@rebasepro/server-postgres 0.9.1-canary.a57c262 → 0.9.1-canary.ad25bc0

package/dist/services/FetchService.d.ts

@@ -40,22 +40,52 @@ export declare class FetchService {
      * the target relation so actual row data is returned.
      */
     private buildWithConfig;
+    /**
+     * Detect if a many-to-many relation uses a junction table in the Drizzle schema.
+     */
+    private isJunctionRelation;
     /**
      * Get the Drizzle relation name on the junction table that points to the actual target row.
      * For example, for posts_tags junction, this returns "tag_id" (the relation pointing to tags).
      */
     private getJunctionTargetRelationName;
+    /**
+     * Convert a db.query result row (with nested relation objects) to a flat row.
+     * Handles:
+     * - Type normalization (dates, numbers, NaN) via normalizeDbValues
+     * - Converting nested relation objects to { id, path, __type: "relation" } for CMS
+     * - Flattening junction-table many-to-many results
+     *
+     * The row's own address is not among them: it is derived by the consumer
+     * from the collection's primary keys.
+     */
+    private drizzleResultToRow;
     /**
      * Post-fetch joinPath relations for a single flat row.
      * joinPath relations cannot be expressed via Drizzle's `with` config,
      * so they must be loaded separately after the primary query.
      */
     private resolveJoinPathRelations;
+    /**
+     * Post-fetch joinPath relations for a batch of flat rows.
+     * Uses batch fetching to avoid N+1 queries for list views.
+     */
+    private resolveJoinPathRelationsBatch;
     /**
      * Resolves joinPath relations for raw REST rows and directly injects them.
      * Uses RelationService to query the database and maps results back to the flattened objects.
      */
     private resolveJoinPathRelationsBatchRest;
+    /**
+     * Convert a db.query result row to a flat REST-style row with populated relations.
+     *
+     * Every column is copied through under its own name, with the value Postgres
+     * returned. This used to open with a synthesized `id` and then skip the key
+     * column, which renamed it (a `sku` primary key was served as `id`, and `sku`
+     * did not appear at all) and restringified it (`42` → `"42"`). Consumers that
+     * need an address derive it from the collection's primary keys.
+     */
+    private drizzleResultToRestRow;
     /**
      * Build db.query-compatible options from standard fetch options.
      * Handles filter, search, orderBy, limit, and cursor-based pagination.
@@ -86,10 +116,8 @@ export declare class FetchService {
     }): Promise<Record<string, unknown>[]>;
     /**
      * Fallback path used when db.query is unavailable.
-     *
-     * The primary path runs the results through `toCmsRow`, which maps
-     * relations from what drizzle already nested — no query per row. This one
-     * has no nesting to read, so it resolves relations itself, in batches.
+     * The primary path uses drizzleResultToRow which handles relation
+     * mapping without N+1 queries.
      *
      * Process raw database results into flat rows with relations.
      */

package/dist/services/RelationService.d.ts

@@ -20,40 +20,6 @@ export declare class RelationService {
     private db;
     private registry;
     constructor(db: DrizzleClient, registry: PostgresCollectionRegistry);
-    /**
-     * One target row, as the {@link RelatedRow} everything here returns.
-     *
-     * Eight sites built this by hand, which is how the address came to be the
-     * target's first key column in all eight — one edit, eight places to miss.
-     *
-     * `resolveNested` is the one thing they did not agree on, and the
-     * disagreement was invisible: the single-parent fetches pass `db` and
-     * `registry` to `parseDataFromServer`, so the target's *own* relations get
-     * resolved too, while the batch paths deliberately do not — a query per
-     * target row is the N+1 the batching exists to avoid. Naming the parameter
-     * makes that a decision rather than a difference between two call sites
-     * nobody was comparing.
-     */
-    private toRelatedRow;
-    /**
-     * A WHERE matching any of `parentIds`, by the whole key.
-     *
-     * A single key is an `IN (…)`. A composite one cannot be: matching
-     * `tenant_id IN (1, 1)` collects every row of tenant 1, so two parents that
-     * share their first column each receive the other's relations. It becomes
-     * an OR of ANDs — one exact address per parent — which Postgres indexes the
-     * same way it would a multi-column key lookup.
-     */
-    private parentKeyCondition;
-    /**
-     * Reject a relation that cannot express a composite-keyed parent.
-     *
-     * `localKey` and `foreignKeyOnTarget` are single column names: one column
-     * cannot reference a two-column key, so such a relation has no correct
-     * reading. Left alone it would silently match on the first key column and
-     * hand a tenant's rows to its neighbour — say so instead.
-     */
-    private assertSingleKeyAddressable;
     /**
      * Fetch rows related to a parent row through a specific relation
      */
@@ -106,6 +72,7 @@ export declare class RelationService {
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }>): Promise<void>;
     /**
      * Handle inverse relations with joinPath

