@nodatachat/guard 2.6.1 → 3.0.0

package/dist/cli.js

@@ -26,7 +26,7 @@ const reporter_1 = require("./reporter");
 const scheduler_1 = require("./fixers/scheduler");
 const vault_crypto_1 = require("./vault-crypto");
 const capsule_dir_1 = require("./capsule-dir");
-const VERSION = "2.6.1";
+const VERSION = "3.0.0";
 async function main() {
     const args = process.argv.slice(2);
     // ── Subcommand routing ──
@@ -292,6 +292,50 @@ async function main() {
             const encryptedDb = dbResult.pii_fields.filter(f => f.encrypted).length;
             log(ciMode, `DB PII: ${dbResult.pii_fields.length} found, ${encryptedDb} encrypted`);
             log(ciMode, `RLS: ${dbResult.rls.filter(r => r.rls_enabled).length}/${dbResult.rls.length} tables`);
+            // Save full DB evidence
+            if (dbResult.evidence) {
+                const evidencePath = (0, path_1.resolve)(outputDir, "nodata-db-evidence.json");
+                (0, fs_1.writeFileSync)(evidencePath, JSON.stringify(dbResult.evidence, null, 2), "utf-8");
+                log(ciMode, `DB evidence: ${evidencePath}`);
+                // Print evidence summary
+                if (!ciMode) {
+                    const ev = dbResult.evidence;
+                    console.log("");
+                    console.log("  ══════════════════════════════════════");
+                    console.log("  DB EVIDENCE — FORENSIC SUMMARY");
+                    console.log("  ══════════════════════════════════════");
+                    console.log(`  Connection:    ${ev.connection.connection_encrypted ? "\x1b[32mEncrypted\x1b[0m" : "\x1b[31mPlaintext\x1b[0m"}${ev.connection.ssl_version ? ` (${ev.connection.ssl_version})` : ""}`);
+                    if (ev.connection.ssl_cipher)
+                        console.log(`  Cipher:        ${ev.connection.ssl_cipher} (${ev.connection.ssl_bits} bits)`);
+                    console.log(`  Server:        ${ev.infrastructure.db_version_short}`);
+                    console.log(`  Password enc:  ${ev.security_config.password_encryption}`);
+                    console.log("  ──────────────────────────────────────");
+                    console.log(`  Tables:        ${ev.schema.total_tables} (${ev.schema.pii_columns_found} PII columns)`);
+                    console.log(`  Encrypted:     \x1b[32m${ev.encryption.summary.encrypted_fields}/${ev.encryption.summary.total_pii_fields}\x1b[0m fields`);
+                    console.log(`  Rows scanned:  ${ev.encryption.summary.total_rows_scanned.toLocaleString()}`);
+                    console.log(`  Rows encrypted: \x1b[32m${ev.encryption.summary.total_rows_encrypted.toLocaleString()}\x1b[0m`);
+                    console.log(`  Rows plaintext: ${ev.encryption.summary.total_rows_plaintext > 0 ? `\x1b[31m${ev.encryption.summary.total_rows_plaintext.toLocaleString()}\x1b[0m` : "\x1b[32m0\x1b[0m"}`);
+                    console.log(`  Rows null:     ${ev.encryption.summary.total_rows_null.toLocaleString()}`);
+                    console.log(`  Patterns:      ${ev.encryption.summary.encryption_patterns_found.join(", ") || "none"}`);
+                    console.log(`  Coverage:      ${ev.encryption.summary.coverage_percent}%`);
+                    console.log("  ──────────────────────────────────────");
+                    console.log(`  RLS:           ${ev.rls.summary.rls_enabled_count}/${ev.rls.summary.total_tables} tables (${ev.rls.summary.coverage_percent}%)`);
+                    console.log(`  Policies:      ${ev.rls.summary.total_policies}`);
+                    if (ev.rls.summary.tables_without_rls.length > 0 && ev.rls.summary.tables_without_rls.length <= 5) {
+                        console.log(`  \x1b[31mNo RLS:\x1b[0m        ${ev.rls.summary.tables_without_rls.join(", ")}`);
+                    }
+                    console.log("  ──────────────────────────────────────");
+                    console.log(`  Extensions:    ${ev.infrastructure.security_extensions.join(", ") || "none security-related"}`);
+                    console.log(`  Enc functions: ${ev.infrastructure.encrypt_functions.length}`);
+                    console.log(`  Enc triggers:  ${ev.infrastructure.encrypt_triggers.length}`);
+                    console.log(`  Superusers:    ${ev.security_config.roles_with_superuser}`);
+                    console.log(`  Login roles:   ${ev.security_config.roles_with_login}`);
