@rebasepro/server-postgres 0.9.1-canary.1d2d8b5 → 0.9.1-canary.5809e39

package/src/schema/doctor.ts

@@ -37,7 +37,7 @@ export type IssueSeverity = "error" | "warning" | "info";
 
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
     table?: string;
     column?: string;
     expected?: string;
@@ -61,19 +61,29 @@ export function getExpectedColumnType(prop: Property): string | null {
             const sp = prop as StringProperty;
             if (sp.enum) return "USER-DEFINED"; // pgEnum → USER-DEFINED in information_schema
             if ("isId" in sp && sp.isId === "uuid") return "uuid";
-            if (sp.columnType === "text") return "text";
+            if (sp.columnType === "uuid") return "uuid";
+            // A markdown/multiline string compiles to `text`, not varchar — the
+            // generator treats those UI hints as column-type signals, so the
+            // expectation here must too or every such column reads as drift.
+            if (sp.columnType === "text" || sp.ui?.markdown || sp.ui?.multiline) return "text";
             if (sp.columnType === "char") return "character";
             return "character varying";
         }
         case "number": {
             const np = prop as NumberProperty;
-            if (np.columnType === "double precision") return "double precision";
-            if (np.columnType === "real") return "real";
-            if (np.columnType === "bigint") return "bigint";
-            if (np.columnType === "serial") return "integer"; // serial is integer under the hood
-            if (np.columnType === "bigserial") return "bigint";
-            if (np.columnType === "integer") return "integer";
-            if (np.columnType === "numeric") return "numeric";
+            if (np.columnType) {
+                // The generator passes any columnType straight through to drizzle,
+                // so mirror that rather than enumerating a subset (which reported
+                // drift for anything unlisted, e.g. smallint). Serial types are
+                // integers with a sequence default; information_schema reports the
+                // underlying width.
+                const serialWidths: Record<string, string> = {
+                    serial: "integer",
+                    bigserial: "bigint",
+                    smallserial: "smallint"
+                };
+                return serialWidths[np.columnType] ?? np.columnType;
+            }
             if (np.validation?.integer || ("isId" in np && np.isId)) return "integer";
             return "numeric";
         }
@@ -201,15 +211,18 @@ export async function checkCollectionsVsSdk(
 ): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
     const issues: DoctorIssue[] = [];
 
-    // Check if SDK file exists
+    // The typed SDK is opt-in — nothing in a scaffolded project imports it until
+    // you choose to. A project that never generated one isn't drifting, so report
+    // it as information rather than a warning; otherwise `doctor` can never come
+    // back clean on a fresh project and users learn to ignore its output.
     if (!fs.existsSync(sdkFilePath)) {
         issues.push({
-            severity: "warning",
-            category: "sdk_stale",
-            message: `Generated SDK typedefs file does not exist at "${sdkFilePath}".`,
-            fix: "Run `rebase generate-sdk`"
+            severity: "info",
+            category: "sdk_not_generated",
+            message: "Typed SDK not generated (optional).",
+            fix: "Run `rebase generate-sdk` if you want typed collection access"
         });
-        return { passed: false,
+        return { passed: true,
 issues };
     }
 
@@ -631,11 +644,15 @@ export function renderReport(report: DoctorReport): void {
 }
 
 function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): void {
-    if (passed) {
+    const errorCount = issues.filter((i) => i.severity === "error").length;
+    const warnCount = issues.filter((i) => i.severity === "warning").length;
+    const infoIssues = issues.filter((i) => i.severity === "info");
+
+    // Informational notes don't make a phase unhealthy, so key the header off
+    // real problems rather than `passed` alone.
+    if (errorCount === 0 && warnCount === 0) {
         logger.info(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
     } else {
-        const errorCount = issues.filter((i) => i.severity === "error").length;
-        const warnCount = issues.filter((i) => i.severity === "warning").length;
         const parts: string[] = [];
         if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
         if (warnCount > 0) parts.push(`${warnCount} warning${warnCount > 1 ? "s" : ""}`);
@@ -643,7 +660,14 @@ function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): voi
     }
     logger.info("");
 
