@safegres/test 0.0.2 → 1.30.7

package/index.js

@@ -1,4 +1,11 @@
 "use strict";
+/**
+ * Public surface of `safegres` — a pure-PostgreSQL Row-Level-Security auditor.
+ *
+ * The auditor introspects pg_class / pg_policy / role grants and emits
+ * structured findings (A1–A7, P1, P5). It has no knowledge of any specific
+ * application schema or policy DSL.
+ */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -14,9 +21,225 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./admin"), exports);
-__exportStar(require("./connect"), exports);
-__exportStar(require("./manager"), exports);
-__exportStar(require("./roles"), exports);
-__exportStar(require("./seed"), exports);
-__exportStar(require("./test-client"), exports);
+exports.analyzeViewWrites = exports.checkMatviewSnapshot = exports.checkLeakyFilterView = exports.analyzeViewExposure = exports.DEFAULT_STATS_THRESHOLDS = exports.checkUnusedIndexes = exports.checkTopStatements = exports.checkStats = exports.checkSeqScanDominant = exports.checkDeadTuples = exports.checkUntrustedRoleWrites = exports.checkUntrustedRolePolicies = exports.checkPublicGrants = exports.collectPredicateColumns = exports.checkUnindexedPolicyColumns = exports.checkUnhoistedPolicyFunctions = exports.checkPolicyColumnCasts = exports.checkNonLeakproofPolicyFunctions = exports.checkUntrustedSequenceGrants = exports.checkUntrustedForeignTableGrants = exports.effectiveGrants = exports.effectiveColumnGrants = exports.computeRoleAccess = exports.checkUntrustedIndirectAccess = exports.checkUnreachableGrants = exports.checkIndirectCoverageGaps = exports.checkDeadSchemaUsage = exports.checkDeadPolicies = exports.checkUnindexedSortColumns = exports.checkUnindexedSearchColumns = exports.checkUnindexedForeignKeys = exports.checkRedundantIndexes = exports.checkMissingPrimaryKey = exports.checkUnreadableViewReach = exports.checkUnauditedViewReach = exports.checkDefinerViewBypass = exports.analyzeViewBodies = exports.checkUnreadableFunctionReach = exports.checkInsteadOfTriggerWrite = exports.checkDefinerFunctionReach = exports.analyzeFunctionBodies = exports.checkUntrustedColumnGrants = exports.buildCallGraph = exports.toBaseline = exports.serializeBaseline = exports.parseBaseline = exports.diffCallGraph = exports.boundaryKey = exports.PolicyParseError = exports.parsePolicyExpression = void 0;
+exports.supabaseAdapter = exports.resolveAdapters = exports.postgrestAdapter = exports.postgraphileAdapter = exports.hasuraAdapter = exports.graphileAdapter = exports.definePlanes = exports.constructiveAdapter = exports.BUILTIN_ADAPTERS = exports.loadCorpus = exports.loadCase = exports.gradeCase = exports.corpusDir = exports.corpusBootstrap = exports.validateConfigShape = exports.toJsonSchema = exports.SCHEMA_ID = exports.CONFIG_SHAPE = exports.rulesForTable = exports.ruleCodesForDimension = exports.resolveRules = exports.matchTablePattern = exports.defaultRuleMap = exports.ConfigValidationError = exports.applyRulesToFindings = exports.allAstRulesDisabled = exports.supabase = exports.strict = exports.recommended = exports.PRESETS = exports.postgrest = exports.oltp = exports.multiTenant = exports.minimal = exports.hasura = exports.graphile = exports.constructive = exports.safegresConfigLoader = exports.loadConfig = exports.configFingerprint = exports.runEval = exports.doctor = exports.audit = exports.selectGithubBaseline = exports.selectBaseline = exports.MAX_BASELINE_AGE_MS = exports.CANDIDATE_LIMIT = exports.checkViewRuleBypass = exports.checkUncheckedViewWrite = exports.checkDefinerViewWrite = void 0;
+exports.scoreBadge = exports.renderGithubSummary = exports.renderGithubComment = exports.renderAnnotations = exports.postStickyComment = exports.gradeBadge = exports.emitGithub = exports.COMMENT_MARKER = exports.toSnapshot = exports.serializeSnapshot = exports.parseSnapshot = exports.formatDelta = exports.formatAge = exports.describeBaseline = exports.compareReports = exports.baselineLabel = exports.renderCallGraphDiff = exports.renderCallGraph = exports.introspectStats = exports.resolveRoles = exports.listAuditableRoles = exports.introspectObjectAcls = exports.introspectTables = exports.introspectViews = exports.introspectIndexes = exports.introspectFunctions = exports.UNKNOWN_EXPOSURE = exports.resolveReach = exports.resolvePlanes = exports.resolveExposure = exports.resolveConstructiveExposure = exports.introspectSchemaAcls = exports.introspectRoleGraph = exports.proveFindings = exports.toPerfBaseline = exports.toBaselineFinding = exports.subjectOf = exports.serializePerfBaseline = exports.parsePerfBaseline = exports.findingKey = exports.diffPerf = exports.ROOT_ABILITIES = exports.FORWARD_ABILITIES = exports.computeApiReach = exports.BACKWARD_ABILITIES = exports.stampPlanes = exports.scorePlane = exports.resolvePlaneReach = exports.relationKey = exports.onPlane = void 0;
+exports.meetsGrade = exports.DEFAULT_WEIGHTS = exports.DEFAULT_GRADE_BANDS = exports.computeScore = exports.RULES_BY_CODE = exports.RULES = exports.isKnownRule = exports.expandRuleSelector = exports.dimensionOf = exports.viewConfigFromReportConfig = exports.selectView = exports.matchPlane = exports.ALL_SECTIONS = exports.renderSarif = exports.buildSourceIndex = exports.renderPretty = exports.renderMarkdown = exports.renderJson = void 0;