package/dist/services/collection-helpers.d.ts

@@ -24,80 +24,4 @@ export interface DrizzleColumnMeta {
 export declare function getColumnMeta(col: AnyPgColumn): DrizzleColumnMeta;
 export declare function getCollectionByPath(collectionPath: string, registry: PostgresCollectionRegistry): CollectionConfig;
 export declare function getTableForCollection(collection: CollectionConfig, registry: PostgresCollectionRegistry): PgTable<any>;
-/**
- * The key columns a collection's rows are addressed by.
- *
- * Three tiers, in order: properties marked `isId`, the primary keys of the
- * drizzle schema, and finally a column literally named `id`. Only the first is
- * visible to the browser, which is why a key known only to drizzle is reported
- * at boot — see {@link warnOnKeysTheAdminCannotResolve}.
- *
- * Returns `[]` when nothing resolves, rather than throwing. It used to open by
- * resolving the table, which throws when there is none — so the `isId` tier,
- * which needs no table at all, was unreachable for exactly the collections
- * most likely to have no table registered. Every caller that wanted "no keys"
- * to mean "no keys" had to spell that out in a try/catch.
- *
- * Callers that cannot proceed without a key must say so themselves, naming the
- * collection: an empty array here means "this collection has no address", which
- * is a different answer in a notification (broadcast a wildcard) than in a save
- * (fail).
- */
 export declare function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[];
-/**
- * The key columns, for callers that cannot do their job without one.
- *
- * {@link getPrimaryKeys} answers "what keys, if any" and returns `[]` for a
- * collection with no address. Most of this driver, though, is building a WHERE
- * clause and has no meaning without a key — for those, an empty array is not an
- * answer, and indexing `[0]` into it produces `Cannot read properties of
- * undefined` three frames from where the real problem is. This says what is
- * wrong and which collection it is wrong about.
- */
-export declare function requirePrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[];
-/**
- * Collections whose key the *browser* cannot resolve, and what it will do
- * instead.
- *
- * The two sides resolve keys from different evidence. This driver reads, in
- * order: properties marked `isId`, the primary keys of the Drizzle schema, then
- * a column literally named `id`. The admin shares the `CollectionConfig` — it
- * compiles the same collection files into its bundle — but never the Drizzle
- * schema, so the middle tier is invisible to it.
- *
- * Nothing can normalize this at runtime: the server does not serve the admin
- * its collections, so a key resolved here cannot be handed over there. The
- * config files are the only thing both sides read, so the fix is an edit to
- * them, and the most this can do is say exactly which edit.
- *
- * Two shapes, and the second is the dangerous one:
- *
- * - No `isId`, no `id` property → the admin resolves no address, warns in the
- *   console, and rows cannot be opened or linked.
- * - No `isId`, but an `id` property that is *not* the key → the admin addresses
- *   rows by `id` while this driver reads the address as the real key. Nothing
- *   errors: the addresses look right and route wrong.
- */
-export declare function findUnresolvableKeyCollections(collections: CollectionConfig[], registry: PostgresCollectionRegistry): {
-    collection: CollectionConfig;
-    keys: PrimaryKeyInfo[];
-    shadowedByIdProperty: boolean;
-}[];
-/**
- * Report the collections from {@link findUnresolvableKeyCollections} at boot,
- * with the edit that fixes each one.
- *
- * Grouped by failure, not by collection: the shadowed case is a routing bug and
- * the silent case is a missing feature, and they deserve different urgency.
- */
-export declare function warnOnKeysTheAdminCannotResolve(collections: CollectionConfig[], registry: PostgresCollectionRegistry): void;
-/**
- * The address of a row: derived from the collection's primary keys, because a
- * row does not carry one — it is exactly its columns.
- *
- * Falls back to a literal `id` column, for a row that reached us from somewhere
- * other than this driver. Returns `""` when there is no key and no `id` —
- * callers decide what that means, since "unaddressable" is a different answer
- * in a notification (broadcast a wildcard) than in a save (fail).
- */
-export declare function deriveRowAddress(row: Record<string, unknown>, collection: CollectionConfig, registry: PostgresCollectionRegistry): string;

