@guard-rail/core 0.9.1 → 0.10.0

package/dist/cli/doctor.js

@@ -0,0 +1,911 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  copyFileSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync
+} from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
+import { GR_SCHEMA, GR_MEMBERS_TABLE } from "../core/defs.js";
+const NEXT_MIN_PATCHED = {
+  15: [15, 5, 28],
+  16: [16, 4, 1]
+};
+const SECURITY_HEADERS_BLOCK = `  // Baseline response headers. frame-ancestors keeps another site from framing
+  // this one (the editing toolbar included) in a clickjacking overlay. A full
+  // Content-Security-Policy is specific to what your pages load, so add yours
+  // alongside it.
+  async headers() {
+    return [
+      {
+        source: "/:path*",
+        headers: [
+          { key: "Content-Security-Policy", value: "frame-ancestors 'self'" },
+          { key: "X-Frame-Options", value: "SAMEORIGIN" },
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+          { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
+          // Only honored over HTTPS; browsers ignore it on plain HTTP.
+          { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains" },
+        ],
+      },
+    ];
+  },
+`;
+const SITE_URL_ENV_NOTE = `
+# The site's public address. Every emailed invite/reset link points here, and in
+# production nothing is sent without it (links are never built from the request).
+# GUARDRAIL_SITE_URL=https://example.com
+`;
+const USAGE = `Usage:
+  guardrail-doctor [options]
+
+Checks this project's Guardrail setup. Read-only unless you ask otherwise.
+
+Options:
+  --fix              Repair what can be repaired in local files: copy missing
+                     migrations, add a GUARDRAIL_SITE_URL note to your env
+                     files, add baseline security headers to next.config.
+                     Never touches secrets or Supabase dashboard settings.
+  --push             With --fix: also run \`supabase db push\` after copying.
+  --app-url=<url>    Also check the response headers of a running copy of the
+                     site (e.g. --app-url=http://localhost:3000).
+  --e2e              Run the end-to-end suite against the database: creates a
+                     throwaway user and rows, exercises sign-in, invite claims,
+                     row-level security, the admin guard, rate limiting and
+                     storage, then deletes everything it made.
+  --yes              Don't ask before --e2e touches a non-local database.
+  --offline          Don't contact the npm registry. By default the installed
+                     versions of next, @supabase/* and @guard-rail/core are
+                     checked against its published security advisories (only
+                     package names and versions are sent, as \`pnpm audit\` does).
+  --production       Treat production-only requirements (like
+                     GUARDRAIL_SITE_URL) as failures rather than warnings.
+  --strict           Exit non-zero on warnings too.
+  --json             Print results as JSON.
+  -h, --help         This text.
+
+Reads SUPABASE_URL, SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY (or
+SERVICE_KEY) from the environment, then .env.local and .env.`;
+const results = [];
+let currentGroup = "";
+function group(name) {
+  currentGroup = name;
+}
+function record(status, title, detail, hint) {
+  results.push({ group: currentGroup, status, title, ...detail ? { detail } : {}, ...hint ? { hint } : {} });
+}
+const pass = (t, d) => record("pass", t, d);
+const warn = (t, d, h) => record("warn", t, d, h);
+const fail = (t, d, h) => record("fail", t, d, h);
+const skip = (t, d) => record("skip", t, d);
+const info = (t, d) => record("info", t, d);
+function parseFlags(argv) {
+  const flags = /* @__PURE__ */ new Set();
+  const values = {};
+  const unknown = [];
+  for (const arg of argv) {
+    const m = arg.match(/^--([^=]+)=([\s\S]*)$/);
+    if (m) {
+      values[m[1]] = m[2];
+    } else if (arg.startsWith("-")) {
+      flags.add(arg.replace(/^-+/, ""));
+    } else {
+      unknown.push(arg);
+    }
+  }
+  const known = /* @__PURE__ */ new Set(["fix", "push", "e2e", "yes", "production", "strict", "json", "offline", "help", "h"]);
+  for (const f of flags) if (!known.has(f)) unknown.push(`--${f}`);
+  for (const k of Object.keys(values)) if (k !== "app-url") unknown.push(`--${k}`);
+  return { flags, values, unknown };
+}
+function readEnvFiles(cwd) {
+  const out = {};
+  for (const file of [".env", ".env.local"]) {
+    const p = path.join(cwd, file);
+    if (!existsSync(p)) continue;
+    for (const line of readFileSync(p, "utf8").split(/\r?\n/)) {
+      const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+      if (!m) continue;
+      const value = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+      if (value) out[m[1]] = value;
+    }
+  }
+  return out;
+}
+function parseVersion(v) {
+  const m = v.match(/^(\d+)\.(\d+)\.(\d+)/);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function atLeast(v, min) {
