@rebasepro/rls-check 0.22.0 → 0.24.0

package/dist/index.es.js

@@ -398,6 +398,42 @@ var ANONYMOUS_ROLES = [
 ];
 var isPublicRole = (role) => role.toLowerCase() === "public";
 var sameRole = (a, b) => a.toLowerCase() === b.toLowerCase();
+function grouped(cache, items, key) {
+	const hit = cache.get(items);
+	if (hit && hit.length === items.length) return hit.groups;
+	const groups = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const k = key(item);
+		const list = groups.get(k);
+		if (list) list.push(item);
+		else groups.set(k, [item]);
+	}
+	cache.set(items, {
+		length: items.length,
+		groups
+	});
+	return groups;
+}
+/** A NUL cannot appear in a Postgres identifier, so it cannot make two pairs collide. */
+var pairKey = (schema, name) => `${schema}\u0000${name}`;
+var RELATIONS = /* @__PURE__ */ new WeakMap();
+var GRANTS = /* @__PURE__ */ new WeakMap();
+var POLICIES = /* @__PURE__ */ new WeakMap();
+var FOREIGN_KEYS = /* @__PURE__ */ new WeakMap();
+var ROLES = /* @__PURE__ */ new WeakMap();
+var SCHEMA_USAGE = /* @__PURE__ */ new WeakMap();
+/** Every grant on one relation, in snapshot order. */
+function grantsOn(snapshot, schema, table) {
+	return grouped(GRANTS, snapshot.grants, (g) => pairKey(g.schema, g.table)).get(pairKey(schema, table)) ?? [];
+}
+/** The foreign keys declared on one table, in snapshot order. */
+function foreignKeysOf(snapshot, schema, table) {
+	return grouped(FOREIGN_KEYS, snapshot.foreignKeys, (fk) => pairKey(fk.schema, fk.table)).get(pairKey(schema, table)) ?? [];
+}
+/** A role by name, compared the way {@link sameRole} compares. */
+function roleNamed(snapshot, name) {
+	return grouped(ROLES, snapshot.roles, (r) => r.name.toLowerCase()).get(name.toLowerCase())?.[0];
+}
 /**
 * Every role whose grants `role` actually receives: itself, PUBLIC, and the
 * transitive closure of its memberships.
@@ -409,16 +445,34 @@ var sameRole = (a, b) => a.toLowerCase() === b.toLowerCase();
 */
 function rolesUsableBy(snapshot, role) {
 	const out = /* @__PURE__ */ new Set(["public", role.toLowerCase()]);
-	const def = snapshot.roles.find((r) => sameRole(r.name, role));
+	const def = roleNamed(snapshot, role);
 	for (const m of def?.memberOf ?? []) out.add(m.toLowerCase());
 	return out;
 }
-/** Privileges `role` effectively holds on a relation, memberships included. */
-function effectivePrivileges(snapshot, schema, table, role) {
+/**
+* Can `role` name objects in `schema` at all?
+*
+* Without USAGE on the schema a role gets "permission denied for schema" before
+* any table privilege is looked at, so a grant on a table there reaches
+* nothing. Unknown — the read failed, or the schema has no record — counts as
+* yes: a scanner that cannot tell must report, not stay quiet.
+*/
+function hasSchemaUsage(snapshot, schema, role) {
+	if (!snapshot.schemaUsage) return true;
+	const holders = grouped(SCHEMA_USAGE, snapshot.schemaUsage, (u) => u.schema).get(schema);
+	if (!holders) return true;
 	const via = rolesUsableBy(snapshot, role);
+	return holders.some((u) => via.has(u.grantee.toLowerCase()));
+}
+/**
+* Privileges `role` effectively holds on a relation, memberships included —
+* and none at all when it cannot use the relation's schema.
+*/
+function effectivePrivileges(snapshot, schema, table, role) {
 	const out = /* @__PURE__ */ new Set();
-	for (const g of snapshot.grants) {
-		if (g.schema !== schema || g.table !== table) continue;
+	if (!hasSchemaUsage(snapshot, schema, role)) return out;
+	const via = rolesUsableBy(snapshot, role);
+	for (const g of grantsOn(snapshot, schema, table)) {
 		if (!via.has(g.grantee.toLowerCase())) continue;
 		for (const p of g.privileges) out.add(p);
 	}
@@ -459,16 +513,45 @@ function policyTargetsExposedRole(snapshot, policy) {
 	}
 	return [...new Set(hits)];
 }
+/** The privileges a policy's command is exercised with. */
+var COMMAND_PRIVILEGES = {
+	ALL: DML,
+	SELECT: ["SELECT"],
+	INSERT: ["INSERT"],
+	UPDATE: ["UPDATE"],
+	DELETE: ["DELETE"]
+};
+/**
+* The exposed callers a policy applies to *and* that can reach its table for
+* its command: {@link policyTargetsExposedRole}, kept to the roles holding a
+* privilege the command needs (and USAGE on the schema).
+*
+* A policy nobody can reach the table through is a latent problem, not an
+* exposure, and every check claims an exposure: "a caller can read every row"
+* is false for a role Postgres answers "permission denied". `PUBLIC` stays when
+* the policy is TO PUBLIC and any exposed role reaches the table.
+*/
+function policyReachedBy(snapshot, policy) {
+	const wanted = COMMAND_PRIVILEGES[policy.command] ?? DML;
+	return policyTargetsExposedRole(snapshot, policy).filter((target) => target === "PUBLIC" ? exposedGrantees(snapshot, policy.schema, policy.table, wanted).length > 0 : wanted.some((p) => effectivePrivileges(snapshot, policy.schema, policy.table, target).has(p)));
+}
 var TABLE_KINDS$1 = ["table", "partitioned_table"];
 var isTable = (r) => TABLE_KINDS$1.includes(r.kind);
 function scannedTables(snapshot) {
 	return snapshot.relations.filter((r) => isTable(r) && snapshot.schemas.includes(r.schema));
 }
+/**
+* Foreign tables in the scanned schemas. Postgres cannot put row-level
+* security on one, so a grant is all that stands between it and a caller.
+*/
+function scannedForeignTables(snapshot) {
+	return snapshot.relations.filter((r) => r.kind === "foreign_table" && snapshot.schemas.includes(r.schema));
+}
 function relationAt(snapshot, schema, name) {
-	return snapshot.relations.find((r) => r.schema === schema && r.name === name);
+	return grouped(RELATIONS, snapshot.relations, (r) => pairKey(r.schema, r.name)).get(pairKey(schema, name))?.[0];
 }
 function policiesFor(snapshot, schema, table) {
-	return snapshot.policies.filter((p) => p.schema === schema && p.table === table);
+	return [...grouped(POLICIES, snapshot.policies, (p) => pairKey(p.schema, p.table)).get(pairKey(schema, table)) ?? []];
 }
 var hasColumn = (r, name) => r.columns.some((c) => c.name.toLowerCase() === name.toLowerCase());
 /** `≈ 12,000 rows` — only ever used to convey blast radius, never severity. */
@@ -477,10 +560,49 @@ function rowsPhrase(rel) {
 	if (rel.estimatedRows === 0) return " (the planner currently estimates 0 rows)";
 	return ` (≈${Math.round(rel.estimatedRows).toLocaleString("en-US")} rows)`;
 }
-var qi = (ident) => `"${ident.replace(/"/g, "\"\"")}"`;
+/**
+* Characters that cannot sit inside a fix as themselves: a line break would
+* end the `--` comment a suggestion is printed in and run the rest of the name
+* as SQL, and the other controls are invisible or rewrite the terminal. The
+* control characters are the point, so the lint rule that objects to them is
+* off for this line.
+*/
+var UNPRINTABLE = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+var UNPRINTABLE_ALL = new RegExp(UNPRINTABLE.source, "g");
+/**
+* A quoted identifier that is one printable token wherever a fix puts it.
+*
+* Every name here comes out of the catalog, which means out of whoever could
+* create a table, a role or a policy, and every fix is printed to be pasted
+* into psql. Doubling `"` keeps a name inside its quotes; a name with a line
+* break in it is written as a Unicode-escape identifier (`U&"a\000Ab"`), which
+* names the same object and has no line break to escape a comment with.
+*/
+function qi(ident) {
+	const doubled = ident.replace(/"/g, "\"\"");
+	if (!UNPRINTABLE.test(ident)) return `"${doubled}"`;
+	return `U&"${doubled.replace(/\\/g, "\\\\").replace(UNPRINTABLE_ALL, (ch) => `\\${ch.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`)}"`;
+}
 var qrel = (schema, name) => `${qi(schema)}.${qi(name)}`;
 /** PUBLIC is a keyword, not an identifier — quoting it changes what it means. */
 var qrole = (role) => isPublicRole(role) ? "PUBLIC" : qi(role);
+/**
+* The REVOKEs that take `privileges` on a relation away from the exposed roles:
+* one per grant that reaches them, made to the role the grant names.
+*
+* Revoking from the exposed role by name is not the same thing. A grant to
+* `app_reader` that `anon` inherits survives `REVOKE … FROM anon`, which is a
+* no-op, and a relation granted to `anon` and `authenticated` keeps the second
+* grant when the fix names only the first. Every fix that takes a grant away
+* builds it here, so applying it and rescanning clears the finding.
+*/
+function revokesReaching(snapshot, schema, table, exposed, privileges) {
+	const reaching = new Set(exposed.flatMap((role) => [...rolesUsableBy(snapshot, role)]));
+	return grantsOn(snapshot, schema, table).filter((g) => reaching.has(g.grantee.toLowerCase())).map((g) => ({
+		grantee: g.grantee,
+		held: privileges.filter((p) => g.privileges.includes(p))
+	})).filter((g) => g.held.length > 0).map((g) => `REVOKE ${g.held.join(", ")} ON ${qrel(schema, table)} FROM ${qrole(g.grantee)};`);
+}
 function finding(f) {
 	return {
 		...f,
@@ -594,8 +716,9 @@ var COMMANDS_FOR = {
 *      correct one — satisfies condition 1 on almost every project out there.
 *      Flagging it would make this check fire on the whole ecosystem.
 *
-* So what is reported is the narrow, certain case: the check expression is
-* absent or constant-true, which in Postgres means "accept any row". Policies
+* So what is reported is the narrow, certain case: the clause that decides the
+* command is constant-true, which in Postgres means "accept any row". An
+* *absent* clause is the opposite — see {@link writesAcceptingAnyRow}. Policies
 * whose expression is an anonymous *tautology* rather than a constant are the
 * business of `policy-anonymous-tautology`, which can weigh the platform.
 */
@@ -609,11 +732,11 @@ var anonymousWriteAllowed = {
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			const wanted = COMMANDS_FOR[policy.command] ?? [];
+			const open = writesAcceptingAnyRow(policy);
+			const wanted = (COMMANDS_FOR[policy.command] ?? []).filter((p) => open.includes(p));
 			if (wanted.length === 0) continue;
 			const identities = anonymousIdentities(snapshot, policy.roles);
 			if (identities.length === 0) continue;
-			if (!acceptsAnyRow(policy)) continue;
 			const granted = /* @__PURE__ */ new Set();
 			const grantedTo = [];
 			for (const role of identities) {
@@ -636,9 +759,9 @@ var anonymousWriteAllowed = {
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: `Policy "${policy.name}" is a permissive ${policy.command} policy for ${listAnd(grantedTo)}, and its check expression ${policy.using == null && policy.withCheck == null ? "is absent, which Postgres treats as accepting every row" : "is a constant truth, so every row satisfies it"}. ${listAnd(grantedTo)} also ${grantedTo.length > 1 ? "hold" : "holds"} ${listAnd(commands)} on the table, so both the privilege check and the row check pass for a request that carries no credentials.`,
+				detail: `Policy "${policy.name}" is a permissive ${policy.command} policy for ${listAnd(grantedTo)}, and the expression that decides ${listAnd(commands)} is a constant truth, so every row satisfies it. ${listAnd(grantedTo)} also ${grantedTo.length > 1 ? "hold" : "holds"} ${listAnd(commands)} on the table, so both the privilege check and the row check pass for a request that carries no credentials.`,
 				impact: `An unauthenticated caller reaching this database over an API can ${listAnd(verbs)} rows in ${policy.schema}.${policy.table} at will — inserting records attributed to other users, or ${commands.includes("DELETE") ? "deleting the table's contents" : "modifying rows they do not own"}.`,
-				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the write rule to the caller (an `ownerField`) or restrict it to `roles` — and if anonymous writes are never intended, say so there rather than by revoking the grant, which boot re-makes") : `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map((r) => r === "PUBLIC" ? "PUBLIC" : `"${r}"`).join(", ")};`
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the write rule to the caller (an `ownerField`) or restrict it to `roles` — and if anonymous writes are never intended, say so there rather than by revoking the grant, which boot re-makes") : `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\n` + revokesReaching(snapshot, policy.schema, policy.table, grantedTo, commands).join("\n")
 			}));
 		}
 		return findings;
@@ -659,16 +782,30 @@ function anonymousIdentities(snapshot, policyRoles) {
 	return ["public", ...snapshot.roles.map((r) => r.name).filter((name) => ANONYMOUS_ROLES.includes(name.toLowerCase()) && !isPublicRole(name))];
 }
 /**
-* Does this policy impose no row condition at all?
