@syntopica/db-quality 0.1.0

package/dist/cli.js

@@ -0,0 +1,1636 @@
+// src/cli.ts
+import { argv, cwd, exit, stderr, stdout } from "process";
+
+// src/audit/isSupabaseHost.ts
+var isSupabaseHost = (dbUrl) => {
+  try {
+    const { hostname } = new URL(dbUrl);
+    return hostname.endsWith(".supabase.co") || hostname.endsWith(".pooler.supabase.com");
+  } catch {
+    return false;
+  }
+};
+
+// src/config/ConfigError.ts
+var ConfigError = class extends Error {
+};
+
+// src/audit/auditPlan.ts
+var auditPlan = (config, target) => {
+  const supabase = "linked" in target || isSupabaseHost(target.dbUrl);
+  const soda = config.audit.soda !== void 0 && "dbUrl" in target;
+  const skipped = [
+    ...supabase ? [] : ["supabase: skipped, --db-url is not a Supabase project host"],
+    ...config.audit.soda !== void 0 && !soda ? [
+      "soda: skipped, a linked target carries no database password; pass --db-url"
+    ] : []
+  ];
+  if (!supabase && !soda) {
+    throw new ConfigError(
+      "nothing to audit: not a Supabase host and audit.soda is not configured"
+    );
+  }
+  return { supabase, soda, skipped };
+};
+
+// src/audit/resolveAuditTarget.ts
+import { existsSync } from "fs";
+import { join } from "path";
+var resolveAuditTarget = (root, values) => {
+  if (values["db-url"]) return { dbUrl: values["db-url"] };
+  if (values.linked) {
+    if (!existsSync(join(root, "supabase/.temp/project-ref"))) {
+      throw new ConfigError(
+        'project is not linked; run "supabase link" or pass --db-url'
+      );
+    }
+    return { linked: true };
+  }
+  throw new ConfigError("audit needs --linked or --db-url");
+};
+
+// src/adapters/soda/runSoda.ts
+import {
+  existsSync as existsSync2,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+
+// src/adapters/soda/dataSourceType.ts
+var dataSourceType = (url) => {
+  const scheme = url.split(":")[0] ?? "";
+  if (scheme === "postgres" || scheme === "postgresql") return "postgres";
+  if (scheme === "mysql") return "mysql";
+  throw new ConfigError(
+    `Soda supports postgres and mysql URLs, not "${scheme}"`
+  );
+};
+
+// src/config/isDisabled.ts
+var isDisabled = (code, disabled) => disabled.includes(code);
+
+// src/model/fingerprintFinding.ts
+import { createHash } from "crypto";
+var fingerprintFinding = (finding, context) => createHash("sha256").update(["1", finding.code, finding.path, context].join("|")).digest("hex").slice(0, 16);
+
+// src/adapters/soda/parseSodaResults.ts
+var parseSodaResults = (json, sodaDir, disabled) => {
+  const { checks } = JSON.parse(json);
+  return checks.flatMap((check) => {
+    if (check.outcome !== "fail" && check.outcome !== "warn") return [];
+    const code = `BDB700/${check.name}`;
+    if (isDisabled(code, disabled)) return [];
+    const partial = {
+      code,
+      severity: check.outcome === "fail" ? "error" : "warn",
+      path: `${sodaDir}/checks.yml`,
+      line: 0,
+      message: `check ${check.outcome === "fail" ? "failed" : "warned"}: ${check.name}`,
+      subject: [check.table, check.column].filter(Boolean).join(".")
+    };
+    return [
+      { ...partial, fingerprint: fingerprintFinding(partial, check.name) }
+    ];
+  });
+};
+
+// src/adapters/soda/renderSodaConfiguration.ts
+var renderSodaConfiguration = (name, url) => {
+  const type = dataSourceType(url);
+  const parsed = new URL(url);
+  const lines = [
+    `data_source ${name}:`,
+    `  type: ${type}`,
+    `  host: ${parsed.hostname}`,
+    `  port: ${parsed.port || (type === "postgres" ? "5432" : "3306")}`,
+    `  username: ${decodeURIComponent(parsed.username)}`,
+    `  password: ${JSON.stringify(decodeURIComponent(parsed.password))}`,
+    `  database: ${parsed.pathname.slice(1)}`,
+    ...type === "postgres" ? ["  schema: public"] : []
+  ];
+  return `${lines.join("\n")}
+`;
+};
+
+// src/tools/ToolMissingError.ts
+var ToolMissingError = class extends Error {
+  constructor(tool, hint) {
+    super(`${tool} is not installed or not on PATH; ${hint}`);
+  }
+};
+
+// src/adapters/soda/runSoda.ts
+var runSoda = (runner, root, soda, disabled) => {
+  const scratch = mkdtempSync(join2(tmpdir(), "codeality-db-soda-"));
+  try {
+    const configuration = join2(scratch, "configuration.yml");
+    const results = join2(scratch, "results.json");
+    writeFileSync(configuration, renderSodaConfiguration("codeality", soda.url));
+    const result = runner(
+      "uvx",
+      [
+        "--with",
+        "setuptools",
+        "--from",
+        `soda-core-${dataSourceType(soda.url)}`,
+        "soda",
+        "scan",
+        "-d",
+        "codeality",
+        "-c",
+        configuration,
+        "-srf",
+        results,
+        `${soda.dir}/checks.yml`
+      ],
+      { cwd: root, env: { SETUPTOOLS_USE_DISTUTILS: "local" } }
+    );
+    if (result.missing) throw new ToolMissingError("uvx", "install uv");
+    if (!existsSync2(results)) {
+      const tail = result.stderr.trim().slice(-500);
+      throw new Error(
+        `soda scan produced no results (exit ${String(result.status)}): ${tail}`
+      );
+    }
+    return parseSodaResults(readFileSync(results, "utf8"), soda.dir, disabled);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+};
+
+// src/adapters/supabase/ADVISOR_SEVERITY.ts
+var ADVISOR_SEVERITY = {
+  ERROR: "error",
+  WARN: "warn",
+  INFO: "info"
+};
+
+// src/adapters/supabase/parseAdvisorReport.ts
+var parseAdvisorReport = (stdout2, disabled) => {
+  const { results } = JSON.parse(stdout2);
+  return results.flatMap((entry) => {
+    const code = `BDB500/${entry.name}`;
+    if (isDisabled(code, disabled)) return [];
+    const subject = entry.metadata?.schema && entry.metadata.name ? `${entry.metadata.schema}.${entry.metadata.name}` : "";
+    const partial = {
+      code,
+      severity: ADVISOR_SEVERITY[entry.level],
+      path: "supabase",
+      line: 0,
+      message: entry.detail.replaceAll("\\`", "`"),
+      subject
+    };
+    return [
+      { ...partial, fingerprint: fingerprintFinding(partial, entry.detail) }
+    ];
+  });
+};
+
+// src/adapters/supabase/parseCliError.ts
+var parseCliError = (text) => {
+  const start = text.indexOf('{"_tag":"Error"');
+  if (start === -1) return void 0;
+  for (let end = text.indexOf("}", start); end !== -1; end = text.indexOf("}", end + 1)) {
+    try {
+      const { error } = JSON.parse(text.slice(start, end + 1));
+      return { code: error.code, message: error.message };
+    } catch {
