@rebasepro/server-postgres 0.9.1-canary.f2f61da → 0.9.1-canary.fd3754b

package/src/cli-helpers.ts

@@ -1,11 +1,29 @@
 import path from "path";
 import fs from "fs";
 import { execSync } from "child_process";
-import { pathToFileURL } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
 import chalk from "chalk";
 import { logger } from "@rebasepro/server";
 import type { CollectionConfig, Relation } from "@rebasepro/types";
-import { moduleDir as __helpersDirname } from "./module-dir";
+
+const getHelpersDirname = () => {
+    try {
+        return eval("__dirname");
+    } catch {
+        const err = new Error();
+        const stackLine = err.stack?.split("\n")[1] || "";
+        const match = stackLine.match(/\((.*?):\d+:\d+\)/) || stackLine.match(/at (.*?):\d+:\d+/);
+        if (match && match[1]) {
+            let cleanPath = match[1];
+            if (cleanPath.startsWith("file://")) {
+                cleanPath = fileURLToPath(cleanPath);
+            }
+            return path.dirname(cleanPath);
+        }
+        return process.cwd();
+    }
+};
+const __helpersDirname = getHelpersDirname();
 
 
 

package/src/connection.ts

@@ -27,68 +27,11 @@ const DEFAULT_POOL: Required<PostgresPoolConfig> = {
     max: 20,
     idleTimeoutMillis: 30_000,
     connectionTimeoutMillis: 10_000,
-    // The client-side read timeout MUST be comfortably above the server-side
-    // statement_timeout. When the client timer fires first, node-postgres
-    // abandons the in-flight statement but keeps the connection — inside a
-    // transaction that leaves the tx open (and any pending ROLLBACK is
-    // spliced out of the client queue before it ever reaches the wire), so
-    // the pooled connection is returned still in-transaction with its RLS
-    // GUCs set. The server abort (SQLSTATE 57014) is the clean path; the
-    // client timeout is only a backstop for a dead network.
-    queryTimeout: 60_000,
+    queryTimeout: 30_000,
     statementTimeout: 30_000,
     keepAlive: true
 };
 
-/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
-const TX_IDLE = "I";
-
-/**
- * Destroy pool clients that are released while still inside a transaction.
- *
- * pg-pool returns a client to the idle list whenever `release()` is called
- * without an error — even if the connection is still mid-transaction (status
- * `T`/`E`). That happens in practice: drizzle's pool transaction releases in
- * a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
- * (e.g. it was queued behind a statement that hit the client-side
- * query_timeout), the client goes back dirty. The next checkout then runs
- * its statements inside the zombie transaction — with the previous request's
- * `app.*` RLS GUCs still applied, which turns unrelated queries into
- * RLS-scoped ones (observed in production as registration failing with
- * SQLSTATE 42501 under a leaked anonymous context).
- *
- * pg-pool emits `release` before it consults its private `_expired` set, so
- * marking the client expired here makes `_release()` destroy it instead of
- * pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
- * private APIs — feature-detect and fall back to loud logging so an upstream
- * change degrades to observability, never to silent corruption.
- */
-export function guardPoolAgainstDirtyRelease(pool: Pool, label: string): void {
-    pool.on("release", (err: Error | undefined, client: unknown) => {
-        if (err) return; // errored clients are already destroyed by pg-pool
-        const txStatus = (client as { _txStatus?: string | null })?._txStatus;
-        if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
-
-        // pg-pool keeps expired clients in a WeakSet (a plain object works too
-        // if upstream ever changes it — duck-type on add/has).
-        const expired = (pool as unknown as { _expired?: { add(c: object): unknown; has(c: object): boolean } })._expired;
-        if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
-            expired.add(client);
-            logger.error(
-                `[${label}] Client released back to the pool while still in a transaction ` +
-                `(status '${txStatus}') — destroying it so the open transaction and its ` +
-                `session state (RLS GUCs) cannot leak into the next request.`
-            );
-        } else {
-            logger.error(
-                `[${label}] Client released mid-transaction (status '${txStatus}') but the ` +
-                `pool's internal expiry set is unavailable (pg-pool internals changed?). ` +
-                `The connection may leak its open transaction into subsequent requests.`
-            );
-        }
-    });
-}
-
 /**
  * Create a Drizzle-backed Postgres connection with a production-grade
  * connection pool.
@@ -132,7 +75,6 @@ export function createPostgresDatabaseConnection(
             logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
         }
     });
-    guardPoolAgainstDirtyRelease(pool, "pg-pool");
 