+* The writes this policy admits for any row whatsoever.
 *
-* For INSERT, Postgres falls back to USING when WITH CHECK is absent, and a
-* policy with neither clause admits every row. For UPDATE/DELETE the USING
-* clause selects the rows that may be touched.
+* Postgres ORs together the expressions the permissive policies for a command
+* *have*, and denies when there are none — so a clause a policy lacks admits
+* nothing, it does not admit everything. Reading an absent clause as true
+* reported `FOR INSERT TO anon` with no WITH CHECK (the insert is refused),
+* `FOR DELETE TO anon` with no USING (no row is deleted) and `FOR UPDATE TO anon
+* WITH CHECK (true)` with no USING (no row is reached) as open writes.
+*
+*   - INSERT is decided by WITH CHECK (USING is not allowed on an INSERT policy,
+*     and a `FOR ALL` policy's USING stands in for a missing WITH CHECK);
+*   - UPDATE needs USING to reach the row and the check — WITH CHECK, or USING
+*     again — to accept the new one;
+*   - DELETE is decided by USING.
 */
-function acceptsAnyRow(policy) {
-	const present = (policy.command === "INSERT" ? [policy.withCheck ?? policy.using] : [policy.using, policy.command === "DELETE" ? null : policy.withCheck]).filter((c) => c != null);
-	if (present.length === 0) return true;
-	return present.every((c) => isUnconditionalTrue(c));
+function writesAcceptingAnyRow(policy) {
+	const using = policy.using != null && isUnconditionalTrue(policy.using);
+	const checkExpr = policy.withCheck ?? policy.using;
+	const check = checkExpr != null && isUnconditionalTrue(checkExpr);
+	const out = [];
+	if (check) out.push("INSERT");
+	if (using && check) out.push("UPDATE");
+	if (using) out.push("DELETE");
+	return out;
 }
 //#endregion
 //#region src/checks/current-setting-throws.ts
@@ -764,7 +901,11 @@ var grantToPublic = {
 			if (!isPublicRole(grant.grantee)) continue;
 			if (!snapshot.schemas.includes(grant.schema)) continue;
 			const rel = relationAt(snapshot, grant.schema, grant.table);
-			if (!rel || rel.kind !== "table" && rel.kind !== "partitioned_table") continue;
+			if (!rel || ![
+				"table",
+				"partitioned_table",
+				"foreign_table"
+			].includes(rel.kind)) continue;
 			const privileges = DML.filter((p) => grant.privileges.includes(p));
 			if (privileges.length === 0) continue;
 			findings.push(finding({
@@ -776,7 +917,7 @@ var grantToPublic = {
 					schema: grant.schema,
 					table: grant.table
 				},
-				detail: "PUBLIC is every role in this cluster, including roles created after this grant was made. " + (rel.rlsEnabled ? "Row-level security is enabled on the table, so rows are still filtered by policy — but this grant decides *whose* policies get evaluated, and it answers \"everyone's\". A permissive policy added later for any role applies immediately, with no separate grant needed." : "Row-level security is not enabled on this table, so nothing filters the rows this grant exposes."),
+				detail: "PUBLIC is every role in this cluster, including roles created after this grant was made. " + (rel.rlsEnabled ? "Row-level security is enabled on the table, so rows are still filtered by policy — but this grant decides *whose* policies get evaluated, and it answers \"everyone's\". A permissive policy added later for any role applies immediately, with no separate grant needed." : rel.kind === "foreign_table" ? "This is a foreign table, which cannot have row-level security, so nothing filters the rows this grant exposes." : "Row-level security is not enabled on this table, so nothing filters the rows this grant exposes."),
 				impact: rel.rlsEnabled ? `Every role in the database can attempt ${listAnd(privileges)} on this table${rowsPhrase(rel)}; what they get back depends entirely on the policies, including any added in future.` : `Every role in the database, including any role an API connects as, can ${listAnd(privileges.map((p) => p.toLowerCase()))} every row of this table${rowsPhrase(rel)}.`,
 				fix: `REVOKE ${privileges.join(", ")} ON ${qrel(grant.schema, grant.table)} FROM PUBLIC;\n-- then grant explicitly to the roles that need it:\n-- GRANT ${privileges.join(", ")} ON ${qrel(grant.schema, grant.table)} TO "your_app_role";`
 			}));
@@ -823,13 +964,14 @@ var junctionTableUnprotected = {
 		const findings = [];
 		for (const rel of scannedTables(snapshot)) {
 			if (rel.rlsEnabled) continue;
-			const fks = snapshot.foreignKeys.filter((fk) => fk.schema === rel.schema && fk.table === rel.name);
+			const fks = foreignKeysOf(snapshot, rel.schema, rel.name);
 			if (fks.length !== 2) continue;
 			const endpoints = fks.map((fk) => `${fk.refSchema}.${fk.refTable}`);
 			if (endpoints[0] === endpoints[1]) continue;
 			if (endpoints.some((e) => e === `${rel.schema}.${rel.name}`)) continue;
 			if (!fks.map((fk) => relationAt(snapshot, fk.refSchema, fk.refTable)).every((t) => t?.rlsEnabled)) continue;
 			if (!isMostlyKeys(rel, fks.flatMap((fk) => fk.columns))) continue;
+			if (exposedGrantees(snapshot, rel.schema, rel.name, DML).length === 0) continue;
 			findings.push(finding({
 				id: ID$11,
 				severity: "high",
@@ -841,7 +983,7 @@ var junctionTableUnprotected = {
 				},
 				detail: `This table looks like a many-to-many join table: its columns are the foreign keys to ${endpoints[0]} and ${endpoints[1]} plus bookkeeping. Both of those tables have row-level security enabled; this one does not, so no policy is consulted when it is read or written.`,
 				impact: `If this table is reachable over an API, a caller reads the full membership graph between ${endpoints[0]} and ${endpoints[1]} — which rows relate to which — even though neither endpoint table can be read directly. Where the join table is also writable, a caller can grant themselves a relationship that the policies on the endpoint tables then honour.`,
-				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- A join table's policy normally follows its endpoints, e.g.:\n-- CREATE POLICY ${JSON.stringify(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT USING (EXISTS (\n--         SELECT 1 FROM ${endpoints[0]} e\n--         WHERE e.id = ${qrel(rel.schema, rel.name)}.${fks[0].columns[0]}\n--     ));`
+				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- A join table's policy normally follows its endpoints, e.g.:\n-- CREATE POLICY ${qi(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT USING (EXISTS (\n--         SELECT 1 FROM ${qrel(fks[0].refSchema, fks[0].refTable)} e\n--         WHERE e.id = ${qrel(rel.schema, rel.name)}.${qi(fks[0].columns[0])}\n--     ));`
 			}));
 		}
 		return findings;
@@ -861,7 +1003,7 @@ function isMostlyKeys(rel, keyColumns) {
 var ID$10 = "view-bypasses-rls";
 /** Base relations of `view` that have RLS turned on. */
 function protectedBaseTables(snapshot, view) {
-	return view.dependsOn.map((d) => relationAt(snapshot, d.schema, d.table)).filter((r) => Boolean(r?.rlsEnabled)).map((r) => `${r.schema}.${r.name}`);
+	return view.dependsOn.map((d) => relationAt(snapshot, d.schema, d.table)).filter((r) => Boolean(r?.rlsEnabled));
 }
 /**
 * A view granted to an untrusted role that reads an RLS-protected table without
@@ -888,8 +1030,9 @@ var viewBypassesRls = {
 			const rel = relationAt(snapshot, view.schema, view.name);
 			if (rel && rel.kind !== "view") continue;
 			if (view.securityInvoker === true) continue;
-			const bases = protectedBaseTables(snapshot, view);
-			if (bases.length === 0) continue;
+			const baseTables = protectedBaseTables(snapshot, view);
+			if (baseTables.length === 0) continue;
+			const bases = baseTables.map((r) => `${r.schema}.${r.name}`);
 			const exposed = exposedGrantees(snapshot, view.schema, view.name, ["SELECT"]);
 			if (exposed.length === 0) continue;
 			const roles = exposed.map((e) => e.role);
@@ -908,7 +1051,7 @@ var viewBypassesRls = {
 				impact: `If this view is reachable over an API as ${listAnd(roles)}, a caller reads rows from ${listAnd(bases)} that the policies on ${bases.length > 1 ? "those tables" : "that table"} were written to withhold — the view is an unfiltered path around them.`,
 				fix: legacy ? `-- \`security_invoker\` requires PostgreSQL 15 or newer. On this server, either:
 --   1. revoke access and let callers query the base table directly:
-REVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n--   2. or set FORCE ROW LEVEL SECURITY on the base tables and add policies\n--      that apply to ${view.owner}, so the view's own execution is filtered.` : `ALTER VIEW ${qrel(view.schema, view.name)} SET (security_invoker = true);\n-- Callers then need their own SELECT privilege on ${listAnd(bases)}, and the\n-- policies there apply to them.`
+${revokesReaching(snapshot, view.schema, view.name, roles, ["SELECT"]).join("\n")}\n--   2. or set FORCE ROW LEVEL SECURITY on the base tables and add policies\n--      that apply to ${qi(view.owner)}, so the view's own execution is filtered.` : `ALTER VIEW ${qrel(view.schema, view.name)} SET (security_invoker = true);\n-- Callers then need their own SELECT privilege on ${listAnd(baseTables.map((r) => qrel(r.schema, r.name)))}, and the\n-- policies there apply to them.`
 			}));
 		}
 		return findings;
@@ -935,8 +1078,9 @@ var matviewBypassesRls = {
 		for (const view of snapshot.views) {
 			if (!snapshot.schemas.includes(view.schema)) continue;
 			if (relationAt(snapshot, view.schema, view.name)?.kind !== "materialized_view") continue;
-			const bases = protectedBaseTables(snapshot, view);
-			if (bases.length === 0) continue;
+			const baseTables = protectedBaseTables(snapshot, view);
+			if (baseTables.length === 0) continue;
+			const bases = baseTables.map((r) => `${r.schema}.${r.name}`);
 			const exposed = exposedGrantees(snapshot, view.schema, view.name, ["SELECT"]);
 			if (exposed.length === 0) continue;
 			const roles = exposed.map((e) => e.role);
@@ -952,7 +1096,7 @@ var matviewBypassesRls = {
 				},
 				detail: `This materialized view reads ${listAnd(bases)}, which ${bases.length > 1 ? "have" : "has"} row-level security enabled. Materialized views cannot have policies of their own, and \`security_invoker\` does not apply to them — the rows were computed once, by ${view.owner}, and are stored unfiltered. Every caller with SELECT reads the same stored rows.`,
 				impact: `If this materialized view is reachable over an API as ${listAnd(roles)}, a caller reads a full copy of the protected data in ${listAnd(bases)} as of the last REFRESH. No policy can restrict this; only the grant can.`,
-				fix: `-- There is no RLS for materialized views. Restrict the grant:\nREVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n-- and, if callers need this data, expose it through a view that applies the\n-- caller's own privileges:\n-- CREATE VIEW ${qrel(view.schema, `${view.name}_scoped`)} WITH (security_invoker = true)\n--     AS SELECT * FROM ${bases[0].split(".").map((p) => `"${p}"`).join(".")} WHERE ...;`
+				fix: `-- There is no RLS for materialized views. Restrict the grant:\n${revokesReaching(snapshot, view.schema, view.name, roles, ["SELECT"]).join("\n")}\n-- and, if callers need this data, expose it through a view that applies the\n-- caller's own privileges:\n-- CREATE VIEW ${qrel(view.schema, `${view.name}_scoped`)} WITH (security_invoker = true)\n--     AS SELECT * FROM ${qrel(baseTables[0].schema, baseTables[0].name)} WHERE ...;`
 			}));
 		}
 		return findings;
@@ -970,8 +1114,8 @@ var ID$8 = "policy-always-true";
 * substring-matching version of this check would flag both.
