@rigour-labs/core 6.5.2 → 6.5.4

package/dist/gates/deprecated-dependencies.js

@@ -0,0 +1,104 @@
+/**
+ * Deprecated dependencies: a package.json dependency whose installed version
+ * npm marks deprecated.
+ *
+ * npm deprecates individual versions, so the check asks about the version
+ * actually installed (package-lock.json, else node_modules), never the latest;
+ * a dependency whose installed version cannot be known says nothing. The
+ * finding sits on the dependency's line in package.json, so review reports it
+ * when a change adds or moves a dependency onto a deprecated version.
+ *
+ * Opt-in and advisory: it sends package names and versions to the registry
+ * (as `npm install` does). Answers are cached for a day in .rigour/; a slow or
+ * unreachable registry means no findings, never a failed check.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { Gate } from './base.js';
+import { Logger } from '../utils/logger.js';
+const CACHE_FILE = path.join('.rigour', 'deprecated-dependencies.json');
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const TIMEOUT_MS = 3000;
+const CONCURRENCY = 8;
+const MAX_PACKAGES = 300;
+export class DeprecatedDependenciesGate extends Gate {
+    config;
+    fetchImpl;
+    constructor(config = {}, fetchImpl = fetch) {
+        super('deprecated-dependencies', 'Deprecated dependency');
+        this.config = config;
+        this.fetchImpl = fetchImpl;
+    }
+    async run(context) {
+        if (!this.config.enabled)
+            return [];
+        const manifestPath = path.join(context.cwd, 'package.json');
+        if (!(await fs.pathExists(manifestPath)))
+            return [];
+        const manifestText = await fs.readFile(manifestPath, 'utf8');
+        const manifest = JSON.parse(manifestText);
+        const names = Object.keys({ ...manifest.dependencies, ...manifest.devDependencies }).slice(0, MAX_PACKAGES);
+        const installed = await installedVersions(context.cwd, names);
+        const answers = await this.deprecations(context.cwd, installed);
+        return [...answers].flatMap(([name, message]) => [this.createFailure(`${name}@${installed.get(name)} is deprecated on npm: ${message}`, ['package.json'], `Move to the replacement the deprecation names, or a supported version of ${name}.`, undefined, lineOfDependency(manifestText, name), undefined, 'medium')]);
+    }
+    /** Deprecation messages for installed versions, from the day's cache and then the registry. */
+    async deprecations(cwd, installed) {
+        const cachePath = path.join(cwd, CACHE_FILE);
+        const cache = await fs.readJson(cachePath).catch(() => ({}));
+        const now = Date.now();
+        const stale = [...installed].filter(([name, version]) => !(cache[`${name}@${version}`]?.checkedAt > now - CACHE_TTL_MS));
+        let unreachable = 0;
+        for (let i = 0; i < stale.length; i += CONCURRENCY) {
+            await Promise.all(stale.slice(i, i + CONCURRENCY).map(async ([name, version]) => {
+                const deprecated = await this.lookup(name, version);
+                if (deprecated === undefined)
+                    unreachable++;
+                else
+                    cache[`${name}@${version}`] = { deprecated, checkedAt: now };
+            }));
+        }
+        if (unreachable)
+            Logger.info(`Deprecated dependencies: registry did not answer for ${unreachable} package(s); they are skipped this run.`);
+        await fs.outputJson(cachePath, cache, { spaces: 2 }).catch(() => undefined);
+        const found = new Map();
+        for (const [name, version] of installed) {
+            const message = cache[`${name}@${version}`]?.deprecated;
+            if (message)
+                found.set(name, message);
+        }
+        return found;
+    }
+    /** The version's deprecation message, null when it is not deprecated, undefined when the registry did not answer. */
+    async lookup(name, version) {
+        const registry = (this.config.registry ?? 'https://registry.npmjs.org').replace(/\/+$/, '');
+        try {
+            const response = await this.fetchImpl(`${registry}/${name.replace('/', '%2F')}/${encodeURIComponent(version)}`, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+            if (!response.ok)
+                return undefined;
+            const body = await response.json();
+            return typeof body?.deprecated === 'string' && body.deprecated.trim() ? body.deprecated.trim() : null;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+/** Installed versions from package-lock.json, else node_modules; names with neither are left out. */
+export async function installedVersions(cwd, names) {
+    const lock = await fs.readJson(path.join(cwd, 'package-lock.json')).catch(() => null);
+    const versions = new Map();
+    for (const name of names) {
+        const fromLock = lock?.packages?.[`node_modules/${name}`]?.version ?? lock?.dependencies?.[name]?.version;
+        const fromModules = fromLock ? undefined : (await fs.readJson(path.join(cwd, 'node_modules', name, 'package.json')).catch(() => null))?.version;
+        const version = fromLock ?? fromModules;
+        if (typeof version === 'string' && /^\d+\.\d+\.\d+/.test(version))
+            versions.set(name, version);
+    }
+    return versions;
+}
+/** The package.json line declaring a dependency, so review can tell whether the change touched it. */
+export function lineOfDependency(manifestText, name) {
+    const at = manifestText.split('\n').findIndex(line => line.trimStart().startsWith(`${JSON.stringify(name)}:`));
+    return at >= 0 ? at + 1 : undefined;
+}