+    }
+  }
+  return { code: "unknown", message: text.slice(start, start + 200) };
+};
+
+// src/adapters/supabase/supabaseJson.ts
+var supabaseJson = (runner, root, args, label) => {
+  const result = runner("supabase", args, { cwd: root });
+  if (result.missing)
+    throw new ToolMissingError("supabase", "install the Supabase CLI");
+  const failure = parseCliError(`${result.stdout}
+${result.stderr}`);
+  if (failure || result.status !== 0) {
+    const code = failure?.code ?? String(result.status);
+    throw new Error(
+      `${label} failed: ${code}: ${failure?.message ?? result.stderr.trim()}`
+    );
+  }
+  return result.stdout.slice(result.stdout.indexOf("{"));
+};
+
+// src/audit/targetArgs.ts
+var targetArgs = (target) => "dbUrl" in target ? ["--db-url", target.dbUrl] : ["--linked"];
+
+// src/adapters/supabase/runAdvisors.ts
+var runAdvisors = (runner, root, target, disabled) => parseAdvisorReport(
+  supabaseJson(
+    runner,
+    root,
+    [
+      "db",
+      "advisors",
+      "--type",
+      "all",
+      "--output-format",
+      "json",
+      ...targetArgs(target)
+    ],
+    "supabase advisors"
+  ),
+  disabled
+);
+
+// src/adapters/supabase/parseBloat.ts
+var parseBloat = (stdout2, threshold, disabled) => {
+  if (isDisabled("BDB602", disabled)) return [];
+  const { rows } = JSON.parse(stdout2);
+  return rows.filter((row) => Number(row.bloat) > threshold).map((row) => {
+    const partial = {
+      code: "BDB602",
+      severity: "warn",
+      path: "supabase",
+      line: 0,
+      message: `bloat factor ${row.bloat}, ${row.waste} wasted`,
+      subject: row.name
+    };
+    return { ...partial, fingerprint: fingerprintFinding(partial, row.name) };
+  });
+};
+
+// src/adapters/supabase/parseIndexStats.ts
+var parseIndexStats = (stdout2, disabled) => {
+  if (isDisabled("BDB601", disabled)) return [];
+  const { rows } = JSON.parse(stdout2);
+  return rows.filter(
+    (row) => (row.unused || row.index_scans === "0") && !row.name.endsWith("_pkey")
+  ).map((row) => {
+    const partial = {
+      code: "BDB601",
+      severity: "info",
+      path: "supabase",
+      line: 0,
+      message: `index has never been scanned (${row.size})`,
+      subject: row.name
+    };
+    return { ...partial, fingerprint: fingerprintFinding(partial, row.name) };
+  });
+};
+
+// src/adapters/supabase/runInspect.ts
+var runInspect = (runner, root, target, config) => {
+  const query = (report) => supabaseJson(
+    runner,
+    root,
+    [
+      "inspect",
+      "db",
+      report,
+      "--output-format",
+      "json",
+      ...targetArgs(target)
+    ],
+    `supabase inspect ${report}`
+  );
+  return [
+    ...parseIndexStats(query("index-stats"), config.disable),
+    ...parseBloat(query("bloat"), config.audit.bloatThreshold, config.disable)
+  ];
+};
+
+// src/model/compareFindings.ts
+var compareFindings = (a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.code.localeCompare(b.code);
+
+// src/audit/runAudit.ts
+var runAudit = ({
+  root,
+  config,
+  runner,
+  target
+}) => {
+  const plan = auditPlan(config, target);
+  const findings = [];
+  if (plan.soda && "dbUrl" in target && config.audit.soda !== void 0) {
+    const soda = { dir: config.audit.soda, url: target.dbUrl };
+    findings.push(...runSoda(runner, root, soda, config.disable));
+  }
+  if (plan.supabase) {
+    findings.push(
+      ...runAdvisors(runner, root, target, config.disable),
+      ...runInspect(runner, root, target, config)
+    );
+  }
+  return findings.sort(compareFindings);
+};
+
+// src/check/renderFindings.ts
+var renderFindings = (findings) => [
+  ...findings.map(
+    (f) => `${f.path}:${String(f.line)}: ${f.code} ${f.message}${f.subject ? ` (${f.subject})` : ""}`
+  ),
+  `${String(findings.length)} findings`
+].join("\n");
+
+// src/check/renderFindingsJson.ts
+var renderFindingsJson = (findings) => JSON.stringify({ schemaVersion: 1, findings }, null, 2);
+
+// src/commands/parseCommandArgs.ts
+import { parseArgs } from "util";
+var parseCommandArgs = (argv2, options) => {
+  try {
+    const parsed = parseArgs({
+      args: argv2,
+      options,
+      allowPositionals: true,
+      strict: true
+    });
+    return { values: parsed.values, positionals: parsed.positionals };
+  } catch (error) {
+    throw new ConfigError(error.message);
+  }
+};
+
+// src/model/ExitCode.ts
+var ExitCode = {
+  OK: 0,
+  FINDINGS: 1,
+  CONFIGURATION: 2,
+  INFRASTRUCTURE: 3
+};
+
+// src/commands/reportCommandError.ts
+var reportCommandError = (error, stderr2) => {
+  const configuration = error instanceof ConfigError;
+  const message = error instanceof Error ? error.message : String(error);
+  stderr2(`${configuration ? "configuration error" : "error"}: ${message}
+`);
+  return configuration ? ExitCode.CONFIGURATION : ExitCode.INFRASTRUCTURE;
+};
+
+// src/config/readConfig.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+
+// src/config/CONFIG_FILENAME.ts
+var CONFIG_FILENAME = "codeality-db.json";
+
+// src/config/expectConfig.ts
+var expectConfig = (condition, message) => {
+  if (!condition) throw new ConfigError(message);
+};
+
+// src/config/auditSectionFrom.ts
+var auditSectionFrom = (audit) => {
+  const inGate = audit?.["inGate"] ?? true;
+  const bloatThreshold = audit?.["bloatThreshold"] ?? 5;
+  const soda = audit?.["soda"];
+  expectConfig(typeof inGate === "boolean", "audit.inGate must be a boolean");
+  expectConfig(
+    typeof bloatThreshold === "number",
+    "audit.bloatThreshold must be a number"
+  );
+  expectConfig(
+    soda === void 0 || typeof soda === "string",
+    "audit.soda must be a string"
+  );
+  return {
+    inGate,
+    bloatThreshold,
+    ...soda === void 0 ? {} : { soda }
+  };
+};
+
+// src/config/CONFIG_KEYS.ts
+var CONFIG_KEYS = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "supabase",
+  "prisma",
+  "drizzle",
+  "sqlite",
+  "audit",
+  "disable"
+]);
+
+// src/config/configSection.ts
+var configSection = (raw, name) => {
+  const value = raw[name];
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ConfigError(`${name} must be an object`);
+  }
+  return value;
+};
+
+// src/config/isStringList.ts
+var isStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+
+// src/config/drizzleSectionFrom.ts
+var drizzleSectionFrom = (drizzle) => {
+  const roots = drizzle["roots"];
+  const objectNames = drizzle["objectNames"] ?? ["db", "tx"];
+  if (!isStringList(roots))