+  for (let i = 0; i < 3; i++) {
+    if (v[i] !== min[i]) return v[i] > min[i];
+  }
+  return true;
+}
+function jwtRole(key) {
+  const parts = key.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return typeof payload.role === "string" ? payload.role : null;
+  } catch {
+    return null;
+  }
+}
+function isLocalHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+}
+function commandExists(cmd) {
+  const res = process.platform === "win32" ? spawnSync("where", [cmd]) : spawnSync("which", [cmd]);
+  return res.status === 0;
+}
+function findNextConfig(cwd) {
+  for (const name of ["next.config.ts", "next.config.mjs", "next.config.js", "next.config.cjs", "next.config.mts"]) {
+    const p = path.join(cwd, name);
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
+function bundledMigrationsDir() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.join(here, "..", "..", "supabase", "migrations");
+}
+const applied = [];
+function fixMigrations(cwd) {
+  const src = bundledMigrationsDir();
+  if (!existsSync(src)) return;
+  const dest = path.join(cwd, "supabase", "migrations");
+  mkdirSync(dest, { recursive: true });
+  const have = new Set(readdirSync(dest));
+  for (const file of readdirSync(src)) {
+    if (have.has(file)) continue;
+    copyFileSync(path.join(src, file), path.join(dest, file));
+    applied.push(`Copied supabase/migrations/${file}`);
+  }
+}
+function fixEnvNotes(cwd) {
+  for (const file of [".env.example", ".env.local"]) {
+    const p = path.join(cwd, file);
+    if (!existsSync(p)) continue;
+    const content = readFileSync(p, "utf8");
+    if (/GUARDRAIL_SITE_URL/.test(content)) continue;
+    writeFileSync(p, content.replace(/\n*$/, "\n") + SITE_URL_ENV_NOTE);
+    applied.push(`Added a GUARDRAIL_SITE_URL note to ${file}`);
+  }
+}
+const CACHE_COMPONENTS_LINE = /^[ \t]*(?:cacheComponents|partialPrefetching)\s*:\s*true\s*,?[ \t]*\r?\n/gm;
+function fixCacheComponents(cwd) {
+  const configPath = findNextConfig(cwd);
+  if (!configPath) return false;
+  const content = readFileSync(configPath, "utf8");
+  const next = content.replace(CACHE_COMPONENTS_LINE, "");
+  if (next === content) return false;
+  writeFileSync(configPath, next);
+  applied.push(`Turned off Cache Components in ${path.basename(configPath)}`);
+  return true;
+}
+function fixHeaders(cwd) {
+  const configPath = findNextConfig(cwd);
+  if (!configPath) return "none";
+  const content = readFileSync(configPath, "utf8");
+  if (/frame-ancestors|x-frame-options/i.test(content)) return "present";
+  if (/\bheaders\s*\(/.test(content)) return "manual";
+  const openers = [
+    /(const\s+nextConfig\s*(?::\s*[A-Za-z<>[\]| ]+)?=\s*\{[ \t]*\r?\n)/,
+    /(export\s+default\s*\{[ \t]*\r?\n)/,
+    /(module\.exports\s*=\s*\{[ \t]*\r?\n)/
+  ];
+  for (const re of openers) {
+    if (!re.test(content)) continue;
+    writeFileSync(configPath, content.replace(re, `$1${SECURITY_HEADERS_BLOCK}`));
+    applied.push(`Added baseline security headers to ${path.basename(configPath)}`);
+    return "patched";
+  }
+  return "manual";
+}
+async function fetchAdvisories(versions) {
+  const body = {};
+  for (const [name, v] of Object.entries(versions)) body[name] = [v];
+  if (Object.keys(body).length === 0) return {};
+  try {
+    const res = await fetch("https://registry.npmjs.org/-/npm/v1/security/advisories/bulk", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function checkProject(ctx) {
+  group("Project");
+  const pkgPath = path.join(ctx.cwd, "package.json");
+  if (!existsSync(pkgPath)) {
+    fail("No package.json here", "Run this from the root of your Next.js project.");
+    return;
+  }
+  const ownPkg = JSON.parse(readFileSync(path.join(bundledMigrationsDir(), "..", "..", "package.json"), "utf8"));
+  pass(`@guard-rail/core ${ownPkg.version}`);
+  const require2 = createRequire(pkgPath);
+  const installed = (name) => {
+    try {
+      return JSON.parse(readFileSync(require2.resolve(`${name}/package.json`), "utf8")).version;
+    } catch {
+      return void 0;
+    }
+  };
+  const nextVersion = installed("next");
+  if (!nextVersion) warn("Next.js isn't installed here", "Couldn't resolve `next` from this directory.");
+  const checked = {};
+  for (const name of ["next", "@supabase/supabase-js", "@supabase/ssr"]) {
+    const v = installed(name);
+    if (v) checked[name] = v;
+  }
+  checked["@guard-rail/core"] = ownPkg.version;
+  const advisories = ctx.offline ? null : await fetchAdvisories(checked);
+  if (advisories) {
+    let clean = 0;
+    for (const [name, version] of Object.entries(checked)) {
+      const found = advisories[name] ?? [];
+      const serious = found.filter((a) => a.severity === "critical" || a.severity === "high");
+      if (found.length === 0) {
+        clean++;
+        continue;
+      }
+      const lines = found.slice(0, 3).map((a) => `${a.severity}: ${a.title} (${a.url})`);
+      if (found.length > 3) lines.push(`\u2026and ${found.length - 3} more`);