package/dist/gates/deprecated-dependencies.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/deprecated-dependencies.test.js

@@ -0,0 +1,55 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { DeprecatedDependenciesGate, installedVersions, lineOfDependency } from './deprecated-dependencies.js';
+let cwd;
+beforeEach(() => {
+    cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'deprecated-deps-'));
+    fs.writeFileSync(path.join(cwd, 'package.json'), JSON.stringify({ dependencies: { request: '^2.88.0', 'left-pad': '^1.3.0' }, devDependencies: { '@scope/tool': '1.0.0' } }, null, 2));
+    fs.writeFileSync(path.join(cwd, 'package-lock.json'), JSON.stringify({ packages: {
+            'node_modules/request': { version: '2.88.2' },
+            'node_modules/@scope/tool': { version: '1.0.0' },
+        } }));
+});
+afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
+/** A registry answering per exact version, like registry.npmjs.org/<name>/<version>. */
+const registry = (deprecated) => vi.fn(async (url) => {
+    const [, name, version] = /registry\.test\/(.+)\/([^/]+)$/.exec(url);
+    return { ok: true, json: async () => ({ version, deprecated: deprecated[`${decodeURIComponent(name)}@${version}`] }) };
+});
+describe('DeprecatedDependenciesGate', () => {
+    it('reports the installed version npm deprecated, on its package.json line', async () => {
+        const fetch = registry({ 'request@2.88.2': 'request has been deprecated' });
+        const failures = await new DeprecatedDependenciesGate({ enabled: true, registry: 'https://registry.test' }, fetch).run({ cwd });
+        expect(failures).toEqual([expect.objectContaining({ id: 'deprecated-dependencies', files: ['package.json'], line: 3 })]);
+        expect(failures[0].details).toContain('request@2.88.2 is deprecated on npm: request has been deprecated');
+        expect(fetch.mock.calls.map(c => c[0])).toEqual(['https://registry.test/request/2.88.2', 'https://registry.test/@scope%2Ftool/1.0.0']);
+    });
+    it('asks once a day, and says nothing for a version it cannot determine or a registry that does not answer', async () => {
+        const fetch = registry({ 'request@2.88.2': 'deprecated' });
+        const gate = new DeprecatedDependenciesGate({ enabled: true, registry: 'https://registry.test' }, fetch);
+        await gate.run({ cwd });
+        await gate.run({ cwd });
+        expect(fetch).toHaveBeenCalledTimes(2); // left-pad has no installed version; the second run is cached
+        fs.rmSync(path.join(cwd, '.rigour'), { recursive: true });
+        const down = vi.fn(async () => { throw new Error('offline'); });
+        expect(await new DeprecatedDependenciesGate({ enabled: true }, down).run({ cwd })).toEqual([]);
+    });
+    it('is off unless enabled', async () => {
+        const fetch = registry({});
+        expect(await new DeprecatedDependenciesGate({}, fetch).run({ cwd })).toEqual([]);
+        expect(fetch).not.toHaveBeenCalled();
+    });
+});
+describe('helpers', () => {
+    it('reads installed versions from the lockfile, else node_modules', async () => {
+        fs.mkdirSync(path.join(cwd, 'node_modules', 'left-pad'), { recursive: true });
+        fs.writeFileSync(path.join(cwd, 'node_modules', 'left-pad', 'package.json'), JSON.stringify({ version: '1.3.0' }));
+        expect([...(await installedVersions(cwd, ['request', 'left-pad', 'missing']))]).toEqual([['request', '2.88.2'], ['left-pad', '1.3.0']]);
+    });
+    it('finds the line declaring a dependency', () => {
+        expect(lineOfDependency('{\n  "dependencies": {\n    "request": "^2"\n  }\n}', 'request')).toBe(3);
+        expect(lineOfDependency('{}', 'request')).toBeUndefined();
+    });
+});