+var parse_1 = require("./ast/parse");
+Object.defineProperty(exports, "parsePolicyExpression", { enumerable: true, get: function () { return parse_1.parsePolicyExpression; } });
+Object.defineProperty(exports, "PolicyParseError", { enumerable: true, get: function () { return parse_1.PolicyParseError; } });
+var baseline_1 = require("./callgraph/baseline");
+Object.defineProperty(exports, "boundaryKey", { enumerable: true, get: function () { return baseline_1.boundaryKey; } });
+Object.defineProperty(exports, "diffCallGraph", { enumerable: true, get: function () { return baseline_1.diffCallGraph; } });
+Object.defineProperty(exports, "parseBaseline", { enumerable: true, get: function () { return baseline_1.parseBaseline; } });
+Object.defineProperty(exports, "serializeBaseline", { enumerable: true, get: function () { return baseline_1.serializeBaseline; } });
+Object.defineProperty(exports, "toBaseline", { enumerable: true, get: function () { return baseline_1.toBaseline; } });
+var graph_1 = require("./callgraph/graph");
+Object.defineProperty(exports, "buildCallGraph", { enumerable: true, get: function () { return graph_1.buildCallGraph; } });
+var column_grants_1 = require("./checks/column-grants");
+Object.defineProperty(exports, "checkUntrustedColumnGrants", { enumerable: true, get: function () { return column_grants_1.checkUntrustedColumnGrants; } });
+var definer_function_1 = require("./checks/definer-function");
+Object.defineProperty(exports, "analyzeFunctionBodies", { enumerable: true, get: function () { return definer_function_1.analyzeFunctionBodies; } });
+Object.defineProperty(exports, "checkDefinerFunctionReach", { enumerable: true, get: function () { return definer_function_1.checkDefinerFunctionReach; } });
+Object.defineProperty(exports, "checkInsteadOfTriggerWrite", { enumerable: true, get: function () { return definer_function_1.checkInsteadOfTriggerWrite; } });
+Object.defineProperty(exports, "checkUnreadableFunctionReach", { enumerable: true, get: function () { return definer_function_1.checkUnreadableFunctionReach; } });
+var definer_view_1 = require("./checks/definer-view");
+Object.defineProperty(exports, "analyzeViewBodies", { enumerable: true, get: function () { return definer_view_1.analyzeViewBodies; } });
+Object.defineProperty(exports, "checkDefinerViewBypass", { enumerable: true, get: function () { return definer_view_1.checkDefinerViewBypass; } });
+Object.defineProperty(exports, "checkUnauditedViewReach", { enumerable: true, get: function () { return definer_view_1.checkUnauditedViewReach; } });
+Object.defineProperty(exports, "checkUnreadableViewReach", { enumerable: true, get: function () { return definer_view_1.checkUnreadableViewReach; } });
+var indexes_1 = require("./checks/indexes");
+Object.defineProperty(exports, "checkMissingPrimaryKey", { enumerable: true, get: function () { return indexes_1.checkMissingPrimaryKey; } });
+Object.defineProperty(exports, "checkRedundantIndexes", { enumerable: true, get: function () { return indexes_1.checkRedundantIndexes; } });
+Object.defineProperty(exports, "checkUnindexedForeignKeys", { enumerable: true, get: function () { return indexes_1.checkUnindexedForeignKeys; } });
+Object.defineProperty(exports, "checkUnindexedSearchColumns", { enumerable: true, get: function () { return indexes_1.checkUnindexedSearchColumns; } });
+Object.defineProperty(exports, "checkUnindexedSortColumns", { enumerable: true, get: function () { return indexes_1.checkUnindexedSortColumns; } });
+var lattice_1 = require("./checks/lattice");
+Object.defineProperty(exports, "checkDeadPolicies", { enumerable: true, get: function () { return lattice_1.checkDeadPolicies; } });
+Object.defineProperty(exports, "checkDeadSchemaUsage", { enumerable: true, get: function () { return lattice_1.checkDeadSchemaUsage; } });
+Object.defineProperty(exports, "checkIndirectCoverageGaps", { enumerable: true, get: function () { return lattice_1.checkIndirectCoverageGaps; } });
+Object.defineProperty(exports, "checkUnreachableGrants", { enumerable: true, get: function () { return lattice_1.checkUnreachableGrants; } });
+Object.defineProperty(exports, "checkUntrustedIndirectAccess", { enumerable: true, get: function () { return lattice_1.checkUntrustedIndirectAccess; } });
+Object.defineProperty(exports, "computeRoleAccess", { enumerable: true, get: function () { return lattice_1.computeRoleAccess; } });
+Object.defineProperty(exports, "effectiveColumnGrants", { enumerable: true, get: function () { return lattice_1.effectiveColumnGrants; } });
+Object.defineProperty(exports, "effectiveGrants", { enumerable: true, get: function () { return lattice_1.effectiveGrants; } });
+var object_acls_1 = require("./checks/object-acls");
+Object.defineProperty(exports, "checkUntrustedForeignTableGrants", { enumerable: true, get: function () { return object_acls_1.checkUntrustedForeignTableGrants; } });
