@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/checks/supabase-static/sql.mjs

@@ -0,0 +1,557 @@
+// Minimal PostgreSQL migration reader for supabase-static (REQ-014). It tokenizes SQL (comments, quoted identifiers,
+// strings, dollar-quoted bodies), splits statements, and replays the security-relevant ones in filename order to build the
+// final schema state. It never executes SQL and never looks inside dollar-quoted bodies except to flag DO blocks and
+// functions that enable RLS.
+
+// ---- tokenizer ----
+// Token kinds: w = unquoted word (lowercased), q = "quoted identifier", s = 'string', d = $tag$ body $tag$, n = number, p = punctuation.
+const WORD = /[A-Za-z_\u0080-￿][\w$\u0080-￿]*/y;
+const DOLLAR = /\$([A-Za-z_\u0080-￿][\w\u0080-￿]*)?\$/y;
+const NUMBER = /\d[\d.]*(?:[eE][+-]?\d+)?/y;
+const PARAM = /\$\d+/y;
+
+export function tokenize(sql) {
+  const toks = [];
+  const n = sql.length;
+  let i = 0;
+  let line = 1;
+  const quoted = (q, escapes) => {
+    let out = '';
+    i++; // opening quote
+    while (i < n) {
+      const c = sql[i];
+      if (c === '\n') line++;
+      if (escapes && c === '\\' && i + 1 < n) { out += sql[i + 1]; if (sql[i + 1] === '\n') line++; i += 2; continue; }
+      if (c === q) { if (sql[i + 1] === q) { out += q; i += 2; continue; } i++; return out; }
+      out += c; i++;
+    }
+    return out; // unterminated: take the rest of the file
+  };
+  while (i < n) {
+    const c = sql[i];
+    if (c === '\n') { line++; i++; continue; }
+    if (c === ' ' || c === '\t' || c === '\r' || c === '\f' || c === '\v') { i++; continue; }
+    if (c === '-' && sql[i + 1] === '-') { while (i < n && sql[i] !== '\n') i++; continue; }
+    if (c === '/' && sql[i + 1] === '*') {
+      let depth = 1;
+      i += 2;
+      while (i < n && depth > 0) {
+        if (sql[i] === '/' && sql[i + 1] === '*') { depth++; i += 2; } else if (sql[i] === '*' && sql[i + 1] === '/') { depth--; i += 2; } else { if (sql[i] === '\n') line++; i++; }
+      }
+      continue;
+    }
+    const start = i;
+    const l = line;
+    const push = (k, v) => toks.push({ k, v, line: l, pos: start, end: i });
+    if (c === "'") { push('s', quoted("'", false)); continue; }
+    if ((c === 'e' || c === 'E') && sql[i + 1] === "'") { i++; push('s', quoted("'", true)); continue; }
+    if (c === '"') { push('q', quoted('"', false)); continue; }
+    if (c === '$') {
+      DOLLAR.lastIndex = i;
+      const m = DOLLAR.exec(sql);
+      if (m) {
+        const tag = m[0];
+        const bodyStart = i + tag.length;
+        const close = sql.indexOf(tag, bodyStart);
+        const body = close === -1 ? sql.slice(bodyStart) : sql.slice(bodyStart, close);
+        for (const ch of body) if (ch === '\n') line++;
+        i = close === -1 ? n : close + tag.length;
+        push('d', body);
+        continue;
+      }
+      PARAM.lastIndex = i;
+      const pm = PARAM.exec(sql);
+      i += pm ? pm[0].length : 1;
+      push('n', sql.slice(start, i));
+      continue;
+    }
+    WORD.lastIndex = i;
+    const w = WORD.exec(sql);
+    if (w) { i += w[0].length; push('w', w[0].toLowerCase()); continue; }
+    NUMBER.lastIndex = i;
+    const num = NUMBER.exec(sql);
+    if (num) { i += num[0].length; push('n', num[0]); continue; }
+    i++;
+    push('p', c);
+  }
+  return toks;
+}
+
+/** Splits tokens at top-level semicolons. Each statement: { toks, line, start, end }. */
+export function splitStatements(toks) {
+  const out = [];
+  let cur = [];
+  const flush = () => { if (cur.length) out.push({ toks: cur, line: cur[0].line, start: cur[0].pos, end: cur.at(-1).end }); cur = []; };
+  for (const t of toks) { if (t.k === 'p' && t.v === ';') flush(); else cur.push(t); }
+  flush();
+  return out;
+}
+
+// ---- token helpers ----
+const W = (t, v) => t?.k === 'w' && t.v === v;
+const P = (t, v) => t?.k === 'p' && t.v === v;
+const isName = (t) => t?.k === 'w' || t?.k === 'q';
+const seq = (toks, i, ...ws) => ws.every((w, j) => W(toks[i + j], w));
+const keyOf = (schema, name) => `${schema}.${name}`;
+
+/** Qualified name at i: { schema, name, next }. Unqualified names are in schema public. Normalized: unquoted lowercased, quoted verbatim. */