-    for (const issue of issues) {
+    // Notes render as a quiet one-liner, not a full drift box.
+    for (const issue of infoIssues) {
+        const fixPart = issue.fix ? chalk.gray(` — ${issue.fix}`) : "";
+        logger.info(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
+        logger.info("");
+    }
+
+    for (const issue of issues.filter((i) => i.severity !== "info")) {
         const severityIcon = issue.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
         const categoryLabel = formatCategory(issue.category);
         logger.info(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
@@ -674,7 +698,8 @@ function formatCategory(cat: DoctorIssue["category"]): string {
         missing_enum: "Missing Enum",
         enum_value_mismatch: "Enum Value Mismatch",
         missing_foreign_key: "Missing Foreign Key",
-        sdk_stale: "Stale SDK Types"
+        sdk_stale: "Stale SDK Types",
+        sdk_not_generated: "SDK Types Not Generated"
     };
     return labels[cat];
 }

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,10 +1,8 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
-import { toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "crypto";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
-import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -315,22 +313,6 @@ const wrapSql = (clause: string): string => `sql\`${clause}\``;
 /**
  * Generates a deterministic hash based on the rule configuration.
  */
-const getPolicyNameHash = (rule: SecurityRule): string => {
-    const data = JSON.stringify({
-        a: rule.access,
-        m: rule.mode,
-        op: rule.operation,
-        ops: rule.operations?.slice().sort(),
-        own: rule.ownerField,
-        rol: rule.roles?.slice().sort(),
-        pg: rule.pgRoles?.slice().sort(),
-        u: rule.using,
-        w: rule.withCheck,
-        c: rule.condition,
-        ch: rule.check
-    });
-    return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 
 /**
  * Generates Drizzle pgPolicy() calls from a declarative SecurityRule definition.
@@ -351,15 +333,11 @@ const generatePolicyCode = (collection: CollectionConfig, rule: SecurityRule, in
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const ruleHash = getPolicyNameHash(rule);
+    const policyNames = getPolicyNamesForRule(rule, tableName);
 
     // Generate one pgPolicy per operation
     return ops.map((op, opIdx) => {
-        const policyName = rule.name
-            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
-            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
-
-        return generateSinglePolicyCode(collection, rule, op, policyName, resolveCollection);
+        return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
     }).join("");
 };
 
@@ -567,6 +545,10 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -623,9 +605,22 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ({\n";
-            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-            schemaContent += "}));\n\n";
+            schemaContent += "}, (table) => ([\n";
+            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+
+            // Junctions are generated tables like any other: locked by default,
+            // with derived policies (reads follow the endpoints, writes follow
+            // the declaring side's update rules). RLS is enabled regardless of
+            // policy stripping — a bare junction must default-deny, not fail open.
+            const junctionSpec = junctionSpecs.get(baseTableName);
+            if (!stripPolicies && junctionSpec) {
+                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
+                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+                });
+            }
+            schemaContent += "])).enableRLS();\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,8 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
-import { toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "crypto";
-import { getEffectiveSecurityRules } from "./auth-default-policies";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
 
@@ -44,22 +42,6 @@ const isIdProperty = (propName: string, prop: Property, collection: CollectionCo
     return !hasExplicitId && propName === "id";
 };
 