package/dist/services/index.d.ts

@@ -1,4 +1,4 @@
 export { FetchService } from "./FetchService";
 export { PersistService } from "./PersistService";
 export { RelationService } from "./RelationService";
-export { getCollectionByPath, getTableForCollection, getPrimaryKeys, deriveRowAddress, parseIdValues, buildCompositeId } from "./collection-helpers";
+export { getCollectionByPath, getTableForCollection, getPrimaryKeys, parseIdValues, buildCompositeId } from "./collection-helpers";

package/dist/services/realtimeService.d.ts

@@ -177,15 +177,8 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
     /**
      * Send a lightweight row-level patch to a collection subscriber.
      * The client can merge this into its cached data for instant feedback.
-     *
-     * The key columns ride along: the patch names a row by address, and the
-     * client has to find that row among the ones it cached — which carry
-     * columns and no address. The SDK holds no collection config to derive one
-     * from, so this is the only place the mapping can come from.
      */
     private sendCollectionPatch;
-    /** The key columns of the collection at `path`, if they can be resolved. */
-    private primaryKeysForPath;
     private sendError;
     private sendMessage;
     /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.a57c262",
+  "version": "0.9.1-canary.ad25bc0",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -71,20 +71,18 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.9.1-canary.a57c262",
-    "@rebasepro/common": "0.9.1-canary.a57c262",
-    "@rebasepro/utils": "0.9.1-canary.a57c262",
-    "@rebasepro/server": "0.9.1-canary.a57c262",
-    "@rebasepro/types": "0.9.1-canary.a57c262"
+    "@rebasepro/codegen": "0.9.1-canary.ad25bc0",
+    "@rebasepro/types": "0.9.1-canary.ad25bc0",
+    "@rebasepro/utils": "0.9.1-canary.ad25bc0",
+    "@rebasepro/server": "0.9.1-canary.ad25bc0",
+    "@rebasepro/common": "0.9.1-canary.ad25bc0"
   },
   "devDependencies": {
-    "@hono/node-server": "^2.0.9",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.20.0",
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^6.0.2",
-    "hono": "^4.12.25",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3",
@@ -105,7 +103,6 @@
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "jest --passWithNoTests",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f",
-    "smoke:baas": "tsx scripts/smoke-baas.ts"
+    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
   }
 }

package/src/PostgresBackendDriver.ts

@@ -29,7 +29,6 @@ import {
 import { sql as drizzleSql } from "drizzle-orm";
 import { buildPropertyCallbacks, buildSdkData, resolveCollectionRelations, updateDateAutoValues } from "@rebasepro/common";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
-import { deriveRowAddress } from "./services/collection-helpers";
 import { HistoryService } from "./history/HistoryService";
 import { mergeDeep } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
@@ -653,19 +652,8 @@ export class PostgresBackendDriver implements DataDriver {
                 }
             }
 
-            // The row is exactly its columns, so its address is derived, not read
-            // off it: `savedRow.id` is undefined for every table whose key is not
-            // literally named `id`, and is ordinary data for a table that has such
-            // a column without it being the key.
-            const savedId = deriveRowAddress(
-                savedRow,
-                (resolvedCollection ?? collection) as CollectionConfig,
-                this.registry
-            );
-            // `values` are the row's columns — all of them. For an `id`-keyed table
-            // that includes `id`, which used to be stripped here because it was the
-            // synthesized address rather than the column it now is.
-            const savedValues = savedRow;
+            const savedId = savedRow.id as string | number;
+            const { id: _savedId, ...savedValues } = savedRow;
 
             if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
                 // 1. Global callbacks first
@@ -710,7 +698,7 @@ export class PostgresBackendDriver implements DataDriver {
             if (this.historyService && resolvedCollection?.history) {
                 this.historyService.recordHistory({
                     tableName: path,
-                    id: savedId,
+                    id: savedId.toString(),
                     action: status === "new" ? "create" : "update",
                     values: savedValues as Record<string, unknown>,
                     previousValues: previousValuesForHistory as Record<string, unknown> | undefined,
@@ -722,14 +710,14 @@ export class PostgresBackendDriver implements DataDriver {
             if (this._deferNotifications) {
                 this._pendingNotifications.push({
                     path,
-                    id: savedId,
+                    id: savedId.toString(),
                     row: savedRow,
                     databaseId: resolvedCollection?.databaseId
                 });
             } else {
                 await this.realtimeService.notifyUpdate(
                     path,
-                    savedId,
+                    savedId.toString(),
                     savedRow,
                     resolvedCollection?.databaseId
                 );
@@ -855,10 +843,7 @@ export class PostgresBackendDriver implements DataDriver {
                                                           }: DeleteProps<M>): Promise<void> {
 
