auditai-scan 0.4.0 → 0.6.0

package/dist/auditai-scan.mjs

@@ -78,20 +78,20 @@ var IllegalTransitionError = class extends Error {
   to;
   name = "IllegalTransitionError";
 };
-function transition(finding3, to, opts = {}) {
-  if (!canTransition(finding3.status, to)) {
-    throw new IllegalTransitionError(finding3.id, finding3.status, to);
+function transition(finding4, to, opts = {}) {
+  if (!canTransition(finding4.status, to)) {
+    throw new IllegalTransitionError(finding4.id, finding4.status, to);
   }
   const requiresEvidence = to === "confirmed" || to === "verified";
   if (requiresEvidence && !opts.evidence) {
-    throw new Error(`Finding ${finding3.id}: transition to ${to} requires evidence`);
+    throw new Error(`Finding ${finding4.id}: transition to ${to} requires evidence`);
   }
-  if (to === "verified" && !isVerificationPassing(finding3.verification)) {
-    throw new Error(`Finding ${finding3.id}: cannot mark verified without a passing verification`);
+  if (to === "verified" && !isVerificationPassing(finding4.verification)) {
+    throw new Error(`Finding ${finding4.id}: cannot mark verified without a passing verification`);
   }
-  const evidence = opts.evidence ? [...finding3.evidence, opts.evidence] : finding3.evidence;
+  const evidence = opts.evidence ? [...finding4.evidence, opts.evidence] : finding4.evidence;
   return {
-    ...finding3,
+    ...finding4,
     status: to,
     evidence,
     updatedAt: opts.now ?? (/* @__PURE__ */ new Date()).toISOString()
@@ -100,8 +100,8 @@ function transition(finding3, to, opts = {}) {
 function isVerificationPassing(v) {
   return v !== void 0 && v.securityTestBefore === "failed" && v.securityTestAfter === "passed" && (v.existingTests === "passed" || v.existingTests === "skipped") && v.rescan === "passed";
 }
-function isDeterministic(finding3) {
-  return finding3.evidence.some((e) => e.kind === "rule" && e.data?.deterministic === true);
+function isDeterministic(finding4) {
+  return finding4.evidence.some((e) => e.kind === "rule" && e.data?.deterministic === true);
 }
 var DEFAULT_BLOCKING_POLICY = {
   minConfidence: 0.8,
@@ -109,14 +109,14 @@ var DEFAULT_BLOCKING_POLICY = {
   blockDeterministicCritical: true
 };
 var CONFIRMED_OR_LATER = ["confirmed", "fix_proposed", "fix_applied"];
-function isBlocking(finding3, policy = DEFAULT_BLOCKING_POLICY) {
-  if (finding3.status === "suppressed") return false;
-  if (finding3.status === "verified") return true;
-  if (finding3.confidence < policy.minConfidence) return false;
-  if (CONFIRMED_OR_LATER.includes(finding3.status) && policy.blockOnConfirmedSeverities.includes(finding3.severity)) {
+function isBlocking(finding4, policy = DEFAULT_BLOCKING_POLICY) {
+  if (finding4.status === "suppressed") return false;
+  if (finding4.status === "verified") return true;
+  if (finding4.confidence < policy.minConfidence) return false;
+  if (CONFIRMED_OR_LATER.includes(finding4.status) && policy.blockOnConfirmedSeverities.includes(finding4.severity)) {
     return true;
   }
-  if (policy.blockDeterministicCritical && finding3.severity === "critical" && isDeterministic(finding3) && finding3.status !== "unverified") {
+  if (policy.blockDeterministicCritical && finding4.severity === "critical" && isDeterministic(finding4) && finding4.status !== "unverified") {
     return true;
   }
   return false;
@@ -158,9 +158,15 @@ function formatScanText(r) {
   const s = r.summary;
   const out = [
     `Audit AI scan  ${displayRoot(s.root)}`,
-    `Files ${s.files} \xB7 Routes ${s.routes} \xB7 Supabase queries ${s.queries} \xB7 Tables with RLS ${s.tablesWithRls}/${s.tablesKnown} \xB7 Rules ${s.rules}`,
-    ""
+    `Files ${s.files} \xB7 Routes ${s.routes} \xB7 Supabase queries ${s.queries} \xB7 Tables with RLS ${s.tablesWithRls}/${s.tablesKnown} \xB7 Rules ${s.rules}`
   ];
+  if (s.publicTables.length > 0) {
+    const n = r.findings.filter((f) => f.evidence.some((e) => e.data?.publicTables)).length;
+    out.push(
+      `Declared public in audit.config.json: ${s.publicTables.join(", ")} (${n} read-only finding${n === 1 ? "" : "s"} suppressed by the declaration; write paths are never covered)`
+    );
+  }
+  out.push("");
   if (r.findings.length === 0) {
     out.push(
       `No findings. ${s.routes} route${s.routes === 1 ? "" : "s"} and ${s.queries} quer${s.queries === 1 ? "y" : "ies"} checked.`
@@ -181,6 +187,9 @@ function formatScanText(r) {
 `;
 }
 
+// packages/scanner/src/scan.ts
+import { statSync as statSync2 } from "node:fs";
+
 // packages/graph/src/graph.ts
 var SecurityGraph = class {
   nodes = /* @__PURE__ */ new Map();
@@ -255,7 +264,8 @@ function buildGraph(model) {
       method: h.method,
       route: h.route,
       inputs: h.inputs,
-      metadataAccesses: h.metadataAccesses
+      metadataAccesses: h.metadataAccesses,
+      roleChecks: h.roleChecks ?? []
     };
     const handler = g.addNode({
       id: `handler:${h.location.file}:${h.location.line}`,
@@ -295,7 +305,8 @@ function buildGraph(model) {
         table: q.table,
         ...q.via && q.via.length > 0 ? { via: q.via } : {},
         ...q.storage ? { storage: q.storage } : {},
-        ...q.guard ? { guard: q.guard } : {}
+        ...q.guard ? { guard: q.guard } : {},
+        ...q.ownerChecks ? { ownerChecks: q.ownerChecks } : {}
       };
       const qn = g.addNode({
         // Per handler: the same helper query reached from two entry points carries different
@@ -865,7 +876,7 @@ function isClientComponentFile(sf) {
 // packages/parser/src/parse-project.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 import { join as join3, resolve as resolve2 } from "node:path";
-import ts10 from "typescript";
+import ts11 from "typescript";
 
 // packages/parser/src/auth-evidence.ts
 import ts3 from "typescript";
@@ -1180,6 +1191,36 @@ function missingRowExit(tail, segments) {
   }
   return null;
 }
+var INEQUALITY = /* @__PURE__ */ new Set([
+  ts4.SyntaxKind.ExclamationEqualsEqualsToken,
+  ts4.SyntaxKind.ExclamationEqualsToken
+]);
+function rowComparisons(tail) {
+  const { parent } = outerOf(tail);
+  if (!parent || !ts4.isVariableDeclaration(parent)) return [];
+  const { data } = resultNames(parent.name);
+  const out = [];
+  for (const s of ifsAfter(parent)) {
+    const exit = exitKind(s.thenStatement);
+    if (!exit) continue;
+    walk(s.expression, (n) => {
+      if (!ts4.isBinaryExpression(n) || !INEQUALITY.has(n.operatorToken.kind)) return void 0;
+      for (const [a, b] of [
+        [n.left, n.right],
+        [n.right, n.left]
+      ]) {
+        const ua = unwrap(a);
+        if (!ts4.isPropertyAccessExpression(ua)) continue;
+        const r = rootName(ua.expression);
+        if (r === null || !data.has(r)) continue;
+        out.push({ column: ua.name.text, value: b, exit });
+        break;
+      }
+      return void 0;
+    });
+  }
+  return out;
+}
 function callResultChecked(call) {
   const { node, parent } = outerOf(call);
   if (!parent) return false;
@@ -1452,10 +1493,17 @@ var Resolver = class {
     }
     this.packages.sort((a, b) => b.name.length - a.name.length);
     for (const rel of tsconfigs) {
-      const read = ts6.readConfigFile(join2(root, rel), (p) => readFileSync(p, "utf8"));
-      const config = read.config;
-      if (read.error || !config) continue;
-      const co = config.compilerOptions ?? {};
+      let config;
+      try {
+        const read = ts6.readConfigFile(join2(root, rel), (p) => readFileSync(p, "utf8"));
+        if (read.error) continue;
+        config = read.config;
+      } catch (e) {
+        warnings.push(`could not read ${rel}: ${e instanceof Error ? e.message : String(e)}`);
+        continue;
+      }
+      if (!config || typeof config !== "object") continue;
+      const co = config.compilerOptions && typeof config.compilerOptions === "object" ? config.compilerOptions : {};
       const paths = co.paths;
       if (!paths || typeof paths !== "object") continue;
       const dir = dirOf(rel);
@@ -1556,7 +1604,7 @@ function isIdentPart(code) {
 function isDigit(code) {
   return code >= 48 && code <= 57;
 }
-function readQuoted(text, from, quote, backslashEscapes) {
+function readQuoted(text, from, quote2, backslashEscapes) {
   let value = "";
   let j = from + 1;
   while (j < text.length) {
@@ -1567,9 +1615,9 @@ function readQuoted(text, from, quote, backslashEscapes) {
       j += 2;
       continue;
     }
-    if (c === quote) {
-      if (text.charAt(j + 1) === quote) {
-        value += quote;
+    if (c === quote2) {
+      if (text.charAt(j + 1) === quote2) {
+        value += quote2;
         j += 2;
         continue;
       }
@@ -2091,6 +2139,213 @@ function parseTableConstraint(tokens) {
   return { kind: "other", name };
 }
 
+// packages/parser/src/sql-do-loops.ts
+function placeholders(fmt) {
+  const out = [];
+  let next = 0;
+  for (let i = 0; i < fmt.length; i += 1) {
+    if (fmt.charAt(i) !== "%") continue;
+    const rest = fmt.slice(i + 1);
+    if (rest.startsWith("%")) {
+      out.push({ kind: "s", arg: -1, start: i, end: i + 2 });
+      i += 1;
+      continue;
+    }
+    const m = /^(?:(\d+)\$)?([IsL])/.exec(rest);
+    if (!m) return null;
+    const arg = m[1] !== void 0 ? Number(m[1]) - 1 : next;
+    next = arg + 1;
+    out.push({ kind: m[2], arg, start: i, end: i + 1 + m[0].length });
+    i += m[0].length;
+  }
+  return out;
+}
+function quoteIdent(v) {
+  return /^[a-z_][a-z0-9_]*$/.test(v) ? v : `"${v.replace(/"/g, '""')}"`;
+}
+function render(fmt, args) {
+  const ph = placeholders(fmt);
+  if (ph === null) return null;
+  let out = "";
+  let from = 0;
+  for (const p of ph) {
+    out += fmt.slice(from, p.start);
+    from = p.end;
+    if (p.arg < 0) {
+      out += "%";
+      continue;
+    }
+    const v = args[p.arg];
+    if (v === void 0) return null;
+    out += p.kind === "I" ? quoteIdent(v) : p.kind === "L" ? `'${v.replace(/'/g, "''")}'` : v;
+  }
+  return out + fmt.slice(from);
+}
+function literalArg(part, loopVar, element) {
+  const first = part[0];
+  if (!first) return null;
+  if (part.length === 1 && first.kind === "string") return first.value;
+  if (loopVar === null || element === null) return null;
+  const name = identOf(first);
+  if (name === null || name.toLowerCase() !== loopVar) return null;
+  if (part.length === 1) return element;
+  if (part.length === 3 && isPunct(part[1], ".") && identOf(part[2]) !== null) return element;
+  return null;
+}
+function executedSql(tk, loopVar, element) {
+  if (!isWord(tk[0], "execute")) return null;
+  const a = tk[1];
+  if (a?.kind === "string" && tk.length === 2) return a.value;
+  if (!isWord(a, "format") || !isPunct(tk[2], "(")) return null;
+  const parts = splitTopLevelTokens(groupInner(tk, 2));
+  const fmtTok = parts[0]?.[0];
+  if (!fmtTok || parts[0]?.length !== 1 || fmtTok.kind !== "string") return null;
+  const args = [];
+  for (const part of parts.slice(1)) {
+    const v = literalArg(part, loopVar, element);
+    if (v === null) return null;
+    args.push(v);
+  }
+  return render(fmtTok.value, args);
+}
+function literalElements(expr) {
+  const arrayAt = expr.findIndex((t, i) => isWord(t, "array") && isPunct(expr[i + 1], "["));
+  if (arrayAt >= 0) {
+    const out = [];
+    for (const part of splitTopLevelTokens(groupInner(expr, arrayAt + 1))) {
+      const t = part[0];
+      if (!t || part.length !== 1 || t.kind !== "string") return null;
+      out.push(t.value);
+    }
+    return out;
+  }
+  const valuesAt = expr.findIndex((t) => isWord(t, "values"));
+  if (valuesAt >= 0) {
+    const out = [];
+    let rows = expr.slice(valuesAt + 1);
+    const close = rows.findIndex((t, i) => isPunct(t, ")") && depthAt(rows, i) < 0);
+    if (close >= 0) rows = rows.slice(0, close);
+    for (const part of splitTopLevelTokens(rows)) {
+      if (!isPunct(part[0], "(")) return null;
+      const inner = groupInner(part, 0);
+      const t = inner[0];
+      if (!t || inner.length !== 1 || t.kind !== "string") return null;
+      out.push(t.value);
+    }
+    return out;
+  }
+  return null;
+}
+function depthAt(tokens, i) {
+  let depth = 0;
+  for (let j = 0; j < i; j += 1) {
+    if (isPunct(tokens[j], "(") || isPunct(tokens[j], "[")) depth += 1;
+    else if (isPunct(tokens[j], ")") || isPunct(tokens[j], "]")) depth -= 1;
+  }
+  return depth;
+}
+function loopHeader(tk, declared) {
+  const foreach = isWord(tk[0], "foreach");
+  if (!foreach && !isWord(tk[0], "for")) return null;
+  const variable = identOf(tk[1])?.toLowerCase();
+  if (variable === void 0 || !isWord(tk[2], "in")) return null;
+  const loopAt = findWord(tk, 3, "loop");
+  if (loopAt < 0) return null;
+  let from = 3;
+  if (foreach && isWord(tk[from], "array")) from += 1;
+  if (isWord(tk[from], "reverse")) return { variable, elements: null, rest: [] };
+  const expr = tk.slice(from, loopAt);
+  const rest = tk.slice(loopAt + 1);
+  const name = expr.length === 1 ? identOf(expr[0])?.toLowerCase() : void 0;
+  if (name !== void 0) return { variable, elements: declared.get(name) ?? null, rest };
+  const elements = expr.some((t) => t.kind === "op" && t.raw === "..") ? null : literalElements(expr);
+  return { variable, elements, rest };
+}
+function declaredList(tk) {
+  let i = 0;
+  if (isWord(tk[i], "declare")) i += 1;
+  const name = identOf(tk[i])?.toLowerCase();
+  if (name === void 0) return null;
+  const assign = tk.findIndex(
+    (t, j) => j > i && (t.kind === "op" && t.raw === ":" && tk[j + 1]?.raw === "=" || isWord(t, "default"))
+  );
+  if (assign < 0) return null;
+  const elements = literalElements(tk.slice(assign + (isWord(tk[assign], "default") ? 1 : 2)));
+  return elements === null ? null : [name, elements];
+}
+function stripBegin(tk) {
+  let i = 0;
+  while (isWord(tk[i], "begin")) i += 1;
+  return tk.slice(i);
+}
+function conditionalDelta(tk) {
+  if (isWord(tk[0], "if") && findWord(tk, 1, "then") >= 0 || isWord(tk[0], "case")) return 1;
+  if (isWord(tk[0], "end") && (isWord(tk[1], "if") || isWord(tk[1], "case"))) return -1;
+  return 0;
+}
+function expandDoBlock(stmt) {
+  const body = stmt.tokens.find((t) => t.kind === "string");
+  const out = { statements: [], dynamic: false };
+  if (!body || !isWord(stmt.tokens[0], "do")) return out;
+  const inner = splitSqlStatements(body.value).map((s) => stripBegin(s.tokens));
+  const emit = (sql) => {
+    if (sql === null) {
+      out.dynamic = true;
+      return;
+    }
+    for (const s of splitSqlStatements(sql)) out.statements.push({ ...s, line: stmt.line });
+  };
+  const declared = /* @__PURE__ */ new Map();
+  for (const tk of inner) {
+    const d = declaredList(tk);
+    if (d) declared.set(d[0], d[1]);
+  }
+  let conditional = 0;
+  let loop = null;
+  const bodyStatements = [];
+  for (const tk of inner) {
+    if (tk.length === 0) continue;
+    if (loop) {
+      if (isWord(tk[0], "end") && isWord(tk[1], "loop")) {
+        if (loop.elements === null) out.dynamic = true;
+        else runLoop(loop, bodyStatements, emit);
+        loop = null;
+        bodyStatements.length = 0;
+        continue;
+      }
+      if (loopHeader(tk, declared)) {
+        loop.elements = null;
+      }
+      bodyStatements.push(tk);
+      continue;
+    }
+    const header = loopHeader(tk, declared);
+    if (header) {
+      loop = header;
+      if (conditional > 0) loop.elements = null;
+      if (header.rest.length > 0) bodyStatements.push(header.rest);
+      continue;
+    }
+    conditional = Math.max(0, conditional + conditionalDelta(tk));
+    if (isWord(tk[0], "execute")) emit(conditional > 0 ? null : executedSql(tk, null, null));
+  }
+  if (loop) out.dynamic = true;
+  return out;
+}
+function runLoop(loop, body, emit) {
+  const elements = loop.elements ?? [];
+  let conditional = 0;
+  for (const tk of body) {
+    conditional = Math.max(0, conditional + conditionalDelta(tk));
+    if (!isWord(tk[0], "execute")) continue;
+    if (conditional > 0) {
+      emit(null);
+      continue;
+    }
+    for (const element of elements) emit(executedSql(tk, loop.variable, element));
+  }
+}
+
 // packages/parser/src/sql-functions.ts
 function newFunctionRegistry() {
   return {
@@ -2548,7 +2803,8 @@ function schemaStateFor(tables) {
       uniqueIndexes: /* @__PURE__ */ new Map(),
       enums: /* @__PURE__ */ new Map(),
       functions: newFunctionRegistry(),
-      buckets: newBucketRegistry()
+      buckets: newBucketRegistry(),
+      warnings: []
     };
     STATES.set(tables, state);
   }
@@ -3022,7 +3278,8 @@ function finishSchema(state) {
     // fromEntries defines own properties, so a hostile type name like "__proto__" stays a plain key.