+function qname(toks, i) {
+  const parts = [];
+  let j = i;
+  while (isName(toks[j])) {
+    parts.push(toks[j].v);
+    j++;
+    if (P(toks[j], '.') && isName(toks[j + 1])) { j++; continue; }
+    break;
+  }
+  if (!parts.length) return null;
+  return { schema: parts.length > 1 ? parts.at(-2) : 'public', name: parts.at(-1), next: j };
+}
+
+/** toks[i] must be "(": returns { inner, next } where next is the index after the matching ")". */
+function group(toks, i) {
+  if (!P(toks[i], '(')) throw new Error('expected "("');
+  let depth = 0;
+  for (let j = i; j < toks.length; j++) {
+    if (P(toks[j], '(')) depth++;
+    else if (P(toks[j], ')') && --depth === 0) return { inner: toks.slice(i + 1, j), next: j + 1 };
+  }
+  throw new Error('unbalanced parentheses');
+}
+
+/** Splits tokens at depth-0 commas. */
+function splitCommas(toks) {
+  const parts = [[]];
+  let depth = 0;
+  for (const t of toks) {
+    if (P(t, '(')) depth++;
+    else if (P(t, ')')) depth--;
+    if (depth === 0 && P(t, ',')) parts.push([]); else parts.at(-1).push(t);
+  }
+  return parts.filter((p) => p.length);
+}
+
+/** An expression that is literally true: true, (true), ((true)). */
+export function isTrueExpr(toks) {
+  let t = toks;
+  while (t && t.length >= 3 && P(t[0], '(') && P(t.at(-1), ')') && group(t, 0).next === t.length) t = t.slice(1, -1);
+  return !!t && t.length === 1 && W(t[0], 'true');
+}
+
+const truthy = (t) => !!t && ((t.k === 'w' && ['true', 'on', 'yes', 't'].includes(t.v)) || (t.k === 'n' && t.v === '1') || (t.k === 's' && ['true', 'on', 'yes', 't', '1'].includes(t.v.toLowerCase())));
+const falsy = (t) => !!t && ((t.k === 'w' && ['false', 'off', 'no', 'f'].includes(t.v)) || (t.k === 'n' && t.v === '0') || (t.k === 's' && ['false', 'off', 'no', 'f', '0'].includes(t.v.toLowerCase())));
+
+/** Value of a reloption such as security_invoker inside a parenthesized option list; null when the option is absent. */
+function optionValue(inner, name) {
+  const i = inner.findIndex((t) => isName(t) && t.v === name);
+  if (i === -1) return null;
+  if (!P(inner[i + 1], '=')) return true; // an option without a value means true
+  return truthy(inner[i + 2]);
+}
+
+/** Parses policy clauses starting at i: AS, FOR, TO, USING (...), WITH CHECK (...). Missing clauses are undefined. */
+function policyClauses(toks, i) {
+  const out = {};
+  while (i < toks.length) {
+    if (W(toks[i], 'as') && (W(toks[i + 1], 'permissive') || W(toks[i + 1], 'restrictive'))) { out.restrictive = toks[i + 1].v === 'restrictive'; i += 2; }
+    else if (W(toks[i], 'for') && isName(toks[i + 1])) { out.cmd = toks[i + 1].v; i += 2; }
+    else if (W(toks[i], 'to')) {
+      i++;
+      out.roles = [];
+      while (isName(toks[i])) {
+        out.roles.push(toks[i].v);
+        i++;
+        if (P(toks[i], ',')) i++; else break;
+      }
+    } else if (W(toks[i], 'using')) { const g = group(toks, i + 1); out.using = g.inner; i = g.next; }
+    else if (seq(toks, i, 'with', 'check')) { const g = group(toks, i + 2); out.check = g.inner; i = g.next; }
+    else i++;
+  }
+  return out;
+}
+
+/** Argument list of a function reduced to what ALTER FUNCTION accepts: defaults removed. */
+function signature(inner, src) {
+  return splitCommas(inner).map((arg) => {
+    let depth = 0;
+    let cut = arg.length;
+    for (let j = 0; j < arg.length; j++) {
+      if (P(arg[j], '(')) depth++;
+      else if (P(arg[j], ')')) depth--;
+      else if (depth === 0 && (W(arg[j], 'default') || P(arg[j], '='))) { cut = j; break; }
+    }
+    const a = arg.slice(0, cut);
+    return a.length ? src.slice(a[0].pos, a.at(-1).end).replace(/\s+/g, ' ') : '';
+  }).filter(Boolean).join(', ');
+}
+
+const snippet = (src, st) => src.slice(st.start, st.end).replace(/\s+/g, ' ').slice(0, 240);
+
+/** Fresh schema state for one migrations directory. */
+export function newState() {
+  return { tables: new Map(), policies: [], functions: new Map(), views: new Map(), buckets: new Map(), autoRls: false, dynamicRls: [], dynamicRlsApplied: [], statements: 0, skipped: [] };
+}
+
+function dropMany(toks, i, fn) {
+  if (seq(toks, i, 'if', 'exists')) i += 2;
+  for (;;) {
