@rigour-labs/core 6.5.2 → 6.5.4

package/dist/gates/unindexed-reads/queries.test.js

@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest';
+import { findReads } from './queries.js';
+const reads = (code) => findReads('a.ts', code);
+describe('findReads', () => {
+    it('models a literal supabase-js read: filters, first order column, line', () => {
+        const [read] = reads(`
+const page = await supabase
+  .from('orders')
+  .select('id, placed_at')
+  .eq('status', 'open')
+  .not('customer_id', 'is', null)
+  .gt('placed_at', since)
+  .lte('placed_at', until)
+  .order('placed_at')
+  .order('id')
+  .limit(100);`);
+        expect(read).toEqual({
+            table: 'orders', line: 3, uncertain: false, orderBy: 'placed_at',
+            filters: [
+                { column: 'status', op: 'eq', value: 'open' },
+                { column: 'customer_id', op: 'notnull' },
+                { column: 'placed_at', op: 'range' },
+                { column: 'placed_at', op: 'range' },
+            ],
+        });
+    });
+    it('reads .in, .is(null), .match and .filter, and qualifies a non-public schema', () => {
+        const [read] = reads(`db.schema('billing').from('invoices').select('*').in('id', ids).is('paid_at', null).match({ kind: 'card' }).filter('total', 'gte', 10);`);
+        expect(read.table).toBe('billing.invoices');
+        expect(read.filters).toEqual([
+            { column: 'id', op: 'in' },
+            { column: 'paid_at', op: 'isnull' },
+            { column: 'kind', op: 'eq', value: 'card' },
+            { column: 'total', op: 'range' },
+        ]);
+        expect(read.uncertain).toBe(false);
+    });
+    it('is uncertain when anything is computed, OR-ed, embedded or unknown', () => {
+        const uncertain = [
+            `db.from(table).select('*').eq('a', 1);`,
+            `db.from('t').select('*').eq(column, 1);`,
+            `db.from('t').select('*').or('a.eq.1,b.eq.2');`,
+            `db.from('t').select('*, u!inner(*)').eq('u.id', 1);`,
+            `db.from('t').select('*').someNewFilter('a', 1);`,
+            `db.schema(name).from('t').select('*').eq('a', 1);`,
+        ];
+        expect(uncertain.map(code => reads(code)[0].uncertain)).toEqual(uncertain.map(() => true));
+    });
+    it('ignores writes and calls that are not reads', () => {
+        expect(reads(`db.from('t').insert({ a: 1 }).select();`)).toEqual([]);
+        expect(reads(`db.from('t').update({ a: 1 }).eq('id', 1);`)).toEqual([]);
+        expect(reads(`Array.from(items).filter(Boolean);`)).toEqual([]);
+    });
+});

package/dist/gates/unindexed-reads/schema.d.ts

@@ -0,0 +1,38 @@
+/** One term of a partial index's WHERE, or `unknown` when it is not a plain comparison. */
+export type PredicateTerm = {
+    kind: 'eq';
+    column: string;
+    value: string;
+} | {
+    kind: 'notnull';
+    column: string;
+} | {
+    kind: 'null';
+    column: string;
+} | {
+    kind: 'unknown';
+};
+export interface IndexDef {
+    name?: string;
+    /** Leading key column, or null when the key starts with an expression. */
+    leading: string | null;
+    predicate: PredicateTerm[];
+}
+export interface TableSchema {
+    indexes: IndexDef[];
+    /** Policy name → columns its USING clause compares to the user, or null when the expression is not one this reads. */
+    policies: Map<string, string[] | null>;
+    uncertain: boolean;
+}
+/** Columns every policy-filtered read of the table also compares, and whether some policy could not be read. */
+export declare function policyFilters(table: TableSchema): {
+    columns: string[];
+    unknown: boolean;
+};
+export type Schema = Map<string, TableSchema>;
+/** Replay migration files (already in apply order) into a schema. */
+export declare function replayMigrations(sqlFiles: string[]): Schema;
+/** A conjunction of plain comparisons; anything else is `unknown`, which the gate treats as possibly serving. */
+export declare function parsePredicate(text: string): PredicateTerm[];
+/** Columns a policy compares to the current user (`auth.uid() = col`, `col = (select auth.uid())`); `true` gives none; anything else, null. */
+export declare function policyColumns(expression: string): string[] | null;