     // Create drizzle instance — pass schema when available to enable db.query relational API
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
@@ -176,7 +118,6 @@ export function createDirectDatabaseConnection(
     pool.on("error", (err) => {
         logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
     });
-    guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 
@@ -216,7 +157,6 @@ export function createReadReplicaConnection(
     pool.on("error", (err) => {
         logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
     });
-    guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 

package/src/data-transformer.ts

@@ -20,19 +20,12 @@ import { logger } from "@rebasepro/server";
 export interface SerializedEntityData {
     /** Scalar column values ready for INSERT/UPDATE. */
     scalarData: Record<string, unknown>;
-    /**
-     * Inverse relation updates that must be applied to target tables.
-     *
-     * No address here: the row being written does not know its own. These are
-     * applied by `PersistService`, which addresses them with the id it holds —
-     * the one it was given for an update, or the one the INSERT returned — and
-     * that is the authority. This item used to carry a `currentId` derived from
-     * the *input* values, which nothing ever read.
-     */
+    /** Inverse relation updates that must be applied to target tables. */
     inverseRelationUpdates: Array<{
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }>;
     /** JoinPath relation updates that require multi-hop writes. */
     joinPathRelationUpdates: Array<{
@@ -112,6 +105,7 @@ joinPathRelationUpdates: [] };
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }> = [];
     const joinPathRelationUpdates: Array<{
         relationKey: string;
@@ -152,10 +146,12 @@ joinPathRelationUpdates: [] };
                 } else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
                     // Inverse relation: Need to update the target table's FK
                     const serializedValue = serializePropertyToServer(effectiveValue, property);
+                    const pks = getPrimaryKeys(collection, registry!);
                     inverseRelationUpdates.push({
                         relationKey: key,
                         relation,
-                        newValue: serializedValue
+                        newValue: serializedValue,
+                        currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
                     });
                     // Don't add the original relation property to the result
                     continue;
@@ -174,10 +170,12 @@ joinPathRelationUpdates: [] };
                         });
                     } else {
                         // Many inverse joinPath: capture as inverse relation update
+                        const pks = getPrimaryKeys(collection, registry!);
                         inverseRelationUpdates.push({
                             relationKey: key,
                             relation,
-                            newValue: serializedValue
+                            newValue: serializedValue,
+                            currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
                         });
                     }
                     // Don't add the original relation property to the result

package/src/databasePoolManager.ts

@@ -2,7 +2,6 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
-import { guardPoolAgainstDirtyRelease } from "./connection";
 
 export class DatabasePoolManager {
     private pools: Map<string, Pool> = new Map();
@@ -51,7 +50,6 @@ export class DatabasePoolManager {
         pool.on("error", (err) => {
             logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
         });
-        guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 
         this.pools.set(databaseName, pool);
         return pool;