+    throw new ConfigError("drizzle.roots must be a list of strings");
+  if (!isStringList(objectNames)) {
+    throw new ConfigError("drizzle.objectNames must be a list of strings");
+  }
+  return { roots, objectNames };
+};
+
+// src/config/stackSectionsFrom.ts
+var stackSectionsFrom = (raw) => {
+  const stacks = {};
+  const supabase = configSection(raw, "supabase");
+  if (supabase) {
+    const migrations = supabase["migrations"];
+    if (typeof migrations !== "string")
+      throw new ConfigError("supabase.migrations must be a string");
+    stacks.supabase = { migrations };
+  }
+  const prisma = configSection(raw, "prisma");
+  if (prisma) {
+    const schema = prisma["schema"];
+    if (typeof schema !== "string")
+      throw new ConfigError("prisma.schema must be a string");
+    stacks.prisma = { schema };
+  }
+  const drizzle = configSection(raw, "drizzle");
+  if (drizzle) stacks.drizzle = drizzleSectionFrom(drizzle);
+  const sqlite = configSection(raw, "sqlite");
+  if (sqlite) {
+    const files = sqlite["files"];
+    if (!isStringList(files))
+      throw new ConfigError("sqlite.files must be a list of strings");
+    stacks.sqlite = { files };
+  }
+  return stacks;
+};
+
+// src/config/configFromDocument.ts
+var configFromDocument = (document) => {
+  if (typeof document !== "object" || document === null || Array.isArray(document)) {
+    throw new ConfigError("configuration must be an object");
+  }
+  const raw = document;
+  for (const key of Object.keys(raw)) {
+    if (!CONFIG_KEYS.has(key)) throw new ConfigError(`unknown key "${key}"`);
+  }
+  if (raw["schemaVersion"] !== 1)
+    throw new ConfigError("schemaVersion must be 1");
+  const disable = raw["disable"] ?? [];
+  if (!isStringList(disable))
+    throw new ConfigError("disable must be a list of strings");
+  return {
+    schemaVersion: 1,
+    ...stackSectionsFrom(raw),
+    audit: auditSectionFrom(configSection(raw, "audit")),
+    disable
+  };
+};
+
+// src/config/readConfig.ts
+var readConfig = (root) => {
+  const path = join3(root, CONFIG_FILENAME);
+  if (!existsSync3(path)) {
+    throw new ConfigError(
+      `${CONFIG_FILENAME} not found in ${root}; run "codeality-db init"`
+    );
+  }
+  let document;
+  try {
+    document = JSON.parse(readFileSync2(path, "utf8"));
+  } catch (error) {
+    throw new ConfigError(
+      `${CONFIG_FILENAME} is not valid JSON: ${error.message}`
+    );
+  }
+  return configFromDocument(document);
+};
+
+// src/commands/auditCommand.ts
+var auditCommand = (argv2, io) => {
+  try {
+    const { values } = parseCommandArgs(argv2, {
+      json: { type: "boolean" },
+      linked: { type: "boolean" },
+      "db-url": { type: "string" }
+    });
+    const config = readConfig(io.root);
+    const target = resolveAuditTarget(io.root, {
+      linked: values["linked"] === true,
+      "db-url": values["db-url"]
+    });
+    for (const notice of auditPlan(config, target).skipped)
+      io.stderr(`${notice}
+`);
+    const findings = runAudit({
+      root: io.root,
+      config,
+      runner: io.runner,
+      target
+    });
+    io.stdout(
+      `${values["json"] === true ? renderFindingsJson(findings) : renderFindings(findings)}
+`
+    );
+    return findings.length > 0 ? ExitCode.FINDINGS : ExitCode.OK;
+  } catch (error) {
+    return reportCommandError(error, io.stderr);
+  }
+};
+
+// src/commands/baselineCommand.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join7 } from "path";
+
+// src/baseline/BASELINE_FILENAME.ts
+var BASELINE_FILENAME = ".codeality-db-baseline.json";
+
+// src/baseline/BASELINE_USAGE.ts
+var BASELINE_USAGE = "usage: codeality-db baseline create|update|check [--check-stale]";
+
+// src/baseline/baselineActionFrom.ts
+var baselineActionFrom = (positionals) => {
+  const action = positionals[0];
+  if (action === "create" || action === "update" || action === "check")
+    return action;
+  throw new ConfigError(BASELINE_USAGE);
+};
+
+// src/baseline/classifyFindings.ts
+var classifyFindings = (findings, baseline) => {
+  const entries = new Set(baseline.entries);
+  const current = new Set(findings.map((finding) => finding.fingerprint));
+  return {
+    new: findings.filter((finding) => !entries.has(finding.fingerprint)),
+    known: findings.filter((finding) => entries.has(finding.fingerprint)),
+    resolved: baseline.entries.filter((entry) => !current.has(entry)).sort()
+  };
+};
+
+// src/baseline/readBaseline.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
+var readBaseline = (root) => {
+  const path = join4(root, BASELINE_FILENAME);
+  if (!existsSync4(path)) {
+    throw new ConfigError(
+      `${BASELINE_FILENAME} not found; run "codeality-db baseline create"`
+    );
+  }
+  const document = JSON.parse(
+    readFileSync3(path, "utf8")
+  );
+  if (document.schemaVersion !== 1 || !Array.isArray(document.entries)) {
+    throw new ConfigError(`${BASELINE_FILENAME} is not a version 1 baseline`);
+  }
+  return {
+    schemaVersion: 1,
+    toolVersion: document.toolVersion ?? "",
+    entries: [...document.entries].sort()
+  };
+};
+
+// src/baseline/renderClassified.ts
+var renderClassified = (classified) => {
+  const counts = `${String(classified.new.length)} new, ${String(classified.known.length)} known, ${String(classified.resolved.length)} resolved`;
+  return classified.new.length > 0 ? `${counts}
+${renderFindings(classified.new)}` : counts;
+};
+
+// src/baseline/writeBaseline.ts
+import { renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join5 } from "path";
+var writeBaseline = (root, baseline) => {
+  const path = join5(root, BASELINE_FILENAME);
+  const document = {
+    schemaVersion: 1,
+    toolVersion: baseline.toolVersion,
+    entries: [...baseline.entries].sort()
+  };
+  writeFileSync2(`${path}.tmp`, `${JSON.stringify(document, null, 2)}
+`);
+  renameSync(`${path}.tmp`, path);
+};
+
+// src/adapters/drizzle/parseEslintReport.ts
+import { relative } from "path";
+var parseEslintReport = (stdout2, root, disabled) => {
+  if (!stdout2.trim()) return [];
+  let files;
+  try {
+    files = JSON.parse(stdout2);
+  } catch {
+    throw new Error(`eslint produced no JSON report: ${stdout2.slice(0, 200)}`);
+  }
+  return files.flatMap(
+    (file) => file.messages.flatMap((message) => {
+      if (!message.ruleId?.startsWith("drizzle/")) return [];
+      const rule = message.ruleId.slice("drizzle/".length);
+      const code = `BDB300/${rule}`;