+    const q = qname(toks, i);
+    if (!q) throw new Error('expected a name');
+    i = q.next;
+    if (P(toks[i], '(')) i = group(toks, i).next; // function argument list
+    fn(q);
+    if (P(toks[i], ',')) i++; else break;
+  }
+}
+
+function renameTable(state, from, to) {
+  const t = state.tables.get(from);
+  if (!t) return;
+  state.tables.delete(from);
+  state.tables.set(to, t);
+  for (const p of state.policies) if (p.table === from) p.table = to;
+}
+
+function createStatement(state, st, ctx) {
+  const t = st.toks;
+  let i = 1;
+  if (seq(t, i, 'or', 'replace')) i += 2;
+  while (t[i]?.k === 'w' && ['global', 'local', 'temp', 'temporary', 'unlogged', 'recursive', 'trusted'].includes(t[i].v)) {
+    if (t[i].v === 'temp' || t[i].v === 'temporary') return; // temporary objects are not exposed
+    i++;
+  }
+  const kind = t[i]?.k === 'w' ? t[i].v : '';
+  i++;
+  if (kind === 'table') {
+    let ifNot = false;
+    if (seq(t, i, 'if', 'not', 'exists')) { i += 3; ifNot = true; }
+    const q = qname(t, i);
+    if (!q) throw new Error('expected a table name');
+    const key = keyOf(q.schema, q.name);
+    if (ifNot && state.tables.has(key)) return;
+    state.tables.set(key, { schema: q.schema, name: q.name, rls: state.autoRls, anonOpen: true, authOpen: true, file: ctx.file, line: st.line, text: snippet(ctx.src, st) });
+  } else if (kind === 'policy') {
+    if (!isName(t[i]) || !W(t[i + 1], 'on')) throw new Error('expected a policy name and ON');
+    const name = t[i].v;
+    const q = qname(t, i + 2);
+    if (!q) throw new Error('expected a table name');
+    const c = policyClauses(t, q.next);
+    const table = keyOf(q.schema, q.name);
+    state.policies = state.policies.filter((p) => !(p.table === table && p.name === name));
+    state.policies.push({
+      name, table, schema: q.schema, tableName: q.name, cmd: c.cmd ?? 'all', roles: c.roles ?? [], restrictive: !!c.restrictive,
+      using: c.using ?? null, check: c.check ?? null, file: ctx.file, line: st.line, text: snippet(ctx.src, st),
+    });
+  } else if (kind === 'function' || kind === 'procedure') {
+    const q = qname(t, i);
+    if (!q || !P(t[q.next], '(')) throw new Error('expected a function name and argument list');
+    const args = group(t, q.next);
+    const rest = t.slice(args.next);
+    let definer = false;
+    let searchPath = false;
+    let bodyHasRls = false;
+    for (let j = 0; j < rest.length; j++) {
+      if (seq(rest, j, 'security', 'definer')) definer = true;
+      else if (seq(rest, j, 'security', 'invoker')) definer = false;
+      else if (W(rest[j], 'set') && isName(rest[j + 1]) && rest[j + 1].v === 'search_path') searchPath = true;
+      else if (rest[j].k === 'd' && /row\s+level\s+security/i.test(rest[j].v)) bodyHasRls = true;
+    }
+    state.functions.set(keyOf(q.schema, q.name), { schema: q.schema, name: q.name, definer, searchPath, bodyHasRls, args: signature(args.inner, ctx.src), file: ctx.file, line: st.line, text: snippet(ctx.src, st) });
+  } else if (kind === 'view') {
+    const q = qname(t, i);
+    if (!q) throw new Error('expected a view name');
+    let depth = 0;
+    let invoker = false;
+    for (let j = q.next; j < t.length; j++) {
+      if (P(t[j], '(')) depth++;
+      else if (P(t[j], ')')) depth--;
+      else if (depth === 0 && W(t[j], 'as')) break;
+      else if (depth === 0 && W(t[j], 'with') && P(t[j + 1], '(')) invoker = optionValue(group(t, j + 1).inner, 'security_invoker') === true;
+    }
+    state.views.set(keyOf(q.schema, q.name), { schema: q.schema, name: q.name, invoker, file: ctx.file, line: st.line, text: snippet(ctx.src, st) });
+  } else if (kind === 'event' && W(t[i], 'trigger')) {
+    // an event trigger that runs a function which enables RLS makes tables created afterwards RLS-enabled
+    const j = t.findIndex((x, k) => k > i && W(x, 'execute') && (W(t[k + 1], 'function') || W(t[k + 1], 'procedure')));
+    const q = j === -1 ? null : qname(t, j + 2);
+    if (q && state.functions.get(keyOf(q.schema, q.name))?.bodyHasRls) state.autoRls = true;
+  }
+}
+
+function alterStatement(state, st, ctx) {
+  const t = st.toks;
+  let i = 1;
+  const kind = t[i]?.k === 'w' ? t[i].v : '';