package/src/schema/auth-default-policies.ts

@@ -0,0 +1,125 @@
+import { CollectionConfig, SecurityRule, SecurityOperation, AuthCollectionConfig, PolicyExpression, isPostgresCollectionConfig, policy } from "@rebasepro/types";
+import { getTableName } from "@rebasepro/common";
+
+/**
+ * Default RLS policies injected by the schema generator.
+ *
+ * Rebase's enforcement model is unified: authenticated (user-context) requests
+ * run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+ * statement — reads and writes. A collection's `securityRules` are the whole
+ * authorization model. The server context (auth flows, migrations,
+ * `dataAsAdmin`) runs as the owner and bypasses RLS.
+ *
+ * Because RLS default-denies, every collection is **locked by default**: with
+ * no rules, only the server context and admins can touch it. The generator
+ * injects that safe baseline:
+ *
+ * **For every collection**
+ *  1. A permissive **server-or-admin SELECT** grant.
+ *  2. A permissive **server-or-admin write** grant (insert/update/delete).
+ *
+ * Author `securityRules` are permissive and OR together, so explicit rules only
+ * *broaden* access from this locked baseline (e.g. "users read/write their own
+ * rows").
+ *
+ * **For auth collections additionally**
+ *  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+ *     their own row (profile, session bootstrap) without every app re-declaring
+ *     it.
+ *  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+ *     every other policy, so a write is rejected unless the caller is an admin
+ *     (or the server context) — even if the author also wrote a permissive rule
+ *     such as "a user may edit their own row". Without this, a permissive owner
+ *     rule would let a user change their own `roles`.
+ *
+ * The server context is recognised as `auth.uid() IS NULL` — the built-in flows
+ * that run without a user (signup, migrations) set no user GUC — which also
+ * lets the owner connection satisfy these policies even under FORCE RLS.
+ *
+ * Opt out with `disableDefaultPolicies: true` to take full responsibility for
+ * the collection's RLS.
+ */
+// Expressed structurally (not as raw SQL) so the admin UI can evaluate it
+// exactly — the framework's most security-critical policies must be reflected
+// precisely, not left as un-evaluable raw clauses. Compiles to
+// `auth.uid() IS NULL OR (string_to_array(auth.roles(), ',') && ARRAY['admin'])`.
+const SERVER_OR_ADMIN_EXPR: PolicyExpression = policy.or(
+    policy.not(policy.authenticated()),
+    policy.rolesOverlap(["admin"])
+);
+
+/** Write operations that must be admin-gated by default on auth collections. */
+const DEFAULT_GUARDED_OPS: SecurityOperation[] = ["insert", "update", "delete"];
+
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection: CollectionConfig): boolean {
+    const auth = collection.auth;
+    return auth === true || (typeof auth === "object" && (auth as AuthCollectionConfig)?.enabled === true);
+}
+
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection: CollectionConfig): string {
+    for (const [name, prop] of Object.entries(collection.properties ?? {})) {
+        if (prop && typeof prop === "object" && "isId" in prop && (prop as { isId?: unknown }).isId) {
+            return name;
+        }
+    }
+    return "id";
+}
+
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules` plus the framework defaults described in
+ * the module doc (baseline server/admin read for all collections; self-read
+ * and the admin write gate for auth collections).
+ *
+ * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+ */
+export function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[] {
+    const explicit = [...((isPostgresCollectionConfig(collection) ? collection.securityRules : undefined) ?? [])];
+
+    if (collection.disableDefaultPolicies) {
+        return explicit;
+    }
+
+    const tableName = getTableName(collection);
+    const injected: SecurityRule[] = [];
+
+    // Baseline read + write: the server context and admins can always operate.
+    // RLS default-denies under the user role, so without these a rule-less
+    // collection would be locked to everyone — including the admin studio.
+    // Author rules are permissive and broaden access from here.
+    injected.push({
+        name: `${tableName}_default_admin_read`,
+        operations: ["select"],
+        condition: SERVER_OR_ADMIN_EXPR
+    });
+    injected.push({
+        name: `${tableName}_default_admin_write`,
+        operations: [...DEFAULT_GUARDED_OPS],
+        condition: SERVER_OR_ADMIN_EXPR,
+        check: SERVER_OR_ADMIN_EXPR
+    });
+
+    if (isAuthCollection(collection)) {
+        // Self-read: a user can always read their own row.
+        injected.push({
+            name: `${tableName}_default_self_read`,
+            operations: ["select"],
+            condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+        });
+
+        // Restrictive gate: AND'd with all other policies, so no permissive rule
+        // (e.g. an owner "edit your own row" rule) can let a non-admin change
+        // privileged columns like `roles`.
+        injected.push({
+            name: `${tableName}_require_admin_write`,
+            mode: "restrictive",
+            operations: [...DEFAULT_GUARDED_OPS],
+            condition: SERVER_OR_ADMIN_EXPR,
+            check: SERVER_OR_ADMIN_EXPR
+        });
+    }
+
+    return [...explicit, ...injected];
+}