 *
 * The one thing that legitimately rescues `USING (true)` is a RESTRICTIVE
-* policy on the same command, because RESTRICTIVE clauses are ANDed after the
-* PERMISSIVE ones are ORed. "Permissive default, restrictive gate" is a real
+* policy on the same command that applies to the same callers, because
+* RESTRICTIVE clauses are ANDed after the PERMISSIVE ones are ORed. "Permissive default, restrictive gate" is a real
 * pattern, so when one is present the finding degrades to a question instead of
 * an accusation rather than disappearing (the restrictive policy may well not
 * cover the same rows).
@@ -986,16 +1130,24 @@ var policyAlwaysTrue = {
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			const exposed = policyTargetsExposedRole(snapshot, policy);
+			const exposed = policyReachedBy(snapshot, policy);
 			if (exposed.length === 0) continue;
 			const clauses = [];
 			if (isUnconditionalTrue(policy.using)) clauses.push("USING");
 			if (isUnconditionalTrue(policy.withCheck)) clauses.push("WITH CHECK");
 			if (clauses.length === 0) continue;
-			const gate = restrictiveGate(snapshot, policy);
+			const gates = restrictiveGate(snapshot, policy);
+			const gate = gates && gates.length === 1 ? {
+				name: `RESTRICTIVE policy "${gates[0]}"`,
+				verb: "applies"
+			} : gates ? {
+				name: `RESTRICTIVE policies ${listAnd(gates.map((g) => `"${g}"`))}`,
+				verb: "apply"
+			} : null;
 			const rel = relationAt(snapshot, policy.schema, policy.table);
 			const verb = policy.command === "SELECT" ? "read" : "act on";
-			const severity = gate ? "medium" : "critical";
+			const checkOnly = !clauses.includes("USING") && (policy.command === "UPDATE" || policy.command === "ALL");
+			const severity = gate ? "medium" : checkOnly && policy.command === "UPDATE" ? "high" : "critical";
 			findings.push(finding({
 				id: ID$8,
 				severity,
@@ -1006,17 +1158,58 @@ var policyAlwaysTrue = {
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.` + (gate ? ` A RESTRICTIVE policy ("${gate}") also applies to this command and is ANDed after it, so access may still be gated — verify that restrictive policy covers the rows and roles you expect, because nothing else here does.` : ""),
-				impact: gate ? `Row filtering on this table rests entirely on the RESTRICTIVE policy "${gate}". If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
+				detail: (checkOnly ? `This permissive ${policy.command} policy's WITH CHECK expression is a constant truth, so any new row value passes it for ${listAnd(exposed)}. ` + (policy.using == null ? "It has no USING clause, so on its own it lets no row be updated — but permissive policies' checks are ORed, so every UPDATE another policy lets through may write any values at all." : "Its USING clause still decides which rows can be touched; the check decides what they may become, and it accepts anything. Permissive policies' checks are ORed, so this one overrides any stricter check beside it.") + (policy.command === "ALL" ? " On a FOR ALL policy the same check governs INSERT, so any row at all can be inserted." : "") : `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.`) + (gate ? ` The ${gate.name} also ${gate.verb} to this command and to every role it reaches, ANDed after it, so access may still be gated — verify that the restrictive side covers the rows you expect, because nothing else here does.` : ""),
+				impact: gate ? `Row filtering on this table rests entirely on the ${gate.name}. If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : checkOnly ? `If this table is reachable over an API as ${listAnd(exposed)}, a caller can rewrite any row it is allowed to update into anything — reassign it to another user, move it to another tenant, set any flag it carries` + (policy.command === "ALL" ? ` — and insert rows with any values, attributed to anyone.` : `. Which rows it can reach is still scoped by USING.`) : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
 				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `replace the rule that grants unconditional ${policy.command === "SELECT" ? "reads" : "access"} with one that scopes the rows — \`ownerField\`, \`roles\`, or a \`condition\``) : `-- Replace the constant with the scoping you intended, e.g.:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clauses.includes("USING") ? `USING (user_id = ${uidCall})` : `WITH CHECK (user_id = ${uidCall})`};\n-- or, if unconditional access really is intended, drop the policy and say so\n-- with an explicit grant instead:\n-- DROP POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)};`
 			}));
 		}
 		return findings;
 	}
 };
-/** Name of a RESTRICTIVE policy that is ANDed with this one, if any. */
+/**
+* Does `policy` apply to a caller arriving as `role`?
+*
+* `PUBLIC` in `role` stands for "some role nothing else here names", which is a
+* member of nothing: only a policy TO PUBLIC applies to it.
+*/
+function policyAppliesTo(snapshot, policy, role) {
+	if (policy.roles.some(isPublicRole)) return true;
+	if (isPublicRole(role)) return false;
+	const usable = rolesUsableBy(snapshot, role);
+	return policy.roles.some((target) => usable.has(target.toLowerCase()));
+}
+/**
+* The callers a permissive policy lets in: every named exposed role it applies
+* to, or `PUBLIC` when it applies to no named one and is TO PUBLIC.
+*
+* The `PUBLIC` pseudo-caller is left out whenever a named role is there,
+* because it would otherwise demand a gate TO PUBLIC for a policy that every
+* real caller already has to pass a gate for — on Supabase, a restrictive
+* policy TO anon and authenticated covers every request the API makes.
+*/
+function callersOf(snapshot, policy) {
+	const named = snapshot.exposedRoles.filter((role) => !isPublicRole(role) && policyAppliesTo(snapshot, policy, role));
+	if (named.length > 0) return named;
+	return policy.roles.some(isPublicRole) ? ["PUBLIC"] : [];
+}
+/**
+* The RESTRICTIVE policies that gate this one, or `null` when they do not gate
+* every caller it lets in.
+*
+* A restrictive policy is ANDed only for the roles in its own TO list and only
+* for its own command. Any restrictive policy on the table used to count, so
+* Supabase's documented MFA gate — `AS RESTRICTIVE TO authenticated` — next to
+* `USING (true) TO anon` softened the finding to medium while anon read every
+* row, and the default `--fail-on high` passed it. So a gate now has to apply
+* to every command the permissive policy covers (`ALL` needs `ALL`), and the
+* restrictive policies together have to apply to every caller it lets in.
+*/
 function restrictiveGate(snapshot, policy) {
-	return snapshot.policies.find((p) => !p.permissive && p.schema === policy.schema && p.table === policy.table && (p.command === "ALL" || policy.command === "ALL" || p.command === policy.command))?.name ?? null;
+	const gates = policiesFor(snapshot, policy.schema, policy.table).filter((p) => !p.permissive && (p.command === "ALL" || p.command === policy.command));
+	const callers = callersOf(snapshot, policy);
+	if (callers.length === 0) return null;
+	const covering = gates.filter((gate) => callers.some((role) => policyAppliesTo(snapshot, gate, role)));
+	return callers.every((role) => covering.some((gate) => policyAppliesTo(snapshot, gate, role))) ? covering.map((gate) => gate.name) : null;
 }
 //#endregion
 //#region src/types.ts
@@ -1053,7 +1246,10 @@ var ID$7 = "policy-anonymous-tautology";
 *   - Supabase: `auth.uid()` reads a JWT claim and returns NULL for an anonymous
 *     caller, so the expression is a legitimate "signed in" test. Its only real
 *     failing is that it does not scope rows to their owner — worth `low`, worded
-*     as a design observation rather than a vulnerability.
+*     as a design observation rather than a vulnerability. That is a fact about
+*     `auth.uid()`, not about Supabase: an anonymous caller there still carries
+*     the anon key's JWT, so `auth.role()` and `auth.jwt()` are non-null for it,
+*     and the same shape built on them is a bypass — see {@link CallerCall}.
 *   - Rebase / PostgREST-style stacks that coerce a missing id to a sentinel
 *     (`'anonymous'`, `''`): the expression is true for signed-out callers, so it
 *     is a straight authentication bypass. This exact policy shipped in this
@@ -1072,18 +1268,19 @@ var policyAnonymousTautology = {
 	run(snapshot) {
 		const uidCall = callerIdCall(snapshot);
 		const findings = [];
-		const { severity: baseSeverity, meaning, impactSuffix } = platformReading(snapshot.platform);
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			if (policyTargetsExposedRole(snapshot, policy).length === 0) continue;
+			if (policyReachedBy(snapshot, policy).length === 0) continue;
 			const clauses = [];
 			const usingMatch = matchTautology(policy.using);
 			const checkMatch = matchTautology(policy.withCheck);
 			if (usingMatch) clauses.push("USING");
 			if (checkMatch) clauses.push("WITH CHECK");
 			if (clauses.length === 0) continue;
-			const shape = usingMatch?.shape ?? checkMatch?.shape ?? "the caller id";
+			const matched = worstMatch(snapshot.platform, usingMatch, checkMatch);
+			const { severity: baseSeverity, meaning, impactSuffix } = platformReading(snapshot.platform, matched);
+			const shape = matched.shape;
 			const decoys = [.../* @__PURE__ */ new Set([...usingMatch?.decoyGuards ?? [], ...checkMatch?.decoyGuards ?? []])];
 			const severity = forCommand(baseSeverity, policy.command);
 			const written = decoys.map((d) => `\`${shape} <> '${d}'\``);
@@ -1097,7 +1294,7 @@ var policyAnonymousTautology = {
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: (decoys.length > 0 ? `The ${listAnd(clauses)} expression of this ${policy.command} policy reads as "signed in": it tests that ${shape} is non-null and excludes ${listAnd(written)}. But the id a signed-out caller actually arrives with is ${listAnd(CLEARING_SENTINELS.map(describeSentinel))}, and neither is ${listAnd(decoys.map((d) => `'${d}'`))} — so the guard excludes nobody and the null test stands on its own. ` : `The ${listAnd(clauses)} expression of this ${policy.command} policy tests only that ${shape} is non-null. `) + `It does not compare anything to a column, so every row of the table satisfies it equally — the policy distinguishes signed-in from signed-out callers and nothing else. ${meaning}` + (policy.command === "ALL" || policy.command === "UPDATE" || policy.command === "DELETE" ? ` This policy governs ${policy.command === "ALL" ? "every command, writes included" : policy.command}, so the same expression decides who may change rows, not only who may read them.` : ""),
+				detail: (decoys.length > 0 ? `The ${listAnd(clauses)} expression of this ${policy.command} policy reads as "signed in": it tests that ${shape} is non-null and excludes ${listAnd(written)}. But ` + (matched.call.sentinels.length > 0 ? `the ${matched.call.noun} a signed-out caller actually arrives with is ${listAnd(matched.call.sentinels.map(describeSentinel))}, and neither is ${listAnd(decoys.map((d) => `'${d}'`))}` : `no literal stands for a signed-out caller in ${shape}`) + ` — so the guard excludes nobody and the null test stands on its own. ` : `The ${listAnd(clauses)} expression of this ${policy.command} policy tests only that ${shape} is non-null. `) + `It does not compare anything to a column, so every row of the table satisfies it equally — the policy distinguishes signed-in from signed-out callers and nothing else. ${meaning}` + (policy.command === "ALL" || policy.command === "UPDATE" || policy.command === "DELETE" ? ` This policy governs ${policy.command === "ALL" ? "every command, writes included" : policy.command}, so the same expression decides who may change rows, not only who may read them.` : ""),
 				impact: `Any caller for whom ${shape} is non-null can reach every row this policy covers, including rows belonging to other users or tenants. ${impactSuffix}` + (decoys.length > 0 ? " A policy in this shape reads as safe on review, which is why it survives: the guard is present, spelled plausibly, and matches nothing." : ""),
 				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the rule to the row's owner (an `ownerField`) rather than to the existence of an id — `access: \"authenticated\"` compiled to exactly this shape before 1.0, so a database pushed then still carries it") : `-- Scope the policy to the row's owner rather than to the existence of an id:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- If the intent really is "any signed-in user", exclude every id your stack has\n-- ever used for "nobody" — one literal is not enough:\n--     USING (${uidCall} IS NOT NULL AND ${uidCall} <> ALL (ARRAY['anonymous', 'anon']));`
 			}));
@@ -1120,26 +1317,55 @@ function forCommand(base, command) {
 	return SEVERITIES[Math.min(SEVERITIES.indexOf(base) + 1, SEVERITIES.length - 1)];
 }
 var describeSentinel = (s) => s === "" ? "the empty string" : `'${s}'`;
-function platformReading(platform) {
+/** Of the USING and WITH CHECK clauses that matched, the one whose reading is worse. */
+function worstMatch(platform, using, check) {
+	if (!using) return check;
+	if (!check) return using;
+	const rank = (m) => SEVERITIES.indexOf(platformReading(platform, m).severity);
+	return rank(check) > rank(using) ? check : using;
+}
+/**
+* What the expression means on this platform, for the call it is built on.
