken the
+-- new schema but is still served by an older backend keeps resolving the
+-- principal. Drop the COALESCE once no such deployment remains.
 CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-    SELECT NULLIF(current_setting('app.user_id', true), '');
+    SELECT COALESCE(
+        NULLIF(current_setting('app.uid', true), ''),
+        NULLIF(current_setting('app.user_id', true), '')
+    );
 $$ LANGUAGE sql STABLE;
 
 CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$

package/src/schema/auth-schema.ts

@@ -35,14 +35,14 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const refreshTokens = tableCreator("refresh_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
-        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         userAgent: varchar("user_agent", { length: 500 }),
         ipAddress: varchar("ip_address", { length: 45 }),
         createdAt: timestamp("created_at").defaultNow().notNull()
     }, (table) => ({
-        uniqueDeviceSession: unique("unique_device_session").on(table.userId, table.userAgent, table.ipAddress)
+        uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress)
     }));
 
     /**
@@ -50,7 +50,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const passwordResetTokens = tableCreator("password_reset_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
-        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         usedAt: timestamp("used_at"),
@@ -71,7 +71,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const userIdentities = tableCreator("user_identities", {
         id: uuid("id").defaultRandom().primaryKey(),
-        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         provider: varchar("provider", { length: 50 }).notNull(), // e.g. 'google', 'linkedin'
         providerId: varchar("provider_id", { length: 255 }).notNull(),
         profileData: jsonb("profile_data"),
@@ -86,7 +86,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const mfaFactors = tableCreator("mfa_factors", {
         id: uuid("id").defaultRandom().primaryKey(),
-        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         factorType: varchar("factor_type", { length: 20 }).notNull(), // 'totp'
         secretEncrypted: varchar("secret_encrypted", { length: 500 }).notNull(),
         friendlyName: varchar("friendly_name", { length: 255 }),
@@ -112,7 +112,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const recoveryCodes = tableCreator("recovery_codes", {
         id: uuid("id").defaultRandom().primaryKey(),
-        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         codeHash: varchar("code_hash", { length: 255 }).notNull(),
         usedAt: timestamp("used_at"),
         createdAt: timestamp("created_at").defaultNow().notNull()
@@ -123,7 +123,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const magicLinkTokens = tableCreator("magic_link_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
-        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         usedAt: timestamp("used_at"),
@@ -171,28 +171,28 @@ export const usersRelations = relations(users, ({ many }) => ({
 
 export const refreshTokensRelations = relations(refreshTokens, ({ one }) => ({
     user: one(users, {
-        fields: [refreshTokens.userId],
+        fields: [refreshTokens.uid],
         references: [users.id]
     })
 }));
 
 export const passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({
     user: one(users, {
-        fields: [passwordResetTokens.userId],
+        fields: [passwordResetTokens.uid],
         references: [users.id]
     })
 }));
 
 export const userIdentitiesRelations = relations(userIdentities, ({ one }) => ({
     user: one(users, {
-        fields: [userIdentities.userId],
+        fields: [userIdentities.uid],
         references: [users.id]
     })
 }));
 
 export const mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
     user: one(users, {
-        fields: [mfaFactors.userId],
+        fields: [mfaFactors.uid],
         references: [users.id]
     }),
     challenges: many(mfaChallenges)
@@ -207,14 +207,14 @@ export const mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({
 
 export const recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({
     user: one(users, {
-        fields: [recoveryCodes.userId],
+        fields: [recoveryCodes.uid],
         references: [users.id]
     })
 }));
 
 export const magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({
     user: one(users, {
-        fields: [magicLinkTokens.userId],
+        fields: [magicLinkTokens.uid],
         references: [users.id]
     })
 }));

package/src/schema/doctor.ts

@@ -37,7 +37,7 @@ export type IssueSeverity = "error" | "warning" | "info";
 
