@everystack/cli 0.3.3 → 0.3.4

package/src/cli/commands/security-probe.ts

@@ -0,0 +1,213 @@
+/**
+ * `everystack security:probe --stage <name>` — live black-box security probe.
+ *
+ * Config-free. Two instruments meeting in the middle:
+ *   1. White-box introspection: reads the live DB catalog (grants, columns, RLS)
+ *      via the ops-Lambda `db:query` path to learn what the deployed app exposes.
+ *   2. Black-box probing: hits the deployed router URL and asserts the surface
+ *      behaves safely against that discovered truth.
+ *
+ * No fixtures, no config — the plan is derived from the database itself. When the
+ * v3 Model lands, the plan source moves from catalog to the Model's abilities and
+ * this command becomes the generated `diff(declared, live)` red-team.
+ */
+
+import {
+  buildProbePlan,
+  assessRlsCoverage,
+  assessColumnExposure,
+  assessLimitCap,
+  assessInjection,
+  assessEmbedDepth,
+  summarizeProbe,
+  type Catalog,
+  type CatalogTable,
+  type CatalogColumn,
+  type CatalogGrant,
+  type ProbeResult,
+} from '../security-probe.js';
+import { resolveConfig, opsFunction } from '../config.js';
+import { invokeAction } from '../aws.js';
+import { step, info, fail, success, warn } from '../output.js';
+
+const SYS_SCHEMAS = "('pg_catalog','information_schema','pg_toast')";
+
+const TABLES_SQL = `
+  SELECT n.nspname AS schema, c.relname AS "table", c.relrowsecurity AS rls_enabled
+  FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+  WHERE c.relkind = 'r' AND n.nspname NOT IN ${SYS_SCHEMAS}`;
+
+const COLUMNS_SQL = `
+  SELECT table_schema AS schema, table_name AS "table", column_name AS "column", data_type
+  FROM information_schema.columns
+  WHERE table_schema NOT IN ${SYS_SCHEMAS}`;
+
+const GRANTS_SQL = `
+  SELECT table_schema AS schema, table_name AS "table", grantee, privilege_type AS privilege
+  FROM information_schema.role_table_grants
+  WHERE table_schema NOT IN ${SYS_SCHEMAS}`;
+
+async function catalogQuery(region: string, fn: string, sql: string): Promise<any[]> {
+  const result: any = await invokeAction(region, fn, 'db:query', { sql });
+  if (result?.error) throw new Error(`Catalog query failed: ${result.error}`);
+  return result?.rows ?? [];
+}
+
+function toCatalog(tables: any[], columns: any[], grants: any[]): Catalog {
+  return {
+    tables: tables.map(
+      (r): CatalogTable => ({ schema: r.schema, table: r.table, rlsEnabled: r.rls_enabled === true }),
+    ),
+    columns: columns.map(
+      (r): CatalogColumn => ({ schema: r.schema, table: r.table, column: r.column, dataType: r.data_type }),
+    ),
+    grants: grants.map(
+      (r): CatalogGrant => ({ schema: r.schema, table: r.table, grantee: r.grantee, privilege: r.privilege }),
+    ),
+  };
+}
+
+interface GetResult {
+  status: number;
+  rows: Record<string, unknown>[];
+}
+
+async function apiGet(base: string, pathAndQuery: string): Promise<GetResult> {
+  const res = await fetch(`${base}${pathAndQuery}`, { redirect: 'follow' });
+  let rows: Record<string, unknown>[] = [];
+  try {
+    const body = await res.json();
+    if (Array.isArray(body)) rows = body;
+    else if (Array.isArray((body as any)?.data)) rows = (body as any).data;
+  } catch {
+    // non-JSON body
+  }
+  return { status: res.status, rows };
+}
+
+export interface ProbeRunOptions {
+  region: string;
+  opsFn: string;
+  base: string;
+  maxLimit?: number;
+}
+
+/** Result-producing core, shared by the command wrapper and the `audit` capstone. */
+export async function runSecurityProbe(opts: ProbeRunOptions): Promise<ProbeResult[]> {
+  const { region, opsFn, base } = opts;
+
+  step('Introspecting database catalog (grants, columns, RLS)...');
+  const [t, c, g] = await Promise.all([
+    catalogQuery(region, opsFn, TABLES_SQL),
+    catalogQuery(region, opsFn, COLUMNS_SQL),
+    catalogQuery(region, opsFn, GRANTS_SQL),
+  ]);
+  const plan = buildProbePlan(toCatalog(t, c, g));
+  info(