+      (serious.length ? fail : warn)(
+        `${name} ${version} has ${found.length} known security advisor${found.length === 1 ? "y" : "ies"}`,
+        lines.join("\n      "),
+        `Upgrade: pnpm add ${name}@latest`
+      );
+    }
+    if (clean) pass(`No known security advisories for ${clean} checked package${clean === 1 ? "" : "s"}`, Object.entries(checked).filter(([n]) => (advisories[n] ?? []).length === 0).map(([n, v]) => `${n} ${v}`).join(", "));
+  } else if (nextVersion) {
+    const v = parseVersion(nextVersion);
+    const floor = v ? NEXT_MIN_PATCHED[v[0]] : void 0;
+    const why = ctx.offline ? "offline" : "the advisory service couldn't be reached";
+    if (!v) {
+      info(`Next.js ${nextVersion}`);
+    } else if (floor && !atLeast(v, floor)) {
+      fail(
+        `Next.js ${nextVersion} has known security vulnerabilities`,
+        `Releases before ${floor.join(".")} carry published advisories (checked against this tool's built-in list \u2014 ${why}).`,
+        `Upgrade: pnpm add next@latest`
+      );
+    } else if (floor) {
+      pass(`Next.js ${nextVersion}`, `Checked against this tool's built-in list (${why}); it may not know about newer advisories.`);
+    } else {
+      warn(
+        `Next.js ${nextVersion}`,
+        `This tool doesn't know the patched release for the ${v[0]}.x line (${why}).`,
+        `Make sure you're on its latest patch, or move to the current major.`
+      );
+    }
+  }
+  for (const dep of ["@supabase/supabase-js", "@supabase/ssr"]) {
+    try {
+      require2.resolve(`${dep}/package.json`);
+      pass(`${dep} installed`);
+    } catch {
+      fail(`${dep} isn't installed`, void 0, `pnpm add ${dep}`);
+    }
+  }
+}
+function checkEnvironment(ctx) {
+  group("Environment");
+  const { env } = ctx;
+  if (!ctx.url) {
+    fail("SUPABASE_URL isn't set", "Not in the environment, .env.local or .env.");
+  } else {
+    try {
+      const u = new URL(ctx.url);
+      if (u.protocol !== "https:" && u.protocol !== "http:") throw new Error();
+      if (u.protocol === "http:" && !isLocalHost(u.hostname)) {
+        warn("SUPABASE_URL uses plain http", "Use the project's https:// address.");
+      } else {
+        pass("SUPABASE_URL", u.host);
+      }
+    } catch {
+      fail("SUPABASE_URL isn't a valid URL", "Expected https://<project>.supabase.co.");
+    }
+  }
+  const anon = ctx.anonKey;
+  if (!anon) {
+    fail("SUPABASE_ANON_KEY isn't set");
+  } else {
+    const role = jwtRole(anon);
+    if (role === "service_role" || anon.startsWith("sb_secret_")) {
+      fail(
+        "SUPABASE_ANON_KEY holds the service-role (secret) key",
+        "The anon key is meant to be public; the service-role key bypasses every access rule.",
+        "Swap them: put the anon / publishable key here."
+      );
+    } else {
+      pass("SUPABASE_ANON_KEY");
+    }
+  }
+  const svc = ctx.serviceKey;
+  if (!svc) {
+    warn(
+      "No service-role key",
+      "Invites, password resets and database-backed rate limits need SUPABASE_SERVICE_ROLE_KEY (server-only)."
+    );
+  } else {
+    const role = jwtRole(svc);
+    if (role === "anon" || svc.startsWith("sb_publishable_")) {
+      fail("SUPABASE_SERVICE_ROLE_KEY holds the anon (publishable) key", void 0, "Use the service-role / secret key here.");
+    } else {
+      pass("Service-role key present");
+    }
+  }
+  const leaked = Object.keys(env).filter((k) => /^NEXT_PUBLIC_.*(SERVICE|SECRET|RESEND|PRIVATE)/i.test(k));
+  if (leaked.length) {
+    fail(
+      "Secret behind a NEXT_PUBLIC_ name",
+      `${leaked.join(", ")} would be published to every visitor's browser.`,
+      "Rename it without the NEXT_PUBLIC_ prefix and read it only in server code."
+    );
+  } else {
+    pass("No secrets behind NEXT_PUBLIC_ names");
+  }
+  const siteUrl = env.GUARDRAIL_SITE_URL;
+  if (!siteUrl) {
+    (ctx.production ? fail : warn)(
+      "GUARDRAIL_SITE_URL isn't set",
+      'Production sends no invite or password-reset emails without it \u2014 and "Forgot password?" fails silently.',
+      "Set it to your public address, e.g. https://example.com (or pass siteUrl to withGuardrail())."
+    );
+  } else {
+    try {
+      const u = new URL(siteUrl);
+      if (u.protocol !== "https:" && u.protocol !== "http:") throw new Error();
+      if (u.protocol === "http:" && !isLocalHost(u.hostname)) {
+        warn("GUARDRAIL_SITE_URL uses plain http", "Emailed links should point at an https address.");
+      } else {
+        pass("GUARDRAIL_SITE_URL", u.origin);
+      }
+    } catch {
+      fail("GUARDRAIL_SITE_URL isn't a valid http(s) URL", siteUrl);
+    }
+  }
+  const hasKey = Boolean(env.RESEND_API_KEY);
+  const hasFrom = Boolean(env.GUARDRAIL_EMAIL_FROM);
+  if (hasKey && hasFrom) {
+    pass("Resend email configured");
+  } else if (hasKey !== hasFrom) {
+    fail(
+      `${hasKey ? "GUARDRAIL_EMAIL_FROM" : "RESEND_API_KEY"} is missing`,
+      "Email through Resend needs both RESEND_API_KEY and GUARDRAIL_EMAIL_FROM."
