@rebasepro/rls-check 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/checks/anonymous-write-allowed.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A write policy that lets an unauthenticated caller through, backed by a real grant.
  *

package/dist/checks/current-setting-throws.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * `current_setting('x')` in a policy, without the `missing_ok` second argument.
  *

package/dist/checks/grant-to-public.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A DML privilege granted to PUBLIC.
  *

package/dist/checks/index.d.ts

@@ -6,7 +6,7 @@
  * is not, which is why the list is ordered by severity rather than alphabetically
  * — it is read by humans deciding what to look at first.
  */
-import type { Check, DbSnapshot, Finding } from "../types";
+import type { Check, DbSnapshot, Finding } from "../types.js";
 export declare const CHECKS: Check[];
 export interface RunOptions {
     /** Run only these check ids. */

package/dist/checks/junction-table-unprotected.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * The edge table of a many-to-many relationship, left without RLS while both
  * endpoints have it.

package/dist/checks/matview-bypasses-rls.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A materialized view over an RLS-protected table, readable by an untrusted role.
  *

package/dist/checks/policy-always-true.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A PERMISSIVE policy whose expression is a constant truth, targeted at a role
  * an untrusted caller reaches.

package/dist/checks/policy-anonymous-tautology.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * `auth.uid() IS NOT NULL` and its relatives.
  *

package/dist/checks/policy-role-unreachable.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * Every policy on a table names roles that nothing can arrive as.
  *

package/dist/checks/rls-disabled.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A table with RLS off *and* a DML grant to a role an untrusted caller arrives as.
  *

package/dist/checks/rls-enabled-no-policies.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * RLS on, zero policies — deny-all for everyone except the table's owner.
  *

package/dist/checks/rls-enabled-not-forced.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * RLS on, FORCE off — the table owner is exempt from its own policies.
  *

package/dist/checks/security-definer-mutable-search-path.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A SECURITY DEFINER routine whose `search_path` is not pinned.
  *

package/dist/checks/unqualified-column-in-subquery.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A bare column reference inside a policy subquery that resolves to the *inner*
  * relation when the outer row was meant.

package/dist/checks/util.d.ts

@@ -6,7 +6,7 @@
  * noise, and noise is what gets a tool like this uninstalled — so the helpers
  * below err towards "no" whenever the catalog is ambiguous.
  */
-import type { DbGrant, DbPolicy, DbRelation, DbSnapshot, Finding, Severity } from "../types";
+import type { DbGrant, DbPolicy, DbRelation, DbSnapshot, Finding, Severity } from "../types.js";
 export declare const SEVERITY_ORDER: Severity[];
 export declare const docsFor: (id: string) => string;
 export type Privilege = DbGrant["privileges"][number];

package/dist/checks/view-bypasses-rls.d.ts

@@ -1,4 +1,4 @@
-import type { Check, DbSnapshot, DbView } from "../types";
+import type { Check, DbSnapshot, DbView } from "../types.js";
 /** Base relations of `view` that have RLS turned on. */
 export declare function protectedBaseTables(snapshot: DbSnapshot, view: DbView): string[];
 /**

package/dist/cli.d.ts

@@ -18,7 +18,7 @@
  *    could have come from `pg`, Node or the user goes through `redactSecrets`
  *    on its way out.
  */
-import type { ScanResult, Severity } from "./types";
+import type { ScanResult, Severity } from "./types.js";
 /** Clean, or nothing at or above `--fail-on`. */
 export declare const EXIT_OK = 0;
 /** Findings at or above `--fail-on`. */

package/dist/index.d.ts

@@ -16,14 +16,14 @@
  * at production databases by people who have never heard of us, and the install
  * has to be something they can read in full before they run it.
  */
-export { runCli, scan, selectCheckIds, EXIT_OK, EXIT_FINDINGS, EXIT_ERROR } from "./cli";
-export type { ScanOptions, CliIo, CliOptions } from "./cli";
-export { introspect } from "./introspect";
-export type { ConnectOptions } from "./introspect";
-export { CHECKS, runChecks } from "./checks";
-export { renderReport, renderJson, renderCheckCatalog, severityRank, maxSeverity, exceedsThreshold, formatTarget } from "./report";
-export type { RenderOptions } from "./report";
-export { redactConnectionString, redactSecrets, parseConnectionString, formatEndpoint } from "./redact";
-export type { ConnectionTarget } from "./redact";
-export { SEVERITIES } from "./types";
-export type { Check, DbColumn, DbForeignKey, DbGrant, DbPolicy, DbRelation, DbRole, DbRoutine, DbSnapshot, DbView, Finding, FindingTarget, PolicyCommand, PgRelationKind, ScanResult, Severity } from "./types";
+export { runCli, scan, selectCheckIds, EXIT_OK, EXIT_FINDINGS, EXIT_ERROR } from "./cli.js";
+export type { ScanOptions, CliIo, CliOptions } from "./cli.js";
+export { introspect } from "./introspect.js";
+export type { ConnectOptions } from "./introspect.js";
+export { CHECKS, runChecks } from "./checks/index.js";
+export { renderReport, renderJson, renderCheckCatalog, severityRank, maxSeverity, exceedsThreshold, formatTarget } from "./report.js";
+export type { RenderOptions } from "./report.js";
+export { redactConnectionString, redactSecrets, parseConnectionString, formatEndpoint } from "./redact.js";
+export type { ConnectionTarget } from "./redact.js";
+export { SEVERITIES } from "./types.js";
+export type { Check, DbColumn, DbForeignKey, DbGrant, DbPolicy, DbRelation, DbRole, DbRoutine, DbSnapshot, DbView, Finding, FindingTarget, PolicyCommand, PgRelationKind, ScanResult, Severity } from "./types.js";

package/dist/introspect.d.ts

@@ -1,4 +1,4 @@
-import type { DbSnapshot } from "./types";
+import type { DbSnapshot } from "./types.js";
 export interface ConnectOptions {
     connectionString: string;
     /** Explicit schema allowlist. Default: every non-system schema. */

package/dist/report.d.ts

@@ -13,7 +13,7 @@
  *    judgement. A tool that mixes "your table is public" with "this might be a
  *    junction table" trains people to distrust both.
  */
-import type { Check, Finding, ScanResult, Severity } from "./types";
+import type { Check, Finding, ScanResult, Severity } from "./types.js";
 /** Higher is worse. `info` = 0 … `critical` = 4. */
 export declare function severityRank(severity: Severity): number;
 /** The worst severity present, or `null` for an empty list. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/rls-check",
-  "version": "0.16.0",
+  "version": "0.16.1-canary.g2d1aec8",
   "description": "Audit Row-Level Security on any PostgreSQL database — finds tables served without RLS, permissive tautologies, unqualified columns in policy subqueries, RLS-bypassing views and unprotected junction tables. Read-only.",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -53,7 +53,7 @@
   "scripts": {
     "test": "vitest run",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/add-dts-extensions.mjs dist && node ../../scripts/assert-build-output.mjs",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   }