+      if (isDisabled(code, disabled)) return [];
+      const partial = {
+        code,
+        severity: "error",
+        path: relative(root, file.filePath).replaceAll("\\", "/"),
+        line: message.line,
+        message: message.message,
+        subject: rule
+      };
+      return [
+        {
+          ...partial,
+          fingerprint: fingerprintFinding(partial, message.message)
+        }
+      ];
+    })
+  );
+};
+
+// src/assetPath.ts
+import { fileURLToPath } from "url";
+var assetPath = (name) => fileURLToPath(new URL(`../assets/${name}`, import.meta.url));
+
+// src/adapters/drizzle/runDrizzleLint.ts
+var runDrizzleLint = (runner, root, drizzle, disabled) => {
+  const result = runner(
+    "eslint",
+    [
+      "--no-config-lookup",
+      "-c",
+      assetPath("drizzle-eslint.config.mjs"),
+      "-f",
+      "json",
+      "--pass-on-unpruned-suppressions",
+      ...drizzle.roots
+    ],
+    {
+      cwd: root,
+      env: { CODEALITY_DB_DRIZZLE_OBJECTS: drizzle.objectNames.join(",") }
+    }
+  );
+  if (result.missing) {
+    throw new ToolMissingError(
+      "eslint",
+      "add eslint, eslint-plugin-drizzle and typescript-eslint as devDependencies"
+    );
+  }
+  if (result.status !== 0 && result.status !== 1) {
+    throw new Error(
+      `eslint exited ${String(result.status)}: ${result.stderr.trim()}`
+    );
+  }
+  return parseEslintReport(result.stdout, root, disabled);
+};
+
+// src/adapters/prisma/parsePrismaLintReport.ts
+var parsePrismaLintReport = (stderr2, disabled) => {
+  if (!stderr2.trim()) return [];
+  let violations;
+  try {
+    violations = JSON.parse(stderr2).violations;
+  } catch {
+    throw new Error(
+      `prisma-lint produced no JSON report: ${stderr2.slice(0, 200)}`
+    );
+  }
+  return violations.flatMap((violation) => {
+    const code = `BDB200/${violation.ruleName}`;
+    if (isDisabled(code, disabled)) return [];
+    const partial = {
+      code,
+      severity: "warn",
+      path: violation.fileName,
+      line: violation.location.startLine,
+      message: violation.message,
+      subject: /Field "([^"]+)"/.exec(violation.message)?.[1] ?? ""
+    };
+    return [
+      {
+        ...partial,
+        fingerprint: fingerprintFinding(partial, violation.message)
+      }
+    ];
+  });
+};
+
+// src/adapters/prisma/runPrismaLint.ts
+var runPrismaLint = (runner, root, schemaPath, disabled) => {
+  const result = runner(
+    "prisma-lint",
+    ["-c", assetPath("prisma-lint.json"), "-o", "json", schemaPath],
+    { cwd: root }
+  );
+  if (result.missing) {
+    throw new ToolMissingError(
+      "prisma-lint",
+      "add prisma-lint as a devDependency"
+    );
+  }
+  if (result.status !== 0 && result.status !== 1) {
+    throw new Error(
+      `prisma-lint exited ${String(result.status)}: ${result.stderr.trim()}`
+    );
+  }
+  return parsePrismaLintReport(result.stderr, disabled);
+};
+
+// src/adapters/sqlite/sqliteFinding.ts
+var sqliteFinding = (input, disabled) => {
+  if (isDisabled(input.code, disabled)) return [];
+  const partial = {
+    code: input.code,
+    severity: input.severity,
+    path: input.file,
+    line: 0,
+    message: input.message,
+    subject: input.subject
+  };
+  return [
+    { ...partial, fingerprint: fingerprintFinding(partial, input.context) }
+  ];
+};
+
+// src/adapters/sqlite/sqliteQuery.ts
+var sqliteQuery = (runner, root, file, sql) => {
+  const result = runner("sqlite3", ["-json", "-readonly", file, sql], {
+    cwd: root
+  });
+  if (result.missing) {
+    throw new ToolMissingError(
+      "sqlite3",
+      "install the sqlite3 command line shell"
+    );
+  }
+  if (result.status !== 0)
+    throw new Error(`sqlite3 failed on ${file}: ${result.stderr.trim()}`);
+  return result.stdout;
+};
+
+// src/adapters/sqlite/sqliteRows.ts
+var sqliteRows = (runner, root, file, sql) => {
+  const out = sqliteQuery(runner, root, file, sql).trim();
+  return out ? JSON.parse(out) : [];
+};
+
+// src/adapters/sqlite/foreignKeyFindings.ts
+var foreignKeyFindings = (runner, root, file, disabled) => sqliteRows(
+  runner,
+  root,
+  file,
+  "PRAGMA foreign_key_check"
+).flatMap(
+  (row) => sqliteFinding(
+    {
+      code: "BDB402",
+      severity: "error",
+      file,
+      subject: row.table,
+      message: `row ${String(row.rowid)} references missing ${row.parent}`,
+      context: `${row.table}:${String(row.rowid)}:${row.parent}`
+    },
+    disabled
+  )
+);
+
+// src/adapters/sqlite/integrityFindings.ts
+var integrityFindings = (runner, root, file, disabled) => {
+  const rows = sqliteRows(
+    runner,
+    root,
+    file,
+    "PRAGMA integrity_check"
+  );
+  const first = rows[0]?.integrity_check ?? "no result";
+  if (rows.length === 1 && first === "ok") return [];
+  return sqliteFinding(
+    {
+      code: "BDB401",
+      severity: "error",
+      file,
+      subject: "",
+      message: `integrity_check: ${first}`,
+      context: first
+    },
+    disabled
+  );
+};
+
+// src/adapters/sqlite/hasPrimaryKey.ts
+var hasPrimaryKey = (createSql) => {
+  const text = createSql.toLowerCase();
+  return text.startsWith("create virtual table") || text.includes("primary key");
+};
+
+// src/adapters/sqlite/primaryKeyFindings.ts
+var primaryKeyFindings = (runner, root, file, disabled) => sqliteRows(
+  runner,
+  root,
+  file,
+  "select name, sql from sqlite_master where type = 'table' and name not like 'sqlite_%'"
+).flatMap(
+  (row) => hasPrimaryKey(row.sql) ? [] : sqliteFinding(
+    {
+      code: "BDB403",
+      severity: "warn",
+      file,
+      subject: row.name,
+      message: "table has no primary key",
+      context: row.name
+    },
+    disabled
+  )
+);
+
+// src/adapters/sqlite/runSqliteChecks.ts
+var runSqliteChecks = (runner, root, files, disabled) => files.flatMap((file) => [
+  ...integrityFindings(runner, root, file, disabled),
+  ...foreignKeyFindings(runner, root, file, disabled),
+  ...primaryKeyFindings(runner, root, file, disabled)
+]);
+
+// src/model/normalizeSqlText.ts
+var normalizeSqlText = (text) => text.toLowerCase().replaceAll(/\s+/g, " ").trim();
+
+// src/sql/statementAtLine.ts
+var statementAtLine = (file, line) => [...file.statements].reverse().find((statement) => statement.line <= line);
+
+// src/adapters/squawk/parseSquawkReport.ts
+var parseSquawkReport = (stdout2, set, disabled) => {
+  if (!stdout2.trim()) return [];
+  let entries;
+  try {
+    entries = JSON.parse(stdout2);
+  } catch {