+                    console.log(`  Log level:     ${ev.security_config.log_statement}`);
+                    console.log(`  Scan time:     ${(ev.scan_duration_ms / 1000).toFixed(1)}s`);
+                    console.log("  ══════════════════════════════════════");
+                    console.log(`  \x1b[2mFull evidence: ${evidencePath}\x1b[0m\n`);
+                }
+            }
         }
         catch (err) {
             log(ciMode, `DB scan failed: ${err instanceof Error ? err.message : err}`);

package/dist/db-scanner.d.ts

@@ -1,7 +1,123 @@
 import type { PIIFieldResult, RLSResult, InfraResult } from "./types";
+export interface DbEvidence {
+    connection: ConnectionEvidence;
+    schema: SchemaEvidence;
+    encryption: EncryptionEvidence;
+    rls: RlsEvidence;
+    infrastructure: InfraEvidence;
+    security_config: SecurityConfigEvidence;
+    collected_at: string;
+    scan_duration_ms: number;
+}
+interface ConnectionEvidence {
+    ssl_in_use: boolean;
+    ssl_version: string | null;
+    ssl_cipher: string | null;
+    ssl_bits: number | null;
+    server_host: string;
+    server_version: string;
+    connection_encrypted: boolean;
+}
+interface SchemaEvidence {
+    total_tables: number;
+    total_columns: number;
+    pii_columns_found: number;
+    tables_with_pii: string[];
+    companion_columns_found: number;
+}
+interface EncryptionEvidence {
+    fields: FieldEncryptionEvidence[];
+    summary: {
+        total_pii_fields: number;
+        encrypted_fields: number;
+        plaintext_fields: number;
+        total_rows_scanned: number;
+        total_rows_encrypted: number;
+        total_rows_plaintext: number;
+        total_rows_null: number;
+        encryption_patterns_found: string[];
+        coverage_percent: number;
+    };
+}
+interface FieldEncryptionEvidence {
+    table: string;
+    column: string;
+    pii_type: string;
+    data_type: string;
+    total_rows: number;
+    non_null_rows: number;
+    null_rows: number;
+    encrypted_rows: number;
+    plaintext_rows: number;
+    coverage_percent: number;
+    pattern_counts: {
+        aes256gcm_v1: number;
+        enc_v1: number;
+        enc_any: number;
+        ndc_enc: number;
+        base64_long: number;
+    };
+    dominant_pattern: string;
+    has_companion: boolean;
+    companion_encrypted_rows: number;
+    is_encrypted: boolean;
+    evidence_source: string;
+}
+interface RlsEvidence {
+    tables: RlsTableEvidence[];
+    summary: {
+        total_tables: number;
+        rls_enabled_count: number;
+        rls_disabled_count: number;
+        total_policies: number;
+        coverage_percent: number;
+        tables_without_rls: string[];
+    };
+}
+interface RlsTableEvidence {
+    table: string;
+    rls_enabled: boolean;
+    force_rls: boolean;
+    policy_count: number;
+    policies: Array<{
+        name: string;
+        command: string;
+        permissive: string;
+    }>;
+}
+interface InfraEvidence {
+    db_type: string;
+    db_version_full: string;
+    db_version_short: string;
+    ssl_enabled: boolean;
+    extensions: string[];
+    security_extensions: string[];
+    encrypt_functions: string[];
+    encrypt_triggers: string[];
+    has_pgcrypto: boolean;
+    has_pgsodium: boolean;
+}
+interface SecurityConfigEvidence {
+    password_encryption: string;
+    ssl_setting: string;
+    log_connections: boolean;
+    log_disconnections: boolean;
+    log_statement: string;
+    statement_timeout: string;
+    row_security: boolean;
+    roles_with_superuser: number;
+    roles_with_createdb: number;
+    roles_with_login: number;
+    search_path: string;
+    current_user: string;
+    session_user: string;
+    is_superuser: boolean;
+}
 export declare function scanDatabase(connectionString: string, onProgress?: (msg: string) => void): Promise<{
     tables: number;
     pii_fields: PIIFieldResult[];
     rls: RLSResult[];
     infra: InfraResult;
+    evidence?: DbEvidence;
 }>;
+export {};

package/dist/db-scanner.js

@@ -1,37 +1,39 @@
 "use strict";
-// ═══════════════════════════════════════════════════════════
-// @nodatachat/guard — Database Scanner (Blind Probe)
+// ═══════════════════════���═══════════════════════════════════
+// @nodatachat/guard — Database Scanner (Forensic Probe)
+//
+// Comprehensive, evidence-based database security analysis.