+    );
+  } else {
+    info("No Resend settings in the environment", "Fine if you pass your own onInvite / onPasswordReset, or only use consoleEmails() in development.");
+  }
+  if (env.GUARDRAIL_SITE_ID) pass("GUARDRAIL_SITE_ID", env.GUARDRAIL_SITE_ID);
+  else info("GUARDRAIL_SITE_ID isn't set", 'Sites default to the id "default".');
+}
+function checkFiles(ctx) {
+  group("Files");
+  const src = bundledMigrationsDir();
+  const dest = path.join(ctx.cwd, "supabase", "migrations");
+  if (existsSync(src)) {
+    const shipped = readdirSync(src);
+    const have = existsSync(dest) ? new Set(readdirSync(dest)) : /* @__PURE__ */ new Set();
+    const missing = shipped.filter((f) => !have.has(f));
+    if (missing.length === 0) {
+      pass("All Guardrail migrations are in supabase/migrations/");
+    } else {
+      fail(
+        `${missing.length} migration${missing.length === 1 ? "" : "s"} not copied into supabase/migrations/`,
+        missing.join(", "),
+        "Run: pnpm exec guardrail-doctor --fix   (or guardrail-init-db)"
+      );
+    }
+  }
+  const configToml = path.join(ctx.cwd, "supabase", "config.toml");
+  if (existsSync(configToml)) {
+    const toml = readFileSync(configToml, "utf8");
+    const schemas = toml.match(/\[api\][\s\S]*?schemas\s*=\s*\[([^\]]*)\]/)?.[1] ?? "";
+    if (schemas.includes('"guardrail"')) pass('supabase/config.toml exposes the "guardrail" schema');
+    else fail(`supabase/config.toml doesn't expose the "guardrail" schema`, void 0, "Run: pnpm exec guardrail-init-db");
+  }
+  const layouts = ["app/layout.tsx", "src/app/layout.tsx", "app/layout.jsx", "src/app/layout.jsx", "app/layout.js", "src/app/layout.js"];
+  const layout = layouts.map((l) => path.join(ctx.cwd, l)).find(existsSync);
+  const wiredIn = (file) => /withGuardrail/.test(readFileSync(file, "utf8"));
+  if (!layout) {
+    skip("Root layout not found", "Looked for app/layout and src/app/layout.");
+  } else if (wiredIn(layout)) {
+    pass("Root layout uses withGuardrail()");
+  } else {
+    warn(
+      "Root layout doesn't mention withGuardrail()",
+      `${path.relative(ctx.cwd, layout)} \u2014 fine if it's wrapped where the layout is exported from another file.`
+    );
+  }
+  const configPath = findNextConfig(ctx.cwd);
+  if (!configPath) {
+    skip("next.config not found");
+  } else {
+    const content = readFileSync(configPath, "utf8");
+    if (/^[ \t]*cacheComponents\s*:\s*true/m.test(content)) {
+      fail(
+        "Cache Components is turned on",
+        "Guardrail reads the session cookie to decide what to render, which Next's Cache Components mode refuses outside <Suspense> \u2014 the site won't pass `next build`.",
+        "Run: pnpm exec guardrail-doctor --fix   (removes `cacheComponents: true` and `partialPrefetching: true`)"
+      );
+    }
+    if (/frame-ancestors|x-frame-options/i.test(content)) {
+      pass(`${path.basename(configPath)} sets anti-framing headers`);
+    } else {
+      warn(
+        `${path.basename(configPath)} sets no security headers`,
+        "Without frame-ancestors, another site can frame yours \u2014 including the editing toolbar \u2014 under a clickjacking overlay.",
+        "Run: pnpm exec guardrail-doctor --fix   (skip if your host or middleware sets them; verify with --app-url)"
+      );
+    }
+  }
+  const gitignore = path.join(ctx.cwd, ".gitignore");
+  const hasEnvFile = [".env.local", ".env"].some((f) => existsSync(path.join(ctx.cwd, f)));
+  if (hasEnvFile) {
+    const ignores = existsSync(gitignore) ? readFileSync(gitignore, "utf8") : "";
+    if (/^\s*\.env(\*|\.local|\.\*)?\s*$/m.test(ignores) || /^\s*\.env\*/m.test(ignores)) {
+      pass("Env files are gitignored");
+    } else {
+      fail(".env files aren't gitignored", "Your Supabase keys could be committed.", "Add `.env*` (and `!.env.example`) to .gitignore.");
+    }
+  }
+}
+async function loadSupabase() {
+  try {
+    return await import("@supabase/supabase-js");
+  } catch {
+    return null;
+  }
+}
+async function checkDatabase(ctx, sb) {
+  group("Database");
+  if (!ctx.url || !ctx.anonKey) {
+    skip("Skipped", "Needs SUPABASE_URL and SUPABASE_ANON_KEY.");
+    return false;
+  }
+  if (!sb) {
+    skip("Skipped", "@supabase/supabase-js isn't installed.");
+    return false;
+  }
+  const base = ctx.url.replace(/\/$/, "");
+  try {
+    const res = await fetch(`${base}/rest/v1/gr_content?select=path_key&limit=1`, {
+      headers: { apikey: ctx.anonKey, Authorization: `Bearer ${ctx.anonKey}`, "Accept-Profile": GR_SCHEMA }
+    });
+    const body = res.ok ? "" : await res.text();
+    if (res.ok) {
+      pass(`"${GR_SCHEMA}" schema is exposed and readable`);
+    } else if (/PGRST106|Invalid schema/i.test(body)) {
+      fail(
+        `The "${GR_SCHEMA}" schema isn't exposed`,
+        "PostgREST refuses requests for it.",
+        "Supabase dashboard > Settings > API > Exposed schemas: add guardrail."