+    `Surface: ${plan.anonReadableTables.length} anon-readable, ${plan.authReadableTables.length} auth-readable table(s).`,
+  );
+
+  const results: ProbeResult[] = [];
+  const maxLimit = opts.maxLimit ?? 10000;
+
+  // 1. RLS coverage — pure, from the catalog (no HTTP).
+  results.push(...assessRlsCoverage(plan));
+
+  // 2. Sensitive-column exposure — anon GET each readable table that has them.
+  step('Probing anon column exposure...');
+  for (const table of plan.anonReadableTables) {
+    const sensitive = plan.sensitiveColumns[table];
+    if (!sensitive?.length) continue;
+    try {
+      const { status, rows } = await apiGet(base, `/api/${table}?limit=5`);
+      if (status === 404) {
+        warn(`/api/${table} → 404 (route naming differs from DB table; skipped)`);
+        continue;
+      }
+      results.push(assessColumnExposure(table, rows, sensitive));
+    } catch (err: any) {
+      warn(`column-exposure ${table} inconclusive: ${err.message}`);
+    }
+  }
+
+  // 3/4/5 — pick a representative anon-readable table for the protocol probes.
+  const probeTable = plan.anonReadableTables[0];
+  if (probeTable) {
+    step(`Probing query protocol on /api/${probeTable}...`);
+    try {
+      const cap = await apiGet(base, `/api/${probeTable}?limit=999999999`);
+      results.push(assessLimitCap(cap.status, cap.rows.length, maxLimit));
+    } catch (err: any) {
+      warn(`limit-cap inconclusive: ${err.message}`);
+    }
+
+    const jsonCol = plan.jsonbColumns[probeTable]?.[0];
+    if (jsonCol) {
+      try {
+        const payload = encodeURIComponent("' OR '1'='1");
+        const inj = await apiGet(base, `/api/${probeTable}?${jsonCol}->>x=eq.${payload}`);
+        results.push(assessInjection(inj.status));
+      } catch (err: any) {
+        warn(`json-path-injection inconclusive: ${err.message}`);
+      }
+    }
+
+    try {
+      const deep = 'select=*,a(*,b(*,c(*,d(*,e(*)))))';
+      const depth = await apiGet(base, `/api/${probeTable}?${deep}`);
+      results.push(assessEmbedDepth(depth.status));
+    } catch (err: any) {
+      warn(`embed-depth inconclusive: ${err.message}`);
+    }
+  }
+
+  return results;
+}
+
+/** Print probe results; returns the number of failures (for exit-code logic). */
+export function reportProbeResults(results: ProbeResult[]): number {
+  for (const r of results) {
+    const tag = `[${r.severity}]`;
+    if (r.pass) success(`${tag} ${r.name} — ${r.detail}`);
+    else fail(`${tag} ${r.name} — ${r.detail}`);
+  }
+  const s = summarizeProbe(results);
+  console.log('');
+  const summary = `security:probe — ${s.pass} passed, ${s.fail} failed (${s.critical} critical)`;
+  if (s.fail > 0) fail(summary);
+  else success(summary);
+  return s.fail;
+}
+
+export async function securityProbeCommand(flags: Record<string, string>): Promise<void> {
+  step('Resolving deployed config...');
+  let config;
+  try {
+    config = await resolveConfig(flags.stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+  const base = (flags.host || config.baseUrl || '').replace(/\/+$/, '');
+  if (!base) {
+    fail('No router URL to probe. Pass --host or ensure the stage has a deployed URL.');
+    process.exit(1);
+  }
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}, URL: ${base}`);
+
+  let results: ProbeResult[];
+  try {
+    results = await runSecurityProbe({
+      region: config.region,
+      opsFn: opsFunction(config),
+      base,
+      maxLimit: flags.maxLimit ? Number(flags.maxLimit) : undefined,
+    });
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  console.log('');
+  process.exit(reportProbeResults(results) > 0 ? 1 : 0);
+}

package/src/cli/commands/security.ts

@@ -104,10 +104,18 @@ async function runCatalogAudit(flags: Record<string, string>, waivers: Waivers):
   step('Resolving deployed config...');
   const config = await resolveConfig(flags.stage);
   info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+  return auditDeployedSql(config.region, opsFunction(config), waivers);
+}
 
