@nodatachat/guard 2.6.1 → 3.1.0

package/dist/cli.js

@@ -26,7 +26,8 @@ const reporter_1 = require("./reporter");
 const scheduler_1 = require("./fixers/scheduler");
 const vault_crypto_1 = require("./vault-crypto");
 const capsule_dir_1 = require("./capsule-dir");
-const VERSION = "2.6.1";
+const db_detect_1 = require("./db-detect");
+const VERSION = "3.1.0";
 async function main() {
     const args = process.argv.slice(2);
     // ── Subcommand routing ──
@@ -44,6 +45,12 @@ async function main() {
     if (subcommand === "attest") {
         return handleAttest(args.slice(1));
     }
+    if (subcommand === "detect") {
+        const dir = args.includes("--dir") ? (0, path_1.resolve)(args[args.indexOf("--dir") + 1]) : process.cwd();
+        const result = (0, db_detect_1.detectDatabases)(dir);
+        (0, db_detect_1.printDetectionResults)(result);
+        return;
+    }
     // Parse args
     let licenseKey;
     let dbUrl;
@@ -114,12 +121,21 @@ async function main() {
         licenseKey = process.env.NDC_LICENSE || process.env.NODATA_LICENSE_KEY || process.env.NODATA_API_KEY || process.env.NDC_API_KEY;
     if (!dbUrl)
         dbUrl = process.env.DATABASE_URL;
-    // ── Auto-detect from .env files ──
-    // Guard reads .env files to find DATABASE_URL and license keys.
+    // ── Auto-detect from .env files + project analysis ──
+    // Guard reads .env files AND analyzes the project to find databases.
     // ALL values stay local — never sent anywhere.
-    // If DB URL is found, Guard asks for explicit consent before connecting.
+    // If a DB is found, Guard asks for explicit consent before connecting.
     if (!dbUrl || !licenseKey) {
         const envResult = readEnvFiles(projectDir);
+        // Also run full database detection for richer results
+        if (!dbUrl) {
+            const detection = (0, db_detect_1.detectDatabases)(projectDir);
+            const scannableDb = detection.databases.find(d => d.scannable && d.raw_value);
+            if (scannableDb && !envResult.dbUrl) {
+                envResult.dbUrl = scannableDb.raw_value;
+                envResult.dbSource = `${scannableDb.source} (${scannableDb.engine}/${scannableDb.provider})`;
+            }
+        }
         if (!licenseKey && envResult.licenseKey) {
             licenseKey = envResult.licenseKey;
             if (!ciMode)
@@ -292,6 +308,50 @@ async function main() {
             const encryptedDb = dbResult.pii_fields.filter(f => f.encrypted).length;
             log(ciMode, `DB PII: ${dbResult.pii_fields.length} found, ${encryptedDb} encrypted`);
             log(ciMode, `RLS: ${dbResult.rls.filter(r => r.rls_enabled).length}/${dbResult.rls.length} tables`);
+            // Save full DB evidence
+            if (dbResult.evidence) {
+                const evidencePath = (0, path_1.resolve)(outputDir, "nodata-db-evidence.json");
+                (0, fs_1.writeFileSync)(evidencePath, JSON.stringify(dbResult.evidence, null, 2), "utf-8");
+                log(ciMode, `DB evidence: ${evidencePath}`);
+                // Print evidence summary
+                if (!ciMode) {
+                    const ev = dbResult.evidence;
+                    console.log("");
+                    console.log("  ══════════════════════════════════════");
+                    console.log("  DB EVIDENCE — FORENSIC SUMMARY");
+                    console.log("  ══════════════════════════════════════");
+                    console.log(`  Connection:    ${ev.connection.connection_encrypted ? "\x1b[32mEncrypted\x1b[0m" : "\x1b[31mPlaintext\x1b[0m"}${ev.connection.ssl_version ? ` (${ev.connection.ssl_version})` : ""}`);
+                    if (ev.connection.ssl_cipher)
+                        console.log(`  Cipher:        ${ev.connection.ssl_cipher} (${ev.connection.ssl_bits} bits)`);
+                    console.log(`  Server:        ${ev.infrastructure.db_version_short}`);
+                    console.log(`  Password enc:  ${ev.security_config.password_encryption}`);
+                    console.log("  ──────────────────────────────────────");
+                    console.log(`  Tables:        ${ev.schema.total_tables} (${ev.schema.pii_columns_found} PII columns)`);
+                    console.log(`  Encrypted:     \x1b[32m${ev.encryption.summary.encrypted_fields}/${ev.encryption.summary.total_pii_fields}\x1b[0m fields`);
+                    console.log(`  Rows scanned:  ${ev.encryption.summary.total_rows_scanned.toLocaleString()}`);
+                    console.log(`  Rows encrypted: \x1b[32m${ev.encryption.summary.total_rows_encrypted.toLocaleString()}\x1b[0m`);
+                    console.log(`  Rows plaintext: ${ev.encryption.summary.total_rows_plaintext > 0 ? `\x1b[31m${ev.encryption.summary.total_rows_plaintext.toLocaleString()}\x1b[0m` : "\x1b[32m0\x1b[0m"}`);
+                    console.log(`  Rows null:     ${ev.encryption.summary.total_rows_null.toLocaleString()}`);
+                    console.log(`  Patterns:      ${ev.encryption.summary.encryption_patterns_found.join(", ") || "none"}`);
+                    console.log(`  Coverage:      ${ev.encryption.summary.coverage_percent}%`);
+                    console.log("  ──────────────────────────────────────");
+                    console.log(`  RLS:           ${ev.rls.summary.rls_enabled_count}/${ev.rls.summary.total_tables} tables (${ev.rls.summary.coverage_percent}%)`);
+                    console.log(`  Policies:      ${ev.rls.summary.total_policies}`);
+                    if (ev.rls.summary.tables_without_rls.length > 0 && ev.rls.summary.tables_without_rls.length <= 5) {
+                        console.log(`  \x1b[31mNo RLS:\x1b[0m        ${ev.rls.summary.tables_without_rls.join(", ")}`);
+                    }
+                    console.log("  ──────────────────────────────────────");
+                    console.log(`  Extensions:    ${ev.infrastructure.security_extensions.join(", ") || "none security-related"}`);
+                    console.log(`  Enc functions: ${ev.infrastructure.encrypt_functions.length}`);
+                    console.log(`  Enc triggers:  ${ev.infrastructure.encrypt_triggers.length}`);
+                    console.log(`  Superusers:    ${ev.security_config.roles_with_superuser}`);
+                    console.log(`  Login roles:   ${ev.security_config.roles_with_login}`);
+                    console.log(`  Log level:     ${ev.security_config.log_statement}`);
+                    console.log(`  Scan time:     ${(ev.scan_duration_ms / 1000).toFixed(1)}s`);
+                    console.log("  ══════════════════════════════════════");
+                    console.log(`  \x1b[2mFull evidence: ${evidencePath}\x1b[0m\n`);
+                }
+            }
         }
         catch (err) {
             log(ciMode, `DB scan failed: ${err instanceof Error ? err.message : err}`);
@@ -877,11 +937,13 @@ function printHelp() {
     npx nodata-guard status                                          # Show .capsule/ status (no scan)
     npx nodata-guard diff                                            # Compare last 2 scans
     npx nodata-guard attest --finding ID --status fixed --note "..."  # Manual attestation
+    npx nodata-guard detect                                          # Detect all databases in project
 
   Subcommands:
     status                 Show .capsule/ evidence (scores, proof, overrides) without scanning
     diff                   Compare the last 2 scans — score delta, issues resolved/new
     attest                 Manually attest a finding (saved to .capsule/overrides.json)
+    detect                 Detect all databases in your project (env, deps, config)
       --finding <id>       Finding ID (e.g., PII_UNENCRYPTED_email, ROUTE_NO_AUTH)
       --status <status>    fixed | accepted_risk | not_applicable | compensating_control
       --note <text>        Explanation of what was done

package/dist/db-detect.d.ts

@@ -0,0 +1,24 @@
+export type DbEngine = "postgresql" | "mysql" | "mongodb" | "redis" | "sqlite" | "sqlserver" | "cockroachdb" | "turso" | "dynamodb" | "firebase" | "fauna" | "xata" | "convex" | "d1" | "unknown";
+export type DbProvider = "supabase" | "neon" | "planetscale" | "upstash" | "railway" | "render" | "fly" | "vercel-postgres" | "aws-rds" | "azure" | "gcp-cloudsql" | "digitalocean" | "cockroach-cloud" | "turso-cloud" | "mongodb-atlas" | "firebase-google" | "fauna-cloud" | "xata-cloud" | "convex-cloud" | "cloudflare-d1" | "aiven" | "tembo" | "timescale" | "elephantsql" | "local" | "unknown";
+export interface DetectedDatabase {
+    engine: DbEngine;
+    provider: DbProvider;
+    source: string;
+    connection_key: string;
+    connection_value: string;
+    raw_value: string;
+    scannable: boolean;
+    scan_method: string;
+    confidence: number;
+    details: string;
+}
+export interface DetectionResult {
+    databases: DetectedDatabase[];
+    orm_detected: string | null;
+    framework_detected: string | null;
+    env_files_scanned: string[];
+    config_files_found: string[];
+    total_signals: number;
+}
+export declare function detectDatabases(projectDir: string): DetectionResult;
+export declare function printDetectionResults(result: DetectionResult): void;

package/dist/db-detect.js

@@ -0,0 +1,443 @@
+"use strict";
+// ═══════════════════════════════════════════════════════════
+// @nodatachat/guard — Universal Database Detector
+//
+// Scans a project to find ALL database connections:
+//   1. .env files — connection strings, URLs, keys
+//   2. package.json — ORM/driver dependencies
+//   3. Config files — prisma.schema, drizzle.config, knexfile, etc.