         const targetPath = row.path;
-        // The callbacks' `row` is the row: its columns, nothing else. The address
-        // travels beside it as `id`, so merging it in here only ever invented an
-        // `id` field for tables that have no such column.
-        const targetRow: Record<string, unknown> = { ...(row.values ?? {}) };
+        const targetRow: Record<string, unknown> = { id: row.id, ...(row.values ?? {}) };
 
         // Resolve from backend registry to restore callbacks lost during WebSocket serialization
         const {

package/src/PostgresBootstrapper.ts

@@ -4,7 +4,7 @@
  * Implements the `BackendBootstrapper` interface for PostgreSQL.
  */
 
-import { Relations, sql } from "drizzle-orm";
+import { getTableName, isTable, Relations, sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { PgEnum, PgTable } from "drizzle-orm/pg-core";
 import type { RebasePgTable } from "./types";
@@ -21,7 +21,6 @@ import {
 } from "@rebasepro/types";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import { RealtimeService } from "./services/realtimeService";
-import { buildCollectionRegistry } from "./collections/buildRegistry";
 import { DatabasePoolManager } from "./databasePoolManager";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { createEmailService, type EmailConfig, type EmailService, logger } from "@rebasepro/server";
@@ -162,17 +161,30 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             }
 
             const activeCollections = introspectedCollections ?? collections;
+
+            // Create a fresh registry for this driver
+            const registry = new PostgresCollectionRegistry();
+            if (activeCollections) {
+                registry.registerMultiple(activeCollections);
+                logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map(c => c.slug).join(", ")}]`);
+            }
+
             const schemaTables = introspectedTables ?? pgConfig.schema?.tables;
-            const schemaRelations = introspectedRelations ?? (pgConfig.schema?.relations as Record<string, Relations> | undefined);
 
-            // Create a fresh registry for this driver. Registration order is
-            // load-bearing, so it lives in one place — see `buildCollectionRegistry`.
-            const registry = buildCollectionRegistry({
-                collections: activeCollections,
-                tables: schemaTables,
-                enums: pgConfig.schema?.enums as Record<string, PgEnum<[string, ...string[]]>> | undefined,
-                relations: schemaRelations
-            });
+            // Register tables
+            if (schemaTables) {
+                Object.values(schemaTables).forEach((table) => {
+                    if (isTable(table)) {
+                        const tableName = getTableName(table);
+                        registry.registerTable(table as PgTable, tableName);
+                    }
+                });
+            }
+
+            if (pgConfig.schema?.enums) registry.registerEnums(pgConfig.schema.enums as Record<string, PgEnum<[string, ...string[]]>>);
+
+            const schemaRelations = introspectedRelations ?? (pgConfig.schema?.relations as Record<string, Relations> | undefined);
+            if (schemaRelations) registry.registerRelations(schemaRelations);
 
             // Patch Drizzle's PgArray columns to handle NULL values safely.
             // Drizzle's mapFromDriverValue crashes with "value.map is not a function"

package/src/data-transformer.ts

@@ -20,19 +20,12 @@ import { logger } from "@rebasepro/server";
 export interface SerializedEntityData {
     /** Scalar column values ready for INSERT/UPDATE. */
     scalarData: Record<string, unknown>;
-    /**
-     * Inverse relation updates that must be applied to target tables.
-     *
-     * No address here: the row being written does not know its own. These are
-     * applied by `PersistService`, which addresses them with the id it holds —
-     * the one it was given for an update, or the one the INSERT returned — and
-     * that is the authority. This item used to carry a `currentId` derived from
-     * the *input* values, which nothing ever read.
-     */
+    /** Inverse relation updates that must be applied to target tables. */
     inverseRelationUpdates: Array<{
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }>;
     /** JoinPath relation updates that require multi-hop writes. */
     joinPathRelationUpdates: Array<{
@@ -112,6 +105,7 @@ joinPathRelationUpdates: [] };
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }> = [];
     const joinPathRelationUpdates: Array<{
         relationKey: string;
@@ -152,10 +146,12 @@ joinPathRelationUpdates: [] };
                 } else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
                     // Inverse relation: Need to update the target table's FK
                     const serializedValue = serializePropertyToServer(effectiveValue, property);
+                    const pks = getPrimaryKeys(collection, registry!);
                     inverseRelationUpdates.push({
                         relationKey: key,
                         relation,
-                        newValue: serializedValue
+                        newValue: serializedValue,
+                        currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
                     });
                     // Don't add the original relation property to the result
                     continue;
@@ -174,10 +170,12 @@ joinPathRelationUpdates: [] };
                         });
                     } else {
                         // Many inverse joinPath: capture as inverse relation update
+                        const pks = getPrimaryKeys(collection, registry!);
                         inverseRelationUpdates.push({
                             relationKey: key,
                             relation,
-                            newValue: serializedValue
+                            newValue: serializedValue,
+                            currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
                         });
                     }
                     // Don't add the original relation property to the result