     enums: Object.fromEntries([...state.enums].map(([k, v]) => [k, [...v]])),
     sqlFunctions: finishFunctions(state.functions),
-    storageBuckets: finishBuckets(state.buckets)
+    storageBuckets: finishBuckets(state.buckets),
+    warnings: [...state.warnings]
   };
 }
 
@@ -3045,6 +3302,10 @@ var CREATE_POLICY = new RegExp(
   String.raw`^create\s+policy\s+("([^"]+)"|\S+)\s+on\s+${QUALIFIED}`,
   "i"
 );
+var DROP_POLICY = new RegExp(
+  String.raw`^drop\s+policy\s+(?:if\s+exists\s+)?("([^"]+)"|\S+)\s+on\s+${QUALIFIED}`,
+  "i"
+);
 function isAppliedSqlFile(rel) {
   return !/(?:^|\/)supabase\/migrations\/[^/]+\/.+\.sql$/i.test(rel.split("\\").join("/"));
 }
@@ -3052,48 +3313,166 @@ function parseSqlForRls(rel, text, into) {
   if (!isAppliedSqlFile(rel)) return;
   const state = schemaStateFor(into);
   for (const stmt of splitSqlStatements(text)) {
-    const cp = CREATE_POLICY.exec(stmt.text);
-    if (!cp?.[1] || !cp[4]) {
-      applySchemaStatement(state, stmt, rel);
-      continue;
-    }
-    const t = ensureTable(
-      state,
-      qualifiedKey({ schema: cp[3] ?? null, name: cp[4] }),
-      rel,
-      stmt.line
-    );
-    const name = cp[2] ?? cp[1];
-    const rest = stmt.text.slice(cp[0].length);
-    const cmdMatch = /\bfor\s+(select|insert|update|delete|all)\b/i.exec(rest);
-    const command = cmdMatch?.[1]?.toLowerCase() ?? "all";
-    const rolesMatch = /\bto\s+([A-Za-z_][A-Za-z0-9_]*(?:\s*,\s*[A-Za-z_][A-Za-z0-9_]*)*)/i.exec(
-      rest
-    );
-    const roles = rolesMatch?.[1] ? rolesMatch[1].split(/\s*,\s*/).map((r) => r.toLowerCase()) : [];
-    let using = null;
-    let check = null;
-    const u = /\busing\s*\(/i.exec(rest);
-    if (u) using = balanced(rest, u.index + u[0].length - 1)?.inner.trim() ?? null;
-    const c = /\bwith\s+check\s*\(/i.exec(rest);
-    if (c) check = balanced(rest, c.index + c[0].length - 1)?.inner.trim() ?? null;
-    t.policies.push(name);
-    t.policyDetails.push({
-      name,
-      command,
-      roles,
-      using,
-      check,
-      location: { file: rel, line: stmt.line }
-    });
+    applyStatement(state, stmt, rel);
+    if (!isWord(stmt.tokens[0], "do")) continue;
+    const expanded = expandDoBlock(stmt);
+    for (const s of expanded.statements) applyStatement(state, s, rel);
+    if (expanded.dynamic) warnDynamicSql(state, rel);
+  }
+}
+function warnDynamicSql(state, rel) {
+  const w = `${rel}: a DO block runs dynamic SQL (a loop over a query, or an EXECUTE that is conditional or built from expressions); RLS, policies and privileges it sets are not seen`;
+  if (!state.warnings.includes(w)) state.warnings.push(w);
+}
+var ROLE_NAME = '(?:"[A-Za-z_][A-Za-z0-9_]*"|[A-Za-z_][A-Za-z0-9_]*)';
+var ROLES = new RegExp(`\\bto\\s+(${ROLE_NAME}(?:\\s*,\\s*${ROLE_NAME})*)`, "i");
+function headEnd(rest) {
+  const u = /\busing\s*\(/i.exec(rest);
+  const c = /\bwith\s+check\s*\(/i.exec(rest);
+  const ends = [u?.index, c?.index].filter((i) => i !== void 0);
+  return ends.length === 0 ? rest.length : Math.min(...ends);
+}
+function applyStatement(state, stmt, rel) {
+  const cp = CREATE_POLICY.exec(stmt.text);
+  if (!cp?.[1] || !cp[4]) {
+    dropPolicy(state, stmt) || applySchemaStatement(state, stmt, rel);
+    return;
   }
+  const t = ensureTable(
+    state,
+    qualifiedKey({ schema: cp[3] ?? null, name: cp[4] }),
+    rel,
+    stmt.line
+  );
+  const name = cp[2] ?? cp[1];
+  const rest = stmt.text.slice(cp[0].length);
+  const cmdMatch = /\bfor\s+(select|insert|update|delete|all)\b/i.exec(rest);
+  const command = cmdMatch?.[1]?.toLowerCase() ?? "all";
+  const head = rest.slice(0, headEnd(rest));
+  const rolesMatch = ROLES.exec(head);
+  const roles = rolesMatch?.[1] ? rolesMatch[1].split(/\s*,\s*/).map((r) => r.replace(/"/g, "").toLowerCase()) : [];
+  let using = null;
+  let check = null;
+  const u = /\busing\s*\(/i.exec(rest);
+  if (u) using = balanced(rest, u.index + u[0].length - 1)?.inner.trim() ?? null;
+  const c = /\bwith\s+check\s*\(/i.exec(rest);
+  if (c) check = balanced(rest, c.index + c[0].length - 1)?.inner.trim() ?? null;
+  t.policies.push(name);
+  t.policyDetails.push({
+    name,
+    command,
+    roles,
+    using,
+    check,
+    location: { file: rel, line: stmt.line }
+  });
+}
+function dropPolicy(state, stmt) {
+  const dp = DROP_POLICY.exec(stmt.text);
+  if (!dp?.[1] || !dp[4]) return false;
+  const name = dp[2] ?? dp[1].replace(/^"|"$/g, "");
+  const t = state.tables.get(qualifiedKey({ schema: dp[3] ?? null, name: dp[4] }));
+  if (t) {
+    t.policies = t.policies.filter((p) => p !== name);
+    t.policyDetails = t.policyDetails.filter((p) => p.name !== name);
+  }
+  return true;
 }
 function sqlSchemaFor(into) {
   return finishSchema(schemaStateFor(into));
 }
 
-// packages/parser/src/storage.ts
+// packages/parser/src/role-gates.ts
 import ts7 from "typescript";
+var ROLE_PROPERTY = /^(role|roles|app_metadata|is_?admin|is_?superuser|permissions?|claims?)$/i;
+var EMAIL_PROPERTY = /^email$/i;
+function propertyPath(e) {
+  const u = unwrap(e);
+  if (ts7.isIdentifier(u)) return [u.text];
+  if (ts7.isPropertyAccessExpression(u)) {
+    const base = propertyPath(u.expression);
+    return base === null ? null : [...base, u.name.text];
+  }
+  return null;
+}
+function isLiteral(e) {
+  const u = unwrap(e);
+  return ts7.isStringLiteralLike(u) || ts7.isNumericLiteral(u) || ts7.isArrayLiteralExpression(u) || u.kind === ts7.SyntaxKind.TrueKeyword || u.kind === ts7.SyntaxKind.FalseKeyword || u.kind === ts7.SyntaxKind.NullKeyword;
+}
+function sessionClaim(e, sessionNames) {
+  const path = propertyPath(e);
+  const root = path?.[0];
+  const last = path?.[path.length - 1];
+  if (!path || path.length < 2 || root === void 0 || last === void 0) return null;
+  if (!sessionNames.has(root)) return null;
+  if (path.some((p) => p === "user_metadata")) return null;
+  if (path.some((p) => ROLE_PROPERTY.test(p))) return { source: path.join("."), kind: "role" };
+  if (EMAIL_PROPERTY.test(last)) return { source: path.join("."), kind: "email" };
+  return null;
+}
+function claimIn(cond, sessionNames) {
+  let found = null;
+  const visit = (n) => {
+    if (found !== null) return;
+    if (ts7.isCallExpression(n)) {
+      for (const a of n.arguments) {
+        const c = sessionClaim(a, sessionNames);
+        if (c) {
+          found = c.source;
+          return;
+        }
+      }
+    } else if (ts7.isBinaryExpression(n)) {
+      for (const [a, b] of [
+        [n.left, n.right],
+        [n.right, n.left]
+      ]) {
+        const c = sessionClaim(a, sessionNames);
+        if (!c) continue;
+        if (c.kind === "role" || isLiteral(b) || envNamesIn(b).length > 0) {
+          found = c.source;
+          return;
+        }
+      }
+    } else if (ts7.isPrefixUnaryExpression(n) || ts7.isPropertyAccessExpression(n)) {
+      const target = ts7.isPrefixUnaryExpression(n) ? n.operand : n;
+      const c = sessionClaim(target, sessionNames);
+      if (c?.kind === "role" && !ts7.isCallExpression(n.parent)) {
+        found = c.source;
+        return;
+      }
+    }
+    n.forEachChild(visit);
+  };
+  visit(cond);
+  return found;
+}
+function sessionNamesIn(body, isSessionCall) {
+  const out = /* @__PURE__ */ new Set();
+  walkOwn(body, (n) => {
+    if (!ts7.isVariableDeclaration(n) || !n.initializer) return;
+    const init = unwrap(n.initializer);
+    if (ts7.isCallExpression(init) && isSessionCall(init)) {
+      for (const nm of boundNames(n.name)) out.add(nm);
+    }
+  });
+  return out;
+}
+function roleGatesIn(body, sessionNames) {
+  const out = [];
+  if (sessionNames.size === 0) return out;
+  walkOwn(body, (n) => {
+    if (!ts7.isIfStatement(n)) return;
+    const exit = exitKind(n.thenStatement);
+    if (!exit) return;
+    const source = claimIn(n.expression, sessionNames);
+    if (source !== null) out.push({ node: n, source, exit });
+  });
+  return out;
+}
+
+// packages/parser/src/storage.ts
+import ts8 from "typescript";
 var STORAGE_OPS = {
   download: "select",
   list: "select",
@@ -3109,14 +3488,14 @@ var STORAGE_OPS = {
 var TWO_PATHS = /* @__PURE__ */ new Set(["move", "copy"]);
 function isStorageRoot(e) {
   const u = unwrap(e);
-  return ts7.isPropertyAccessExpression(u) && u.name.text === "storage";
+  return ts8.isPropertyAccessExpression(u) && u.name.text === "storage";
 }
 function storageBindingsIn(body) {
   const out = /* @__PURE__ */ new Map();
-  for (const decl of collect(body, ts7.isVariableDeclaration)) {
-    if (!decl.initializer || !ts7.isIdentifier(decl.name)) continue;
+  for (const decl of collect(body, ts8.isVariableDeclaration)) {
+    if (!decl.initializer || !ts8.isIdentifier(decl.name)) continue;
     const init = unwrap(decl.initializer);
-    if (!ts7.isCallExpression(init) || !ts7.isPropertyAccessExpression(init.expression)) continue;
+    if (!ts8.isCallExpression(init) || !ts8.isPropertyAccessExpression(init.expression)) continue;
     const callee = init.expression;
     if (callee.name.text !== "from" || !isStorageRoot(callee.expression)) continue;
     const root = unwrap(callee.expression);
@@ -3132,7 +3511,7 @@ function storageCallOf(chain, bound) {
     const r = unwrap(root);
     return { clientRoot: r.expression, bucketArg: first.args[0], op: known(second) };
   }
-  if (ts7.isIdentifier(root) && first) {
+  if (ts8.isIdentifier(root) && first) {
     const b = bound.get(root.text);
     if (b) return { clientRoot: b.clientRoot, bucketArg: b.bucketArg, op: known(first) };
   }
@@ -3143,9 +3522,9 @@ function bucketName(arg, sf) {
   const u = unwrap(arg);
   const lit = stringLiteralValue(u);
   if (lit !== null) return lit;
-  if (!ts7.isIdentifier(u)) return null;
-  for (const d of collect(sf, ts7.isVariableDeclaration)) {
-    if (!ts7.isIdentifier(d.name) || d.name.text !== u.text || !d.initializer) continue;
+  if (!ts8.isIdentifier(u)) return null;
+  for (const d of collect(sf, ts8.isVariableDeclaration)) {
+    if (!ts8.isIdentifier(d.name) || d.name.text !== u.text || !d.initializer) continue;
     const v = stringLiteralValue(unwrap(d.initializer));
     if (v !== null) return v;
   }
@@ -3158,20 +3537,20 @@ var INPUT_OBJECT = /^(params|searchParams|body|query|headers|cookies|formData)$/
 var CallerScope = class {
   constructor(body, inputNames) {
     this.inputNames = inputNames;
-    for (const decl of collect(body, ts7.isVariableDeclaration)) {
-      if (!decl.initializer || !ts7.isIdentifier(decl.name)) continue;
+    for (const decl of collect(body, ts8.isVariableDeclaration)) {
+      if (!decl.initializer || !ts8.isIdentifier(decl.name)) continue;
       if (this.refersToCaller(decl.initializer)) this.scopedVars.add(decl.name.text);
     }
-    for (const call of collect(body, ts7.isCallExpression)) {
+    for (const call of collect(body, ts8.isCallExpression)) {
       const callee = call.expression;
-      if (!ts7.isPropertyAccessExpression(callee) || callee.name.text !== "startsWith") continue;
+      if (!ts8.isPropertyAccessExpression(callee) || callee.name.text !== "startsWith") continue;
       const target = unwrap(callee.expression);
       const arg = call.arguments[0];
-      if (ts7.isIdentifier(target) && arg && this.refersToCaller(arg)) this.guarded.add(target.text);
+      if (ts8.isIdentifier(target) && arg && this.refersToCaller(arg)) this.guarded.add(target.text);
     }
-    for (const bin of collect(body, ts7.isBinaryExpression)) {
+    for (const bin of collect(body, ts8.isBinaryExpression)) {
       const k = bin.operatorToken.kind;
-      if (k !== ts7.SyntaxKind.EqualsEqualsEqualsToken && k !== ts7.SyntaxKind.ExclamationEqualsEqualsToken && k !== ts7.SyntaxKind.EqualsEqualsToken && k !== ts7.SyntaxKind.ExclamationEqualsToken) {
+      if (k !== ts8.SyntaxKind.EqualsEqualsEqualsToken && k !== ts8.SyntaxKind.ExclamationEqualsEqualsToken && k !== ts8.SyntaxKind.EqualsEqualsToken && k !== ts8.SyntaxKind.ExclamationEqualsToken) {
         continue;
       }
       for (const [side, other] of [
@@ -3191,13 +3570,13 @@ var CallerScope = class {
     let hit = false;
     walk(e, (n) => {
       if (hit) return false;
-      if (ts7.isPropertyAccessExpression(n) && this.isIdentityAccess(n)) {
+      if (ts8.isPropertyAccessExpression(n) && this.isIdentityAccess(n)) {
         hit = true;
         return false;
       }
-      if (ts7.isIdentifier(n)) {
+      if (ts8.isIdentifier(n)) {
         const parent = n.parent;
-        if (parent && ts7.isPropertyAccessExpression(parent) && parent.name === n) return void 0;
+        if (parent && ts8.isPropertyAccessExpression(parent) && parent.name === n) return void 0;
         if (this.scopedVars.has(n.text)) hit = true;
         else if (IDENTITY_VAR.test(n.text) && !this.inputNames.has(n.text)) hit = true;
       }
@@ -3208,17 +3587,17 @@ var CallerScope = class {
   /** A path argument is covered when it embeds the caller's id or is an identifier checked against it. */
   covers(e) {
     const u = unwrap(e);
-    return this.refersToCaller(u) || ts7.isIdentifier(u) && this.guarded.has(u.text);
+    return this.refersToCaller(u) || ts8.isIdentifier(u) && this.guarded.has(u.text);
   }
   isIdentityAccess(pa) {
     const field = pa.name.text;
     const names = [];
     let base = unwrap(pa.expression);
-    while (ts7.isPropertyAccessExpression(base)) {
+    while (ts8.isPropertyAccessExpression(base)) {
       names.push(base.name.text);
       base = unwrap(base.expression);
     }
-    if (!ts7.isIdentifier(base) || this.inputNames.has(base.text)) return false;
+    if (!ts8.isIdentifier(base) || this.inputNames.has(base.text)) return false;
     names.push(base.text);
     if (names.some((n) => INPUT_OBJECT.test(n))) return false;
     if (OWNER_FIELD.test(field)) return true;
@@ -3227,20 +3606,20 @@ var CallerScope = class {
 };
 function splitHead(e) {
   const u = unwrap(e);
-  if (!ts7.isElementAccessExpression(u)) return null;
+  if (!ts8.isElementAccessExpression(u)) return null;
   const idx = u.argumentExpression;
-  if (!ts7.isNumericLiteral(idx) || idx.text !== "0") return null;
+  if (!ts8.isNumericLiteral(idx) || idx.text !== "0") return null;
   const call = unwrap(u.expression);
-  if (!ts7.isCallExpression(call) || !ts7.isPropertyAccessExpression(call.expression)) return null;
+  if (!ts8.isCallExpression(call) || !ts8.isPropertyAccessExpression(call.expression)) return null;
   if (call.expression.name.text !== "split") return null;
   const target = unwrap(call.expression.expression);
-  return ts7.isIdentifier(target) ? target.text : null;
+  return ts8.isIdentifier(target) ? target.text : null;
 }
 function storageAccessOf(op, bucket, sf, scope, derived) {
   const pathArgs = op.args.slice(0, TWO_PATHS.has(op.name) ? 2 : 1);
   const parts = pathArgs.flatMap((a) => {
     const u = unwrap(a);
-    return ts7.isArrayLiteralExpression(u) ? [...u.elements] : [a];
+    return ts8.isArrayLiteralExpression(u) ? [...u.elements] : [a];
   });
   const tainted = parts.filter((p) => derived(p));
   const judged = tainted.length > 0 ? tainted : parts;
@@ -3254,22 +3633,22 @@ function storageAccessOf(op, bucket, sf, scope, derived) {
 }
 
 // packages/parser/src/supabase.ts
-import ts8 from "typescript";
+import ts9 from "typescript";
 var CREATE_CLIENT_CALLEES = /^(createClient|createServerClient|createBrowserClient)$/;
 function isCreateClientCall(call, sf) {
   const callee = call.expression;
-  if (ts8.isIdentifier(callee)) return CREATE_CLIENT_CALLEES.test(callee.text);
-  if (ts8.isPropertyAccessExpression(callee)) return CREATE_CLIENT_CALLEES.test(callee.name.text);
+  if (ts9.isIdentifier(callee)) return CREATE_CLIENT_CALLEES.test(callee.text);
+  if (ts9.isPropertyAccessExpression(callee)) return CREATE_CLIENT_CALLEES.test(callee.name.text);
   return CREATE_CLIENT_CALLEES.test(callee.getText(sf));