package/dist/gates/unindexed-reads/schema.js

@@ -0,0 +1,256 @@
+/**
+ * Replay Postgres migrations, in order, into the tables they create and the
+ * indexes each table ends up with (primary keys and unique constraints count:
+ * Postgres backs them with an index).
+ *
+ * A table touched by DDL this cannot model is marked uncertain, and the gate
+ * says nothing about it: a rename, `LIKE … INCLUDING`, inheritance or
+ * partitioning, an index statement it cannot parse, or index DDL inside a
+ * function or DO body.
+ *
+ * Row-level security policies are filters a read does not show: a SELECT or
+ * ALL policy `auth.uid() = owner_id` makes every user read filter on
+ * `owner_id`. Policies made of such comparisons (or `true`) are kept per
+ * table; any other policy expression makes the table uncertain.
+ */
+import { NAME, identifier, parenthesized, relationName, splitStatements, splitTopLevel, unwrap } from './sql.js';
+/** Columns every policy-filtered read of the table also compares, and whether some policy could not be read. */
+export function policyFilters(table) {
+    const all = [...table.policies.values()];
+    return { columns: [...new Set(all.flatMap(columns => columns ?? []))], unknown: all.some(columns => columns === null) };
+}
+/** Replay migration files (already in apply order) into a schema. */
+export function replayMigrations(sqlFiles) {
+    const schema = new Map();
+    for (const sql of sqlFiles) {
+        for (const statement of splitStatements(sql))
+            applyStatement(schema, statement);
+    }
+    return schema;
+}
+function applyStatement(schema, statement) {
+    const head = statement.slice(0, 40).toLowerCase();
+    if (head.startsWith('create table') || head.startsWith('create unlogged table'))
+        createTable(schema, statement);
+    else if (/^create (unique )?index/.test(head))
+        createIndex(schema, statement);
+    else if (head.startsWith('drop index'))
+        dropIndexes(schema, statement);
+    else if (head.startsWith('drop table'))
+        dropTables(schema, statement);
+    else if (head.startsWith('alter table'))
+        alterTable(schema, statement);
+    else if (head.startsWith('alter index'))
+        renameIndex(schema, statement);
+    else if (head.startsWith('create policy'))
+        createPolicy(schema, statement);
+    else if (head.startsWith('drop policy'))
+        dropPolicy(schema, statement);
+    else if (head.startsWith('alter policy'))
+        markUncertain(schema, policyTable(statement));
+    else if (/^(do |create (or replace )?(function|procedure))/.test(head))
+        markDynamicDdl(schema, statement);
+}
+function createTable(schema, statement) {
+    const match = new RegExp(String.raw `^create (?:unlogged )?table (?:if not exists )?(${NAME})\s*`, 'i').exec(statement);
+    if (!match)
+        return;
+    const name = relationName(match[1]);
+    if (/if not exists/i.test(statement.slice(0, match[0].length)) && schema.has(name))
+        return;
+    const body = parenthesized(statement, match[0].length);
+    const table = { indexes: [], policies: new Map(), uncertain: false };
+    schema.set(name, table);
+    if (!body || statement[match[0].length] !== '(' || /\b(inherits|partition)\b/i.test(statement.slice(body.end))) {
+        table.uncertain = true;
+        return;
+    }
+    for (const element of splitTopLevel(body.inner, /,/))
+        addTableElement(table, element);
+}
+/** A column definition (`id uuid PRIMARY KEY`) or a table constraint (`UNIQUE (a, b)`). */
+function addTableElement(table, element) {
+    if (/^like\s/i.test(element)) {
+        table.uncertain = true;
+        return;
+    }
+    const constraint = /^(?:constraint \S+ )?(primary key|unique)(?: nulls (?:not )?distinct)? \(([^)]*)\)/i.exec(element);
+    if (constraint) {
+        table.indexes.push({ leading: identifier(constraint[2].split(',')[0]), predicate: [] });
+        return;
+    }
+    if (/^(constraint|check|foreign key|exclude)\b/i.test(element))
+        return;
+    const column = new RegExp(String.raw `^(${NAME})\s`, 'i').exec(element);
+    if (column && /\b(primary key|unique)\b/i.test(element))