+      );
+      return false;
+    } else if (/PGRST205|42P01|does not exist|schema cache/i.test(body)) {
+      fail("Guardrail's tables don't exist", "The migration hasn't been applied to this project.", "Run: pnpm exec guardrail-init-db --push");
+      return false;
+    } else if (res.status === 401 || res.status === 403) {
+      fail("The anon key was rejected", `HTTP ${res.status}`, "Check SUPABASE_ANON_KEY belongs to this project.");
+      return false;
+    } else {
+      fail("Unexpected response reading content", `HTTP ${res.status}: ${body.slice(0, 160)}`);
+      return false;
+    }
+  } catch (e) {
+    fail("Couldn't reach Supabase", e instanceof Error ? e.message : String(e), "Check SUPABASE_URL, and that the project isn't paused.");
+    return false;
+  }
+  try {
+    const res = await fetch(`${base}/auth/v1/settings`, { headers: { apikey: ctx.anonKey } });
+    if (res.ok) {
+      const s = await res.json();
+      if (s.external?.email === false) {
+        fail("Email sign-in is disabled in Supabase", void 0, "Authentication > Sign In / Providers: enable Email.");
+      } else if (s.disable_signup) {
+        pass("Public sign-ups are off");
+      } else if (s.mailer_autoconfirm) {
+        warn(
+          "Anyone can sign up, and addresses count as confirmed instantly",
+          "Someone could register an invited person's address before they do, and claim the invitation.",
+          "Authentication > Sign In / Providers > Email: turn on Confirm email (or turn off public sign-ups)."
+        );
+      } else {
+        pass("Sign-ups require a confirmed email");
+      }
+    } else {
+      skip("Couldn't read the project's sign-up settings", `HTTP ${res.status}`);
+    }
+  } catch {
+    skip("Couldn't read the project's sign-up settings");
+  }
+  if (!ctx.serviceKey) {
+    skip("Service-role checks skipped", "No service-role key to inspect the database's functions with.");
+    return true;
+  }
+  const admin = sb.createClient(ctx.url, ctx.serviceKey, { auth: { persistSession: false, autoRefreshToken: false } });
+  const gr = () => admin.schema(GR_SCHEMA);
+  for (const table of [GR_MEMBERS_TABLE, "gr_content", "gr_repeater_items", "gr_rate_limits"]) {
+    const { error: error2 } = await gr().from(table).select("*", { head: true, count: "exact" }).limit(1);
+    if (!error2) pass(`Table ${table}`);
+    else if (table === "gr_rate_limits") warn("Table gr_rate_limits is missing", "Rate limits are counted in memory until the migration is applied.", "Run: pnpm exec guardrail-init-db --push");
+    else fail(`Table ${table} isn't readable`, error2.message, "Run: pnpm exec guardrail-init-db --push");
+  }
+  const probes = [
+    ["gr_confirmed_email", {}, "Confirmed-email identity check"],
+    ["gr_claim_invite", { target_site: "doctor-probe" }, "Invite-claim function"],
+    ["gr_ensure_bucket", { target_bucket: "gr-doctor-probe" }, "Media bucket function"]
+  ];
+  for (const [fn, args, label] of probes) {
+    const { error: error2 } = await gr().rpc(fn, args);
+    if (!error2 || error2.code === "42501" || /permission denied/i.test(error2.message)) {
+      pass(label);
+    } else if (error2.code === "PGRST202" || error2.code === "42883" || /could not find the function/i.test(error2.message)) {
+      fail(`${label} is missing`, `Function ${fn}() doesn't exist.`, "Apply the latest migrations: pnpm exec guardrail-init-db --push");
+    } else {
+      pass(label);
+    }
+  }
+  const probeKey = `doctor-${randomBytes(3).toString("hex")}`;
+  const { data, error } = await gr().rpc("gr_rate_hit", { p_name: "doctor:probe", p_key: probeKey, p_limit: 1e3, p_window_seconds: 60 });
+  if (!error && data) {
+    pass("Database-backed rate limiting");
+    await gr().from("gr_rate_limits").delete().eq("bucket", `doctor:probe|${probeKey}`);
+  } else if (error?.code === "PGRST202" || error?.code === "42883") {
+    warn("Rate-limit function is missing", "Limits are counted in memory, which doesn't hold across serverless instances.", "Apply the latest migrations: pnpm exec guardrail-init-db --push");
+  } else if (error) {
+    warn("Rate-limit function failed", error.message);
+  }
+  info("Admin guard (can't delete the last admin)", "Verified by --e2e; it's a trigger, which can't be probed read-only.");
+  return true;
+}
+async function checkLiveSite(appUrl) {
+  group("Live site");
+  let res;
+  try {
+    res = await fetch(appUrl, { redirect: "manual" });
+  } catch (e) {
+    fail(`Couldn't reach ${appUrl}`, e instanceof Error ? e.message : String(e), "Is the site running?");
+    return;
+  }
+  if (res.status >= 500) {
+    fail(`${appUrl} answered HTTP ${res.status}`);
+    return;
+  }
+  pass(`${appUrl} answered HTTP ${res.status}`);
+  const h = res.headers;
+  const csp = h.get("content-security-policy") ?? "";
+  if (/frame-ancestors/i.test(csp) || h.get("x-frame-options")) pass("Can't be framed by another site");
+  else fail("Can be framed by another site", "No frame-ancestors or X-Frame-Options header.", "Add the baseline headers: pnpm exec guardrail-doctor --fix");
+  if (/nosniff/i.test(h.get("x-content-type-options") ?? "")) pass("X-Content-Type-Options: nosniff");
+  else warn("X-Content-Type-Options header missing");
+  if (h.get("referrer-policy")) pass(`Referrer-Policy: ${h.get("referrer-policy")}`);
+  else warn("Referrer-Policy header missing");
+  if (new URL(appUrl).protocol === "https:") {
+    if (h.get("strict-transport-security")) pass("Strict-Transport-Security set");
+    else warn("Strict-Transport-Security header missing", "Browsers won't insist on HTTPS for this site.");
+  } else {
+    skip("Strict-Transport-Security", "Only meaningful over HTTPS.");
+  }
+  const setCookie = typeof h.getSetCookie === "function" ? h.getSetCookie() : [];
+  const session = setCookie.filter((c) => /^sb-.*-auth-token/i.test(c));
+  if (session.length) fail("A session cookie was set for an anonymous request", session.map((c) => c.split("=")[0]).join(", "));
+}
+const TINY_PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==",
+  "base64"
+);
+async function confirmE2E(ctx, yes) {
+  const host = new URL(ctx.url).host;
+  const local = isLocalHost(new URL(ctx.url).hostname);
+  console.log(
+    `
+The end-to-end suite will create a throwaway user, a few rows and one test image on ${host},
+exercise them as a signed-in editor would, then delete everything it made.