package/dist/gates/runner.d.ts

@@ -1,5 +1,5 @@
 import { Gate } from './base.js';
-import { Config, Report, DeepOptions } from '../types/index.js';
+import { Failure, Config, Report, DeepOptions } from '../types/index.js';
 export declare class GateRunner {
     private config;
     private gates;
@@ -13,3 +13,9 @@ export declare class GateRunner {
         onProgress?: (msg: string) => void;
     }): Promise<Report>;
 }
+/**
+ * One finding per rule, file and line. The title names the rule: a learned rule shares its gate
+ * id with the built-in rules, and keying on the gate alone dropped it whenever a built-in rule
+ * fired on the same line.
+ */
+export declare function dedupeFailures(failures: Failure[]): Failure[];

package/dist/gates/runner.js

@@ -29,6 +29,8 @@ import { SideEffectAnalysisGate } from './side-effect-analysis/index.js';
 import { StyleDriftGate } from './style-drift.js';
 import { SemanticBugsGate } from './semantic-bugs.js';
 import { LogicDriftGate } from './logic-drift.js';
+import { UnindexedReadsGate } from './unindexed-reads/index.js';
+import { DeprecatedDependenciesGate } from './deprecated-dependencies.js';
 import { execa } from 'execa';
 import { Logger } from '../utils/logger.js';
 import { FileSystemCache } from '../services/filesystem-cache.js';
@@ -101,6 +103,12 @@ export class GateRunner {
         if (this.config.gates.phantom_apis?.enabled !== false) {
             this.gates.push(new PhantomApisGate(this.config.gates.phantom_apis));
         }
+        if (this.config.gates.deprecated_dependencies?.enabled) {
+            this.gates.push(new DeprecatedDependenciesGate(this.config.gates.deprecated_dependencies));
+        }
+        if (this.config.gates.unindexed_reads?.enabled) {
+            this.gates.push(new UnindexedReadsGate(this.config.gates.unindexed_reads));
+        }
         if (this.config.gates.deprecated_apis?.enabled !== false) {
             this.gates.push(new DeprecatedApisGate(this.config.gates.deprecated_apis));
         }
@@ -212,17 +220,8 @@ export class GateRunner {
         }
         const status = failures.length > 0 ? 'FAIL' : 'PASS';
         // Severity-weighted scoring with per-gate cap and deduplication
-        // Step 1: Deduplicate — same file + line + gate should not stack
-        const deduped = [];
-        const seen = new Set();
-        for (const f of failures) {
-            const key = `${f.id}:${(f.files || []).join(',')}:${f.line || 0}`;
-            if (!seen.has(key)) {
-                seen.add(key);
-                deduped.push(f);
-            }
-        }
-        // Replace failures array with deduplicated version
+        // Step 1: Deduplicate — the same rule on the same file and line should not stack
+        const deduped = dedupeFailures(failures);
         failures.length = 0;
         failures.push(...deduped);
         // Step 2: Calculate per-gate deductions with dynamic cap
@@ -340,3 +339,18 @@ export class GateRunner {
         return report;
     }
 }
+/**
+ * One finding per rule, file and line. The title names the rule: a learned rule shares its gate
+ * id with the built-in rules, and keying on the gate alone dropped it whenever a built-in rule
+ * fired on the same line.
+ */
+export function dedupeFailures(failures) {
+    const seen = new Set();
+    return failures.filter(f => {
+        const key = `${f.id}:${f.title}:${(f.files || []).join(',')}:${f.line || 0}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}