 }
 function resolveArgText(expr, sf) {
   const u = unwrap(expr);
-  if (!ts8.isIdentifier(u)) return expr.getText(sf);
+  if (!ts9.isIdentifier(u)) return expr.getText(sf);
   let scope = expr.parent;
   while (scope) {
-    if (ts8.isFunctionLike(scope) || ts8.isBlock(scope) || ts8.isSourceFile(scope)) {
-      const decl = collect(scope, ts8.isVariableDeclaration).find(
-        (d) => ts8.isIdentifier(d.name) && d.name.text === u.text && d.initializer
+    if (ts9.isFunctionLike(scope) || ts9.isBlock(scope) || ts9.isSourceFile(scope)) {
+      const decl = collect(scope, ts9.isVariableDeclaration).find(
+        (d) => ts9.isIdentifier(d.name) && d.name.text === u.text && d.initializer
       );
       if (decl?.initializer) return `${u.text} = ${decl.initializer.getText(sf)}`;
     }
@@ -3311,7 +3690,7 @@ function classifyCreateClientCall(call, sf) {
 }
 var AUTH_CALL = /\.auth\.(getUser|getSession|getClaims)\s*\(/;
 function hasModifier(node, kind) {
-  const mods = ts8.canHaveModifiers(node) ? ts8.getModifiers(node) : void 0;
+  const mods = ts9.canHaveModifiers(node) ? ts9.getModifiers(node) : void 0;
   return mods?.some((m) => m.kind === kind) ?? false;
 }
 function analyzeModule(rel, sf) {
@@ -3320,33 +3699,33 @@ function analyzeModule(rel, sf) {
   const exportedNames = /* @__PURE__ */ new Set();
   let defaultExport = null;
   for (const stmt of sf.statements) {
-    if (ts8.isImportDeclaration(stmt) && ts8.isStringLiteral(stmt.moduleSpecifier)) {
+    if (ts9.isImportDeclaration(stmt) && ts9.isStringLiteral(stmt.moduleSpecifier)) {
       const spec = stmt.moduleSpecifier.text;
       const clause = stmt.importClause;
       if (!clause) continue;
       if (clause.name) imports.set(clause.name.text, { spec, imported: "default" });
       const nb = clause.namedBindings;
-      if (nb && ts8.isNamedImports(nb)) {
+      if (nb && ts9.isNamedImports(nb)) {
         for (const el of nb.elements) {
           imports.set(el.name.text, { spec, imported: (el.propertyName ?? el.name).text });
         }
       }
-      if (nb && ts8.isNamespaceImport(nb)) imports.set(nb.name.text, { spec, imported: "*" });
-    } else if (ts8.isExportDeclaration(stmt)) {
-      const spec = stmt.moduleSpecifier && ts8.isStringLiteral(stmt.moduleSpecifier) ? stmt.moduleSpecifier.text : null;
+      if (nb && ts9.isNamespaceImport(nb)) imports.set(nb.name.text, { spec, imported: "*" });
+    } else if (ts9.isExportDeclaration(stmt)) {
+      const spec = stmt.moduleSpecifier && ts9.isStringLiteral(stmt.moduleSpecifier) ? stmt.moduleSpecifier.text : null;
       const clause = stmt.exportClause;
       if (spec && !clause) reexports.push({ star: true, spec });
-      else if (clause && ts8.isNamedExports(clause)) {
+      else if (clause && ts9.isNamedExports(clause)) {
         for (const el of clause.elements) {
           const name = (el.propertyName ?? el.name).text;
           if (spec) reexports.push({ star: false, name, alias: el.name.text, spec });
           else exportedNames.add(name);
         }
       }
-    } else if (ts8.isExportAssignment(stmt) && !stmt.isExportEquals) {
+    } else if (ts9.isExportAssignment(stmt) && !stmt.isExportEquals) {
       const e = unwrap(stmt.expression);
-      if (ts8.isIdentifier(e)) defaultExport = e.text;
-    } else if (ts8.isFunctionDeclaration(stmt) && stmt.name && hasModifier(stmt, ts8.SyntaxKind.DefaultKeyword)) {
+      if (ts9.isIdentifier(e)) defaultExport = e.text;
+    } else if (ts9.isFunctionDeclaration(stmt) && stmt.name && hasModifier(stmt, ts9.SyntaxKind.DefaultKeyword)) {
       defaultExport = stmt.name.text;
     }
   }
@@ -3361,15 +3740,15 @@ function analyzeModule(rel, sf) {
   const moduleVars = /* @__PURE__ */ new Map();
   const drizzleTables = /* @__PURE__ */ new Map();
   for (const stmt of sf.statements) {
-    if (!ts8.isVariableStatement(stmt)) continue;
-    const exported = hasModifier(stmt, ts8.SyntaxKind.ExportKeyword);
+    if (!ts9.isVariableStatement(stmt)) continue;
+    const exported = hasModifier(stmt, ts9.SyntaxKind.ExportKeyword);
     for (const d of stmt.declarationList.declarations) {
-      if (!ts8.isIdentifier(d.name) || !d.initializer || functions.has(d.name.text)) continue;
+      if (!ts9.isIdentifier(d.name) || !d.initializer || functions.has(d.name.text)) continue;
       const init = clientCreatingOperand(d.initializer);
-      if (!ts8.isCallExpression(init) && !ts8.isNewExpression(init)) continue;
-      if (ts8.isCallExpression(init)) {
+      if (!ts9.isCallExpression(init) && !ts9.isNewExpression(init)) continue;
+      if (ts9.isCallExpression(init)) {
         const callee = init.expression;
-        const fn = ts8.isIdentifier(callee) ? callee.text : ts8.isPropertyAccessExpression(callee) ? callee.name.text : "";
+        const fn = ts9.isIdentifier(callee) ? callee.text : ts9.isPropertyAccessExpression(callee) ? callee.name.text : "";
         const tableName = stringLiteralValue(init.arguments[0]);
         if ((DRIZZLE_TABLE_FNS.has(fn) || fn === "table") && tableName !== null) {
           drizzleTables.set(d.name.text, tableName);
@@ -3392,8 +3771,8 @@ function analyzeModule(rel, sf) {
   );
   if (nextAuthLocal.size > 0) {
     for (const stmt of sf.statements) {
-      if (!ts8.isVariableStatement(stmt)) continue;
-      const exported = hasModifier(stmt, ts8.SyntaxKind.ExportKeyword);
+      if (!ts9.isVariableStatement(stmt)) continue;
+      const exported = hasModifier(stmt, ts9.SyntaxKind.ExportKeyword);
       for (const name of nextAuthSessionNames(stmt, nextAuthLocal)) {
         const helper = {
           name,
@@ -3416,7 +3795,7 @@ function analyzeModule(rel, sf) {
       });
       continue;
     }
-    const creates = collect(f.fn, ts8.isCallExpression).filter((c) => isCreateClientCall(c, sf));
+    const creates = collect(f.fn, ts9.isCallExpression).filter((c) => isCreateClientCall(c, sf));
     const first = creates[0];
     if (first) {
       const { kind, evidence } = classifyCreateClientCall(first, sf);
@@ -3439,7 +3818,7 @@ function analyzeModule(rel, sf) {
 }
 
 // packages/parser/src/whole-input.ts
-import ts9 from "typescript";
+import ts10 from "typescript";
 var ELEMENT_PRESERVING = /* @__PURE__ */ new Set([
   "filter",
   "slice",
@@ -3455,35 +3834,35 @@ var ELEMENT_PRESERVING = /* @__PURE__ */ new Set([
 ]);
 var RESHAPING = /* @__PURE__ */ new Set(["map", "flatMap"]);
 var LOGICAL = /* @__PURE__ */ new Set([
-  ts9.SyntaxKind.QuestionQuestionToken,
-  ts9.SyntaxKind.BarBarToken,
-  ts9.SyntaxKind.AmpersandAmpersandToken
+  ts10.SyntaxKind.QuestionQuestionToken,
+  ts10.SyntaxKind.BarBarToken,
+  ts10.SyntaxKind.AmpersandAmpersandToken
 ]);
 function isWholeInput(e, cx) {
   const u = unwrap(e);
-  if (ts9.isIdentifier(u)) return cx.wholeName(u.text);
-  if (ts9.isPropertyAccessExpression(u) || ts9.isElementAccessExpression(u)) {
+  if (ts10.isIdentifier(u)) return cx.wholeName(u.text);
+  if (ts10.isPropertyAccessExpression(u) || ts10.isElementAccessExpression(u)) {
     return isWholeInput(u.expression, cx);
   }
-  if (ts9.isObjectLiteralExpression(u)) {
-    return u.properties.some((pr) => ts9.isSpreadAssignment(pr) && isWholeInput(pr.expression, cx));
+  if (ts10.isObjectLiteralExpression(u)) {
+    return u.properties.some((pr) => ts10.isSpreadAssignment(pr) && isWholeInput(pr.expression, cx));
   }
-  if (ts9.isArrayLiteralExpression(u)) {
-    return u.elements.some((el) => isWholeInput(ts9.isSpreadElement(el) ? el.expression : el, cx));
+  if (ts10.isArrayLiteralExpression(u)) {
+    return u.elements.some((el) => isWholeInput(ts10.isSpreadElement(el) ? el.expression : el, cx));
   }
-  if (ts9.isConditionalExpression(u)) {
+  if (ts10.isConditionalExpression(u)) {
     return isWholeInput(u.whenTrue, cx) || isWholeInput(u.whenFalse, cx);
   }
-  if (ts9.isBinaryExpression(u) && LOGICAL.has(u.operatorToken.kind)) {
+  if (ts10.isBinaryExpression(u) && LOGICAL.has(u.operatorToken.kind)) {
     return isWholeInput(u.left, cx) || isWholeInput(u.right, cx);
   }
-  if (ts9.isCallExpression(u)) return isWholeCall(u, cx);
+  if (ts10.isCallExpression(u)) return isWholeCall(u, cx);
   return false;
 }
 function isWholeCall(call, cx) {
   if (cx.requestBody(call)) return true;
   const callee = call.expression;
-  if (ts9.isPropertyAccessExpression(callee)) {
+  if (ts10.isPropertyAccessExpression(callee)) {
     const method = callee.name.text;
     const receiverWhole = isWholeInput(callee.expression, cx);
     if (RESHAPING.has(method)) return callbackKeepsWhole(call.arguments[0], receiverWhole, cx);
@@ -3491,13 +3870,13 @@ function isWholeCall(call, cx) {
   }
   return call.arguments.some((a) => {
     const ua = unwrap(a);
-    return isWholeInput(a, cx) || ts9.isIdentifier(ua) && cx.requestName(ua.text);
+    return isWholeInput(a, cx) || ts10.isIdentifier(ua) && cx.requestName(ua.text);
   });
 }
 function callbackKeepsWhole(cb, receiverWhole, cx) {
   if (!cb) return false;
   const f = unwrap(cb);
-  if (!ts9.isArrowFunction(f) && !ts9.isFunctionExpression(f)) return receiverWhole;
+  if (!ts10.isArrowFunction(f) && !ts10.isFunctionExpression(f)) return receiverWhole;
   const element = f.parameters[0];
   const elementNames = new Set(receiverWhole && element ? boundNames(element.name) : []);
   const inner = {
@@ -3508,19 +3887,19 @@ function callbackKeepsWhole(cb, receiverWhole, cx) {
   return ownReturns(f).some((r) => isWholeInput(r, inner));
 }
 function propertyKey(name) {
-  if (ts9.isIdentifier(name) || ts9.isStringLiteral(name)) return name.text;
+  if (ts10.isIdentifier(name) || ts10.isStringLiteral(name)) return name.text;
   return null;
 }
 function wholeParamNames(param, arg, cx) {
   if (!arg) return [];
   const u = unwrap(arg);
-  if (ts9.isObjectBindingPattern(param) && ts9.isObjectLiteralExpression(u) && !u.properties.some(ts9.isSpreadAssignment)) {
+  if (ts10.isObjectBindingPattern(param) && ts10.isObjectLiteralExpression(u) && !u.properties.some(ts10.isSpreadAssignment)) {
     const out = [];
     for (const el of param.elements) {
       if (el.dotDotDotToken) continue;
       const key = propertyKey(el.propertyName ?? el.name);
       const prop = u.properties.find((pr) => pr.name && propertyKey(pr.name) === key);
-      const value = prop && ts9.isPropertyAssignment(prop) ? prop.initializer : prop && ts9.isShorthandPropertyAssignment(prop) ? prop.name : void 0;
+      const value = prop && ts10.isPropertyAssignment(prop) ? prop.initializer : prop && ts10.isShorthandPropertyAssignment(prop) ? prop.name : void 0;
       if (value && isWholeInput(value, cx)) out.push(...boundNames(el.name));
     }
     return out;
@@ -3654,8 +4033,8 @@ function scopeOf(p, facts) {
   return scope;
 }
 function symOfCallee(p, callee, scope) {
-  if (ts10.isIdentifier(callee)) return scope.get(callee.text);
-  if (ts10.isPropertyAccessExpression(callee) && ts10.isIdentifier(callee.expression)) {
+  if (ts11.isIdentifier(callee)) return scope.get(callee.text);
+  if (ts11.isPropertyAccessExpression(callee) && ts11.isIdentifier(callee.expression)) {
     const ns = scope.get(callee.expression.text);
     if (ns?.kind === "namespace") return exportedSym(p, ns.facts, callee.name.text, 0) ?? void 0;
   }
@@ -3663,8 +4042,8 @@ function symOfCallee(p, callee, scope) {
 }
 function returnedExpressions(fn) {
   if (!fn.body) return [];
-  if (!ts10.isBlock(fn.body)) return [fn.body];
-  return collect(fn.body, ts10.isReturnStatement).map((r) => r.expression).filter((e) => e !== void 0);
+  if (!ts11.isBlock(fn.body)) return [fn.body];
+  return collect(fn.body, ts11.isReturnStatement).map((r) => r.expression).filter((e) => e !== void 0);
 }
 function factoryOfFunction(p, sym, depth) {
   const key = `${sym.facts.file}#${sym.name}`;
@@ -3676,7 +4055,7 @@ function factoryOfFunction(p, sym, depth) {
   let found = null;
   for (const ret of returnedExpressions(sym.fn)) {
     const u = unwrap(ret);
-    if (!ts10.isCallExpression(u)) continue;
+    if (!ts11.isCallExpression(u)) continue;
     found = classifyCall(p, u, sf, scope, null, depth + 1);
     if (found) break;
   }
@@ -3713,7 +4092,7 @@ function classifyCall(p, call, sf, scope, frame, depth) {
 }
 function prismaExtensionBase(p, call, sf, scope, frame, depth) {
   const callee = call.expression;
-  if (!ts10.isPropertyAccessExpression(callee) || callee.name.text !== "$extends") return null;
+  if (!ts11.isPropertyAccessExpression(callee) || callee.name.text !== "$extends") return null;
   if (depth > 5) return null;
   const base = unwrap(callee.expression);
   if (isPrismaNew(base)) {
@@ -3723,8 +4102,8 @@ function prismaExtensionBase(p, call, sf, scope, frame, depth) {
       location: { file: sf.fileName, line: lineOf(sf, call) }
     };
   }
-  if (ts10.isCallExpression(base)) return classifyCall(p, base, sf, scope, frame, depth + 1);
-  if (!ts10.isIdentifier(base)) return null;
+  if (ts11.isCallExpression(base)) return classifyCall(p, base, sf, scope, frame, depth + 1);
+  if (!ts11.isIdentifier(base)) return null;
   const bound = frame?.clients.get(base.text);
   if (bound) return bound;
   const sym = scope.get(base.text);
@@ -3734,15 +4113,15 @@ function instanceOfCall(p, call, frame, scope) {
   const sym = symOfCallee(p, call.expression, scope);
   if (sym?.kind !== "function") return null;
   const fscope = scopeOf(p, sym.facts);
-  const params = sym.fn.parameters.map((pp) => ts10.isIdentifier(pp.name) ? pp.name.text : null);
+  const params = sym.fn.parameters.map((pp) => ts11.isIdentifier(pp.name) ? pp.name.text : null);
   for (const ret of returnedExpressions(sym.fn)) {
     const u = unwrap(ret);
-    if (!ts10.isNewExpression(u) || !ts10.isIdentifier(u.expression)) continue;
+    if (!ts11.isNewExpression(u) || !ts11.isIdentifier(u.expression)) continue;
     const cs = fscope.get(u.expression.text);
     if (cs?.kind !== "class") continue;
     const ctorArgs = (u.arguments ?? []).map((a) => {
       const ua = unwrap(a);
-      if (ts10.isIdentifier(ua)) {
+      if (ts11.isIdentifier(ua)) {
         const j = params.indexOf(ua.text);
         if (j >= 0 && frame) return argBinding(p, call.arguments[j], frame);
       }
@@ -3774,7 +4153,7 @@ function varBinding(p, sym) {
       whole: false,
       isRequest: false
     };
-  } else if (ts10.isCallExpression(init)) {
+  } else if (ts11.isCallExpression(init)) {
     const found = classifyCall(p, init, sf, scope, null, 0);
     const client = found ? {
       kind: found.kind,
@@ -3783,7 +4162,7 @@ function varBinding(p, sym) {
     } : null;
     const instance = client ? null : instanceOfCall(p, init, null, scope);
     out = { client, instance, tainted: false, whole: false, isRequest: false };
-  } else if (ts10.isNewExpression(init) && ts10.isIdentifier(init.expression)) {
+  } else if (ts11.isNewExpression(init) && ts11.isIdentifier(init.expression)) {
     const cs = scope.get(init.expression.text);
     if (cs?.kind === "class") {
       out = {
@@ -3809,15 +4188,15 @@ function usesInput(frame, e) {
   let hit = false;
   walk(e, (n) => {
     if (hit) return false;
-    if (ts10.isCallExpression(n) && handsOverRequest(frame, n)) {
+    if (ts11.isCallExpression(n) && handsOverRequest(frame, n)) {
       hit = true;
       return false;
     }
-    if (!ts10.isIdentifier(n)) return void 0;
+    if (!ts11.isIdentifier(n)) return void 0;
     const parent = n.parent;
-    if (parent && ts10.isPropertyAccessExpression(parent) && parent.name === n) return void 0;
-    if (parent && ts10.isPropertyAssignment(parent) && parent.name === n) return void 0;
-    const member = parent && ts10.isPropertyAccessExpression(parent) && parent.expression === n;
+    if (parent && ts11.isPropertyAccessExpression(parent) && parent.name === n) return void 0;
+    if (parent && ts11.isPropertyAssignment(parent) && parent.name === n) return void 0;