+*
+* The platform alone does not decide it. On Supabase `auth.uid()` is NULL for a
+* signed-out request, so a null test on it is a working "signed in" check — but
+* a signed-out request there still carries a JWT, the project's public anon
+* key, so `auth.role()` is `'anon'` and `auth.jwt()` is that key's claims. A
+* null test on either is true for everyone. This used to be read per platform
+* only, which graded `USING (auth.jwt() IS NOT NULL)` low and told the reader
+* that anonymous callers were correctly excluded.
+*/
+function platformReading(platform, match) {
+	const { shape, call } = match;
 	switch (platform) {
-		case "supabase": return {
-			severity: "low",
-			meaning: "On Supabase, `auth.uid()` returns NULL for an anonymous request, so this is a working authenticated-only check rather than a bypass. It is listed because it only distinguishes signed-in from signed-out; it does not scope rows to their owner.",
-			impactSuffix: "Anonymous callers are correctly excluded on Supabase, so this is a data-scoping gap between signed-in users, not an anonymous-access hole."
-		};
+		case "supabase":
+			if (call.onSupabase === "null") return {
+				severity: "low",
+				meaning: `On Supabase, \`${shape}\` returns NULL for an anonymous request, so this is a working authenticated-only check rather than a bypass. It is listed because it only distinguishes signed-in from signed-out; it does not scope rows to their owner.`,
+				impactSuffix: "Anonymous callers are correctly excluded on Supabase, so this is a data-scoping gap between signed-in users, not an anonymous-access hole."
+			};
+			if (call.onSupabase === "present") return {
+				severity: "critical",
+				meaning: `On Supabase a signed-out request still carries a JWT — the project's anon key, which ships in every client — and for it \`${shape}\` is ${call.signedOutValue}, not NULL. So this expression is true for signed-out callers too: it authorises everyone.`,
+				impactSuffix: "That includes unauthenticated callers: the anon key is public, and a request carrying nothing else satisfies the expression."
+			};
+			return unknownReading(shape);
 		case "rebase":
 		case "postgrest": return {
 			severity: "critical",
 			meaning: "On this stack a request without a session is given a sentinel id (an 'anonymous' string rather than NULL), so this expression is true for signed-out callers too — it authorises everyone.",
 			impactSuffix: "Because signed-out requests arrive with a sentinel id rather than NULL, this includes unauthenticated callers."
 		};
-		default: return {
-			severity: "medium",
-			meaning: "Whether this excludes anonymous callers depends on the layer in front of the database: if it leaves the setting unset for signed-out requests the expression is false and this is merely loose; if it coerces them to a sentinel id (an empty string or 'anonymous') the expression is true and this authorises everyone.",
-			impactSuffix: "Whether unauthenticated callers are included depends on whether your stack coerces a missing caller id to a sentinel value — check that before judging the severity."
-		};
+		default: return unknownReading(shape);
 	}
 }
+function unknownReading(shape) {
+	return {
+		severity: "medium",
+		meaning: `Whether this excludes anonymous callers depends on the layer in front of the database: if it leaves \`${shape}\` unset for signed-out requests the expression is false and this is merely loose; if it gives them a value — a sentinel id such as an empty string or 'anonymous', or the claims of a public anon key — the expression is true and this authorises everyone.`,
+		impactSuffix: "Whether unauthenticated callers are included depends on whether your stack coerces a missing caller id to a sentinel value — check that before judging the severity."
+	};
+}
 /**
 * Both schema spellings, deliberately.
 *
@@ -1152,23 +1378,28 @@ function platformReading(platform) {
 var CALLER_ID_CALLS = [
 	{
 		re: /(?:rebase|auth)\.uid\s*\(\s*\)/g,
-		label: (m) => m[0].replace(/\s+/g, "")
+		label: (m) => m[0].replace(/\s+/g, ""),
+		call: () => CALLER_ID
 	},
 	{
 		re: /auth\.role\s*\(\s*\)/g,
-		label: () => "auth.role()"
+		label: () => "auth.role()",
+		call: () => CALLER_ROLE
 	},
 	{
 		re: /(?:rebase|auth)\.roles\s*\(\s*\)/g,
-		label: (m) => m[0].replace(/\s+/g, "")
+		label: (m) => m[0].replace(/\s+/g, ""),
+		call: () => CALLER_ROLE_LIST
 	},
 	{
 		re: /(?:rebase|auth)\.jwt\s*\(\s*\)/g,
-		label: (m) => m[0].replace(/\s+/g, "")
+		label: (m) => m[0].replace(/\s+/g, ""),
+		call: () => CALLER_CLAIMS
 	},
 	{
 		re: /current_setting\s*\(\s*('[^']*')\s*(?:,\s*[a-z]+\s*)?\)/g,
-		label: (m) => `current_setting(${m[1]})`
+		label: (m) => `current_setting(${m[1]})`,
+		call: (m) => settingCall(m[1].slice(1, -1))
 	}
 ];
 /**
@@ -1183,6 +1414,73 @@ var CALLER_ID_CALLS = [
 * `'anon'` as clearing is exactly the mistake this check now exists to catch.
 */
 var CLEARING_SENTINELS = ["anonymous", ""];
+var CALLER_ID = {
+	onSupabase: "null",
+	noun: "id",
+	sentinels: CLEARING_SENTINELS
+};
+/**
+* `auth.role()`, and the claim it reads. `'anon'` is a decoy for an *id* — no
+* signed-out caller arrives with that id — but it is precisely the *role* one
+* arrives as on Supabase (`web_anon` on a stock PostgREST), so excluding it is
+* the real guard here.
+*/
+var CALLER_ROLE = {
+	onSupabase: "present",
+	signedOutValue: "'anon'",
+	noun: "role",
+	sentinels: ["anon", "web_anon"]
+};
+/** Rebase's `roles()`, which coalesces an unset list to the empty string. */
+var CALLER_ROLE_LIST = {
+	onSupabase: "present",
+	signedOutValue: "the empty string",
+	noun: "role list",
+	sentinels: CLEARING_SENTINELS
+};
+var CALLER_CLAIMS = {
+	onSupabase: "present",
+	signedOutValue: "the anon key's claims",
+	noun: "claim set",
+	sentinels: []
+};
+/** A setting nothing on Supabase defines: whatever sets it decides. */
+var CALLER_SETTING = {
+	onSupabase: "unknown",
+	noun: "id",
+	sentinels: CLEARING_SENTINELS
+};
+/** The claims Supabase's anon key carries. Every other claim is unset for it. */
+var ANON_KEY_CLAIMS = [
+	"role",
+	"iss",
+	"ref",
+	"iat",
+	"exp"
+];
+/**
+* `current_setting('…')` by the setting it reads. PostgREST publishes the JWT as
+* `request.jwt.claims`, and older releases also as one `request.jwt.claim.<name>`
+* per claim — so the claim name decides whether the anon key fills it.
+*/
+function settingCall(name) {
+	if (name === "request.jwt.claims") return CALLER_CLAIMS;
+	const claim = /^request\.jwt\.claim\.(.+)$/.exec(name)?.[1];
+	if (claim === void 0) return CALLER_SETTING;
+	if (claim === "sub") return CALLER_ID;
+	if (claim === "role") return CALLER_ROLE;
+	if (ANON_KEY_CLAIMS.includes(claim)) return {
+		onSupabase: "present",
+		signedOutValue: `the anon key's \`${claim}\` claim`,
+		noun: "claim",
+		sentinels: []
+	};
+	return {
+		onSupabase: "null",
+		noun: "claim",
+		sentinels: CLEARING_SENTINELS
+	};
+}
 /**
 * Recognise "the policy tests that a caller id exists, and nothing that narrows
 * which rows" — and report which no-op guards it wears while doing so.
@@ -1210,9 +1508,10 @@ var CLEARING_SENTINELS = ["anonymous", ""];
 function callerIdOnlyClause(clause) {
 	if (!clause) return null;
 	const flat = clause.toLowerCase().replace(/::\s*[a-z0-9_]+(?:\s*\[\s*\])*/g, "").replace(/\s+/g, " ").trim();
-	for (const { re, label } of CALLER_ID_CALLS) {
+	for (const { re, label, call: callFor } of CALLER_ID_CALLS) {
 		const first = new RegExp(re.source).exec(flat);
 		if (!first) continue;
+		const call = callFor(first);
 		const substituted = flat.replace(new RegExp(re.source, "g"), " callerid ");
 		if (/\bor\b/.test(substituted)) return null;
 		let sawNullTest = false;
@@ -1227,19 +1526,15 @@ function callerIdOnlyClause(clause) {
 			}
 			const excluded = excludedLiterals(conjunct);
 			if (!excluded) return null;
-			if (excluded.some((lit) => CLEARING_SENTINELS.includes(lit))) cleared = true;
+			if (excluded.some((lit) => call.sentinels.includes(lit))) cleared = true;
 			decoys.push(...excluded);
 		}
 		if (!sawNullTest) continue;
-		if (cleared) return {
-			shape: label(first),
-			decoyGuards: [...new Set(decoys)],
-			guardsSentinel: true
-		};
 		return {
 			shape: label(first),
+			call,
 			decoyGuards: [...new Set(decoys)],
-			guardsSentinel: false
+			guardsSentinel: cleared
 		};
 	}
 	return null;
@@ -1386,7 +1681,7 @@ var policyAuthenticatedTautology = {
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			if (policyTargetsExposedRole(snapshot, policy).length === 0) continue;
+			if (policyReachedBy(snapshot, policy).length === 0) continue;
 			const usingMatch = callerIdOnlyClause(policy.using);
 			const checkMatch = callerIdOnlyClause(policy.withCheck);
 			const clauses = [];
@@ -1409,7 +1704,7 @@ var policyAuthenticatedTautology = {
 				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the rule to the row rather than to the existence of a session — an `ownerField`, or a `condition` naming the group whose members may share rows") : `-- Scope the policy to the row, rather than to the existence of a session:
 ALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- Or, where members of a shared group really may see each other's rows, say
 -- which group:
---     USING (EXISTS (SELECT 1 FROM memberships m\n--                    WHERE m.org_id = ${policy.table}.org_id AND m.user_id = ${uidCall}));\n-- If the table genuinely is readable by every account, keep this policy and
+--     USING (EXISTS (SELECT 1 FROM memberships m\n--                    WHERE m.org_id = ${qi(policy.table)}.org_id AND m.user_id = ${uidCall}));\n-- If the table genuinely is readable by every account, keep this policy and
 -- skip the finding: rls-check --skip ${ID$6}`
 			}));
 		}
@@ -1462,7 +1757,7 @@ var policyRoleUnreachable = {
 				impact: `Reads of this table return zero rows for every application role, and writes are rejected. Nothing is exposed — the data is invisible instead, and it looks identical to an empty table, which is why this usually goes unnoticed for a long time. The owner (${rel.owner}) still sees everything${rel.rlsForced ? " unless FORCE ROW LEVEL SECURITY changes that" : ", since FORCE ROW LEVEL SECURITY is not set"}.`,
 				fix: policies.every((p) => isRebaseManagedPolicy(snapshot, p)) ? managedPolicyFix(policies[0], "name the role your requests actually arrive as in the rules' `roles` — confirm it with `SELECT current_user` from the application's own connection") : `-- Point the policies at the role your requests actually arrive as. Confirm it with:
 --     SELECT current_user;   -- run this from your application's connection
-ALTER POLICY ${qi(policies[0].name)} ON ${qrel(rel.schema, rel.name)} TO <that role>;\n-- Alternatively, if ${named[0]} is meant to be reachable, grant membership:\n-- GRANT ${qi(named[0])} TO <your login role>;`
+ALTER POLICY ${qi(policies[0].name)} ON ${qrel(rel.schema, rel.name)} TO <that role>;\n-- Alternatively, if ${qi(named[0])} is meant to be reachable, grant membership:\n-- GRANT ${qi(named[0])} TO <your login role>;`
 			}));
 		}
 		return findings;
@@ -1486,6 +1781,10 @@ var ID$4 = "rls-disabled";
 * lookup tables reachable only by the service role. Flagging those is how a
 * scanner produces forty findings on a healthy database and gets ignored, so a
 * table nobody exposed produces no finding at all.
+*
+* Foreign tables are included, and are always "RLS off": Postgres refuses
+* `ENABLE ROW LEVEL SECURITY` on one, so a grant to an exposed role hands over
+* whatever the remote server returns, and the fix is the grant, not a policy.