+`
+  );
+  if (local || yes) return true;
+  if (!process.stdin.isTTY) {
+    console.log("That's not a local database. Re-run with --yes to allow it.");
+    return false;
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question(`${host} is not a local database. Continue? [y/N] `)).trim().toLowerCase();
+  rl.close();
+  return answer === "y" || answer === "yes";
+}
+async function runE2E(ctx, sb) {
+  group("End-to-end");
+  const url = ctx.url;
+  const admin = sb.createClient(url, ctx.serviceKey, { auth: { persistSession: false, autoRefreshToken: false } });
+  const user = sb.createClient(url, ctx.anonKey, { auth: { persistSession: false, autoRefreshToken: false } });
+  const anon = sb.createClient(url, ctx.anonKey, { auth: { persistSession: false, autoRefreshToken: false } });
+  const gr = (c) => c.schema(GR_SCHEMA);
+  const tag = randomBytes(4).toString("hex");
+  const siteId = `doctor-${tag}`;
+  const otherSite = `doctor-${tag}-other`;
+  const email = `guardrail-doctor-${tag}@example.com`;
+  const password = randomBytes(18).toString("base64url");
+  const objectPath = `${siteId}/doctor.png`;
+  let userId;
+  let uploaded = false;
+  let storageChecked = false;
+  const expect = (ok, title, why, hint, note) => ok ? pass(title, note) : fail(title, why, hint);
+  try {
+    const created = await admin.auth.admin.createUser({ email, password, email_confirm: true });
+    if (created.error || !created.data.user) {
+      fail("Create a test account", created.error?.message ?? "No user returned.", "Needs a valid service-role key and Email sign-in enabled.");
+      return;
+    }
+    userId = created.data.user.id;
+    pass("Create a test account (service-role key works)");
+    const link = await admin.auth.admin.generateLink({ type: "recovery", email });
+    expect(
+      !link.error && Boolean(link.data?.properties?.hashed_token),
+      "Mint a password-reset link",
+      link.error?.message,
+      "Invites and resets need this to work; check Email sign-in is enabled."
+    );
+    const seeded = await gr(admin).from(GR_MEMBERS_TABLE).insert({ site_id: siteId, email, role: "admin", status: "pending" });
+    if (seeded.error) {
+      fail("Record a pending invitation", seeded.error.message);
+      return;
+    }
+    const signedIn = await user.auth.signInWithPassword({ email, password });
+    if (signedIn.error) {
+      fail("Sign in with a password", signedIn.error.message);
+      return;
+    }
+    pass("Sign in with a password");
+    const claim = await gr(user).rpc("gr_claim_invite", { target_site: siteId });
+    const after = await gr(user).from(GR_MEMBERS_TABLE).select("status,role").eq("site_id", siteId).eq("email", email).maybeSingle();
+    expect(
+      !claim.error && after.data?.status === "active" && after.data?.role === "admin",
+      "Claim an invitation",
+      claim.error?.message ?? (after.data ? void 0 : "The membership row wasn't visible after claiming."),
+      "Apply the latest migrations: pnpm exec guardrail-init-db --push"
+    );
+    const write = await gr(user).from("gr_content").insert({
+      site_id: siteId,
+      path_key: "doctor.check",
+      type: "text",
+      value: { type: "text", text: "doctor" }
+    });
+    expect(!write.error, "Editor can save content to their site", write.error?.message);
+    const read = await gr(anon).from("gr_content").select("path_key").eq("site_id", siteId).eq("path_key", "doctor.check");
+    expect(!read.error && (read.data?.length ?? 0) === 1, "Visitors can read saved content", read.error?.message);
+    const cross = await gr(user).from("gr_content").insert({
+      site_id: otherSite,
+      path_key: "doctor.check",
+      type: "text",
+      value: { type: "text", text: "nope" }
+    });
+    expect(Boolean(cross.error), "Editor can't write to a site they don't belong to", cross.error ? void 0 : "The write was allowed \u2014 row-level security is not protecting content.");
+    const anonWrite = await gr(anon).from("gr_content").insert({
+      site_id: siteId,
+      path_key: "doctor.anon",
+      type: "text",
+      value: { type: "text", text: "nope" }
+    });
+    expect(Boolean(anonWrite.error), "Visitors can't write content", anonWrite.error ? void 0 : "An unauthenticated write was allowed.");
+    const demote = await gr(user).from(GR_MEMBERS_TABLE).update({ role: "editor" }).eq("site_id", siteId).eq("email", email);
+    expect(
+      Boolean(demote.error),
+      "The last admin can't be demoted",
