@safegres/test 0.0.1 → 1.30.7

package/esm/config/presets.d.ts

@@ -0,0 +1,95 @@
+import type { SafegresConfig } from './types';
+/**
+ * Built-in presets, resolvable via `extends: 'safegres:<name>'`.
+ * A preset is just a partial config; users can publish their own as files
+ * or npm packages.
+ */
+/**
+ * Today's default behavior: every rule at its registry default severity.
+ *
+ * The untrusted-role rules take whichever roles the surface says are reachable
+ * without credentials, so a declared `exposure.anonRoles` (or an adapter that
+ * resolves one) is enough to switch them on. With no such surface `anonRoles`
+ * is empty and they stay inert, exactly as before.
+ */
+export declare const recommended: SafegresConfig;
+/**
+ * Everything on and escalated. Fail-closed hygiene findings (dead grants,
+ * locked tables) are re-tuned upward and even contribute a fraction of
+ * their weight to the score.
+ */
+export declare const strict: SafegresConfig;
+/**
+ * Tuned for Constructive's architecture:
+ * - the exposure surface auto-resolves from the routing plane
+ *   (`routing_public.apis` → `api_schemas` → `metaschema_public.schema`),
+ *   so only what the exposed APIs can reach drives the score;
+ * - untrusted-role rules watch `anonymous`; anything that can leak rows
+ *   across the role boundary is critical;
+ * - A3 is demoted to `info` rather than switched off — API roles never own
+ *   tables in the Constructive model, so non-FORCEd RLS is not an exposure
+ *   here, but the finding stays visible (info carries zero weight, so the
+ *   score is identical to switching it off) and re-tunable;
+ * - `pg_partman`'s schema is skipped: it creates child partitions and
+ *   templates at runtime with no dependency on the extension, so ownership
+ *   alone leaves them looking like unsecured application tables.
+ */
+export declare const constructive: SafegresConfig;
+/** Structural flags only — a fast CI smoke check. */
+export declare const minimal: SafegresConfig;
+/**
+ * PostgREST: the exposed schemas come from `pgrst.db_schemas` in the catalog,
+ * and `anon` is the role an unauthenticated request runs as — so anything it
+ * can write, or any policy that lets it through, is the whole threat model.
+ *
+ * The connecting role (`authenticator`) is graded as a secondary plane rather
+ * than folded into the headline: it can `SET ROLE`, so its own grants are a
+ * separate question from what the API serves.
+ */
+export declare const postgrest: SafegresConfig;
+/**
+ * Supabase is PostgREST with a fixed role vocabulary: `anon` (unauthenticated)
+ * and `authenticated` (any signed-up user — a much weaker boundary than it
+ * reads, since anyone can sign up) are both untrusted; `service_role` bypasses
+ * RLS by design, so its plane reports as skipped rather than F.
+ *
+ * `auth`, `storage`, `realtime`, `vault` and friends are Supabase's own
+ * schemas: they ship with their own policies and are not the developer's to
+ * fix, so they are scoped out of the score while staying in the report.
+ */
+export declare const supabase: SafegresConfig;
+/**
+ * PostGraphile / graphile-starter: `app_public` is served, `app_hidden` is
+ * reachable through it, `app_private` is not exposed.
+ *
+ * The request role is `<app>_visitor` — project-specific, so it cannot be
+ * named here. The adapter resolves it from role membership and the rules take
+ * it from there. Every request runs as that role, authenticated or not (the
+ * caller is a JWT claim, not a role), which is exactly what makes it
+ * untrusted.
+ *
+ * A3 stays at its default: in this layout the API role is *not* the table
+ * owner, so a missing FORCE genuinely is an owner-bypass hole.
+ */
+export declare const graphile: SafegresConfig;
+/** Hasura: the surface is whatever is *tracked* in `hdb_catalog`. */
+export declare const hasura: SafegresConfig;
+/**
+ * Tenancy posture, independent of stack: in a shared-table multi-tenant
+ * database every RLS gap is a cross-tenant read, not a self-service leak, so
+ * the row-visibility rules are escalated and a single critical caps the grade
+ * at D. Owner-bypass hygiene is *not* escalated — it is a deployment property,
+ * and drowning the report in it hides the boundary findings.