+//   4. Code patterns — import statements, connection code
+//
+// Supports: PostgreSQL, MySQL, MongoDB, Redis, SQLite,
+//           SQL Server, CockroachDB, Turso/LibSQL, DynamoDB,
+//           Supabase, Neon, PlanetScale, Upstash, Firebase,
+//           Fauna, Xata, Convex, D1 (Cloudflare)
+//
+// ALL detection is LOCAL. No data leaves the machine.
+// ═══════════════════════════════════════════════════════════
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDatabases = detectDatabases;
+exports.printDetectionResults = printDetectionResults;
+const path_1 = require("path");
+const fs_1 = require("fs");
+const ENV_PATTERNS = [
+    // Supabase
+    { keys: ["NEXT_PUBLIC_SUPABASE_URL", "SUPABASE_URL", "VITE_SUPABASE_URL", "REACT_APP_SUPABASE_URL", "NUXT_PUBLIC_SUPABASE_URL"],
+        engine: "postgresql", provider: "supabase", urlPattern: /supabase\.co/ },
+    { keys: ["SUPABASE_DB_URL"], engine: "postgresql", provider: "supabase" },
+    // Neon
+    { keys: ["DATABASE_URL", "POSTGRES_URL", "NEON_DATABASE_URL"],
+        engine: "postgresql", provider: "neon", urlPattern: /neon\.tech/ },
+    // PlanetScale
+    { keys: ["DATABASE_URL"], engine: "mysql", provider: "planetscale", urlPattern: /planetscale|psdb\.cloud/ },
+    // Vercel Postgres
+    { keys: ["POSTGRES_URL", "POSTGRES_PRISMA_URL", "POSTGRES_URL_NON_POOLING"],
+        engine: "postgresql", provider: "vercel-postgres", urlPattern: /vercel-storage\.com/ },
+    // Railway
+    { keys: ["DATABASE_URL", "RAILWAY_DATABASE_URL"],
+        engine: "postgresql", provider: "railway", urlPattern: /railway\.app/ },
+    // Render
+    { keys: ["DATABASE_URL"], engine: "postgresql", provider: "render", urlPattern: /render\.com/ },
+    // Fly.io
+    { keys: ["DATABASE_URL"], engine: "postgresql", provider: "fly", urlPattern: /fly\.dev|flycast/ },
+    // Upstash
+    { keys: ["UPSTASH_REDIS_REST_URL", "KV_REST_API_URL"],
+        engine: "redis", provider: "upstash" },
+    // MongoDB Atlas
+    { keys: ["MONGODB_URI", "MONGO_URL", "MONGODB_URL", "DATABASE_URL"],
+        engine: "mongodb", provider: "mongodb-atlas", urlPattern: /mongodb\.net|mongodb\+srv/ },
+    // AWS RDS
+    { keys: ["DATABASE_URL", "RDS_HOSTNAME", "RDS_DB_NAME"],
+        engine: "postgresql", provider: "aws-rds", urlPattern: /rds\.amazonaws\.com/ },
+    // Azure
+    { keys: ["DATABASE_URL", "AZURE_SQL_CONNECTION_STRING"],
+        engine: "sqlserver", provider: "azure", urlPattern: /database\.windows\.net|azure/ },
+    // GCP Cloud SQL
+    { keys: ["DATABASE_URL", "CLOUD_SQL_CONNECTION_NAME"],
+        engine: "postgresql", provider: "gcp-cloudsql", urlPattern: /cloudsql|google/ },
+    // CockroachDB
+    { keys: ["DATABASE_URL"], engine: "cockroachdb", provider: "cockroach-cloud", urlPattern: /cockroachlabs\.cloud/ },
+    // Turso
+    { keys: ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"],
+        engine: "turso", provider: "turso-cloud", urlPattern: /turso\.io|libsql/ },
+    // Firebase
+    { keys: ["FIREBASE_DATABASE_URL", "NEXT_PUBLIC_FIREBASE_DATABASE_URL"],
+        engine: "firebase", provider: "firebase-google", urlPattern: /firebaseio\.com/ },
+    // Fauna
+    { keys: ["FAUNA_SECRET", "FAUNADB_SECRET"],
+        engine: "fauna", provider: "fauna-cloud" },
+    // Xata
+    { keys: ["XATA_API_KEY", "XATA_DATABASE_URL"],
+        engine: "xata", provider: "xata-cloud" },
+    // Convex
+    { keys: ["CONVEX_DEPLOYMENT", "NEXT_PUBLIC_CONVEX_URL"],
+        engine: "convex", provider: "convex-cloud" },
+    // Aiven
+    { keys: ["DATABASE_URL"], engine: "postgresql", provider: "aiven", urlPattern: /aivencloud\.com/ },
+    // Tembo
+    { keys: ["DATABASE_URL"], engine: "postgresql", provider: "tembo", urlPattern: /tembo\.io/ },
+    // Timescale
+    { keys: ["DATABASE_URL"], engine: "postgresql", provider: "timescale", urlPattern: /timescaledb\.io|tsdb\.cloud/ },
+    // DigitalOcean
+    { keys: ["DATABASE_URL"], engine: "postgresql", provider: "digitalocean", urlPattern: /db\.ondigitalocean\.com/ },
+    // Generic PostgreSQL
+    { keys: ["DATABASE_URL", "DIRECT_URL", "POSTGRES_URL", "PG_CONNECTION_STRING", "DB_URL", "POSTGRES_PRISMA_URL"],
+        engine: "postgresql", provider: "unknown", urlPattern: /^postgres(ql)?:\/\// },
+    // Generic MySQL
+    { keys: ["DATABASE_URL", "MYSQL_URL", "DB_URL"],
+        engine: "mysql", provider: "unknown", urlPattern: /^mysql:\/\// },
+    // Generic Redis
+    { keys: ["REDIS_URL", "REDIS_TLS_URL"],
+        engine: "redis", provider: "unknown", urlPattern: /^redis(s)?:\/\// },
+    // Generic SQLite
+    { keys: ["DATABASE_URL"], engine: "sqlite", provider: "local", urlPattern: /^file:|\.sqlite|\.db$/ },
+    // Generic SQL Server
+    { keys: ["DATABASE_URL", "MSSQL_CONNECTION_STRING"],
+        engine: "sqlserver", provider: "unknown", urlPattern: /^mssql:\/\/|Server=/ },
+];
+const DEP_SIGNALS = [
+    // ORMs (high confidence — they define the DB)
+    { packages: ["@prisma/client", "prisma"], engine: "postgresql", orm: "prisma", confidence: 90 },
+    { packages: ["drizzle-orm"], engine: "postgresql", orm: "drizzle", confidence: 85 },
+    { packages: ["typeorm"], engine: "postgresql", orm: "typeorm", confidence: 80 },
+    { packages: ["knex"], engine: "postgresql", orm: "knex", confidence: 75 },
+    { packages: ["sequelize"], engine: "postgresql", orm: "sequelize", confidence: 75 },
+    { packages: ["mongoose", "mongodb"], engine: "mongodb", orm: "mongoose", confidence: 90 },
+    { packages: ["@libsql/client", "better-sqlite3"], engine: "sqlite", orm: undefined, confidence: 85 },
+    // Direct drivers
+    { packages: ["pg", "@neondatabase/serverless"], engine: "postgresql", confidence: 95 },
+    { packages: ["mysql2", "mysql"], engine: "mysql", confidence: 95 },
+    { packages: ["redis", "ioredis", "@upstash/redis"], engine: "redis", confidence: 90 },
+    { packages: ["tedious", "mssql"], engine: "sqlserver", confidence: 90 },
+    // Managed DB SDKs
+    { packages: ["@supabase/supabase-js"], engine: "postgresql", confidence: 85 },
+    { packages: ["@planetscale/database"], engine: "mysql", confidence: 90 },
+    { packages: ["@vercel/postgres"], engine: "postgresql", confidence: 90 },
+    { packages: ["@neondatabase/serverless"], engine: "postgresql", confidence: 90 },
+    { packages: ["@libsql/client"], engine: "turso", confidence: 90 },
+    { packages: ["firebase", "firebase-admin"], engine: "firebase", confidence: 80 },
+    { packages: ["faunadb", "fauna"], engine: "fauna", confidence: 90 },
+    { packages: ["@xata.io/client"], engine: "xata", confidence: 90 },
+    { packages: ["convex"], engine: "convex", confidence: 85 },
+    { packages: ["@aws-sdk/client-dynamodb"], engine: "dynamodb", confidence: 90 },
+];
+const CONFIG_SIGNALS = [
+    {
+        files: ["prisma/schema.prisma", "schema.prisma"],
+        engine: "postgresql", orm: "prisma",
+        parseProvider: (content) => {
+            if (content.includes("supabase"))
+                return "supabase";
+            if (content.includes("neon.tech"))
+                return "neon";