+    throw new Error(`squawk produced no JSON report: ${stdout2.slice(0, 200)}`);
+  }
+  return entries.flatMap((entry) => {
+    const code = `BDB100/${entry.rule_name}`;
+    if (isDisabled(code, disabled)) return [];
+    const file = set.find((candidate) => candidate.path === entry.file);
+    const statement = file ? statementAtLine(file, entry.line) : void 0;
+    const partial = {
+      code,
+      severity: entry.level === "Error" ? "error" : "warn",
+      path: entry.file,
+      line: entry.line,
+      message: entry.message,
+      subject: entry.rule_name
+    };
+    const context = statement ? normalizeSqlText(statement.text) : entry.message;
+    return [{ ...partial, fingerprint: fingerprintFinding(partial, context) }];
+  });
+};
+
+// src/adapters/squawk/SUPABASE_SQUAWK_EXCLUDES.ts
+var SUPABASE_SQUAWK_EXCLUDES = [
+  "prefer-robust-stmts",
+  "require-lock-timeout",
+  "require-statement-timeout",
+  "require-concurrent-index-creation"
+];
+
+// src/adapters/squawk/runSquawk.ts
+var runSquawk = (runner, root, set, disabled) => {
+  const result = runner(
+    "squawk",
+    [
+      "--reporter",
+      "json",
+      "--exclude",
+      SUPABASE_SQUAWK_EXCLUDES.join(","),
+      ...set.map((f) => f.path)
+    ],
+    { cwd: root }
+  );
+  if (result.missing)
+    throw new ToolMissingError("squawk", "add squawk-cli as a devDependency");
+  if (result.status !== 0 && result.status !== 1) {
+    throw new Error(
+      `squawk exited ${String(result.status)}: ${result.stderr.trim()}`
+    );
+  }
+  return parseSquawkReport(result.stdout, set, disabled);
+};
+
+// src/rules/makeSqlFinding.ts
+var makeSqlFinding = (rule, { file, statement }, subject, message) => {
+  const partial = {
+    code: rule.code,
+    severity: rule.severity,
+    path: file.path,
+    line: statement.line,
+    message,
+    subject
+  };
+  return {
+    ...partial,
+    fingerprint: fingerprintFinding(partial, normalizeSqlText(statement.text))
+  };
+};
+
+// src/sql/qualifiedName.ts
+var qualifiedName = (raw) => {
+  const parts = raw.trim().split(".").map((part) => part.replaceAll('"', "").toLowerCase());
+  return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
+};
+
+// src/rules/policyTable.ts
+var policyTable = (statement) => {
+  const match = /^create policy .+? on ((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)/.exec(
+    normalizeSqlText(statement.text)
+  );
+  return match?.[1] === void 0 ? void 0 : qualifiedName(match[1]);
+};
+
+// src/rules/authUidNotWrapped.ts
+var authUidNotWrapped = {
+  code: "BDB004",
+  name: "auth-uid-not-wrapped",
+  severity: "warn",
+  run: (set) => set.flatMap(
+    (file) => file.statements.filter((statement) => {
+      const text = normalizeSqlText(statement.text);
+      return text.startsWith("create policy") && /(?<!\(select )auth\.(?:uid|jwt)\(\)/.test(text);
+    }).map(
+      (statement) => makeSqlFinding(
+        authUidNotWrapped,
+        { file, statement },
+        policyTable(statement) ?? "",
+        "auth.uid() or auth.jwt() is re-evaluated per row; wrap it as (select auth.uid()) so Postgres caches it as an initplan"
+      )
+    )
+  )
+};
+
+// src/rules/definerWithoutSearchPath.ts
+var definerWithoutSearchPath = {
+  code: "BDB005",
+  name: "definer-without-search-path",
+  severity: "warn",
+  run: (set) => set.flatMap(
+    (file) => file.statements.flatMap((statement) => {
+      const text = normalizeSqlText(statement.text);
+      const head = /^create (?:or replace )?(?:function|procedure) ((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)\s*\(/.exec(
+        text
+      );
+      if (!head?.[1] || !text.includes(" security definer") || text.includes(" set search_path")) {
+        return [];
+      }
+      return [
+        makeSqlFinding(
+          definerWithoutSearchPath,
+          { file, statement },
+          qualifiedName(head[1]),
+          'SECURITY DEFINER function without "set search_path": a caller can shadow the objects it touches'
+        )
+      ];
+    })
+  )
+};
+
+// src/rules/permissivePolicy.ts
+var permissivePolicy = {
+  code: "BDB001",
+  name: "permissive-policy",
+  severity: "warn",
+  run: (set) => set.flatMap(
+    (file) => file.statements.filter((statement) => {
+      const text = normalizeSqlText(statement.text);
+      return text.startsWith("create policy") && /(?:using|with check) \( ?true ?\)/.test(text);
+    }).map(
+      (statement) => makeSqlFinding(
+        permissivePolicy,
+        { file, statement },
+        policyTable(statement) ?? "",
+        "policy is permissive: using (true) or with check (true) lets every row through for the granted role"
+      )
+    )
+  )
+};
+
+// src/rules/policyTables.ts
+var policyTables = (set) => {
+  const tables = /* @__PURE__ */ new Set();
+  for (const file of set)
+    for (const statement of file.statements) {
+      const table = policyTable(statement);
+      if (table) tables.add(table);
+    }
+  return tables;
+};
+
+// src/rules/matchedTables.ts
+var matchedTables = (set, pattern) => {
+  const tables = /* @__PURE__ */ new Map();
+  for (const file of set)
+    for (const statement of file.statements) {
+      const match = pattern.exec(normalizeSqlText(statement.text));
+      if (!match?.[1]) continue;
+      const name = qualifiedName(match[1]);
+      if (!tables.has(name)) tables.set(name, { file, statement });
+    }
+  return tables;
+};
+
+// src/rules/rlsEnabledTables.ts
+var rlsEnabledTables = (set) => matchedTables(
+  set,
+  /^alter table (?:if exists )?(?:only )?((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?) enable row level security/
+);
+
+// src/rules/rlsEnabledNoPolicy.ts
+var rlsEnabledNoPolicy = {
+  code: "BDB002",
+  name: "rls-enabled-no-policy",
+  severity: "info",
+  run: (set) => {
+    const withPolicy = policyTables(set);
+    return [...rlsEnabledTables(set)].filter(([table]) => !withPolicy.has(table)).map(
+      ([table, ref]) => makeSqlFinding(
+        rlsEnabledNoPolicy,
+        ref,
+        table,
+        "RLS is enabled but no migration defines a policy: only the service role can reach this table"
+      )
+    );
+  }
+};
+
+// src/rules/createdTables.ts
+var createdTables = (set) => new Map(
+  [
+    ...matchedTables(
+      set,
+      /^create (?:unlogged |temp(?:orary)? )?table (?:if not exists )?((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)/
+    )
+  ].filter(([name]) => name.startsWith("public."))