+        table.indexes.push({ leading: identifier(column[1]), predicate: [] });
+}
+function createIndex(schema, statement) {
+    const match = new RegExp(String.raw `^create (?:unique )?index (?:concurrently )?(?:if not exists )?(${NAME} )?on (?:only )?(${NAME})(?: using \w+)?\s*\(`, 'i').exec(statement);
+    const onTable = new RegExp(String.raw `\bon (?:only )?(${NAME})`, 'i').exec(statement);
+    if (!match) {
+        markUncertain(schema, onTable ? relationName(onTable[1]) : undefined);
+        return;
+    }
+    const table = schema.get(relationName(match[2]));
+    const keys = parenthesized(statement, match[0].length - 1);
+    if (!table)
+        return;
+    if (!keys) {
+        table.uncertain = true;
+        return;
+    }
+    const name = match[1] ? identifier(match[1].trim().split('.').pop()) : undefined;
+    if (name && /if not exists/i.test(statement) && findIndex(schema, name))
+        return;
+    const where = /^\s*(?:include \([^)]*\)\s*)?(?:with \([^)]*\)\s*)?(?:tablespace \S+\s*)?where (.*)$/i.exec(statement.slice(keys.end));
+    table.indexes.push({ name, leading: leadingColumn(keys.inner), predicate: where ? parsePredicate(where[1]) : [] });
+}
+/** The first key column, or null when the key starts with an expression such as `lower(email)`. */
+function leadingColumn(keys) {
+    const first = splitTopLevel(keys, /,/)[0] ?? '';
+    const column = new RegExp(String.raw `^(${NAME})(?:\s+(?:asc|desc|nulls (?:first|last)|collate \S+|\w+_ops))*$`, 'i').exec(first);
+    return column ? identifier(column[1]) : null;
+}
+/** A conjunction of plain comparisons; anything else is `unknown`, which the gate treats as possibly serving. */
+export function parsePredicate(text) {
+    const cleaned = unwrap(text);
+    if (/\bor\b/i.test(cleaned))
+        return [{ kind: 'unknown' }];
+    return splitTopLevel(cleaned, /\s+and\s+/i).map(term => {
+        const bare = unwrap(term);
+        const notNull = new RegExp(String.raw `^(${NAME}) is not null$`, 'i').exec(bare);
+        if (notNull)
+            return { kind: 'notnull', column: identifier(notNull[1]) };
+        const isNull = new RegExp(String.raw `^(${NAME}) is null$`, 'i').exec(bare);
+        if (isNull)
+            return { kind: 'null', column: identifier(isNull[1]) };
+        const eq = new RegExp(String.raw `^(${NAME}) = '((?:[^']|'')*)'(?:::\w+)?$`, 'i').exec(bare);
+        if (eq)
+            return { kind: 'eq', column: identifier(eq[1]), value: eq[2].replace(/''/g, "'") };
+        return { kind: 'unknown' };
+    });
+}
+function dropIndexes(schema, statement) {
+    const names = statement.replace(/^drop index (?:concurrently )?(?:if exists )?/i, '').replace(/\s+(cascade|restrict)$/i, '');
+    for (const raw of names.split(',')) {
+        const name = identifier(raw.trim().split('.').pop());
+        for (const table of schema.values())
+            table.indexes = table.indexes.filter(index => index.name !== name);
+    }
+}
+function dropTables(schema, statement) {
+    const names = statement.replace(/^drop table (?:if exists )?/i, '').replace(/\s+(cascade|restrict)$/i, '');
+    for (const raw of names.split(','))
+        schema.delete(relationName(raw.trim()));
+}
+function alterTable(schema, statement) {
+    const match = new RegExp(String.raw `^alter table (?:if exists )?(?:only )?(${NAME}) (.*)$`, 'i').exec(statement);
+    if (!match)
+        return;
+    const name = relationName(match[1]);
+    const table = schema.get(name);
+    if (!table)
+        return;
+    const rename = new RegExp(String.raw `^rename to (${NAME})$`, 'i').exec(match[2]);
+    if (rename) {
+        schema.delete(name);
+        schema.set(relationName(rename[1]), table);
+        return;
+    }
+    for (const action of splitTopLevel(match[2], /,/))
+        alterAction(table, action);
+}
+function alterAction(table, action) {
+    if (/^rename\b/i.test(action)) {
+        table.uncertain = true;
+        return;
+    }
+    const constraint = /^add (?:constraint \S+ )?(primary key|unique)(?: nulls (?:not )?distinct)?\s*(?:\(([^)]*)\)|using index (\S+))/i.exec(action);