+Object.defineProperty(exports, "checkUntrustedSequenceGrants", { enumerable: true, get: function () { return object_acls_1.checkUntrustedSequenceGrants; } });
+var policy_index_1 = require("./checks/policy-index");
+Object.defineProperty(exports, "checkNonLeakproofPolicyFunctions", { enumerable: true, get: function () { return policy_index_1.checkNonLeakproofPolicyFunctions; } });
+Object.defineProperty(exports, "checkPolicyColumnCasts", { enumerable: true, get: function () { return policy_index_1.checkPolicyColumnCasts; } });
+Object.defineProperty(exports, "checkUnhoistedPolicyFunctions", { enumerable: true, get: function () { return policy_index_1.checkUnhoistedPolicyFunctions; } });
+Object.defineProperty(exports, "checkUnindexedPolicyColumns", { enumerable: true, get: function () { return policy_index_1.checkUnindexedPolicyColumns; } });
+Object.defineProperty(exports, "collectPredicateColumns", { enumerable: true, get: function () { return policy_index_1.collectPredicateColumns; } });
+var role_trust_1 = require("./checks/role-trust");
+Object.defineProperty(exports, "checkPublicGrants", { enumerable: true, get: function () { return role_trust_1.checkPublicGrants; } });
+Object.defineProperty(exports, "checkUntrustedRolePolicies", { enumerable: true, get: function () { return role_trust_1.checkUntrustedRolePolicies; } });
+Object.defineProperty(exports, "checkUntrustedRoleWrites", { enumerable: true, get: function () { return role_trust_1.checkUntrustedRoleWrites; } });
+var stats_1 = require("./checks/stats");
+Object.defineProperty(exports, "checkDeadTuples", { enumerable: true, get: function () { return stats_1.checkDeadTuples; } });
+Object.defineProperty(exports, "checkSeqScanDominant", { enumerable: true, get: function () { return stats_1.checkSeqScanDominant; } });
+Object.defineProperty(exports, "checkStats", { enumerable: true, get: function () { return stats_1.checkStats; } });
+Object.defineProperty(exports, "checkTopStatements", { enumerable: true, get: function () { return stats_1.checkTopStatements; } });
+Object.defineProperty(exports, "checkUnusedIndexes", { enumerable: true, get: function () { return stats_1.checkUnusedIndexes; } });
+Object.defineProperty(exports, "DEFAULT_STATS_THRESHOLDS", { enumerable: true, get: function () { return stats_1.DEFAULT_STATS_THRESHOLDS; } });
+var view_exposure_1 = require("./checks/view-exposure");
+Object.defineProperty(exports, "analyzeViewExposure", { enumerable: true, get: function () { return view_exposure_1.analyzeViewExposure; } });
+Object.defineProperty(exports, "checkLeakyFilterView", { enumerable: true, get: function () { return view_exposure_1.checkLeakyFilterView; } });
+Object.defineProperty(exports, "checkMatviewSnapshot", { enumerable: true, get: function () { return view_exposure_1.checkMatviewSnapshot; } });
+var view_writes_1 = require("./checks/view-writes");
+Object.defineProperty(exports, "analyzeViewWrites", { enumerable: true, get: function () { return view_writes_1.analyzeViewWrites; } });
+Object.defineProperty(exports, "checkDefinerViewWrite", { enumerable: true, get: function () { return view_writes_1.checkDefinerViewWrite; } });
+Object.defineProperty(exports, "checkUncheckedViewWrite", { enumerable: true, get: function () { return view_writes_1.checkUncheckedViewWrite; } });
+Object.defineProperty(exports, "checkViewRuleBypass", { enumerable: true, get: function () { return view_writes_1.checkViewRuleBypass; } });
+var baseline_2 = require("./ci/baseline");
+Object.defineProperty(exports, "CANDIDATE_LIMIT", { enumerable: true, get: function () { return baseline_2.CANDIDATE_LIMIT; } });
+Object.defineProperty(exports, "MAX_BASELINE_AGE_MS", { enumerable: true, get: function () { return baseline_2.MAX_BASELINE_AGE_MS; } });
+Object.defineProperty(exports, "selectBaseline", { enumerable: true, get: function () { return baseline_2.selectBaseline; } });
+var github_1 = require("./ci/github");
+Object.defineProperty(exports, "selectGithubBaseline", { enumerable: true, get: function () { return github_1.selectGithubBaseline; } });
+var audit_1 = require("./commands/audit");
+Object.defineProperty(exports, "audit", { enumerable: true, get: function () { return audit_1.audit; } });
+var doctor_1 = require("./commands/doctor");
+Object.defineProperty(exports, "doctor", { enumerable: true, get: function () { return doctor_1.doctor; } });
+var eval_1 = require("./commands/eval");
+Object.defineProperty(exports, "runEval", { enumerable: true, get: function () { return eval_1.runEval; } });
+var fingerprint_1 = require("./config/fingerprint");
+Object.defineProperty(exports, "configFingerprint", { enumerable: true, get: function () { return fingerprint_1.configFingerprint; } });
+var loader_1 = require("./config/loader");
+Object.defineProperty(exports, "loadConfig", { enumerable: true, get: function () { return loader_1.loadConfig; } });
+Object.defineProperty(exports, "safegresConfigLoader", { enumerable: true, get: function () { return loader_1.safegresConfigLoader; } });
+var presets_1 = require("./config/presets");
+Object.defineProperty(exports, "constructive", { enumerable: true, get: function () { return presets_1.constructive; } });