package/src/schema/doctor-cli.ts

@@ -8,7 +8,7 @@ import chalk from "chalk";
 import fs from "fs";
 import { runDoctor, loadCollections } from "./doctor";
 import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
-import { validatePolicyPgRoles, warnOnAnonymousGrants } from "../security/rls-enforcement";
+import { validatePolicyPgRoles } from "../security/rls-enforcement";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -41,10 +41,6 @@ async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): P
             logger.error(chalk.red(err instanceof Error ? err.message : String(err)));
         }
 
-        // A rule that reads as a lockdown but is true for every caller compiles
-        // to a grant. Report it without booting a server.
-        warnOnAnonymousGrants(collections as never);
-
         const drift = await checkPolicyDrift(pool as never, collections);
         logger.info("");
         if (hasDrift(drift)) {

package/src/schema/doctor.ts

@@ -37,7 +37,7 @@ export type IssueSeverity = "error" | "warning" | "info";
 
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
     table?: string;
     column?: string;
     expected?: string;
@@ -61,29 +61,19 @@ export function getExpectedColumnType(prop: Property): string | null {
             const sp = prop as StringProperty;
             if (sp.enum) return "USER-DEFINED"; // pgEnum → USER-DEFINED in information_schema
             if ("isId" in sp && sp.isId === "uuid") return "uuid";
-            if (sp.columnType === "uuid") return "uuid";
-            // A markdown/multiline string compiles to `text`, not varchar — the
-            // generator treats those UI hints as column-type signals, so the
-            // expectation here must too or every such column reads as drift.
-            if (sp.columnType === "text" || sp.ui?.markdown || sp.ui?.multiline) return "text";
+            if (sp.columnType === "text") return "text";
             if (sp.columnType === "char") return "character";
             return "character varying";
         }
         case "number": {
             const np = prop as NumberProperty;
-            if (np.columnType) {
-                // The generator passes any columnType straight through to drizzle,
-                // so mirror that rather than enumerating a subset (which reported
-                // drift for anything unlisted, e.g. smallint). Serial types are
-                // integers with a sequence default; information_schema reports the
-                // underlying width.
-                const serialWidths: Record<string, string> = {
-                    serial: "integer",
-                    bigserial: "bigint",
-                    smallserial: "smallint"
-                };
-                return serialWidths[np.columnType] ?? np.columnType;
-            }
+            if (np.columnType === "double precision") return "double precision";
+            if (np.columnType === "real") return "real";
+            if (np.columnType === "bigint") return "bigint";
+            if (np.columnType === "serial") return "integer"; // serial is integer under the hood
+            if (np.columnType === "bigserial") return "bigint";
+            if (np.columnType === "integer") return "integer";
+            if (np.columnType === "numeric") return "numeric";
             if (np.validation?.integer || ("isId" in np && np.isId)) return "integer";
             return "numeric";
         }
@@ -211,18 +201,15 @@ export async function checkCollectionsVsSdk(
 ): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
     const issues: DoctorIssue[] = [];
 
-    // The typed SDK is opt-in — nothing in a scaffolded project imports it until
-    // you choose to. A project that never generated one isn't drifting, so report
-    // it as information rather than a warning; otherwise `doctor` can never come
-    // back clean on a fresh project and users learn to ignore its output.
+    // Check if SDK file exists
     if (!fs.existsSync(sdkFilePath)) {
         issues.push({
-            severity: "info",
-            category: "sdk_not_generated",
-            message: "Typed SDK not generated (optional).",
-            fix: "Run `rebase generate-sdk` if you want typed collection access"
+            severity: "warning",
+            category: "sdk_stale",
+            message: `Generated SDK typedefs file does not exist at "${sdkFilePath}".`,
+            fix: "Run `rebase generate-sdk`"
         });
-        return { passed: true,
+        return { passed: false,
 issues };
     }
 