+            if (content.includes("planetscale"))
+                return "planetscale";
+            if (content.includes("cockroach"))
+                return "cockroach-cloud";
+            if (/provider\s*=\s*"mysql"/i.test(content))
+                return "unknown"; // engine override
+            if (/provider\s*=\s*"sqlite"/i.test(content))
+                return "local";
+            return "unknown";
+        },
+    },
+    {
+        files: ["drizzle.config.ts", "drizzle.config.js", "drizzle.config.mjs"],
+        engine: "postgresql", orm: "drizzle",
+    },
+    {
+        files: ["knexfile.js", "knexfile.ts"],
+        engine: "postgresql", orm: "knex",
+    },
+    {
+        files: ["ormconfig.json", "ormconfig.ts", "ormconfig.js"],
+        engine: "postgresql", orm: "typeorm",
+    },
+    {
+        files: [".sequelizerc", "config/database.js", "config/database.json"],
+        engine: "postgresql", orm: "sequelize",
+    },
+    {
+        files: ["firebase.json", ".firebaserc"],
+        engine: "firebase",
+    },
+    {
+        files: ["convex/_generated", "convex/schema.ts"],
+        engine: "convex",
+    },
+    {
+        files: ["wrangler.toml"], // D1
+        engine: "d1",
+        parseProvider: (content) => content.includes("d1_databases") ? "cloudflare-d1" : null,
+    },
+];
+// ── Engine scan capabilities ──
+const SCAN_SUPPORT = {
+    postgresql: { scannable: true, method: "direct_sql" },
+    mysql: { scannable: true, method: "direct_sql" },
+    cockroachdb: { scannable: true, method: "direct_sql" },
+    sqlserver: { scannable: false, method: "not_yet_supported" },
+    mongodb: { scannable: false, method: "not_yet_supported" },
+    redis: { scannable: false, method: "not_applicable" },
+    sqlite: { scannable: false, method: "not_yet_supported" },
+    turso: { scannable: false, method: "not_yet_supported" },
+    dynamodb: { scannable: false, method: "not_applicable" },
+    firebase: { scannable: false, method: "not_applicable" },
+    fauna: { scannable: false, method: "not_applicable" },
+    xata: { scannable: false, method: "not_yet_supported" },
+    convex: { scannable: false, method: "not_applicable" },
+    d1: { scannable: false, method: "not_yet_supported" },
+    unknown: { scannable: false, method: "unknown" },
+};
+// ── Mask connection string ──
+function maskValue(val) {
+    if (val.includes("://")) {
+        try {
+            const u = new URL(val);
+            return `${u.protocol}//${u.username ? u.username.slice(0, 4) + "***" : "***"}@${u.hostname}:${u.port || "???"}${u.pathname}`;
+        }
+        catch { /* fallback */ }
+    }
+    if (val.length > 20)
+        return val.slice(0, 8) + "..." + val.slice(-4);
+    return val.slice(0, 4) + "***";
+}
+// ── Main detection ──
+function detectDatabases(projectDir) {
+    const databases = [];
+    const envFilesScanned = [];
+    const configFilesFound = [];
+    let ormDetected = null;
+    let frameworkDetected = null;
+    const seen = new Set(); // dedup by connection_key + engine
+    // ── Phase 1: Scan .env files ──
+    const envFiles = [
+        ".env", ".env.local", ".env.development", ".env.development.local",
+        ".env.production", ".env.production.local", ".env.staging",
+    ];
+    const envVars = new Map();
+    for (const envFile of envFiles) {
+        const filePath = (0, path_1.resolve)(projectDir, envFile);
+        if (!(0, fs_1.existsSync)(filePath))
+            continue;
+        envFilesScanned.push(envFile);
+        try {
+            const content = (0, fs_1.readFileSync)(filePath, "utf-8");
+            for (const line of content.split("\n")) {
+                const trimmed = line.trim();
+                if (!trimmed || trimmed.startsWith("#"))
+                    continue;
+                const eqIdx = trimmed.indexOf("=");
+                if (eqIdx < 1)
+                    continue;
+                const key = trimmed.slice(0, eqIdx).trim();
+                let val = trimmed.slice(eqIdx + 1).trim();
+                if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+                    val = val.slice(1, -1);
+                }
+                if (val)
+                    envVars.set(key, { val, source: envFile });
+            }
+        }
+        catch { /* skip */ }
+    }
+    // Match env vars to patterns
+    for (const pattern of ENV_PATTERNS) {
+        for (const key of pattern.keys) {
+            const entry = envVars.get(key);
+            if (!entry)
+                continue;
+            // Check URL pattern if specified
+            if (pattern.urlPattern && !pattern.urlPattern.test(entry.val))
+                continue;
+            const dedup = `${key}:${pattern.engine}:${pattern.provider}`;
+            if (seen.has(dedup))
+                continue;
+            seen.add(dedup);
+            const support = SCAN_SUPPORT[pattern.engine];
+            databases.push({
+                engine: pattern.engine,
+                provider: pattern.provider,
+                source: entry.source,
+                connection_key: key,
+                connection_value: maskValue(entry.val),
+                raw_value: entry.val,
+                scannable: support.scannable,
+                scan_method: support.method,
+                confidence: 95,
+                details: `Found ${key} in ${entry.source} → ${pattern.engine} (${pattern.provider})`,
+            });
+        }
+    }
+    // ── Phase 2: Scan package.json ──
+    const pkgPath = (0, path_1.resolve)(projectDir, "package.json");
+    if ((0, fs_1.existsSync)(pkgPath)) {
+        try {
+            const pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, "utf-8"));
+            const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+            // Framework detection
+            if (allDeps.next)
+                frameworkDetected = "nextjs";
+            else if (allDeps.nuxt)
+                frameworkDetected = "nuxt";
+            else if (allDeps.express)
+                frameworkDetected = "express";
+            else if (allDeps.fastify)
+                frameworkDetected = "fastify";
+            else if (allDeps["@sveltejs/kit"])
+                frameworkDetected = "sveltekit";
+            else if (allDeps["@angular/core"])
+                frameworkDetected = "angular";
+            for (const signal of DEP_SIGNALS) {
+                const found = signal.packages.find(p => allDeps[p]);
+                if (!found)
+                    continue;
+                if (signal.orm && !ormDetected)
+                    ormDetected = signal.orm;
+                const dedup = `dep:${found}:${signal.engine}`;
+                if (seen.has(dedup))
+                    continue;
+                seen.add(dedup);
+                const support = SCAN_SUPPORT[signal.engine];
+                databases.push({
+                    engine: signal.engine,
+                    provider: "unknown",
+                    source: "package.json",
+                    connection_key: found,
+                    connection_value: allDeps[found],