+  i++;
+  if (kind === 'table') {
+    if (seq(t, i, 'if', 'exists')) i += 2;
+    if (W(t[i], 'only')) i++;
+    const q = qname(t, i);
+    if (!q) throw new Error('expected a table name');
+    let key = keyOf(q.schema, q.name);
+    const tbl = state.tables.get(key);
+    if (!tbl) return; // created outside these migrations
+    for (let j = q.next; j < t.length; j++) {
+      if (seq(t, j, 'enable', 'row', 'level', 'security')) tbl.rls = true;
+      else if (seq(t, j, 'disable', 'row', 'level', 'security')) tbl.rls = false;
+      else if (W(t[j], 'rename') && W(t[j + 1], 'to') && isName(t[j + 2])) {
+        const to = keyOf(tbl.schema, t[j + 2].v);
+        renameTable(state, key, to);
+        tbl.name = t[j + 2].v;
+        key = to;
+      } else if (seq(t, j, 'set', 'schema') && isName(t[j + 2])) {
+        const to = keyOf(t[j + 2].v, tbl.name);
+        renameTable(state, key, to);
+        tbl.schema = t[j + 2].v;
+        key = to;
+      }
+    }
+  } else if (kind === 'policy') {
+    if (!isName(t[i]) || !W(t[i + 1], 'on')) throw new Error('expected a policy name and ON');
+    const name = t[i].v;
+    const q = qname(t, i + 2);
+    if (!q) throw new Error('expected a table name');
+    const table = keyOf(q.schema, q.name);
+    const p = state.policies.find((x) => x.table === table && x.name === name);
+    if (!p) return;
+    if (W(t[q.next], 'rename') && W(t[q.next + 1], 'to') && isName(t[q.next + 2])) { p.name = t[q.next + 2].v; return; }
+    const c = policyClauses(t, q.next);
+    if (c.roles) p.roles = c.roles;
+    if (c.using) p.using = c.using;
+    if (c.check) p.check = c.check;
+    p.file = ctx.file;
+    p.line = st.line;
+    p.text = snippet(ctx.src, st);
+  } else if (kind === 'function' || kind === 'procedure' || kind === 'routine') {
+    const q = qname(t, i);
+    if (!q) throw new Error('expected a function name');
+    const key = keyOf(q.schema, q.name);
+    const f = state.functions.get(key);
+    if (!f) return;
+    for (let j = q.next; j < t.length; j++) {
+      if (seq(t, j, 'security', 'definer')) f.definer = true;
+      else if (seq(t, j, 'security', 'invoker')) f.definer = false;
+      else if (W(t[j], 'set') && isName(t[j + 1]) && t[j + 1].v === 'search_path') f.searchPath = true;
+      else if (W(t[j], 'reset') && isName(t[j + 1]) && t[j + 1].v === 'search_path') f.searchPath = false;
+      else if (W(t[j], 'rename') && W(t[j + 1], 'to') && isName(t[j + 2])) {
+        state.functions.delete(key);
+        f.name = t[j + 2].v;
+        state.functions.set(keyOf(f.schema, f.name), f);
+      }
+    }
+  } else if (kind === 'view') {
+    if (seq(t, i, 'if', 'exists')) i += 2;
+    const q = qname(t, i);
+    if (!q) throw new Error('expected a view name');
+    const key = keyOf(q.schema, q.name);
+    const v = state.views.get(key);
+    if (!v) return;
+    const k = q.next;
+    if (W(t[k], 'rename') && W(t[k + 1], 'to') && isName(t[k + 2])) {
+      state.views.delete(key);
+      v.name = t[k + 2].v;
+      state.views.set(keyOf(v.schema, v.name), v);
+    } else if (seq(t, k, 'set', 'schema') && isName(t[k + 2])) {
+      state.views.delete(key);
+      v.schema = t[k + 2].v;
+      state.views.set(keyOf(v.schema, v.name), v);
+    } else if (W(t[k], 'set') && P(t[k + 1], '(')) {
+      const val = optionValue(group(t, k + 1).inner, 'security_invoker');
+      if (val !== null) v.invoker = val;
+    } else if (W(t[k], 'reset') && P(t[k + 1], '(')) {
+      if (group(t, k + 1).inner.some((x) => isName(x) && x.v === 'security_invoker')) v.invoker = false;
+    }
+  }
+}
+
+function dropStatement(state, st) {
+  const t = st.toks;
+  let i = 1;
+  const kind = t[i]?.k === 'w' ? t[i].v : '';
+  i++;
+  if (kind === 'table') {
+    dropMany(t, i, (q) => {
+      const key = keyOf(q.schema, q.name);
+      state.tables.delete(key);
+      state.policies = state.policies.filter((p) => p.table !== key);
+    });
+  } else if (kind === 'view') dropMany(t, i, (q) => state.views.delete(keyOf(q.schema, q.name)));
+  else if (kind === 'function' || kind === 'procedure' || kind === 'routine') dropMany(t, i, (q) => state.functions.delete(keyOf(q.schema, q.name)));