package/dist/gates/security-patterns-data.js

@@ -128,7 +128,8 @@ export const VULNERABILITY_PATTERNS = [
     // ReDoS — Denial of Service via regex (OWASP #7)
     {
         type: 'redos',
-        regex: /new RegExp\s*\([^)]*(?:req\.|params|query|body|input|user)/g,
+        // Request data, or a first argument that is exactly an input name; not any argument that merely contains "user" or "query".
+        regex: /new RegExp\s*\(\s*(?:[^)]*\b(?:req|request)\.(?:query|params|body)\b|(?:userInput|input|searchTerm|search|query|term|keyword|pattern)\s*[,)])/g,
         severity: 'high',
         description: 'Dynamic regex from user input — potential ReDoS',
         cwe: 'CWE-1333',

package/dist/gates/security-patterns-owasp.test.js

@@ -25,6 +25,21 @@ describe('SecurityPatternsGate — OWASP extended patterns', () => {
             const vulns = await checkSecurityPatterns(filePath);
             expect(vulns.some(v => v.type === 'redos')).toBe(true);
         });
+        it('detects request data and input-named arguments, not constants that contain those words', async () => {
+            const tainted = path.join(testDir, 'tainted.ts');
+            fs.writeFileSync(tainted, `
+                const a = new RegExp(\`^\${req.body.term}$\`);
+                const b = new RegExp(input, 'i');
+            `);
+            expect((await checkSecurityPatterns(tainted)).filter(v => v.type === 'redos')).toHaveLength(2);
+            const constant = path.join(testDir, 'constant.ts');
+            fs.writeFileSync(constant, `
+                const user = String.raw\`auth\\.uid\\(\\)\`;
+                const left = new RegExp(String.raw\`^\${user} ?= ?(\${NAME})$\`, 'i');
+                const byQuery = new RegExp(queryPrefix + '$');
+            `);
+            expect((await checkSecurityPatterns(constant)).filter(v => v.type === 'redos')).toEqual([]);
+        });
         it('should detect nested quantifiers', async () => {
             const filePath = path.join(testDir, 'regex.ts');
             fs.writeFileSync(filePath, `

package/dist/gates/semantic-bugs.js

@@ -42,7 +42,7 @@ export class SemanticBugsGate extends Gate {
         return wanted?.length ? [...ALL_RULES, ...learned].filter(rule => wanted.includes(rule.id)) : [...BUILT_IN_RULES, ...learned];
     }
     toFailure(finding) {
-        const failure = this.createFailure(`${finding.message}\n${finding.evidence.map(e => `  at ${e}`).join('\n')}`, [finding.file], finding.hint, `[${finding.rule}] ${finding.message.split('. ')[0]}`.slice(0, 120), finding.line, undefined, finding.severity);
+        const failure = this.createFailure(`${finding.message}\n${finding.evidence.map(e => `  at ${e}`).join('\n')}`, [finding.file], finding.hint, `[${finding.rule}] ${finding.message.split('. ')[0]}`.slice(0, 120), finding.line, finding.endLine, finding.severity);
         const category = finding.rule.startsWith(LEARNED_PREFIX) ? 'learned-rule' : finding.rule;
         return { ...failure, provenance: finding.provenance, source: 'ast', category, verified: true, confidence: 1 };
     }

package/dist/gates/trusted-reviews.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/trusted-reviews.test.js