-const getPolicyNameHash = (rule: SecurityRule): string => {
-    const data = JSON.stringify({
-        a: rule.access,
-        m: rule.mode,
-        op: rule.operation,
-        ops: rule.operations?.slice().sort(),
-        own: rule.ownerField,
-        rol: rule.roles?.slice().sort(),
-        pg: rule.pgRoles?.slice().sort(),
-        u: rule.using,
-        w: rule.withCheck,
-        c: rule.condition,
-        ch: rule.check
-    });
-    return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
@@ -69,14 +51,10 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const ruleHash = getPolicyNameHash(rule);
+    const policyNames = getPolicyNamesForRule(rule, tableName);
 
     return ops.map((op, opIdx) => {
-        const policyName = rule.name
-            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
-            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
-
-        return generateSinglePolicyDdl(collection, rule, op, policyName, resolveCollection);
+        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
     }).join("");
 };
 
@@ -248,6 +226,10 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -283,6 +265,11 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
+    // Policies are emitted after every CREATE TABLE, like the FK constraints:
+    // a policy may reference other tables (a junction's derived policies always
+    // reference both endpoints; `policy.existsIn` references a join table), and
+    // CREATE POLICY validates those relations at creation time.
+    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -315,6 +302,25 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+
+            if (options.includePolicies) {
+                // Junction tables are generated tables like any other: locked by
+                // default, with derived policies — reads follow the endpoints'
+                // visibility, writes follow the declaring side's update rules.
+                // Without this they were the one kind of generated table with no
+                // RLS at all, readable and writable by every signed-in user.
+                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+                ddl += `\n`;
+
+                const spec = junctionSpecs.get(baseTableName);
+                if (spec) {
+                    const junctionCollection = getJunctionCollectionConfig(spec);
+                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
+                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
+                    });
+                }
+            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -436,9 +442,8 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
+                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
                     });
-                    ddl += "\n";
                 }
             }
         }
@@ -449,6 +454,12 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
+    if (policyStatements.length > 0) {
+        ddl += "-- Row Level Security Policies\n";
+        ddl += policyStatements.join("");
+        ddl += "\n";
+    }
+
     return ddl;
 };
 
@@ -478,13 +489,50 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         const securityRules = getEffectiveSecurityRules(collection);
         if (securityRules.length > 0) {
             const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
+
             securityRules.forEach((rule: SecurityRule) => {
+                // Say which policies the author did not write. They are permissive,
+                // so they OR with the declared rules and widen the final ACL beyond
+                // what `securityRules` reads like — and re-appear after any manual
+                // DROP, because a push asserts the declared state.
+                if (rule.name && injectedNames.has(rule.name)) {
+                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
+                    ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
+                }
                 ddl += generatePolicyDdl(collection, rule, resolveCollection);
             });
             ddl += "\n";
         }
     }
 
+    // Junction tables are generated from `through` relations, not declared as
+    // collections, so the walk above never sees them. They get the same
+    // treatment as any generated table: locked by default, with derived
+    // policies — reads follow the endpoints, writes follow the declaring
+    // side's update rules.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+    for (const spec of junctionSpecs.values()) {
+        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
+        ddl += `\n`;
+
+        const junctionRules = getJunctionSecurityRules(spec);
+        if (junctionRules.length === 0) continue;
+
+        const junctionCollection = getJunctionCollectionConfig(spec);
+        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
+
+        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
+        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
+        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
+        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
+        junctionRules.forEach((rule: SecurityRule) => {
+            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
+        });
+        ddl += "\n";
+    }
+
     return ddl;
 };
 

package/src/schema/introspect-db.ts

@@ -30,6 +30,7 @@ async function main() {
             "--force": Boolean,
             "--schema": String,
             "--data-inference": Boolean,
+            "--no-data-inference": Boolean,
             "-o": "--output",
             "-c": "--collections",
             "-f": "--force"
@@ -166,8 +167,14 @@ async function main() {
         logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
 