+    if (constraint) {
+        if (constraint[2])
+            table.indexes.push({ leading: identifier(constraint[2].split(',')[0]), predicate: [] });
+        return;
+    }
+    const column = new RegExp(String.raw `^add (?:column )?(?:if not exists )?(${NAME})\s`, 'i').exec(action);
+    if (column && /\b(primary key|unique)\b/i.test(action))
+        table.indexes.push({ leading: identifier(column[1]), predicate: [] });
+}
+function renameIndex(schema, statement) {
+    const match = new RegExp(String.raw `^alter index (?:if exists )?(${NAME}) rename to (${NAME})$`, 'i').exec(statement);
+    if (!match)
+        return;
+    const index = findIndex(schema, identifier(match[1].split('.').pop()));
+    if (index)
+        index.name = identifier(match[2].split('.').pop());
+}
+/** Index or constraint DDL inside a function or DO body runs later, maybe dynamically: the tables it names are unknown. */
+function markDynamicDdl(schema, statement) {
+    const ddl = new RegExp(String.raw `(?:create (?:unique )?index[^;]*? on (?:only )?|alter table (?:if exists )?(?:only )?)(${NAME})`, 'gi');
+    let named = false;
+    for (const match of statement.matchAll(ddl)) {
+        named = true;
+        markUncertain(schema, relationName(match[1]));
+    }
+    if (!named && /\bexecute\b/i.test(statement) && /\b(index|constraint|primary key|unique)\b/i.test(statement))
+        markUncertain(schema, undefined);
+}
+/** One table, or every table when the target cannot be named. */
+function markUncertain(schema, name) {
+    if (name === undefined)
+        for (const table of schema.values())
+            table.uncertain = true;
+    else {
+        const table = schema.get(name);
+        if (table)
+            table.uncertain = true;
+    }
+}
+function createPolicy(schema, statement) {
+    const match = new RegExp(String.raw `^create policy (${NAME}) on (${NAME})(.*)$`, 'i').exec(statement);
+    const table = match ? schema.get(relationName(match[2])) : undefined;
+    if (!match || !table)
+        return;
+    const command = /\bfor (all|select|insert|update|delete)\b/i.exec(match[3])?.[1].toLowerCase() ?? 'all';
+    if (command !== 'all' && command !== 'select')
+        return;
+    const using = /\busing\s*\(/i.exec(match[3]);
+    const body = using ? parenthesized(match[3], using.index + using[0].length - 1) : undefined;
+    table.policies.set(identifier(match[1]), using && body ? policyColumns(body.inner) : null);
+}
+/** Columns a policy compares to the current user (`auth.uid() = col`, `col = (select auth.uid())`); `true` gives none; anything else, null. */
+export function policyColumns(expression) {
+    const bare = unwrap(expression);
+    if (/^true$/i.test(bare))
+        return [];
+    // splitStatements leaves single spaces, so ` ?` is enough and nothing can backtrack.
+    const uidPattern = String.raw `\(? ?(?:select )?auth\.uid\(\) ?\)?(?:::\w+)?`;
+    const columns = [];
+    for (const term of splitTopLevel(bare, /\s+(?:and|or)\s+/i)) {
+        const inner = unwrap(term);
+        const left = new RegExp(String.raw `^${uidPattern} ?= ?(${NAME})(?:::\w+)?$`, 'i').exec(inner);
+        const right = new RegExp(String.raw `^(${NAME})(?:::\w+)? ?= ?${uidPattern}$`, 'i').exec(inner);
+        const column = left?.[1] ?? right?.[1];
+        if (!column)
+            return null;
+        columns.push(identifier(column.split('.').pop()));
+    }
+    return columns;
+}
+function dropPolicy(schema, statement) {
+    const match = new RegExp(String.raw `^drop policy (?:if exists )?(${NAME}) on (${NAME})`, 'i').exec(statement);
+    if (match)
+        schema.get(relationName(match[2]))?.policies.delete(identifier(match[1]));
+}
+function policyTable(statement) {
+    const match = new RegExp(String.raw `\bon (${NAME})`, 'i').exec(statement);
+    return match ? relationName(match[1]) : undefined;
+}
+function findIndex(schema, name) {
+    for (const table of schema.values()) {
+        const found = table.indexes.find(index => index.name === name);
+        if (found)
+            return found;
+    }
+    return undefined;
+}