+ *
+ * Compose it: `"extends": ["safegres:supabase", "safegres:multi-tenant"]`.
+ */
+export declare const multiTenant: SafegresConfig;
+/**
+ * Perf posture for a read-heavy OLTP database, where a sequential scan behind
+ * an RLS policy is a production incident rather than a slow report. Security
+ * stays at whatever the composed preset says; this only retunes the P/X axis
+ * and gates on the perf grade, which is only meaningful once a baseline
+ * exists — see `--write-baseline`.
+ */
+export declare const oltp: SafegresConfig;
+export declare const PRESETS: Record<string, SafegresConfig>;

package/esm/config/presets.js

@@ -0,0 +1,324 @@
+/**
+ * Built-in presets, resolvable via `extends: 'safegres:<name>'`.
+ * A preset is just a partial config; users can publish their own as files
+ * or npm packages.
+ */
+/**
+ * Today's default behavior: every rule at its registry default severity.
+ *
+ * The untrusted-role rules take whichever roles the surface says are reachable
+ * without credentials, so a declared `exposure.anonRoles` (or an adapter that
+ * resolves one) is enough to switch them on. With no such surface `anonRoles`
+ * is empty and they stay inert, exactly as before.
+ */
+export const recommended = {
+    rules: {
+        // The convention linter (`C*`) enforces Constructive house style rather
+        // than a universal security fact, so the big-tent preset leaves it off;
+        // the `constructive` preset turns it on.
+        'C*': 'off',
+        R1: ['critical', { rolesFrom: 'anon' }],
+        R2: ['high', { rolesFrom: 'anon' }],
+        L5: ['info', { rolesFrom: 'anon' }],
+        // Signal-only for now: an unauthenticated role that can SET ROLE to a role
+        // with more reach is a real escalation, but the rule is new and unproven,
+        // so it reports at zero weight until validated. See the registry entry.
+        L7: ['info', { rolesFrom: 'anon' }],
+        // Same posture, same reason: a view that executes as its owner hands its
+        // readers that owner's reach, which is a real bypass, but the rule is new
+        // and body-derived, so it reports at zero weight until validated.
+        L8: ['info', { rolesFrom: 'anon' }],
+        // The write half of the same story: an auto-updatable definer view, and a
+        // rewrite rule whose action runs as the view owner. Same posture again —
+        // new, body-derived, zero weight until validated.
+        L9: ['info', { rolesFrom: 'anon' }],
+        L10: ['info', { rolesFrom: 'anon' }],
+        // The other two ways a readable view is not what its definition says: a
+        // materialized view serves rows RLS never filtered, and a filtering view
+        // without `security_barrier` is not a boundary. Same posture again.
+        L11: ['info', { rolesFrom: 'anon' }],
+        L12: ['info', { rolesFrom: 'anon' }],
+        // Reach that only `pg_attribute.attacl` shows. New, so zero weight — but
+        // note this one is catalog-derived, not body-derived: what was missing was
+        // the introspection, not the proof.
+        L13: ['info', { rolesFrom: 'anon' }],
+        // The coverage half of L8: a body reference the audit could not follow
+        // because the schema was out of scope. Reports an unknown, never a leak.
+        L14: ['info', { rolesFrom: 'anon' }],
+        // And the coverage half of the body itself: a view an untrusted role reads
+        // whose definition this analysis could not follow. Also an unknown.
+        L15: ['info', { rolesFrom: 'anon' }],
+        // Privileges on the objects that are not tables. Neither is row-filterable
+        // — RLS does not apply to a sequence and cannot be enabled on a foreign
+        // table at all — so both are reach the table rules never saw.
+        L16: ['info', { rolesFrom: 'anon' }],
+        L17: ['info', { rolesFrom: 'anon' }],
+        // The write-side twin of L12: a writable view whose `WHERE` is a read
+        // filter only, because `WITH CHECK OPTION` is not the default. Same
+        // posture again.
+        L18: ['info', { rolesFrom: 'anon' }],
+        // Privilege that arrives through a function body: a definer function's
+        // reach, and the write an INSTEAD OF trigger's definer function performs.
+        // Both are the L8 escalation with different syntax, and ship the same way.