+// Every finding is backed by a DB query result — zero assumptions.
 //
-// Connects to the customer's DB and checks encryption status.
 // READS ONLY:
-//   - Schema (table/column names, data types)
-//   - Counts (row counts, encrypted counts)
-//   - Prefixes (LEFT(value, N) — detects encryption without reading data):
-//       "aes256gcm:v1:" (13 chars) — direct AES-256-GCM
-//       "enc:v1:"       (7 chars)  — Capsule Proxy encryption
-//       "ndc_enc_"      (8 chars)  — @nodatachat/protect format
-//   - System tables (pg_policies, pg_user, pg_settings, pg_extension)
+//   - Schema metadata (information_schema, pg_catalog)
+//   - Value PREFIXES via LEFT(col, N) — never actual data
+//   - System views (pg_settings, pg_policies, pg_roles, pg_stat_ssl)
+//   - Counts and aggregates — never individual rows
 //
-// NEVER READS: actual data values, passwords, tokens, emails, phones
-// ═══════════════════════════════════════════════════════════
+// NEVER READS: actual data values, passwords, tokens, PII content
+// ════════════════════��══════════════════════════���═══════════
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanDatabase = scanDatabase;
 const pg_1 = require("pg");
-// ── PII patterns (same as code-scanner) ──
+// ── PII column name patterns ──
 const PII_PATTERNS = [
-    { pattern: /^(email|e_?mail|email_?address)$/i, type: "email" },
-    { pattern: /^(phone|mobile|telephone|phone_?number)$/i, type: "phone" },
-    { pattern: /^(address|street_?address|home_?address)$/i, type: "address" },
-    { pattern: /^(ip_?address)$/i, type: "tracking" },
-    { pattern: /^(latitude|longitude|lat|lng)$/i, type: "location" },
+    { pattern: /^(email|e_?mail|email_?address|user_?email|contact_?email)$/i, type: "email" },
+    { pattern: /^(phone|mobile|telephone|phone_?number|cell_?phone|contact_?phone|sms_?number)$/i, type: "phone" },
+    { pattern: /^(address|street_?address|home_?address|mailing_?address|postal_?address)$/i, type: "address" },
+    { pattern: /^(ip_?address|client_?ip|remote_?ip|source_?ip|user_?ip)$/i, type: "tracking" },
+    { pattern: /^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i, type: "location" },
     { pattern: /^(signature|digital_?signature)$/i, type: "id" },
-    { pattern: /^(full_?name|first_?name|last_?name)$/i, type: "name" },
-    { pattern: /^(id_?number|ssn|national_?id|passport)$/i, type: "id" },
-    { pattern: /^(bank_?account|credit_?card|iban)$/i, type: "financial" },
-    { pattern: /^(salary|income)$/i, type: "financial" },
-    { pattern: /^(date_?of_?birth|dob)$/i, type: "dob" },
+    { pattern: /^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name|given_?name|family_?name)$/i, type: "name" },
+    { pattern: /^(id_?number|ssn|national_?id|passport|driver_?license|identity_?number|teudat_?zehut)$/i, type: "id" },
+    { pattern: /^(bank_?account|credit_?card|iban|account_?number|card_?number|routing_?number)$/i, type: "financial" },
+    { pattern: /^(salary|income|compensation|wage)$/i, type: "financial" },
+    { pattern: /^(date_?of_?birth|dob|birth_?date|birthday)$/i, type: "dob" },
+    { pattern: /^(biometric|fingerprint|face_?id|voice_?print)$/i, type: "biometric" },
+    { pattern: /^(device_?id|device_?fingerprint|browser_?fingerprint)$/i, type: "tracking" },
+    { pattern: /^(user_?agent)$/i, type: "tracking" },
 ];
-const SKIP_COLUMNS = /^(id|uuid|created_?at|updated_?at|status|type|description|title|name|display_?name|password_?hash|secret|token|key|value|metadata|config)$/i;
+const SKIP_COLUMNS = /^(id|uuid|created_?at|updated_?at|status|type|description|title|name|display_?name|password_?hash|password|secret|token|key|value|metadata|config|settings|data|content|body|slug|enabled|active|version|role)$/i;
 function classifyColumn(col) {
     if (SKIP_COLUMNS.test(col))
         return null;
@@ -48,31 +50,44 @@ function quoteIdent(name) {
 }
 // ── Main DB scan ──
 async function scanDatabase(connectionString, onProgress) {
+    const startTime = Date.now();
     const client = new pg_1.Client({
         connectionString,
-        ssl: connectionString.includes("supabase.co") ? { rejectUnauthorized: false } : undefined,
-        statement_timeout: 10000,
+        ssl: connectionString.includes("supabase.co") || connectionString.includes("pooler")
+            ? { rejectUnauthorized: false }
+            : undefined,
+        statement_timeout: 15000,
     });
     try {
         await client.connect();
         onProgress?.("Connected to database");
-        // ── 1. Schema discovery ──
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 1: Connection Security
+        // ═══════════��═══════════════════════════════════════════
+        onProgress?.("Verifying connection security...");