+                    raw_value: "",
+                    scannable: support.scannable,
+                    scan_method: support.method,
+                    confidence: signal.confidence,
+                    details: `Dependency "${found}" detected → ${signal.engine}${signal.orm ? ` (ORM: ${signal.orm})` : ""}`,
+                });
+            }
+        }
+        catch { /* skip */ }
+    }
+    // Also check apps/*/package.json for monorepos
+    for (const subDir of ["apps/web", "apps/api", "apps/server", "packages/db", "packages/database"]) {
+        const subPkg = (0, path_1.resolve)(projectDir, subDir, "package.json");
+        if (!(0, fs_1.existsSync)(subPkg))
+            continue;
+        try {
+            const pkg = JSON.parse((0, fs_1.readFileSync)(subPkg, "utf-8"));
+            const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+            for (const signal of DEP_SIGNALS) {
+                const found = signal.packages.find(p => allDeps[p]);
+                if (!found)
+                    continue;
+                const dedup = `dep:${subDir}:${found}:${signal.engine}`;
+                if (seen.has(dedup))
+                    continue;
+                seen.add(dedup);
+                if (signal.orm && !ormDetected)
+                    ormDetected = signal.orm;
+                const support = SCAN_SUPPORT[signal.engine];
+                databases.push({
+                    engine: signal.engine, provider: "unknown",
+                    source: `${subDir}/package.json`,
+                    connection_key: found, connection_value: allDeps[found], raw_value: "",
+                    scannable: support.scannable, scan_method: support.method,
+                    confidence: signal.confidence,
+                    details: `Dependency "${found}" in ${subDir} → ${signal.engine}`,
+                });
+            }
+        }
+        catch { /* skip */ }
+    }
+    // ── Phase 3: Scan config files ──
+    for (const signal of CONFIG_SIGNALS) {
+        for (const file of signal.files) {
+            const filePath = (0, path_1.resolve)(projectDir, file);
+            if (!(0, fs_1.existsSync)(filePath))
+                continue;
+            configFilesFound.push(file);
+            const dedup = `config:${file}:${signal.engine}`;
+            if (seen.has(dedup))
+                continue;
+            seen.add(dedup);
+            let provider = "unknown";
+            try {
+                const content = (0, fs_1.readFileSync)(filePath, "utf-8");
+                if (signal.parseProvider) {
+                    provider = signal.parseProvider(content) || "unknown";
+                }
+            }
+            catch { /* skip */ }
+            if (signal.orm && !ormDetected)
+                ormDetected = signal.orm;
+            const support = SCAN_SUPPORT[signal.engine];
+            databases.push({
+                engine: signal.engine, provider,
+                source: file, connection_key: file, connection_value: "", raw_value: "",
+                scannable: support.scannable, scan_method: support.method,
+                confidence: 80,
+                details: `Config file "${file}" detected → ${signal.engine}${signal.orm ? ` (ORM: ${signal.orm})` : ""}`,
+            });
+        }
+    }
+    // ── Deduplicate: prefer env vars over deps, higher confidence wins ──
+    const unique = new Map();
+    for (const db of databases) {
+        const key = `${db.engine}:${db.provider !== "unknown" ? db.provider : db.connection_key}`;
+        const existing = unique.get(key);
+        if (!existing || db.confidence > existing.confidence || (db.raw_value && !existing.raw_value)) {
+            unique.set(key, db);
+        }
+    }
+    return {
+        databases: [...unique.values()].sort((a, b) => b.confidence - a.confidence),
+        orm_detected: ormDetected,
+        framework_detected: frameworkDetected,
+        env_files_scanned: envFilesScanned,
+        config_files_found: configFilesFound,
+        total_signals: databases.length,
+    };
+}
+// ── Pretty print detection results ──
+function printDetectionResults(result) {
+    console.log("");
+    console.log("  ╔══════════════════════════════════════════╗");
+    console.log("  ║  \x1b[33mDatabase Detection Results\x1b[0m              ║");
+    console.log("  ╚══════════════════════════════════════════╝");
+    console.log("");
+    if (result.framework_detected) {
+        console.log(`  Framework:  \x1b[36m${result.framework_detected}\x1b[0m`);
+    }
+    if (result.orm_detected) {
+        console.log(`  ORM:        \x1b[36m${result.orm_detected}\x1b[0m`);
+    }
+    console.log(`  Scanned:    ${result.env_files_scanned.length} env files, ${result.config_files_found.length} config files`);
+    console.log(`  Signals:    ${result.total_signals} total`);
+    console.log("");
+    if (result.databases.length === 0) {
+        console.log("  \x1b[33mNo databases detected.\x1b[0m");
+        console.log("  Add DATABASE_URL to .env.local or install a database driver.\n");
+        return;
+    }
+    console.log(`  Found \x1b[1m${result.databases.length}\x1b[0m database(s):\n`);
+    for (let i = 0; i < result.databases.length; i++) {
+        const db = result.databases[i];
+        const num = `  ${i + 1}.`;
+        const engineColor = db.scannable ? "\x1b[32m" : "\x1b[33m";
+        const scanLabel = db.scannable ? "\x1b[32m✓ scannable\x1b[0m" : `\x1b[33m○ ${db.scan_method}\x1b[0m`;
+        console.log(`${num} ${engineColor}${db.engine.toUpperCase()}\x1b[0m — ${db.provider} ${scanLabel}`);
+        console.log(`     Source:     ${db.source}`);
+        if (db.connection_value) {
+            console.log(`     Connection: ${db.connection_value}`);
+        }
+        console.log(`     Confidence: ${db.confidence}%`);
+        console.log(`     ${db.details}`);
+        console.log("");
+    }
+    const scannable = result.databases.filter(d => d.scannable);
+    if (scannable.length > 0) {
+        console.log(`  \x1b[32m${scannable.length} database(s) can be scanned for encryption.\x1b[0m`);
+    }
+    const notScannable = result.databases.filter(d => !d.scannable);
+    if (notScannable.length > 0) {
+        console.log(`  \x1b[33m${notScannable.length} database(s) not yet supported for scanning.\x1b[0m`);
+    }
+    console.log("");
+}

package/dist/db-scanner.d.ts

@@ -1,7 +1,123 @@
 import type { PIIFieldResult, RLSResult, InfraResult } from "./types";
+export interface DbEvidence {
+    connection: ConnectionEvidence;
+    schema: SchemaEvidence;
+    encryption: EncryptionEvidence;
+    rls: RlsEvidence;
+    infrastructure: InfraEvidence;
+    security_config: SecurityConfigEvidence;
+    collected_at: string;
+    scan_duration_ms: number;
+}
+interface ConnectionEvidence {
+    ssl_in_use: boolean;
+    ssl_version: string | null;
+    ssl_cipher: string | null;
+    ssl_bits: number | null;
+    server_host: string;
+    server_version: string;
+    connection_encrypted: boolean;
+}
+interface SchemaEvidence {
+    total_tables: number;
