@rebasepro/server-postgres 0.9.1-canary.ad25bc0 → 0.9.1-canary.ad870eb

package/dist/schema/auth-default-policies.d.ts

@@ -0,0 +1,10 @@
+import { CollectionConfig, SecurityRule } from "@rebasepro/types";
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules` plus the framework defaults described in
+ * the module doc (baseline server/admin read for all collections; self-read
+ * and the admin write gate for auth collections).
+ *
+ * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+ */
+export declare function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[];

package/dist/services/FetchService.d.ts

@@ -52,12 +52,10 @@ export declare class FetchService {
     /**
      * Convert a db.query result row (with nested relation objects) to a flat row.
      * Handles:
+     * - Placing `id` at the top level as a string
      * - Type normalization (dates, numbers, NaN) via normalizeDbValues
      * - Converting nested relation objects to { id, path, __type: "relation" } for CMS
      * - Flattening junction-table many-to-many results
-     *
-     * The row's own address is not among them: it is derived by the consumer
-     * from the collection's primary keys.
      */
     private drizzleResultToRow;
     /**
@@ -77,13 +75,7 @@ export declare class FetchService {
      */
     private resolveJoinPathRelationsBatchRest;
     /**
-     * Convert a db.query result row to a flat REST-style row with populated relations.
-     *
-     * Every column is copied through under its own name, with the value Postgres
-     * returned. This used to open with a synthesized `id` and then skip the key
-     * column, which renamed it (a `sku` primary key was served as `id`, and `sku`
-     * did not appear at all) and restringified it (`42` → `"42"`). Consumers that
-     * need an address derive it from the collection's primary keys.
+     * Convert a db.query result row to a flat REST-style object with populated relations.
      */
     private drizzleResultToRestRow;
     /**

package/dist/services/PersistService.d.ts

@@ -12,24 +12,6 @@ export declare class PersistService {
     private relationService;
     private fetchService;
     constructor(db: DrizzleClient, registry: PostgresCollectionRegistry);
-    /**
-     * Explain a write that matched no rows.
-     *
-     * Row-level security filters UPDATE and DELETE through the policy's USING
-     * clause instead of raising: a denied write is reported by Postgres exactly
-     * like a successful one that happened to match nothing. Left unchecked, a
-     * caller cannot tell "denied" from "done" — the write returns 200/204 and
-     * the row is untouched.
-     *
-     * Re-reading the target over the *same* RLS-scoped handle separates the two
-     * cases. A visible row means the policy rejected the write (403); an
-     * invisible one means there is nothing there to write for this caller (404,
-     * matching what a GET would say). The re-read is bound by the caller's own
-     * policies, so it discloses nothing a plain read wouldn't.
-     *
-     * Only reached when zero rows matched, so the happy path pays nothing.
-     */
-    private explainZeroRowWrite;
     /**
      * Delete an row by ID
      */
@@ -40,16 +22,8 @@ export declare class PersistService {
     deleteAll(collectionPath: string, _databaseId?: string): Promise<void>;
     /**
      * Save an row (create or update)
-     *
-     * With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
-     * UPDATE against the primary key rather than a plain UPDATE. That is one
-     * statement, so it cannot lose a race the way a read-then-write can, and it
-     * does not care whether the row already exists — which is what a re-runnable
-     * import needs.
      */
-    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string, options?: {
-        upsert?: boolean;
-    }): Promise<Record<string, unknown>>;
+    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string): Promise<Record<string, unknown>>;
     /**
      * Get the RelationService instance for external use
      */

package/dist/services/collection-helpers.d.ts

@@ -1,9 +1,6 @@
 import { PgTable, AnyPgColumn } from "drizzle-orm/pg-core";
 import { CollectionConfig } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
-export { buildCompositeId, parseIdValues, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
-export type { PrimaryKeyInfo } from "@rebasepro/common";
-import type { PrimaryKeyInfo } from "@rebasepro/common";
 /**
  * Shared helper functions for row operations.
  * These are used by FetchService, PersistService, and RelationService.
@@ -24,4 +21,18 @@ export interface DrizzleColumnMeta {
 export declare function getColumnMeta(col: AnyPgColumn): DrizzleColumnMeta;
 export declare function getCollectionByPath(collectionPath: string, registry: PostgresCollectionRegistry): CollectionConfig;
 export declare function getTableForCollection(collection: CollectionConfig, registry: PostgresCollectionRegistry): PgTable<any>;
-export declare function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[];
+export declare function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
+}[];
+export declare function parseIdValues(idValue: string | number, primaryKeys: {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
+}[]): Record<string, string | number>;
+export declare function buildCompositeId(values: Record<string, unknown>, primaryKeys: {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
+}[]): string;