+        const connectionEvidence = await collectConnectionEvidence(client);
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 2: Schema Discovery
+        // ═════════════════════════════════════════════════��═════
         onProgress?.("Discovering schema...");
         const { rows: columns } = await client.query(`
-      SELECT table_name, column_name, data_type
+      SELECT table_name, column_name, data_type, is_nullable
       FROM information_schema.columns
       WHERE table_schema = 'public'
       ORDER BY table_name, ordinal_position
     `);
         const tables = new Set();
         const columnSet = new Set();
+        const columnTypes = new Map();
         for (const row of columns) {
             tables.add(row.table_name);
             columnSet.add(`${row.table_name}.${row.column_name}`);
+            columnTypes.set(`${row.table_name}.${row.column_name}`, row.data_type);
         }
         // Find PII fields
         const piiFields = [];
         const seen = new Set();
+        const tablesWithPii = new Set();
         for (const row of columns) {
             const piiType = classifyColumn(row.column_name);
             if (!piiType)
@@ -81,6 +96,7 @@ async function scanDatabase(connectionString, onProgress) {
             if (seen.has(key))
                 continue;
             seen.add(key);
+            tablesWithPii.add(row.table_name);
             piiFields.push({
                 table: row.table_name,
                 column: row.column_name,
@@ -92,122 +108,357 @@ async function scanDatabase(connectionString, onProgress) {
                 encrypted_count: 0,
             });
         }
-        // ── 2. Encryption detection ──
-        onProgress?.(`Checking encryption on ${piiFields.length} PII fields...`);
+        const companionCount = piiFields.filter(f => f.has_companion_column).length;
+        const schemaEvidence = {
+            total_tables: tables.size,
+            total_columns: columns.length,
+            pii_columns_found: piiFields.length,
+            tables_with_pii: [...tablesWithPii],
+            companion_columns_found: companionCount,
+        };
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 3: Encryption Verification (per-field)
+        // ═══════════════════════════════════════════════════════
+        onProgress?.(`Verifying encryption on ${piiFields.length} PII fields...`);
+        const fieldEvidence = [];
+        let totalRowsScanned = 0, totalEncrypted = 0, totalPlaintext = 0, totalNull = 0;
+        const patternsFound = new Set();
         for (const field of piiFields) {
-            // Check both original and _encrypted companion
-            const columnsToCheck = [
+            const colsToCheck = [
                 { col: field.column, isCompanion: false },
             ];
             if (field.has_companion_column) {
-                columnsToCheck.push({ col: `${field.column}_encrypted`, isCompanion: true });
+                colsToCheck.push({ col: `${field.column}_encrypted`, isCompanion: true });
             }
-            for (const { col, isCompanion } of columnsToCheck) {
+            const fe = {
+                table: field.table,
+                column: field.column,
+                pii_type: field.pii_type,
+                data_type: columnTypes.get(`${field.table}.${field.column}`) || "unknown",
+                total_rows: 0, non_null_rows: 0, null_rows: 0,
+                encrypted_rows: 0, plaintext_rows: 0, coverage_percent: 0,
+                pattern_counts: { aes256gcm_v1: 0, enc_v1: 0, enc_any: 0, ndc_enc: 0, base64_long: 0 },
+                dominant_pattern: "none",
+                has_companion: field.has_companion_column,
+                companion_encrypted_rows: 0,
+                is_encrypted: false,
+                evidence_source: "none",
+            };
+            for (const { col, isCompanion } of colsToCheck) {
                 try {
-                    // SAFE: LEFT(value, N) reads only the prefix — never actual data
-                    // Detects multiple encryption formats:
-                    //   aes256gcm:v1:  — legacy direct encryption (13 chars)
-                    //   enc:v1:        — Capsule Proxy encryption (7 chars)
-                    //   ndc_enc_       — @nodatachat/protect format (8 chars)
-                    //   enc:           — any enc: prefix variant (4 chars)
-                    //   Also checks for long base64 strings (>80 chars, alphanumeric)
                     const { rows } = await client.query(`
             SELECT
-              count(*) as total,
-              count(${quoteIdent(col)}) as non_null,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 13) = 'aes256gcm:v1:') as aes_gcm,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 7) = 'enc:v1:') as enc_v1,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 4) = 'enc:') as enc_any,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 8) = 'ndc_enc_') as ndc_enc,