+    total_columns: number;
+    pii_columns_found: number;
+    tables_with_pii: string[];
+    companion_columns_found: number;
+}
+interface EncryptionEvidence {
+    fields: FieldEncryptionEvidence[];
+    summary: {
+        total_pii_fields: number;
+        encrypted_fields: number;
+        plaintext_fields: number;
+        total_rows_scanned: number;
+        total_rows_encrypted: number;
+        total_rows_plaintext: number;
+        total_rows_null: number;
+        encryption_patterns_found: string[];
+        coverage_percent: number;
+    };
+}
+interface FieldEncryptionEvidence {
+    table: string;
+    column: string;
+    pii_type: string;
+    data_type: string;
+    total_rows: number;
+    non_null_rows: number;
+    null_rows: number;
+    encrypted_rows: number;
+    plaintext_rows: number;
+    coverage_percent: number;
+    pattern_counts: {
+        aes256gcm_v1: number;
+        enc_v1: number;
+        enc_any: number;
+        ndc_enc: number;
+        base64_long: number;
+    };
+    dominant_pattern: string;
+    has_companion: boolean;
+    companion_encrypted_rows: number;
+    is_encrypted: boolean;
+    evidence_source: string;
+}
+interface RlsEvidence {
+    tables: RlsTableEvidence[];
+    summary: {
+        total_tables: number;
+        rls_enabled_count: number;
+        rls_disabled_count: number;
+        total_policies: number;
+        coverage_percent: number;
+        tables_without_rls: string[];
+    };
+}
+interface RlsTableEvidence {
+    table: string;
+    rls_enabled: boolean;
+    force_rls: boolean;
+    policy_count: number;
+    policies: Array<{
+        name: string;
+        command: string;
+        permissive: string;
+    }>;
+}
+interface InfraEvidence {
+    db_type: string;
+    db_version_full: string;
+    db_version_short: string;
+    ssl_enabled: boolean;
+    extensions: string[];
+    security_extensions: string[];
+    encrypt_functions: string[];
+    encrypt_triggers: string[];
+    has_pgcrypto: boolean;
+    has_pgsodium: boolean;
+}
+interface SecurityConfigEvidence {
+    password_encryption: string;
+    ssl_setting: string;
+    log_connections: boolean;
+    log_disconnections: boolean;
+    log_statement: string;
+    statement_timeout: string;
+    row_security: boolean;
+    roles_with_superuser: number;
+    roles_with_createdb: number;
+    roles_with_login: number;
+    search_path: string;
+    current_user: string;
+    session_user: string;
+    is_superuser: boolean;
+}
 export declare function scanDatabase(connectionString: string, onProgress?: (msg: string) => void): Promise<{
     tables: number;
     pii_fields: PIIFieldResult[];
     rls: RLSResult[];
     infra: InfraResult;
+    evidence?: DbEvidence;
 }>;
+export {};

package/dist/db-scanner.js

@@ -1,37 +1,39 @@
 "use strict";
-// ═══════════════════════════════════════════════════════════
-// @nodatachat/guard — Database Scanner (Blind Probe)
+// ═══════════════════════���═══════════════════════════════════
+// @nodatachat/guard — Database Scanner (Forensic Probe)
+//
+// Comprehensive, evidence-based database security analysis.
+// Every finding is backed by a DB query result — zero assumptions.
 //
-// Connects to the customer's DB and checks encryption status.
 // READS ONLY:
-//   - Schema (table/column names, data types)
-//   - Counts (row counts, encrypted counts)
-//   - Prefixes (LEFT(value, N) — detects encryption without reading data):
-//       "aes256gcm:v1:" (13 chars) — direct AES-256-GCM
-//       "enc:v1:"       (7 chars)  — Capsule Proxy encryption
-//       "ndc_enc_"      (8 chars)  — @nodatachat/protect format
-//   - System tables (pg_policies, pg_user, pg_settings, pg_extension)
+//   - Schema metadata (information_schema, pg_catalog)
+//   - Value PREFIXES via LEFT(col, N) — never actual data
+//   - System views (pg_settings, pg_policies, pg_roles, pg_stat_ssl)
+//   - Counts and aggregates — never individual rows
 //
-// NEVER READS: actual data values, passwords, tokens, emails, phones
-// ═══════════════════════════════════════════════════════════
+// NEVER READS: actual data values, passwords, tokens, PII content
+// ════════════════════��══════════════════════════���═══════════
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanDatabase = scanDatabase;
 const pg_1 = require("pg");
-// ── PII patterns (same as code-scanner) ──
+// ── PII column name patterns ──
 const PII_PATTERNS = [
-    { pattern: /^(email|e_?mail|email_?address)$/i, type: "email" },
-    { pattern: /^(phone|mobile|telephone|phone_?number)$/i, type: "phone" },
-    { pattern: /^(address|street_?address|home_?address)$/i, type: "address" },
-    { pattern: /^(ip_?address)$/i, type: "tracking" },
-    { pattern: /^(latitude|longitude|lat|lng)$/i, type: "location" },
+    { pattern: /^(email|e_?mail|email_?address|user_?email|contact_?email)$/i, type: "email" },
+    { pattern: /^(phone|mobile|telephone|phone_?number|cell_?phone|contact_?phone|sms_?number)$/i, type: "phone" },
+    { pattern: /^(address|street_?address|home_?address|mailing_?address|postal_?address)$/i, type: "address" },
+    { pattern: /^(ip_?address|client_?ip|remote_?ip|source_?ip|user_?ip)$/i, type: "tracking" },
+    { pattern: /^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i, type: "location" },
     { pattern: /^(signature|digital_?signature)$/i, type: "id" },
-    { pattern: /^(full_?name|first_?name|last_?name)$/i, type: "name" },
-    { pattern: /^(id_?number|ssn|national_?id|passport)$/i, type: "id" },
-    { pattern: /^(bank_?account|credit_?card|iban)$/i, type: "financial" },
-    { pattern: /^(salary|income)$/i, type: "financial" },
-    { pattern: /^(date_?of_?birth|dob)$/i, type: "dob" },
+    { pattern: /^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name|given_?name|family_?name)$/i, type: "name" },
+    { pattern: /^(id_?number|ssn|national_?id|passport|driver_?license|identity_?number|teudat_?zehut)$/i, type: "id" },
+    { pattern: /^(bank_?account|credit_?card|iban|account_?number|card_?number|routing_?number)$/i, type: "financial" },
+    { pattern: /^(salary|income|compensation|wage)$/i, type: "financial" },
+    { pattern: /^(date_?of_?birth|dob|birth_?date|birthday)$/i, type: "dob" },
+    { pattern: /^(biometric|fingerprint|face_?id|voice_?print)$/i, type: "biometric" },
+    { pattern: /^(device_?id|device_?fingerprint|browser_?fingerprint)$/i, type: "tracking" },
+    { pattern: /^(user_?agent)$/i, type: "tracking" },
 ];
-const SKIP_COLUMNS = /^(id|uuid|created_?at|updated_?at|status|type|description|title|name|display_?name|password_?hash|secret|token|key|value|metadata|config)$/i;
+const SKIP_COLUMNS = /^(id|uuid|created_?at|updated_?at|status|type|description|title|name|display_?name|password_?hash|password|secret|token|key|value|metadata|config|settings|data|content|body|slug|enabled|active|version|role)$/i;
 function classifyColumn(col) {
     if (SKIP_COLUMNS.test(col))
         return null;
@@ -48,31 +50,44 @@ function quoteIdent(name) {
 }
 // ── Main DB scan ──
 async function scanDatabase(connectionString, onProgress) {
