@rebasepro/server-postgres 0.9.1-canary.ed943fa → 0.9.1-canary.f0ac103

package/dist/schema/doctor.d.ts

@@ -2,7 +2,7 @@ import { CollectionConfig, Property } from "@rebasepro/types";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
     table?: string;
     column?: string;
     expected?: string;

package/dist/security/policy-drift.d.ts

@@ -63,36 +63,6 @@ export declare function parseExpectedPolicies(ddl: string): PolicyRef[];
  * of reads. The same blindness would hide a policy that fails open.
  */
 export declare function checkPolicyDrift(client: Queryable, collections: CollectionConfig[]): Promise<PolicyDrift>;
-/**
- * Does this name look like one the generator produced for this table?
- *
- * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
- * rule spans several operations), and the hash covers the rule's semantics — so
- * *editing* a rule renames its policy. The policy under the old name is left
- * behind by `db push`, which only DROPs the names it is about to CREATE, and
- * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
- * granting everything no matter how tight its replacement is.
- *
- * Matching the shape is what makes dropping them safe. A hand-written policy
- * would have to collide with a 7-hex digest to be mistaken for generated one;
- * a policy named anything else is left alone and merely reported, because a
- * custom name is indistinguishable from one someone wrote in SQL on purpose.
- */
-export declare function isGeneratedPolicyName(name: string, table: string): boolean;
-export interface OrphanCleanup {
-    /** Superseded generated policies that were dropped. */
-    dropped: PolicyRef[];
-    /** Orphans left in place because their names are not generator-shaped. */
-    kept: PolicyRef[];
-}
-/**
- * Drop the policies an earlier push superseded but never removed.
- *
- * Only touches tables the collections describe — a table with no expected
- * policy is not ours to reconcile, and scanning by schema alone would sweep up
- * policies belonging to something else sharing the database.
- */
-export declare function dropOrphanedPolicies(client: Queryable, drift: PolicyDrift, collections: CollectionConfig[]): Promise<OrphanCleanup>;
 export declare const hasDrift: (d: PolicyDrift) => boolean;
 /** Human-readable report; empty string when the database matches the config. */
 export declare function formatPolicyDrift(drift: PolicyDrift): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.ed943fa",
+  "version": "0.9.1-canary.f0ac103",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -71,15 +71,14 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.9.1-canary.ed943fa",
-    "@rebasepro/types": "0.9.1-canary.ed943fa",
-    "@rebasepro/server": "0.9.1-canary.ed943fa",
-    "@rebasepro/utils": "0.9.1-canary.ed943fa",
-    "@rebasepro/common": "0.9.1-canary.ed943fa"
+    "@rebasepro/codegen": "0.9.1-canary.f0ac103",
+    "@rebasepro/common": "0.9.1-canary.f0ac103",
+    "@rebasepro/types": "0.9.1-canary.f0ac103",
+    "@rebasepro/utils": "0.9.1-canary.f0ac103",
+    "@rebasepro/server": "0.9.1-canary.f0ac103"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",
-    "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.20.0",

package/src/cli.ts

@@ -176,7 +176,6 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             
             if (databaseUrl) {
                 await applyPolicies(databaseUrl);
-                await reconcilePolicies(databaseUrl, collectionsPath);
                 await ensureRlsUserRole(databaseUrl);
             } else {
                 logger.warn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
@@ -270,65 +269,6 @@ async function applyPolicies(databaseUrl: string): Promise<void> {
     }
 }
 