+              count(*)::int as total,
+              count(${quoteIdent(col)})::int as non_null,
+              (count(*) - count(${quoteIdent(col)}))::int as null_count,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 13) = 'aes256gcm:v1:')::int as aes_gcm,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 7) = 'enc:v1:')::int as enc_v1,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 4) = 'enc:')::int as enc_any,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 8) = 'ndc_enc_')::int as ndc_enc,
               count(*) FILTER (WHERE LENGTH(${quoteIdent(col)}::text) > 80
-                AND ${quoteIdent(col)}::text ~ '^[A-Za-z0-9+/=:_-]+$') as base64_long
+                AND ${quoteIdent(col)}::text ~ '^[A-Za-z0-9+/=:_-]+$')::int as base64_long
             FROM ${quoteIdent(field.table)}
           `);
-                    const total = parseInt(rows[0].total);
-                    const nonNull = parseInt(rows[0].non_null);
-                    const aesGcm = parseInt(rows[0].aes_gcm);
-                    const encV1 = parseInt(rows[0].enc_v1);
-                    const encAny = parseInt(rows[0].enc_any);
-                    const ndcEnc = parseInt(rows[0].ndc_enc);
-                    const b64 = parseInt(rows[0].base64_long);
-                    // enc_any catches enc:v1:, enc:v2:, enc:aes:, etc.
-                    // Use the most specific match for naming, but count all enc: variants
-                    const encDirectPrefixes = Math.max(aesGcm, encV1, encAny, ndcEnc);
-                    const encCount = encDirectPrefixes + (encDirectPrefixes === 0 ? b64 : 0);
-                    // Determine pattern name for reporting
+                    const r = rows[0];
+                    const total = r.total, nonNull = r.non_null, nullCount = r.null_count;
+                    const aesGcm = r.aes_gcm, encV1 = r.enc_v1, encAny = r.enc_any;
+                    const ndcEnc = r.ndc_enc, b64 = r.base64_long;
+                    const encCount = Math.max(aesGcm, encV1, encAny, ndcEnc, b64);
                     const pattern = aesGcm > 0 ? "aes256gcm:v1"
-                        : encV1 > 0 ? "enc:v1 (Capsule Proxy)"
-                            : encAny > 0 ? "enc: (encrypted prefix)"
-                                : ndcEnc > 0 ? "ndc_enc (Protect)"
+                        : encV1 > 0 ? "enc:v1"
+                            : encAny > 0 ? "enc:"
+                                : ndcEnc > 0 ? "ndc_enc"
                                     : b64 > 0 ? "base64_long"
-                                        : "unknown";
-                    if (isCompanion && encCount > 0) {
-                        field.encrypted = true;
-                        field.encryption_pattern = pattern;
-                        field.encrypted_count = encCount;
+                                        : "none";
+                    if (isCompanion) {
+                        fe.companion_encrypted_rows = encCount;
+                        if (encCount > 0) {
+                            fe.is_encrypted = true;
+                            fe.evidence_source = `companion:${pattern}`;
+                            fe.dominant_pattern = pattern;
+                            if (pattern !== "none")
+                                patternsFound.add(pattern);
+                        }
                     }
-                    else if (!isCompanion) {
+                    else {
+                        fe.total_rows = total;
+                        fe.non_null_rows = nonNull;
+                        fe.null_rows = nullCount;
+                        fe.encrypted_rows = encCount;
+                        fe.plaintext_rows = nonNull - encCount;
+                        fe.coverage_percent = nonNull > 0 ? Math.round((encCount / nonNull) * 100) : 0;
+                        fe.pattern_counts = {
+                            aes256gcm_v1: aesGcm, enc_v1: encV1, enc_any: encAny,
+                            ndc_enc: ndcEnc, base64_long: b64,
+                        };
+                        if (encCount > 0) {
+                            fe.is_encrypted = true;
+                            fe.dominant_pattern = pattern;
+                            fe.evidence_source = `prefix:${pattern}`;
+                            if (pattern !== "none")
+                                patternsFound.add(pattern);
+                        }
+                        // Update PIIFieldResult for backward compat
                         field.row_count = total;
-                        // If even ONE row has an encryption prefix → encryption is implemented.