+        L19: ['info', { rolesFrom: 'anon' }],
+        L20: ['info', { rolesFrom: 'anon' }]
+    }
+};
+/**
+ * Everything on and escalated. Fail-closed hygiene findings (dead grants,
+ * locked tables) are re-tuned upward and even contribute a fraction of
+ * their weight to the score.
+ */
+export const strict = {
+    extends: 'safegres:recommended',
+    rules: {
+        A1: 'medium',
+        A3: 'medium',
+        A4: 'high',
+        A5: 'medium',
+        A6: 'medium',
+        A8: 'medium',
+        P1b: 'high'
+    },
+    scoring: { failClosedWeight: 0.25 },
+    failOn: { severity: 'high' }
+};
+/**
+ * Tuned for Constructive's architecture:
+ * - the exposure surface auto-resolves from the routing plane
+ *   (`routing_public.apis` → `api_schemas` → `metaschema_public.schema`),
+ *   so only what the exposed APIs can reach drives the score;
+ * - untrusted-role rules watch `anonymous`; anything that can leak rows
+ *   across the role boundary is critical;
+ * - A3 is demoted to `info` rather than switched off — API roles never own
+ *   tables in the Constructive model, so non-FORCEd RLS is not an exposure
+ *   here, but the finding stays visible (info carries zero weight, so the
+ *   score is identical to switching it off) and re-tunable;
+ * - `pg_partman`'s schema is skipped: it creates child partitions and
+ *   templates at runtime with no dependency on the extension, so ownership
+ *   alone leaves them looking like unsecured application tables.
+ */
+export const constructive = {
+    extends: 'safegres:recommended',
+    exposure: { resolver: 'constructive' },
+    extensions: { ignore: ['pg_partman'] },
+    rules: {
+        A2: 'critical',
+        A3: 'info',
+        P5: 'critical',
+        // Each API declares its own `anon_role`; the adapter reads it, so a
+        // custom one is picked up instead of being missed, with the platform
+        // default kept explicitly so an unresolved surface still checks it.
+        // `role_name` (`authenticated`) is deliberately *not* included: a
+        // signed-in user holding a write grant is the product, not a finding.
+        R1: ['critical', { roles: ['anonymous'], rolesFrom: 'anon' }],
+        R2: ['high', { roles: ['anonymous'], rolesFrom: 'anon' }],
+        R3: 'medium',
+        L5: ['info', { roles: ['anonymous'], rolesFrom: 'anon' }],
+        // House-style convention rules, enforced here for the first time:
+        // never set search_path (C1), never use #variable_conflict (C2),
+        // schema-qualify every relation (C3, adoption severity — ratchet to
+        // error once clean), and no dynamic SQL (C4) unless waived inline with a
+        // categorized reason (`-- safegres-disable-next-line no-dynamic-sql --
+        // lookup-only: …`).
+        C1: 'high',
+        C2: 'medium',
+        C3: 'low',
+        C4: 'high'
+    },
+    scoring: { floorOnCritical: 'C' },
+    // The headline grades the API surface, which is the product's own question.
+    // These are the two other questions this codebase actually gates on, and
+    // neither is well served by being averaged into the first.
+    scorecards: {
+        'anon-surface': {
+            title: 'Anonymous surface',
+            description: 'What an unauthenticated caller reaches — exposure ignored, leaks only.',
+            select: {
+                roles: ['anonymous'],
+                direction: 'fail-open',
+                exposure: 'all',
+                denominator: 'all',
+                severities: 'declared'
+            },
+            // Nothing about the anonymous surface is informational. The L-series
+            // ships at `info` because each rule is new, not because "an
+            // unauthenticated caller reaches this" is a matter of interest — so on
+            // the card that asks exactly that question, a finding costs a point.
+            weights: { info: 1 },
+            floorOnCritical: 'C'
+        },
+        'sql-conventions': {
+            title: 'SQL conventions',
+            description: 'House style in function bodies — reachable or not, it is still the codebase.',
+            select: { rules: ['C*'], exposure: 'all', denominator: 'all' }
+        }
+    }
+};
+/** Structural flags only — a fast CI smoke check. */
+export const minimal = {
+    rules: {
+        '*': 'off',
+        A1: 'critical',
+        A2: 'high',
+        A3: 'medium'
+    }
+};
+/**
+ * PostgREST: the exposed schemas come from `pgrst.db_schemas` in the catalog,
+ * and `anon` is the role an unauthenticated request runs as — so anything it
+ * can write, or any policy that lets it through, is the whole threat model.