 */
 var rlsDisabled = {
 	id: ID$4,
@@ -1494,8 +1793,9 @@ var rlsDisabled = {
 	run(snapshot) {
 		const uidCall = callerIdCall(snapshot);
 		const findings = [];
-		for (const rel of scannedTables(snapshot)) {
+		for (const rel of [...scannedTables(snapshot), ...scannedForeignTables(snapshot)]) {
 			if (rel.rlsEnabled) continue;
+			const foreign = rel.kind === "foreign_table";
 			const exposed = exposedGrantees(snapshot, rel.schema, rel.name, DML);
 			if (exposed.length === 0) continue;
 			const roles = exposed.map((e) => e.role);
@@ -1509,19 +1809,23 @@ var rlsDisabled = {
 				id: ID$4,
 				severity: "critical",
 				confidence: "certain",
-				title: `${rel.schema}.${rel.name} has row-level security disabled and is granted to ${listAnd(roles)}`,
+				title: foreign ? `${rel.schema}.${rel.name} is a foreign table, which cannot have row-level security, and is granted to ${listAnd(roles)}` : `${rel.schema}.${rel.name} has row-level security disabled and is granted to ${listAnd(roles)}`,
 				target: {
 					schema: rel.schema,
 					table: rel.name
 				},
-				detail: `Row-level security is not enabled on this table, so Postgres applies no per-row filter at all — policies, if any exist, are never consulted. ${listAnd(roles)} ${roles.length > 1 ? "hold" : "holds"} ${listAnd(privileges)} on it.`,
+				detail: (foreign ? "This is a foreign table. Postgres cannot enable row-level security on one, so no per-row filter applies to it and every row the remote server returns is returned. " : "Row-level security is not enabled on this table, so Postgres applies no per-row filter at all — policies, if any exist, are never consulted. ") + `${listAnd(roles)} ${roles.length > 1 ? "hold" : "holds"} ${listAnd(privileges)} on it.`,
 				impact: `If this table is reachable over an API that connects as ${listAnd(roles)}, a caller can ${listAnd(reach)}, with no tenant or owner scoping.`,
-				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- Enabling RLS with no policies denies every row to everyone but the owner,\n-- so add the policy you intend in the same migration, for example:\n-- CREATE POLICY ${JSON.stringify(`${rel.name}_owner_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT TO ${qrole(roles[0])} USING (user_id = ${uidCall});`
+				fix: foreign ? foreignTableFix(snapshot, rel.schema, rel.name, roles) : `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- Enabling RLS with no policies denies every row to everyone but the owner,\n-- so add the policy you intend in the same migration, for example:\n-- CREATE POLICY ${qi(`${rel.name}_owner_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT TO ${qrole(roles[0])} USING (user_id = ${uidCall});`
 			}));
 		}
 		return findings;
 	}
 };
+/** Take a foreign table away from the exposed roles: it cannot have row-level security. */
+function foreignTableFix(snapshot, schema, table, exposed) {
+	return `-- A foreign table cannot have row-level security, so take the grant away:\n${revokesReaching(snapshot, schema, table, exposed, DML).join("\n")}\n-- and keep it in a schema your API does not expose, reading it through a\n-- function that checks the caller.`;
+}
 //#endregion
 //#region src/checks/rls-enabled-no-policies.ts
 var ID$3 = "rls-enabled-no-policies";
@@ -1555,7 +1859,7 @@ var rlsEnabledNoPolicies = {
 				},
 				detail: `With RLS enabled and no policy defined, Postgres denies every row to every role. ${ownerNote}`,
 				impact: "Reads of this table return zero rows and writes are rejected for every non-owner role. No data is exposed; data is silently missing instead, and an empty result is indistinguishable from a correctly filtered one.",
-				fix: `-- Either define the policy you intended:\nCREATE POLICY ${JSON.stringify(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n    FOR SELECT TO authenticated USING (user_id = ${uidCall});\n-- or, if this table is genuinely meant to be unreadable, drop the grants\n-- instead of relying on an empty policy set:\n-- REVOKE ALL ON ${qrel(rel.schema, rel.name)} FROM PUBLIC;`
+				fix: `-- Either define the policy you intended:\nCREATE POLICY ${qi(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n    FOR SELECT TO authenticated USING (user_id = ${uidCall});\n-- or, if this table is genuinely meant to be unreadable, drop the grants\n-- instead of relying on an empty policy set:\n-- REVOKE ALL ON ${qrel(rel.schema, rel.name)} FROM PUBLIC;`
 			}));
 		}
 		return findings;
@@ -1568,11 +1872,18 @@ var ID$2 = "rls-enabled-not-forced";
 * RLS on, FORCE off — the table owner is exempt from its own policies.
 *
 * How much that matters is entirely a question of *who the owner is*, and the
-* severity has to follow that or the check becomes noise:
+* severity has to follow that or the check becomes noise. "The owner" means
+* every role with the owner's privileges: Postgres decides the exemption with
+* `has_privs_of_role`, so a member of the owning role is exempt exactly as the
+* owner is.
 *
-*   - Owner cannot log in: a provisioning role nothing connects as. Informational.
-*   - Owner can log in and is otherwise ordinary: anything using that connection
-*     string reads the whole table. This is the case worth waking up for.
+*   - A role an untrusted caller arrives as is, or is a member of, the owner:
+*     every request made as it skips the policies. Critical.
+*   - Owner can log in, or a login role is a member of it, and it is otherwise
+*     ordinary: anything using that connection string reads the whole table.
+*     This is the case worth waking up for.
+*   - Owner cannot log in and nothing that can is a member of it: a
+*     provisioning role nothing connects as. Informational.
 *   - Owner is a superuser or has BYPASSRLS: FORCE would not help either way,
 *     because those attributes skip RLS before ownership is even considered.
 *     Reporting `high` here would be misleading — the fix is "do not connect as
@@ -1589,6 +1900,9 @@ var rlsEnabledNotForced = {
 			const owner = snapshot.roles.find((r) => sameRole(r.name, rel.owner));
 			const bypasses = Boolean(owner?.superuser || owner?.bypassRls);
 			const canLogin = Boolean(owner?.canLogin);
+			const holdsOwner = (role) => rolesUsableBy(snapshot, role).has(rel.owner.toLowerCase());
+			const exposedOwners = snapshot.exposedRoles.filter((role) => !isPublicRole(role) && holdsOwner(role));
+			const loginMembers = snapshot.roles.filter((r) => r.canLogin && !sameRole(r.name, rel.owner) && holdsOwner(r.name)).map((r) => r.name);
 			let severity = "medium";
 			let detail;
 			let impact;
@@ -1597,11 +1911,18 @@ var rlsEnabledNotForced = {
 				severity = "medium";
 				detail = `Policies on this table do not apply to its owner, ${rel.owner}, because FORCE ROW LEVEL SECURITY is not set. That role is additionally ${owner?.superuser ? "a superuser" : "marked BYPASSRLS"}, so it skips row-level security on every table regardless of this setting — FORCE would not constrain it.`;
 				impact = `Any connection made as ${rel.owner} reads and writes every row of this table, ignoring all policies. This is expected for an administrative role and dangerous only if an application connects with it.`;
-				fix = `-- FORCE cannot constrain this role. Connect your application as a role that is\n-- neither the owner nor BYPASSRLS, and keep ${rel.owner} for migrations only.\nALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY; -- still worth setting`;
-			} else if (canLogin) {
+				fix = `-- FORCE cannot constrain this role. Connect your application as a role that is\n-- neither the owner nor BYPASSRLS, and keep ${qi(rel.owner)} for migrations only.\nALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY; -- still worth setting`;
+			} else if (exposedOwners.length > 0) {
+				severity = "critical";
+				const members = exposedOwners.filter((role) => !sameRole(role, rel.owner));
+				detail = `FORCE ROW LEVEL SECURITY is not set, so the owning role ${rel.owner} is exempt from every policy on this table, and Postgres extends that exemption to every member of the owning role. ${listAnd(exposedOwners)} — ${exposedOwners.length > 1 ? "roles" : "a role"} untrusted callers arrive as — ${exposedOwners.length > 1 ? "are" : "is"} ${members.length === exposedOwners.length ? "a member of it" : "the owner or a member of it"}.`;
+				impact = `A caller arriving as ${listAnd(exposedOwners)} reads and writes every row of this table, ignoring all policies on it.`;
+				fix = `ALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY;` + (members.length > 0 ? `\n-- and unless callers are meant to hold the owner's privileges:\n` + members.map((role) => `REVOKE ${qi(rel.owner)} FROM ${qi(role)};`).join("\n") : "");
+			} else if (canLogin || loginMembers.length > 0) {
 				severity = "high";
-				detail = `FORCE ROW LEVEL SECURITY is not set, so the owning role ${rel.owner} is exempt from every policy on this table. ${rel.owner} can log in directly, which means a connection string for it bypasses all row filtering.`;
-				impact = `Anything connecting as ${rel.owner} — including an application that was handed the owner's connection string, which is the default in most quick-start setups — reads and writes every row, ignoring the policies on this table.`;
+				const who = canLogin ? [rel.owner, ...loginMembers] : loginMembers;
+				detail = `FORCE ROW LEVEL SECURITY is not set, so the owning role ${rel.owner} is exempt from every policy on this table. ` + (canLogin ? `${rel.owner} can log in directly, which means a connection string for it bypasses all row filtering.` : `${rel.owner} cannot log in, but ${listAnd(loginMembers)} can, and Postgres exempts a member of the owning role exactly as it exempts the owner.`) + (canLogin && loginMembers.length > 0 ? ` So ${loginMembers.length > 1 ? "do" : "does"} ${listAnd(loginMembers)}, which can log in and ${loginMembers.length > 1 ? "are members" : "is a member"} of it.` : "");
+				impact = `Anything connecting as ${listAnd(who)} — including an application that was handed the owner's connection string, which is the default in most quick-start setups — reads and writes every row, ignoring the policies on this table.`;
 				fix = `ALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY;`;
 			} else {
 				severity = "medium";
@@ -1663,20 +1984,31 @@ var securityDefinerMutableSearchPath = {
 				},
 				detail: `This routine runs with the privileges of its owner (${routine.owner}) but resolves unqualified names using the *caller's* search_path, because no \`SET search_path\` is attached to it. A caller who can create objects in any schema on that path can shadow a table or function the routine uses, and their object then runs as ${routine.owner}.`,
 				impact: `Any role that can both execute this routine and create objects in a schema on its search_path can have arbitrary SQL run as ${routine.owner} — which bypasses row-level security on every table ${routine.owner} can reach. Without CREATE on some schema this is not directly exploitable, so check who holds CREATE (commonly PUBLIC on \`public\` in older databases).`,
-				fix: `-- Pin the search_path on every overload of this routine:
-DO \$\$
-DECLARE r record;
+				fix: `-- Pin the search_path on every overload of this routine:\n` + dollarQuotedDo(`DECLARE r record;
 BEGIN
     FOR r IN
         SELECT p.oid::regprocedure AS sig
         FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = ${literal(routine.schema)} AND p.proname = ${literal(routine.name)}\n    LOOP\n        EXECUTE format('ALTER ROUTINE %s SET search_path = pg_catalog, pg_temp', r.sig);\n    END LOOP;\nEND $$;\n-- Then schema-qualify every identifier in the body, since nothing but\n-- pg_catalog is on the path any more.`
+        WHERE n.nspname = ${literal(routine.schema)} AND p.proname = ${literal(routine.name)}\n    LOOP\n        EXECUTE format('ALTER ROUTINE %s SET search_path = pg_catalog, pg_temp', r.sig);\n    END LOOP;\nEND`) + "\n-- Then schema-qualify every identifier in the body, since nothing but\n-- pg_catalog is on the path any more."
 			}));
 		}
 		return findings;
 	}
 };
 var literal = (value) => `'${value.replace(/'/g, "''")}'`;
+/**
+* `DO $$ … $$;`, with a dollar-quote tag the body does not contain.
+*
+* The body carries the routine's schema and name as string literals, and a
+* routine can be named anything, `$$` included. A `$$` in the name ended the
+* body there and ran the rest of the name as SQL, whatever the quotes around
+* it said: nothing inside a dollar-quoted string is special except its tag.
+*/
+function dollarQuotedDo(body) {
+	let tag = "$$";
+	for (let i = 0; body.includes(tag); i++) tag = `$fix${i === 0 ? "" : i}$`;
+	return `DO ${tag}\n${body} ${tag};`;
+}
 //#endregion
 //#region src/checks/unqualified-column-in-subquery.ts
 var ID = "unqualified-column-in-subquery";
@@ -1705,11 +2037,21 @@ var ID = "unqualified-column-in-subquery";
 *     flagging it merely because the outer table also has a `user_id` would fire
 *     on a large fraction of correct policies.
 *
-* Confidence is always heuristic, and the detail says why an absence proves
-* nothing: `pg_policies.qual` is Postgres's re-rendering of the parse tree, and
-* it normally re-qualifies references. A finding here therefore means the
-* ambiguity survived that rewrite, which is strong evidence — but a clean scan
-* is not proof that the original SQL was unambiguous.