package/dist/gates/unindexed-reads/schema.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/unindexed-reads/schema.test.js

@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest';
+import { policyColumns, policyFilters, replayMigrations } from './schema.js';
+import { splitStatements } from './sql.js';
+describe('splitStatements', () => {
+    it('keeps comments, quotes and dollar bodies from splitting a statement', () => {
+        const sql = `-- a; comment\ncreate table a (x text default ';');\n/* b; */ do $$ begin perform 1; end $$;\nselect 'it''s; fine';`;
+        expect(splitStatements(sql)).toEqual(["create table a (x text default ';')", 'do $$ begin perform 1; end $$', "select 'it''s; fine'"]);
+    });
+});
+describe('replayMigrations', () => {
+    it('collects primary keys, unique columns and table constraints as indexes', () => {
+        const schema = replayMigrations([`
+            create table public.orders (
+              id uuid primary key default gen_random_uuid(),
+              code text not null unique,
+              customer_id uuid not null references customers(id),
+              placed_at timestamptz,
+              constraint orders_customer_code unique (customer_id, code)
+            );`]);
+        expect(schema.get('orders').indexes.map(i => i.leading)).toEqual(['id', 'code', 'customer_id']);
+        expect(schema.get('orders').uncertain).toBe(false);
+    });
+    it('applies indexes, partial predicates, drops and renames in order', () => {
+        const schema = replayMigrations([
+            'create table orders (id uuid primary key, status text, placed_at timestamptz, customer_id uuid);',
+            `create index concurrently orders_open_idx on public.orders (placed_at desc, id) where status = 'open' and customer_id is not null;`,
+            'create index orders_customer_idx on orders using btree (customer_id);',
+            'create index orders_lower_idx on orders (lower(status));',
+            'drop index if exists public.orders_customer_idx;',
+            'alter index orders_open_idx rename to orders_open_v2_idx;',
+        ]);
+        const indexes = schema.get('orders').indexes;
+        expect(indexes.map(i => [i.name, i.leading])).toEqual([[undefined, 'id'], ['orders_open_v2_idx', 'placed_at'], ['orders_lower_idx', null]]);
+        expect(indexes[1].predicate).toEqual([{ kind: 'eq', column: 'status', value: 'open' }, { kind: 'notnull', column: 'customer_id' }]);
+    });
+    it('follows ALTER TABLE: added keys, table renames, dropped tables', () => {
+        const schema = replayMigrations([
+            'create table events (id bigint, kind text);',
+            'alter table events add constraint events_pkey primary key (id);',
+            'alter table events add column ref text unique;',
+            'alter table events rename to audit_events;',
+            'create table scratch (x int);',
+            'drop table scratch;',
+        ]);
+        expect(schema.get('audit_events').indexes.map(i => i.leading)).toEqual(['id', 'ref']);
+        expect([...schema.keys()]).toEqual(['audit_events']);
+    });
+    it('marks a table uncertain when DDL is beyond what it models', () => {
+        const schema = replayMigrations([
+            'create table a (id int, x int); create table b (id int); create table c (like a including indexes); create table d (id int) partition by range (id);',
+            'alter table a rename column x to y;',
+            `create or replace function f() returns void language plpgsql as $$ begin create index on b (id); end $$;`,
+        ]);
+        expect(['a', 'b', 'c', 'd'].map(t => schema.get(t).uncertain)).toEqual([true, true, true, true]);
+    });
+    it('treats an OR or an unreadable predicate as unknown', () => {
+        const schema = replayMigrations([
+            'create table t (a int, b int);',
+            `create index t_or on t (a) where a = 1 or b = 2;`,
+            `create index t_fn on t (a) where coalesce(b, 0) > 0;`,
+        ]);
+        expect(schema.get('t').indexes.map(i => i.predicate)).toEqual([[{ kind: 'unknown' }], [{ kind: 'unknown' }]]);
+    });
+    it('keeps SELECT and ALL policies as the columns they compare to the user', () => {
+        const schema = replayMigrations([
+            'create table subs (id text primary key, user_id uuid, status text);',
+            `create policy "own" on subs for select using (auth.uid() = user_id);`,
+            `create policy "writes" on subs for insert with check (auth.uid() = user_id);`,
+            `create policy "all" on subs to authenticated using (true);`,
+        ]);
+        expect(policyFilters(schema.get('subs'))).toEqual({ columns: ['user_id'], unknown: false });
+    });
+});
+describe('policyColumns', () => {
+    it('reads comparisons to the current user and gives up on anything else', () => {
+        expect(policyColumns('(select auth.uid()) = owner_id')).toEqual(['owner_id']);
+        expect(policyColumns('(owner_id = auth.uid()) or (editor_id = auth.uid())')).toEqual(['owner_id', 'editor_id']);
+        expect(policyColumns('true')).toEqual([]);
+        expect(policyColumns('exists (select 1 from members m where m.org_id = org_id)')).toBeNull();
+    });
+});