-/**
- * Remove the policies an earlier push superseded but never dropped.
- *
- * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
- * generated name contains a hash of its own semantics — so editing a rule
- * writes a *new* policy and abandons the old one. Postgres ORs PERMISSIVE
- * policies together, which makes an abandoned grant outrank every tightening
- * that replaced it, and push reported success the whole time.
- *
- * Runs after `applyPolicies` so the current policies are already in place: the
- * drift check then sees exactly the set that should survive, and anything else
- * on a managed table is by definition left over.
- */
-async function reconcilePolicies(databaseUrl: string, collectionsPath: string): Promise<void> {
-    try {
-        const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } =
-            await import("./security/policy-drift");
-        const { loadCollections } = await import("./schema/doctor");
-
-        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
-        const { Client } = await import("pg");
-        const client = new Client({ connectionString: databaseUrl });
-        await client.connect();
-        try {
-            const drift = await checkPolicyDrift(client as never, collections);
-            const { dropped, kept } = await dropOrphanedPolicies(client as never, drift, collections);
-
-            for (const p of dropped) {
-                logger.info(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
-            }
-            if (dropped.length > 0) {
-                logger.info(chalk.green(`  ✓ Removed ${dropped.length} superseded RLS ${dropped.length === 1 ? "policy" : "policies"}.`));
-            }
-
-            // Custom-named orphans are indistinguishable from policies someone
-            // wrote in SQL deliberately, so they are reported, never dropped.
-            if (kept.length > 0) {
-                logger.warn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
-                for (const p of kept) {
-                    logger.warn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
-                }
-                logger.warn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
-            }
-
-            // Missing/diverged are not push's to fix, but staying silent about
-            // them is how a database ends up not matching its config.
-            const remaining = { ...drift, orphaned: kept };
-            if (hasDrift(remaining) && (remaining.missing.length > 0 || remaining.diverged.length > 0)) {
-                logger.warn(chalk.yellow("  ⚠️  RLS policies do not match your collections:"));
-                logger.warn(formatPolicyDrift({ ...remaining, orphaned: [] }));
-            }
-        } finally {
-            await client.end();
-        }
-    } catch (err) {
-        logger.warn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
-    }
-}
-
 async function branchCommand(rawArgs: string[]): Promise<void> {
     const branchAction = rawArgs[2]; // create, list, delete, info
 

package/src/schema/doctor.ts

@@ -37,7 +37,7 @@ export type IssueSeverity = "error" | "warning" | "info";
 
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
     table?: string;
     column?: string;
     expected?: string;
@@ -61,29 +61,19 @@ export function getExpectedColumnType(prop: Property): string | null {
             const sp = prop as StringProperty;
             if (sp.enum) return "USER-DEFINED"; // pgEnum → USER-DEFINED in information_schema
             if ("isId" in sp && sp.isId === "uuid") return "uuid";
-            if (sp.columnType === "uuid") return "uuid";
-            // A markdown/multiline string compiles to `text`, not varchar — the
-            // generator treats those UI hints as column-type signals, so the
-            // expectation here must too or every such column reads as drift.
-            if (sp.columnType === "text" || sp.ui?.markdown || sp.ui?.multiline) return "text";
+            if (sp.columnType === "text") return "text";
             if (sp.columnType === "char") return "character";
             return "character varying";
         }
         case "number": {
             const np = prop as NumberProperty;
-            if (np.columnType) {
-                // The generator passes any columnType straight through to drizzle,
-                // so mirror that rather than enumerating a subset (which reported
-                // drift for anything unlisted, e.g. smallint). Serial types are
-                // integers with a sequence default; information_schema reports the
-                // underlying width.
-                const serialWidths: Record<string, string> = {
-                    serial: "integer",
-                    bigserial: "bigint",
-                    smallserial: "smallint"
-                };
-                return serialWidths[np.columnType] ?? np.columnType;
-            }
+            if (np.columnType === "double precision") return "double precision";
+            if (np.columnType === "real") return "real";
+            if (np.columnType === "bigint") return "bigint";
+            if (np.columnType === "serial") return "integer"; // serial is integer under the hood
+            if (np.columnType === "bigserial") return "bigint";
+            if (np.columnType === "integer") return "integer";
+            if (np.columnType === "numeric") return "numeric";
             if (np.validation?.integer || ("isId" in np && np.isId)) return "integer";
             return "numeric";
         }
@@ -211,18 +201,15 @@ export async function checkCollectionsVsSdk(
 ): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
     const issues: DoctorIssue[] = [];
 
-    // The typed SDK is opt-in — nothing in a scaffolded project imports it until
-    // you choose to. A project that never generated one isn't drifting, so report
-    // it as information rather than a warning; otherwise `doctor` can never come
-    // back clean on a fresh project and users learn to ignore its output.
+    // Check if SDK file exists
     if (!fs.existsSync(sdkFilePath)) {
         issues.push({
-            severity: "info",
-            category: "sdk_not_generated",
-            message: "Typed SDK not generated (optional).",
-            fix: "Run `rebase generate-sdk` if you want typed collection access"
+            severity: "warning",
+            category: "sdk_stale",
+            message: `Generated SDK typedefs file does not exist at "${sdkFilePath}".`,
+            fix: "Run `rebase generate-sdk`"
         });
-        return { passed: true,
+        return { passed: false,
 issues };
     }
 