+);
+
+// src/rules/tableWithoutRls.ts
+var tableWithoutRls = {
+  code: "BDB003",
+  name: "table-without-rls",
+  severity: "warn",
+  run: (set) => {
+    const enabled = rlsEnabledTables(set);
+    return [...createdTables(set)].filter(([table]) => !enabled.has(table)).map(
+      ([table, ref]) => makeSqlFinding(
+        tableWithoutRls,
+        ref,
+        table,
+        "table in public never enables row level security: it is readable through the Data API by anyone holding the anon key"
+      )
+    );
+  }
+};
+
+// src/rules/SQL_RULES.ts
+var SQL_RULES = [
+  permissivePolicy,
+  rlsEnabledNoPolicy,
+  tableWithoutRls,
+  authUidNotWrapped,
+  definerWithoutSearchPath
+];
+
+// src/rules/runSqlRules.ts
+var runSqlRules = (set, disabled) => SQL_RULES.filter((rule) => !isDisabled(rule.code, disabled)).flatMap((rule) => rule.run(set)).sort(compareFindings);
+
+// src/sql/readMigrationSet.ts
+import { readdirSync, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
+
+// src/sql/quotedSpanEnd.ts
+var quotedSpanEnd = (sql, index) => {
+  const dollar = /^\$[a-z_]*\$/i.exec(sql.slice(index, index + 64));
+  if (dollar) {
+    const end2 = sql.indexOf(dollar[0], index + dollar[0].length);
+    return end2 === -1 ? sql.length : end2 + dollar[0].length;
+  }
+  const quote = sql[index];
+  if (quote !== "'" && quote !== '"') return void 0;
+  const end = sql.indexOf(quote, index + 1);
+  return end === -1 ? sql.length : end + 1;
+};
+
+// src/sql/stripSqlComments.ts
+var stripSqlComments = (sql) => {
+  let out = "";
+  let index = 0;
+  while (index < sql.length) {
+    const quoted = quotedSpanEnd(sql, index);
+    if (quoted !== void 0) {
+      out += sql.slice(index, quoted);
+      index = quoted;
+    } else if (sql.startsWith("--", index)) {
+      const end = sql.indexOf("\n", index);
+      index = end === -1 ? sql.length : end;
+    } else if (sql.startsWith("/*", index)) {
+      const end = sql.indexOf("*/", index + 2);
+      const stop = end === -1 ? sql.length : end + 2;
+      out += sql.slice(index, stop).replaceAll(/[^\n]/g, "");
+      index = stop;
+    } else {
+      out += sql.charAt(index);
+      index += 1;
+    }
+  }
+  return out;
+};
+
+// src/sql/splitSqlStatements.ts
+var splitSqlStatements = (sql) => {
+  const text = stripSqlComments(sql);
+  const statements = [];
+  let start = 0;
+  const flush = (end) => {
+    const raw = text.slice(start, end);
+    const leading = raw.length - raw.trimStart().length;
+    const body = raw.trim();
+    if (body) {
+      const line = 1 + (text.slice(0, start + leading).match(/\n/g)?.length ?? 0);
+      statements.push({ text: body, line });
+    }
+    start = end + 1;
+  };
+  let index = 0;
+  while (index < text.length) {
+    const quoted = quotedSpanEnd(text, index);
+    if (quoted !== void 0) index = quoted;
+    else {
+      if (text[index] === ";") flush(index);
+      index += 1;
+    }
+  }
+  flush(text.length);
+  return statements;
+};
+
+// src/sql/readMigrationSet.ts
+var readMigrationSet = (root, migrationsDir) => readdirSync(join6(root, migrationsDir)).filter((name) => name.endsWith(".sql")).sort().map((name) => ({
+  path: `${migrationsDir.replaceAll("\\", "/")}/${name}`,
+  statements: splitSqlStatements(
+    readFileSync4(join6(root, migrationsDir, name), "utf8")
+  )
+}));
+
+// src/check/runCheck.ts
+var runCheck = ({ root, config, runner }) => {
+  const findings = [];
+  if (config.supabase) {
+    const set = readMigrationSet(root, config.supabase.migrations);
+    findings.push(
+      ...runSqlRules(set, config.disable),
+      ...runSquawk(runner, root, set, config.disable)
+    );
+  }
+  if (config.prisma) {
+    findings.push(
+      ...runPrismaLint(runner, root, config.prisma.schema, config.disable)
+    );
+  }
+  if (config.drizzle)
+    findings.push(
+      ...runDrizzleLint(runner, root, config.drizzle, config.disable)
+    );
+  if (config.sqlite) {
+    findings.push(
+      ...runSqliteChecks(runner, root, config.sqlite.files, config.disable)
+    );
+  }
+  return findings.sort(compareFindings);
+};
+
+// src/packageVersion.ts
+import { createRequire } from "module";
+var PACKAGE_VERSION = createRequire(import.meta.url)("../package.json").version;
+
+// src/commands/baselineCommand.ts
+var baselineCommand = (argv2, io) => {
+  try {
+    const { values, positionals } = parseCommandArgs(argv2, {
+      "check-stale": { type: "boolean" }
+    });
+    const action = baselineActionFrom(positionals);
+    if (action === "create" && existsSync5(join7(io.root, BASELINE_FILENAME))) {
+      throw new ConfigError(
+        `${BASELINE_FILENAME} exists; use "baseline update" to rewrite it`
+      );
+    }
+    const findings = runCheck({
+      root: io.root,
+      config: readConfig(io.root),
+      runner: io.runner
+    });
+    if (action !== "check") {
+      const entries = findings.map((f) => f.fingerprint);
+      writeBaseline(io.root, {
+        schemaVersion: 1,
+        toolVersion: PACKAGE_VERSION,
+        entries
+      });
+      io.stdout(
+        `recorded ${String(findings.length)} findings in ${BASELINE_FILENAME}
+`
+      );
+      return ExitCode.OK;
+    }
+    const classified = classifyFindings(findings, readBaseline(io.root));
+    io.stdout(`${renderClassified(classified)}
+`);
+    const stale = values["check-stale"] === true && classified.resolved.length > 0;
+    return classified.new.length > 0 || stale ? ExitCode.FINDINGS : ExitCode.OK;
+  } catch (error) {
+    return reportCommandError(error, io.stderr);
+  }
+};
+
+// src/commands/checkCommand.ts
+var checkCommand = (argv2, io) => {
+  try {
+    const { values } = parseCommandArgs(argv2, { json: { type: "boolean" } });
+    const findings = runCheck({
+      root: io.root,
+      config: readConfig(io.root),
+      runner: io.runner
+    });
+    io.stdout(
+      `${values["json"] === true ? renderFindingsJson(findings) : renderFindings(findings)}
+`
+    );
+    return findings.length > 0 ? ExitCode.FINDINGS : ExitCode.OK;
+  } catch (error) {