package/dist/services/dataService.d.ts

@@ -82,9 +82,7 @@ export declare class DataService implements DataRepository {
     /**
      * Save an row (create or update)
      */
-    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string, options?: {
-        upsert?: boolean;
-    }): Promise<Record<string, unknown>>;
+    save<M extends Record<string, unknown>>(collectionPath: string, values: Partial<M>, id?: string | number, databaseId?: string): Promise<Record<string, unknown>>;
     /**
      * Delete an row by ID
      */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.ad25bc0",
+  "version": "0.9.1-canary.ad870eb",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -69,13 +69,14 @@
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "execa": "^9.6.1",
+    "hono": "^4.12.25",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.9.1-canary.ad25bc0",
-    "@rebasepro/types": "0.9.1-canary.ad25bc0",
-    "@rebasepro/utils": "0.9.1-canary.ad25bc0",
-    "@rebasepro/server": "0.9.1-canary.ad25bc0",
-    "@rebasepro/common": "0.9.1-canary.ad25bc0"
+    "@rebasepro/common": "0.9.1-canary.ad870eb",
+    "@rebasepro/server": "0.9.1-canary.ad870eb",
+    "@rebasepro/codegen": "0.9.1-canary.ad870eb",
+    "@rebasepro/utils": "0.9.1-canary.ad870eb",
+    "@rebasepro/types": "0.9.1-canary.ad870eb"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
@@ -99,7 +100,7 @@
   ],
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json",
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "jest --passWithNoTests",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",

package/src/PostgresBackendDriver.ts

@@ -17,7 +17,6 @@ import {
     RebaseData,
     RebaseSdkData,
     RestFetchService,
-    SaveManyProps,
     SaveProps,
     TableColumnInfo,
     TableForeignKeyInfo,
@@ -533,8 +532,7 @@ export class PostgresBackendDriver implements DataDriver {
                                                             id,
                                                             values,
                                                             collection,
-                                                            status,
-                                                            upsert
+                                                            status
                                                         }: SaveProps<M>): Promise<Record<string, unknown>> {
 
         const {
@@ -618,8 +616,7 @@ export class PostgresBackendDriver implements DataDriver {
                 path,
                 updatedValues,
                 id,
-                resolvedCollection?.databaseId,
-                { upsert }
+                resolvedCollection?.databaseId
             );
 
             if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
@@ -767,76 +764,6 @@ export class PostgresBackendDriver implements DataDriver {
         }
     }
 
-    /**
-     * Write many rows through the same pipeline as {@link save}.
-     *
-     * The batch runs in one transaction of its own, so a failure part-way leaves
-     * nothing behind — the point of a batch is that a re-run starts from a known
-     * state. When this driver is already inside a transaction (the authenticated
-     * path, via `withTransaction`) the nested call becomes a savepoint, which is
-     * still atomic and still commits once.
-     *
-     * Rows are applied in order, so a batch that touches the same key twice ends
-     * with the last write winning, exactly as separate calls would.
-     */
-    async saveMany<M extends Record<string, unknown>>({
-                                                          path,
-                                                          rows,
-                                                          collection,
-                                                          upsert
-                                                      }: SaveManyProps<M>): Promise<Record<string, unknown>[]> {
-        return this.db.transaction(async (tx) => {
-            // Bind the whole batch to the transaction handle. Without this the
-            // rows would be written through `this.db` and survive a rollback.
-            const txDriver = new PostgresBackendDriver(
-                tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService
-            );
-            txDriver.dataService = new DataService(tx, this.registry);
-            txDriver.client = this.client;
-            // Carry the caller's notification batching through, so a bulk write
-            // nested in an outer transaction still holds its events until commit.
-            txDriver._deferNotifications = this._deferNotifications;
-            txDriver._pendingNotifications = this._pendingNotifications;
-
-            const saved: Record<string, unknown>[] = [];
-
-            for (let i = 0; i < rows.length; i++) {
-                const values = rows[i];
-                const id = (values as Record<string, unknown>)?.id as string | number | undefined;
-                try {
-                    saved.push(await txDriver.save<M>({
-                        path,
-                        values,
-                        // No `id` argument, deliberately: passing one selects the
-                        // UPDATE path, and an import's rows usually carry a natural
-                        // key for a row that does not exist yet — which would 404 on
-                        // every one. Leaving the key inside `values` is what
-                        // single-row `create(data, id)` does, and it inserts.
-                        // Callers who want existing rows overwritten pass `upsert`.
-                        collection,
-                        status: "new",
-                        upsert
-                    }));
-                } catch (error) {
-                    // One bad row in ten thousand is impossible to find from a
-                    // message that only says the batch failed. Say which row, and
-                    // keep the original error as the cause so its status survives.
-                    const label = id !== undefined ? `id ${JSON.stringify(id)}` : "no id";
-                    throw Object.assign(
-                        new Error(`Row ${i} of ${rows.length} (${label}) failed: ${(error as Error)?.message ?? error}`, { cause: error }),
-                        {
-                            statusCode: (error as { statusCode?: number })?.statusCode,
-                            code: (error as { code?: string })?.code,
-                            name: (error as Error)?.name
-                        }
-                    );
-                }
-            }
-
-            return saved;
-        });
-    }
-
     async delete<M extends Record<string, unknown>>({
                                                               row,
                                                               collection
@@ -1435,19 +1362,6 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
         return this.withTransaction((delegate) => delegate.save(props));
     }
 