+* What a live database hands this check is not what anyone typed.
+* `pg_policies.qual` is Postgres's re-rendering of the parse tree, and inside a
+* subquery it qualifies *every* column — so the bare name is never in the text.
+* The bare-name scan below only ever fires on text that did not come out of the
+* catalog. Against a real database the mistake shows up as its effect: the bare
+* `organization_id` bound to the inner relation, so the stored comparison reads
+* `m.organization_id = m.organization_id` — a column compared with itself. That
+* shape is what {@link selfComparisons} looks for, and it is the half of this
+* check that can fire on a scan. It was the half missing until it was noticed
+* that the check could not fire at all; the e2e suite now holds it to that.
+*
+* Confidence is always heuristic, and an absence still proves nothing: a bare
+* name compared with a *different* inner column (`organization_id = id`) comes
+* back as `m.organization_id = m.id`, which is indistinguishable from a
+* comparison somebody meant.
 */
 var unqualifiedColumnInSubquery = {
 	id: ID,
@@ -1784,6 +2126,12 @@ function scanExpression(snapshot, outer, expr) {
 		}
 		const from = parseFrom(tokens, own);
 		if (from.length === 0) continue;
+		for (const hit of selfComparisons(snapshot, outer, tokens, own, from)) {
+			const key = `${hit.column}|${hit.inner}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			out.push(hit);
+		}
 		const relations = from.map((item) => resolveRelation(snapshot, outer.schema, item)).filter((r) => Boolean(r)).filter((r) => !(r.schema === outer.schema && r.name === outer.name));
 		if (relations.length === 0) continue;
 		const aliases = new Set(from.map((f) => f.alias).filter((a) => Boolean(a)));
@@ -1801,14 +2149,67 @@ function scanExpression(snapshot, outer, expr) {
 			if (seen.has(key)) continue;
 			seen.add(key);
 			out.push({
+				kind: "bare",
 				column: token.value,
 				inner: `${inner.schema}.${inner.name}`,
+				innerRelation: {
+					schema: inner.schema,
+					name: inner.name
+				},
 				comparedTo: partner
 			});
 		}
 	}
 	return out;
 }
+/**
+* `q.col <op> q.col` in this subquery's predicate, where `q` is one of the
+* subquery's own FROM items and the policy's table has a `col` too.
+*
+* Nobody writes a column compared with itself; Postgres does, when it stores
+* `WHERE m.user_id = auth.uid() AND org_id = org_id` and the second `org_id`
+* bound to `m`. The outer table having the column is what makes it this bug
+* rather than some other one: it is the column the author could have meant.
+*/
+function selfComparisons(snapshot, outer, tokens, own, from) {
+	const inPredicate = new Set(predicateIndices(tokens, own));
+	const out = [];
+	const at = (k) => tokens[own[k]];
+	const isDot = (k) => at(k)?.kind === "punct" && at(k)?.value === ".";
+	const isIdent = (k) => at(k)?.kind === "ident";
+	for (let k = 0; k + 6 < own.length; k++) {
+		if (!inPredicate.has(own[k])) continue;
+		if (isDot(k - 1)) continue;
+		if (!isIdent(k) || !isDot(k + 1) || !isIdent(k + 2)) continue;
+		const op = at(k + 3);
+		if (!op || !COMPARISONS.has(op.value) || op.value === "in" || op.value === "is") continue;
+		if (!isIdent(k + 4) || !isDot(k + 5) || !isIdent(k + 6)) continue;
+		if (isDot(k + 7) || at(k + 7)?.kind === "punct" && at(k + 7)?.value === "(") continue;
+		const qualifier = at(k).value;
+		const column = at(k + 2).value;
+		if (at(k + 4).value !== qualifier || at(k + 6).value !== column) continue;
+		if (!hasColumn(outer, column)) continue;
+		const item = from.find((f) => (f.alias ?? f.name) === qualifier);
+		if (!item) continue;
+		const resolved = resolveRelation(snapshot, outer.schema, item);
+		const innerRelation = resolved ? {
+			schema: resolved.schema,
+			name: resolved.name
+		} : {
+			schema: item.schema ?? outer.schema,
+			name: item.name
+		};
+		out.push({
+			kind: "self",
+			column,
+			inner: `${innerRelation.schema}.${innerRelation.name}`,
+			innerRelation,
+			comparedTo: `${qualifier}.${column}`,
+			operator: op.value
+		});
+	}
+	return out;
+}
 /** Relation references in the subquery's FROM list, with their aliases. */
 function parseFrom(tokens, own) {
 	const start = own.findIndex((i) => tokens[i].kind === "ident" && tokens[i].value === "from");
@@ -1922,20 +2323,30 @@ function resolveRelation(snapshot, policySchema, item) {
 	return candidates.length === 1 ? candidates[0] : void 0;
 }
 function buildFinding(snapshot, policy, outer, clause, hit) {
+	const innerSql = qrel(hit.innerRelation.schema, hit.innerRelation.name);
+	const self = hit.kind === "self";
+	const admits = !self || [
+		"=",
+		"<=",
+		">=",
+		"~~",
+		"like",
+		"ilike"
+	].includes(hit.operator ?? "=");
 	return finding({
 		id: ID,
 		severity: "high",
 		confidence: "heuristic",
-		title: `Policy "${policy.name}" on ${policy.schema}.${policy.table}: does \`${hit.column}\` in the subquery mean ${outer.name}.${hit.column} or ${hit.inner}.${hit.column}?`,
+		title: self ? `Policy "${policy.name}" on ${policy.schema}.${policy.table}: the subquery compares \`${hit.comparedTo}\` with itself — was one side meant to be ${outer.name}.${hit.column}?` : `Policy "${policy.name}" on ${policy.schema}.${policy.table}: does \`${hit.column}\` in the subquery mean ${outer.name}.${hit.column} or ${hit.inner}.${hit.column}?`,
 		target: {
 			schema: policy.schema,
 			table: policy.table,
 			policy: policy.name,
 			column: hit.column
 		},
-		detail: `In the ${clause} expression, \`${hit.column}\` is written unqualified inside a subquery over ${hit.inner}, compared against \`${hit.comparedTo}\`. Both ${hit.inner} and ${policy.schema}.${policy.table} have a column named \`${hit.column}\`, and Postgres resolves the bare name against the innermost scope that has it — so it binds to ${hit.inner}.${hit.column}, not to the outer row. If the intent was to correlate the subquery with the row being checked, that correlation is not happening.\n\nNote that \`pg_policies\` shows Postgres's own re-rendering of the policy, which usually re-qualifies column references. A match here means the ambiguity survived that rewrite, so it is strong evidence — but the absence of a match on other policies is not proof that they are unambiguous.`,
-		impact: "The predicate does not mean what it reads like. Depending on the data it either matches far more rows than intended — exposing other users' or tenants' rows to anyone the policy applies to — or, if the inner comparison is never satisfiable, matches none, and the table silently returns empty results.",
-		fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `qualify every reference in the rule's condition so the binding is explicit — \`${hit.inner}.${hit.column}\` and \`${policy.table}.${hit.column}\` are different columns, and the bare name binds to the inner one`) : `-- Qualify every reference so the binding is explicit:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clause === "USING" ? "USING" : "WITH CHECK"} (EXISTS (\n        SELECT 1 FROM ${hit.inner}\n        WHERE ${hit.inner}.${hit.comparedTo.includes(".") ? hit.comparedTo.split(".").pop() : hit.comparedTo}\n            = ${policy.table}.${hit.column}\n    ));\n-- Verify the intended direction first — this rewrite assumes the outer row was meant.`
+		detail: self ? `In the ${clause} expression, the subquery over ${hit.inner} compares \`${hit.comparedTo}\` with itself, so that comparison does not depend on the row being checked. It is what Postgres stores for a comparison written with a bare \`${hit.column}\` meant for the outer row: ${hit.inner} has a \`${hit.column}\` too, Postgres resolves a bare name against the innermost scope that has it, and \`pg_policies\` shows the result with both sides qualified. If the intent was to correlate the subquery with ${policy.schema}.${policy.table}.${hit.column}, that correlation is not happening.` : `In the ${clause} expression, \`${hit.column}\` is written unqualified inside a subquery over ${hit.inner}, compared against \`${hit.comparedTo}\`. Both ${hit.inner} and ${policy.schema}.${policy.table} have a column named \`${hit.column}\`, and Postgres resolves the bare name against the innermost scope that has it — so it binds to ${hit.inner}.${hit.column}, not to the outer row. If the intent was to correlate the subquery with the row being checked, that correlation is not happening.\n\nNote that \`pg_policies\` qualifies every column inside a subquery, so a bare name never appears in text read from a live database: there the same mistake reads as a column compared with itself, which this check also reports. A comparison of two different columns looks deliberate either way, so an absence of this finding is not proof.`,
+		impact: self ? admits ? `The subquery is true for every row of ${policy.schema}.${policy.table} as soon as it is true for one: anyone it admits to one row is admitted to all of them, other users' and other tenants' rows included.` : "The comparison is never true, so the subquery matches nothing and the policy admits no row — the table silently returns empty results to everyone it covers." : "The predicate does not mean what it reads like. Depending on the data it either matches far more rows than intended — exposing other users' or tenants' rows to anyone the policy applies to — or, if the inner comparison is never satisfiable, matches none, and the table silently returns empty results.",
+		fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `qualify every reference in the rule's condition so the binding is explicit — \`${hit.inner}.${hit.column}\` and \`${policy.table}.${hit.column}\` are different columns, and the bare name binds to the inner one`) : `-- Qualify every reference so the binding is explicit:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clause === "USING" ? "USING" : "WITH CHECK"} (EXISTS (\n        SELECT 1 FROM ${innerSql}\n        WHERE ${innerSql}.${qi(hit.comparedTo.split(".").pop() ?? hit.comparedTo)}\n            = ${qi(policy.table)}.${qi(hit.column)}\n    ));\n-- Verify the intended direction first — this rewrite assumes the outer row was meant.`
 	});
 }
 //#endregion
@@ -2257,6 +2668,23 @@ var UnknownRoleError = class extends Error {
 		this.roles = roles;
 	}
 };
+/**
+* A `--schema` that is not in `pg_namespace`.
+*
+* The same failure as an unknown `--role`, and worse: a typo such as
+* `--schema pubic`, or `--schema Public` for a schema named `public`, scanned
+* nothing at all. Zero tables, "No findings", exit 0, for as long as the typo
+* sat in a CI job. A name that matches nothing only ever narrows the scan, so
+* it is an error.
+*/
+var UnknownSchemaError = class extends Error {
+	schemas;
+	constructor(schemas) {
+		super(`Unknown schema${schemas.length === 1 ? "" : "s"}: ${schemas.join(", ")}.`);
+		this.name = "UnknownSchemaError";
+		this.schemas = schemas;
+	}
+};
 var SYSTEM_SCHEMAS = [
 	"pg_catalog",
 	"information_schema",
@@ -2419,6 +2847,49 @@ function clientConfigFromKeywords(keywords) {
 	return config;
 }
 /**
+* The TLS postures to try, in order, for an `sslmode`. Each entry says whether
+* certificate verification had to be given up to get there.
+*/
+function connectionAttempts(sslmode) {
+	switch (sslmode) {
+		case "disable": return [{
+			ssl: false,
+			downgraded: false
+		}];
+		case "require":
+		case "no-verify": return [{
+			ssl: { rejectUnauthorized: false },
+			downgraded: false
+		}];
+		case "verify-ca":
+		case "verify-full": return [{
+			ssl: { rejectUnauthorized: true },
+			downgraded: false
+		}];
+		case "allow": return [{
+			ssl: false,
+			downgraded: false
+		}, {
+			ssl: { rejectUnauthorized: false },
+			downgraded: false
+		}];
+		default: return [
+			{
+				ssl: { rejectUnauthorized: true },
+				downgraded: false
+			},
+			{
+				ssl: { rejectUnauthorized: false },
+				downgraded: true
+			},
+			{
+				ssl: false,
+				downgraded: false
+			}
+		];
+	}
+}
+/**
 * Connect, negotiating TLS the way libpq would.
