@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/cjs/cli/doctor/checks.js

@@ -0,0 +1,677 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PG_ROLE_CHECK_NAME = exports.SECURE_CONFIG_MODE = exports.SECURE_CONFIG_FILES = void 0;
+exports.checkSwAgentDirExists = checkSwAgentDirExists;
+exports.checkMachineConfigValid = checkMachineConfigValid;
+exports.checkTokenFormat = checkTokenFormat;
+exports.checkDatabasesConfigValid = checkDatabasesConfigValid;
+exports.checkDatabasesReachable = checkDatabasesReachable;
+exports.inspectConfigFileModes = inspectConfigFileModes;
+exports.formatMode = formatMode;
+exports.checkConfigFilePermissions = checkConfigFilePermissions;
+exports.checkAuditDirWritable = checkAuditDirWritable;
+exports.checkAuditChain = checkAuditChain;
+exports.ensureAuditDirForDoctor = ensureAuditDirForDoctor;
+exports.checkDiskSpace = checkDiskSpace;
+exports.pgRoleFindings = pgRoleFindings;
+exports.checkPgRoleLeastPrivilege = checkPgRoleLeastPrivilege;
+exports.checkNodeVersion = checkNodeVersion;
+exports.checkPidFile = checkPidFile;
+exports.runAllChecks = runAllChecks;
+const pid_file_1 = require("../daemon/pid-file");
+const pg_1 = require("pg");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const files_1 = require("../../audit/files");
+const verify_cache_1 = require("../../audit/verify-cache");
+const pool_1 = require("../../execution/pool");
+const role_policy_1 = require("../../permissions/role-policy");
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+async function checkSwAgentDirExists(ctx) {
+    try {
+        const fs_ = await Promise.resolve().then(() => __importStar(require('fs/promises')));
+        const stat = await fs_.stat(ctx.swAgentDir);
+        if (stat.isDirectory()) {
+            return { name: 'SW Agent directory exists', status: 'pass' };
+        }
+        return { name: 'SW Agent directory exists', status: 'fail', detail: 'Not a directory' };
+    }
+    catch {
+        return {
+            name: 'SW Agent directory exists',
+            status: 'fail',
+            detail: 'Directory does not exist',
+        };
+    }
+}
+async function checkMachineConfigValid(ctx) {
+    if (!ctx.machineConfig) {
+        return {
+            name: 'Machine config valid',
+            status: 'fail',
+            detail: 'Config file missing or invalid',
+        };
+    }
+    if (!ctx.machineConfig.agent_token) {
+        return { name: 'Machine config valid', status: 'fail', detail: 'Missing agent_token' };
+    }
+    return {
+        name: 'Machine config valid',
+        status: 'pass',
+        detail: `Agent ID: ${ctx.machineConfig.agent_id}`,
+    };
+}
+async function checkTokenFormat(ctx) {
+    if (!ctx.machineConfig?.agent_token) {
+        return { name: 'Token format', status: 'fail', detail: 'No token to check' };
+    }
+    const token = ctx.machineConfig.agent_token;
+    const pattern = /^swagt_[A-Za-z0-9]{32}$/;
+    if (pattern.test(token)) {
+        return { name: 'Token format', status: 'pass' };
+    }
+    if (!token.startsWith('swagt_')) {
+        return { name: 'Token format', status: 'fail', detail: 'Token must start with "swagt_"' };
+    }
+    const body = token.slice(6);
+    if (body.length < 32) {
+        return {
+            name: 'Token format',
+            status: 'fail',
+            detail: `Token body too short (${body.length} chars, expected 32)`,
+        };
+    }
+    if (body.length > 32) {
+        return {
+            name: 'Token format',
+            status: 'fail',
+            detail: `Token body too long (${body.length} chars, expected 32)`,
+        };
+    }
+    if (!/^[A-Za-z0-9]+$/.test(body)) {
+        return {
+            name: 'Token format',
+            status: 'fail',
+            detail: 'Token body contains invalid characters (must be base62)',
+        };
+    }
+    return { name: 'Token format', status: 'pass' };
+}
+async function checkDatabasesConfigValid(ctx) {
+    if (!ctx.databasesConfig) {
+        return {
+            name: 'Databases config valid',
+            status: 'fail',
+            detail: 'Config file missing or invalid',
+        };
+    }
+    if (ctx.databasesConfig.databases.length === 0) {
+        return { name: 'Databases config valid', status: 'warn', detail: 'No databases configured' };
+    }
+    return {
+        name: 'Databases config valid',
+        status: 'pass',
+        detail: `${ctx.databasesConfig.databases.length} database(s) configured`,
+    };
+}
+async function checkDatabasesReachable(ctx) {
+    if (!ctx.databasesConfig || ctx.databasesConfig.databases.length === 0) {
+        return {
+            name: 'Databases reachable',
+            status: 'warn',
+            detail: 'No databases configured to test',
+        };
+    }
+    const results = [];
+    for (const db of ctx.databasesConfig.databases) {
+        try {
+            const password = db.password_stored || (db.password_env ? process.env[db.password_env] : undefined);
+            if (!password) {
+                results.push({ alias: db.db_alias, ok: false, detail: 'No password configured' });
+                continue;
+            }
+            const poolConfig = {
+                host: db.host,
+                port: db.port,
+                database: db.database,
+                user: db.user,
+                password,
+                connectionTimeoutMillis: 5000,
+            };
+            // Same negotiator the pool uses, so doctor cannot report a healthy
+            // private-CA database as unreachable. An inlined copy of this logic was
+            // the bug: it dropped the CA, and used the system trust store instead.