@@ -0,0 +1,16 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { trustedReviews } from './deep-analysis.js';
+let cwd;
+afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
+describe('trustedReviews', () => {
+    it('lets a normal run skip what agents recorded as reviewed, and an independent run skip nothing', () => {
+        cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'trusted-reviews-'));
+        fs.mkdirSync(path.join(cwd, '.rigour'));
+        fs.writeFileSync(path.join(cwd, '.rigour', 'reviewed.json'), JSON.stringify({ version: 1, entries: [{ file: 'src/a.ts', function: 'f', hash: 'h', reviewer: 'agent', verdict: 'no_issue' }] }));
+        expect(trustedReviews(cwd, {}).map(r => r.function)).toEqual(['f']);
+        expect(trustedReviews(cwd, { independent: true })).toEqual([]);
+    });
+});

package/dist/gates/unindexed-reads/coverage.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Whether any index on a table can serve a read.
+ *
+ * The claim is deliberately narrow, so it can be proved from the schema
+ * alone: no index starts with a column the read compares to a value or sorts
+ * by first, or every index that does is partial with a WHERE the read's
+ * filters do not satisfy. `IS NOT NULL` alone is not a comparison: it narrows
+ * nothing on a mostly filled column. When a predicate cannot be read, the
+ * index counts as serving, so doubt keeps the gate silent.
+ */
+import type { IndexDef } from './schema.js';
+import type { Read } from './queries.js';
+/** Columns the read narrows by value or orders by first (lower case). */
+export declare function seekColumns(read: Read): Set<string>;
+export declare function servesRead(index: IndexDef, read: Read): boolean;

package/dist/gates/unindexed-reads/coverage.js

@@ -0,0 +1,24 @@
+/** Columns the read narrows by value or orders by first (lower case). */
+export function seekColumns(read) {
+    const columns = new Set(read.filters.filter(f => f.op !== 'notnull').map(f => f.column.toLowerCase()));
+    if (read.orderBy)
+        columns.add(read.orderBy.toLowerCase());
+    return columns;
+}
+export function servesRead(index, read) {
+    if (index.leading === null || !seekColumns(read).has(index.leading.toLowerCase()))
+        return false;
+    return index.predicate.every(term => satisfied(term, read.filters));
+}
+/** Whether the read's filters satisfy one partial-index term; an unreadable term is assumed satisfied. */
+function satisfied(term, filters) {
+    if (term.kind === 'unknown')
+        return true;
+    const own = filters.filter(f => f.column.toLowerCase() === term.column.toLowerCase());
+    if (term.kind === 'null')
+        return own.some(f => f.op === 'isnull');
+    // Every operator but IS NULL is strict: a row it matches has a value, so it implies IS NOT NULL.
+    if (term.kind === 'notnull')
+        return own.some(f => f.op !== 'isnull');
+    return own.some(f => f.op === 'eq' && (f.value === undefined || f.value === term.value)) || own.some(f => f.op === 'in' || f.op === 'match');
+}

package/dist/gates/unindexed-reads/index.d.ts

@@ -0,0 +1,20 @@
+import { Gate, type GateContext } from '../base.js';
+import type { Failure } from '../../types/index.js';
+import { type Schema } from './schema.js';
+import { type Read } from './queries.js';
+export interface UnindexedReadsConfig {
+    enabled?: boolean;
+    /** Globs for migration .sql files; each directory is replayed as its own database. */
+    migrations?: string[];
+}
+export declare class UnindexedReadsGate extends Gate {
+    private config;
+    constructor(config?: UnindexedReadsConfig);
+    run(context: GateContext): Promise<Failure[]>;
+    private finding;
+}
+/**
+ * The columns the read narrows by (its own and the table's policy filters) when
+ * no migration set can serve it; undefined when one can, or when that is not provable.
+ */
+export declare function unservedColumns(read: Read, schemas: Schema[]): string[] | undefined;