+    const startTime = Date.now();
     const client = new pg_1.Client({
         connectionString,
-        ssl: connectionString.includes("supabase.co") ? { rejectUnauthorized: false } : undefined,
-        statement_timeout: 10000,
+        ssl: connectionString.includes("supabase.co") || connectionString.includes("pooler")
+            ? { rejectUnauthorized: false }
+            : undefined,
+        statement_timeout: 15000,
     });
     try {
         await client.connect();
         onProgress?.("Connected to database");
-        // ── 1. Schema discovery ──
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 1: Connection Security
+        // ═══════════��═══════════════════════════════════════════
+        onProgress?.("Verifying connection security...");
+        const connectionEvidence = await collectConnectionEvidence(client);
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 2: Schema Discovery
+        // ═════════════════════════════════════════════════��═════
         onProgress?.("Discovering schema...");
         const { rows: columns } = await client.query(`
-      SELECT table_name, column_name, data_type
+      SELECT table_name, column_name, data_type, is_nullable
       FROM information_schema.columns
       WHERE table_schema = 'public'
       ORDER BY table_name, ordinal_position
     `);
         const tables = new Set();
         const columnSet = new Set();
+        const columnTypes = new Map();
         for (const row of columns) {
             tables.add(row.table_name);
             columnSet.add(`${row.table_name}.${row.column_name}`);
+            columnTypes.set(`${row.table_name}.${row.column_name}`, row.data_type);
         }
         // Find PII fields
         const piiFields = [];
         const seen = new Set();
+        const tablesWithPii = new Set();
         for (const row of columns) {
             const piiType = classifyColumn(row.column_name);
             if (!piiType)
@@ -81,6 +96,7 @@ async function scanDatabase(connectionString, onProgress) {
             if (seen.has(key))
                 continue;
             seen.add(key);
+            tablesWithPii.add(row.table_name);
             piiFields.push({
                 table: row.table_name,
                 column: row.column_name,
@@ -92,122 +108,357 @@ async function scanDatabase(connectionString, onProgress) {
                 encrypted_count: 0,
             });
         }
-        // ── 2. Encryption detection ──
-        onProgress?.(`Checking encryption on ${piiFields.length} PII fields...`);
+        const companionCount = piiFields.filter(f => f.has_companion_column).length;
+        const schemaEvidence = {
+            total_tables: tables.size,
+            total_columns: columns.length,
+            pii_columns_found: piiFields.length,
+            tables_with_pii: [...tablesWithPii],
+            companion_columns_found: companionCount,
+        };
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 3: Encryption Verification (per-field)
+        // ═══════════════════════════════════════════════════════
+        onProgress?.(`Verifying encryption on ${piiFields.length} PII fields...`);
+        const fieldEvidence = [];
+        let totalRowsScanned = 0, totalEncrypted = 0, totalPlaintext = 0, totalNull = 0;
+        const patternsFound = new Set();
         for (const field of piiFields) {
-            // Check both original and _encrypted companion
-            const columnsToCheck = [
+            const colsToCheck = [
                 { col: field.column, isCompanion: false },
             ];
             if (field.has_companion_column) {
-                columnsToCheck.push({ col: `${field.column}_encrypted`, isCompanion: true });
+                colsToCheck.push({ col: `${field.column}_encrypted`, isCompanion: true });
             }
-            for (const { col, isCompanion } of columnsToCheck) {
+            const fe = {
+                table: field.table,
+                column: field.column,
+                pii_type: field.pii_type,
+                data_type: columnTypes.get(`${field.table}.${field.column}`) || "unknown",
+                total_rows: 0, non_null_rows: 0, null_rows: 0,
+                encrypted_rows: 0, plaintext_rows: 0, coverage_percent: 0,
+                pattern_counts: { aes256gcm_v1: 0, enc_v1: 0, enc_any: 0, ndc_enc: 0, base64_long: 0 },
+                dominant_pattern: "none",
+                has_companion: field.has_companion_column,
+                companion_encrypted_rows: 0,
+                is_encrypted: false,
+                evidence_source: "none",
+            };
+            for (const { col, isCompanion } of colsToCheck) {
                 try {
-                    // SAFE: LEFT(value, N) reads only the prefix — never actual data
-                    // Detects multiple encryption formats:
-                    //   aes256gcm:v1:  — legacy direct encryption (13 chars)
-                    //   enc:v1:        — Capsule Proxy encryption (7 chars)
-                    //   ndc_enc_       — @nodatachat/protect format (8 chars)
-                    //   enc:           — any enc: prefix variant (4 chars)
-                    //   Also checks for long base64 strings (>80 chars, alphanumeric)
                     const { rows } = await client.query(`
             SELECT
-              count(*) as total,
-              count(${quoteIdent(col)}) as non_null,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 13) = 'aes256gcm:v1:') as aes_gcm,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 7) = 'enc:v1:') as enc_v1,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 4) = 'enc:') as enc_any,
-              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 8) = 'ndc_enc_') as ndc_enc,
+              count(*)::int as total,
+              count(${quoteIdent(col)})::int as non_null,
+              (count(*) - count(${quoteIdent(col)}))::int as null_count,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 13) = 'aes256gcm:v1:')::int as aes_gcm,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 7) = 'enc:v1:')::int as enc_v1,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 4) = 'enc:')::int as enc_any,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 8) = 'ndc_enc_')::int as ndc_enc,
               count(*) FILTER (WHERE LENGTH(${quoteIdent(col)}::text) > 80
-                AND ${quoteIdent(col)}::text ~ '^[A-Za-z0-9+/=:_-]+$') as base64_long
+                AND ${quoteIdent(col)}::text ~ '^[A-Za-z0-9+/=:_-]+$')::int as base64_long
             FROM ${quoteIdent(field.table)}
           `);
-                    const total = parseInt(rows[0].total);
-                    const nonNull = parseInt(rows[0].non_null);
-                    const aesGcm = parseInt(rows[0].aes_gcm);
-                    const encV1 = parseInt(rows[0].enc_v1);
-                    const encAny = parseInt(rows[0].enc_any);
-                    const ndcEnc = parseInt(rows[0].ndc_enc);
-                    const b64 = parseInt(rows[0].base64_long);
-                    // enc_any catches enc:v1:, enc:v2:, enc:aes:, etc.