+            poolConfig.ssl = (0, pool_1.buildSslConfig)(db.ssl_mode, db.ssl_root_cert, db.host);
+            const pool = new pg_1.Pool(poolConfig);
+            try {
+                await Promise.race([
+                    pool.query('SELECT 1'),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), 5000)),
+                ]);
+                results.push({ alias: db.db_alias, ok: true, detail: 'Connected' });
+            }
+            catch (err) {
+                results.push({ alias: db.db_alias, ok: false, detail: errorText(err) });
+            }
+            finally {
+                await pool.end();
+            }
+        }
+        catch (err) {
+            results.push({ alias: db.db_alias, ok: false, detail: errorText(err) });
+        }
+    }
+    const allOk = results.every((r) => r.ok);
+    if (allOk) {
+        return {
+            name: 'Databases reachable',
+            status: 'pass',
+            detail: `${results.length} database(s) connected`,
+        };
+    }
+    const failed = results.filter((r) => !r.ok);
+    return {
+        name: 'Databases reachable',
+        status: 'fail',
+        detail: `${failed.length} database(s) failed: ${failed.map((f) => f.alias).join(', ')}`,
+    };
+}
+/**
+ * Files whose contents are credential material and which must therefore be
+ * readable only by their owner.
+ */
+exports.SECURE_CONFIG_FILES = ['sw-agent.config.json', 'databases.config.json'];
+/** Mode every config file must have: read/write for the owner, nothing else. */
+exports.SECURE_CONFIG_MODE = 0o600;
+/**
+ * Resolve the real config file paths and read their modes. Does not follow
+ * symlinks for the permission read: a symlinked config is reported as
+ * irregular rather than silently checking whatever it points at.
+ */
+function inspectConfigFileModes(swAgentDir) {
+    return exports.SECURE_CONFIG_FILES.map((name) => {
+        const p = path.join(swAgentDir, name);
+        const base = { name, path: p };
+        let st;
+        try {
+            st = fs.lstatSync(p);
+        }
+        catch {
+            return { ...base, mode: null, irregular: false, exists: false };
+        }
+        if (st.isSymbolicLink() || !st.isFile()) {
+            return { ...base, mode: st.mode & 0o777, irregular: true, exists: true };
+        }
+        return { ...base, mode: st.mode & 0o777, irregular: false, exists: true };
+    });
+}
+function formatMode(mode) {
+    return '0o' + mode.toString(8);
+}
+/**
+ * Check that the config files are owner-only (0o600).
+ *
+ * `databases.config.json` holds encrypted database passwords and
+ * `sw-agent.config.json` holds the agent token that authenticates this agent to
+ * the cloud. A group- or world-readable copy of either is a credential
+ * disclosure to every other local user, so a 0o644 config FAILS here rather
+ * than producing a warning. Missing files are reported as a warning: their
+ * absence is covered by the config-validity checks.
