auditai-scan 0.6.0 → 0.7.0

package/dist/auditai-scan.mjs

@@ -138,6 +138,9 @@ function where(f) {
   for (const e of f.evidence) for (const l of e.locations ?? []) seen.add(`${l.file}:${l.line}`);
   return [...seen].join(", ");
 }
+function fixBody(diff) {
+  return diff.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).map((l) => l.slice(1));
+}
 function formatFinding(f) {
   const why = f.evidence.find((e) => e.kind === "rule")?.summary ?? "";
   const lines = [
@@ -152,6 +155,10 @@ function formatFinding(f) {
     const s = [...f.evidence].reverse().find((e) => e.data?.suppressed === true);
     if (s) lines.push(`  Ignored ${s.summary}`);
   }
+  if (f.fix) {
+    lines.push(`  Fix     ${f.fix.summary} (${f.fix.touchedFiles.join(", ")})`);
+    for (const line of fixBody(f.fix.diff)) lines.push(`          ${line}`);
+  }
   return lines.join("\n");
 }
 function formatScanText(r) {
@@ -190,6 +197,222 @@ function formatScanText(r) {
 // packages/scanner/src/scan.ts
 import { statSync as statSync2 } from "node:fs";
 
+// packages/fixes/dist/sql-fixes.js
+var OWNER_COLUMNS = [
+  "user_id",
+  "owner_id",
+  "profile_id",
+  "author_id",
+  "created_by",
+  "account_id",
+  "tenant_id",
+  "organization_id",
+  "org_id",
+  "workspace_id",
+  "team_id"
+];
+var API_ROLES = "public, anon, authenticated";
+function table(model, name) {
+  if (!name)
+    return void 0;
+  const key = name.toLowerCase();
+  return model.tables.find((t) => t.table.toLowerCase() === key);
+}
+function ownerColumn(t) {
+  if (!t)
+    return null;
+  const cols = t.columns.map((c) => c.toLowerCase());
+  for (const candidate of OWNER_COLUMNS)
+    if (cols.includes(candidate))
+      return candidate;
+  return null;
+}
+function qualified(name) {
+  return name.includes(".") ? name : `public.${name}`;
+}
+function fn(model, name) {
+  if (!name)
+    return void 0;
+  const key = name.toLowerCase();
+  return (model.sqlFunctions ?? []).find((f) => f.name.toLowerCase() === key);
+}
+function signatureOf(f) {
+  const name = f.name.includes(".") ? f.name : `public.${f.name}`;
+  return f.args === void 0 ? `${name}(...)` : `${name}(${f.args})`;
+}
+var HEADER = (title) => `-- ${title}
+-- Proposed by Audit AI. Read it, then apply it with the rest of your migrations.
+`;
+function sqlFunctionFix(finding4, model) {
+  const name = finding4.evidence[0]?.data?.function;
+  const f = fn(model, typeof name === "string" ? name : void 0);
+  if (!f)
+    return null;
+  const sig = signatureOf(f);
+  const ambiguous = sig.endsWith("(...)");
+  const body = [
+    HEADER(`Stop anon and authenticated from calling ${f.name} directly`),
+    ambiguous ? "-- The argument types could not be read from the migrations; put the real signature in\n-- place of (...) before applying. `\\df public.*` in psql prints it.\n" : "",
+    `revoke execute on function ${sig} from ${API_ROLES};
+`,
+    "-- Leave this line out if nothing calls the function with the service role.\n",
+    `grant execute on function ${sig} to service_role;
+`
+  ].join("");
+  return {
+    file: `fix_revoke_execute_${f.name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}.sql`,
+    sql: body,
+    summary: `Revoke execute on ${f.name} from the API roles`,
+    rationale: "The function runs as its creator, so row level security does not apply inside it, and Supabase grants execute on new functions in schema public to anon and authenticated directly. Revoking from PUBLIC alone does not remove those grants, which is why a function that looks locked down is still callable with the public key. If a browser is supposed to call it, do not apply this: add a caller check inside the body instead (`where owner_id = (select auth.uid())`)."
+  };
+}
+function enableRlsFix(finding4, model, withPolicy) {
+  const name = finding4.evidence[0]?.data?.table;
+  if (typeof name !== "string")
+    return null;
+  const t = table(model, name);
+  const full = qualified(name);
+  const owner = ownerColumn(t);
+  const lines = [HEADER(`Turn on row level security for ${full}`)];
+  lines.push(`alter table ${full} enable row level security;
+`);
+  if (withPolicy) {
+    if (owner) {
+      lines.push(`
+create policy "${name}: owner reads" on ${full}
+  for select to authenticated