-                    // Use the most specific match for naming, but count all enc: variants
-                    const encDirectPrefixes = Math.max(aesGcm, encV1, encAny, ndcEnc);
-                    const encCount = encDirectPrefixes + (encDirectPrefixes === 0 ? b64 : 0);
-                    // Determine pattern name for reporting
+                    const r = rows[0];
+                    const total = r.total, nonNull = r.non_null, nullCount = r.null_count;
+                    const aesGcm = r.aes_gcm, encV1 = r.enc_v1, encAny = r.enc_any;
+                    const ndcEnc = r.ndc_enc, b64 = r.base64_long;
+                    const encCount = Math.max(aesGcm, encV1, encAny, ndcEnc, b64);
                     const pattern = aesGcm > 0 ? "aes256gcm:v1"
-                        : encV1 > 0 ? "enc:v1 (Capsule Proxy)"
-                            : encAny > 0 ? "enc: (encrypted prefix)"
-                                : ndcEnc > 0 ? "ndc_enc (Protect)"
+                        : encV1 > 0 ? "enc:v1"
+                            : encAny > 0 ? "enc:"
+                                : ndcEnc > 0 ? "ndc_enc"
                                     : b64 > 0 ? "base64_long"
-                                        : "unknown";
-                    if (isCompanion && encCount > 0) {
-                        field.encrypted = true;
-                        field.encryption_pattern = pattern;
-                        field.encrypted_count = encCount;
+                                        : "none";
+                    if (isCompanion) {
+                        fe.companion_encrypted_rows = encCount;
+                        if (encCount > 0) {
+                            fe.is_encrypted = true;
+                            fe.evidence_source = `companion:${pattern}`;
+                            fe.dominant_pattern = pattern;
+                            if (pattern !== "none")
+                                patternsFound.add(pattern);
+                        }
                     }
-                    else if (!isCompanion) {
+                    else {
+                        fe.total_rows = total;
+                        fe.non_null_rows = nonNull;
+                        fe.null_rows = nullCount;
+                        fe.encrypted_rows = encCount;
+                        fe.plaintext_rows = nonNull - encCount;
+                        fe.coverage_percent = nonNull > 0 ? Math.round((encCount / nonNull) * 100) : 0;
+                        fe.pattern_counts = {
+                            aes256gcm_v1: aesGcm, enc_v1: encV1, enc_any: encAny,
+                            ndc_enc: ndcEnc, base64_long: b64,
+                        };
+                        if (encCount > 0) {
+                            fe.is_encrypted = true;
+                            fe.dominant_pattern = pattern;
+                            fe.evidence_source = `prefix:${pattern}`;
+                            if (pattern !== "none")
+                                patternsFound.add(pattern);
+                        }
+                        // Update PIIFieldResult for backward compat
                         field.row_count = total;
-                        // If even ONE row has an encryption prefix → encryption is implemented.
-                        // Coverage (what % of rows) is tracked separately for the report.
                         if (encCount > 0) {
                             field.encrypted = true;
                             field.encryption_pattern = pattern;
                             field.encrypted_count = encCount;
                             field.sentinel_prefix = pattern;
                         }
+                        totalRowsScanned += total;
+                        totalEncrypted += encCount;
+                        totalPlaintext += (nonNull - encCount);
+                        totalNull += nullCount;
                     }
                 }
-                catch { /* column might not exist */ }
+                catch { /* column might not exist or query error */ }
             }
+            fieldEvidence.push(fe);
         }
-        // ── 3. RLS ──
-        onProgress?.("Checking Row-Level Security...");
+        const encryptionEvidence = {
+            fields: fieldEvidence,
+            summary: {
+                total_pii_fields: piiFields.length,
+                encrypted_fields: piiFields.filter(f => f.encrypted).length,
+                plaintext_fields: piiFields.filter(f => !f.encrypted).length,
+                total_rows_scanned: totalRowsScanned,
+                total_rows_encrypted: totalEncrypted,
+                total_rows_plaintext: totalPlaintext,
+                total_rows_null: totalNull,
+                encryption_patterns_found: [...patternsFound],
+                coverage_percent: totalRowsScanned > 0
+                    ? Math.round((totalEncrypted / (totalEncrypted + totalPlaintext)) * 100) : 0,
+            },
+        };
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 4: Row-Level Security (per-table)
+        // ═════════════════════════════════════════════��═════════
+        onProgress?.("Analyzing Row-Level Security policies...");
         const { rows: rlsTables } = await client.query(`
       SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'
     `);
+        // Force RLS check
+        let forceRlsMap = new Map();
+        try {
+            const { rows: forceRows } = await client.query(`
+        SELECT relname, relforcerowsecurity
+        FROM pg_class c JOIN pg_namespace n ON c.relnamespace = n.oid
+        WHERE n.nspname = 'public' AND c.relkind = 'r'
+      `);
+            for (const r of forceRows)
+                forceRlsMap.set(r.relname, r.relforcerowsecurity);
+        }
+        catch { /* older PG versions */ }
+        // Policy details
         const { rows: rlsPolicies } = await client.query(`
-      SELECT tablename, policyname FROM pg_policies WHERE schemaname = 'public'
+      SELECT tablename, policyname, cmd, permissive
+      FROM pg_policies WHERE schemaname = 'public'
     `);
-        const policyCount = new Map();
+        const policyMap = new Map();
         for (const p of rlsPolicies) {
-            policyCount.set(p.tablename, (policyCount.get(p.tablename) || 0) + 1);
+            const list = policyMap.get(p.tablename) || [];
+            list.push({ name: p.policyname, command: p.cmd, permissive: p.permissive });
+            policyMap.set(p.tablename, list);
         }
-        const rls = rlsTables.map((t) => ({
+        const rlsTableEvidence = rlsTables.map((t) => ({
             table: t.tablename,
             rls_enabled: t.rowsecurity,
-            policy_count: policyCount.get(t.tablename) || 0,
+            force_rls: forceRlsMap.get(t.tablename) ?? false,
+            policy_count: policyMap.get(t.tablename)?.length ?? 0,
+            policies: policyMap.get(t.tablename) || [],
         }));
-        // ── 4. Infrastructure ──
-        onProgress?.("Checking infrastructure...");
+        const tablesWithoutRls = rlsTableEvidence.filter(t => !t.rls_enabled).map(t => t.table);
+        const rlsEvidence = {
+            tables: rlsTableEvidence,
+            summary: {
+                total_tables: rlsTableEvidence.length,
+                rls_enabled_count: rlsTableEvidence.filter(t => t.rls_enabled).length,
+                rls_disabled_count: tablesWithoutRls.length,
+                total_policies: rlsPolicies.length,
+                coverage_percent: rlsTableEvidence.length > 0
+                    ? Math.round((rlsTableEvidence.filter(t => t.rls_enabled).length / rlsTableEvidence.length) * 100) : 0,
+                tables_without_rls: tablesWithoutRls,
+            },
+        };
+        // Backward compat
+        const rls = rlsTableEvidence.map(t => ({
+            table: t.table, rls_enabled: t.rls_enabled, policy_count: t.policy_count,
+        }));
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 5: Infrastructure & Extensions
+        // ═══════════════════════════════════════════════════════
+        onProgress?.("Collecting infrastructure evidence...");
         const { rows: vRows } = await client.query("SELECT version()");