         let runDataInference = false;
-        if (args["--data-inference"] !== undefined) {
+        if (args["--no-data-inference"]) {
+            runDataInference = false;
+        } else if (args["--data-inference"] !== undefined) {
             runDataInference = args["--data-inference"];
+        } else if (!process.stdin.isTTY) {
+            // No terminal to answer the question below (scaffolding scripts, CI,
+            // `rebase init --introspect`) — asking would hang forever.
+            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,
@@ -236,7 +243,17 @@ async function main() {
                 const merged = mergeIndexContent(existing, generatedFiles);
                 fs.writeFileSync(indexPath, merged, "utf-8");
             } else {
-                const indexContent = generateIndexContent(generatedFiles);
+                // --force replaces collections derived from the database, but the
+                // directory can also hold hand-written ones with no table in the
+                // introspected schema (the auth users collection lives in
+                // "rebase"). The backend discovers the whole directory, so an
+                // index listing only introspected tables would silently drop them
+                // from the admin UI while the API still served them.
+                const siblings = fs.readdirSync(outDir)
+                    .filter(f => f.endsWith(".ts") && f !== "index.ts")
+                    .map(f => f.replace(/\.ts$/, ""));
+                const allFiles = [...new Set([...generatedFiles, ...siblings])];
+                const indexContent = generateIndexContent(allFiles);
                 fs.writeFileSync(indexPath, indexContent, "utf-8");
             }
             logger.info(chalk.green(`  ✓ ${indexPath}`));

package/src/services/BranchService.ts

@@ -11,10 +11,45 @@ import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
+import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
 
 /** Internal prefix applied to branch database names to avoid collisions. */
 const BRANCH_DB_PREFIX = "rb_";
 
+/** `duplicate_database` — the target database name is already taken. */
+const PG_DUPLICATE_DATABASE = "42P04";
+
+/** `object_in_use` — the database still has connections attached. */
+const PG_OBJECT_IN_USE = "55006";
+
+/**
+ * Describe a failed branch DDL statement in terms a user can act on.
+ *
+ * Drizzle reports failures as `Failed query: <sql> params:` and hides the real
+ * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
+ * the actual problem. Match on the PG error code instead — it survives wrapping
+ * and, unlike the message text, is not locale-dependent.
+ */
+function describeBranchDdlError(err: unknown, fallbackContext: string): Error {
+    const pgError = extractPgError(err);
+
+    if (pgError?.code === PG_DUPLICATE_DATABASE) {
+        return new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
+    }
+    if (pgError?.code === PG_OBJECT_IN_USE) {
+        return new Error(
+            `Cannot complete the operation: the database "${fallbackContext}" has active connections. ` +
+            "Close other clients or connections and try again."
+        );
+    }
+
+    // Unknown failure: surface the real PG message rather than the Drizzle
+    // wrapper, which would otherwise show the raw SQL and no reason at all.
+    const detail = pgError?.message ?? extractCauseMessage(err);
+    if (detail) return new Error(detail);
+    return err instanceof Error ? err : new Error(String(err));
+}
+
 /** Fully-qualified metadata table in the rebase schema. */
 const BRANCHES_TABLE = "rebase.branches";
 
@@ -109,18 +144,15 @@ export class BranchService {
                 sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`)
             );
         } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            if (msg.includes("already exists")) {
-                throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
-            }
-            // If template fails due to active connections, provide a helpful error
-            if (msg.includes("being accessed by other users")) {
+            const pgError = extractPgError(err);
+            if (pgError?.code === PG_OBJECT_IN_USE) {
+                // The template — not the new database — is the one still in use.
                 throw new Error(
                     `Cannot create branch: the source database "${sourceDb}" has active connections. ` +
                     "Close other clients or connections and try again."
                 );
             }
-            throw err;
+            throw describeBranchDdlError(err, dbName);
         }
 
         // Record metadata in the default database
@@ -166,14 +198,14 @@ export class BranchService {
         try {
             await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
         } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            if (msg.includes("being accessed by other users")) {
+            const pgError = extractPgError(err);
+            if (pgError?.code === PG_OBJECT_IN_USE) {
                 throw new Error(
                     `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
-            throw err;
+            throw describeBranchDdlError(err, dbName);
         }
 
         // Remove metadata