+    return reportCommandError(error, io.stderr);
+  }
+};
+
+// src/gate/gateExitCode.ts
+var gateExitCode = (results) => {
+  if (results.some((result) => result.status === "failed-to-run"))
+    return ExitCode.INFRASTRUCTURE;
+  if (results.some((result) => result.status === "findings"))
+    return ExitCode.FINDINGS;
+  return ExitCode.OK;
+};
+
+// src/gate/gateStages.ts
+import { existsSync as existsSync6 } from "fs";
+import { join as join8 } from "path";
+var gateStages = (context) => {
+  const hasBaseline = existsSync6(join8(context.root, BASELINE_FILENAME));
+  const linked = existsSync6(join8(context.root, "supabase/.temp/project-ref"));
+  return [
+    hasBaseline ? {
+      name: "baseline-check",
+      run: () => classifyFindings(runCheck(context), readBaseline(context.root)).new
+    } : { name: "check", run: () => runCheck(context) },
+    {
+      name: "audit",
+      run: () => context.config.audit.inGate && linked ? runAudit({ ...context, target: { linked: true } }) : "not-applicable"
+    }
+  ];
+};
+
+// src/gate/renderGateReport.ts
+var renderGateReport = (results) => results.flatMap((result) => [
+  `${result.status.padStart(22)}  ${result.name.padEnd(14)}${result.durationSeconds.toFixed(2).padStart(8)}s`,
+  ...result.status === "passed" || result.status === "skipped-not-applicable" || !result.detail ? [] : result.detail.split("\n").map((line) => `  ${line}`)
+]).join("\n");
+
+// src/gate/runStage.ts
+import { performance } from "perf_hooks";
+var runStage = (stage) => {
+  const started = performance.now();
+  const done = (status, detail) => ({
+    name: stage.name,
+    status,
+    durationSeconds: (performance.now() - started) / 1e3,
+    detail
+  });
+  try {
+    const outcome = stage.run();
+    if (outcome === "not-applicable") return done("skipped-not-applicable", "");
+    return outcome.length === 0 ? done("passed", "") : done("findings", renderFindings(outcome));
+  } catch (error) {
+    return done(
+      "failed-to-run",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+};
+
+// src/gate/runGate.ts
+var runGate = (stages) => stages.map(runStage);
+
+// src/commands/gateCommand.ts
+var gateCommand = (argv2, io) => {
+  try {
+    const { values } = parseCommandArgs(argv2, { json: { type: "boolean" } });
+    const results = runGate(
+      gateStages({
+        root: io.root,
+        config: readConfig(io.root),
+        runner: io.runner
+      })
+    );
+    const report = values["json"] === true ? JSON.stringify({ schemaVersion: 1, stages: results }, null, 2) : renderGateReport(results);
+    io.stdout(`${report}
+`);
+    return gateExitCode(results);
+  } catch (error) {
+    return reportCommandError(error, io.stderr);
+  }
+};
+
+// src/init/applyInit.ts
+import { mkdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname, join as join9 } from "path";
+var applyInit = (root, plan) => {
+  for (const file of plan) {
+    const writes = file.disposition === "create" || file.disposition === "merge";
+    if (!writes || file.content === void 0) continue;
+    mkdirSync(dirname(join9(root, file.path)), { recursive: true });
+    writeFileSync3(join9(root, file.path), file.content);
+  }
+};
+
+// src/init/planConfigFile.ts
+import { existsSync as existsSync9, readFileSync as readFileSync5 } from "fs";
+import { join as join12 } from "path";
+
+// src/config/detectStacks.ts
+import { existsSync as existsSync8 } from "fs";
+import { join as join11 } from "path";
+
+// src/config/findSqliteFiles.ts
+import { readdirSync as readdirSync2 } from "fs";
+import { join as join10, relative as relative2 } from "path";
+var findSqliteFiles = (root) => {
+  const skipped = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage"]);
+  const found = [];
+  const walk = (directory, depth) => {
+    for (const entry of readdirSync2(directory, { withFileTypes: true })) {
+      if (skipped.has(entry.name) || entry.name.startsWith(".")) continue;
+      const path = join10(directory, entry.name);
+      if (entry.isDirectory() && depth < 2) walk(path, depth + 1);
+      else if (entry.isFile() && /\.(?:db|sqlite|sqlite3)$/.test(entry.name)) {
+        found.push(relative2(root, path).replaceAll("\\", "/"));
+      }
+    }
+  };
+  walk(root, 0);
+  return found.sort();
+};
+
+// src/config/isDirectory.ts
+import { existsSync as existsSync7, statSync } from "fs";
+var isDirectory = (path) => existsSync7(path) && statSync(path).isDirectory();
+
+// src/config/detectStacks.ts
+var detectStacks = (root) => {
+  const sqliteFiles = findSqliteFiles(root);
+  const hasDrizzle = ["ts", "js", "mjs"].some(
+    (ext) => existsSync8(join11(root, `drizzle.config.${ext}`))
+  );
+  const drizzleRoots = ["src", "server", "app", "lib", "db"].filter(
+    (name) => isDirectory(join11(root, name))
+  );
+  return {
+    ...isDirectory(join11(root, "supabase/migrations")) ? { supabase: { migrations: "supabase/migrations" } } : {},
+    ...existsSync8(join11(root, "prisma/schema.prisma")) ? { prisma: { schema: "prisma/schema.prisma" } } : {},
+    ...hasDrizzle ? { drizzle: { roots: drizzleRoots, objectNames: ["db", "tx"] } } : {},
+    ...sqliteFiles.length > 0 ? { sqlite: { files: sqliteFiles } } : {}
+  };
+};
+
+// src/init/planConfigFile.ts
+var planConfigFile = (root, force) => {
+  const content = `${JSON.stringify({ schemaVersion: 1, ...detectStacks(root) }, null, 2)}
+`;
+  const path = join12(root, CONFIG_FILENAME);
+  if (!existsSync9(path)) {
+    return {
+      path: CONFIG_FILENAME,
+      disposition: "create",
+      detail: "from the detected stacks",
+      content
+    };
+  }
+  try {
+    configFromDocument(JSON.parse(readFileSync5(path, "utf8")));
+    return { path: CONFIG_FILENAME, disposition: "unchanged", detail: "valid" };
+  } catch (error) {
+    return force ? {
+      path: CONFIG_FILENAME,
+      disposition: "merge",
+      detail: "replaced (--force)",
+      content
+    } : {
+      path: CONFIG_FILENAME,
+      disposition: "conflict",
+      detail: error.message
+    };
+  }
+};
+