+Object.defineProperty(exports, "graphile", { enumerable: true, get: function () { return presets_1.graphile; } });
+Object.defineProperty(exports, "hasura", { enumerable: true, get: function () { return presets_1.hasura; } });
+Object.defineProperty(exports, "minimal", { enumerable: true, get: function () { return presets_1.minimal; } });
+Object.defineProperty(exports, "multiTenant", { enumerable: true, get: function () { return presets_1.multiTenant; } });
+Object.defineProperty(exports, "oltp", { enumerable: true, get: function () { return presets_1.oltp; } });
+Object.defineProperty(exports, "postgrest", { enumerable: true, get: function () { return presets_1.postgrest; } });
+Object.defineProperty(exports, "PRESETS", { enumerable: true, get: function () { return presets_1.PRESETS; } });
+Object.defineProperty(exports, "recommended", { enumerable: true, get: function () { return presets_1.recommended; } });
+Object.defineProperty(exports, "strict", { enumerable: true, get: function () { return presets_1.strict; } });
+Object.defineProperty(exports, "supabase", { enumerable: true, get: function () { return presets_1.supabase; } });
+var resolve_1 = require("./config/resolve");
+Object.defineProperty(exports, "allAstRulesDisabled", { enumerable: true, get: function () { return resolve_1.allAstRulesDisabled; } });
+Object.defineProperty(exports, "applyRulesToFindings", { enumerable: true, get: function () { return resolve_1.applyRulesToFindings; } });
+Object.defineProperty(exports, "ConfigValidationError", { enumerable: true, get: function () { return resolve_1.ConfigValidationError; } });
+Object.defineProperty(exports, "defaultRuleMap", { enumerable: true, get: function () { return resolve_1.defaultRuleMap; } });
+Object.defineProperty(exports, "matchTablePattern", { enumerable: true, get: function () { return resolve_1.matchTablePattern; } });
+Object.defineProperty(exports, "resolveRules", { enumerable: true, get: function () { return resolve_1.resolveRules; } });
+Object.defineProperty(exports, "ruleCodesForDimension", { enumerable: true, get: function () { return resolve_1.ruleCodesForDimension; } });
+Object.defineProperty(exports, "rulesForTable", { enumerable: true, get: function () { return resolve_1.rulesForTable; } });
+var schema_1 = require("./config/schema");
+Object.defineProperty(exports, "CONFIG_SHAPE", { enumerable: true, get: function () { return schema_1.CONFIG_SHAPE; } });
+Object.defineProperty(exports, "SCHEMA_ID", { enumerable: true, get: function () { return schema_1.SCHEMA_ID; } });
+Object.defineProperty(exports, "toJsonSchema", { enumerable: true, get: function () { return schema_1.toJsonSchema; } });
+var validate_1 = require("./config/validate");
+Object.defineProperty(exports, "validateConfigShape", { enumerable: true, get: function () { return validate_1.validateConfigShape; } });
+var corpus_1 = require("./corpus");
+Object.defineProperty(exports, "corpusBootstrap", { enumerable: true, get: function () { return corpus_1.corpusBootstrap; } });
+Object.defineProperty(exports, "corpusDir", { enumerable: true, get: function () { return corpus_1.corpusDir; } });
+Object.defineProperty(exports, "gradeCase", { enumerable: true, get: function () { return corpus_1.gradeCase; } });
+Object.defineProperty(exports, "loadCase", { enumerable: true, get: function () { return corpus_1.loadCase; } });
+Object.defineProperty(exports, "loadCorpus", { enumerable: true, get: function () { return corpus_1.loadCorpus; } });
+var adapters_1 = require("./exposure/adapters");
+Object.defineProperty(exports, "BUILTIN_ADAPTERS", { enumerable: true, get: function () { return adapters_1.BUILTIN_ADAPTERS; } });
+Object.defineProperty(exports, "constructiveAdapter", { enumerable: true, get: function () { return adapters_1.constructiveAdapter; } });
+Object.defineProperty(exports, "definePlanes", { enumerable: true, get: function () { return adapters_1.definePlanes; } });
+Object.defineProperty(exports, "graphileAdapter", { enumerable: true, get: function () { return adapters_1.graphileAdapter; } });
+Object.defineProperty(exports, "hasuraAdapter", { enumerable: true, get: function () { return adapters_1.hasuraAdapter; } });
+Object.defineProperty(exports, "postgraphileAdapter", { enumerable: true, get: function () { return adapters_1.postgraphileAdapter; } });
+Object.defineProperty(exports, "postgrestAdapter", { enumerable: true, get: function () { return adapters_1.postgrestAdapter; } });
+Object.defineProperty(exports, "resolveAdapters", { enumerable: true, get: function () { return adapters_1.resolveAdapters; } });
+Object.defineProperty(exports, "supabaseAdapter", { enumerable: true, get: function () { return adapters_1.supabaseAdapter; } });
+var planes_1 = require("./exposure/planes");
+Object.defineProperty(exports, "onPlane", { enumerable: true, get: function () { return planes_1.onPlane; } });
+Object.defineProperty(exports, "relationKey", { enumerable: true, get: function () { return planes_1.relationKey; } });
+Object.defineProperty(exports, "resolvePlaneReach", { enumerable: true, get: function () { return planes_1.resolvePlaneReach; } });