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
     table?: string;
     column?: string;
     expected?: string;
@@ -61,19 +61,29 @@ export function getExpectedColumnType(prop: Property): string | null {
             const sp = prop as StringProperty;
             if (sp.enum) return "USER-DEFINED"; // pgEnum → USER-DEFINED in information_schema
             if ("isId" in sp && sp.isId === "uuid") return "uuid";
-            if (sp.columnType === "text") return "text";
+            if (sp.columnType === "uuid") return "uuid";
+            // A markdown/multiline string compiles to `text`, not varchar — the
+            // generator treats those UI hints as column-type signals, so the
+            // expectation here must too or every such column reads as drift.
+            if (sp.columnType === "text" || sp.ui?.markdown || sp.ui?.multiline) return "text";
             if (sp.columnType === "char") return "character";
             return "character varying";
         }
         case "number": {
             const np = prop as NumberProperty;
-            if (np.columnType === "double precision") return "double precision";
-            if (np.columnType === "real") return "real";
-            if (np.columnType === "bigint") return "bigint";
-            if (np.columnType === "serial") return "integer"; // serial is integer under the hood
-            if (np.columnType === "bigserial") return "bigint";
-            if (np.columnType === "integer") return "integer";
-            if (np.columnType === "numeric") return "numeric";
+            if (np.columnType) {
+                // The generator passes any columnType straight through to drizzle,
+                // so mirror that rather than enumerating a subset (which reported
+                // drift for anything unlisted, e.g. smallint). Serial types are
+                // integers with a sequence default; information_schema reports the
+                // underlying width.
+                const serialWidths: Record<string, string> = {
+                    serial: "integer",
+                    bigserial: "bigint",
+                    smallserial: "smallint"
+                };
+                return serialWidths[np.columnType] ?? np.columnType;
+            }
             if (np.validation?.integer || ("isId" in np && np.isId)) return "integer";
             return "numeric";
         }
@@ -201,15 +211,18 @@ export async function checkCollectionsVsSdk(
 ): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
     const issues: DoctorIssue[] = [];
 
-    // Check if SDK file exists
+    // The typed SDK is opt-in — nothing in a scaffolded project imports it until
+    // you choose to. A project that never generated one isn't drifting, so report
+    // it as information rather than a warning; otherwise `doctor` can never come
+    // back clean on a fresh project and users learn to ignore its output.
     if (!fs.existsSync(sdkFilePath)) {
         issues.push({
-            severity: "warning",
-            category: "sdk_stale",
-            message: `Generated SDK typedefs file does not exist at "${sdkFilePath}".`,
-            fix: "Run `rebase generate-sdk`"
+            severity: "info",
+            category: "sdk_not_generated",
+            message: "Typed SDK not generated (optional).",
+            fix: "Run `rebase generate-sdk` if you want typed collection access"
         });
-        return { passed: false,
+        return { passed: true,
 issues };
     }
 
@@ -631,11 +644,15 @@ export function renderReport(report: DoctorReport): void {
 }
 
 function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): void {
-    if (passed) {
+    const errorCount = issues.filter((i) => i.severity === "error").length;
+    const warnCount = issues.filter((i) => i.severity === "warning").length;
+    const infoIssues = issues.filter((i) => i.severity === "info");
+
+    // Informational notes don't make a phase unhealthy, so key the header off
+    // real problems rather than `passed` alone.
+    if (errorCount === 0 && warnCount === 0) {
         logger.info(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
     } else {
-        const errorCount = issues.filter((i) => i.severity === "error").length;
-        const warnCount = issues.filter((i) => i.severity === "warning").length;
         const parts: string[] = [];
         if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
         if (warnCount > 0) parts.push(`${warnCount} warning${warnCount > 1 ? "s" : ""}`);
@@ -643,7 +660,14 @@ function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): voi
     }
     logger.info("");
 
-    for (const issue of issues) {
+    // Notes render as a quiet one-liner, not a full drift box.
+    for (const issue of infoIssues) {
+        const fixPart = issue.fix ? chalk.gray(` — ${issue.fix}`) : "";
+        logger.info(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
+        logger.info("");
+    }
+
+    for (const issue of issues.filter((i) => i.severity !== "info")) {
         const severityIcon = issue.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
         const categoryLabel = formatCategory(issue.category);
         logger.info(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
@@ -674,7 +698,8 @@ function formatCategory(cat: DoctorIssue["category"]): string {
         missing_enum: "Missing Enum",
         enum_value_mismatch: "Enum Value Mismatch",
         missing_foreign_key: "Missing Foreign Key",
-        sdk_stale: "Stale SDK Types"
+        sdk_stale: "Stale SDK Types",
+        sdk_not_generated: "SDK Types Not Generated"
     };
     return labels[cat];
 }

package/src/schema/introspect-db-inference.ts

@@ -1,4 +1,4 @@
-import { humanize } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface InferenceResult {
     propType?: string; // If the inference changes the base type

package/src/schema/introspect-db-logic.ts

@@ -7,6 +7,7 @@
  * and consumed directly by tests.
  */
 import { inferPropertyFromData } from "./introspect-db-inference";
+import { humanize } from "./introspect-db-naming";
 