+      demote.error ? void 0 : "The demotion succeeded \u2014 the admin guard trigger isn't installed.",
+      "Apply the latest migrations: pnpm exec guardrail-init-db --push"
+    );
+    await gr(admin).from(GR_MEMBERS_TABLE).upsert(
+      { site_id: siteId, email, user_id: userId, role: "admin", status: "active" },
+      { onConflict: "site_id,email" }
+    );
+    const remove = await gr(user).from(GR_MEMBERS_TABLE).delete().eq("site_id", siteId).eq("email", email);
+    const stillThere = await gr(admin).from(GR_MEMBERS_TABLE).select("email").eq("site_id", siteId).eq("email", email);
+    expect(
+      Boolean(remove.error) || (stillThere.data?.length ?? 0) === 1,
+      "The last admin can't be removed",
+      remove.error ? void 0 : "The row was deleted \u2014 the admin guard trigger isn't installed.",
+      "Apply the latest migrations: pnpm exec guardrail-init-db --push"
+    );
+    await gr(admin).from(GR_MEMBERS_TABLE).upsert(
+      { site_id: siteId, email, user_id: userId, role: "admin", status: "active" },
+      { onConflict: "site_id,email" }
+    );
+    const hits = [];
+    let rateErr;
+    for (let i = 0; i < 3; i++) {
+      const r = await gr(admin).rpc("gr_rate_hit", { p_name: "doctor:e2e", p_key: siteId, p_limit: 2, p_window_seconds: 60 });
+      if (r.error) {
+        rateErr = r.error.message;
+        break;
+      }
+      const row = Array.isArray(r.data) ? r.data[0] : r.data;
+      hits.push(Boolean(row?.allowed));
+    }
+    expect(
+      !rateErr && hits.join() === "true,true,false",
+      "Rate limiter allows up to the limit, then refuses",
+      rateErr ?? (hits.length ? `Got ${hits.join(", ")} instead of true, true, false` : void 0),
+      "Apply the latest migrations: pnpm exec guardrail-init-db --push",
+      `Allowed ${hits.filter(Boolean).length} of ${hits.length} attempts at a limit of 2`
+    );
+    const buckets = await admin.storage.listBuckets();
+    const mediaBucket = buckets.data?.find((b) => b.id === "gr-media");
+    if (!mediaBucket) {
+      skip("Storage", 'No "gr-media" bucket \u2014 skipped (this site may not use editable images).');
+    } else {
+      storageChecked = true;
+      const up = await user.storage.from("gr-media").upload(objectPath, TINY_PNG, { contentType: "image/png" });
+      uploaded = !up.error;
+      expect(!up.error, "Editor can upload an image to their site's folder", up.error?.message, "Check the storage policies from the migration are applied.");
+      if (uploaded) {
+        const { data } = user.storage.from("gr-media").getPublicUrl(objectPath);
+        const res = await fetch(data.publicUrl).catch(() => null);
+        expect(Boolean(res?.ok), "Uploaded images are publicly readable", res ? `HTTP ${res.status}` : "Request failed.", "next/image also needs the storage host in remotePatterns.", `HTTP ${res?.status}`);
+      }
+      const elsewhere = await user.storage.from("gr-media").upload(`${otherSite}/doctor.png`, TINY_PNG, { contentType: "image/png" });
+      if (!elsewhere.error) await admin.storage.from("gr-media").remove([`${otherSite}/doctor.png`]);
+      expect(Boolean(elsewhere.error), "Editor can't upload into another site's folder", elsewhere.error ? void 0 : "The upload was allowed.");
+    }
+  } catch (e) {
+    fail("The end-to-end run stopped unexpectedly", e instanceof Error ? e.message : String(e));
+  } finally {
+    const leftovers = [];
+    const attempt = async (what, run) => {
+      try {
+        const { error } = await run();
+        if (error) leftovers.push(`${what} (${error.message})`);
+      } catch (e) {
+        leftovers.push(`${what} (${e instanceof Error ? e.message : String(e)})`);
+      }
+    };
+    if (storageChecked && uploaded) await attempt(`storage object ${objectPath}`, () => admin.storage.from("gr-media").remove([objectPath]));
+    await attempt("content rows", () => gr(admin).from("gr_content").delete().in("site_id", [siteId, otherSite]));
+    await attempt("membership rows", () => gr(admin).from(GR_MEMBERS_TABLE).delete().eq("site_id", siteId));
+    await attempt("rate-limit row", () => gr(admin).from("gr_rate_limits").delete().eq("bucket", `doctor:e2e|${siteId}`));
+    if (userId) await attempt(`test account ${email}`, () => admin.auth.admin.deleteUser(userId));
+    if (leftovers.length) {
+      warn("Cleanup left something behind", leftovers.join("; "), `Everything it made is tagged "${siteId}" / ${email}; delete it by hand.`);
+    } else {
+      pass("Cleaned up everything the test created");
+    }
+  }
+}