+    const member = parent && ts11.isPropertyAccessExpression(parent) && parent.expression === n;
     if (frame.inputNames.has(n.text)) hit = true;
     else if (member && frame.reqNames.has(n.text) && REQUEST_MEMBER.test(parent.name.text)) {
       hit = true;
@@ -3836,46 +4215,46 @@ function handsOverRequest(frame, call) {
   if (IDENTITY_CALLEE.test(callee) || REQUEST_CLIENT_CALLEE.test(callee)) return false;
   return call.arguments.some((a) => {
     const u = unwrap(a);
-    return ts10.isIdentifier(u) && frame.reqNames.has(u.text);
+    return ts11.isIdentifier(u) && frame.reqNames.has(u.text);
   });
 }
 function propertyKeyOf(name) {
-  if (name && (ts10.isIdentifier(name) || ts10.isStringLiteral(name))) return name.text;
+  if (name && (ts11.isIdentifier(name) || ts11.isStringLiteral(name))) return name.text;
   return null;
 }
 function taintedProperties(frame, lit) {
   const out = /* @__PURE__ */ new Set();
   for (const pr of lit.properties) {
-    if (ts10.isSpreadAssignment(pr)) {
+    if (ts11.isSpreadAssignment(pr)) {
       if (derivedIn(frame, pr.expression)) return null;
       continue;
     }
     const key = propertyKeyOf(pr.name);
     if (key === null) continue;
-    if (ts10.isPropertyAssignment(pr) && derivedIn(frame, pr.initializer)) out.add(key);
-    else if (ts10.isShorthandPropertyAssignment(pr) && derivedIn(frame, pr.name)) out.add(key);
+    if (ts11.isPropertyAssignment(pr) && derivedIn(frame, pr.initializer)) out.add(key);
+    else if (ts11.isShorthandPropertyAssignment(pr) && derivedIn(frame, pr.name)) out.add(key);
   }
   return out;
 }
 function bindParamTaint(child, param, arg, frame) {
   const u = arg ? unwrap(arg) : void 0;
   let props = null;
-  if (u && ts10.isObjectLiteralExpression(u)) props = taintedProperties(frame, u);
-  else if (u && ts10.isIdentifier(u) && !frame.inputNames.has(u.text)) {
+  if (u && ts11.isObjectLiteralExpression(u)) props = taintedProperties(frame, u);
+  else if (u && ts11.isIdentifier(u) && !frame.inputNames.has(u.text)) {
     props = frame.partialInputs.get(u.text) ?? null;
   }
   if (props === null) {
     for (const nm of boundNames(param)) child.inputNames.add(nm);
     return;
   }
-  if (ts10.isIdentifier(param)) {
+  if (ts11.isIdentifier(param)) {
     child.partialInputs.set(param.text, new Set(props));
     return;
   }
   bindPatternFrom(child, param, props);
 }
 function bindPatternFrom(child, pattern, props) {
-  if (!ts10.isObjectBindingPattern(pattern)) {
+  if (!ts11.isObjectBindingPattern(pattern)) {
     if (props.size > 0) for (const nm of boundNames(pattern)) child.inputNames.add(nm);
     return;
   }
@@ -3888,11 +4267,11 @@ function bindPatternFrom(child, pattern, props) {
 }
 function isRequestBodyCall(frame, call) {
   const callee = call.expression;
-  if (!ts10.isPropertyAccessExpression(callee) || !/^(json|formData|text)$/.test(callee.name.text)) {
+  if (!ts11.isPropertyAccessExpression(callee) || !/^(json|formData|text)$/.test(callee.name.text)) {
     return false;
   }
   const recv = unwrap(callee.expression);
-  if (!ts10.isIdentifier(recv)) return false;
+  if (!ts11.isIdentifier(recv)) return false;
   if (frame.reqNames.has(recv.text)) return true;
   return frame.depth === 0 && frame.reqNames.size === 0 && REQUEST_NAME.test(recv.text);
 }
@@ -3905,7 +4284,7 @@ function wholeContext(frame) {
 }
 function receiverTainted(frame, call) {
   const callee = call.expression;
-  if (!ts10.isPropertyAccessExpression(callee) && !ts10.isElementAccessExpression(callee)) return false;
+  if (!ts11.isPropertyAccessExpression(callee) && !ts11.isElementAccessExpression(callee)) return false;
   return derivedIn(frame, callee);
 }
 function argBinding(p, arg, frame) {
@@ -3915,7 +4294,7 @@ function argBinding(p, arg, frame) {
   let client = null;
   let instance = null;
   let isRequest = false;
-  if (ts10.isIdentifier(u)) {
+  if (ts11.isIdentifier(u)) {
     client = frame.clients.get(u.text) ?? null;
     instance = frame.instances.get(u.text) ?? null;
     isRequest = frame.reqNames.has(u.text);
@@ -3927,14 +4306,14 @@ function argBinding(p, arg, frame) {
         instance = vb.instance;
       }
     }
-  } else if (ts10.isPropertyAccessExpression(u) && u.expression.kind === ts10.SyntaxKind.ThisKeyword) {
+  } else if (ts11.isPropertyAccessExpression(u) && u.expression.kind === ts11.SyntaxKind.ThisKeyword) {
     const tp = frame.thisProps.get(u.name.text);
     if (tp) {
       client = tp.client;
       instance = tp.instance;
       isRequest = tp.isRequest;
     }
-  } else if (ts10.isCallExpression(u)) {
+  } else if (ts11.isCallExpression(u)) {
     client = classifyCall(p, u, frame.sf, scope, frame, 0);
     if (!client) instance = instanceOfCall(p, u, frame, scope);
   } else if (isPrismaNew(u)) {
@@ -3943,7 +4322,7 @@ function argBinding(p, arg, frame) {
       name: "PrismaClient",
       location: { file: frame.rel, line: lineOf(frame.sf, u) }
     };
-  } else if (ts10.isNewExpression(u) && ts10.isIdentifier(u.expression)) {
+  } else if (ts11.isNewExpression(u) && ts11.isIdentifier(u.expression)) {
     const cs = scope.get(u.expression.text);
     if (cs?.kind === "class") {
       instance = {
@@ -3971,7 +4350,7 @@ function methodTarget(inst, method) {
 }
 function callTarget(p, call, frame, scope) {
   const callee = call.expression;
-  if (ts10.isIdentifier(callee)) {
+  if (ts11.isIdentifier(callee)) {
     const sym = scope.get(callee.text);
     if (sym?.kind === "function") {
       return { fn: sym.fn, facts: sym.facts, name: sym.name, cls: null, thisProps: /* @__PURE__ */ new Map() };
@@ -3987,10 +4366,10 @@ function callTarget(p, call, frame, scope) {
     }
     return null;
   }
-  if (!ts10.isPropertyAccessExpression(callee)) return null;
+  if (!ts11.isPropertyAccessExpression(callee)) return null;
   const obj = callee.expression;
   const method = callee.name.text;
-  if (ts10.isIdentifier(obj)) {
+  if (ts11.isIdentifier(obj)) {
     const inst = frame.instances.get(obj.text);
     if (inst) return methodTarget(inst, method);
     const sym = scope.get(obj.text);
@@ -4008,7 +4387,7 @@ function callTarget(p, call, frame, scope) {
     }
     return null;
   }
-  if (obj.kind === ts10.SyntaxKind.ThisKeyword && frame.cls) {
+  if (obj.kind === ts11.SyntaxKind.ThisKeyword && frame.cls) {
     const m = frame.cls.methods.get(method);
     if (!m) return null;
     return {
@@ -4019,13 +4398,13 @@ function callTarget(p, call, frame, scope) {
       thisProps: frame.thisProps
     };
   }
-  if (ts10.isPropertyAccessExpression(obj) && obj.expression.kind === ts10.SyntaxKind.ThisKeyword) {
+  if (ts11.isPropertyAccessExpression(obj) && obj.expression.kind === ts11.SyntaxKind.ThisKeyword) {
     const tp = frame.thisProps.get(obj.name.text);
     if (tp?.instance) return methodTarget(tp.instance, method);
   }
   return null;
 }
-function analyzeFrame(p, frame, acc) {
+function bindDeclarations(p, frame, acc) {
   const { rel, sf, fn } = frame;
   const scope = scopeOf(p, frame.facts);
   const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
@@ -4057,24 +4436,24 @@ function analyzeFrame(p, frame, acc) {
     for (const nm of names) addInput(kind, nm, decl, true);
     bindInput(names, true);
   };
-  for (const decl of collect(body, ts10.isVariableDeclaration)) {
+  for (const decl of collect(body, ts11.isVariableDeclaration)) {
     if (!decl.initializer) continue;
     const init = clientCreatingOperand(decl.initializer);
     const names = boundNames(decl.name);
     const text = init.getText(sf);
     aliasLocal(frame, decl.name, init);
-    const client = ts10.isCallExpression(init) ? classifyCall(p, init, sf, scope, frame, 0) : null;
-    if (client && ts10.isIdentifier(decl.name)) {
+    const client = ts11.isCallExpression(init) ? classifyCall(p, init, sf, scope, frame, 0) : null;
+    if (client && ts11.isIdentifier(decl.name)) {
       frame.clients.set(decl.name.text, client);
       continue;
     }
-    const rowsOfQuery = ts10.isCallExpression(init) && (isQueryChain(init) || isDbChain(init, frame));
+    const rowsOfQuery = ts11.isCallExpression(init) && (isQueryChain(init) || isDbChain(init, frame));
     if (frame.depth === 0 && !rowsOfQuery) {
       if (/^(params|context\.params|ctx\.params|props\.params)$/.test(text)) {
         handlerInput("route_param", names, decl);
         continue;
       }
-      if (ts10.isCallExpression(init) && isRequestCall(text)) {
+      if (ts11.isCallExpression(init) && isRequestCall(text)) {
         handlerInput("body", names, decl);
         continue;
       }
@@ -4087,9 +4466,9 @@ function analyzeFrame(p, frame, acc) {
         continue;
       }
     }
-    if (ts10.isCallExpression(init)) {
+    if (ts11.isCallExpression(init)) {
       const inst = instanceOfCall(p, init, frame, scope);
-      if (inst && ts10.isIdentifier(decl.name)) {
+      if (inst && ts11.isIdentifier(decl.name)) {
         frame.instances.set(decl.name.text, inst);
         continue;
       }
@@ -4097,34 +4476,41 @@ function analyzeFrame(p, frame, acc) {
       if (returnsIdentity(p, init, scope)) continue;
       const args = init.arguments.map((a) => argBinding(p, a, frame));
       if (args.some((a) => a.tainted || a.isRequest) || receiverTainted(frame, init)) {
-        bindInput(names, isWholeInput(init, wholeContext(frame)));
+        const rt = returnTaint(p, init, frame, scope, 0);
+        if (rt === null || rt.tainted && rt.props === null) {
+          bindInput(names, isWholeInput(init, wholeContext(frame)));
+        } else if (rt.tainted && rt.props !== null) {
+          if (ts11.isIdentifier(decl.name))
+            frame.partialInputs.set(decl.name.text, new Set(rt.props));
+          else bindPatternFrom(frame, decl.name, rt.props);
+        }
       }
-    } else if (isPrismaNew(init) && ts10.isIdentifier(decl.name)) {
+    } else if (isPrismaNew(init) && ts11.isIdentifier(decl.name)) {
       frame.clients.set(decl.name.text, {
         kind: "direct_db",
         name: decl.name.text,
         location: loc2(init)
       });
-    } else if (ts10.isNewExpression(init) && ts10.isIdentifier(init.expression) && scope.get(init.expression.text)?.kind === "class") {
+    } else if (ts11.isNewExpression(init) && ts11.isIdentifier(init.expression) && scope.get(init.expression.text)?.kind === "class") {
       const cs = scope.get(init.expression.text);
-      if (cs?.kind === "class" && ts10.isIdentifier(decl.name)) {
+      if (cs?.kind === "class" && ts11.isIdentifier(decl.name)) {
         frame.instances.set(decl.name.text, {
           cls: cs.cls,
           facts: cs.facts,
           ctorArgs: (init.arguments ?? []).map((a) => argBinding(p, a, frame))
         });
       }
-    } else if (ts10.isIdentifier(init)) {
+    } else if (ts11.isIdentifier(init)) {
       const c = frame.clients.get(init.text);
-      if (c && ts10.isIdentifier(decl.name)) frame.clients.set(decl.name.text, c);
+      if (c && ts11.isIdentifier(decl.name)) frame.clients.set(decl.name.text, c);
       const i = frame.instances.get(init.text);
-      if (i && ts10.isIdentifier(decl.name)) frame.instances.set(decl.name.text, i);
+      if (i && ts11.isIdentifier(decl.name)) frame.instances.set(decl.name.text, i);
       if (frame.inputNames.has(init.text)) {
         if (frame.depth === 0) for (const nm of names) addInput("body", nm, decl, true);
         bindInput(names, frame.wholeNames.has(init.text));
       } else {
         const partial = frame.partialInputs.get(init.text);
-        if (partial && ts10.isIdentifier(decl.name)) {
+        if (partial && ts11.isIdentifier(decl.name)) {
           frame.partialInputs.set(decl.name.text, new Set(partial));
         } else if (partial) bindPatternFrom(frame, decl.name, partial);
       }
@@ -4134,34 +4520,47 @@ function analyzeFrame(p, frame, acc) {
   }
   if (frame.depth === 0) {
     walk(body, (n) => {
-      if (ts10.isPropertyAccessExpression(n) && ts10.isIdentifier(n.expression) && n.expression.text === "params") {
+      if (ts11.isPropertyAccessExpression(n) && ts11.isIdentifier(n.expression) && n.expression.text === "params") {
         addInput("route_param", n.name.text, n, false);
       }
       return void 0;
     });
   }
-  for (const call of collect(body, ts10.isCallExpression)) {
+}
+function analyzeFrame(p, frame, acc) {
+  const { rel, sf, fn } = frame;
+  const scope = scopeOf(p, frame.facts);
+  const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
+  const body = fn.body ?? fn;
+  bindDeclarations(p, frame, acc);
+  for (const call of collect(body, ts11.isCallExpression)) {
     const callee = call.expression;
-    if (!ts10.isPropertyAccessExpression(callee) || !/^\$?transaction$/.test(callee.name.text))
+    if (!ts11.isPropertyAccessExpression(callee) || !/^\$?transaction$/.test(callee.name.text))
       continue;
-    if (!ts10.isIdentifier(callee.expression)) continue;
+    if (!ts11.isIdentifier(callee.expression)) continue;
     const outer = frame.clients.get(callee.expression.text);
-    const fn2 = call.arguments.map((a) => unwrap(a)).find((a) => ts10.isArrowFunction(a) || ts10.isFunctionExpression(a));
-    const param = fn2 && (ts10.isArrowFunction(fn2) || ts10.isFunctionExpression(fn2)) ? fn2.parameters[0] : void 0;
-    if (outer && param && ts10.isIdentifier(param.name)) frame.clients.set(param.name.text, outer);
-  }
-  for (const call of collect(body, ts10.isCallExpression)) {
-    const calleeText = call.expression.getText(sf);
-    if (/\.auth\.(getUser|getSession|getClaims)$/.test(calleeText) || symOfCallee(p, call.expression, scope)?.kind === "auth") {
-      acc.authChecks.push({ ...loc2(call), kind: "session" });
-    }
+    const fn2 = call.arguments.map((a) => unwrap(a)).find((a) => ts11.isArrowFunction(a) || ts11.isFunctionExpression(a));
+    const param = fn2 && (ts11.isArrowFunction(fn2) || ts11.isFunctionExpression(fn2)) ? fn2.parameters[0] : void 0;
+    if (outer && param && ts11.isIdentifier(param.name)) frame.clients.set(param.name.text, outer);
+  }
+  const isSessionCall = (call) => /\.auth\.(getUser|getSession|getClaims)$/.test(call.expression.getText(sf)) || symOfCallee(p, call.expression, scope)?.kind === "auth";
+  for (const call of collect(body, ts11.isCallExpression)) {
+    if (isSessionCall(call)) acc.authChecks.push({ ...loc2(call), kind: "session" });
+  }
+  for (const gate of roleGatesIn(body, sessionNamesIn(body, isSessionCall))) {
+    if (gate.exit === "return" && !frame.exitPropagates) continue;
+    acc.roleChecks.push({
+      ...loc2(gate.node),
+      source: gate.source,
+      text: gate.node.expression.getText(sf).replace(/\s+/g, " ").slice(0, 160)
+    });
   }
   for (const check of secretChecksIn(fn, sf)) {
     acc.authChecks.push({ ...loc2(check.node), kind: "secret" });
   }
-  for (const pa of collect(body, ts10.isPropertyAccessExpression)) {
+  for (const pa of collect(body, ts11.isPropertyAccessExpression)) {
     const inner = pa.expression;
-    if (ts10.isPropertyAccessExpression(inner) && (inner.name.text === "user_metadata" || inner.name.text === "app_metadata")) {
+    if (ts11.isPropertyAccessExpression(inner) && (inner.name.text === "user_metadata" || inner.name.text === "app_metadata")) {
       acc.metadataAccesses.push({
         path: pa.getText(sf),
         bucket: inner.name.text,
@@ -4173,15 +4572,15 @@ function analyzeFrame(p, frame, acc) {
   const seen = /* @__PURE__ */ new Set();
   const clientOf = (root) => {
     const u = unwrap(root);
-    if (ts10.isIdentifier(u)) {
+    if (ts11.isIdentifier(u)) {
       const b = frame.clients.get(u.text) ?? null;
       return { binding: b, name: b ? null : u.text };
     }
-    if (ts10.isCallExpression(u)) {
+    if (ts11.isCallExpression(u)) {
       const b = classifyCall(p, u, sf, scope, frame, 0);