+ */
+async function checkConfigFilePermissions(ctx) {
+    const name = 'Config file permissions';
+    if (ctx.platform === 'win32') {
+        return { name, status: 'warn', detail: 'Skipped (POSIX modes do not apply on Windows)' };
+    }
+    const inspected = inspectConfigFileModes(ctx.swAgentDir);
+    const present = inspected.filter((f) => f.exists);
+    if (present.length === 0) {
+        return { name, status: 'warn', detail: 'No config files found to check' };
+    }
+    const irregular = present.filter((f) => f.irregular);
+    const loose = present.filter((f) => !f.irregular && f.mode !== exports.SECURE_CONFIG_MODE);
+    if (irregular.length > 0 || loose.length > 0) {
+        const problems = [];
+        for (const f of irregular) {
+            problems.push(`${f.name} is not a regular file (symlink or special file)`);
+        }
+        for (const f of loose) {
+            problems.push(`${f.name} is ${formatMode(f.mode)}, expected ${formatMode(exports.SECURE_CONFIG_MODE)}`);
+        }
+        return {
+            name,
+            status: 'fail',
+            detail: `${problems.join('; ')}. Other local users can read credential material. Run 'sw-agent doctor --fix'.`,
+        };
+    }
+    const modes = present.map((f) => `${f.name} ${formatMode(f.mode)}`).join(', ');
+    return { name, status: 'pass', detail: modes };
+}
+async function checkAuditDirWritable(ctx) {
+    const auditDir = path.join(ctx.swAgentDir, 'audit');
+    const probe = await (0, files_1.probeAuditDir)(auditDir);
+    const mode = formatMode(probe.dirMode);
+    if (!probe.ok) {
+        return {
+            name: `Audit directory writable (mode ${mode})`,
+            status: 'fail',
+            detail: probe.reason,
+        };
+    }
+    return {
+        name: `Audit directory writable (mode ${mode})`,
+        status: 'pass',
+        detail: probe.repaired ? 'repaired mode (was untraversable)' : 'append + fsync verified',
+    };
+}
+/**
+ * Verifies the existing audit log against its anchor. A log that does not
+ * verify is reported as a failure, not a warning: an operator running `doctor`
+ * is exactly the person who needs to be told.
+ *
+ * This is the one caller that reuses {@link verifyAuditDirCached}: an operator
+ * running `doctor` repeatedly in the same shell re-verifies an unchanged log
+ * over and over, and the archives are the bulk of it. A reused file is only
+ * skipped when it is byte-identical to what was verified (dev/inode/size/mtime
+ * *and* ctime, at nanosecond precision), when the entry was verified from the
+ * chain state the walk is resuming into, when it was verified with the same
+ * signing key, and — for the end of the log — when the tail record on disk is
+ * still the record that was verified. The anchors are re-read from disk on
+ * every call. The result always says how much it did *not* read, so a pass
+ * backed by the cache can never look like a full re-read.
+ */
+async function checkAuditChain(ctx) {
+    const auditDir = path.join(ctx.swAgentDir, 'audit');
+    let hasLog = false;
+    try {
+        hasLog = fs
+            .readdirSync(auditDir)
+            .some((e) => e === 'audit.jsonl' || /^audit-\d+\.jsonl$/.test(e));
+    }
+    catch {
+        hasLog = false;
+    }
+    if (!hasLog) {
+        return {
+            name: 'Audit log integrity',
+            status: 'pass',
+            detail: 'no log yet (nothing to verify)',
+        };
+    }
+    try {
+        const verification = await (0, verify_cache_1.verifyAuditDirCached)(auditDir, { keyDir: ctx.swAgentDir });
+        if (verification.intact) {
+            return {
+                name: 'Audit log integrity',
+                status: 'pass',
+                detail: `${verification.events} record(s) verified against ` +
+                    `${verification.head_present ? 'head.json' : 'no anchor'}` +
+                    cacheNote(verification),
+            };
+        }
+        return {
+            name: 'Audit log integrity',
+            status: 'fail',
+            detail: `${verification.reason ?? 'failed'}: ${verification.detail ?? 'no detail'}`,
+        };
+    }
+    catch (err) {
+        return {
+            name: 'Audit log integrity',
+            status: 'fail',
+            detail: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/** Names the files a pass did not re-read. A cache hit is never silent. */
+function cacheNote(verification) {
+    const reused = verification.cached_files.length;
+    if (reused === 0)
+        return '';
+    const total = verification.files.length;
+    const when = verification.cached_since ? ` since ${verification.cached_since}` : '';
+    const reread = verification.verified_files.length;
+    return ` (${reused}/${total} file(s) unchanged${when}, ${reread} re-read)`;
+}
+/**
+ * Repairs an audit directory that exists with a mode that cannot be traversed.