-    /**
-     * One transaction for the whole batch, rather than one per row.
-     *
-     * This is the point of the method: `save` opens a transaction per call, so
-     * importing 10k rows through it means 10k transactions (and, over HTTP, 10k
-     * round trips). Here the RLS context is established once and every row lands
-     * or none does. Realtime notifications are already deferred to commit by
-     * `withTransaction`, so a batch does not flood subscribers mid-flight.
-     */
-    async saveMany<M extends Record<string, unknown>>(props: SaveManyProps<M>): Promise<Record<string, unknown>[]> {
-        return this.withTransaction((delegate) => delegate.saveMany(props));
-    }
-
     async delete<M extends Record<string, unknown>>(props: DeleteProps<M>): Promise<void> {
         return this.withTransaction((delegate) => delegate.delete(props));
     }

package/src/schema/auth-default-policies.ts

@@ -0,0 +1,132 @@
+import { CollectionConfig, SecurityRule, SecurityOperation, AuthCollectionConfig, PolicyExpression, isPostgresCollectionConfig, policy } from "@rebasepro/types";
+import { getTableName } from "@rebasepro/common";
+
+/**
+ * Default RLS policies injected by the schema generator.
+ *
+ * Rebase's enforcement model is unified: authenticated (user-context) requests
+ * run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+ * statement — reads and writes. A collection's `securityRules` are the whole
+ * authorization model. The server context (auth flows, migrations,
+ * `dataAsAdmin`) runs as the owner and bypasses RLS.
+ *
+ * Because RLS default-denies, every collection is **locked by default**: with
+ * no rules, only the server context and admins can touch it. The generator
+ * injects that safe baseline:
+ *
+ * **For every collection**
+ *  1. A permissive **server-or-admin SELECT** grant.
+ *  2. A permissive **server-or-admin write** grant (insert/update/delete).
+ *
+ * Author `securityRules` are permissive and OR together, so explicit rules only
+ * *broaden* access from this locked baseline (e.g. "users read/write their own
+ * rows").
+ *
+ * **For auth collections additionally**
+ *  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+ *     their own row (profile, session bootstrap) without every app re-declaring
+ *     it.
+ *  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+ *     every other policy, so a write is rejected unless the caller is an admin
+ *     (or the server context) — even if the author also wrote a permissive rule
+ *     such as "a user may edit their own row". Without this, a permissive owner
+ *     rule would let a user change their own `roles`.
+ *
+ * The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+ * — the built-in flows that run without a user (signup, migrations) set no user
+ * GUC — which also lets the owner connection satisfy these policies even under
+ * FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+ * `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+ *
+ * Opt out with `disableDefaultPolicies: true` to take full responsibility for
+ * the collection's RLS.
+ */
+// Expressed structurally (not as raw SQL) so the admin UI can evaluate it
+// exactly — the framework's most security-critical policies must be reflected
+// precisely, not left as un-evaluable raw clauses. Compiles to
+// `auth.uid() IS NULL OR (string_to_array(auth.roles(), ',') && ARRAY['admin'])`.
+//
+// `serverContext()`, emphatically not `not(authenticated())`: the server arm of
+// this grant must match the server context and nothing else. Anonymous visitors
+// are not signed in either, so a negated `authenticated()` would hand them the
+// server-or-admin grant on every collection's default policy.
+const SERVER_OR_ADMIN_EXPR: PolicyExpression = policy.or(
+    policy.serverContext(),
+    policy.rolesOverlap(["admin"])
+);
+
+/** Write operations that must be admin-gated by default on auth collections. */
+const DEFAULT_GUARDED_OPS: SecurityOperation[] = ["insert", "update", "delete"];
+
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection: CollectionConfig): boolean {
+    const auth = collection.auth;
+    return auth === true || (typeof auth === "object" && (auth as AuthCollectionConfig)?.enabled === true);
+}
+
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection: CollectionConfig): string {
+    for (const [name, prop] of Object.entries(collection.properties ?? {})) {