       return { binding: b, name: b ? null : u.expression.getText(sf) };
     }
-    if (ts10.isPropertyAccessExpression(u) && u.expression.kind === ts10.SyntaxKind.ThisKeyword) {
+    if (ts11.isPropertyAccessExpression(u) && u.expression.kind === ts11.SyntaxKind.ThisKeyword) {
       const b = frame.thisProps.get(u.name.text)?.client ?? null;
       return { binding: b, name: b ? null : u.getText(sf) };
     }
@@ -4190,11 +4589,11 @@ function analyzeFrame(p, frame, acc) {
   const tableSym = (e) => {
     if (!e) return null;
     const u = unwrap(e);
-    if (ts10.isIdentifier(u)) {
+    if (ts11.isIdentifier(u)) {
       const sym = scope.get(u.text);
       return sym?.kind === "table" ? sym.table : null;
     }
-    if (ts10.isPropertyAccessExpression(u) && ts10.isIdentifier(u.expression)) {
+    if (ts11.isPropertyAccessExpression(u) && ts11.isIdentifier(u.expression)) {
       const ns = scope.get(u.expression.text);
       if (ns?.kind === "namespace") {
         const sym = exportedSym(p, ns.facts, u.name.text, 0);
@@ -4251,7 +4650,46 @@ function analyzeFrame(p, frame, acc) {
     if (frame.via.length > 0) query.via = frame.via;
     acc.queries.push(query);
   };
-  for (const call of collect(body, ts10.isCallExpression)) {
+  const supabaseFilters = (segments) => {
+    const filters = [];
+    for (const s of segments) {
+      if (!FILTER_METHODS.has(s.name)) continue;
+      const firstArg = s.args[0];
+      if (s.name === "match" && firstArg && ts11.isObjectLiteralExpression(firstArg)) {
+        for (const pr of firstArg.properties) {
+          if (ts11.isPropertyAssignment(pr)) {
+            const f2 = {
+              method: "match",
+              column: pr.name.getText(sf).replace(/['"]/g, ""),
+              valueText: pr.initializer.getText(sf),
+              inputDerived: derivedIn(frame, pr.initializer)
+            };
+            filters.push(valued(f2, pr.initializer));
+          }
+        }
+        continue;
+      }
+      const val = s.args[1];
+      const f = {
+        method: s.name,
+        column: stringLiteralValue(firstArg),
+        valueText: val ? val.getText(sf) : "",
+        inputDerived: val ? derivedIn(frame, val) : false
+      };
+      filters.push(valued(f, val));
+    }
+    return filters;
+  };
+  const builders = /* @__PURE__ */ new Map();
+  const bindBuilder = (tail, query) => {
+    const { node, parent } = outerOf(tail);
+    if (parent && ts11.isVariableDeclaration(parent) && ts11.isIdentifier(parent.name)) {
+      builders.set(parent.name.text, query);
+    } else if (parent && ts11.isBinaryExpression(parent) && parent.operatorToken.kind === ts11.SyntaxKind.EqualsToken && parent.right === node && ts11.isIdentifier(parent.left)) {
+      builders.set(parent.left.text, query);
+    }
+  };
+  for (const call of collect(body, ts11.isCallExpression)) {
     if (!isChainTail(call)) continue;
     const chain = flattenChain(call);
     const storageCall = storageCallOf(chain, storageHandles);
@@ -4260,6 +4698,18 @@ function analyzeFrame(p, frame, acc) {
       continue;
     }
     const root = unwrap(chain.root);
+    const builder = ts11.isIdentifier(root) ? builders.get(root.text) : void 0;
+    if (builder) {
+      const condition = enclosingCondition(call, body);
+      if (!condition || !derivedIn(frame, condition)) {
+        const note = condition ? ` (when ${condition.getText(sf).replace(/\s+/g, " ")})` : "";
+        for (const f of supabaseFilters(chain.segments)) {
+          builder.filters.push(note ? { ...f, valueText: `${f.valueText}${note}` } : f);
+        }
+      }
+      bindBuilder(call, builder);
+      continue;
+    }
     const first = chain.segments[0];
     const fromIdx = chain.segments.findIndex((s) => s.name === "from");
     const rpcIdx = chain.segments.findIndex((s) => s.name === "rpc");
@@ -4282,33 +4732,7 @@ function analyzeFrame(p, frame, acc) {
           break;
         }
       }
-      const filters = [];
-      for (const s of after) {
-        if (!FILTER_METHODS.has(s.name)) continue;
-        const firstArg = s.args[0];
-        if (s.name === "match" && firstArg && ts10.isObjectLiteralExpression(firstArg)) {
-          for (const pr of firstArg.properties) {
-            if (ts10.isPropertyAssignment(pr)) {
-              const f2 = {
-                method: "match",
-                column: pr.name.getText(sf).replace(/['"]/g, ""),
-                valueText: pr.initializer.getText(sf),
-                inputDerived: derivedIn(frame, pr.initializer)
-              };
-              filters.push(valued(f2, pr.initializer));
-            }
-          }
-          continue;
-        }
-        const val = s.args[1];
-        const f = {
-          method: s.name,
-          column: stringLiteralValue(firstArg),
-          valueText: val ? val.getText(sf) : "",
-          inputDerived: val ? derivedIn(frame, val) : false
-        };
-        filters.push(valued(f, val));
-      }
+      const filters = supabaseFilters(after);
       parsed = {
         anchor: anchor.node,
         table: fromTable ?? stringLiteralValue(anchor.args[0]) ?? "(dynamic)",
@@ -4337,7 +4761,7 @@ function analyzeFrame(p, frame, acc) {
         payload: payloadOf(payloadSeg?.args[0]),
         clientRoot: chain.root
       };
-    } else if (first && DRIZZLE_QUERY_API.has(first.name) && ts10.isPropertyAccessExpression(root) && ts10.isPropertyAccessExpression(root.expression) && root.expression.name.text === "query") {
+    } else if (first && DRIZZLE_QUERY_API.has(first.name) && ts11.isPropertyAccessExpression(root) && ts11.isPropertyAccessExpression(root.expression) && root.expression.name.text === "query") {
       const key = root.name.text;
       parsed = {
         anchor: first.node,
@@ -4349,7 +4773,7 @@ function analyzeFrame(p, frame, acc) {
         payload: null,
         clientRoot: root.expression.expression
       };
-    } else if (first && PRISMA_OPS[first.name] && ts10.isPropertyAccessExpression(root) && ts10.isIdentifier(root.expression) && clientOf(root.expression).binding?.kind === "direct_db") {
+    } else if (first && PRISMA_OPS[first.name] && ts11.isPropertyAccessExpression(root) && ts11.isIdentifier(root.expression) && clientOf(root.expression).binding?.kind === "direct_db") {
       const accessor = root.name.text;
       const arg = first.args[0];
       parsed = {
@@ -4382,6 +4806,13 @@ function analyzeFrame(p, frame, acc) {
         call,
         chain.segments.map((s) => s.name)
       );
+      const checks = rowComparisons(call).filter((c) => c.exit === "throw" || frame.exitPropagates).map((c) => ({
+        method: "compare",
+        column: c.column,
+        valueText: c.value.getText(sf).replace(/\s+/g, " "),
+        inputDerived: derivedIn(frame, c.value)
+      }));
+      if (checks.length > 0) query.ownerChecks = checks;
       acc.reads.push({
         query,
         keys: query.filters.map((f) => {
@@ -4389,76 +4820,151 @@ function analyzeFrame(p, frame, acc) {
           return v ? valueKey(frame, v) : null;
         }),
         order: [...frame.pathPos, parsed.anchor.getStart(sf)],
-        exits: rowExit === "throw" || rowExit === "return" && frame.exitPropagates
+        exits: rowExit === "throw" || rowExit === "return" && frame.exitPropagates,
+        checks
       });
+      bindBuilder(call, query);
     }
     if (query.filters.some((f) => f.inputDerived && isCredentialColumn(f.column))) {
       acc.authChecks.push({ ...query.location, kind: "credential" });
     }
   }
   if (frame.depth >= MAX_DEPTH) return;
-  for (const call of collect(body, ts10.isCallExpression)) {
+  for (const call of collect(body, ts11.isCallExpression)) {
     const target = callTarget(p, call, frame, scope);
     if (!target) continue;
-    const tsf = p.sources.get(target.facts.file);
-    if (!tsf) continue;
-    const child = {
-      rel: target.facts.file,
-      sf: tsf,
-      facts: target.facts,
-      fn: target.fn,
-      depth: frame.depth + 1,
-      via: [...frame.via, `${target.name} (${target.facts.file}:${lineOf(tsf, target.fn)})`],
-      inputNames: /* @__PURE__ */ new Set(),
-      wholeNames: /* @__PURE__ */ new Set(),
-      partialInputs: /* @__PURE__ */ new Map(),
-      reqNames: /* @__PURE__ */ new Set(),
-      clients: /* @__PURE__ */ new Map(),
-      instances: /* @__PURE__ */ new Map(),
-      cls: target.cls,
-      thisProps: target.thisProps,
-      key: `${target.facts.file}#${target.name}@${call.getStart(frame.sf)}`,
-      aliases: /* @__PURE__ */ new Map(),
-      pathPos: [...frame.pathPos, call.getStart(frame.sf)],
-      exitPropagates: frame.exitPropagates && callResultChecked(call)
-    };
-    const cx = wholeContext(frame);
-    target.fn.parameters.forEach((param, i) => {
-      const arg = call.arguments[i];
-      const ab = argBinding(p, arg, frame);
-      const names = boundNames(param.name);
-      const head = names[0];
-      if (ab.client && head !== void 0 && ts10.isIdentifier(param.name)) {
-        child.clients.set(head, ab.client);
-      }
-      if (ab.instance && head !== void 0 && ts10.isIdentifier(param.name)) {
-        child.instances.set(head, ab.instance);
-      }
-      for (const nm of names) if (ab.isRequest) child.reqNames.add(nm);
-      if (ab.tainted) {
-        bindParamTaint(child, param.name, arg, frame);
-        for (const nm of wholeParamNames(param.name, arg, cx)) {
-          child.inputNames.add(nm);
-          child.wholeNames.add(nm);
-        }
-        aliasParam(child, param.name, arg, frame);
-      }
-    });
-    const signature = [
-      ...[...child.clients].map(([n, c]) => `${n}=${c.kind}`),
-      ...[...child.inputNames].map((n) => `${n}!${child.wholeNames.has(n) ? "*" : ""}`),
-      ...[...child.partialInputs].map(([n, s]) => `${n}.{${[...s].sort().join("|")}}`),
-      ...[...child.reqNames].map((n) => `${n}?`),
-      ...[...child.thisProps].map(([n, b]) => `this.${n}=${b.client?.kind ?? "-"}`),
-      ...[...child.aliases].map(([n, k]) => `${n}~${k}`),
-      `exit=${child.exitPropagates}`
-    ].sort();
-    const key = `${target.facts.file}#${target.name}#${signature.join(",")}`;
+    const child = childFrame(p, call, target, frame);
+    if (!child) continue;
+    const key = `${target.facts.file}#${target.name}#${frameSignature(child)}`;
     if (acc.visited.has(key)) continue;
     acc.visited.add(key);
     analyzeFrame(p, child, acc);
   }
 }
+function childFrame(p, call, target, frame) {
+  const tsf = p.sources.get(target.facts.file);
+  if (!tsf) return null;
+  const child = {
+    rel: target.facts.file,
+    sf: tsf,
+    facts: target.facts,
+    fn: target.fn,
+    depth: frame.depth + 1,
+    via: [...frame.via, `${target.name} (${target.facts.file}:${lineOf(tsf, target.fn)})`],
+    inputNames: /* @__PURE__ */ new Set(),
+    wholeNames: /* @__PURE__ */ new Set(),
+    partialInputs: /* @__PURE__ */ new Map(),
+    reqNames: /* @__PURE__ */ new Set(),
+    clients: /* @__PURE__ */ new Map(),
+    instances: /* @__PURE__ */ new Map(),
+    cls: target.cls,
+    thisProps: target.thisProps,
+    key: `${target.facts.file}#${target.name}@${call.getStart(frame.sf)}`,
+    aliases: /* @__PURE__ */ new Map(),
+    pathPos: [...frame.pathPos, call.getStart(frame.sf)],
+    exitPropagates: frame.exitPropagates && callResultChecked(call)
+  };
+  const cx = wholeContext(frame);
+  target.fn.parameters.forEach((param, i) => {
+    const arg = call.arguments[i];
+    const ab = argBinding(p, arg, frame);
+    const names = boundNames(param.name);
+    const head = names[0];
+    if (ab.client && head !== void 0 && ts11.isIdentifier(param.name)) {
+      child.clients.set(head, ab.client);
+    }
+    if (ab.instance && head !== void 0 && ts11.isIdentifier(param.name)) {
+      child.instances.set(head, ab.instance);
+    }
+    for (const nm of names) if (ab.isRequest) child.reqNames.add(nm);
+    if (ab.tainted) {
+      bindParamTaint(child, param.name, arg, frame);
+      for (const nm of wholeParamNames(param.name, arg, cx)) {
+        child.inputNames.add(nm);
+        child.wholeNames.add(nm);
+      }
+      aliasParam(child, param.name, arg, frame);
+    }
+  });
+  return child;
+}
+function frameSignature(child) {
+  return [
+    ...[...child.clients].map(([n, c]) => `${n}=${c.kind}`),
+    ...[...child.inputNames].map((n) => `${n}!${child.wholeNames.has(n) ? "*" : ""}`),
+    ...[...child.partialInputs].map(([n, s]) => `${n}.{${[...s].sort().join("|")}}`),
+    ...[...child.reqNames].map((n) => `${n}?`),
+    ...[...child.thisProps].map(([n, b]) => `this.${n}=${b.client?.kind ?? "-"}`),
+    ...[...child.aliases].map(([n, k]) => `${n}~${k}`),
+    `exit=${child.exitPropagates}`
+  ].sort().join(",");
+}
+var CLEAN = { tainted: false, props: null };
+var TAINTED = { tainted: true, props: null };
+var MAX_RETURN_DEPTH = 2;
+function branchesOf(e) {
+  const u = unwrap(e);
+  if (ts11.isConditionalExpression(u)) return [...branchesOf(u.whenTrue), ...branchesOf(u.whenFalse)];
+  if (ts11.isBinaryExpression(u) && (u.operatorToken.kind === ts11.SyntaxKind.QuestionQuestionToken || u.operatorToken.kind === ts11.SyntaxKind.BarBarToken || u.operatorToken.kind === ts11.SyntaxKind.AmpersandAmpersandToken)) {
+    return [...branchesOf(u.left), ...branchesOf(u.right)];
+  }
+  return [u];
+}
+function isLiteralValue(e) {
+  return ts11.isStringLiteralLike(e) || ts11.isNumericLiteral(e) || e.kind === ts11.SyntaxKind.NullKeyword || e.kind === ts11.SyntaxKind.TrueKeyword || e.kind === ts11.SyntaxKind.FalseKeyword || ts11.isIdentifier(e) && e.text === "undefined";
+}
+function mergeTaint(a, b) {
+  if (!a.tainted) return b;
+  if (!b.tainted) return a;
+  if (a.props === null || b.props === null) return TAINTED;
+  return { tainted: true, props: /* @__PURE__ */ new Set([...a.props, ...b.props]) };
+}
+function leafTaint(p, leaf, child, scope, depth) {
+  if (isLiteralValue(leaf)) return CLEAN;
+  if (ts11.isObjectLiteralExpression(leaf)) {
+    const props = taintedProperties(child, leaf);
+    if (props === null) return TAINTED;
+    return props.size === 0 ? CLEAN : { tainted: true, props };
+  }
+  if (ts11.isCallExpression(leaf)) {
+    if (isChainWithQuery(leaf) || isDbChain(leaf, child)) return CLEAN;
+    if (returnsIdentity(p, leaf, scope)) return CLEAN;
+    const nested = returnTaint(p, leaf, child, scope, depth + 1);
+    if (nested !== null) return nested;
+  }
+  return derivedIn(child, leaf) ? TAINTED : CLEAN;
+}
+function returnTaint(p, call, frame, scope, depth) {
+  if (depth > MAX_RETURN_DEPTH) return null;
+  const target = callTarget(p, call, frame, scope);
+  if (!target) return null;
+  const child = childFrame(p, call, target, frame);
+  if (!child) return null;
+  const key = `${target.facts.file}#${target.name}#${frameSignature(child)}`;
+  const cached = p.returnTaints.get(key);
+  if (cached !== void 0) return cached;
+  p.returnTaints.set(key, null);
+  const scratch = {
+    inputs: [],
+    authChecks: [],
+    roleChecks: [],
+    queries: [],
+    metadataAccesses: [],
+    visited: /* @__PURE__ */ new Set(),
+    reads: []
+  };
+  bindDeclarations(p, child, scratch);
+  const childScope = scopeOf(p, child.facts);
+  let out = CLEAN;
+  for (const ret of ownReturns(target.fn)) {
+    for (const leaf of branchesOf(ret)) {
+      out = mergeTaint(out, leafTaint(p, leaf, child, childScope, depth));
+      if (out.tainted && out.props === null) break;
+    }
+  }
+  p.returnTaints.set(key, out);
+  return out;
+}
 function pushQuery(acc, q) {
   const same = acc.queries.find(
     (x) => x.location.file === q.location.file && x.location.line === q.location.line && x.text === q.text && x.client === q.client && x.clientName === q.clientName && x.filters.length === q.filters.length
@@ -4479,8 +4985,8 @@ function pushQuery(acc, q) {
 }
 function dottedPath(e) {