+ * `mkdir({ recursive: true })` is a no-op on an existing directory, so without
+ * this the wrong mode is permanent and the audit log silently records nothing.
+ */
+async function ensureAuditDirForDoctor(ctx) {
+    const auditDir = path.join(ctx.swAgentDir, 'audit');
+    const before = await statMode(auditDir);
+    await (0, files_1.ensureAuditDir)(auditDir);
+    const after = await statMode(auditDir);
+    const fixed = before !== null && after !== null && before !== after;
+    return {
+        name: 'Audit directory permissions',
+        status: 'pass',
+        detail: fixed
+            ? `Repaired mode ${formatMode(before)} -> ${formatMode(after)}`
+            : `Mode ${formatMode(after ?? files_1.AUDIT_DIR_MODE)}`,
+    };
+}
+async function statMode(p) {
+    try {
+        const st = await fs.promises.stat(p);
+        return st.mode & 0o777;
+    }
+    catch {
+        return null;
+    }
+}
+async function checkDiskSpace(_ctx) {
+    return { name: 'Disk space', status: 'pass', detail: 'Skipped (platform check)' };
+}
+const ATTRIBUTE_RULE_RE = /^(\w+)\s*=\s*(true|false)$/;
+/** Attribute rules taken from the role policy, or the rules that could not be parsed. */
+function pgRoleAttributeRules() {
+    const rules = [];
+    const unparsed = [];
+    for (const entry of role_policy_1.RECOMMENDED_PG_ROLE.required_attributes) {
+        const m = ATTRIBUTE_RULE_RE.exec(entry.trim());
+        if (!m) {
+            unparsed.push(entry);
+            continue;
+        }
+        rules.push({ attribute: m[1], expect: m[2] === 'true' });
+    }
+    return { rules, unparsed };
+}
+/** The documented probe for `privilege`, e.g. TEMP on the database. */
+function privilegeProbeSql(fragment) {
+    const query = role_policy_1.RECOMMENDED_PG_ROLE.verification_queries.find((q) => q.sql.includes(fragment));
+    return query ? query.sql.trim() : null;
+}
+/** The value the policy documents for a probe whose expectation is a bare value. */
+function probeExpectedValue(fragment) {
+    const query = role_policy_1.RECOMMENDED_PG_ROLE.verification_queries.find((q) => q.sql.includes(fragment));
+    return query ? query.expect.trim().toLowerCase() : null;
+}
+/**
+ * Every way the connected role departs from {@link RECOMMENDED_PG_ROLE}, as
+ * human-readable findings. An empty array means the role is acceptable.
+ *
+ * Pure and fail-closed: an unanswered probe is itself a finding, because a probe
+ * that did not answer has not established anything.
+ */
+function pgRoleFindings(facts) {
+    const findings = [];
+    const { rules, unparsed } = pgRoleAttributeRules();
+    for (const entry of unparsed) {
+        findings.push(`role policy rule "${entry}" is not verifiable`);
+    }
+    if (rules.length === 0) {
+        findings.push('role policy declares no verifiable pg_roles attributes');
+    }
+    for (const rule of rules) {
+        const value = facts.attributes[rule.attribute];
+        if (value === null || value === undefined) {
+            findings.push(`${rule.attribute} could not be read`);
+        }
+        else if (value !== rule.expect) {
+            findings.push(`${rule.attribute}=${value} (expected ${rule.expect})`);
+        }
+    }
+    const mustBeFalse = [
+        ['TEMP on database', facts.can_create_temp],
+        ['CREATE on schema public', facts.can_create_in_public],
+    ];
+    for (const [label, value] of mustBeFalse) {
+        if (value === null)
+            findings.push(`${label} could not be read`);
+        else if (value)
+            findings.push(`${label} is granted`);
+    }
+    if (facts.forbidden_memberships.length > 0) {
+        findings.push(`member of ${facts.forbidden_memberships.join(', ')}`);
+    }
+    const expectedReadOnly = probeExpectedValue('default_transaction_read_only');
+    const readOnly = facts.default_transaction_read_only;
+    if (readOnly === null) {
+        findings.push('default_transaction_read_only could not be read');
+    }
+    else if (expectedReadOnly !== null && readOnly !== expectedReadOnly) {
+        findings.push(`default_transaction_read_only=${readOnly} (expected ${expectedReadOnly})`);
+    }
+    return findings;
+}
+/** The label the role check reports under. */
+exports.PG_ROLE_CHECK_NAME = `PostgreSQL role is least privilege (${role_policy_1.RECOMMENDED_PG_ROLE.role_name})`;
+/**
+ * Reads the least-privilege facts for one database.