+const COLOR = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code, s) => COLOR ? `\x1B[${code}m${s}\x1B[0m` : s;
+const ICON = {
+  pass: paint(32, "\u2713"),
+  warn: paint(33, "!"),
+  fail: paint(31, "\u2717"),
+  skip: paint(90, "\u2013"),
+  info: paint(36, "i")
+};
+function printReport() {
+  let last = "";
+  for (const r of results) {
+    if (r.group !== last) {
+      console.log(`
+${paint(1, r.group)}`);
+      last = r.group;
+    }
+    console.log(`  ${ICON[r.status]} ${r.title}`);
+    if (r.detail) console.log(`      ${paint(90, r.detail)}`);
+    if (r.hint && (r.status === "fail" || r.status === "warn")) console.log(`      ${paint(90, "\u2192 " + r.hint)}`);
+  }
+  const count = (s) => results.filter((r) => r.status === s).length;
+  const parts = [`${count("pass")} passed`, count("warn") ? paint(33, `${count("warn")} to review`) : null, count("fail") ? paint(31, `${count("fail")} failed`) : null].filter(Boolean);
+  console.log(`
+${parts.join(", ")}
+`);
+}
+async function main() {
+  const { flags, values, unknown } = parseFlags(process.argv.slice(2));
+  if (flags.has("help") || flags.has("h")) {
+    console.log(USAGE);
+    return 0;
+  }
+  if (unknown.length) {
+    console.error(`Unknown option${unknown.length === 1 ? "" : "s"}: ${unknown.join(", ")}
+
+${USAGE}`);
+    return 2;
+  }
+  const cwd = process.cwd();
+  const fileEnv = readEnvFiles(cwd);
+  const env = { ...fileEnv };
+  for (const [k, v] of Object.entries(process.env)) if (v) env[k] = v;
+  const ctx = {
+    cwd,
+    env,
+    production: flags.has("production"),
+    offline: flags.has("offline"),
+    url: env.SUPABASE_URL,
+    anonKey: env.SUPABASE_ANON_KEY,
+    serviceKey: env.SUPABASE_SERVICE_ROLE_KEY ?? env.SERVICE_KEY
+  };
+  const json = flags.has("json");
+  if (!json) console.log("Guardrail doctor");
+  if (flags.has("fix")) {
+    fixMigrations(cwd);
+    fixEnvNotes(cwd);
+    fixCacheComponents(cwd);
+    const headers = fixHeaders(cwd);
+    if (headers === "manual") {
+      applied.push(`next.config has a shape I can't patch safely \u2014 add the headers from the README's "Before you deploy" yourself`);
+    }
+    if (flags.has("push")) {
+      if (!commandExists("supabase")) {
+        applied.push("Supabase CLI not found \u2014 apply the migrations yourself (`supabase db push`, or paste them into the SQL editor)");
+      } else {
+        const local = ctx.url ? isLocalHost(new URL(ctx.url).hostname) : false;
+        const cmd = local ? ["migration", "up", "--local"] : ["db", "push"];
+        const res = spawnSync("supabase", cmd, { stdio: json ? "ignore" : "inherit" });
+        applied.push(
+          res.status === 0 ? `Applied migrations with \`supabase ${cmd.slice(0, 2).join(" ")}\`` : local ? "`supabase migration up` failed \u2014 is the local stack running? (`supabase start`)" : "`supabase db push` failed \u2014 if the project isn't linked yet, run `supabase link` first"
+        );
+      }
+    }
+    if (!json) {
+      console.log(`
+${paint(1, "Fixes")}`);
+      if (applied.length === 0) console.log("  Nothing to fix locally.");
+      for (const a of applied) console.log(`  \u2022 ${a}`);
+    }
+  } else if (flags.has("push")) {
+    console.error("--push only applies together with --fix.");
+    return 2;
+  }
+  await checkProject(ctx);
+  checkEnvironment(ctx);
+  checkFiles(ctx);
+  const sb = await loadSupabase();
+  const dbReachable = await checkDatabase(ctx, sb);
+  if (values["app-url"]) await checkLiveSite(values["app-url"]);
+  if (flags.has("e2e")) {
+    group("End-to-end");
+    if (!dbReachable || !sb) {
+      skip("Skipped", "The database checks above need to pass first.");
+    } else if (!ctx.serviceKey) {
+      skip("Skipped", "The end-to-end suite needs the service-role key to create and remove its test account.");
+    } else if (await confirmE2E(ctx, flags.has("yes"))) {
+      await runE2E(ctx, sb);
+    } else {
+      skip("Skipped", "Not confirmed.");
+    }
+  }
+  if (json) {
+    console.log(JSON.stringify({ applied, results }, null, 2));
+  } else {
+    printReport();
+    if (results.some((r) => r.status === "fail")) {
+      console.log("Fix the failures above, then run guardrail-doctor again.\n");
+    }
+  }
+  const failed = results.some((r) => r.status === "fail");
+  const warned = results.some((r) => r.status === "warn");
+  return failed || flags.has("strict") && warned ? 1 : 0;
+}
+main().then(
+  (code) => process.exit(code),
+  (err) => {
+    console.error(err);
+    process.exit(1);
+  }
+);
+//# sourceMappingURL=doctor.js.map