+ *
+ * The connecting role (`authenticator`) is graded as a secondary plane rather
+ * than folded into the headline: it can `SET ROLE`, so its own grants are a
+ * separate question from what the API serves.
+ */
+export const postgrest = {
+    extends: 'safegres:recommended',
+    exposure: { adapters: ['postgrest'] },
+    rules: {
+        // The anon role is `pgrst.db_anon_role`, so the adapter knows its name and
+        // the rules take it from the resolved surface rather than assuming `anon`.
+        R1: ['critical', { rolesFrom: 'anon' }],
+        R2: ['critical', { rolesFrom: 'anon' }],
+        R3: 'high',
+        L5: ['high', { rolesFrom: 'anon' }]
+    },
+    scoring: { floorOnCritical: 'C' }
+};
+/**
+ * Supabase is PostgREST with a fixed role vocabulary: `anon` (unauthenticated)
+ * and `authenticated` (any signed-up user — a much weaker boundary than it
+ * reads, since anyone can sign up) are both untrusted; `service_role` bypasses
+ * RLS by design, so its plane reports as skipped rather than F.
+ *
+ * `auth`, `storage`, `realtime`, `vault` and friends are Supabase's own
+ * schemas: they ship with their own policies and are not the developer's to
+ * fix, so they are scoped out of the score while staying in the report.
+ */
+export const supabase = {
+    extends: 'safegres:postgrest',
+    exposure: { adapters: ['supabase'] },
+    rules: {
+        // Both are named outright, not just the anon one: on Supabase anyone can
+        // sign up, so `authenticated` is a boundary the internet crosses at will.
+        // Fixed by the platform, so unlike PostgREST's anon role they are safe to
+        // name — and the adapter's anon set unions in on a self-hosted project.
+        R1: ['critical', { roles: ['anon', 'authenticated'], rolesFrom: 'anon' }],
+        R2: ['critical', { roles: ['anon', 'authenticated'], rolesFrom: 'anon' }],
+        L5: ['high', { roles: ['anon', 'authenticated'], rolesFrom: 'anon' }]
+    },
+    overrides: [
+        // Supabase-managed schemas: their policies ship with the platform, not
+        // with your migrations. Demoted, not excluded — still in the report.
+        {
+            tables: [
+                'auth.*',
+                'storage.*',
+                'realtime.*',
+                'vault.*',
+                'extensions.*',
+                'graphql.*',
+                'supabase_migrations.*'
+            ],
+            rules: { '*': 'info' }
+        }
+    ]
+};
+/**
+ * PostGraphile / graphile-starter: `app_public` is served, `app_hidden` is
+ * reachable through it, `app_private` is not exposed.
+ *
+ * The request role is `<app>_visitor` — project-specific, so it cannot be
+ * named here. The adapter resolves it from role membership and the rules take
+ * it from there. Every request runs as that role, authenticated or not (the
+ * caller is a JWT claim, not a role), which is exactly what makes it
+ * untrusted.
+ *
+ * A3 stays at its default: in this layout the API role is *not* the table
+ * owner, so a missing FORCE genuinely is an owner-bypass hole.
+ */
+export const graphile = {
+    extends: 'safegres:recommended',
+    exposure: { adapters: ['graphile'] },
+    rules: {
+        // Every request is the visitor role, signed in or not, so for graphile the
+        // anon set and the API-edge set are the same thing.
+        R1: ['high', { rolesFrom: 'anon' }],
+        R2: ['high', { rolesFrom: 'anon' }],
+        R3: 'high',
+        L5: ['medium', { rolesFrom: 'anon' }]
+    }
+};
+/** Hasura: the surface is whatever is *tracked* in `hdb_catalog`. */
+export const hasura = {
+    extends: 'safegres:recommended',
+    exposure: { adapters: ['hasura'] },
+    rules: {
+        R1: ['critical', { roles: ['anonymous', 'public'] }],
+        R2: ['critical', { roles: ['anonymous', 'public'] }],
+        R3: 'high'
+    },
+    overrides: [
+        // Hasura's own metadata catalog, managed by the engine.