   const u = unwrap(e);
-  if (ts10.isIdentifier(u)) return u.text;
-  if (ts10.isPropertyAccessExpression(u)) {
+  if (ts11.isIdentifier(u)) return u.text;
+  if (ts11.isPropertyAccessExpression(u)) {
     const base = dottedPath(u.expression);
     return base === null ? null : `${base}.${u.name.text}`;
   }
@@ -4499,14 +5005,14 @@ function valueKey(frame, e) {
 function aliasLocal(frame, name, init) {
   const key = valueKey(frame, init);
   if (key === null) return;
-  if (ts10.isIdentifier(name)) {
+  if (ts11.isIdentifier(name)) {
     frame.aliases.set(name.text, key);
     return;
   }
-  if (!ts10.isObjectBindingPattern(name)) return;
+  if (!ts11.isObjectBindingPattern(name)) return;
   for (const el of name.elements) {
     const k = propertyKeyOf(el.propertyName ?? el.name);
-    if (k !== null && !el.dotDotDotToken && ts10.isIdentifier(el.name)) {
+    if (k !== null && !el.dotDotDotToken && ts11.isIdentifier(el.name)) {
       frame.aliases.set(el.name.text, `${key}.${k}`);
     }
   }
@@ -4514,51 +5020,102 @@ function aliasLocal(frame, name, init) {
 function aliasParam(child, param, arg, frame) {
   if (!arg) return;
   const u = unwrap(arg);
-  if (ts10.isIdentifier(param)) {
+  if (ts11.isIdentifier(param)) {
     const key = valueKey(frame, arg);
     if (key !== null) child.aliases.set(param.text, key);
-    else if (ts10.isObjectLiteralExpression(u)) {
+    else if (ts11.isObjectLiteralExpression(u)) {
       for (const pr of u.properties) {
         const k = propertyKeyOf(pr.name);
-        const v = ts10.isPropertyAssignment(pr) ? pr.initializer : ts10.isShorthandPropertyAssignment(pr) ? pr.name : void 0;
+        const v = ts11.isPropertyAssignment(pr) ? pr.initializer : ts11.isShorthandPropertyAssignment(pr) ? pr.name : void 0;
         const vk = k !== null && v ? valueKey(frame, v) : null;
         if (k !== null && vk !== null) child.aliases.set(`${param.text}.${k}`, vk);
       }
     }
     return;
   }
-  if (!ts10.isObjectBindingPattern(param)) return;
+  if (!ts11.isObjectBindingPattern(param)) return;
   const base = valueKey(frame, arg);
   for (const el of param.elements) {
     const k = propertyKeyOf(el.propertyName ?? el.name);
-    if (k === null || el.dotDotDotToken || !ts10.isIdentifier(el.name)) continue;
+    if (k === null || el.dotDotDotToken || !ts11.isIdentifier(el.name)) continue;
     if (base !== null) {
       child.aliases.set(el.name.text, `${base}.${k}`);
       continue;
     }
-    if (!ts10.isObjectLiteralExpression(u)) continue;
+    if (!ts11.isObjectLiteralExpression(u)) continue;
     const pr = u.properties.find((x) => propertyKeyOf(x.name) === k);
-    const v = pr && ts10.isPropertyAssignment(pr) ? pr.initializer : pr && ts10.isShorthandPropertyAssignment(pr) ? pr.name : void 0;
+    const v = pr && ts11.isPropertyAssignment(pr) ? pr.initializer : pr && ts11.isShorthandPropertyAssignment(pr) ? pr.name : void 0;
     const vk = v ? valueKey(frame, v) : null;
     if (vk !== null) child.aliases.set(el.name.text, vk);
   }
 }
-function linkGuards(reads) {
-  const col = (c) => (c ?? "").toLowerCase().replace(/_/g, "");
+function enclosingCondition(node, body) {
+  let child = node;
+  let cur = node.parent;
+  while (cur && cur !== body && !isFunctionLikeNode(cur)) {
+    if (ts11.isIfStatement(cur) && cur.expression !== child) return cur.expression;
+    child = cur;
+    cur = cur.parent;
+  }
+  return null;
+}
+var normalizeColumn = (c) => (c ?? "").toLowerCase().replace(/_/g, "");
+function singular(table) {
+  if (table.endsWith("ies")) return `${table.slice(0, -3)}y`;
+  if (table.endsWith("ses") || table.endsWith("xes")) return table.slice(0, -2);
+  return table.endsWith("s") ? table.slice(0, -1) : table;
+}
+function columnNamesTable(column, table) {
+  const c = normalizeColumn(column);
+  if (!c.endsWith("id") || c === "id") return false;
+  const stem = c.slice(0, -2);
+  const t = normalizeColumn(table);
+  return stem === t || stem === singular(t);
+}
+function guardMatch(q, g, tables) {
+  const qTable = q.query.table.toLowerCase();
+  const gTable = g.query.table.toLowerCase();
+  const info = tables.get(qTable);
+  for (let i = 0; i < q.query.filters.length; i += 1) {
+    const f = q.query.filters[i];
+    const k = q.keys[i];
+    if (!f?.inputDerived || !f.column || k === null || k === void 0) continue;
+    const j = g.keys.indexOf(k);
+    const gf = j >= 0 ? g.query.filters[j] : void 0;
+    if (!gf) continue;
+    if (qTable === gTable) {
+      if (normalizeColumn(gf.column) === normalizeColumn(f.column))
+        return { read: g, column: f.column };
+      continue;
+    }
+    const ref = info?.columnInfo?.find((c) => c.name === f.column?.toLowerCase())?.references;
+    if (ref && ref.table === gTable && normalizeColumn(ref.column) === normalizeColumn(gf.column)) {
+      return {
+        read: g,
+        column: f.column,
+        parent: { table: g.query.table, column: gf.column ?? "id", how: "foreign key" }
+      };
+    }
+    if (normalizeColumn(gf.column) === "id" && columnNamesTable(f.column, gTable)) {
+      return {
+        read: g,
+        column: f.column,
+        parent: { table: g.query.table, column: gf.column ?? "id", how: "column name" }
+      };
+    }
+  }
+  return null;
+}
+function linkGuards(reads, tables) {
   for (const q of reads) {
     let best = null;
     for (const g2 of reads) {
       if (g2 === q || !["select", "unknown"].includes(g2.query.operation)) continue;
-      if (g2.query.table.toLowerCase() !== q.query.table.toLowerCase()) continue;
       if (compareOrder(g2.order, q.order) >= 0) continue;
-      const shared = q.query.filters.findIndex((f, i) => {
-        const k = q.keys[i];
-        if (!f.inputDerived || k === null || k === void 0) return false;
-        return g2.query.filters.some((gf, j) => g2.keys[j] === k && col(gf.column) === col(f.column));
-      });
-      const column = q.query.filters[shared]?.column;
-      if (shared < 0 || !column) continue;
-      if (!best || g2.exits && !best.read.exits) best = { read: g2, column };
+      const m = guardMatch(q, g2, tables);
+      if (!m) continue;
+      const stops = (r) => r.exits || r.checks.length > 0;
+      if (!best || stops(m.read) && !stops(best.read)) best = m;
     }
     if (!best) continue;
     const g = best.read.query;
@@ -4569,20 +5126,23 @@ function linkGuards(reads) {
       clientName: g.clientName,
       filters: g.filters,
       column: best.column,
-      exitsWhenMissing: best.read.exits,
+      // A row that fails the comparison stops the entry point too; a missing one fails it as well.
+      exitsWhenMissing: best.read.exits || best.read.checks.length > 0,
       text: g.text,
-      ...g.via ? { via: g.via } : {}
+      ...g.via ? { via: g.via } : {},
+      ...best.read.checks.length > 0 ? { checks: best.read.checks } : {},
+      ...best.parent ? { parent: best.parent } : {}
     };
   }
 }
 function isChainWithQuery(e) {
-  return ts10.isCallExpression(e) && isQueryChain(e);
+  return ts11.isCallExpression(e) && isQueryChain(e);
 }
 function isDbChain(call, frame) {
   const root = unwrap(flattenChain(call).root);
   let base = root;
-  while (ts10.isPropertyAccessExpression(base)) base = base.expression;
-  return ts10.isIdentifier(base) && frame.clients.has(base.text);
+  while (ts11.isPropertyAccessExpression(base)) base = base.expression;
+  return ts11.isIdentifier(base) && frame.clients.has(base.text);
 }
 var IDENTITY_CALLEE = /\.auth\.|user|session|claims|auth|principal|viewer/i;
 function returnsIdentity(p, call, scope) {
@@ -4591,10 +5151,10 @@ function returnsIdentity(p, call, scope) {
 }
 function calleePath(e) {
   const u = unwrap(e);
-  if (ts10.isIdentifier(u)) return u.text;
-  if (ts10.isPropertyAccessExpression(u)) return `${calleePath(u.expression)}.${u.name.text}`;
-  if (ts10.isCallExpression(u)) return `${calleePath(u.expression)}()`;
-  if (ts10.isElementAccessExpression(u)) return `${calleePath(u.expression)}[]`;
+  if (ts11.isIdentifier(u)) return u.text;
+  if (ts11.isPropertyAccessExpression(u)) return `${calleePath(u.expression)}.${u.name.text}`;
+  if (ts11.isCallExpression(u)) return `${calleePath(u.expression)}()`;
+  if (ts11.isElementAccessExpression(u)) return `${calleePath(u.expression)}[]`;
   return "";
 }
 function analyzeHandler(p, h) {
@@ -4603,6 +5163,7 @@ function analyzeHandler(p, h) {
   const acc = {
     inputs: [],
     authChecks: [],
+    roleChecks: [],
     queries: [],
     metadataAccesses: [],
     visited: /* @__PURE__ */ new Set(),
@@ -4632,7 +5193,7 @@ function analyzeHandler(p, h) {
   };
   const first = fn.parameters[0];
   if (h.kind === "route" && first) {
-    if (ts10.isIdentifier(first.name)) frame.reqNames.add(first.name.text);
+    if (ts11.isIdentifier(first.name)) frame.reqNames.add(first.name.text);
     else for (const nm of boundNames(first.name)) if (REQUEST_NAME.test(nm)) frame.reqNames.add(nm);
   }
   if (h.kind === "server_action") {
@@ -4651,7 +5212,7 @@ function analyzeHandler(p, h) {
     acc.authChecks.push({ ...loc2(h.node), kind: "session" });
   }
   analyzeFrame(p, frame, acc);
-  linkGuards(acc.reads);
+  linkGuards(acc.reads, p.tables);
   const entry = h.kind === "route" ? `${h.method} ${h.route}` : h.kind === "page" ? `PAGE ${h.route}` : `server action ${h.route}`;
   const stmt = enclosingStatement(h.node);
   const ignores = parseIgnoreDirectives(sf, stmt.getFullStart()).map((d) => ({
@@ -4669,19 +5230,20 @@ function analyzeHandler(p, h) {
     authChecks: acc.authChecks,
     queries: acc.queries,
     metadataAccesses: acc.metadataAccesses,
-    ignores
+    ignores,
+    roleChecks: acc.roleChecks
   };
 }
 function publicSecretEnvReads(sf) {
-  const isProcessEnv = (e) => ts10.isPropertyAccessExpression(e) && e.name.text === "env" && ts10.isIdentifier(e.expression) && e.expression.text === "process";
+  const isProcessEnv = (e) => ts11.isPropertyAccessExpression(e) && e.name.text === "env" && ts11.isIdentifier(e.expression) && e.expression.text === "process";
   const out = [];
   const visit = (n) => {
-    if (ts10.isPropertyAccessExpression(n) && isProcessEnv(n.expression)) {
+    if (ts11.isPropertyAccessExpression(n) && isProcessEnv(n.expression)) {
       if (PUBLIC_SECRET_ENV.test(n.name.text)) out.push({ name: n.name.text, node: n });
-    } else if (ts10.isElementAccessExpression(n) && isProcessEnv(n.expression) && ts10.isStringLiteralLike(n.argumentExpression) && PUBLIC_SECRET_ENV.test(n.argumentExpression.text)) {
+    } else if (ts11.isElementAccessExpression(n) && isProcessEnv(n.expression) && ts11.isStringLiteralLike(n.argumentExpression) && PUBLIC_SECRET_ENV.test(n.argumentExpression.text)) {
       out.push({ name: n.argumentExpression.text, node: n });
     }
-    ts10.forEachChild(n, visit);
+    ts11.forEachChild(n, visit);
   };
   visit(sf);
   return out;
@@ -4696,7 +5258,7 @@ function findExposures(rel, sf) {
     });
   }
   if (isClientComponentFile(sf)) {
-    for (const call of collect(sf, ts10.isCallExpression)) {
+    for (const call of collect(sf, ts11.isCallExpression)) {
       if (!isCreateClientCall(call, sf)) continue;
       const c = classifyCreateClientCall(call, sf);
       if (c.kind === "service_role") {
@@ -4727,7 +5289,14 @@ function parseProject(rootInput, opts = {}) {
     }
   }
   const registry = /* @__PURE__ */ new Map();
-  for (const [rel, sf] of sources) registry.set(rel, analyzeModule(rel, sf));
+  for (const [rel, sf] of sources) {
+    try {
+      registry.set(rel, analyzeModule(rel, sf));
+    } catch (e) {
+      sources.delete(rel);
+      warnings.push(`could not analyse ${rel}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
   const tables = /* @__PURE__ */ new Map();
   for (const rel of sql) {
     try {
@@ -4759,12 +5328,46 @@ function parseProject(rootInput, opts = {}) {
     varBindings: /* @__PURE__ */ new Map(),
     drizzleTablesByExport,
     prismaModels,
+    returnTaints: /* @__PURE__ */ new Map(),
+    tables,
     warnings
   };
   const routes = [];
   const exposures = [];
   const fileIgnores = {};
   for (const [rel, sf] of sources) {
+    try {
+      analyzeFile(project, rel, sf, registry.get(rel) ?? analyzeModule(rel, sf), {
+        routes,
+        exposures,
+        fileIgnores
+      });
+    } catch (e) {
+      warnings.push(`could not analyse ${rel}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  routes.sort((a, b) => a.entry.localeCompare(b.entry));
+  const all = [...registry.values()];
+  const schema = sqlSchemaFor(tables);
+  warnings.push(...schema.warnings);
+  return {
+    root,
+    files: [...source, ...sql],
+    routes,
+    clientFactories: all.flatMap((f) => f.clientFactories),
+    authHelpers: all.flatMap((f) => f.authHelpers),
+    tables: [...tables.values()],
+    exposures,
+    fileIgnores,
+    warnings,
+    enums: schema.enums,
+    sqlFunctions: schema.sqlFunctions,
+    storageBuckets: schema.storageBuckets
+  };
+}
+function analyzeFile(project, rel, sf, facts, out) {
+  const { routes, exposures, fileIgnores } = out;
+  {
     const top = parseIgnoreDirectives(sf, 0).map((d) => ({
       ruleId: d.ruleId,
       reason: d.reason,
@@ -4772,7 +5375,6 @@ function parseProject(rootInput, opts = {}) {
     }));
     if (top.length > 0) fileIgnores[rel] = top;
     exposures.push(...findExposures(rel, sf));
-    const facts = registry.get(rel) ?? analyzeModule(rel, sf);
     const route = routeFromFile(rel);
     if (route) {
       for (const { method, exported } of routeHandlersIn(sf)) {
@@ -4825,23 +5427,6 @@ function parseProject(rootInput, opts = {}) {
       }
     }
   }
-  routes.sort((a, b) => a.entry.localeCompare(b.entry));
-  const all = [...registry.values()];
-  const schema = sqlSchemaFor(tables);
-  return {
-    root,
-    files: [...source, ...sql],
-    routes,
-    clientFactories: all.flatMap((f) => f.clientFactories),
-    authHelpers: all.flatMap((f) => f.authHelpers),
-    tables: [...tables.values()],
-    exposures,
-    fileIgnores,
-    warnings,
-    enums: schema.enums,
-    sqlFunctions: schema.sqlFunctions,
-    storageBuckets: schema.storageBuckets
-  };
 }
 
 // packages/rules/src/packs/sql-functions.ts
@@ -4885,16 +5470,16 @@ var SCOPE_COLUMNS = /* @__PURE__ */ new Set([
   "author_id",
   "profile_id"
 ]);
-function normalizeColumn(column) {
+function normalizeColumn2(column) {
   return column.toLowerCase().replace(/_/g, "");
 }
-var SCOPE_KEYS = new Set([...SCOPE_COLUMNS].map(normalizeColumn));
+var SCOPE_KEYS = new Set([...SCOPE_COLUMNS].map(normalizeColumn2));
 function isScopeColumn(column) {
-  return column !== null && SCOPE_KEYS.has(normalizeColumn(column));
+  return column !== null && SCOPE_KEYS.has(normalizeColumn2(column));
 }
 function isObjectIdColumn(column) {
   if (column === null || isScopeColumn(column)) return false;
-  const c = normalizeColumn(column);
+  const c = normalizeColumn2(column);
   return c === "id" || c === "uuid" || c === "slug" || c.endsWith("id");
 }
 function bypassesRls(kind) {
@@ -4925,7 +5510,8 @@ function handlerViews(ctx) {
       data,
       inputs: data.inputs ?? [],
       authenticated: kinds.length > 0,
-      operatorOnly: kinds.length > 0 && kinds.every((k) => k === "secret")
+      operatorOnly: kinds.length > 0 && kinds.every((k) => k === "secret"),
+      roleChecks: data.roleChecks ?? []
     };
   });
 }
@@ -4955,12 +5541,12 @@ function rlsNote(t, tableName, kind) {
   const bypass = kind === "direct_db" ? "a direct database connection (Drizzle/Prisma) does not go through PostgREST, so it does not apply" : "the service role bypasses it";
   return `RLS is enabled on public.${tableName} with ${t.policies.length} polic${t.policies.length === 1 ? "y" : "ies"}, but ${bypass}.`;
 }
-function finding(ctx, rule, partial) {
+function finding(ctx, rule, partial, severity) {