package/dist/gates/unindexed-reads/index.js

@@ -0,0 +1,98 @@
+/**
+ * Unindexed read: a supabase-js read whose table, as the repository's own
+ * migrations define it, has no index that can serve it (coverage.ts).
+ *
+ * Advisory and off by default. It speaks only when the claim is provable:
+ * the read is fully literal, its table is created in the migrations, and no
+ * DDL touching that table is beyond what schema.ts models. A small table
+ * read without an index is fine; dismiss the finding for it.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { Gate } from '../base.js';
+import { FileScanner } from '../../utils/scanner.js';
+import { Logger } from '../../utils/logger.js';
+import { policyFilters, replayMigrations } from './schema.js';
+import { findReads } from './queries.js';
+import { seekColumns, servesRead } from './coverage.js';
+const DEFAULT_MIGRATIONS = ['**/migrations/**/*.sql'];
+const SOURCE = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
+const SKIP = ['**/node_modules/**', '**/dist/**', '**/build/**', '**/*.test.*', '**/*.spec.*', '**/__tests__/**', '**/*.d.ts'];
+export class UnindexedReadsGate extends Gate {
+    config;
+    constructor(config = {}) {
+        super('unindexed-reads', 'Unindexed read');
+        this.config = config;
+    }
+    async run(context) {
+        if (!this.config.enabled)
+            return [];
+        const schemas = await loadSchemas(context.cwd, this.config.migrations?.length ? this.config.migrations : DEFAULT_MIGRATIONS, context.ignore ?? []);
+        if (schemas.length === 0)
+            return [];
+        const files = (await FileScanner.findFiles({ cwd: context.cwd, patterns: context.patterns, ignore: [...(context.ignore ?? []), ...SKIP] }))
+            .filter(file => SOURCE.test(file));
+        Logger.info(`Unindexed reads: ${files.length} files against ${schemas.length} migration set(s)`);
+        const failures = [];
+        for (const file of files) {
+            const content = await fs.readFile(path.join(context.cwd, file), 'utf-8');
+            if (!content.includes('.from('))
+                continue;
+            for (const read of findReads(file, content)) {
+                const columns = unservedColumns(read, schemas);
+                if (columns)
+                    failures.push(this.finding(file, read, columns));
+            }
+        }
+        return failures;
+    }
+    finding(file, read, columns) {
+        const list = columns.map(c => `\`${c}\``).join(', ');
+        return this.createFailure(`No index on \`${read.table}\` starts with a column this read compares to a value or sorts by first, including any its row-level policy adds (${list}), and none of its partial indexes match the read's filters, so Postgres cannot seek to these rows.`, [file], `Add an index in a new migration that leads with the most selective of ${list}, in the read's sort order. If the table stays small, dismiss this finding.`, undefined, read.line, undefined, 'medium');
+    }
+}
+/**
+ * The columns the read narrows by (its own and the table's policy filters) when
+ * no migration set can serve it; undefined when one can, or when that is not provable.
+ */
+export function unservedColumns(read, schemas) {
+    if (read.uncertain || seekColumns(read).size === 0)
+        return undefined;
+    const tables = schemas.map(schema => schema.get(read.table)).filter(table => table !== undefined);
+    if (tables.length === 0 || tables.some(table => table.uncertain || policyFilters(table).unknown))
+        return undefined;
+    const columns = new Set();
+    for (const table of tables) {
+        const filtered = withPolicyFilters(read, policyFilters(table).columns);
+        if (table.indexes.some(index => servesRead(index, filtered)))
+            return undefined;
+        for (const column of seekColumns(filtered))
+            columns.add(column);
+    }
+    return [...columns];
+}
+/** The read as Postgres runs it for a signed-in user: the policy's columns are compared too. */
+function withPolicyFilters(read, columns) {
+    return { ...read, filters: [...read.filters, ...columns.map(column => ({ column, op: 'eq', value: undefined }))] };
+}
+/** One schema per migrations directory, replayed in filename order. */
+async function loadSchemas(cwd, globs, ignore) {
+    const files = await FileScanner.findFiles({ cwd, patterns: globs, ignore });
+    const byDirectory = new Map();
+    for (const file of files) {
+        const directory = migrationsRoot(file);
+        byDirectory.set(directory, [...(byDirectory.get(directory) ?? []), file]);
+    }
+    const schemas = [];
+    for (const group of byDirectory.values()) {
+        const sql = await Promise.all(group.sort().map(file => fs.readFile(path.join(cwd, file), 'utf-8')));
+        schemas.push(replayMigrations(sql));
+    }
+    return schemas;
+}
+/** The directory a migration belongs to: up to and including its `migrations` segment, else its own folder. */
+function migrationsRoot(file) {
+    const parts = file.split('/');
+    const at = parts.lastIndexOf('migrations');
+    return at >= 0 ? parts.slice(0, at + 1).join('/') : path.posix.dirname(file);
+}