+        if (prop && typeof prop === "object" && "isId" in prop && (prop as { isId?: unknown }).isId) {
+            return name;
+        }
+    }
+    return "id";
+}
+
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules` plus the framework defaults described in
+ * the module doc (baseline server/admin read for all collections; self-read
+ * and the admin write gate for auth collections).
+ *
+ * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+ */
+export function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[] {
+    const explicit = [...((isPostgresCollectionConfig(collection) ? collection.securityRules : undefined) ?? [])];
+
+    if (collection.disableDefaultPolicies) {
+        return explicit;
+    }
+
+    const tableName = getTableName(collection);
+    const injected: SecurityRule[] = [];
+
+    // Baseline read + write: the server context and admins can always operate.
+    // RLS default-denies under the user role, so without these a rule-less
+    // collection would be locked to everyone — including the admin studio.
+    // Author rules are permissive and broaden access from here.
+    injected.push({
+        name: `${tableName}_default_admin_read`,
+        operations: ["select"],
+        condition: SERVER_OR_ADMIN_EXPR
+    });
+    injected.push({
+        name: `${tableName}_default_admin_write`,
+        operations: [...DEFAULT_GUARDED_OPS],
+        condition: SERVER_OR_ADMIN_EXPR,
+        check: SERVER_OR_ADMIN_EXPR
+    });
+
+    if (isAuthCollection(collection)) {
+        // Self-read: a user can always read their own row.
+        injected.push({
+            name: `${tableName}_default_self_read`,
+            operations: ["select"],
+            condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+        });
+
+        // Restrictive gate: AND'd with all other policies, so no permissive rule
+        // (e.g. an owner "edit your own row" rule) can let a non-admin change
+        // privileged columns like `roles`.
+        injected.push({
+            name: `${tableName}_require_admin_write`,
+            mode: "restrictive",
+            operations: [...DEFAULT_GUARDED_OPS],
+            condition: SERVER_OR_ADMIN_EXPR,
+            check: SERVER_OR_ADMIN_EXPR
+        });
+    }
+
+    return [...explicit, ...injected];
+}

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,8 +1,10 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules } from "@rebasepro/common";
-import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
+import { toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "crypto";
 import { logger } from "@rebasepro/server";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -313,6 +315,22 @@ const wrapSql = (clause: string): string => `sql\`${clause}\``;
 /**
  * Generates a deterministic hash based on the rule configuration.
  */
+const getPolicyNameHash = (rule: SecurityRule): string => {
+    const data = JSON.stringify({
+        a: rule.access,
+        m: rule.mode,
+        op: rule.operation,
+        ops: rule.operations?.slice().sort(),
+        own: rule.ownerField,
+        rol: rule.roles?.slice().sort(),
+        pg: rule.pgRoles?.slice().sort(),
+        u: rule.using,
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
+    });
+    return createHash("sha1").update(data).digest("hex").substring(0, 7);
+};
 
 /**
  * Generates Drizzle pgPolicy() calls from a declarative SecurityRule definition.
@@ -333,11 +351,15 @@ const generatePolicyCode = (collection: CollectionConfig, rule: SecurityRule, in
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const policyNames = getPolicyNamesForRule(rule, tableName);
+    const ruleHash = getPolicyNameHash(rule);
 
     // Generate one pgPolicy per operation
     return ops.map((op, opIdx) => {
-        return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
+        const policyName = rule.name
+            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
+            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
+
+        return generateSinglePolicyCode(collection, rule, op, policyName, resolveCollection);
     }).join("");
 };
 

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,6 +1,8 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules } from "@rebasepro/common";
-import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
+import { toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "crypto";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 
 // --- Helper Functions ---
 