package/dist/gates/unindexed-reads/sql.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Just enough SQL lexing to replay Postgres migrations: statements, top-level
+ * lists, and identifiers. Anything this cannot read is reported as unknown so
+ * the gate stays silent rather than guess.
+ */
+/** Statements in order, comments removed; a `$tag$ … $tag$` body stays inside its statement. */
+export declare function splitStatements(sql: string): string[];
+/** Split on `separator` outside parentheses and quotes. */
+export declare function splitTopLevel(text: string, separator: RegExp): string[];
+/** The text inside the parentheses that open at `open`, or undefined when they never close. */
+export declare function parenthesized(text: string, open: number): {
+    inner: string;
+    end: number;
+} | undefined;
+/** Strip parentheses that enclose the whole expression, as often as they do: `((a))` → `a`, but `(a) or (b)` stays. */
+export declare function unwrap(text: string): string;
+/** A relation name as Rigour keys it: unquoted names fold to lower case, `public.` is implied. */
+export declare function relationName(raw: string): string;
+export declare function identifier(raw: string): string;
+/** One identifier, optionally schema-qualified and quoted: the `name` in `CREATE TABLE name (`. */
+export declare const NAME: string;

package/dist/gates/unindexed-reads/sql.js

@@ -0,0 +1,131 @@
+/**
+ * Just enough SQL lexing to replay Postgres migrations: statements, top-level
+ * lists, and identifiers. Anything this cannot read is reported as unknown so
+ * the gate stays silent rather than guess.
+ */
+/** Statements in order, comments removed; a `$tag$ … $tag$` body stays inside its statement. */
+export function splitStatements(sql) {
+    const statements = [];
+    let current = '';
+    let i = 0;
+    while (i < sql.length) {
+        const rest = sql.slice(i);
+        const dollar = /^\$[A-Za-z_]*\$/.exec(rest);
+        if (rest.startsWith('--')) {
+            const end = sql.indexOf('\n', i);
+            i = end === -1 ? sql.length : end;
+        }
+        else if (rest.startsWith('/*')) {
+            const end = sql.indexOf('*/', i + 2);
+            i = end === -1 ? sql.length : end + 2;
+            current += ' ';
+        }
+        else if (dollar) {
+            const end = sql.indexOf(dollar[0], i + dollar[0].length);
+            const stop = end === -1 ? sql.length : end + dollar[0].length;
+            current += sql.slice(i, stop);
+            i = stop;
+        }
+        else if (sql[i] === "'" || sql[i] === '"') {
+            const stop = quotedEnd(sql, i);
+            current += sql.slice(i, stop);
+            i = stop;
+        }
+        else if (sql[i] === ';') {
+            if (current.trim())
+                statements.push(current.trim());
+            current = '';
+            i++;
+        }
+        else {
+            current += sql[i++];
+        }
+    }
+    if (current.trim())
+        statements.push(current.trim());
+    return statements.map(s => s.replace(/\s+/g, ' '));