package/dist/gates/unindexed-reads/queries.d.ts

@@ -0,0 +1,17 @@
+export type Filter = {
+    column: string;
+    op: 'eq';
+    value: string | undefined;
+} | {
+    column: string;
+    op: 'in' | 'range' | 'isnull' | 'notnull' | 'match';
+};
+export interface Read {
+    table: string;
+    line: number;
+    filters: Filter[];
+    /** First `.order()` column: the only one an index can return rows in. */
+    orderBy?: string;
+    uncertain: boolean;
+}
+export declare function findReads(fileName: string, content: string): Read[];

package/dist/gates/unindexed-reads/queries.js

@@ -0,0 +1,147 @@
+/**
+ * supabase-js reads in a TypeScript or JavaScript file: `.from('table')`
+ * followed by `.select(…)` and filters, as one call chain.
+ *
+ * A read is only modelled when every part of it is literal: the table, the
+ * filter columns, and the methods. Anything else (a computed table name,
+ * `.or(…)`, a filter on an embedded resource, a method this does not know)
+ * makes the read `uncertain`, and the gate says nothing about it.
+ */
+import ts from 'typescript';
+const RANGE = new Set(['gt', 'gte', 'lt', 'lte', 'like', 'ilike', 'likeAllOf', 'likeAnyOf', 'ilikeAllOf', 'ilikeAnyOf']);
+/** Operators a GIN or GiST index could serve: they keep the read silent rather than prove anything. */
+const MATCH = new Set(['contains', 'containedBy', 'overlaps', 'textSearch', 'rangeGt', 'rangeGte', 'rangeLt', 'rangeLte', 'rangeAdjacent']);
+const NEUTRAL = new Set(['select', 'limit', 'range', 'single', 'maybeSingle', 'returns', 'abortSignal', 'csv', 'geojson', 'explain', 'throwOnError', 'setHeader', 'then', 'neq', 'overrideTypes']);
+const WRITES = new Set(['insert', 'update', 'upsert', 'delete']);
+export function findReads(fileName, content) {
+    const source = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+    const reads = [];
+    const visit = (node) => {
+        const read = readAt(source, node);
+        if (read)
+            reads.push(read);
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return reads;
+}
+/** A read rooted at this `.from(…)` call, or undefined when the node is not one. */
+function readAt(source, node) {
+    if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression) || node.expression.name.text !== 'from')
+        return undefined;
+    const tableArg = node.arguments[0];
+    const schema = schemaOf(node.expression.expression);
+    const chain = callsAfter(node);
+    if (!chain.some(call => call.method === 'select') || chain.some(call => WRITES.has(call.method)))
+        return undefined;
+    const line = source.getLineAndCharacterOfPosition(node.expression.name.getStart(source)).line + 1;
+    const literalTable = tableArg && ts.isStringLiteralLike(tableArg) ? tableArg.text : undefined;
+    const read = { table: literalTable ? qualified(schema, literalTable) : '', line, filters: [], uncertain: !literalTable || schema === null };
+    for (const call of chain)
+        applyCall(read, call);
+    return read;
+}
+/** Calls chained onto `node`: `.from(…).select(…).eq(…)` gives select, eq. */
+function callsAfter(node) {
+    const calls = [];
+    let current = node;
+    while (ts.isPropertyAccessExpression(current.parent) && ts.isCallExpression(current.parent.parent) && current.parent.parent.expression === current.parent) {
+        calls.push({ method: current.parent.name.text, args: current.parent.parent.arguments });
+        current = current.parent.parent;
+    }
+    return calls;
+}
+/** `client.schema('s').from(…)`: the schema name; undefined for the default; null when it is not a literal. */
+function schemaOf(target) {
+    if (!ts.isCallExpression(target) || !ts.isPropertyAccessExpression(target.expression) || target.expression.name.text !== 'schema')
+        return undefined;