+// src/init/planPackageScript.ts
+import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
+import { join as join13 } from "path";
+
+// src/init/PACKAGE_MANIFEST.ts
+var PACKAGE_MANIFEST = "package.json";
+
+// src/init/planPackageScript.ts
+var planPackageScript = (root, force) => {
+  const path = join13(root, PACKAGE_MANIFEST);
+  if (!existsSync10(path)) {
+    return {
+      path: PACKAGE_MANIFEST,
+      disposition: "unchanged",
+      detail: "no package.json"
+    };
+  }
+  const manifest = JSON.parse(readFileSync6(path, "utf8"));
+  const current = manifest.scripts?.["db:gate"];
+  if (current === "codeality-db gate") {
+    return {
+      path: PACKAGE_MANIFEST,
+      disposition: "unchanged",
+      detail: "db:gate present"
+    };
+  }
+  if (current !== void 0 && !force) {
+    return {
+      path: PACKAGE_MANIFEST,
+      disposition: "conflict",
+      detail: `db:gate is "${current}"`
+    };
+  }
+  const scripts = { ...manifest.scripts, "db:gate": "codeality-db gate" };
+  const content = `${JSON.stringify({ ...manifest, scripts }, null, 2)}
+`;
+  return {
+    path: PACKAGE_MANIFEST,
+    disposition: "merge",
+    detail: "add scripts.db:gate",
+    content
+  };
+};
+
+// src/init/planWorkflow.ts
+import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
+import { join as join14 } from "path";
+var planWorkflow = (root, force) => {
+  const relative3 = ".github/workflows/db-quality.yml";
+  const content = readFileSync7(assetPath("db-quality.yml"), "utf8");
+  const path = join14(root, relative3);
+  if (!existsSync11(path)) {
+    const detail = "runs codeality-db gate on push and pull request";
+    return { path: relative3, disposition: "create", detail, content };
+  }
+  if (readFileSync7(path, "utf8") === content) {
+    return { path: relative3, disposition: "unchanged", detail: "identical" };
+  }
+  return force ? {
+    path: relative3,
+    disposition: "merge",
+    detail: "replaced (--force)",
+    content
+  } : {
+    path: relative3,
+    disposition: "conflict",
+    detail: "differs from the shipped workflow"
+  };
+};
+
+// src/init/planInit.ts
+var planInit = (root, force) => [
+  planConfigFile(root, force),
+  planPackageScript(root, force),
+  planWorkflow(root, force)
+];
+
+// src/init/renderInitPlan.ts
+var renderInitPlan = (plan) => plan.map(
+  (file) => `${file.disposition.padEnd(9)}  ${file.path}  ${file.detail}`
+).join("\n");
+
+// src/commands/initCommand.ts
+var initCommand = (argv2, io) => {
+  try {
+    const { values } = parseCommandArgs(argv2, {
+      check: { type: "boolean" },
+      apply: { type: "boolean" },
+      force: { type: "boolean" }
+    });
+    const force = values["force"] === true;
+    const plan = planInit(io.root, force);
+    io.stdout(`${renderInitPlan(plan)}
+`);
+    if (values["check"] === true) {
+      return plan.every((file) => file.disposition === "unchanged") ? ExitCode.OK : ExitCode.FINDINGS;
+    }
+    if (values["apply"] !== true && !force) return ExitCode.OK;
+    if (plan.some((file) => file.disposition === "conflict")) {
+      throw new ConfigError("conflicts remain; resolve them or pass --force");
+    }
+    applyInit(io.root, plan);
+    return ExitCode.OK;
+  } catch (error) {
+    return reportCommandError(error, io.stderr);
+  }
+};
+
+// src/cli/COMMANDS.ts
+var COMMANDS = {
+  init: initCommand,
+  check: checkCommand,
+  audit: auditCommand,
+  gate: gateCommand,
+  baseline: baselineCommand
+};
+
+// src/cli/USAGE.ts
+var USAGE = `usage: codeality-db [--project <dir>] <command> [options]
+
+  init      [--check|--apply|--force]          detect stacks, write codeality-db.json, the db:gate script and the CI workflow
+  check     [--json]                           static findings from the repository alone
+  audit     --linked|--db-url <url> [--json]   findings from the live database
+  gate      [--json]                           check (or baseline check) and the linked audit, one exit code
+  baseline  create|update|check [--check-stale]   record, refresh or enforce the debt the project carries
+
+exit codes: 0 passed, 1 findings, 2 invalid usage or configuration, 3 required tool missing or unusable
+`;
+
+// src/cli/runCli.ts
+var runCli = (argv2, io) => {
+  const args = [...argv2];
+  if (args.includes("--version")) {
+    io.stdout(`codeality-db ${PACKAGE_VERSION}
+`);
+    return ExitCode.OK;
+  }
+  if (args.includes("--help") || args.includes("-h")) {
+    io.stdout(USAGE);
+    return ExitCode.OK;
+  }
+  let root = io.root;
+  if (args[0] === "--project") {
+    root = args[1] ?? "";
+    args.splice(0, 2);
+  }
+  const [command, ...rest] = args;
+  const handler = command === void 0 ? void 0 : COMMANDS[command];
+  if (!handler) {
+    io.stderr(USAGE);
+    return ExitCode.CONFIGURATION;
+  }
+  return handler(rest, { ...io, root });
+};
+
+// src/tools/spawnRunner.ts
+import { spawnSync } from "child_process";
+import { delimiter, join as join15 } from "path";
+import { env as processEnv } from "process";
+
+// src/tools/packageBinPath.ts
+import { fileURLToPath as fileURLToPath2 } from "url";
+var packageBinPath = () => fileURLToPath2(new URL("../node_modules/.bin", import.meta.url));
+
+// src/tools/spawnRunner.ts
+var spawnRunner = (command, args, options) => {
+  const path = [
+    join15(options.cwd, "node_modules/.bin"),
+    packageBinPath(),
+    processEnv["PATH"] ?? ""
+  ].join(delimiter);
+  const child = spawnSync(command, args, {
+    cwd: options.cwd,
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024,
+    env: { ...processEnv, ...options.env, PATH: path }
+  });
+  const output = child;
+  return {
+    status: child.status ?? -1,
+    stdout: output.stdout ?? "",
+    stderr: output.stderr ?? "",
+    missing: child.error?.code === "ENOENT"
+  };
+};
+
+// src/cli.ts
+exit(
+  runCli(argv.slice(2), {
+    root: cwd(),
+    runner: spawnRunner,
+    stdout: (text) => {
+      stdout.write(text);
+    },
+    stderr: (text) => {
+      stderr.write(text);
+    }
+  })
+);
+//# sourceMappingURL=cli.js.map