 // ── Typed interfaces for SQL query results ────────────────────────────
 
@@ -117,16 +118,6 @@ export function singularize(word: string): string {
     return word;
 }
 
-/**
- * Convert a snake_case name to a human-readable Title Case label.
- * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
- */
-export function humanize(snakeName: string): string {
-    return snakeName
-        .replace(/_/g, " ")
-        .replace(/\b\w/g, (c) => c.toUpperCase());
-}
-
 /**
  * Convert a snake_case table name to a camelCase + "Collection" variable name.
  * e.g. "company_token" -> "companyTokenCollection"

package/src/schema/introspect-db-naming.ts

@@ -0,0 +1,15 @@
+/**
+ * Naming helpers shared by the introspection modules. These live apart from
+ * `introspect-db-logic.ts` because the inference pass needs them too, and
+ * importing them from there would close a cycle back through this module.
+ */
+
+/**
+ * Convert a snake_case name to a human-readable Title Case label.
+ * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+ */
+export function humanize(snakeName: string): string {
+    return snakeName
+        .replace(/_/g, " ")
+        .replace(/\b\w/g, (c) => c.toUpperCase());
+}

package/src/schema/introspect-runtime.ts

@@ -23,11 +23,11 @@ import {
     buildTablesMap,
     buildEnumMap,
     identifyJoinTables,
-    humanize,
     singularize,
     mapPgType,
     getIconForTable
 } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface IntrospectedSchema {
     tablesMap: Map<string, TableMeta>;

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type PolicyRef, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, dropOrphanedPolicies, isGeneratedPolicyName, type PolicyRef, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -154,3 +154,108 @@ describe("checkPolicyDrift", () => {
         expect(drift.missing.length).toBeGreaterThan(0);
     });
 });
+
+describe("isGeneratedPolicyName", () => {
+    it("recognises the generator's own shape", () => {
+        expect(isGeneratedPolicyName("documents_insert_a1b2c3d", "documents")).toBe(true);
+        // One rule spanning several operations appends the operation index.
+        expect(isGeneratedPolicyName("documents_update_a1b2c3d_1", "documents")).toBe(true);
+    });
+
+    it("does not claim names a human could have written", () => {
+        expect(isGeneratedPolicyName("owner_access", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_default_admin_read", "documents")).toBe(false);
+        // Right shape, wrong table — belongs to something else.
+        expect(isGeneratedPolicyName("teams_insert_a1b2c3d", "documents")).toBe(false);
+        // A digest is 7 lowercase hex characters, nothing else.
+        expect(isGeneratedPolicyName("documents_insert_notahex", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_grant_a1b2c3d", "documents")).toBe(false);
+    });
+});
+
+describe("dropOrphanedPolicies", () => {
+    /** Records the DDL issued so the test can assert on what was dropped. */
+    function recordingDb(rows: Record<string, unknown>[]) {
+        const executed: string[] = [];
+        const db: Queryable = {
+            query: async (text: string) => {
+                if (!/^SELECT/i.test(text)) executed.push(text);
+                return { rows: rows as never[] };
+            }
+        };
+        return { db, executed };
+    }
+
+    it("drops the policy a rule edit superseded", async () => {
+        // The reported failure: tightening a rule renames its policy, and the
+        // permissive original stays live and keeps ORing itself back in.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const stale = {
+            schemaname: "public", tablename: "documents", policyname: "documents_insert_dead1ee",
+            roles: ["public"], cmd: "INSERT", qual: null, with_check: "true"
+        };
+        const live = [...expected.map((p) => liveRow(p)), stale];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(1);
+        expect(dropped[0].name).toBe("documents_insert_dead1ee");
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([
+            'DROP POLICY IF EXISTS "documents_insert_dead1ee" ON "public"."documents"'
+        ]);
+    });
+
+    it("leaves a hand-written policy alone and reports it instead", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "documents", policyname: "ops_break_glass", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["ops_break_glass"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("never touches a table the collections do not describe", async () => {
+        // Another application sharing the schema owns this table; a
+        // generator-shaped name there is coincidence, not our leftover.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "legacy", policyname: "legacy_select_a1b2c3d", roles: ["public"], cmd: "SELECT", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["legacy_select_a1b2c3d"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("does nothing when the database already matches", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([]);
+    });
+});

package/src/security/policy-drift.ts

@@ -192,6 +192,62 @@ export async function checkPolicyDrift(
     return drift;
 }
 