   return {
     id: ctx.nextId(),
     ruleId: rule.id,
     status: "likely",
-    severity: rule.severity,
+    severity: severity ?? rule.severity,
     confidence: rule.confidence,
     cwe: rule.cwe,
     createdAt: ctx.now,
@@ -4968,6 +5554,39 @@ function finding(ctx, rule, partial) {
     ...partial
   };
 }
+function anonReadPolicy(t) {
+  if (!t?.known || !t.rlsEnabled) return void 0;
+  return t.policyDetails.find(
+    (p) => (p.command === "select" || p.command === "all") && (p.using ?? "").replace(/[\s()]/g, "").toLowerCase() === "true" && (p.roles.length === 0 || p.roles.some((r) => r === "anon" || r === "public"))
+  );
+}
+function publicReadNote(p, table) {
+  return ` public.${table} is readable by the anon role through RLS policy "${p.name}" (${p.location.file}:${p.location.line}), so this read leaks nothing beyond what the anon key already returns; the repository may not have intended that policy, so the finding stays at medium.`;
+}
+function adminOnly(ctx, h, t) {
+  const check = h.roleChecks[0];
+  if (!check || !t?.known || !singleTenantTable(ctx, t.table)) return void 0;
+  return check;
+}
+function singleTenantTable(ctx, table) {
+  const info = ctx.model.tables.find((x) => x.table === table.toLowerCase());
+  if (!info || info.columns.some((c) => isScopeColumn(c))) return false;
+  for (const col of info.columnInfo ?? []) {
+    if (!col.references || col.nullable) continue;
+    const parent = ctx.model.tables.find((x) => x.table === col.references?.table);
+    if (parent?.columns.some((c) => isScopeColumn(c))) return false;
+  }
+  return true;
+}
+function adminOnlyNote(check, table) {
+  return ` Admin-only: the handler stops unless ${check.source} passes the role check at ${check.file}:${check.line} (${check.text}), and public.${table} has no tenant or owner column, so the row is shared site content rather than a tenant's; verify the admin check cannot be self-granted.`;
+}
+function tableDataOf(ctx, table) {
+  return ctx.graph.nodes.get(`table:${table}`)?.data;
+}
+function callerCheck(checks) {
+  return checks?.find((c) => isScopeColumn(c.column) && !c.inputDerived);
+}
 function guardTiesRowToCaller(guard, table, callerFns) {
   const callerFilter = guard.filters.find((f) => isScopeColumn(f.column) && !f.inputDerived);
   if (callerFilter) {
@@ -4977,6 +5596,14 @@ function guardTiesRowToCaller(guard, table, callerFns) {
       why: ""
     };
   }
+  const compared = callerCheck(guard.checks);
+  if (compared) {
+    return {
+      tied: true,
+      how: `its ${compared.column} compared with ${compared.valueText} in code, stopping otherwise`,
+      why: ""
+    };
+  }
   if (guard.client !== "user_scoped") {
     return {
       tied: false,
@@ -5017,12 +5644,19 @@ var serviceRoleObjectAccessWithoutTenantScope = {
         const filters = q.filters;
         const idFilter = filters.find((f) => f.inputDerived && isObjectIdColumn(f.column));
         if (!idFilter || filters.some((f) => isScopeColumn(f.column))) continue;
+        if (q.operation === "select" && callerCheck(q.ownerChecks)) continue;
         const guard = q.guard;
-        const tied = guard ? guardTiesRowToCaller(guard, v.tableData, callerFns) : null;
+        const guardTable = guard?.parent ? tableDataOf(ctx, guard.table) : v.tableData;
+        const tied = guard ? guardTiesRowToCaller(guard, guardTable, callerFns) : null;
         if (guard && tied?.tied && guard.exitsWhenMissing) continue;
-        const guardNote = guard && tied && (tied.tied || guard.client === "user_scoped") ? ` An earlier read of the same "${guard.column}" at ${guard.location.file}:${guard.location.line} (${tied.how}) could be an ownership check, but ${tied.tied ? "the entry point does not stop when it finds no row" : tied.why}.` : "";
+        const guardWhat = guard?.parent ? `the parent row ${guard.parent.table}.${guard.parent.column} (${q.table}.${guard.column} refers to it by ${guard.parent.how})` : `the same "${guard?.column}"`;
+        const guardNote = guard && tied && (tied.tied || guard.client === "user_scoped") ? ` An earlier read of ${guardWhat} at ${guard.location.file}:${guard.location.line} (${tied.how}) could be an ownership check, but ${tied.tied ? "the entry point does not stop when it finds no row" : tied.why}.` : "";
         const tableName = v.tableData?.table ?? q.table;
         const authNote = h.authenticated ? "The handler authenticates the caller but never checks that the row belongs to them." : "The handler does not authenticate the caller at all.";
+        const admin = adminOnly(ctx, h, v.tableData);
+        const anonPolicy = q.operation === "select" ? anonReadPolicy(v.tableData) : void 0;
+        const downgrade = admin || anonPolicy ? "medium" : void 0;
+        const downgradeNote = (admin ? adminOnlyNote(admin, tableName) : "") + (anonPolicy ? publicReadNote(anonPolicy, tableName) : "");
         const path = [
           h.data.kind === "server_action" ? "Server action call" : "HTTP request",
           h.data.entry,
@@ -5034,26 +5668,40 @@ var serviceRoleObjectAccessWithoutTenantScope = {
         const evidence = [
           {
             kind: "rule",
-            summary: `${q.operation} on public.${tableName} filtered by user-controlled "${idFilter.column}" through a ${clientNoun(v.clientData)}, with no tenant/owner scoping. ${authNote} ${rlsNote(v.tableData, tableName, v.clientData?.kind)}${viaNote(q)}${guardNote}`,
-            locations: locations(h.handler.location, v.query.location, v.client?.location),
+            summary: `${q.operation} on public.${tableName} filtered by user-controlled "${idFilter.column}" through a ${clientNoun(v.clientData)}, with no tenant/owner scoping. ${authNote} ${rlsNote(v.tableData, tableName, v.clientData?.kind)}${viaNote(q)}${guardNote}${downgradeNote}`,
+            locations: locations(
+              h.handler.location,
+              v.query.location,
+              v.client?.location,
+              admin ? { file: admin.file, line: admin.line } : void 0,
+              anonPolicy?.location
+            ),
             data: {
               deterministic: false,
               ruleId: this.id,
               authenticated: h.authenticated,
-              query: q.text
+              query: q.text,
+              ...admin ? { adminOnly: true, roleCheck: admin.source } : {},
+              ...anonPolicy ? { anonReadPolicy: anonPolicy.name } : {}
             }
           },
           { kind: "trace", summary: path.join(" -> ") }
         ];
+        const who = admin ? "Admin-only" : h.authenticated ? "Cross-tenant" : "Unauthenticated";
         out.push(
-          finding(ctx, this, {
-            title: `${h.authenticated ? "Cross-tenant" : "Unauthenticated"} ${q.operation} on "${tableName}" via ${clientNoun(v.clientData)}`,
-            entrypoints: [h.data.entry],
-            sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
-            sinks: [`supabase.${q.operation}:public.${tableName}`],
-            path,
-            evidence
-          })
+          finding(
+            ctx,
+            this,
+            {
+              title: `${who} ${q.operation} on "${tableName}" via ${clientNoun(v.clientData)}${admin ? " (verify the admin check)" : ""}`,
+              entrypoints: [h.data.entry],
+              sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
+              sinks: [`supabase.${q.operation}:public.${tableName}`],
+              path,
+              evidence
+            },
+            downgrade
+          )
         );
       }
     }
@@ -5170,7 +5818,13 @@ var rlsPolicyWithoutCallerPredicate = {
             ],
             summary: `Policy "${p.name}" for ${p.command} on public.${t.table} uses (${expr}). The table has a scope column (${t.columns.filter(isScopeColumn).join(", ")}) but the policy never compares it to auth.uid() or the caller's tenant, so RLS lets every ${p.roles.join("/") || "authenticated"} user through.`,
             title: `RLS policy "${p.name}" on "${t.table}" does not scope rows to the caller`,
-            data: { deterministic: false, ruleId: this.id, policy: p.name },
+            data: {
+              deterministic: false,
+              ruleId: this.id,
+              policy: p.name,
+              command: p.command,
+              table: t.table
+            },
             tail: locations(p.location)
           }));
           addReach(g, h, v, `supabase.${op}:public.${t.table}`);
@@ -5331,6 +5985,14 @@ var serviceRoleQueryWithoutAuthentication = {
       const v = views[0];
       if (!v) continue;
       const tables = [...new Set(views.map((x) => x.tableData?.table ?? x.data.table))];
+      const anonPolicies = views.map(
+        (x) => x.data.operation === "select" ? anonReadPolicy(x.tableData) : void 0
+      );
+      const allPublicReads = anonPolicies.every((x) => x !== void 0);
+      const publicNote = allPublicReads ? views.map((x, i) => {
+        const pol = anonPolicies[i];
+        return pol ? publicReadNote(pol, x.tableData?.table ?? x.data.table) : "";
+      }).join("") : "";
       const path = [
         h.data.kind === "server_action" ? "Server action call" : "HTTP request",
         h.data.entry,
@@ -5339,24 +6001,37 @@ var serviceRoleQueryWithoutAuthentication = {
         `public.${tables.join(", public.")}`
       ];
       out.push(
-        finding(ctx, this, {
-          title: `Unauthenticated ${views.some((v2) => v2.clientData?.kind === "direct_db") ? "database" : "service-role"} access to "${tables.join('", "')}" in ${h.data.entry}`,
-          entrypoints: [h.data.entry],
-          sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
-          sinks: views.map(
-            (x) => `supabase.${x.data.operation}:public.${x.tableData?.table ?? x.data.table}`
-          ),
-          path,
-          evidence: [
-            {
-              kind: "rule",
-              summary: `${h.data.entry} runs ${views.length} privileged quer${views.length === 1 ? "y" : "ies"} (${tables.join(", ")}; RLS does not protect them) and establishes no caller: no auth.getUser/getSession/getClaims call, no session from an auth library, no auth helper, no comparison of a request credential with a server secret (cron secret, API key, signature) and no API-key lookup was found, directly or in the helpers it calls.`,
-              locations: locations(h.handler.location, ...views.map((x) => x.query.location)),
-              data: { deterministic: false, ruleId: this.id }
-            },
-            { kind: "trace", summary: path.join(" -> ") }
-          ]
-        })
+        finding(
+          ctx,
+          this,
+          {
+            title: `Unauthenticated ${views.some((v2) => v2.clientData?.kind === "direct_db") ? "database" : "service-role"} access to "${tables.join('", "')}" in ${h.data.entry}`,
+            entrypoints: [h.data.entry],
+            sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
+            sinks: views.map(
+              (x) => `supabase.${x.data.operation}:public.${x.tableData?.table ?? x.data.table}`
+            ),
+            path,
+            evidence: [
+              {
+                kind: "rule",
+                summary: `${h.data.entry} runs ${views.length} privileged quer${views.length === 1 ? "y" : "ies"} (${tables.join(", ")}; RLS does not protect them) and establishes no caller: no auth.getUser/getSession/getClaims call, no session from an auth library, no auth helper, no comparison of a request credential with a server secret (cron secret, API key, signature) and no API-key lookup was found, directly or in the helpers it calls.${publicNote}`,
+                locations: locations(
+                  h.handler.location,
+                  ...views.map((x) => x.query.location),
+                  ...anonPolicies.map((x) => x?.location)
+                ),
+                data: {
+                  deterministic: false,
+                  ruleId: this.id,
+                  ...allPublicReads ? { anonReadPolicies: anonPolicies.map((x) => x?.name ?? "") } : {}
+                }
+              },
+              { kind: "trace", summary: path.join(" -> ") }
+            ]
+          },
+          allPublicReads ? "medium" : void 0
+        )
       );
     }
     return out;
@@ -5421,6 +6096,253 @@ var supabaseAuthorizationPack = [
   rlsPolicyWithoutCallerPredicate
 ];
 
+// packages/rules/src/packs/supabase-sql-policies.ts
+var DATA_API = "Supabase Data API (PostgREST)";
+function locations2(...refs) {
+  const out = [];
+  for (const r of refs) {
+    if (r && !out.some((o) => o.file === r.file && o.line === r.line)) out.push(r);
+  }
+  return out;
+}
+function finding2(ctx, rule, body, severity) {
+  return {
+    id: ctx.nextId(),
+    ruleId: rule.id,
+    status: "likely",
+    severity: severity ?? rule.severity,
+    confidence: rule.confidence,
+    cwe: rule.cwe,
+    createdAt: ctx.now,
+    updatedAt: ctx.now,
+    ...body
+  };
+}
+function publicTables(ctx) {
+  return ctx.model.tables.filter((t) => !t.table.includes("."));
+}
+function commandLabel(p) {
+  return p.command === "all" ? "for all commands" : `for ${p.command}`;
+}
+function roleLabel(p) {
+  return p.roles.length === 0 ? "public (no TO clause)" : p.roles.join(", ");
+}
+function quote(expr, max = 200) {
+  if (expr === null) return "(none)";
+  const one = expr.replace(/\s+/g, " ").trim();
+  return one.length > max ? `${one.slice(0, max - 1)}\u2026` : one;
+}
+var USER_METADATA = /\buser_metadata\b/i;
+var RAW_USER_META = /\braw_user_meta_data\b/i;
+var JWT_SOURCE = /auth\s*\.\s*jwt\s*\(|request\.jwt\.claim/i;
+var AUTH_USERS = /\bauth\s*\.\s*users\b/i;
+function readsSelfWrittenMetadata(expr) {
+  if (USER_METADATA.test(expr) && JWT_SOURCE.test(expr)) return true;
+  return RAW_USER_META.test(expr) && AUTH_USERS.test(expr);
+}
+var rlsPolicyTrustsUserMetadata = {
+  id: "supabase.rls-policy-trusts-user-metadata",
+  title: "RLS policy reads user_metadata from the JWT",
+  description: "A policy decides access with a claim under user_metadata (or raw_user_meta_data). Any signed-in user can write user_metadata with updateUser({ data }), and the claim lands in their next JWT without validation, so the policy grants itself. Move the claim to app_metadata, which only the service role writes, or read a roles table joined on auth.uid().",
+  severity: "critical",
+  confidence: 0.9,
+  cwe: ["CWE-602", "CWE-863"],
+  evaluate(ctx) {
+    const out = [];
+    for (const t of publicTables(ctx)) {
+      for (const p of t.policyDetails) {
+        const where2 = [];
+        if (p.using !== null && readsSelfWrittenMetadata(p.using)) where2.push(["USING", p.using]);
+        if (p.check !== null && readsSelfWrittenMetadata(p.check))
+          where2.push(["WITH CHECK", p.check]);
+        if (where2.length === 0) continue;
+        const clause = where2.map(([kind, expr]) => `${kind} ${quote(expr)}`).join(" / ");
+        const evidence = [
+          {
+            kind: "rule",
+            summary: `Policy "${p.name}" on public.${t.table} (${commandLabel(p)}, to ${roleLabel(p)}) decides access from user_metadata: ${clause}. A signed-in user sets user_metadata themselves with supabase.auth.updateUser({ data: { ... } }); the value is copied into their next access token without any check, so the caller can grant themselves whatever this predicate asks for. app_metadata cannot be written this way, and a roles table joined on auth.uid() cannot either.`,
+            locations: locations2(p.location, t.location),
+            // No `deterministic: true`: a critical deterministic finding blocks the GitHub
+            // check, and this rule has not been seen on a real repository yet (zero hits on the
+            // 26-repository corpus of 13 Sept 2026). It blocks once measured, not before.