+ *
+ * Membership uses `pg_has_role(..., 'MEMBER')` rather than the join in the
+ * policy's own query, which resolves inherited membership too: a grant through
+ * an intermediate group is the same privilege and must not read as clean.
+ */
+async function readPgRoleFacts(pool, alias, attributeNames) {
+    const columnList = attributeNames.length > 0 ? attributeNames.join(', ') : 'true';
+    const attrs = await pool.query(`SELECT current_user AS role, ${columnList} FROM pg_roles WHERE rolname = current_user`);
+    const row = attrs.rows[0];
+    const attributes = {};
+    for (const name of attributeNames) {
+        const value = row ? row[name] : undefined;
+        attributes[name] = typeof value === 'boolean' ? value : null;
+    }
+    const tempQuery = privilegeProbeSql('has_database_privilege');
+    const temp = tempQuery ? await pool.query(tempQuery) : undefined;
+    const createQuery = privilegeProbeSql('has_schema_privilege');
+    const create = createQuery ? await pool.query(createQuery) : undefined;
+    const memberships = await pool.query(`SELECT r.rolname AS name
+       FROM unnest($1::text[]) AS wanted(name)
+       JOIN pg_roles r ON r.rolname = wanted.name
+      WHERE pg_has_role(current_user, r.rolname, 'MEMBER')`, [[...role_policy_1.RECOMMENDED_PG_ROLE.forbidden_memberships]]);
+    const readOnly = await pool.query('SHOW default_transaction_read_only');
+    const firstBoolean = (result) => {
+        const value = result?.rows[0] ? Object.values(result.rows[0])[0] : undefined;
+        return typeof value === 'boolean' ? value : null;
+    };
+    const firstString = (result) => {
+        const value = result?.rows[0] ? Object.values(result.rows[0])[0] : undefined;
+        return typeof value === 'string' ? value.trim().toLowerCase() : null;
+    };
+    const roleValue = row ? row['role'] : undefined;
+    return {
+        alias,
+        role: typeof roleValue === 'string' ? roleValue : 'unknown',
+        attributes,
+        can_create_temp: firstBoolean(temp),
+        can_create_in_public: firstBoolean(create),
+        forbidden_memberships: memberships.rows.map((r) => r.name),
+        default_transaction_read_only: firstString(readOnly),
+    };
+}
+/**
+ * Verifies the connected PostgreSQL login role against
+ * {@link RECOMMENDED_PG_ROLE} (C-02).
+ *
+ * `read_only` constrains what the connector is willing to run; it cannot
+ * constrain what the login role is allowed to do. A `rolsuper` or
+ * `pg_read_server_files` role defeats every control above it, so the role is
+ * the only boundary an operator cannot route around from the wire.
+ *
+ * A violation is a failure, not a warning: the operator running `doctor` is
+ * exactly the person who needs to be told. A database that cannot be reached
+ * cannot clear the role, so it is reported as a warning naming what was not
+ * checked — never as a pass.