+Object.defineProperty(exports, "scorePlane", { enumerable: true, get: function () { return planes_1.scorePlane; } });
+Object.defineProperty(exports, "stampPlanes", { enumerable: true, get: function () { return planes_1.stampPlanes; } });
+var reach_1 = require("./exposure/reach");
+Object.defineProperty(exports, "BACKWARD_ABILITIES", { enumerable: true, get: function () { return reach_1.BACKWARD_ABILITIES; } });
+Object.defineProperty(exports, "computeApiReach", { enumerable: true, get: function () { return reach_1.computeApiReach; } });
+Object.defineProperty(exports, "FORWARD_ABILITIES", { enumerable: true, get: function () { return reach_1.FORWARD_ABILITIES; } });
+Object.defineProperty(exports, "ROOT_ABILITIES", { enumerable: true, get: function () { return reach_1.ROOT_ABILITIES; } });
+var baseline_3 = require("./perf/baseline");
+Object.defineProperty(exports, "diffPerf", { enumerable: true, get: function () { return baseline_3.diffPerf; } });
+Object.defineProperty(exports, "findingKey", { enumerable: true, get: function () { return baseline_3.findingKey; } });
+Object.defineProperty(exports, "parsePerfBaseline", { enumerable: true, get: function () { return baseline_3.parsePerfBaseline; } });
+Object.defineProperty(exports, "serializePerfBaseline", { enumerable: true, get: function () { return baseline_3.serializePerfBaseline; } });
+Object.defineProperty(exports, "subjectOf", { enumerable: true, get: function () { return baseline_3.subjectOf; } });
+Object.defineProperty(exports, "toBaselineFinding", { enumerable: true, get: function () { return baseline_3.toBaselineFinding; } });
+Object.defineProperty(exports, "toPerfBaseline", { enumerable: true, get: function () { return baseline_3.toPerfBaseline; } });
+var explain_1 = require("./perf/explain");
+Object.defineProperty(exports, "proveFindings", { enumerable: true, get: function () { return explain_1.proveFindings; } });
+var acl_1 = require("./pg/acl");
+Object.defineProperty(exports, "introspectRoleGraph", { enumerable: true, get: function () { return acl_1.introspectRoleGraph; } });
+Object.defineProperty(exports, "introspectSchemaAcls", { enumerable: true, get: function () { return acl_1.introspectSchemaAcls; } });
+var exposure_1 = require("./pg/exposure");
+Object.defineProperty(exports, "resolveConstructiveExposure", { enumerable: true, get: function () { return exposure_1.resolveConstructiveExposure; } });
+Object.defineProperty(exports, "resolveExposure", { enumerable: true, get: function () { return exposure_1.resolveExposure; } });
+Object.defineProperty(exports, "resolvePlanes", { enumerable: true, get: function () { return exposure_1.resolvePlanes; } });
+Object.defineProperty(exports, "resolveReach", { enumerable: true, get: function () { return exposure_1.resolveReach; } });
+Object.defineProperty(exports, "UNKNOWN_EXPOSURE", { enumerable: true, get: function () { return exposure_1.UNKNOWN_EXPOSURE; } });
+var functions_1 = require("./pg/functions");
+Object.defineProperty(exports, "introspectFunctions", { enumerable: true, get: function () { return functions_1.introspectFunctions; } });
+var indexes_2 = require("./pg/indexes");
+Object.defineProperty(exports, "introspectIndexes", { enumerable: true, get: function () { return indexes_2.introspectIndexes; } });
+Object.defineProperty(exports, "introspectViews", { enumerable: true, get: function () { return indexes_2.introspectViews; } });
+var introspect_1 = require("./pg/introspect");
+Object.defineProperty(exports, "introspectTables", { enumerable: true, get: function () { return introspect_1.introspectTables; } });
+var objects_1 = require("./pg/objects");
+Object.defineProperty(exports, "introspectObjectAcls", { enumerable: true, get: function () { return objects_1.introspectObjectAcls; } });
+var roles_1 = require("./pg/roles");
+Object.defineProperty(exports, "listAuditableRoles", { enumerable: true, get: function () { return roles_1.listAuditableRoles; } });
+Object.defineProperty(exports, "resolveRoles", { enumerable: true, get: function () { return roles_1.resolveRoles; } });
+var stats_2 = require("./pg/stats");
+Object.defineProperty(exports, "introspectStats", { enumerable: true, get: function () { return stats_2.introspectStats; } });
+var callgraph_1 = require("./report/callgraph");
+Object.defineProperty(exports, "renderCallGraph", { enumerable: true, get: function () { return callgraph_1.renderCallGraph; } });
+Object.defineProperty(exports, "renderCallGraphDiff", { enumerable: true, get: function () { return callgraph_1.renderCallGraphDiff; } });
+var compare_1 = require("./report/compare");
+Object.defineProperty(exports, "baselineLabel", { enumerable: true, get: function () { return compare_1.baselineLabel; } });
+Object.defineProperty(exports, "compareReports", { enumerable: true, get: function () { return compare_1.compareReports; } });
+Object.defineProperty(exports, "describeBaseline", { enumerable: true, get: function () { return compare_1.describeBaseline; } });
+Object.defineProperty(exports, "formatAge", { enumerable: true, get: function () { return compare_1.formatAge; } });