+/** Catalog-audit core, shared by the command and the `audit` capstone. */
+export async function auditDeployedSql(
+  region: string,
+  opsFn: string,
+  waivers: Waivers = {},
+): Promise<AuditReport> {
   step('Introspecting database catalog (functions + relations)...');
-  const fnRows = await catalogQuery(config.region, opsFunction(config), FUNCTIONS_SQL);
-  const relRows = await catalogQuery(config.region, opsFunction(config), RELATIONS_SQL);
+  const fnRows = await catalogQuery(region, opsFn, FUNCTIONS_SQL);
+  const relRows = await catalogQuery(region, opsFn, RELATIONS_SQL);
 
   const functions: FunctionDescriptor[] = fnRows.map(catalogFunctionToDescriptor);
   const views: ViewDescriptor[] = relRows.map(catalogRelationToDescriptor);
@@ -125,7 +133,7 @@ async function catalogQuery(region: string, fn: string, sql: string): Promise<an
 // Waivers + reporting.
 // ---------------------------------------------------------------------------
 
-async function loadWaivers(flag?: string): Promise<Waivers> {
+export async function loadWaivers(flag?: string): Promise<Waivers> {
   const candidates = flag ? [flag] : WAIVER_FILES;
   for (const candidate of candidates) {
     const abs = path.resolve(candidate);
@@ -141,7 +149,7 @@ async function loadWaivers(flag?: string): Promise<Waivers> {
   return {};
 }
 
-function printReport(report: AuditReport, instrument: 'static' | 'catalog'): void {
+export function printReport(report: AuditReport, instrument: 'static' | 'catalog'): void {
   const reds = [
     ...report.functions.filter((f) => f.severity === 'red'),
     ...report.views.filter((v) => v.severity === 'red'),

package/src/cli/index.ts

@@ -21,6 +21,10 @@ import { analyzeSSRCommand } from './commands/analyze.js';
 import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs.js';
 import { secretsCommand } from './commands/secrets.js';
 import { securityAuditCommand } from './commands/security.js';
+import { securityProbeCommand } from './commands/security-probe.js';
+import { bundleAnalyzeCommand, bundleAuditCommand } from './commands/bundle.js';
+import { auditLighthouseCommand } from './commands/lighthouse.js';
+import { auditCommand } from './commands/audit.js';
 import { fail } from './output.js';
 
 const args = process.argv.slice(2);
@@ -206,6 +210,25 @@ async function main() {
     case 'security:audit':
       await securityAuditCommand(flags);
       break;
+    case 'security:probe':
+      await securityProbeCommand(flags);
+      break;
+    case 'bundle:analyze': {
+      const positional = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+      await bundleAnalyzeCommand(positional, flags);
+      break;
+    }
+    case 'audit':
+      await auditCommand(flags);
+      break;
+    case 'audit:lighthouse':
+      await auditLighthouseCommand(flags);
+      break;
+    case 'bundle:audit': {
+      const positional = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+      await bundleAuditCommand(positional, flags);
+      break;
+    }
     case 'secrets': {
       // secrets <subcommand> [positional...] [--flags]
       // Extract positional args: everything after subcommand that isn't a flag or flag value
@@ -262,6 +285,11 @@ Usage:
   everystack status            [--stage <name>] [--hours <n>]  Platform health: CDN, Lambda, rollup summary
   everystack security:audit    [--dir <path>] [--config <file>]  Static scan of migration SQL (pre-merge gate)
   everystack security:audit    --stage <name> [--config <file>]  Live catalog scan of a deployed stage (post-deploy)
+  everystack security:probe    --stage <name> [--host <url>]  Live black-box probe: introspects RLS/grants, then tests the deployed surface (RLS coverage, column exposure, injection, limit cap, embed depth)
+  everystack audit             --stage <name> [--host <url>] [--dir <export>] [--lighthouse]  Capstone: security:audit + security:probe + bundle:audit (+ optional lighthouse), combined report + exit code (CI gate); --dir adds the weight/size gate over a local export
+  everystack bundle:analyze    [dir]            Client web-bundle size + composition (run after \`expo export -p web --source-maps\`)
+  everystack audit:lighthouse  [--stage <name>] [--host <url>] [--runs 3] [--path /] [--json out.json]  Mobile Lighthouse (perf/a11y/bp/seo), median over N runs
+  everystack bundle:audit      [url|--dir <export>] [--stage <name>] [--values-from <.env>] [--leak-only] [--max-file-mb N] [--max-total-mb N] [--max-js-mb N] [--max-data-mb N]  Audit a bundle for leaked secrets AND weight (oversized assets, data that belongs in the DB, JS bloat). A URL/stage weighs the remote bundle (assets sized via HEAD, no download); --dir scans a local export; --leak-only skips the weight gate
   everystack certs:generate    [--output ./certs]
   everystack certs:configure   [--input ./certs] [--keyid main]
   everystack cache:purge       [--stage <name>]                  Bust all cached content (global epoch)