-                        // Coverage (what % of rows) is tracked separately for the report.
                         if (encCount > 0) {
                             field.encrypted = true;
                             field.encryption_pattern = pattern;
                             field.encrypted_count = encCount;
                             field.sentinel_prefix = pattern;
                         }
+                        totalRowsScanned += total;
+                        totalEncrypted += encCount;
+                        totalPlaintext += (nonNull - encCount);
+                        totalNull += nullCount;
                     }
                 }
-                catch { /* column might not exist */ }
+                catch { /* column might not exist or query error */ }
             }
+            fieldEvidence.push(fe);
         }
-        // ── 3. RLS ──
-        onProgress?.("Checking Row-Level Security...");
+        const encryptionEvidence = {
+            fields: fieldEvidence,
+            summary: {
+                total_pii_fields: piiFields.length,
+                encrypted_fields: piiFields.filter(f => f.encrypted).length,
+                plaintext_fields: piiFields.filter(f => !f.encrypted).length,
+                total_rows_scanned: totalRowsScanned,
+                total_rows_encrypted: totalEncrypted,
+                total_rows_plaintext: totalPlaintext,
+                total_rows_null: totalNull,
+                encryption_patterns_found: [...patternsFound],
+                coverage_percent: totalRowsScanned > 0
+                    ? Math.round((totalEncrypted / (totalEncrypted + totalPlaintext)) * 100) : 0,
+            },
+        };
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 4: Row-Level Security (per-table)
+        // ═════════════════════════════════════════════��═════════
+        onProgress?.("Analyzing Row-Level Security policies...");
         const { rows: rlsTables } = await client.query(`
       SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'
     `);
+        // Force RLS check
+        let forceRlsMap = new Map();
+        try {
+            const { rows: forceRows } = await client.query(`
+        SELECT relname, relforcerowsecurity
+        FROM pg_class c JOIN pg_namespace n ON c.relnamespace = n.oid
+        WHERE n.nspname = 'public' AND c.relkind = 'r'
+      `);
+            for (const r of forceRows)
+                forceRlsMap.set(r.relname, r.relforcerowsecurity);
+        }
+        catch { /* older PG versions */ }
+        // Policy details
         const { rows: rlsPolicies } = await client.query(`
-      SELECT tablename, policyname FROM pg_policies WHERE schemaname = 'public'
+      SELECT tablename, policyname, cmd, permissive
+      FROM pg_policies WHERE schemaname = 'public'
     `);
-        const policyCount = new Map();
+        const policyMap = new Map();
         for (const p of rlsPolicies) {
-            policyCount.set(p.tablename, (policyCount.get(p.tablename) || 0) + 1);
+            const list = policyMap.get(p.tablename) || [];
+            list.push({ name: p.policyname, command: p.cmd, permissive: p.permissive });
+            policyMap.set(p.tablename, list);
         }
-        const rls = rlsTables.map((t) => ({
+        const rlsTableEvidence = rlsTables.map((t) => ({
             table: t.tablename,
             rls_enabled: t.rowsecurity,
-            policy_count: policyCount.get(t.tablename) || 0,
+            force_rls: forceRlsMap.get(t.tablename) ?? false,
+            policy_count: policyMap.get(t.tablename)?.length ?? 0,
+            policies: policyMap.get(t.tablename) || [],
         }));
-        // ── 4. Infrastructure ──
-        onProgress?.("Checking infrastructure...");
+        const tablesWithoutRls = rlsTableEvidence.filter(t => !t.rls_enabled).map(t => t.table);
+        const rlsEvidence = {
+            tables: rlsTableEvidence,
+            summary: {
+                total_tables: rlsTableEvidence.length,
+                rls_enabled_count: rlsTableEvidence.filter(t => t.rls_enabled).length,
+                rls_disabled_count: tablesWithoutRls.length,
+                total_policies: rlsPolicies.length,
+                coverage_percent: rlsTableEvidence.length > 0
+                    ? Math.round((rlsTableEvidence.filter(t => t.rls_enabled).length / rlsTableEvidence.length) * 100) : 0,