+/**
+ * Does this name look like one the generator produced for this table?
+ *
+ * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
+ * rule spans several operations), and the hash covers the rule's semantics — so
+ * *editing* a rule renames its policy. The policy under the old name is left
+ * behind by `db push`, which only DROPs the names it is about to CREATE, and
+ * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
+ * granting everything no matter how tight its replacement is.
+ *
+ * Matching the shape is what makes dropping them safe. A hand-written policy
+ * would have to collide with a 7-hex digest to be mistaken for generated one;
+ * a policy named anything else is left alone and merely reported, because a
+ * custom name is indistinguishable from one someone wrote in SQL on purpose.
+ */
+export function isGeneratedPolicyName(name: string, table: string): boolean {
+    return new RegExp(`^${table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\d+)?$`)
+        .test(name);
+}
+
+export interface OrphanCleanup {
+    /** Superseded generated policies that were dropped. */
+    dropped: PolicyRef[];
+    /** Orphans left in place because their names are not generator-shaped. */
+    kept: PolicyRef[];
+}
+
+/**
+ * Drop the policies an earlier push superseded but never removed.
+ *
+ * Only touches tables the collections describe — a table with no expected
+ * policy is not ours to reconcile, and scanning by schema alone would sweep up
+ * policies belonging to something else sharing the database.
+ */
+export async function dropOrphanedPolicies(
+    client: Queryable,
+    drift: PolicyDrift,
+    collections: CollectionConfig[]
+): Promise<OrphanCleanup> {
+    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));
+    const managed = new Set(expected.map((p) => `${p.schema}.${p.table}`));
+
+    const cleanup: OrphanCleanup = { dropped: [], kept: [] };
+    for (const p of drift.orphaned) {
+        if (!managed.has(`${p.schema}.${p.table}`) || !isGeneratedPolicyName(p.name, p.table)) {
+            cleanup.kept.push(p);
+            continue;
+        }
+        // Identifiers are quoted, and the name came from pg_policies rather than
+        // from user input, so it is already a valid identifier.
+        await client.query(`DROP POLICY IF EXISTS "${p.name}" ON "${p.schema}"."${p.table}"`);
+        cleanup.dropped.push(p);
+    }
+    return cleanup;
+}
+
 export const hasDrift = (d: PolicyDrift): boolean =>
     d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;
 

package/src/security/rls-enforcement.ts

@@ -59,7 +59,7 @@ export interface ConnectionPosture {
 }
 
 export interface AuthContext {
-    userId: string;
+    uid: string;
     /** Raw roles as carried on the user (strings or `{ id }` objects). */
     roles: unknown[];
 }
@@ -200,7 +200,7 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
  * SECURITY: this function is only ever called on the **user** path (the server
  * context uses the base/owner driver and never calls it). The default policies
  * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
- * is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
+ * is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
  * be read as NULL and silently escalate a user request to server privileges.
  * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
  * rather than trusting every caller (e.g. realtime subscription auth) to do it.
@@ -208,15 +208,21 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
  * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
  */
 export async function applyAuthContext(tx: SqlTx, auth: AuthContext, userRole?: string): Promise<void> {
-    const userId = typeof auth.userId === "string" && auth.userId.trim() !== "" ? auth.userId : ANONYMOUS_USER_ID;
+    const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
     const normalizedRoles = auth.roles.map((r: unknown) =>
         typeof r === "string" ? r : (r as Record<string, unknown>)?.id ?? String(r)
     );
+    // `app.user_id` is the pre-rename spelling, still written because policies
+    // are data: a database provisioned before the rename holds rules compiled
+    // to `current_setting('app.user_id')`, and those predicates would evaluate
+    // to NULL — failing open or locking out — if we stopped setting it. Drop
+    // the alias only once no live database carries a legacy policy.
     await tx.execute(drizzleSql`
         SELECT
-            set_config('app.user_id', ${userId}, true),
+            set_config('app.uid', ${uid}, true),
+            set_config('app.user_id', ${uid}, true),
             set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
-            set_config('app.jwt', ${JSON.stringify({ sub: userId, roles: auth.roles })}, true)
+            set_config('app.jwt', ${JSON.stringify({ sub: uid, roles: auth.roles })}, true)
     `);
     if (userRole) {
         await tx.execute(drizzleSql.raw(`SET LOCAL ROLE ${quoteIdent(userRole)}`));