@@ -644,15 +631,11 @@ export function renderReport(report: DoctorReport): void {
 }
 
 function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): void {
-    const errorCount = issues.filter((i) => i.severity === "error").length;
-    const warnCount = issues.filter((i) => i.severity === "warning").length;
-    const infoIssues = issues.filter((i) => i.severity === "info");
-
-    // Informational notes don't make a phase unhealthy, so key the header off
-    // real problems rather than `passed` alone.
-    if (errorCount === 0 && warnCount === 0) {
+    if (passed) {
         logger.info(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
     } else {
+        const errorCount = issues.filter((i) => i.severity === "error").length;
+        const warnCount = issues.filter((i) => i.severity === "warning").length;
         const parts: string[] = [];
         if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
         if (warnCount > 0) parts.push(`${warnCount} warning${warnCount > 1 ? "s" : ""}`);
@@ -660,14 +643,7 @@ function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): voi
     }
     logger.info("");
 
-    // Notes render as a quiet one-liner, not a full drift box.
-    for (const issue of infoIssues) {
-        const fixPart = issue.fix ? chalk.gray(` — ${issue.fix}`) : "";
-        logger.info(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
-        logger.info("");
-    }
-
-    for (const issue of issues.filter((i) => i.severity !== "info")) {
+    for (const issue of issues) {
         const severityIcon = issue.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
         const categoryLabel = formatCategory(issue.category);
         logger.info(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
@@ -698,8 +674,7 @@ function formatCategory(cat: DoctorIssue["category"]): string {
         missing_enum: "Missing Enum",
         enum_value_mismatch: "Enum Value Mismatch",
         missing_foreign_key: "Missing Foreign Key",
-        sdk_stale: "Stale SDK Types",
-        sdk_not_generated: "SDK Types Not Generated"
+        sdk_stale: "Stale SDK Types"
     };
     return labels[cat];
 }

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, dropOrphanedPolicies, isGeneratedPolicyName, type PolicyRef, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type PolicyRef, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -154,108 +154,3 @@ describe("checkPolicyDrift", () => {
         expect(drift.missing.length).toBeGreaterThan(0);
     });
 });
-
-describe("isGeneratedPolicyName", () => {
-    it("recognises the generator's own shape", () => {
-        expect(isGeneratedPolicyName("documents_insert_a1b2c3d", "documents")).toBe(true);
-        // One rule spanning several operations appends the operation index.
-        expect(isGeneratedPolicyName("documents_update_a1b2c3d_1", "documents")).toBe(true);
-    });
-
-    it("does not claim names a human could have written", () => {
-        expect(isGeneratedPolicyName("owner_access", "documents")).toBe(false);
-        expect(isGeneratedPolicyName("documents_default_admin_read", "documents")).toBe(false);
-        // Right shape, wrong table — belongs to something else.
-        expect(isGeneratedPolicyName("teams_insert_a1b2c3d", "documents")).toBe(false);
-        // A digest is 7 lowercase hex characters, nothing else.
-        expect(isGeneratedPolicyName("documents_insert_notahex", "documents")).toBe(false);
-        expect(isGeneratedPolicyName("documents_grant_a1b2c3d", "documents")).toBe(false);
-    });
-});
-
-describe("dropOrphanedPolicies", () => {
-    /** Records the DDL issued so the test can assert on what was dropped. */
-    function recordingDb(rows: Record<string, unknown>[]) {
-        const executed: string[] = [];
-        const db: Queryable = {
-            query: async (text: string) => {
-                if (!/^SELECT/i.test(text)) executed.push(text);
-                return { rows: rows as never[] };
-            }
-        };
-        return { db, executed };
-    }
-
-    it("drops the policy a rule edit superseded", async () => {
-        // The reported failure: tightening a rule renames its policy, and the
-        // permissive original stays live and keeps ORing itself back in.
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const stale = {
-            schemaname: "public", tablename: "documents", policyname: "documents_insert_dead1ee",
-            roles: ["public"], cmd: "INSERT", qual: null, with_check: "true"
-        };
-        const live = [...expected.map((p) => liveRow(p)), stale];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(1);
-        expect(dropped[0].name).toBe("documents_insert_dead1ee");
-        expect(kept).toHaveLength(0);
-        expect(executed).toEqual([
-            'DROP POLICY IF EXISTS "documents_insert_dead1ee" ON "public"."documents"'
-        ]);
-    });
-
-    it("leaves a hand-written policy alone and reports it instead", async () => {
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = [
-            ...expected.map((p) => liveRow(p)),
-            { schemaname: "public", tablename: "documents", policyname: "ops_break_glass", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }
-        ];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept.map((p) => p.name)).toEqual(["ops_break_glass"]);
-        expect(executed).toEqual([]);
-    });
-
-    it("never touches a table the collections do not describe", async () => {
-        // Another application sharing the schema owns this table; a
-        // generator-shaped name there is coincidence, not our leftover.
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = [
-            ...expected.map((p) => liveRow(p)),
-            { schemaname: "public", tablename: "legacy", policyname: "legacy_select_a1b2c3d", roles: ["public"], cmd: "SELECT", qual: "true", with_check: null }
-        ];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept.map((p) => p.name)).toEqual(["legacy_select_a1b2c3d"]);
-        expect(executed).toEqual([]);
-    });
-
-    it("does nothing when the database already matches", async () => {
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => liveRow(p));
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept).toHaveLength(0);
-        expect(executed).toEqual([]);
-    });
-});

package/src/security/policy-drift.ts

@@ -192,62 +192,6 @@ export async function checkPolicyDrift(
     return drift;
 }
 