+}
+/** Index just past a quoted string or identifier starting at `start` (a doubled quote is an escape). */
+function quotedEnd(text, start) {
+    const quote = text[start];
+    let i = start + 1;
+    while (i < text.length) {
+        if (text[i] === quote && text[i + 1] === quote)
+            i += 2;
+        else if (text[i] === quote)
+            return i + 1;
+        else
+            i++;
+    }
+    return text.length;
+}
+/** Split on `separator` outside parentheses and quotes. */
+export function splitTopLevel(text, separator) {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    let i = 0;
+    while (i < text.length) {
+        const ch = text[i];
+        if (ch === "'" || ch === '"') {
+            i = quotedEnd(text, i);
+            continue;
+        }
+        if (ch === '(')
+            depth++;
+        else if (ch === ')')
+            depth--;
+        else if (depth === 0) {
+            const match = separator.exec(text.slice(i));
+            if (match && match.index === 0) {
+                parts.push(text.slice(start, i).trim());
+                i += match[0].length;
+                start = i;
+                continue;
+            }
+        }
+        i++;
+    }
+    parts.push(text.slice(start).trim());
+    return parts.filter(Boolean);
+}
+/** The text inside the parentheses that open at `open`, or undefined when they never close. */
+export function parenthesized(text, open) {
+    let depth = 0;
+    for (let i = open; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === "'" || ch === '"') {
+            i = quotedEnd(text, i) - 1;
+            continue;
+        }
+        if (ch === '(')
+            depth++;
+        else if (ch === ')' && --depth === 0)
+            return { inner: text.slice(open + 1, i), end: i + 1 };
+    }
+    return undefined;
+}
+/** Strip parentheses that enclose the whole expression, as often as they do: `((a))` → `a`, but `(a) or (b)` stays. */
+export function unwrap(text) {
+    let current = text.trim();
+    while (current.startsWith('(')) {
+        const group = parenthesized(current, 0);
+        if (!group || group.end !== current.length)
+            break;
+        current = group.inner.trim();
+    }
+    return current;
+}
+/** A relation name as Rigour keys it: unquoted names fold to lower case, `public.` is implied. */
+export function relationName(raw) {
+    const parts = raw.split('.').map(identifier);
+    if (parts.length === 2 && parts[0] === 'public')
+        return parts[1];
+    return parts.join('.');
+}
+export function identifier(raw) {
+    const trimmed = raw.trim();
+    return trimmed.startsWith('"') ? trimmed.slice(1, -1).replace(/""/g, '"') : trimmed.toLowerCase();
+}
+/** One identifier, optionally schema-qualified and quoted: the `name` in `CREATE TABLE name (`. */
+export const NAME = String.raw `(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)(?:\.(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*))?`;

package/dist/gates/unindexed-reads/unindexed-reads.test.d.ts

@@ -0,0 +1 @@
+export {};