 *
 * `pg` lets the connection string override an explicit `ssl` option, so the
@@ -2434,43 +2905,7 @@ async function connect(connectionString) {
 	const keywords = parseKeywordConnectionString(connectionString);
 	const sslmode = keywords ? keywords.get("sslmode")?.toLowerCase() : readParam(connectionString, "sslmode");
 	const base = keywords ? clientConfigFromKeywords(keywords) : { connectionString: stripParam(connectionString, "sslmode") };
-	let attempts;
-	switch (sslmode) {
-		case "disable":
-			attempts = [{
-				ssl: false,
-				downgraded: false
-			}];
-			break;
-		case "require":
-		case "no-verify":
-			attempts = [{
-				ssl: { rejectUnauthorized: false },
-				downgraded: false
-			}];
-			break;
-		case "verify-ca":
-		case "verify-full":
-			attempts = [{
-				ssl: { rejectUnauthorized: true },
-				downgraded: false
-			}];
-			break;
-		default: attempts = [
-			{
-				ssl: false,
-				downgraded: false
-			},
-			{
-				ssl: { rejectUnauthorized: true },
-				downgraded: false
-			},
-			{
-				ssl: { rejectUnauthorized: false },
-				downgraded: true
-			}
-		];
-	}
+	const attempts = connectionAttempts(sslmode);
 	let lastError;
 	for (const attempt of attempts) {
 		const client = new Client({
@@ -2545,9 +2980,11 @@ async function readSnapshot(client, opts, diagnostics) {
 	const relations = await readRelations(db, schemas);
 	const policies = await readPolicies(db, schemas);
 	const grants = await readGrants(db, schemas);
-	const views = await readViews(db, schemas, serverVersionNum, relations);
+	const schemaUsage = await readSchemaUsage(db, diagnostics);
+	const views = await readViews(db, schemas, serverVersionNum);
 	const foreignKeys = await readForeignKeys(db, schemas);
 	const routines = await readRoutines(db, schemas);
+	const referenced = await readReferencedRelations(db, outOfScopeReferences(relations, views, foreignKeys));
 	const scannerIsPrivileged = isPrivileged(currentRole, server, roles, relations);
 	const connectingRole = !scannerIsPrivileged && currentRole !== "unknown" ? currentRole : void 0;
 	const exposedRoles = exposedRolesFor(roles, opts.roles, connectingRole);
@@ -2561,10 +2998,11 @@ async function readSnapshot(client, opts, diagnostics) {
 		schemas,
 		exposedRoles,
 		platform: detectPlatform(allSchemas, roles),
-		relations,
+		relations: [...relations, ...referenced],
 		policies,
 		roles,
 		grants,
+		schemaUsage,
 		views,
 		foreignKeys,
 		routines
@@ -2580,6 +3018,11 @@ async function readSnapshot(client, opts, diagnostics) {
 function selectSchemas(all, requested, diagnostics) {
 	const isSystem = (s) => SYSTEM_SCHEMAS.includes(s) || /^pg_temp(_\d+)?$/.test(s) || /^pg_toast_temp(_\d+)?$/.test(s);
 	if (requested && requested.length > 0) {
+		if (!diagnostics.degraded.some((entry) => entry.what === "schema list")) {
+			const present = new Set(all);
+			const unknown = [...new Set(requested.filter((schema) => !present.has(schema)))];
+			if (unknown.length > 0) throw new UnknownSchemaError(unknown);
+		}
 		const wanted = new Set(requested);
 		const kept = [];
 		for (const schema of all) if (wanted.has(schema)) kept.push(schema);
@@ -2650,16 +3093,66 @@ async function readRelations(db, schemas) {
          WHERE c.relkind::text = ANY($2) AND n.nspname = ANY($1)
          ORDER BY n.nspname, c.relname`, [schemas, SCANNED_RELKINDS]);
 	const columns = await readColumns(db, schemas);
-	return rows.map((r) => ({
+	return rows.map((r) => toRelation(r, columns.get(`${r.schema}.${r.name}`) ?? []));
+}
+function toRelation(r, columns) {
+	return {
 		schema: r.schema,
 		name: r.name,
 		kind: RELATION_KINDS[r.kind] ?? "table",
 		owner: r.owner,
 		rlsEnabled: Boolean(r.rls_enabled),
 		rlsForced: Boolean(r.rls_forced),
-		columns: columns.get(`${r.schema}.${r.name}`) ?? [],
+		columns,
 		estimatedRows: Number(r.estimated_rows ?? -1)
-	}));
+	};
+}
+/**
+* Relations a scanned view reads or a scanned foreign key points at that the
+* scan did not read, each named once.
+*
+* View dependencies are read across schemas on purpose, and foreign keys
+* always were — but a dependency on a relation that is not in the snapshot
+* resolves to nothing. `CREATE VIEW public.files AS SELECT * FROM
+* storage.objects`, granted to anon, produced no finding on a default scan
+* (which leaves `storage` out), and a junction table pointing at `auth.users`
+* was never considered.
+*/
+function outOfScopeReferences(relations, views, foreignKeys) {
+	const key = (schema, name) => JSON.stringify([schema, name]);
+	const known = new Set(relations.map((r) => key(r.schema, r.name)));
+	const out = /* @__PURE__ */ new Map();
+	const add = (schema, name) => {
+		const k = key(schema, name);
+		if (!known.has(k) && !out.has(k)) out.set(k, {
+			schema,
+			name
+		});
+	};
+	for (const view of views) for (const dep of view.dependsOn) add(dep.schema, dep.table);
+	for (const fk of foreignKeys) add(fk.refSchema, fk.refTable);
+	return [...out.values()];
+}
+/**
+* Read the relations {@link outOfScopeReferences} names. Columns are not read:
+* nothing judges a referenced relation by its columns, only by whether it has
+* row-level security.
+*/
+async function readReferencedRelations(db, refs) {
+	if (refs.length === 0) return [];
+	return (await db.query("referenced relations", `SELECT n.nspname AS schema, c.relname AS name, c.relkind::text AS kind,
+                pg_get_userbyid(c.relowner) AS owner,
+                c.relrowsecurity      AS rls_enabled,
+                c.relforcerowsecurity AS rls_forced,
+                c.reltuples::float8   AS estimated_rows
+         FROM unnest($1::text[], $2::text[]) AS ref(schema_name, rel_name)
+         JOIN pg_namespace n ON n.nspname = ref.schema_name
+         JOIN pg_class c ON c.relnamespace = n.oid AND c.relname = ref.rel_name
+         WHERE c.relkind::text = ANY($3)`, [
+		refs.map((r) => r.schema),
+		refs.map((r) => r.name),
+		SCANNED_RELKINDS
+	])).map((r) => toRelation(r, []));
 }
 async function readColumns(db, schemas) {
 	const rows = await db.query("columns", `SELECT n.nspname AS schema, c.relname AS table_name, a.attname AS name,
@@ -2703,14 +3196,33 @@ async function readPolicies(db, schemas) {
 		withCheck: r.with_check
 	}));
 }
+/**
+* Privileges on each scanned relation, from the relation's ACL and from its
+* columns' ACLs.
+*
+* A column privilege is a privilege on the relation for what these checks ask:
+* `GRANT SELECT (id, email) ON users TO anon` on a table with RLS off hands
+* anon those columns of every row, and a column-level UPDATE grant next to a
+* `USING (true)` policy lets anon rewrite them. Reading `relacl` alone missed
+* both, so `rls-disabled` and `anonymous-write-allowed` said nothing.
+*/
 async function readGrants(db, schemas) {
-	const rows = await db.query("table privileges", `SELECT n.nspname AS schema, c.relname AS table_name,
+	const tableRows = await db.query("table privileges", `SELECT n.nspname AS schema, c.relname AS table_name,
                 CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END AS grantee,
                 a.privilege_type
          FROM pg_class c
          JOIN pg_namespace n ON n.oid = c.relnamespace
          CROSS JOIN LATERAL aclexplode(COALESCE(c.relacl, acldefault('r'::"char", c.relowner))) a
          WHERE c.relkind::text = ANY($2) AND n.nspname = ANY($1)`, [schemas, SCANNED_RELKINDS]);
+	const columnRows = await db.query("column privileges", `SELECT DISTINCT n.nspname AS schema, c.relname AS table_name,
+                CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END AS grantee,
+                a.privilege_type
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         JOIN pg_attribute att ON att.attrelid = c.oid
+         CROSS JOIN LATERAL aclexplode(att.attacl) a
+         WHERE att.attnum > 0 AND NOT att.attisdropped AND att.attacl IS NOT NULL
+           AND c.relkind::text = ANY($2) AND n.nspname = ANY($1)`, [schemas, SCANNED_RELKINDS]);
 	const known = /* @__PURE__ */ new Set([
 		"SELECT",
 		"INSERT",
@@ -2721,46 +3233,115 @@ async function readGrants(db, schemas) {
 		"TRIGGER"
 	]);
 	const map = /* @__PURE__ */ new Map();
-	for (const row of rows) {
+	for (const row of [...tableRows, ...columnRows]) {
 		if (!known.has(row.privilege_type)) continue;
-		const key = `${row.schema}.${row.table_name}.${row.grantee}`;
+		const key = JSON.stringify([
+			row.schema,
+			row.table_name,
+			row.grantee
+		]);
 		if (!map.has(key)) map.set(key, {
 			schema: row.schema,
 			table: row.table_name,
 			grantee: row.grantee,
 			privileges: []
 		});
-		map.get(key).privileges.push(row.privilege_type);
+		const privileges = map.get(key).privileges;
+		const privilege = row.privilege_type;
+		if (!privileges.includes(privilege)) privileges.push(privilege);
 	}
 	return [...map.values()];
 }
-async function readViews(db, schemas, serverVersionNum, relations) {
+/**
+* Who holds USAGE on each schema. Every schema, not only the scanned ones: a
+* view or a foreign key can point outside the scan.
+*
+* `undefined`, not `[]`, when the read failed — an empty list would say no role
+* can use any schema and silence every check that gates on a grant, which is
+* the wrong direction for a scanner to fail in.
+*/
+async function readSchemaUsage(db, diagnostics) {
+	const what = "schema privileges";
+	const rows = await db.query(what, `SELECT n.nspname AS schema,
+                CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END AS grantee
+         FROM pg_namespace n
+         CROSS JOIN LATERAL aclexplode(COALESCE(n.nspacl, acldefault('n'::"char", n.nspowner))) a
+         WHERE a.privilege_type = 'USAGE'`);
+	if (diagnostics.degraded.some((entry) => entry.what === what)) return void 0;
+	return rows.map((r) => ({
+		schema: r.schema,
+		grantee: r.grantee
+	}));
+}
+async function readViews(db, schemas, serverVersionNum) {
 	const rows = await db.query("views", `SELECT n.nspname AS schema, c.relname AS name, pg_get_userbyid(c.relowner) AS owner,
                 c.relkind::text AS kind, c.reloptions
          FROM pg_class c
          JOIN pg_namespace n ON n.oid = c.relnamespace
          WHERE c.relkind = ANY(ARRAY['v','m']) AND n.nspname = ANY($1)
          ORDER BY n.nspname, c.relname`, [schemas]);
-	const dependencies = await readViewDependencies(db, schemas, relations);
+	const dependencies = await readViewDependencies(db);
 	return rows.map((r) => ({
 		schema: r.schema,
 		name: r.name,
 		owner: r.owner,
-		securityInvoker: serverVersionNum < 15e4 || r.kind === "m" ? null : (r.reloptions ?? []).some((o) => /^security_invoker=(true|on)$/i.test(o)),
-		dependsOn: dependencies.get(`${r.schema}.${r.name}`) ?? []
+		securityInvoker: serverVersionNum < 15e4 || r.kind === "m" ? null : reloptionIsOn(r.reloptions, "security_invoker"),
+		dependsOn: dependencies.get(JSON.stringify([r.schema, r.name])) ?? []
 	}));
 }
 /**
+* Whether a boolean reloption is set on, read the way Postgres reads it.
+*
+* Postgres stores a reloption as the text it was given, after checking it with
+* `parse_bool`, so `WITH (security_invoker = 1)` is stored as
+* `security_invoker=1` and means on. Matching only `true` and `on` reported such
+* a view as a critical bypass. A value `parse_bool` would refuse cannot be
+* stored, so anything unrecognised here is read as off — the direction that
+* reports rather than hides.
+*/
+function reloptionIsOn(reloptions, name) {
+	for (const option of reloptions ?? []) {
+		const eq = option.indexOf("=");
+		if (eq === -1 || option.slice(0, eq).toLowerCase() !== name) continue;
+		return parsePgBool(option.slice(eq + 1)) === true;
+	}
+	return false;
+}
+/**
+* Postgres's `parse_bool`: `true`/`false`, `yes`/`no`, `on`/`off`, `1`/`0`,
+* case-insensitively, and any unambiguous prefix of the words — `t`, `ye`,
+* `of` — but not `o`, which could be either. `null` for anything else.
