@soulbatical/tetra-dev-toolkit 1.17.3 → 1.17.4

package/lib/checks/security/config-rls-alignment.js

@@ -194,15 +194,30 @@ function parseMigrations(projectRoot) {
           || content.match(/(?:TEXT\[\]|text\[\])\s*:=\s*ARRAY\s*\[\s*'([^[\]]+)'\s*\]/i)
         if (arrayMatch) {
           const loopTables = arrayMatch[1].split(/'\s*,\s*'/).map(t => t.trim())
-          const execLines = [...content.matchAll(/EXECUTE\s+format\s*\(\s*'(CREATE\s+POLICY\s+.*?)'\s*,/gi)]
+          // Match EXECUTE format('CREATE POLICY ...', ...) — multi-line, with escaped quotes ('')
+          // PL/pgSQL escapes single quotes as '' inside strings, so we must allow '' within the match
+          // The format string ends with a single ' (not '') followed by , or ;
+          const execLines = [...content.matchAll(/EXECUTE\s+format\s*\(\s*'(CREATE\s+POLICY(?:[^']|'')*?)'\s*,/gi)]
           for (const exec of execLines) {
-            const stmt = exec[1]
+            // Unescape PL/pgSQL doubled quotes back to single quotes for analysis
+            const stmt = exec[1].replace(/''/g, "'")
             const forOp = stmt.match(/FOR\s+(SELECT|INSERT|UPDATE|DELETE|ALL)/i)
             const operation = forOp ? forOp[1].toUpperCase() : 'ALL'
             const hasUsing = /\bUSING\b/i.test(stmt)
             const hasWithCheck = /WITH\s+CHECK/i.test(stmt)
-            const condMatch = stmt.match(/(?:USING|WITH\s+CHECK)\s*\(\s*(.*?)\s*\)/i)
-            const condition = condMatch ? condMatch[1] : ''
+
+            // Extract the full USING/WITH CHECK clause (may be multi-line with nested parens)
+            let usingCondition = ''
+            let withCheckCondition = ''
+            if (hasUsing) {
+              const uMatch = stmt.match(/USING\s*\(\s*([\s\S]*?)\s*\)\s*(?:WITH\s+CHECK|$)/i)
+                || stmt.match(/USING\s*\(\s*([\s\S]*?)\s*\)\s*$/i)
+              usingCondition = uMatch ? uMatch[1].trim() : ''
+            }
+            if (hasWithCheck) {
+              const wcMatch = stmt.match(/WITH\s+CHECK\s*\(\s*([\s\S]*?)\s*\)\s*$/i)
+              withCheckCondition = wcMatch ? wcMatch[1].trim() : ''
+            }
 
             for (const table of loopTables) {
               if (!tables.has(table)) tables.set(table, { rlsEnabled: false, policies: [], rpcFunctions: new Map() })
@@ -211,8 +226,8 @@ function parseMigrations(projectRoot) {
                 tables.get(table).policies.push({
                   name: policyName,
                   operation,
-                  using: hasUsing ? condition : '',
-                  withCheck: hasWithCheck ? condition : '',
+                  using: usingCondition,
+                  withCheck: withCheckCondition,
                   file: relFile
                 })
               }

package/lib/checks/security/systemdb-whitelist.js

@@ -63,6 +63,9 @@ const ALLOWED_FILE_PATTERNS = [
   /BaseCronService/,
   // Internal service-to-service routes (API key auth, no user JWT)
   /internalRoutes/,
+  // Billing routers — hybrid files with both authenticated admin routes and unauthenticated webhook handlers
+  // systemDB is needed for Tetra BillingService config callbacks (getSystemDB, getWebhookDB)
+  /billingRouter/,
 ]
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.17.3",
+  "version": "1.17.4",
   "publishConfig": {
     "access": "restricted"
   },
@@ -31,7 +31,8 @@
     "tetra-dev-token": "./bin/tetra-dev-token.js",
     "tetra-check-rls": "./bin/tetra-check-rls.js",
     "tetra-migration-lint": "./bin/tetra-migration-lint.js",
-    "tetra-db-push": "./bin/tetra-db-push.js"
+    "tetra-db-push": "./bin/tetra-db-push.js",
+    "tetra-check-peers": "./bin/tetra-check-peers.js"
   },
   "files": [
     "bin/",