+  else if (kind === 'policy') {
+    if (seq(t, i, 'if', 'exists')) i += 2;
+    if (!isName(t[i]) || !W(t[i + 1], 'on')) throw new Error('expected a policy name and ON');
+    const name = t[i].v;
+    const q = qname(t, i + 2);
+    if (!q) throw new Error('expected a table name');
+    const table = keyOf(q.schema, q.name);
+    state.policies = state.policies.filter((p) => !(p.table === table && p.name === name));
+  }
+}
+
+const NOT_TABLE_TARGETS = ['schema', 'function', 'sequence', 'database', 'domain', 'type', 'language', 'procedure', 'routine', 'all', 'foreign', 'large', 'tablespace', 'parameter'];
+
+/** GRANT and REVOKE on tables for anon/authenticated: a table revoked from both is not reachable through the API even without RLS. */
+function privilegeStatement(state, st) {
+  const t = st.toks;
+  const grant = W(t[0], 'grant');
+  const on = t.findIndex((x) => W(x, 'on'));
+  const to = t.findIndex((x, k) => k > on && W(x, grant ? 'to' : 'from'));
+  if (on === -1 || to === -1) return;
+  const privs = t.slice(1, on).filter((x) => x.k === 'w').map((x) => x.v);
+  let i = on + 1;
+  let targets;
+  if (seq(t, i, 'all', 'tables', 'in', 'schema')) {
+    const schemas = new Set(t.slice(i + 4, to).filter(isName).map((x) => x.v));
+    targets = [...state.tables.values()].filter((x) => schemas.has(x.schema));
+  } else {
+    if (W(t[i], 'table')) i++;
+    else if (t[i]?.k === 'w' && NOT_TABLE_TARGETS.includes(t[i].v)) return;
+    targets = [];
+    for (const part of splitCommas(t.slice(i, to))) {
+      const q = qname(part, 0);
+      const tbl = q && state.tables.get(keyOf(q.schema, q.name));
+      if (tbl) targets.push(tbl);
+    }
+  }
+  const roles = new Set(t.slice(to + 1).filter(isName).map((x) => x.v));
+  const anon = roles.has('anon') || roles.has('public');
+  const auth = roles.has('authenticated') || roles.has('public');
+  for (const tbl of targets) {
+    if (grant) { if (anon) tbl.anonOpen = true; if (auth) tbl.authOpen = true; }
+    else if (privs.includes('all')) { if (anon) tbl.anonOpen = false; if (auth) tbl.authOpen = false; }
+  }
+}
+
+const isBuckets = (q) => q && q.schema === 'storage' && q.name === 'buckets';
+const stringsOf = (toks) => toks.filter((x) => x.k === 's').map((x) => x.v);
+const bucket = (id, isPublic, ctx, st) => ({ id, public: isPublic, file: ctx.file, line: st.line, text: snippet(ctx.src, st) });
+
+function insertStatement(state, st, ctx) {
+  const t = st.toks;
+  if (!W(t[1], 'into')) return;
+  const q = qname(t, 2);
+  if (!isBuckets(q)) return;
+  if (!P(t[q.next], '(')) throw new Error('expected a column list');
+  const cols = group(t, q.next);
+  if (!W(t[cols.next], 'values')) throw new Error('only INSERT ... VALUES into storage.buckets is analyzed');
+  const names = splitCommas(cols.inner).map((c) => c[0]?.v ?? '');
+  const pub = names.indexOf('public');
+  const idCol = names.includes('id') ? names.indexOf('id') : names.indexOf('name');
+  let i = cols.next + 1;
+  while (P(t[i], '(')) {
+    const g = group(t, i);
+    const vals = splitCommas(g.inner);
+    const id = idCol >= 0 && vals[idCol]?.length === 1 && vals[idCol][0].k === 's' ? vals[idCol][0].v : `(row at line ${st.line})`;
+    const isPublic = pub >= 0 && vals[pub]?.length === 1 && truthy(vals[pub][0]);
+    state.buckets.set(id, bucket(id, isPublic, ctx, st));
+    i = g.next;
+    if (P(t[i], ',')) i++; else break;
+  }
+}
+
+function updateStatement(state, st, ctx) {
+  const t = st.toks;
+  const q = qname(t, 1);
+  if (!isBuckets(q) || !W(t[q.next], 'set')) return;
+  const whereAt = t.findIndex((x) => W(x, 'where'));
+  const setPart = t.slice(q.next + 1, whereAt === -1 ? t.length : whereAt);
+  const i = setPart.findIndex((x, k) => W(x, 'public') && P(setPart[k + 1], '=') && setPart[k + 2]);
+  if (i === -1) return;
+  const value = setPart[i + 2];
+  if (!truthy(value) && !falsy(value)) return; // not a literal
+  const makePublic = truthy(value);
+  let ids = null; // null: every bucket; []: a condition we cannot read
+  if (whereAt !== -1) {
+    const w = t.slice(whereAt + 1);
+    const byId = isName(w[0]) && ['id', 'name'].includes(w[0].v);