+ */
+async function checkPgRoleLeastPrivilege(ctx) {
+    const name = exports.PG_ROLE_CHECK_NAME;
+    if (!ctx.databasesConfig || ctx.databasesConfig.databases.length === 0) {
+        return {
+            name,
+            status: 'warn',
+            detail: 'Skipped: no databases configured, so there is no role to inspect',
+        };
+    }
+    const { rules, unparsed } = pgRoleAttributeRules();
+    if (unparsed.length > 0) {
+        return {
+            name,
+            status: 'fail',
+            detail: `Role policy rule(s) not verifiable: ${unparsed.join(', ')}`,
+        };
+    }
+    if (privilegeProbeSql('has_database_privilege') === null) {
+        return {
+            name,
+            status: 'fail',
+            detail: 'Role policy no longer documents the TEMP privilege probe',
+        };
+    }
+    if (privilegeProbeSql('has_schema_privilege') === null) {
+        return {
+            name,
+            status: 'fail',
+            detail: 'Role policy no longer documents the CREATE-on-public probe',
+        };
+    }
+    const attributeNames = rules.map((r) => r.attribute);
+    const findings = [];
+    const unchecked = [];
+    const checkedRoles = [];
+    for (const db of ctx.databasesConfig.databases) {
+        const alias = db.db_alias;
+        const password = db.password_stored || (db.password_env ? process.env[db.password_env] : undefined);
+        if (!password) {
+            unchecked.push(`${alias} (no password configured)`);
+            continue;
+        }
+        const poolConfig = {
+            host: db.host,
+            port: db.port,
+            database: db.database,
+            user: db.user,
+            password,
+            connectionTimeoutMillis: 5000,
+        };
+        try {
+            poolConfig.ssl = (0, pool_1.buildSslConfig)(db.ssl_mode, db.ssl_root_cert, db.host);
+        }
+        catch (err) {
+            unchecked.push(`${alias} (${errorText(err)})`);
+            continue;
+        }
+        const pool = new pg_1.Pool(poolConfig);
+        try {
+            await Promise.race([
+                pool.query('SELECT 1'),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), 5000)),
+            ]);
+            const facts = await readPgRoleFacts(pool, alias, attributeNames);
+            checkedRoles.push(`${alias}=${facts.role}`);
+            for (const finding of pgRoleFindings(facts)) {
+                findings.push(`${alias} (${facts.role}): ${finding}`);
+            }
+        }
+        catch (err) {
+            unchecked.push(`${alias} (${errorText(err)})`);
+        }
+        finally {
+            await pool.end();
+        }
+    }
+    if (findings.length > 0) {
+        const suffix = unchecked.length > 0
+            ? ` Not checked: ${unchecked.join(', ')}.`
+            : " Apply the role policy's bootstrap, revokes and grants statements once per database.";
+        return { name, status: 'fail', detail: findings.join('; ') + suffix };
+    }
+    if (checkedRoles.length === 0) {
+        return {
+            name,
+            status: 'warn',
+            detail: `Skipped: no database could be reached to inspect the role (${unchecked.join(', ') || 'no candidates'})`,
+        };
+    }
+    const suffix = unchecked.length > 0 ? ` Not checked: ${unchecked.join(', ')}.` : '';
+    return {
+        name,
+        status: 'pass',
+        detail: `${checkedRoles.join(', ')}: no superuser, no object creation, no server-file role, read-only sessions${suffix}`,
+    };
+}
+async function checkNodeVersion(ctx) {
+    const versionMatch = ctx.nodeVersion.match(/^v?(\d+)/);
+    if (!versionMatch) {
+        return { name: 'Node version', status: 'fail', detail: `Unknown version: ${ctx.nodeVersion}` };
+    }
+    const major = parseInt(versionMatch[1], 10);
+    if (major >= 18) {
+        return { name: 'Node version', status: 'pass', detail: ctx.nodeVersion };
+    }
+    return { name: 'Node version', status: 'fail', detail: `${ctx.nodeVersion} (need >= 18.0.0)` };
+}
+async function checkPidFile(ctx) {
+    const fs_ = await Promise.resolve().then(() => __importStar(require('fs/promises')));
+    const pidPath = `${ctx.swAgentDir}/sw-agent.pid`;
+    try {
+        const content = await fs_.readFile(pidPath, 'utf8');
+        const pidInfo = JSON.parse(content);
+        if ((0, pid_file_1.isProcessAlive)(pidInfo.pid)) {
+            return { name: 'PID file', status: 'pass', detail: `Agent running (pid ${pidInfo.pid})` };
+        }
+        return {
+            name: 'PID file',
+            status: 'warn',
+            detail: `Stale PID file (process ${pidInfo.pid} is dead)`,
+        };
+    }
+    catch {
+        return { name: 'PID file', status: 'pass', detail: 'No PID file (agent not running)' };
+    }
+}
+async function runAllChecks(ctx) {
+    return [
+        await checkSwAgentDirExists(ctx),
+        await checkMachineConfigValid(ctx),
+        await checkTokenFormat(ctx),
+        await checkDatabasesConfigValid(ctx),
+        await checkConfigFilePermissions(ctx),
+        await checkDatabasesReachable(ctx),
+        await checkPgRoleLeastPrivilege(ctx),
+        await checkAuditDirWritable(ctx),
+        await checkAuditChain(ctx),
+        await checkDiskSpace(ctx),
+        await checkNodeVersion(ctx),
+        await checkPidFile(ctx),
+    ];
+}
+//# sourceMappingURL=checks.js.map