package/src/cli/lighthouse.ts

@@ -0,0 +1,155 @@
+/**
+ * Lighthouse audit — pure, Lighthouse-free parsing/aggregation logic for
+ * `everystack audit:lighthouse`.
+ *
+ * Why N runs: the category scores are stable but Performance swings run-to-run
+ * because LCP does under throttled-mobile simulation. A single run can read 92
+ * or 65. We run each host several times and report the DISTRIBUTION (median +
+ * min/max) — the median is the honest number, the spread shows how noisy LCP is.
+ *
+ * Measurement rule (in the command): warm the CloudFront edge first, then
+ * measure WITHOUT a cache-buster, so we score the real-user warm-HTML path, not
+ * a pessimistic cold-origin SSR render.
+ *
+ * Config-free: the target URL comes from the deployed SST outputs (or --host),
+ * never a hand-maintained env map.
+ */
+
+export const CATEGORIES = ['performance', 'accessibility', 'best-practices', 'seo'] as const;
+export const METRICS = [
+  'first-contentful-paint',
+  'largest-contentful-paint',
+  'total-blocking-time',
+  'cumulative-layout-shift',
+  'speed-index',
+] as const;
+
+export type Category = (typeof CATEGORIES)[number];
+export type Metric = (typeof METRICS)[number];
+
+export interface LhAudit {
+  title: string;
+  score: number | null;
+  numericValue?: number;
+  scoreDisplayMode?: string;
+}
+
+export interface LhReport {
+  categories: Record<string, { score: number; auditRefs: { id: string }[] }>;
+  audits: Record<string, LhAudit>;
+}
+
+export interface ExtractedRun {
+  scores: Record<string, number>; // category → 0..100
+  metrics: Record<string, number>; // metric → numericValue
+  imperfect: { id: string; title: string; cat: string }[];
+}
+
+export interface Aggregate {
+  scores: Record<string, number[]>;
+  metrics: Record<string, number[]>;
+  failing: { id: string; title: string; cat: string; count: number }[];
+  noindex: boolean;
+}
+
+export function median(xs: number[]): number {
+  const s = [...xs].sort((a, b) => a - b);
+  const m = Math.floor(s.length / 2);
+  return s.length % 2 ? s[m] : Math.round((s[m - 1] + s[m]) / 2);
+}
+
+/** Pull scores, metrics, and imperfect audits out of one Lighthouse report. */
+export function extractRun(report: LhReport): ExtractedRun {
+  const scores: Record<string, number> = {};
+  const metrics: Record<string, number> = {};
+  const imperfect: { id: string; title: string; cat: string }[] = [];
+
+  for (const c of CATEGORIES) {
+    scores[c] = Math.round((report.categories[c]?.score ?? 0) * 100);
+  }
+  for (const m of METRICS) {
+    metrics[m] = report.audits[m]?.numericValue ?? 0;
+  }
+  for (const c of CATEGORIES) {
+    for (const ref of report.categories[c]?.auditRefs ?? []) {
+      const au = report.audits[ref.id];
+      if (au && au.score !== null && au.score < 1 && au.scoreDisplayMode !== 'informative') {
+        imperfect.push({ id: ref.id, title: au.title, cat: c });
+      }
+    }
+  }
+  return { scores, metrics, imperfect };