+    const simple = byId && ((P(w[1], '=') && w[2]?.k === 's' && w.length === 3) || (W(w[1], 'in') && P(w[2], '(') && group(w, 2).next === w.length));
+    ids = simple ? stringsOf(w) : [];
+  }
+  if (ids === null) { for (const [id] of state.buckets) state.buckets.set(id, bucket(id, makePublic, ctx, st)); return; }
+  if (!ids.length) {
+    if (makePublic) { const id = `(rows matched by the condition at line ${st.line})`; state.buckets.set(id, bucket(id, true, ctx, st)); }
+    return;
+  }
+  for (const id of ids) state.buckets.set(id, bucket(id, makePublic, ctx, st));
+}
+
+function deleteStatement(state, st) {
+  const t = st.toks;
+  if (!W(t[1], 'from')) return;
+  const q = qname(t, 2);
+  if (!isBuckets(q)) return;
+  const w = t.findIndex((x) => W(x, 'where'));
+  if (w === -1) { state.buckets.clear(); return; }
+  if (isName(t[w + 1]) && ['id', 'name'].includes(t[w + 1].v)) for (const id of stringsOf(t.slice(w + 2))) state.buckets.delete(id);
+}
+
+/**
+ * What a DO block puts under row level security, or null when the block is not one of two plain loops. Returns { schemas } (every table that
+ * exists at that point in these schemas) or { tables: ['schema.name', ...] } (exactly those tables):
+ *   for t in select tablename from pg_tables where schemaname = 'public' loop execute format('alter table public.%I enable row level security', t.tablename); end loop;
+ *   foreach t in array array['a', 'b'] loop execute format('alter table public.%I enable row level security', t); ... end loop;
+ * Only unconditional loops count. The first needs a catalog query with nothing but a schema filter (pg_tables, or information_schema.tables with
+ * an optional table_type = 'BASE TABLE'); the second needs a literal list. The body must be EXECUTE statements only, one of which is an
+ * ALTER TABLE ... ENABLE ROW LEVEL SECURITY on the loop's table, and none may disable RLS. Anything else (extra conditions, IF or CONTINUE inside
+ * the loop, other statements) is not understood and the table stays reported.
+ */
+export function doBlockRlsCover(body) {
+  const text = String(body).replace(/--[^\n]*/g, ' ').replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/\s+/g, ' ').trim().toLowerCase();
+  const enablesRls = (loopBody) => {
+    const strings = loopBody.match(/'[^']*'/g) ?? [];
+    const statements = loopBody.replace(/'[^']*'/g, "''").split(';').map((x) => x.trim()).filter(Boolean);
+    if (!statements.length || !statements.every((x) => /^execute\s/.test(x))) return null; // anything but EXECUTE statements is not understood
+    if (strings.some((s) => /\bdisable\b/.test(s))) return null;
+    return strings.map((s) => /\balter table\s+(?:only\s+)?([a-z_][\w$]*)\.%i\s+enable row level security\b/.exec(s)?.[1]).find(Boolean) ?? null;
+  };
+  const each = /\bforeach\s+\w+\s+in\s+array\s+array\s*\[\s*((?:'[a-z_][\w$]*'\s*,?\s*)+)\]\s*loop\s+(.*?)\s*end\s+loop\b/.exec(text);
+  if (each) {
+    const schema = enablesRls(each[2]);
+    return schema ? { tables: [...each[1].matchAll(/'([^']+)'/g)].map((x) => `${schema}.${x[1]}`) } : null;
+  }
+  const m = /\bfor\s+\w+\s+in\s+select\s+(.+?)\s+from\s+(pg_catalog\.pg_tables|pg_tables|information_schema\.tables)\s+where\s+(.+?)\s+loop\s+(.*?)\s*end\s+loop\b/.exec(text);
+  if (!m) return null;
+  const [, columns, source, cond, loopBody] = m;
+  if (!/^(?:\w+\.)?(?:tablename|table_name)$/.test(columns.trim())) return null;
+  if (!enablesRls(loopBody)) return null;
+  const schemaCol = source.endsWith('pg_tables') ? 'schemaname' : 'table_schema';
+  let schemas = null;
+  for (const part of cond.split(/\s+and\s+/)) {
+    const eq = new RegExp(`^(?:\\w+\\.)?${schemaCol}\\s*=\\s*'([a-z_][\\w$]*)'$`).exec(part.trim());
+    const list = new RegExp(`^(?:\\w+\\.)?${schemaCol}\\s+in\\s*\\(\\s*('[a-z_][\\w$]*'(?:\\s*,\\s*'[a-z_][\\w$]*')*)\\s*\\)$`).exec(part.trim());
+    if (eq && !schemas) schemas = [eq[1]];
+    else if (list && !schemas) schemas = [...list[1].matchAll(/'([^']+)'/g)].map((x) => x[1]);
+    else if (!(source === 'information_schema.tables' && /^(?:\w+\.)?table_type\s*=\s*'base table'$/.test(part.trim()))) return null;
+  }
+  return schemas ? { schemas } : null;
+}
+