+                tables_without_rls: tablesWithoutRls,
+            },
+        };
+        // Backward compat
+        const rls = rlsTableEvidence.map(t => ({
+            table: t.table, rls_enabled: t.rls_enabled, policy_count: t.policy_count,
+        }));
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 5: Infrastructure & Extensions
+        // ═══════════════════════════════════════════════════════
+        onProgress?.("Collecting infrastructure evidence...");
         const { rows: vRows } = await client.query("SELECT version()");
-        const dbVersion = vRows[0]?.version?.split(" ").slice(0, 2).join(" ") || "unknown";
+        const fullVersion = vRows[0]?.version || "unknown";
+        const shortVersion = fullVersion.split(" ").slice(0, 2).join(" ");
         const { rows: sslRows } = await client.query("SELECT setting FROM pg_settings WHERE name = 'ssl'");
-        const ssl = sslRows[0]?.setting === "on";
-        const { rows: extRows } = await client.query("SELECT extname FROM pg_extension");
+        const sslEnabled = sslRows[0]?.setting === "on";
+        const { rows: extRows } = await client.query("SELECT extname FROM pg_extension ORDER BY extname");
         const extensions = extRows.map((r) => r.extname);
+        const securityExts = extensions.filter((e) => ["pgcrypto", "pgsodium", "pgaudit", "pg_stat_statements", "supabase_vault"].includes(e));
         const { rows: funcRows } = await client.query(`
       SELECT routine_name FROM information_schema.routines
       WHERE routine_schema = 'public'
-      AND (routine_name LIKE 'nodata_%' OR routine_name LIKE 'trg_encrypt_%')
+      AND (routine_name LIKE 'nodata_%' OR routine_name LIKE 'trg_encrypt_%'
+           OR routine_name LIKE 'encrypt_%' OR routine_name LIKE 'decrypt_%')
     `);
-        const funcNames = funcRows.map((r) => r.routine_name);
+        const encFunctions = funcRows.map((r) => r.routine_name);
         const { rows: trigRows } = await client.query(`
-      SELECT trigger_name FROM information_schema.triggers
-      WHERE trigger_schema = 'public' AND trigger_name LIKE 'encrypt_%'
+      SELECT trigger_name, event_object_table, action_timing, event_manipulation
+      FROM information_schema.triggers
+      WHERE trigger_schema = 'public'
     `);
+        const encTriggers = trigRows
+            .filter((t) => /encrypt|nodata|capsule/i.test(t.trigger_name))
+            .map((t) => `${t.trigger_name} ON ${t.event_object_table} (${t.action_timing} ${t.event_manipulation})`);
+        const infraEvidence = {
+            db_type: "PostgreSQL",
+            db_version_full: fullVersion,
+            db_version_short: shortVersion,
+            ssl_enabled: sslEnabled,
+            extensions,
+            security_extensions: securityExts,
+            encrypt_functions: encFunctions,
+            encrypt_triggers: encTriggers,
+            has_pgcrypto: extensions.includes("pgcrypto"),
+            has_pgsodium: extensions.includes("pgsodium"),
+        };
+        // Backward compat
         const infra = {
             db_type: "PostgreSQL",
-            db_version: dbVersion,
-            ssl,
+            db_version: shortVersion,
+            ssl: sslEnabled,
             has_pgcrypto: extensions.includes("pgcrypto"),
-            encrypt_functions: funcNames.includes("nodata_encrypt"),
-            trigger_count: trigRows.length,
+            encrypt_functions: encFunctions.length > 0,
+            trigger_count: encTriggers.length,
         };
-        onProgress?.("DB scan complete");
-        return { tables: tables.size, pii_fields: piiFields, rls, infra };
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 6: Security Configuration
+        // ═════════════════════════════════════════════���═════════
+        onProgress?.("Auditing security configuration...");
+        const securityConfig = await collectSecurityConfig(client);
+        // ═══════════════════════════════════════════════════════
+        // Assemble full evidence
+        // ══════════════════════════���════════════════════════════
+        const evidence = {
+            connection: connectionEvidence,
+            schema: schemaEvidence,
+            encryption: encryptionEvidence,
+            rls: rlsEvidence,
+            infrastructure: infraEvidence,
+            security_config: securityConfig,