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,6 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
 // --- Helper Functions ---
@@ -545,10 +545,6 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -605,22 +601,9 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ([\n";
-            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
-
-            // Junctions are generated tables like any other: locked by default,
-            // with derived policies (reads follow the endpoints, writes follow
-            // the declaring side's update rules). RLS is enabled regardless of
-            // policy stripping — a bare junction must default-deny, not fail open.
-            const junctionSpec = junctionSpecs.get(baseTableName);
-            if (!stripPolicies && junctionSpec) {
-                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
-                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
-                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
-                });
-            }
-            schemaContent += "])).enableRLS();\n\n";
+            schemaContent += "}, (table) => ({\n";
+            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
+            schemaContent += "}));\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
@@ -226,10 +226,6 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -265,11 +261,6 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
-    // Policies are emitted after every CREATE TABLE, like the FK constraints:
-    // a policy may reference other tables (a junction's derived policies always
-    // reference both endpoints; `policy.existsIn` references a join table), and
-    // CREATE POLICY validates those relations at creation time.
-    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -302,25 +293,6 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-
-            if (options.includePolicies) {
-                // Junction tables are generated tables like any other: locked by
-                // default, with derived policies — reads follow the endpoints'
-                // visibility, writes follow the declaring side's update rules.
-                // Without this they were the one kind of generated table with no
-                // RLS at all, readable and writable by every signed-in user.
-                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-                ddl += `\n`;
-
-                const spec = junctionSpecs.get(baseTableName);
-                if (spec) {
-                    const junctionCollection = getJunctionCollectionConfig(spec);
-                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
-                    });
-                }
-            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -442,8 +414,9 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
+                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
                     });
+                    ddl += "\n";
                 }
             }
         }
@@ -454,12 +427,6 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
-    if (policyStatements.length > 0) {
-        ddl += "-- Row Level Security Policies\n";
-        ddl += policyStatements.join("");
-        ddl += "\n";
-    }
-
     return ddl;
 };
 
@@ -506,33 +473,6 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         }
     }
 
-    // Junction tables are generated from `through` relations, not declared as
-    // collections, so the walk above never sees them. They get the same
-    // treatment as any generated table: locked by default, with derived
-    // policies — reads follow the endpoints, writes follow the declaring
-    // side's update rules.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-    for (const spec of junctionSpecs.values()) {
-        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
-        ddl += `\n`;
-
-        const junctionRules = getJunctionSecurityRules(spec);
-        if (junctionRules.length === 0) continue;
-
-        const junctionCollection = getJunctionCollectionConfig(spec);
-        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
-
-        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
-        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
-        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
-        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
-        junctionRules.forEach((rule: SecurityRule) => {
-            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
-        });
-        ddl += "\n";
-    }
-
     return ddl;
 };
 

package/src/schema/introspect-db.ts

@@ -30,7 +30,6 @@ async function main() {
             "--force": Boolean,
             "--schema": String,
             "--data-inference": Boolean,
-            "--no-data-inference": Boolean,
             "-o": "--output",
             "-c": "--collections",
             "-f": "--force"
@@ -167,14 +166,8 @@ async function main() {
         logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
 
         let runDataInference = false;
-        if (args["--no-data-inference"]) {
-            runDataInference = false;
-        } else if (args["--data-inference"] !== undefined) {
+        if (args["--data-inference"] !== undefined) {
             runDataInference = args["--data-inference"];
-        } else if (!process.stdin.isTTY) {
-            // No terminal to answer the question below (scaffolding scripts, CI,
-            // `rebase init --introspect`) — asking would hang forever.
-            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,