+}
+
+/** Aggregate the per-run extracts into score/metric distributions + flags. */
+export function aggregate(runs: ExtractedRun[]): Aggregate {
+  const scores: Record<string, number[]> = Object.fromEntries(CATEGORIES.map((c) => [c, []]));
+  const metrics: Record<string, number[]> = Object.fromEntries(METRICS.map((m) => [m, []]));
+  const failingMap = new Map<string, { title: string; cat: string; count: number }>();
+  let noindex = false;
+
+  for (const run of runs) {
+    for (const c of CATEGORIES) scores[c].push(run.scores[c] ?? 0);
+    for (const m of METRICS) metrics[m].push(run.metrics[m] ?? 0);
+    for (const imp of run.imperfect) {
+      if (imp.id === 'is-crawlable') noindex = true;
+      const e = failingMap.get(imp.id) || { title: imp.title, cat: imp.cat, count: 0 };
+      e.count++;
+      failingMap.set(imp.id, e);
+    }
+  }
+
+  const failing = [...failingMap.entries()]
+    .map(([id, e]) => ({ id, ...e }))
+    .sort((a, b) => b.count - a.count);
+  return { scores, metrics, failing, noindex };
+}
+
+/** extractRun + aggregate over a set of raw reports. */
+export function summarize(reports: LhReport[]): Aggregate {
+  return aggregate(reports.map(extractRun));
+}
+
+function fmtMs(v: number): string {
+  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${Math.round(v)}ms`;
+}
+
+export function formatLighthouseReport(url: string, runs: number, agg: Aggregate): string[] {
+  const lines: string[] = [];
+  lines.push('='.repeat(64));
+  lines.push(`${url}   (${runs} run${runs === 1 ? '' : 's'})`);
+  lines.push('='.repeat(64));
+  lines.push('Category        median   runs');
+  for (const c of CATEGORIES) {
+    const xs = agg.scores[c];
+    const spread = xs.length > 1 ? `  [${Math.min(...xs)}–${Math.max(...xs)}]` : '';
+    lines.push(`  ${c.padEnd(14)} ${String(median(xs)).padStart(3)}     ${xs.join(' ')}${spread}`);
+  }
+  lines.push('');
+  lines.push('Metric                  median        spread');
+  for (const m of METRICS) {
+    const xs = agg.metrics[m];
+    const cls = m === 'cumulative-layout-shift';
+    const f = cls ? (v: number) => v.toFixed(3) : fmtMs;
+    lines.push(`  ${m.padEnd(24)} ${f(median(xs)).padStart(7)}   ${f(Math.min(...xs))}–${f(Math.max(...xs))}`);
+  }
+  if (agg.failing.length) {
+    lines.push('');
+    lines.push('Imperfect audits (count = runs flagged):');
+    for (const e of agg.failing) {
+      const note =
+        e.id === 'is-crawlable'
+          ? '  ← expected when the stage is noindex (true SEO only on the indexable domain)'
+          : '';
+      lines.push(`  [${e.cat}] ${e.id} (${e.count}/${runs}) — ${e.title}${note}`);
+    }
+  }
+  if (agg.noindex) {
+    lines.push('');
+    lines.push(
+      'NOTE: is-crawlable fails because this stage is noindex (robots Disallow: /).',
+    );
+    lines.push('      That suppresses SEO ~20pts. Re-measure the indexable production domain for the true score.');
+  }
+  return lines;
+}