+Object.defineProperty(exports, "formatDelta", { enumerable: true, get: function () { return compare_1.formatDelta; } });
+Object.defineProperty(exports, "parseSnapshot", { enumerable: true, get: function () { return compare_1.parseSnapshot; } });
+Object.defineProperty(exports, "serializeSnapshot", { enumerable: true, get: function () { return compare_1.serializeSnapshot; } });
+Object.defineProperty(exports, "toSnapshot", { enumerable: true, get: function () { return compare_1.toSnapshot; } });
+var github_2 = require("./report/github");
+Object.defineProperty(exports, "COMMENT_MARKER", { enumerable: true, get: function () { return github_2.COMMENT_MARKER; } });
+Object.defineProperty(exports, "emitGithub", { enumerable: true, get: function () { return github_2.emitGithub; } });
+Object.defineProperty(exports, "gradeBadge", { enumerable: true, get: function () { return github_2.gradeBadge; } });
+Object.defineProperty(exports, "postStickyComment", { enumerable: true, get: function () { return github_2.postStickyComment; } });
+Object.defineProperty(exports, "renderAnnotations", { enumerable: true, get: function () { return github_2.renderAnnotations; } });
+Object.defineProperty(exports, "renderGithubComment", { enumerable: true, get: function () { return github_2.renderGithubComment; } });
+Object.defineProperty(exports, "renderGithubSummary", { enumerable: true, get: function () { return github_2.renderGithubSummary; } });
+Object.defineProperty(exports, "scoreBadge", { enumerable: true, get: function () { return github_2.scoreBadge; } });
+var json_1 = require("./report/json");
+Object.defineProperty(exports, "renderJson", { enumerable: true, get: function () { return json_1.renderJson; } });
+var markdown_1 = require("./report/markdown");
+Object.defineProperty(exports, "renderMarkdown", { enumerable: true, get: function () { return markdown_1.renderMarkdown; } });
+var pretty_1 = require("./report/pretty");
+Object.defineProperty(exports, "renderPretty", { enumerable: true, get: function () { return pretty_1.renderPretty; } });
+var sarif_1 = require("./report/sarif");
+Object.defineProperty(exports, "buildSourceIndex", { enumerable: true, get: function () { return sarif_1.buildSourceIndex; } });
+Object.defineProperty(exports, "renderSarif", { enumerable: true, get: function () { return sarif_1.renderSarif; } });
+var view_1 = require("./report/view");
+Object.defineProperty(exports, "ALL_SECTIONS", { enumerable: true, get: function () { return view_1.ALL_SECTIONS; } });
+Object.defineProperty(exports, "matchPlane", { enumerable: true, get: function () { return view_1.matchPlane; } });
+Object.defineProperty(exports, "selectView", { enumerable: true, get: function () { return view_1.selectView; } });
+Object.defineProperty(exports, "viewConfigFromReportConfig", { enumerable: true, get: function () { return view_1.viewConfigFromReportConfig; } });
+var registry_1 = require("./rules/registry");
+Object.defineProperty(exports, "dimensionOf", { enumerable: true, get: function () { return registry_1.dimensionOf; } });
+Object.defineProperty(exports, "expandRuleSelector", { enumerable: true, get: function () { return registry_1.expandRuleSelector; } });
+Object.defineProperty(exports, "isKnownRule", { enumerable: true, get: function () { return registry_1.isKnownRule; } });
+Object.defineProperty(exports, "RULES", { enumerable: true, get: function () { return registry_1.RULES; } });
+Object.defineProperty(exports, "RULES_BY_CODE", { enumerable: true, get: function () { return registry_1.RULES_BY_CODE; } });
+var score_1 = require("./score/score");
+Object.defineProperty(exports, "computeScore", { enumerable: true, get: function () { return score_1.computeScore; } });
+Object.defineProperty(exports, "DEFAULT_GRADE_BANDS", { enumerable: true, get: function () { return score_1.DEFAULT_GRADE_BANDS; } });
+Object.defineProperty(exports, "DEFAULT_WEIGHTS", { enumerable: true, get: function () { return score_1.DEFAULT_WEIGHTS; } });
+Object.defineProperty(exports, "meetsGrade", { enumerable: true, get: function () { return score_1.meetsGrade; } });
+__exportStar(require("./types"), exports);

package/lint/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Source-level SQL/PL/pgSQL convention linter.
+ *
+ * This module used to carry safegres's own copy of the linter. It now lives in
+ * the standalone `@pgsql/lint` package (source text in → findings out, no `pg`
+ * dependency); safegres consumes it as "the catalog adapter", feeding it the
+ * `pg_get_functiondef` text it already reads. This file is a thin re-export so
+ * the rest of safegres keeps importing from `../lint` unchanged.
+ */
+export type { DynamicSqlSite, LintOptions, LintProblem, LintResult, LintRule, LintRuleMeta, LintUnit, SqlFragment, SuppressedProblem, SuppressionScope } from '@pgsql/lint';
+export { LINT_RULES, LINT_RULES_BY_CODE, LINT_RULES_BY_ID, lintDefinition, parseUnit, Suppressions } from '@pgsql/lint';

package/lint/index.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Source-level SQL/PL/pgSQL convention linter.