+/** Replays one migration file into the state. Never throws: statements that fail to parse are counted in state.skipped. */
+export function applyMigration(state, file, src) {
+  const ctx = { file, src };
+  for (const st of splitStatements(tokenize(src))) {
+    state.statements++;
+    const verb = st.toks[0]?.k === 'w' ? st.toks[0].v : '';
+    try {
+      if (verb === 'create') createStatement(state, st, ctx);
+      else if (verb === 'alter') alterStatement(state, st, ctx);
+      else if (verb === 'drop') dropStatement(state, st);
+      else if (verb === 'grant' || verb === 'revoke') privilegeStatement(state, st);
+      else if (verb === 'insert') insertStatement(state, st, ctx);
+      else if (verb === 'update') updateStatement(state, st, ctx);
+      else if (verb === 'delete') deleteStatement(state, st);
+      else if (verb === 'do') {
+        const body = st.toks.find((x) => x.k === 'd' || x.k === 's');
+        if (body && /row\s+level\s+security/i.test(body.v)) {
+          const cover = doBlockRlsCover(body.v);
+          if (cover) {
+            // the block enables RLS on the listed tables, or on every table that exists right now in the listed schemas; tables created later are not covered
+            for (const [key, tbl] of state.tables) if (cover.tables ? cover.tables.includes(key) : cover.schemas.includes(tbl.schema)) tbl.rls = true;
+            state.dynamicRlsApplied.push({ file, line: st.line, ...(cover.schemas ? { schemas: cover.schemas } : { tables: cover.tables.length }) });
+          } else state.dynamicRls.push({ file, line: st.line });
+        }
+      }
+    } catch (e) {
+      state.skipped.push({ file, line: st.line, reason: e.message, text: snippet(src, st).slice(0, 120) });
+    }
+  }
+}

package/dist/security-runtime/src/checks/workflows/index.mjs

@@ -0,0 +1,93 @@
+// workflows (REQ-016): zizmor over GitHub Actions workflows and composite action files.
+// Offline unless a GitHub token is present (then zizmor also runs its online audits). The token reaches only zizmor.
+import fs from 'node:fs';
+import path from 'node:path';
+import { normalizeSarif } from '../../core/sarif.mjs';
+
+export const id = 'workflows';
+export const title = 'GitHub Actions workflow security';
+export const modes = ['scan', 'deep', 'release'];
+export const requiredIn = [];
+export const timeoutSec = 300;
+
+export const applies = (ctx) => (ctx.detection.workflows.length > 0
+  ? true
+  : { applies: false, reason: 'no GitHub Actions workflow or composite action file was found' });
+
+const SEVERITY = { informational: 'info', low: 'low', medium: 'medium', high: 'high' };
+const CONFIDENCE = { low: 'low', medium: 'medium', high: 'high' };
+const FIX = {
+  'zizmor/unpinned-uses': 'Pin the action to a full commit SHA (with the version in a comment), not a tag or branch.',
+  'zizmor/template-injection': 'Pass the value through an environment variable (env: NAME: ${{ ... }}) and use "$NAME" in the script instead of expanding it inline.',
+  'zizmor/excessive-permissions': 'Set the narrowest permissions the job needs (for example permissions: contents: read) instead of write-all or broad write scopes.',
+  'zizmor/dangerous-triggers': 'Use pull_request instead of pull_request_target or workflow_run, or never check out or run code from the pull request in that workflow.',
+  'zizmor/artipacked': 'Set persist-credentials: false on actions/checkout so the token is not left in .git/config.',
+};
+
+const hasToken = () => !!(process.env.GH_TOKEN || process.env.GITHUB_TOKEN);
+
+/** zizmor reports paths relative to the git root, which can sit above the scanned directory: find the real file under repo. */
+function repoRelative(repo, file) {
+  const parts = String(file ?? '').split('/').filter(Boolean);
+  for (let i = 0; i < parts.length; i++) {
+    const rest = parts.slice(i).join('/');
+    if (fs.existsSync(path.join(repo, rest))) return rest;
+  }
+  return parts.join('/');
+}
+
+/** Maps zizmor SARIF to raw findings: zizmor's own severity and confidence decide, so High with High confidence blocks. */
+export function mapZizmor(sarif, repo) {
+  const results = (sarif?.runs ?? []).flatMap((r) => r.results ?? []);