@@ -644,15 +631,11 @@ export function renderReport(report: DoctorReport): void {
 }
 
 function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): void {
-    const errorCount = issues.filter((i) => i.severity === "error").length;
-    const warnCount = issues.filter((i) => i.severity === "warning").length;
-    const infoIssues = issues.filter((i) => i.severity === "info");
-
-    // Informational notes don't make a phase unhealthy, so key the header off
-    // real problems rather than `passed` alone.
-    if (errorCount === 0 && warnCount === 0) {
+    if (passed) {
         logger.info(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
     } else {
+        const errorCount = issues.filter((i) => i.severity === "error").length;
+        const warnCount = issues.filter((i) => i.severity === "warning").length;
         const parts: string[] = [];
         if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
         if (warnCount > 0) parts.push(`${warnCount} warning${warnCount > 1 ? "s" : ""}`);
@@ -660,14 +643,7 @@ function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): voi
     }
     logger.info("");
 
-    // Notes render as a quiet one-liner, not a full drift box.
-    for (const issue of infoIssues) {
-        const fixPart = issue.fix ? chalk.gray(` — ${issue.fix}`) : "";
-        logger.info(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
-        logger.info("");
-    }
-
-    for (const issue of issues.filter((i) => i.severity !== "info")) {
+    for (const issue of issues) {
         const severityIcon = issue.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
         const categoryLabel = formatCategory(issue.category);
         logger.info(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
@@ -698,8 +674,7 @@ function formatCategory(cat: DoctorIssue["category"]): string {
         missing_enum: "Missing Enum",
         enum_value_mismatch: "Enum Value Mismatch",
         missing_foreign_key: "Missing Foreign Key",
-        sdk_stale: "Stale SDK Types",
-        sdk_not_generated: "SDK Types Not Generated"
+        sdk_stale: "Stale SDK Types"
     };
     return labels[cat];
 }

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,8 +1,10 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
-import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
+import { toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "crypto";
 import { logger } from "@rebasepro/server";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -313,6 +315,22 @@ const wrapSql = (clause: string): string => `sql\`${clause}\``;
 /**
  * Generates a deterministic hash based on the rule configuration.
  */
+const getPolicyNameHash = (rule: SecurityRule): string => {
+    const data = JSON.stringify({
+        a: rule.access,
+        m: rule.mode,
+        op: rule.operation,
+        ops: rule.operations?.slice().sort(),
+        own: rule.ownerField,
+        rol: rule.roles?.slice().sort(),
+        pg: rule.pgRoles?.slice().sort(),
+        u: rule.using,
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
+    });
+    return createHash("sha1").update(data).digest("hex").substring(0, 7);
+};
 
 /**
  * Generates Drizzle pgPolicy() calls from a declarative SecurityRule definition.
@@ -333,11 +351,15 @@ const generatePolicyCode = (collection: CollectionConfig, rule: SecurityRule, in
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const policyNames = getPolicyNamesForRule(rule, tableName);
+    const ruleHash = getPolicyNameHash(rule);
 
     // Generate one pgPolicy per operation
     return ops.map((op, opIdx) => {
-        return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
+        const policyName = rule.name
+            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
+            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
+
+        return generateSinglePolicyCode(collection, rule, op, policyName, resolveCollection);
     }).join("");
 };
 
@@ -545,10 +567,6 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -605,22 +623,9 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ([\n";
-            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
-
-            // Junctions are generated tables like any other: locked by default,
-            // with derived policies (reads follow the endpoints, writes follow
-            // the declaring side's update rules). RLS is enabled regardless of
-            // policy stripping — a bare junction must default-deny, not fail open.
-            const junctionSpec = junctionSpecs.get(baseTableName);
-            if (!stripPolicies && junctionSpec) {
-                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
-                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
-                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
-                });
-            }
-            schemaContent += "])).enableRLS();\n\n";
+            schemaContent += "}, (table) => ({\n";
+            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
+            schemaContent += "}));\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";