-/**
- * Does this name look like one the generator produced for this table?
- *
- * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
- * rule spans several operations), and the hash covers the rule's semantics — so
- * *editing* a rule renames its policy. The policy under the old name is left
- * behind by `db push`, which only DROPs the names it is about to CREATE, and
- * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
- * granting everything no matter how tight its replacement is.
- *
- * Matching the shape is what makes dropping them safe. A hand-written policy
- * would have to collide with a 7-hex digest to be mistaken for generated one;
- * a policy named anything else is left alone and merely reported, because a
- * custom name is indistinguishable from one someone wrote in SQL on purpose.
- */
-export function isGeneratedPolicyName(name: string, table: string): boolean {
-    return new RegExp(`^${table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\d+)?$`)
-        .test(name);
-}
-
-export interface OrphanCleanup {
-    /** Superseded generated policies that were dropped. */
-    dropped: PolicyRef[];
-    /** Orphans left in place because their names are not generator-shaped. */
-    kept: PolicyRef[];
-}
-
-/**
- * Drop the policies an earlier push superseded but never removed.
- *
- * Only touches tables the collections describe — a table with no expected
- * policy is not ours to reconcile, and scanning by schema alone would sweep up
- * policies belonging to something else sharing the database.
- */
-export async function dropOrphanedPolicies(
-    client: Queryable,
-    drift: PolicyDrift,
-    collections: CollectionConfig[]
-): Promise<OrphanCleanup> {
-    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));
-    const managed = new Set(expected.map((p) => `${p.schema}.${p.table}`));
-
-    const cleanup: OrphanCleanup = { dropped: [], kept: [] };
-    for (const p of drift.orphaned) {
-        if (!managed.has(`${p.schema}.${p.table}`) || !isGeneratedPolicyName(p.name, p.table)) {
-            cleanup.kept.push(p);
-            continue;
-        }
-        // Identifiers are quoted, and the name came from pg_policies rather than
-        // from user input, so it is already a valid identifier.
-        await client.query(`DROP POLICY IF EXISTS "${p.name}" ON "${p.schema}"."${p.table}"`);
-        cleanup.dropped.push(p);
-    }
-    return cleanup;
-}
-
 export const hasDrift = (d: PolicyDrift): boolean =>
     d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;
 

package/src/services/row-pipeline.ts

@@ -91,30 +91,6 @@ function coerceDeclaredNumbers(
 }
 
 /** Render one target row in the requested style. */
-/**
- * Drop every column the collection marked `excludeFromApi`.
- *
- * Password hashes and verification tokens have to be readable server-side but
- * must never reach a client — and "never" has to mean every exit from this
- * pipeline, including relation targets, or a secret leaks through whichever
- * path was overlooked. Keyed by both the property name and its column name,
- * since a row can arrive keyed either way depending on the caller.
- */
-function stripExcluded(
-    row: Record<string, unknown>,
-    collection: CollectionConfig
-): Record<string, unknown> {
-    const properties = collection.properties as Record<string, Property> | undefined;
-    if (!properties) return row;
-
-    for (const [key, property] of Object.entries(properties)) {
-        if (!property?.excludeFromApi) continue;
-        delete row[key];
-        if (property.columnName) delete row[property.columnName];
-    }
-    return row;
-}
-
 function renderTarget(
     targetRow: Record<string, unknown>,
     targetCollection: CollectionConfig,
@@ -124,7 +100,7 @@ function renderTarget(
     if (style === "inline") {
         // The target's columns, and only those: its address is the consumer's
         // to derive, and merging one in overwrites a real `id` column.
-        return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
+        return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
     }
 
     const address = relationTargetAddress(targetRow, targetCollection, registry);
@@ -192,7 +168,7 @@ export function toCmsRow(
         }
     }
 
-    return stripExcluded(normalized, collection);
+    return normalized;
 }
 
 /**
@@ -235,5 +211,5 @@ export function toRestRow(
         }
     }
 
-    return stripExcluded(flat, collection);
+    return flat;
 }