+  const rules = new Map((sarif?.runs ?? []).flatMap((r) => r.tool?.driver?.rules ?? []).map((r) => [r.id, r]));
+  const raw = normalizeSarif(sarif, { tool: 'zizmor', category: 'workflow', repo });
+  return raw.map((f, i) => {
+    const p = results[i]?.properties ?? {};
+    const rule = rules.get(f.ruleId);
+    const fix = FIX[f.ruleId] ?? (rule?.helpUri ? `Follow the guidance at ${rule.helpUri}.` : 'See the zizmor audit documentation for this rule.');
+    return {
+      ...f,
+      title: rule?.help?.text ? `${rule.help.text} (${rule.name ?? f.ruleId})` : f.title,
+      severity: SEVERITY[String(p['zizmor/severity'] ?? '').toLowerCase()] ?? f.severity,
+      confidence: CONFIDENCE[String(p['zizmor/confidence'] ?? '').toLowerCase()] ?? 'medium',
+      location: { file: repoRelative(repo, f.location.file), line: f.location.line },
+      fix,
+    };
+  });
+}
+
+export async function run(ctx) {
+  // auditor persona: write-all permissions are only reported there. Below Medium is style noise (unnamed jobs, missing concurrency).
+  // --no-config and --no-ignores: the scanned repository cannot switch rules off; acceptances live in vsg.accept.json.
+  const base = ['--format', 'sarif', '--persona', 'auditor', '--min-severity', 'medium', '--no-config', '--no-ignores', '--no-progress', '--strict-collection', '--collect=workflows', '--collect=actions'];
+  const online = hasToken();
+  // Inputs are the .github folders that detection found (it already leaves out nested repositories and worktrees), not "." which would walk them.
+  const inputs = [...new Set(ctx.detection.workflows.map((w) => w.slice(0, w.indexOf('.github/') + '.github'.length)))].sort().map((d) => `./${d}`);
+  let res = await ctx.runTool('zizmor', [...base, ...(online ? [] : ['--offline']), ...inputs]);
+  let degraded = '';
+  if (online && res.status === 'ran' && res.exitCode !== 0 && !(res.exitCode >= 10 && res.exitCode <= 14)) {
+    // the online audits need the GitHub API; fall back to the offline audits rather than reporting nothing
+    degraded = `online audits failed (exit ${res.exitCode}); ran offline instead`;
+    res = await ctx.runTool('zizmor', [...base, '--offline', ...inputs]);
+  }
+  if (res.status !== 'ran') return { status: 'not_run', reason: res.reason };
+  if (res.truncated) return { status: 'not_run', reason: 'zizmor output was too large to read completely.' };
+  // zizmor signals findings through exit codes 10 to 14 (and 0 with SARIF): those are results, not failures.
+  if (res.exitCode !== 0 && !(res.exitCode >= 10 && res.exitCode <= 14)) {
+    const tail = res.stderr.trim().split(/\r?\n/).slice(-3).join(' | ');
+    return { status: 'not_run', reason: `zizmor failed with exit code ${res.exitCode}${tail ? `: ${tail}` : ''}.` };
+  }
+  let sarif;
+  try { sarif = JSON.parse(res.stdout); } catch { return { status: 'not_run', reason: 'zizmor did not return valid SARIF.' }; }
+  const findings = mapZizmor(sarif, ctx.repo);
+  return {
+    status: 'ran',
+    reason: degraded ? `degraded: ${degraded}` : '',
+    findings,
+    toolVersion: ctx.registry?.get('zizmor')?.version ?? null,
+    dataVersions: { mode: online && !degraded ? 'online' : 'offline' },
+    evidence: { zizmorExitCode: res.exitCode, mode: online && !degraded ? 'online' : 'offline', results: findings.length },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/cli/deep.mjs

@@ -0,0 +1,13 @@
+import { RUN_OPTIONS, runMode } from './run-common.mjs';
+
+// Stage 1a: the shared run path only. The deep-only checks arrive with their own packets.
+export default {
+  name: 'deep',
+  summary: 'Full repository audit, including history, malware and the agent-review brief',
+  usage: '[path]',
+  maxPositionals: 1,
+  purpose: 'Runs the scan checks plus history secrets, malware, licenses, Supabase static analysis and agent review. Checks that are not built yet are reported as did-not-run, so the verdict is INCOMPLETE rather than PASS.',
+  options: [...RUN_OPTIONS, { flag: '--no-validate', type: 'bool', help: 'Do not validate found credentials against their issuers' }],
+  examples: ['vsg deep', 'vsg deep ../my-app --json'],
+  run: (args, io) => runMode('deep', args, io),
+};