-        const dbVersion = vRows[0]?.version?.split(" ").slice(0, 2).join(" ") || "unknown";
+        const fullVersion = vRows[0]?.version || "unknown";
+        const shortVersion = fullVersion.split(" ").slice(0, 2).join(" ");
         const { rows: sslRows } = await client.query("SELECT setting FROM pg_settings WHERE name = 'ssl'");
-        const ssl = sslRows[0]?.setting === "on";
-        const { rows: extRows } = await client.query("SELECT extname FROM pg_extension");
+        const sslEnabled = sslRows[0]?.setting === "on";
+        const { rows: extRows } = await client.query("SELECT extname FROM pg_extension ORDER BY extname");
         const extensions = extRows.map((r) => r.extname);
+        const securityExts = extensions.filter((e) => ["pgcrypto", "pgsodium", "pgaudit", "pg_stat_statements", "supabase_vault"].includes(e));
         const { rows: funcRows } = await client.query(`
       SELECT routine_name FROM information_schema.routines
       WHERE routine_schema = 'public'
-      AND (routine_name LIKE 'nodata_%' OR routine_name LIKE 'trg_encrypt_%')
+      AND (routine_name LIKE 'nodata_%' OR routine_name LIKE 'trg_encrypt_%'
+           OR routine_name LIKE 'encrypt_%' OR routine_name LIKE 'decrypt_%')
     `);
-        const funcNames = funcRows.map((r) => r.routine_name);
+        const encFunctions = funcRows.map((r) => r.routine_name);
         const { rows: trigRows } = await client.query(`
-      SELECT trigger_name FROM information_schema.triggers
-      WHERE trigger_schema = 'public' AND trigger_name LIKE 'encrypt_%'
+      SELECT trigger_name, event_object_table, action_timing, event_manipulation
+      FROM information_schema.triggers
+      WHERE trigger_schema = 'public'
     `);
+        const encTriggers = trigRows
+            .filter((t) => /encrypt|nodata|capsule/i.test(t.trigger_name))
+            .map((t) => `${t.trigger_name} ON ${t.event_object_table} (${t.action_timing} ${t.event_manipulation})`);
+        const infraEvidence = {
+            db_type: "PostgreSQL",
+            db_version_full: fullVersion,
+            db_version_short: shortVersion,
+            ssl_enabled: sslEnabled,
+            extensions,
+            security_extensions: securityExts,
+            encrypt_functions: encFunctions,
+            encrypt_triggers: encTriggers,
+            has_pgcrypto: extensions.includes("pgcrypto"),
+            has_pgsodium: extensions.includes("pgsodium"),
+        };
+        // Backward compat
         const infra = {
             db_type: "PostgreSQL",
-            db_version: dbVersion,
-            ssl,
+            db_version: shortVersion,
+            ssl: sslEnabled,
             has_pgcrypto: extensions.includes("pgcrypto"),
-            encrypt_functions: funcNames.includes("nodata_encrypt"),
-            trigger_count: trigRows.length,
+            encrypt_functions: encFunctions.length > 0,
+            trigger_count: encTriggers.length,
         };
-        onProgress?.("DB scan complete");
-        return { tables: tables.size, pii_fields: piiFields, rls, infra };
+        // ═══════════════════════════════════════════════════════
+        // EVIDENCE LAYER 6: Security Configuration
+        // ═════════════════════════════════════════════���═════════
+        onProgress?.("Auditing security configuration...");
+        const securityConfig = await collectSecurityConfig(client);
+        // ═══════════════════════════════════════════════════════
+        // Assemble full evidence
+        // ══════════════════════════���════════════════════════════
+        const evidence = {
+            connection: connectionEvidence,
+            schema: schemaEvidence,
+            encryption: encryptionEvidence,
+            rls: rlsEvidence,
+            infrastructure: infraEvidence,
+            security_config: securityConfig,
+            collected_at: new Date().toISOString(),
+            scan_duration_ms: Date.now() - startTime,
+        };
+        onProgress?.("DB scan complete — full evidence collected");
+        return { tables: tables.size, pii_fields: piiFields, rls, infra, evidence };
     }
     finally {
         await client.end();
     }
 }
+// ── Evidence collectors ──
+async function collectConnectionEvidence(client) {
+    let sslVersion = null;
+    let sslCipher = null;
+    let sslBits = null;
+    try {
+        const { rows } = await client.query(`
+      SELECT ssl, version, cipher, bits
+      FROM pg_stat_ssl
+      WHERE pid = pg_backend_pid()
+    `);
+        if (rows[0]) {
+            sslVersion = rows[0].version;
+            sslCipher = rows[0].cipher;
+            sslBits = rows[0].bits ? parseInt(rows[0].bits) : null;
+        }
+    }
+    catch { /* pg_stat_ssl might not be available */ }
+    const { rows: vRows } = await client.query("SELECT version()");
+    const version = vRows[0]?.version?.split(" ").slice(0, 2).join(" ") || "unknown";
+    // Mask the host for privacy
+    let host = "unknown";
+    try {
+        const { rows: hRows } = await client.query("SELECT inet_server_addr()::text as host");
+        if (hRows[0]?.host) {
+            const parts = hRows[0].host.split(".");
+            host = parts.length >= 4
+                ? `${parts[0]}.${parts[1]}.***.***.`
+                : hRows[0].host.slice(0, 10) + "...";
+        }
+    }
+    catch { /* ok */ }
+    return {
+        ssl_in_use: sslVersion !== null,
+        ssl_version: sslVersion,
+        ssl_cipher: sslCipher,
+        ssl_bits: sslBits,
+        server_host: host,
+        server_version: version,
+        connection_encrypted: sslVersion !== null,
+    };
+}
+async function collectSecurityConfig(client) {
+    const settings = {};
+    try {
+        const { rows } = await client.query(`
+      SELECT name, setting FROM pg_settings
+      WHERE name IN (
+        'password_encryption', 'ssl', 'log_connections', 'log_disconnections',
+        'log_statement', 'statement_timeout', 'row_security', 'search_path'
+      )
+    `);
+        for (const r of rows)
+            settings[r.name] = r.setting;
+    }
+    catch { /* ok */ }
+    // Role counts
+    let superuserCount = 0, createdbCount = 0, loginCount = 0;
+    try {
+        const { rows } = await client.query(`
+      SELECT
+        count(*) FILTER (WHERE rolsuper)::int as superusers,
+        count(*) FILTER (WHERE rolcreatedb)::int as createdb,
+        count(*) FILTER (WHERE rolcanlogin)::int as logins
+      FROM pg_roles
+    `);
+        if (rows[0]) {
+            superuserCount = rows[0].superusers;
+            createdbCount = rows[0].createdb;
+            loginCount = rows[0].logins;
+        }
+    }
+    catch { /* ok */ }
+    // Current user info
+    let currentUser = "unknown", sessionUser = "unknown", isSuperuser = false;
+    try {
+        const { rows } = await client.query(`
+      SELECT current_user, session_user,
+        (SELECT rolsuper FROM pg_roles WHERE rolname = current_user) as is_super
+    `);
+        if (rows[0]) {
+            currentUser = rows[0].current_user;
+            sessionUser = rows[0].session_user;
+            isSuperuser = rows[0].is_super ?? false;
+        }
+    }
+    catch { /* ok */ }
+    return {
+        password_encryption: settings.password_encryption || "unknown",
+        ssl_setting: settings.ssl || "unknown",
+        log_connections: settings.log_connections === "on",
+        log_disconnections: settings.log_disconnections === "on",
+        log_statement: settings.log_statement || "unknown",
+        statement_timeout: settings.statement_timeout || "unknown",
+        row_security: settings.row_security === "on",
+        roles_with_superuser: superuserCount,
+        roles_with_createdb: createdbCount,
+        roles_with_login: loginCount,
+        search_path: settings.search_path || "unknown",
+        current_user: currentUser,
+        session_user: sessionUser,
+        is_superuser: isSuperuser,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/guard",
-  "version": "2.6.1",
+  "version": "3.1.0",
   "description": "NoData Guard — continuous security scanner. Runs locally, reports only metadata. Your data never leaves your machine.",
   "main": "./dist/cli.js",
   "types": "./dist/cli.d.ts",