package/src/cli/security-probe.ts

@@ -0,0 +1,243 @@
+/**
+ * Live security probe — pure plan-builder + assertion engine for
+ * `everystack security:probe`.
+ *
+ * Config-free by INTROSPECTION: the command reads the live DB catalog (grants,
+ * columns, RLS) through the ops-Lambda `db:query` path that `security:audit
+ * --stage` already uses, and this module turns that catalog into a ProbePlan —
+ * which tables are anon/auth-readable, which columns are sensitive, where RLS is
+ * off. The HTTP probes then test the deployed surface against that discovered
+ * truth. Nothing is hand-declared.
+ *
+ * Forward path: when the v3 Model lands, the Model's `abilities` become the
+ * oracle and the same assertions become `diff(declared, live)` — this engine is
+ * reused unchanged; only the source of the plan moves from catalog to Model.
+ */
+
+// --- Catalog shapes (rows returned by the introspection SQL) ----------------
+
+export interface CatalogColumn {
+  schema: string;
+  table: string;
+  column: string;
+  dataType: string;
+}
+
+export interface CatalogGrant {
+  schema: string;
+  table: string;
+  grantee: string; // 'anon' | 'authenticated' | 'PUBLIC' | ...
+  privilege: string; // 'SELECT' | 'INSERT' | ...
+}
+
+export interface CatalogTable {
+  schema: string;
+  table: string;
+  rlsEnabled: boolean;
+}
+
+export interface Catalog {
+  tables: CatalogTable[];
+  columns: CatalogColumn[];
+  grants: CatalogGrant[];
+}
+
+// --- Universal sensitive-column heuristic (app-agnostic) --------------------
+
+const SENSITIVE_PATTERNS: RegExp[] = [
+  /pass(word)?/i,
+  /secret/i,
+  /(^|_)token$/i,
+  /(^|_)hash$/i,
+  /salt/i,
+  /(^|_)key$/i,
+  /api[_-]?key/i,
+  /private[_-]?key/i,
+  /stripe/i,
+  /session[_-]?id/i,
+  /refresh[_-]?token/i,
+  /reset[_-]?password/i,
+  /(^|_)ip(_address)?$/i,
+  /sign_in_ip/i,
+  /distinct_id/i,
+  /(^|_)otp(_|$)/i,
+];
+
+export function isSensitiveColumn(name: string): boolean {
+  return SENSITIVE_PATTERNS.some((re) => re.test(name));
+}
+
+// --- Probe plan -------------------------------------------------------------
+
+export interface ProbePlan {
+  anonReadableTables: string[];
+  authReadableTables: string[];
+  sensitiveColumns: Record<string, string[]>; // table → sensitive columns
+  jsonbColumns: Record<string, string[]>;
+  tablesWithoutRls: string[]; // readable tables with RLS disabled
+  userTable: string | null; // most-sensitive table (heuristic target)
+}
+
+const ANON_GRANTEES = new Set(['anon', 'PUBLIC', 'public']);
+
+export function buildProbePlan(catalog: Catalog): ProbePlan {
+  const selectGrant = (grantee: (g: string) => boolean): Set<string> => {
+    const s = new Set<string>();
+    for (const g of catalog.grants) {
+      if (g.privilege.toUpperCase() === 'SELECT' && grantee(g.grantee)) {
+        s.add(g.table);
+      }
+    }
+    return s;
+  };
+  const anonReadable = selectGrant((g) => ANON_GRANTEES.has(g));
+  const authReadable = selectGrant((g) => g === 'authenticated');
+
+  const sensitiveColumns: Record<string, string[]> = {};
+  const jsonbColumns: Record<string, string[]> = {};
+  for (const c of catalog.columns) {
+    if (isSensitiveColumn(c.column)) {
+      (sensitiveColumns[c.table] ||= []).push(c.column);
+    }
+    if (/json/i.test(c.dataType)) {
+      (jsonbColumns[c.table] ||= []).push(c.column);
+    }
+  }
+
+  const rlsByTable = new Map(catalog.tables.map((t) => [t.table, t.rlsEnabled]));
+  const readable = new Set([...anonReadable, ...authReadable]);
+  const tablesWithoutRls = [...readable].filter((t) => rlsByTable.get(t) === false).sort();
+
+  // Heuristic user-table target: the readable table with the most sensitive cols.
+  let userTable: string | null = null;
+  let max = 0;
+  for (const t of readable) {
+    const n = (sensitiveColumns[t] || []).length;