+ *
+ * This module used to carry safegres's own copy of the linter. It now lives in
+ * the standalone `@pgsql/lint` package (source text in → findings out, no `pg`
+ * dependency); safegres consumes it as "the catalog adapter", feeding it the
+ * `pg_get_functiondef` text it already reads. This file is a thin re-export so
+ * the rest of safegres keeps importing from `../lint` unchanged.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Suppressions = exports.parseUnit = exports.lintDefinition = exports.LINT_RULES_BY_ID = exports.LINT_RULES_BY_CODE = exports.LINT_RULES = void 0;
+var lint_1 = require("@pgsql/lint");
+Object.defineProperty(exports, "LINT_RULES", { enumerable: true, get: function () { return lint_1.LINT_RULES; } });
+Object.defineProperty(exports, "LINT_RULES_BY_CODE", { enumerable: true, get: function () { return lint_1.LINT_RULES_BY_CODE; } });
+Object.defineProperty(exports, "LINT_RULES_BY_ID", { enumerable: true, get: function () { return lint_1.LINT_RULES_BY_ID; } });
+Object.defineProperty(exports, "lintDefinition", { enumerable: true, get: function () { return lint_1.lintDefinition; } });
+Object.defineProperty(exports, "parseUnit", { enumerable: true, get: function () { return lint_1.parseUnit; } });
+Object.defineProperty(exports, "Suppressions", { enumerable: true, get: function () { return lint_1.Suppressions; } });

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@safegres/test",
-  "version": "0.0.2",
-  "author": "Dan Lynch <pyramation@gmail.com>",
-  "description": "safegres offers isolated, role-aware, and rollback-friendly PostgreSQL environments for integration tests — giving developers realistic test coverage without external state pollution",
+  "version": "1.30.7",
+  "author": "Constructive <developers@constructive.io>",
+  "description": "Postgres security and performance auditor: RLS, grants and effective-access analysis plus index and policy-cost checks, scored on two independent axes. One connection, no framework.",
   "main": "index.js",
   "module": "esm/index.js",
   "types": "index.d.ts",
-  "homepage": "https://github.com/launchql/launchql",
+  "homepage": "https://github.com/constructive-io/constructive",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
@@ -14,59 +14,65 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/launchql/launchql"
+    "url": "https://github.com/constructive-io/constructive"
   },
   "bugs": {
-    "url": "https://github.com/launchql/launchql/issues"
+    "url": "https://github.com/constructive-io/constructive/issues"
+  },
+  "bin": {
+    "safegres": "cli.js"
   },
   "keywords": [
     "postgres",
     "postgresql",
-    "testing",
-    "integration-tests",
-    "database-testing",
-    "pg",
+    "database",
+    "security",
+    "performance",
     "rls",
-    "role-based-access",
-    "test-database",
-    "test-runner",
-    "jest",
-    "mocha",
-    "sqitch",
-    "launchql",
-    "graphile",
-    "typeorm",
-    "knex",
-    "seed",
-    "fixtures",
-    "transactions",
-    "rollback",
-    "node-postgres",
-    "pg-pool",
-    "pg-client"
+    "row-level-security",
+    "audit",
+    "auditor",
+    "linter",
+    "static-analysis",
+    "index",
+    "indexing",
+    "query-performance",
+    "explain",
+    "grants",
+    "policy",
+    "sarif",
+    "ci",
+    "devsecops",
+    "dba",
+    "safegres"
   ],
-  "scripts": {
-    "copy": "copyfiles -f ../../LICENSE README.md package.json dist",
-    "clean": "rimraf dist/**",
-    "prepare": "npm run build",
-    "build": "npm run clean; tsc; tsc -p tsconfig.esm.json; npm run copy",
-    "build:dev": "npm run clean; tsc --declarationMap; tsc -p tsconfig.esm.json; npm run copy",
-    "lint": "eslint . --fix",
-    "test": "jest",
-    "test:watch": "jest --watch"
+  "dependencies": {
+    "@inquirerer/utils": "^3.3.13",
+    "@pgpmjs/logger": "^2.27.0",
+    "@pgsql/lint": "^18.3.5",
+    "@pgsql/traverse": "^18.8.3",
+    "@pgsql/types": "^18.0.0",
+    "confstash": "^0.1.2",
+    "inquirerer": "^4.9.4",
+    "libpg-query": "^18.2.0",
+    "pg": "^8.21.0",
+    "pg-env": "^1.33.0",
+    "pgsql-deparser": "^18.4.3",
+    "pgsql-parser": "^18.3.3",
+    "yanse": "^0.2.2"
   },
-  "devDependencies": {
-    "@types/pg": "^8.15.2",
-    "@types/pg-copy-streams": "^1.2.5"
+  "peerDependencies": {
+    "pgsql-test": "*"
   },
-  "dependencies": {
-    "@launchql/core": "^2.11.1",
-    "@launchql/env": "^2.4.1",
-    "@launchql/server-utils": "^2.4.1",
-    "@launchql/types": "^2.6.0",
-    "pg": "^8.16.0",
-    "pg-cache": "^1.3.1",
-    "pg-copy-streams": "^6.0.6",
-    "pg-env": "^1.1.0"
+  "peerDependenciesMeta": {
+    "pgsql-test": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/pg": "^8.20.4",
+    "makage": "^0.8.0",
+    "pgsql-test": "^5.20.6"
   }
 }

package/perf/baseline.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Perf baseline: a committed snapshot of accepted performance debt.
+ *
+ * The point is the ratchet. A large schema will not reach a clean perf report
+ * in one pass, but it can refuse to get worse: commit the current findings,
+ * then fail CI only on findings that are *not* in the baseline.
+ *
+ * Only the identity of a finding is stored — code, relation, policy, and the
+ * one context field that distinguishes findings of the same code on the same
+ * relation. Messages, severities and hints may be reworded between safegres
+ * versions without invalidating a committed baseline.
+ */
+import type { Finding } from '../types';
+export interface PerfBaseline {
+    version: 1;
+    findings: BaselineFinding[];
+}
+export interface BaselineFinding {
+    code: string;
+    schema?: string;
+    table?: string;
+    policy?: string;
+    /** The rule-specific subject: constraint, index, column, expression, or function. */
+    subject?: string;
+}
+export interface PerfDiff {
+    /** Findings present now but absent from the baseline — new debt. */
+    added: Finding[];
+    /** Baseline entries no longer produced — fixed, or the relation is gone. */
+    removed: BaselineFinding[];
+    /** Findings that matched the baseline — accepted debt, still reported. */
+    accepted: Finding[];
+}
+export declare function subjectOf(finding: Finding): string | undefined;
+export declare function findingKey(entry: BaselineFinding): string;
+export declare function toBaselineFinding(finding: Finding): BaselineFinding;
+export declare function toPerfBaseline(findings: Finding[]): PerfBaseline;
+export declare function diffPerf(findings: Finding[], baseline: PerfBaseline): PerfDiff;
+export declare function parsePerfBaseline(raw: string): PerfBaseline;
+export declare function serializePerfBaseline(baseline: PerfBaseline): string;

package/perf/baseline.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * Perf baseline: a committed snapshot of accepted performance debt.