+*/
+function parsePgBool(raw) {
+	const value = raw.trim().toLowerCase();
+	if (value.length === 0) return null;
+	const prefixOf = (word) => word.startsWith(value);
+	switch (value[0]) {
+		case "t": return prefixOf("true") ? true : null;
+		case "f": return prefixOf("false") ? false : null;
+		case "y": return prefixOf("yes") ? true : null;
+		case "n": return prefixOf("no") ? false : null;
+		case "o":
+			if (value.length < 2) return null;
+			if (prefixOf("on")) return true;
+			return prefixOf("off") ? false : null;
+		case "1": return value.length === 1 ? true : null;
+		case "0": return value.length === 1 ? false : null;
+		default: return null;
+	}
+}
+/**
 * Base relations of each view, resolved through `pg_depend` → `pg_rewrite`.
 *
 * Deliberately transitive: a view over a view over a protected table is still a
 * path to that table, and the intermediate view's own options do not save it
-* (the outer view still executes as its own owner). Base tables are not filtered
-* to the scanned schemas — a view in `public` reading a hidden schema is exactly
-* the case worth catching.
+* (the outer view still executes as its own owner). Neither side is filtered to
+* the scanned schemas — a view in `public` reading a hidden schema is exactly
+* the case worth catching, and so is one reading it through a view that lives
+* there. Only the system catalogs' own views are left out.
 */
-async function readViewDependencies(db, schemas, relations) {
-	const rows = await db.query("view dependencies", `SELECT DISTINCT dn.nspname AS view_schema, dc.relname AS view_name,
+async function readViewDependencies(db) {
+	return resolveViewDependencies(await db.query("view dependencies", `SELECT DISTINCT dn.nspname AS view_schema, dc.relname AS view_name,
                 rn.nspname AS ref_schema, rc.relname AS ref_name
          FROM pg_depend d
          JOIN pg_rewrite rw ON rw.oid = d.objid
@@ -2772,32 +3353,39 @@ async function readViewDependencies(db, schemas, relations) {
            AND d.refclassid = 'pg_class'::regclass
            AND dc.oid <> rc.oid
            AND dc.relkind = ANY(ARRAY['v','m'])
-           AND rc.relkind::text = ANY($2)
-           AND dn.nspname = ANY($1)`, [schemas, SCANNED_RELKINDS]);
+           AND rc.relkind::text = ANY($1)
+           AND dn.nspname <> ALL(ARRAY['pg_catalog', 'information_schema'])`, [SCANNED_RELKINDS]));
+}
+/**
+* The transitive closure of direct view dependencies, keyed by
+* `JSON.stringify([schema, name])`.
+*
+* Every view with a dependency of its own is expanded, wherever it lives, and
+* names are kept as pairs: `schema.name` split at the first dot is wrong for a
+* schema whose name has a dot in it.
+*/
+function resolveViewDependencies(rows) {
+	const key = (schema, name) => JSON.stringify([schema, name]);
 	const direct = /* @__PURE__ */ new Map();
 	for (const row of rows) {
-		const key = `${row.view_schema}.${row.view_name}`;
-		if (!direct.has(key)) direct.set(key, /* @__PURE__ */ new Set());
-		direct.get(key).add(`${row.ref_schema}.${row.ref_name}`);
+		const k = key(row.view_schema, row.view_name);
+		if (!direct.has(k)) direct.set(k, /* @__PURE__ */ new Map());
+		direct.get(k).set(key(row.ref_schema, row.ref_name), {
+			schema: row.ref_schema,
+			table: row.ref_name
+		});
 	}
-	const isView = new Set(relations.filter((r) => r.kind === "view" || r.kind === "materialized_view").map((r) => `${r.schema}.${r.name}`));
 	const out = /* @__PURE__ */ new Map();
-	for (const key of direct.keys()) {
-		const seen = /* @__PURE__ */ new Set();
-		const queue = [...direct.get(key) ?? []];
+	for (const [view, refs] of direct) {
+		const seen = /* @__PURE__ */ new Map();
+		const queue = [...refs];
 		while (queue.length > 0) {
-			const next = queue.shift();
-			if (next === key || seen.has(next)) continue;
-			seen.add(next);
-			if (isView.has(next)) queue.push(...direct.get(next) ?? []);
+			const [next, ref] = queue.shift();
+			if (next === view || seen.has(next)) continue;
+			seen.set(next, ref);
+			queue.push(...direct.get(next) ?? []);
 		}
-		out.set(key, [...seen].map((ref) => {
-			const dot = ref.indexOf(".");
-			return {
-				schema: ref.slice(0, dot),
-				table: ref.slice(dot + 1)
-			};
-		}));
+		out.set(view, [...seen.values()]);
 	}
 	return out;
 }
@@ -2991,6 +3579,58 @@ function exceedsThreshold(findings, failOn) {
 	const threshold = severityRank(failOn);
 	return findings.some((finding) => severityRank(finding.severity) >= threshold);
 }
+/** Clean, or nothing at or above `--fail-on`. */
+var EXIT_OK = 0;
+/** Findings at or above `--fail-on`. */
+var EXIT_FINDINGS = 1;
+/** The scan did not happen: bad arguments, bad connection, timeout. */
+var EXIT_ERROR = 2;
+/**
+* The verdict, as an exit code.
+*
+* Pulled out of `runCli` so it can be tested: `runCli` needs a database, and
+* the one line that decides whether CI goes red had no coverage at all —
+* deleting it broke no test.
+*
+* A degraded scan exits 2, the same code a crash uses, rather than 0. Checks
+* whose catalogue reads failed return no findings, which is indistinguishable
+* from finding none, so exiting 0 would have the scanner answer "no problems"
+* to a question it never managed to ask. Both codes mean the same thing here:
+* no verdict.
+*/
+function exitCodeFor(result, failOn) {
+	if ((result.diagnostics?.degraded.length ?? 0) > 0) return 2;
+	return exceedsThreshold(result.findings, failOn) ? 1 : 0;
+}
+/**
+* The summary's last word: the code the process exits with, and why.
+*
+* Both reports print it, and both used to work it out for themselves from the
+* findings alone, so a degraded scan printed "Exit code 0" or "Exit code 1"
+* and then exited 2. It comes from {@link exitCodeFor} now, the same function
+* the CLI exits with.
+*/
+function exitVerdict(result, failOn) {
+	const code = exitCodeFor(result, failOn);
+	if (code === 2) {
+		const failed = result.diagnostics?.degraded.length ?? 0;
+		return {
+			code,
+			reason: `the scan was incomplete (${failed} catalogue ${failed === 1 ? "read" : "reads"} failed), so there is no verdict.`
+		};
+	}
+	if (failOn === "none") return {
+		code,
+		reason: "--fail-on none, so findings never fail the run."
+	};
+	return code === 1 ? {
+		code,
+		reason: `at least one finding is "${failOn}" or worse (--fail-on ${failOn}).`
+	} : {
+		code,
+		reason: `nothing at or above "${failOn}" (--fail-on ${failOn}).`
+	};
+}
 var identity = (value) => value;
 var code = (open, close) => (value) => `\u001B[${open}m${value}\u001B[${close}m`;
 var PLAIN = {
@@ -3259,10 +3899,8 @@ function renderSummary(result, certain, heuristic, style, width, options) {
 	out.push(`  ${style.dim(`${certain.length} confirmed · ${heuristic.length} worth checking · ${result.stats.checksRun} ${plural$1(result.stats.checksRun, "check", "checks")} run against ${result.stats.tables} ${plural$1(result.stats.tables, "table", "tables")} in ${result.stats.schemas} ${plural$1(result.stats.schemas, "schema", "schemas")}`)}`);
 	if (result.stats.tablesWithoutRls > 0) out.push(`  ${style.dim(`${result.stats.tablesWithoutRls} of ${result.stats.tables} ${plural$1(result.stats.tables, "table has", "tables have")} row-level security disabled`)}`);
 	out.push("");
-	const failing = exceedsThreshold(result.findings, options.failOn);
-	if (options.failOn === "none") out.push(`  ${style.dim("Exit code 0 — --fail-on none, so findings never fail the run.")}`);
-	else if (failing) out.push(`  ${style.bold("Exit code 1")} ${style.dim(`— at least one finding is "${options.failOn}" or worse (--fail-on ${options.failOn}).`)}`);
-	else out.push(`  ${style.bold("Exit code 0")} ${style.dim(`— nothing at or above "${options.failOn}" (--fail-on ${options.failOn}).`)}`);
+	const verdict = exitVerdict(result, options.failOn);
+	out.push(`  ${style.bold(`Exit code ${verdict.code}`)} ${style.dim(`— ${verdict.reason}`)}`);
 	out.push(`  ${style.dim(`Scanned ${result.scannedAt} · read-only, and nothing left this machine.`)}`);
 	out.push("");
 	out.push(style.dim("rls-check is free and maintained by the team behind Rebase — https://rebase.pro"));
@@ -3537,8 +4175,8 @@ function renderFindingGroups(findings, opts = {}) {
 	return out.join("");
 }
 function renderFooter(result, options) {
-	const failing = options.failOn !== "none" && result.findings.some((finding) => severityRank(finding.severity) >= severityRank(options.failOn));
-	return `<footer><p>${escapeHtml(options.failOn === "none" ? "Exit code 0 — --fail-on none, so findings never fail the run." : failing ? `Exit code 1 — at least one finding is "${options.failOn}" or worse (--fail-on ${options.failOn}).` : `Exit code 0 — nothing at or above "${options.failOn}" (--fail-on ${options.failOn}).`)}</p><p>${escapeHtml(`Scanned ${result.scannedAt} · read-only, and nothing left this machine. This file makes no network requests.`)}</p><p>rls-check is free and maintained by the team behind Rebase — <a href="https://rebase.pro">rebase.pro</a></p></footer>`;
+	const verdict = exitVerdict(result, options.failOn);
+	return `<footer><p>${escapeHtml(`Exit code ${verdict.code} — ${verdict.reason}`)}</p><p>${escapeHtml(`Scanned ${result.scannedAt} · read-only, and nothing left this machine. This file makes no network requests.`)}</p><p>rls-check is free and maintained by the team behind Rebase — <a href="https://rebase.pro">rebase.pro</a></p></footer>`;
 }
 /**
 * The whole report as one HTML document, ready to write to a file.
@@ -3610,12 +4248,6 @@ function renderHtml(result, options) {
 *    could have come from `pg`, Node or the user goes through `redactSecrets`
 *    on its way out.
 */
-/** Clean, or nothing at or above `--fail-on`. */
-var EXIT_OK = 0;
-/** Findings at or above `--fail-on`. */
-var EXIT_FINDINGS = 1;
-/** The scan did not happen: bad arguments, bad connection, timeout. */
-var EXIT_ERROR = 2;
 var DEFAULT_TIMEOUT_MS = 15e3;
 var DEFAULT_FAIL_ON = "high";
 var TABLE_KINDS = /* @__PURE__ */ new Set(["table", "partitioned_table"]);
@@ -3657,26 +4289,9 @@ function selectCheckIds(options) {
 	const only = options.only && options.only.length > 0 ? new Set(options.only) : null;
 	return CHECKS.filter((check) => (only === null || only.has(check.id)) && !skip.has(check.id)).map((check) => check.id);
 }
-/**
-* The verdict, as an exit code.
-*
-* Pulled out of `runCli` so it can be tested: `runCli` needs a database, and
-* the one line that decides whether CI goes red had no coverage at all —
-* deleting it broke no test.
-*
-* A degraded scan exits 2, the same code a crash uses, rather than 0. Checks
-* whose catalogue reads failed return no findings, which is indistinguishable
-* from finding none, so exiting 0 would have the scanner answer "no problems"
-* to a question it never managed to ask. Both codes mean the same thing here:
-* no verdict.
-*/
-function exitCodeFor(result, failOn) {
-	if (result.diagnostics.degraded.length > 0) return 2;
-	return exceedsThreshold(result.findings, failOn) ? 1 : 0;
-}
 function buildScanResult(snapshot, findings, meta) {
 	const target = parseConnectionString(meta.connectionString);
-	const tables = snapshot.relations.filter((relation) => TABLE_KINDS.has(relation.kind));
+	const tables = snapshot.relations.filter((relation) => TABLE_KINDS.has(relation.kind) && snapshot.schemas.includes(relation.schema));
 	return {
 		scannedAt: meta.scannedAt,
 		database: {
@@ -4188,6 +4803,13 @@ async function runCli(argv, io = defaultIo()) {
 				}, color));
 				return 2;
 			}
+			if (error instanceof UnknownSchemaError) {
+				io.stderr(formatFriendlyError({
+					headline: `No such schema on this database: ${error.schemas.join(", ")}.`,
+					hint: "Schema names are case-sensitive; check the spelling against `SELECT nspname FROM pg_namespace`. A --schema that matches nothing would scan nothing and report it as clean, so it is refused."
+				}, color));
+				return 2;
+			}
 			io.stderr(formatFriendlyError(explainError(error, {
 				endpoint,
 				timeoutMs: options.timeoutMs,