+    if (n > max) {
+      max = n;
+      userTable = t;
+    }
+  }
+
+  return {
+    anonReadableTables: [...anonReadable].sort(),
+    authReadableTables: [...authReadable].sort(),
+    sensitiveColumns,
+    jsonbColumns,
+    tablesWithoutRls,
+    userTable,
+  };
+}
+
+// --- Probe assertions (pure; over HTTP responses) ---------------------------
+
+export type Severity = 'critical' | 'high' | 'medium';
+
+export interface ProbeResult {
+  id: string;
+  name: string;
+  severity: Severity;
+  pass: boolean;
+  detail: string;
+}
+
+/** Readable tables MUST have RLS — without it, the JS role map is the only guard. */
+export function assessRlsCoverage(plan: ProbePlan): ProbeResult[] {
+  if (plan.tablesWithoutRls.length === 0) {
+    return [
+      {
+        id: 'rls-coverage',
+        name: 'RLS enabled on all client-readable tables',
+        severity: 'critical',
+        pass: true,
+        detail: `${plan.anonReadableTables.length + plan.authReadableTables.length} readable table(s), all RLS-protected`,
+      },
+    ];
+  }
+  return plan.tablesWithoutRls.map((t) => ({
+    id: `rls-coverage:${t}`,
+    name: `RLS on ${t}`,
+    severity: 'critical' as const,
+    pass: false,
+    detail: `${t} is client-readable but has ROW LEVEL SECURITY disabled — every row is exposed`,
+  }));
+}
+
+/** An anon GET response must not contain sensitive column values. */
+export function assessColumnExposure(
+  table: string,
+  rows: Record<string, unknown>[],
+  sensitiveCols: string[],
+): ProbeResult {
+  const leaked = new Set<string>();
+  for (const row of rows) {
+    for (const col of sensitiveCols) {
+      if (col in row && row[col] !== null && row[col] !== undefined) leaked.add(col);
+    }
+  }
+  return {
+    id: `column-exposure:${table}`,
+    name: `No sensitive columns exposed on ${table}`,
+    severity: 'critical',
+    pass: leaked.size === 0,
+    detail:
+      leaked.size === 0
+        ? `${sensitiveCols.length} sensitive column(s) withheld`
+        : `exposed sensitive column(s): ${[...leaked].join(', ')}`,
+  };
+}
+
+/** ?limit must be capped — an unbounded result set is a DoS / exfil amplifier. */
+export function assessLimitCap(
+  status: number,
+  returnedCount: number,
+  maxLimit = 10000,
+): ProbeResult {
+  const pass = status === 400 || returnedCount <= maxLimit;
+  return {
+    id: 'limit-cap',
+    name: 'Unbounded ?limit is rejected or clamped',
+    severity: 'medium',
+    pass,
+    detail: pass
+      ? `capped (status ${status}, ${returnedCount} rows)`
+      : `returned ${returnedCount} rows (> ${maxLimit}) — no cap`,
+  };
+}
+
+/** A crafted JSON-path filter must not reach the DB (500) — 400/empty-200 is safe. */
+export function assessInjection(status: number): ProbeResult {
+  const pass = status < 500;
+  return {
+    id: 'json-path-injection',
+    name: 'JSON-path injection payload is rejected, not executed',
+    severity: 'high',
+    pass,
+    detail: pass ? `safe (status ${status})` : `status ${status} — payload reached the database`,
+  };
+}
+
+/** A deeply nested embed must be rejected (400), not executed or timed out. */
+export function assessEmbedDepth(status: number): ProbeResult {
+  const pass = status === 400 || status === 414;
+  return {
+    id: 'embed-depth',
+    name: 'Over-deep relation embed is rejected',
+    severity: 'medium',
+    pass,
+    detail: pass ? `rejected (status ${status})` : `status ${status} — deep embed not capped`,
+  };
+}
+
+export function summarizeProbe(results: ProbeResult[]): {
+  pass: number;
+  fail: number;
+  critical: number;
+} {
+  const failed = results.filter((r) => !r.pass);
+  return {
+    pass: results.filter((r) => r.pass).length,
+    fail: failed.length,
+    critical: failed.filter((r) => r.severity === 'critical').length,
+  };
+}