@@ -42,6 +44,22 @@ const isIdProperty = (propName: string, prop: Property, collection: CollectionCo
     return !hasExplicitId && propName === "id";
 };
 
+const getPolicyNameHash = (rule: SecurityRule): string => {
+    const data = JSON.stringify({
+        a: rule.access,
+        m: rule.mode,
+        op: rule.operation,
+        ops: rule.operations?.slice().sort(),
+        own: rule.ownerField,
+        rol: rule.roles?.slice().sort(),
+        pg: rule.pgRoles?.slice().sort(),
+        u: rule.using,
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
+    });
+    return createHash("sha1").update(data).digest("hex").substring(0, 7);
+};
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
@@ -51,10 +69,14 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const policyNames = getPolicyNamesForRule(rule, tableName);
+    const ruleHash = getPolicyNameHash(rule);
 
     return ops.map((op, opIdx) => {
-        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
+        const policyName = rule.name
+            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
+            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
+
+        return generateSinglePolicyDdl(collection, rule, op, policyName, resolveCollection);
     }).join("");
 };
 
@@ -456,17 +478,7 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         const securityRules = getEffectiveSecurityRules(collection);
         if (securityRules.length > 0) {
             const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
-
             securityRules.forEach((rule: SecurityRule) => {
-                // Say which policies the author did not write. They are permissive,
-                // so they OR with the declared rules and widen the final ACL beyond
-                // what `securityRules` reads like — and re-appear after any manual
-                // DROP, because a push asserts the declared state.
-                if (rule.name && injectedNames.has(rule.name)) {
-                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
-                    ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
-                }
                 ddl += generatePolicyDdl(collection, rule, resolveCollection);
             });
             ddl += "\n";

package/src/services/BranchService.ts

@@ -11,45 +11,10 @@ import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
-import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
 
 /** Internal prefix applied to branch database names to avoid collisions. */
 const BRANCH_DB_PREFIX = "rb_";
 
-/** `duplicate_database` — the target database name is already taken. */
-const PG_DUPLICATE_DATABASE = "42P04";
-
-/** `object_in_use` — the database still has connections attached. */
-const PG_OBJECT_IN_USE = "55006";
-
-/**
- * Describe a failed branch DDL statement in terms a user can act on.
- *
- * Drizzle reports failures as `Failed query: <sql> params:` and hides the real
- * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
- * the actual problem. Match on the PG error code instead — it survives wrapping
- * and, unlike the message text, is not locale-dependent.
- */
-function describeBranchDdlError(err: unknown, fallbackContext: string): Error {
-    const pgError = extractPgError(err);
-
-    if (pgError?.code === PG_DUPLICATE_DATABASE) {
-        return new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
-    }
-    if (pgError?.code === PG_OBJECT_IN_USE) {
-        return new Error(
-            `Cannot complete the operation: the database "${fallbackContext}" has active connections. ` +
-            "Close other clients or connections and try again."
-        );
-    }
-
-    // Unknown failure: surface the real PG message rather than the Drizzle
-    // wrapper, which would otherwise show the raw SQL and no reason at all.
-    const detail = pgError?.message ?? extractCauseMessage(err);
-    if (detail) return new Error(detail);
-    return err instanceof Error ? err : new Error(String(err));
-}
-
 /** Fully-qualified metadata table in the rebase schema. */
 const BRANCHES_TABLE = "rebase.branches";
 
@@ -144,15 +109,18 @@ export class BranchService {
                 sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`)
             );
         } catch (err) {
-            const pgError = extractPgError(err);
-            if (pgError?.code === PG_OBJECT_IN_USE) {
-                // The template — not the new database — is the one still in use.
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes("already exists")) {
+                throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
+            }
+            // If template fails due to active connections, provide a helpful error
+            if (msg.includes("being accessed by other users")) {
                 throw new Error(
                     `Cannot create branch: the source database "${sourceDb}" has active connections. ` +
                     "Close other clients or connections and try again."
                 );
             }
-            throw describeBranchDdlError(err, dbName);
+            throw err;
         }
 
         // Record metadata in the default database
@@ -198,14 +166,14 @@ export class BranchService {
         try {
             await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
         } catch (err) {
-            const pgError = extractPgError(err);
-            if (pgError?.code === PG_OBJECT_IN_USE) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes("being accessed by other users")) {
                 throw new Error(
                     `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
-            throw describeBranchDdlError(err, dbName);
+            throw err;
         }
 
         // Remove metadata