+    const arg = target.arguments[0];
+    return arg && ts.isStringLiteralLike(arg) ? arg.text : null;
+}
+function qualified(schema, table) {
+    const name = table.toLowerCase();
+    return schema && schema !== 'public' ? `${schema.toLowerCase()}.${name}` : name;
+}
+function applyCall(read, call) {
+    const { method, args } = call;
+    if (NEUTRAL.has(method))
+        return;
+    if (method === 'order') {
+        if (read.orderBy === undefined)
+            read.orderBy = columnOf(read, args[0]);
+        return;
+    }
+    if (method === 'match')
+        return applyMatch(read, args[0]);
+    if (method === 'not')
+        return applyNot(read, args);
+    if (method === 'filter')
+        return applyFilter(read, args);
+    const column = columnOf(read, args[0]);
+    if (column === undefined)
+        return;
+    if (method === 'eq')
+        read.filters.push({ column, op: 'eq', value: literal(args[1]) });
+    else if (method === 'in')
+        read.filters.push({ column, op: 'in' });
+    else if (method === 'is')
+        read.filters.push(args[1]?.kind === ts.SyntaxKind.NullKeyword ? { column, op: 'isnull' } : { column, op: 'eq', value: literal(args[1]) });
+    else if (RANGE.has(method))
+        read.filters.push({ column, op: 'range' });
+    else if (MATCH.has(method))
+        read.filters.push({ column, op: 'match' });
+    else
+        read.uncertain = true;
+}
+/** `.not('col', 'is', null)` is IS NOT NULL; any other negation filters nothing an index can seek. */
+function applyNot(read, args) {
+    const column = columnOf(read, args[0]);
+    const op = args[1] && ts.isStringLiteralLike(args[1]) ? args[1].text : undefined;
+    if (column !== undefined && op === 'is' && args[2]?.kind === ts.SyntaxKind.NullKeyword)
+        read.filters.push({ column, op: 'notnull' });
+    else if (op === undefined)
+        read.uncertain = true;
+}
+/** `.filter('col', 'eq', v)`: the same as the named method when the operator is a literal. */
+function applyFilter(read, args) {
+    const op = args[1] && ts.isStringLiteralLike(args[1]) ? args[1].text : undefined;
+    if (op === undefined || !['eq', 'in', 'is', 'gt', 'gte', 'lt', 'lte', 'like', 'ilike'].includes(op)) {
+        read.uncertain = true;
+        return;
+    }
+    applyCall(read, { method: op, args: [args[0], args[2]] });
+}
+/** `.match({ a: 1, b: 'x' })`: equality on each key of an object literal. */
+function applyMatch(read, arg) {
+    if (!arg || !ts.isObjectLiteralExpression(arg)) {
+        read.uncertain = true;
+        return;
+    }
+    for (const property of arg.properties) {
+        const name = ts.isPropertyAssignment(property) && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : undefined;
+        if (name === undefined || name.includes('.'))
+            read.uncertain = true;
+        else
+            read.filters.push({ column: name.toLowerCase(), op: 'eq', value: literal(property.initializer) });
+    }
+}
+/** A literal column on the read's own table; a computed or embedded (`other.col`) column makes the read uncertain. */
+function columnOf(read, arg) {
+    if (!arg || !ts.isStringLiteralLike(arg) || arg.text.includes('.') || arg.text.includes('->')) {
+        read.uncertain = true;
+        return undefined;
+    }
+    return arg.text.toLowerCase();
+}
+/** A literal value as text, or undefined when it is computed at run time. */
+function literal(arg) {
+    if (!arg)
+        return undefined;
+    if (ts.isStringLiteralLike(arg) || ts.isNumericLiteral(arg))
+        return arg.text;
+    if (arg.kind === ts.SyntaxKind.TrueKeyword)
+        return 'true';
+    if (arg.kind === ts.SyntaxKind.FalseKeyword)
+        return 'false';
+    return undefined;
+}

package/dist/gates/unindexed-reads/queries.test.d.ts

@@ -0,0 +1 @@
+export {};