+ *
+ * The point is the ratchet. A large schema will not reach a clean perf report
+ * in one pass, but it can refuse to get worse: commit the current findings,
+ * then fail CI only on findings that are *not* in the baseline.
+ *
+ * Only the identity of a finding is stored — code, relation, policy, and the
+ * one context field that distinguishes findings of the same code on the same
+ * relation. Messages, severities and hints may be reworded between safegres
+ * versions without invalidating a committed baseline.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.subjectOf = subjectOf;
+exports.findingKey = findingKey;
+exports.toBaselineFinding = toBaselineFinding;
+exports.toPerfBaseline = toPerfBaseline;
+exports.diffPerf = diffPerf;
+exports.parsePerfBaseline = parsePerfBaseline;
+exports.serializePerfBaseline = serializePerfBaseline;
+/**
+ * Context keys that identify *which* object a finding is about, in priority
+ * order (X3 carries both `expression` and `column`; the expression is the
+ * narrower identity). Rules that can only fire once per relation — X6 — set
+ * none of these and are keyed by code + relation alone.
+ */
+const SUBJECT_KEYS = ['constraint', 'index', 'expression', 'column', 'function'];
+function subjectOf(finding) {
+    const context = finding.context;
+    if (!context)
+        return undefined;
+    for (const key of SUBJECT_KEYS) {
+        const value = context[key];
+        if (typeof value === 'string' && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+function findingKey(entry) {
+    return [entry.code, entry.schema ?? '', entry.table ?? '', entry.policy ?? '', entry.subject ?? ''].join('|');
+}
+function toBaselineFinding(finding) {
+    const subject = subjectOf(finding);
+    return {
+        code: finding.code,
+        ...(finding.schema ? { schema: finding.schema } : {}),
+        ...(finding.table ? { table: finding.table } : {}),
+        ...(finding.policy ? { policy: finding.policy } : {}),
+        ...(subject ? { subject } : {})
+    };
+}
+function toPerfBaseline(findings) {
+    const seen = new Set();
+    const out = [];
+    for (const finding of findings) {
+        const entry = toBaselineFinding(finding);
+        const key = findingKey(entry);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(entry);
+    }
+    out.sort((a, b) => findingKey(a).localeCompare(findingKey(b)));
+    return { version: 1, findings: out };
+}
+function diffPerf(findings, baseline) {
+    const baseKeys = new Set(baseline.findings.map(findingKey));
+    const currentKeys = new Set();
+    const added = [];
+    const accepted = [];
+    for (const finding of findings) {
+        const key = findingKey(toBaselineFinding(finding));
+        currentKeys.add(key);
+        if (baseKeys.has(key))
+            accepted.push(finding);
+        else
+            added.push(finding);
+    }
+    const removed = baseline.findings.filter((entry) => !currentKeys.has(findingKey(entry)));
+    return { added, removed, accepted };
+}
+function parsePerfBaseline(raw) {
+    const data = JSON.parse(raw);
+    if (data.version !== 1 || !Array.isArray(data.findings)) {
+        throw new Error('invalid perf baseline: expected { version: 1, findings: [...] }');
+    }
+    return { version: 1, findings: data.findings };
+}
+function serializePerfBaseline(baseline) {
+    return JSON.stringify(baseline, null, 2) + '\n';
+}

package/perf/explain.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Proof by EXPLAIN (`--explain`).
+ *
+ * The `X*` rules infer from the catalog that a query *shape* has no index to
+ * serve it. This turns the inference into evidence: for each finding that has
+ * a probe shape, plan the query the finding is about and read the plan back.
+ *
+ * The planner is the authority, so the interesting outcome is disagreement —
+ * a finding whose probe plans as an index scan is **refuted** (some index the
+ * catalog rules didn't credit does serve it) and stops counting against the
+ * score. The reverse is not symmetrical: an empty or unanalyzed table always
+ * seq-scans, so a seq scan only *confirms* a finding above the row floor;
+ * below it the probe is inconclusive and the finding is left exactly as it
+ * was.
+ *
+ * Probes use `EXPLAIN (GENERIC_PLAN)` — parameters stay parameters, nothing
+ * is executed, and no value has to be invented for a column whose domain we
+ * know nothing about. That requires PostgreSQL 16+.
+ */
+import type { TableIndexSnapshot } from '../pg/indexes';
+import type { QueryExecutor } from '../pg/introspect';
+import type { Finding } from '../types';
+export interface ExplainOptions {
+    /**
+     * Below this planner row estimate a sequential scan is the correct plan, so
+     * a seq-scan result proves nothing. Default 1000.
+     */
+    minRows?: number;
+}
+export interface ExplainReport {
+    /** Findings that were probed. */
+    probed: number;
+    /** Probes whose plan showed the scan the finding predicted. */
+    confirmed: number;
+    /** Probes the planner served with an index — the finding was wrong. */
+    refuted: number;
+    /** Probes on tables too small for the plan to mean anything. */
+    inconclusive: number;
+    /** Why probing was skipped entirely, when it was. */
+    unavailable?: string;
+}
+/**
+ * Plan a probe for every probeable perf finding and annotate it in place.
+ * Findings the planner refutes are acknowledged (reported, unscored).
+ */
+export declare function proveFindings(exec: QueryExecutor, findings: Finding[], tables: Map<string, TableIndexSnapshot>, options?: ExplainOptions): Promise<ExplainReport>;