+        { tables: ['hdb_catalog.*'], rules: { '*': 'info' } }
+    ]
+};
+/**
+ * Tenancy posture, independent of stack: in a shared-table multi-tenant
+ * database every RLS gap is a cross-tenant read, not a self-service leak, so
+ * the row-visibility rules are escalated and a single critical caps the grade
+ * at D. Owner-bypass hygiene is *not* escalated — it is a deployment property,
+ * and drowning the report in it hides the boundary findings.
+ *
+ * Compose it: `"extends": ["safegres:supabase", "safegres:multi-tenant"]`.
+ */
+export const multiTenant = {
+    rules: {
+        A1: 'critical',
+        A2: 'critical',
+        A4: 'high',
+        L1: 'critical',
+        L2: 'critical',
+        L3: 'high',
+        L5: 'high',
+        P5: 'high'
+    },
+    scoring: { floorOnCritical: 'D' },
+    failOn: { severity: 'critical' }
+};
+/**
+ * Perf posture for a read-heavy OLTP database, where a sequential scan behind
+ * an RLS policy is a production incident rather than a slow report. Security
+ * stays at whatever the composed preset says; this only retunes the P/X axis
+ * and gates on the perf grade, which is only meaningful once a baseline
+ * exists — see `--write-baseline`.
+ */
+export const oltp = {
+    rules: {
+        // The four that turn a policy into a per-row function call or defeat the
+        // index it should be using — the difference between an index scan and a
+        // seq scan per request.
+        X2: 'critical',
+        X3: 'critical',
+        X4: 'high',
+        X9: 'high',
+        X1: 'high',
+        X6: 'high',
+        P1b: 'high',
+        P5: 'high'
+    },
+    failOn: { perfGrade: 'C' }
+};
+export const PRESETS = {
+    'safegres:recommended': recommended,
+    'safegres:strict': strict,
+    'safegres:constructive': constructive,
+    'safegres:minimal': minimal,
+    'safegres:postgrest': postgrest,
+    'safegres:supabase': supabase,
+    'safegres:graphile': graphile,
+    'safegres:hasura': hasura,
+    'safegres:multi-tenant': multiTenant,
+    'safegres:oltp': oltp
+};

package/esm/config/resolve.d.ts

@@ -0,0 +1,47 @@
+import type { Dimension, Finding, Severity } from '../types';
+import type { OverrideEntry, RulesConfig, SafegresConfig } from './types';
+export interface ResolvedRule {
+    enabled: boolean;
+    severity: Severity;
+    options?: Record<string, unknown>;
+}
+export interface ResolvedRules {
+    rules: Map<string, ResolvedRule>;
+    overrides: OverrideEntry[];
+}
+export declare class ConfigValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Apply a RulesConfig on top of a base rule map. Wildcard selectors apply
+ * first, exact codes second — so `{ 'P*': 'off', P1: 'high' }` disables all
+ * P-rules except P1.
+ */
+export declare function applyRulesConfig(base: Map<string, ResolvedRule>, rulesConfig: RulesConfig, strictUnknown?: boolean): Map<string, ResolvedRule>;
+/** Base rule map: every registered rule enabled at its default severity. */
+export declare function defaultRuleMap(): Map<string, ResolvedRule>;
+/** Resolve the rule + override portion of a merged SafegresConfig. */
+export declare function resolveRules(config: SafegresConfig): ResolvedRules;
+/** Rule codes belonging to a scoring dimension. */
+export declare function ruleCodesForDimension(dimension: Dimension): string[];
+/** Simple `*` glob match against a qualified `schema.table` name. */
+export declare function matchTablePattern(pattern: string, qualified: string): boolean;
+/**
+ * The effective rule settings for one table: base rules plus any matching
+ * override entries (later entries win).
+ */
+export declare function rulesForTable(resolved: ResolvedRules, schema: string, table: string): Map<string, ResolvedRule>;
+/**
+ * Apply resolved rules to raw findings: drop findings for disabled rules and
+ * restamp severities from config (respecting per-table overrides).