+            data: {
+              ruleId: this.id,
+              table: t.table,
+              policy: p.name,
+              command: p.command
+            }
+          },
+          {
+            kind: "trace",
+            summary: [
+              "Any signed-in user",
+              'auth.updateUser({ data: { role: "admin" } })',
+              "the claim is signed into the next JWT",
+              `policy "${p.name}" reads it from user_metadata`,
+              `public.${t.table} (${commandLabel(p)})`
+            ].join(" -> ")
+          }
+        ];
+        out.push(
+          finding2(ctx, this, {
+            title: `Policy "${p.name}" on "${t.table}" trusts user_metadata`,
+            entrypoints: [DATA_API],
+            sources: ["jwt:user_metadata"],
+            sinks: [`supabase.policy:public.${t.table}`],
+            path: [
+              "Any signed-in user",
+              "user_metadata written by the user",
+              `policy "${p.name}"`,
+              `public.${t.table}`
+            ],
+            evidence
+          })
+        );
+      }
+    }
+    return out;
+  }
+};
+var policiesWithoutRlsEnabled = {
+  id: "supabase.policies-without-rls-enabled",
+  title: "Policies exist but RLS is never enabled on the table",
+  description: "A migration writes policies for a table but never runs `alter table ... enable row level security`, so the policies have no effect and the table stays fully readable and writable through the Data API. Every reviewer who sees the policies assumes the table is protected. Supabase's own lint (0007) reports the same shape.",
+  severity: "high",
+  confidence: 0.9,
+  cwe: ["CWE-284"],
+  evaluate(ctx) {
+    const out = [];
+    for (const t of publicTables(ctx)) {
+      if (t.rlsEnabled || t.policyDetails.length === 0) continue;
+      const names = t.policyDetails.map((p) => `"${p.name}" (${commandLabel(p)})`).join(", ");
+      const evidence = [
+        {
+          kind: "rule",
+          summary: `public.${t.table} has ${t.policyDetails.length} ${t.policyDetails.length === 1 ? "policy" : "policies"} \u2014 ${names} \u2014 and no "alter table public.${t.table} enable row level security" anywhere in the migrations. Policies only apply to a table with RLS on, so every one of them is dead and the table is fully readable and writable by anyone holding the public anon key. The policies say what the intent was, which is what makes this a defect rather than a choice.`,
+          locations: locations2(t.location, t.policyDetails[0]?.location),
+          data: {
+            deterministic: true,
+            ruleId: this.id,
+            table: t.table,
+            policies: t.policyDetails.map((p) => p.name)
+          }
+        },
+        {
+          kind: "trace",
+          summary: [
+            "Anyone with the public anon key",
+            "PostgREST",
+            `public.${t.table} (RLS never enabled)`,
+            `${t.policyDetails.length} policies that never run`
+          ].join(" -> ")
+        }
+      ];
+      out.push(
+        finding2(ctx, this, {
+          title: `Table "${t.table}" has policies but RLS is off`,
+          entrypoints: [DATA_API],
+          sources: ["anon-key"],
+          sinks: [`supabase.select:public.${t.table}`],
+          path: [
+            "Anyone with the public anon key",
+            "PostgREST",
+            `public.${t.table} (RLS off, policies inert)`
+          ],
+          evidence
+        })
+      );
+    }
+    return out;
+  }
+};
+function isTautology(expr) {
+  if (expr === null) return false;
+  return /^\(*\s*true\s*\)*$/i.test(expr.trim());
+}
+var ANON_ROLES = /* @__PURE__ */ new Set(["anon", "public"]);
+function reachableByAnon(p) {
+  if (p.roles.length === 0) return true;
+  return p.roles.some((r) => ANON_ROLES.has(r.toLowerCase().replace(/^"|"$/g, "")));
+}
+var WRITE_COMMANDS = /* @__PURE__ */ new Set(["insert", "update", "delete", "all"]);
+var anonWritePolicy = {
+  id: "supabase.anon-write-policy",
+  title: "Write policy open to anon or every role",
+  description: "An insert, update or delete policy targets anon (or omits the TO clause, which means PUBLIC) and decides with `true`. Anyone holding the public anon key writes the table directly through PostgREST, including rows that belong to signed-in users, whether or not the application has a form for it.",
+  severity: "high",
+  confidence: 0.85,
+  cwe: ["CWE-284", "CWE-862"],
+  evaluate(ctx) {
+    const out = [];
+    for (const t of publicTables(ctx)) {
+      if (!t.rlsEnabled) continue;
+      for (const p of t.policyDetails) {
+        if (!WRITE_COMMANDS.has(p.command) || !reachableByAnon(p)) continue;
+        const decides = p.command === "insert" ? [["WITH CHECK", p.check]] : p.command === "all" ? [
+          ["USING", p.using],
+          ["WITH CHECK", p.check]
+        ] : [["USING", p.using]];
+        const open = decides.filter(([, expr]) => isTautology(expr));
+        if (open.length === 0) continue;
+        const insertOnly = p.command === "insert";
+        const severity = insertOnly ? "medium" : "high";
+        const clause = open.map(([kind, expr]) => `${kind} ${quote(expr)}`).join(" / ");
+        const verbs = p.command === "all" ? "insert, update and delete" : `${p.command} rows in`;
+        const evidence = [
+          {
+            kind: "rule",
+            summary: `Policy "${p.name}" on public.${t.table} is ${commandLabel(p)} to ${roleLabel(p)} and decides with a tautology: ${clause}. Anyone holding the public anon key can ${verbs} public.${t.table} straight through PostgREST, without going through this application.${insertOnly ? " An insert-only policy is how deliberate public forms are written, so this is reported as medium: check that the table is meant to accept rows from strangers and that a rate limit and a validation trigger exist." : " Rows that belong to signed-in users can be changed or deleted by a stranger."}`,
+            locations: locations2(p.location, t.location),
+            data: {
+              deterministic: true,
+              ruleId: this.id,
+              table: t.table,
+              policy: p.name,
+              command: p.command,
+              roles: p.roles
+            }
+          },
+          {
+            kind: "trace",
+            summary: [
+              "Anyone with the public anon key",
+              "PostgREST",
+              `policy "${p.name}" (${commandLabel(p)}, to ${roleLabel(p)}, ${clause})`,
+              `public.${t.table}`
+            ].join(" -> ")
+          }
+        ];
+        out.push(
+          finding2(
+            ctx,
+            this,
+            {
+              title: `Policy "${p.name}" lets anyone ${p.command === "all" ? "write" : p.command} "${t.table}"`,
+              entrypoints: [DATA_API],
+              sources: ["anon-key"],
+              sinks: [`supabase.${p.command === "all" ? "insert" : p.command}:public.${t.table}`],
+              path: [
+                "Anyone with the public anon key",
+                "PostgREST",
+                `policy "${p.name}" (${commandLabel(p)}, to ${roleLabel(p)})`,
+                `public.${t.table}`
+              ],
+              evidence
+            },
+            severity
+          )
+        );
+      }
+    }
+    return out;
+  }
+};
+var supabaseSqlPoliciesPack = [
+  rlsPolicyTrustsUserMetadata,
+  policiesWithoutRlsEnabled,
+  anonWritePolicy
+];
+
 // packages/rules/src/packs/supabase-storage-rpc.ts
 function reaches(ctx) {
   const out = [];
@@ -5443,7 +6365,7 @@ function reaches(ctx) {
   }
   return out;
 }
-function locations2(...refs) {
+function locations3(...refs) {
   const out = [];
   for (const r of refs) {
     if (r && !out.some((o) => o.file === r.file && o.line === r.line)) out.push(r);
@@ -5453,7 +6375,7 @@ function locations2(...refs) {
 function unique(values) {
   return [...new Set(values)];
 }
-function finding2(ctx, rule, body, severity) {
+function finding3(ctx, rule, body, severity) {
   return {
     id: ctx.nextId(),
     ruleId: rule.id,
@@ -5509,7 +6431,7 @@ var storageObjectAccessWithoutOwnerScope = {
         {
           kind: "rule",
           summary: `storage.from(${s.bucket === null ? "\u2026" : `"${s.bucket}"`}).${s.op}(${s.pathText}) runs through ${client}, a service-role client, so storage policies on storage.objects do not apply. The object path comes from the request and is neither prefixed with nor checked against the caller's user id, so any signed-in user can ${verb} any object in ${bucketLabel(s.bucket)}, including other users' files. The handler authenticates the caller but never ties the path to them.${via}`,
-          locations: locations2(r.handler.location, r.query.location, r.client?.location),
+          locations: locations3(r.handler.location, r.query.location, r.client?.location),
           data: {
             deterministic: false,
             ruleId: this.id,
@@ -5522,7 +6444,7 @@ var storageObjectAccessWithoutOwnerScope = {
         { kind: "trace", summary: path.join(" -> ") }
       ];
       out.push(
-        finding2(ctx, this, {
+        finding3(ctx, this, {
           title: `Cross-user storage ${s.op} in ${bucketLabel(s.bucket)} via service-role client`,
           entrypoints: [r.handlerData.entry],
           sources: r.inputs.map((i) => `${i.kind}:${i.name}`),
@@ -5629,7 +6551,7 @@ var storagePolicyWithoutOwnerCheck = {
         ];
         const reachNote = entries.length > 0 ? ` The app reaches the bucket from ${entries.join(", ")} with a client that relies on this policy.` : "";
         out.push(
-          finding2(ctx, this, {
+          finding3(ctx, this, {
             title: `Storage policy "${p.name}" lets ${who} ${verb} every object in ${buckets.length > 0 ? `bucket ${where2}` : "every bucket"}`,
             entrypoints: [...entries, storageEntry],
             sources: unique([
@@ -5642,7 +6564,7 @@ var storagePolicyWithoutOwnerCheck = {
               {
                 kind: "rule",
                 summary: `Policy "${p.name}" for ${p.command} on storage.objects ${clause} (${expr}) checks only the bucket: no auth.uid(), no storage.foldername(name) ownership, no owner column. So ${whoLong} can ${verb} every object in ${where2}, including other users' files, straight through the Storage API.${privateNote}${reachNote} Scope it to the owner, e.g. bucket_id = '${buckets[0] ?? "<bucket>"}' and (storage.foldername(name))[1] = (select auth.uid())::text.`,
-                locations: locations2(p.location, ...reached.map((r) => r.query.location)),
+                locations: locations3(p.location, ...reached.map((r) => r.query.location)),
                 data: { deterministic: false, ruleId: this.id, policy: p.name, buckets }
               },
               { kind: "trace", summary: path.join(" -> ") }
@@ -5690,7 +6612,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
         "no auth.uid() / auth.jwt() check"
       ];
       out.push(
-        finding2(
+        finding3(
           ctx,
           this,
           {
@@ -5706,7 +6628,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
               {
                 kind: "rule",
                 summary: `public.${fn.name}() is SECURITY DEFINER: it runs with the rights of its owner and Row Level Security does not apply inside it. Its body never reads the caller's identity (auth.uid(), auth.jwt(), auth.email() or the request JWT), so whatever it returns or changes is available to every role that can execute it: ${roles.join(", ")}. ${who} at ${endpoint}.${callNote} Filter by auth.uid() inside the function, make it SECURITY INVOKER, or revoke EXECUTE from public, anon and authenticated.`,
-                locations: locations2(
+                locations: locations3(
                   fn.location,
                   ...sites.flatMap((s) => [s.handler.location, s.query.location])
                 ),
@@ -5751,8 +6673,40 @@ function runRules(rules, model, graph, opts = {}) {
     }
   }
   findings = applySuppressions(findings, model, now);
+  findings = applyPublicTables(findings, opts.publicTables ?? [], now);
   return findings;
 }
+var PUBLIC_TABLE_RULES = /* @__PURE__ */ new Set([
+  "supabase.service-role-query-without-authentication",
+  "supabase.rls-policy-without-caller-predicate"
+]);
+var READ_SINK = /^supabase\.select:public\.(.+)$/;
+function applyPublicTables(findings, publicTables2, now) {
+  if (publicTables2.length === 0) return findings;
+  const declared = new Set(publicTables2.map((t) => t.toLowerCase()));
+  return findings.map((f) => {
+    if (f.status === "suppressed" || !PUBLIC_TABLE_RULES.has(f.ruleId)) return f;
+    if (f.sinks.length === 0) return f;
+    const tables = [];
+    for (const sink of f.sinks) {
+      const table = READ_SINK.exec(sink)?.[1];
+      if (table === void 0 || !declared.has(table.toLowerCase())) return f;
+      if (!tables.includes(table)) tables.push(table);
+    }
+    const command = f.evidence[0]?.data?.command;
+    if (f.ruleId === "supabase.rls-policy-without-caller-predicate" && command !== "select") {
+      return f;
+    }
+    return transition(f, "suppressed", {
+      evidence: {
+        kind: "rule",
+        summary: `Suppressed: declared public in audit.config.json (publicTables: ${tables.join(", ")}). Every query of this finding only reads ${tables.map((t) => `public.${t}`).join(", ")}; the declaration never covers insert, update, delete or rpc paths, nor the object-access and mass-assignment rules.`,
+        data: { suppressed: true, ruleId: f.ruleId, publicTables: tables }
+      },
+      now
+    });
+  });
+}
 function applySuppressions(findings, model, now) {
   const byEntry = new Map(model.routes.map((h) => [h.entry, h.ignores]));
   return findings.map((f) => {
@@ -5777,12 +6731,15 @@ function applySuppressions(findings, model, now) {
 // packages/rules/src/index.ts
 var defaultRules = [
   ...supabaseAuthorizationPack,
-  ...supabaseStorageRpcPack
+  ...supabaseStorageRpcPack,
+  ...supabaseSqlPoliciesPack
 ];
 
 // packages/scanner/src/config.ts
 import { existsSync, readFileSync as readFileSync3, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join as join4, resolve as resolve3, sep as sep2 } from "node:path";
+var MAX_PUBLIC_TABLES = 64;
+var TABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var MAX_REPO_MIGRATION_DIRS = 16;
 function shown2(value) {
   return JSON.stringify(value.length > 120 ? `${value.slice(0, 120)}...` : value);
@@ -5808,14 +6765,42 @@ function loadAuditConfig(root) {
   const obj = raw;
   const ignore = strings(obj.ignore);
   const migrations = strings(obj.migrations);
+  const publicTables2 = publicTableNames(obj.publicTables);
   return {
     config: {
       ...ignore ? { ignore } : {},
-      ...migrations ? { migrations } : {}
+      ...migrations ? { migrations } : {},
+      ...publicTables2.tables ? { publicTables: publicTables2.tables } : {}
     },
-    warnings: []
+    warnings: publicTables2.warnings
   };
 }
+function publicTableNames(value) {
+  const warnings = [];
+  if (value === void 0) return { warnings };
+  if (!Array.isArray(value)) {
+    return { warnings: ["audit.config.json: publicTables ignored (not an array of table names)"] };
+  }
+  const tables = [];
+  for (const entry of value) {
+    if (typeof entry !== "string" || !TABLE_NAME.test(entry.trim())) {
+      warnings.push(
+        `audit.config.json: ignored publicTables entry ${shown2(String(entry))} (not a table name)`
+      );
+      continue;
+    }
+    const name = entry.trim().toLowerCase();
+    if (tables.includes(name)) continue;
+    if (tables.length >= MAX_PUBLIC_TABLES) {
+      warnings.push(
+        `audit.config.json: ignored publicTables entry ${shown2(entry)} (at most ${MAX_PUBLIC_TABLES} tables)`
+      );
+      continue;
+    }
+    tables.push(name);
+  }
+  return { tables, warnings };
+}
 function inside(base, p) {
   return p === base || p.startsWith(base.endsWith(sep2) ? base : `${base}${sep2}`);
 }
@@ -5881,7 +6866,28 @@ function repoMigrationDirs(root, entries) {
 }
 
 // packages/scanner/src/scan.ts
-function summarize(model, rules) {
+var ScanError = class extends Error {
+  constructor(code, path, message) {
+    super(message);
+    this.code = code;
+    this.path = path;
+  }
+  code;
+  path;
+  name = "ScanError";
+};
+function ensureDirectory(path) {
+  let isDirectory;
+  try {
+    isDirectory = statSync2(path).isDirectory();
+  } catch (e) {
+    const code = errorCode2(e);
+    const why = code === "ENOENT" ? "no such file or directory" : code;
+    throw new ScanError("path_not_found", path, `${path} is not a directory (${why})`);
+  }
+  if (!isDirectory) throw new ScanError("path_not_found", path, `${path} is not a directory`);
+}
+function summarize(model, rules, publicTables2 = []) {
   const apiTables = model.tables.filter((t) => !t.table.includes("."));
   return {
     root: model.root,
@@ -5891,10 +6897,12 @@ function summarize(model, rules) {
     tablesKnown: apiTables.length,
     tablesWithRls: apiTables.filter((t) => t.rlsEnabled).length,
     rules,
-    warnings: model.warnings
+    warnings: model.warnings,
+    publicTables: [...publicTables2]
   };
 }
 function runScan(path, opts = {}) {
+  ensureDirectory(path);
   const cfg = loadAuditConfig(path);
   const repoDirs = repoMigrationDirs(path, cfg.config.migrations ?? []);
   const sqlDirs = [...repoDirs.dirs, ...opts.sqlDirs ?? []];
@@ -5904,10 +6912,11 @@ function runScan(path, opts = {}) {
     ...ignore.globs.length > 0 ? { ignore: ignore.globs } : {}
   });
   const graph = buildGraph(model);
-  const runOpts = opts.now === void 0 ? {} : { now: opts.now };
+  const publicTables2 = cfg.config.publicTables ?? [];
+  const runOpts = { ...opts.now === void 0 ? {} : { now: opts.now }, publicTables: publicTables2 };
   const findings = runRules(defaultRules, model, graph, runOpts);
   const coverage = summarizeCoverage(findings);
-  const summary = summarize(model, defaultRules.length);
+  const summary = summarize(model, defaultRules.length, publicTables2);
   return {
     summary: {
       ...summary,
@@ -5941,6 +6950,8 @@ Options:
   --migrations <dir>   extra directory with Supabase migration SQL (repeatable)
   -h, --help           show this help
 
+Exit code: 0 clean, 1 a finding reached --fail-on, 2 usage error or <path> is not a directory
+
 Config: <path>/audit.config.json { "ignore": ["evals/**"], "migrations": ["supabase/migrations"] }
 Suppress a finding: // auditai:ignore <ruleId|*> -- reason   (above the handler or at the top of a file)
 `;
@@ -5976,10 +6987,15 @@ function main(argv) {
     return 2;
   }
   const migrations = values.migrations.map((m) => resolve4(m));
-  const result = runScan(
-    positionals[0] ?? ".",
-    migrations.length > 0 ? { sqlDirs: migrations } : {}
-  );
+  let result;
+  try {
+    result = runScan(positionals[0] ?? ".", migrations.length > 0 ? { sqlDirs: migrations } : {});
+  } catch (e) {
+    if (!(e instanceof ScanError)) throw e;
+    process.stderr.write(`error: ${e.message}
+`);
+    return 2;
+  }
   process.stdout.write(
     values.json ? `${JSON.stringify(result, null, 2)}
 ` : formatScanText(result)