+            collected_at: new Date().toISOString(),
+            scan_duration_ms: Date.now() - startTime,
+        };
+        onProgress?.("DB scan complete — full evidence collected");
+        return { tables: tables.size, pii_fields: piiFields, rls, infra, evidence };
     }
     finally {
         await client.end();
     }
 }
+// ── Evidence collectors ──
+async function collectConnectionEvidence(client) {
+    let sslVersion = null;
+    let sslCipher = null;
+    let sslBits = null;
+    try {
+        const { rows } = await client.query(`
+      SELECT ssl, version, cipher, bits
+      FROM pg_stat_ssl
+      WHERE pid = pg_backend_pid()
+    `);
+        if (rows[0]) {
+            sslVersion = rows[0].version;
+            sslCipher = rows[0].cipher;
+            sslBits = rows[0].bits ? parseInt(rows[0].bits) : null;
+        }
+    }
+    catch { /* pg_stat_ssl might not be available */ }
+    const { rows: vRows } = await client.query("SELECT version()");
+    const version = vRows[0]?.version?.split(" ").slice(0, 2).join(" ") || "unknown";
+    // Mask the host for privacy
+    let host = "unknown";
+    try {
+        const { rows: hRows } = await client.query("SELECT inet_server_addr()::text as host");
+        if (hRows[0]?.host) {
+            const parts = hRows[0].host.split(".");
+            host = parts.length >= 4
+                ? `${parts[0]}.${parts[1]}.***.***.`
+                : hRows[0].host.slice(0, 10) + "...";
+        }
+    }
+    catch { /* ok */ }
+    return {
+        ssl_in_use: sslVersion !== null,
+        ssl_version: sslVersion,
+        ssl_cipher: sslCipher,
+        ssl_bits: sslBits,
+        server_host: host,
+        server_version: version,
+        connection_encrypted: sslVersion !== null,
+    };
+}
+async function collectSecurityConfig(client) {
+    const settings = {};
+    try {
+        const { rows } = await client.query(`
+      SELECT name, setting FROM pg_settings
+      WHERE name IN (
+        'password_encryption', 'ssl', 'log_connections', 'log_disconnections',
+        'log_statement', 'statement_timeout', 'row_security', 'search_path'
+      )
+    `);
+        for (const r of rows)
+            settings[r.name] = r.setting;
+    }
+    catch { /* ok */ }
+    // Role counts
+    let superuserCount = 0, createdbCount = 0, loginCount = 0;
+    try {
+        const { rows } = await client.query(`
+      SELECT
+        count(*) FILTER (WHERE rolsuper)::int as superusers,
+        count(*) FILTER (WHERE rolcreatedb)::int as createdb,
+        count(*) FILTER (WHERE rolcanlogin)::int as logins
+      FROM pg_roles
+    `);
+        if (rows[0]) {
+            superuserCount = rows[0].superusers;
+            createdbCount = rows[0].createdb;
+            loginCount = rows[0].logins;
+        }
+    }
+    catch { /* ok */ }
+    // Current user info
+    let currentUser = "unknown", sessionUser = "unknown", isSuperuser = false;
+    try {
+        const { rows } = await client.query(`
+      SELECT current_user, session_user,
+        (SELECT rolsuper FROM pg_roles WHERE rolname = current_user) as is_super
+    `);
+        if (rows[0]) {
+            currentUser = rows[0].current_user;
+            sessionUser = rows[0].session_user;
+            isSuperuser = rows[0].is_super ?? false;
+        }
+    }
+    catch { /* ok */ }
+    return {
+        password_encryption: settings.password_encryption || "unknown",
+        ssl_setting: settings.ssl || "unknown",
+        log_connections: settings.log_connections === "on",
+        log_disconnections: settings.log_disconnections === "on",
+        log_statement: settings.log_statement || "unknown",
+        statement_timeout: settings.statement_timeout || "unknown",
+        row_security: settings.row_security === "on",
+        roles_with_superuser: superuserCount,
+        roles_with_createdb: createdbCount,
+        roles_with_login: loginCount,
+        search_path: settings.search_path || "unknown",
+        current_user: currentUser,
+        session_user: sessionUser,
+        is_superuser: isSuperuser,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/guard",
-  "version": "2.6.1",
+  "version": "3.0.0",
   "description": "NoData Guard — continuous security scanner. Runs locally, reports only metadata. Your data never leaves your machine.",
   "main": "./dist/cli.js",
   "types": "./dist/cli.d.ts",