+ */
+export declare function applyRulesToFindings(resolved: ResolvedRules, findings: Finding[]): Finding[];
+/**
+ * True when every AST-scoped rule is disabled (lets the audit skip parsing).
+ *
+ * The policy-aware index rules (X2–X4) are AST-scoped but only run when the
+ * perf dimension is on, so they hold parsing open only in that mode.
+ */
+export declare function allAstRulesDisabled(resolved: ResolvedRules, options?: {
+    perf?: boolean;
+}): boolean;

package/esm/config/resolve.js

@@ -0,0 +1,180 @@
+import { dimensionOf, expandRuleSelector, isKnownRule, RULES, RULES_BY_CODE } from '../rules/registry';
+import { SEVERITY_ORDER } from '../types';
+export class ConfigValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ConfigValidationError';
+    }
+}
+function parseSetting(code, setting) {
+    if (setting === 'off') {
+        return { enabled: false, severity: RULES_BY_CODE.get(code).defaultSeverity };
+    }
+    if (typeof setting === 'string') {
+        assertSeverity(code, setting);
+        return { enabled: true, severity: setting };
+    }
+    if (Array.isArray(setting) && setting.length >= 1) {
+        assertSeverity(code, setting[0]);
+        return { enabled: true, severity: setting[0], options: setting[1] };
+    }
+    throw new ConfigValidationError(`Invalid setting for rule "${code}": expected "off", a severity, or [severity, options].`);
+}
+function assertSeverity(code, sev) {
+    if (!(sev in SEVERITY_ORDER)) {
+        throw new ConfigValidationError(`Invalid severity "${sev}" for rule "${code}". Expected one of: ${Object.keys(SEVERITY_ORDER).join(', ')}, off.`);
+    }
+}
+/**
+ * Apply a RulesConfig on top of a base rule map. Wildcard selectors apply
+ * first, exact codes second — so `{ 'P*': 'off', P1: 'high' }` disables all
+ * P-rules except P1.
+ */
+export function applyRulesConfig(base, rulesConfig, strictUnknown = true) {
+    const out = new Map(base);
+    const entries = Object.entries(rulesConfig);
+    const wildcards = entries.filter(([sel]) => sel.endsWith('*'));
+    const exacts = entries.filter(([sel]) => !sel.endsWith('*'));
+    for (const [selector, setting] of [...wildcards, ...exacts]) {
+        if (!selector.endsWith('*') && !isKnownRule(selector)) {
+            if (strictUnknown) {
+                throw new ConfigValidationError(`Unknown rule code "${selector}". Known rules: ${RULES.map((r) => r.code).join(', ')}.`);
+            }
+            continue;
+        }
+        for (const code of expandRuleSelector(selector)) {
+            out.set(code, parseSetting(code, setting));
+        }
+    }
+    return out;
+}
+/** Base rule map: every registered rule enabled at its default severity. */
+export function defaultRuleMap() {
+    return new Map(RULES.map((r) => [r.code, { enabled: true, severity: r.defaultSeverity }]));
+}
+/** Resolve the rule + override portion of a merged SafegresConfig. */
+export function resolveRules(config) {
+    let rules = defaultRuleMap();
+    if (config.rules) {
+        rules = applyRulesConfig(rules, config.rules);
+    }
+    if (config.perf?.rules) {
+        assertPerfSelectors(config.perf.rules);
+        rules = applyRulesConfig(rules, config.perf.rules);
+    }
+    const overrides = config.overrides ?? [];
+    for (const o of overrides) {
+        if (!Array.isArray(o.tables) || o.tables.length === 0) {
+            throw new ConfigValidationError('Every "overrides" entry needs a non-empty "tables" array.');
+        }
+        // Validate override rule settings eagerly.
+        applyRulesConfig(rules, o.rules ?? {});
+    }
+    const publicRead = config.public?.read;
+    if (publicRead !== undefined) {
+        if (!Array.isArray(publicRead) || publicRead.some((p) => typeof p !== 'string' || p.length === 0)) {
+            throw new ConfigValidationError('"public.read" must be an array of non-empty schema.table glob patterns.');
+        }
+    }
+    const perfIgnore = config.perf?.ignore;
+    if (perfIgnore !== undefined) {
+        if (!Array.isArray(perfIgnore) || perfIgnore.some((p) => typeof p !== 'string' || p.length === 0)) {
+            throw new ConfigValidationError('"perf.ignore" must be an array of non-empty schema.table glob patterns.');
+        }
+    }
+    const ignoredExtensions = config.extensions?.ignore;
+    if (ignoredExtensions !== undefined) {
+        if (!Array.isArray(ignoredExtensions)
+            || ignoredExtensions.some((e) => typeof e !== 'string' || e.length === 0)) {
+            throw new ConfigValidationError('"extensions.ignore" must be an array of non-empty extension names.');
+        }
+    }
+    return { rules, overrides };
+}
+/**
+ * `perf.rules` may only retune perf-dimension codes — otherwise a security
+ * rule would silently change behind the perf flag.
+ */
+function assertPerfSelectors(rules) {
+    for (const selector of Object.keys(rules)) {
+        const codes = expandRuleSelector(selector);
+        if (codes.length === 0) {
+            throw new ConfigValidationError(`Unknown rule code "${selector}" in "perf.rules". Perf rules: ${perfRuleCodes().join(', ')}.`);
+        }
+        const security = codes.filter((code) => dimensionOf(RULES_BY_CODE.get(code)) !== 'perf');
+        if (security.length > 0) {
+            throw new ConfigValidationError(`"perf.rules" may only configure perf-dimension rules; "${selector}" matches security rule(s) `
+                + `${security.join(', ')}. Configure those under the top-level "rules".`);
+        }
+    }
+}
+/** Rule codes belonging to a scoring dimension. */
+export function ruleCodesForDimension(dimension) {
+    return RULES.filter((r) => dimensionOf(r) === dimension).map((r) => r.code);
+}
+function perfRuleCodes() {
+    return ruleCodesForDimension('perf');
+}
+/** Simple `*` glob match against a qualified `schema.table` name. */
+export function matchTablePattern(pattern, qualified) {
+    const re = new RegExp(`^${pattern.split('*').map(escapeRegExp).join('.*')}$`);
+    return re.test(qualified);
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * The effective rule settings for one table: base rules plus any matching
+ * override entries (later entries win).
+ */
+export function rulesForTable(resolved, schema, table) {
+    const qualified = `${schema}.${table}`;
+    let rules = resolved.rules;
+    for (const o of resolved.overrides) {
+        if (o.tables.some((p) => matchTablePattern(p, qualified))) {
+            rules = applyRulesConfig(rules, o.rules ?? {});
+        }
+    }
+    return rules;
+}
+/**
+ * Apply resolved rules to raw findings: drop findings for disabled rules and
+ * restamp severities from config (respecting per-table overrides).
+ */
+export function applyRulesToFindings(resolved, findings) {
+    const out = [];
+    for (const f of findings) {
+        const rules = f.schema && f.table ? rulesForTable(resolved, f.schema, f.table) : resolved.rules;
+        const rule = rules.get(f.code);
+        if (!rule) {
+            out.push(f); // unknown/unregistered code — pass through untouched
+            continue;
+        }
+        if (!rule.enabled)
+            continue;
+        out.push(f.severity === rule.severity ? f : { ...f, severity: rule.severity });
+    }
+    return out;
+}
+/**
+ * True when every AST-scoped rule is disabled (lets the audit skip parsing).
+ *
+ * The policy-aware index rules (X2–X4) are AST-scoped but only run when the
+ * perf dimension is on, so they hold parsing open only in that mode.
+ */
+export function allAstRulesDisabled(resolved, options = {}) {
+    const astCodes = RULES
+        .filter((r) => r.scope === 'policy-ast')
+        .filter((r) => options.perf || r.category !== 'index')
+        .map((r) => r.code);
+    const base = astCodes.every((code) => resolved.rules.get(code)?.enabled === false);
+    if (!base)
+        return false;
+    // An override could re-enable an AST rule for some table.
+    for (const o of resolved.overrides) {
+        const merged = applyRulesConfig(resolved.rules, o.rules ?? {});
+        if (astCodes.some((code) => merged.get(code)?.enabled))
+            return false;
+    }
+    return true;
+}