+  using (${owner} = (select auth.uid()));
+`, `
+create policy "${name}: owner writes" on ${full}
+  for all to authenticated
+  using (${owner} = (select auth.uid()))
+  with check (${owner} = (select auth.uid()));
+`);
+    } else {
+      lines.push(`
+-- No column of ${full} ties a row to a person (looked for ${OWNER_COLUMNS.slice(0, 4).join(", ")}\u2026),
+-- so no policy is proposed: with RLS on and no policy the table is readable only with the
+-- service role, which is the safe default. Add a policy once you decide who owns a row.
+`);
+    }
+  } else {
+    lines.push(`
+-- The policies this table already has start applying the moment row level security is on;
+-- read them once before applying, because until now they have never run.
+`);
+  }
+  return {
+    file: `fix_enable_rls_${name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}.sql`,
+    sql: lines.join(""),
+    summary: `Enable row level security on ${full}`,
+    rationale: withPolicy ? "Without row level security the anon key reads and writes every row of the table through PostgREST. Turning it on denies everything by default, so apply this together with a policy, and check that your own server code uses the service role where it needs full access." : "The table already carries policies, which is what makes this a defect rather than a choice: they have no effect until row level security is on. Read them once before applying \u2014 they have never run, so they may not say what their author believed."
+  };
+}
+function anonWriteFix(finding4, model) {
+  const data = finding4.evidence[0]?.data ?? {};
+  const name = data.table;
+  const policy = data.policy;
+  const command = data.command;
+  if (typeof name !== "string" || typeof policy !== "string")
+    return null;
+  const full = qualified(name);
+  const owner = ownerColumn(table(model, name));
+  const cmd = typeof command === "string" ? command : "all";
+  const safeName = policy.replace(/"/g, '""');
+  const lines = [HEADER(`Close the open write policy "${policy}" on ${full}`)];
+  if (owner) {
+    lines.push(`drop policy "${safeName}" on ${full};
+`, `
+create policy "${safeName}" on ${full}
+  for ${cmd} to authenticated
+`, cmd === "insert" ? `  with check (${owner} = (select auth.uid()));
+` : `  using (${owner} = (select auth.uid()))${cmd === "all" ? `
+  with check (${owner} = (select auth.uid()))` : ""};
+`);
+  } else {
+    lines.push(`-- No column of ${full} ties a row to a person, so there is nothing to compare the caller
+-- with. Either add one, or take the policy away and let your server write the table with the
+-- service role after it has checked the caller itself.
+`, `drop policy "${safeName}" on ${full};
+`);
+  }
+  return {
+    file: `fix_policy_${name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}_${cmd}.sql`,
+    sql: lines.join(""),
+    summary: `Tie the write policy on ${full} to the caller`,
+    rationale: owner ? `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. The replacement keeps the same command and ties the row to the signed-in caller through ${owner}. If this table is meant to accept rows from strangers (a contact form, a newsletter), keep the insert open but give it a predicate on the row's shape and a rate limit.` : `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. Nothing in the table identifies an owner, so the honest fix is to remove the policy and write the table from your server after it has checked the caller.`
+  };
+}
+function userMetadataFix(finding4) {
+  const data = finding4.evidence[0]?.data ?? {};
+  const name = data.table;
+  const policy = data.policy;
+  if (typeof name !== "string" || typeof policy !== "string")
+    return null;
+  const full = qualified(name);
+  return {
+    file: `fix_policy_${name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}_app_metadata.sql`,
+    sql: [
+      HEADER(`Stop the policy "${policy}" on ${full} from trusting user_metadata`),
+      "-- Re-create the policy with the claim read from app_metadata, which only the service role\n",
+      "-- writes. Copy the predicate from your own migration and change the one word: replace\n",
+      "--   (select auth.jwt()) -> 'user_metadata' ->> '<claim>'\n",
+      "-- with\n",
+      "--   (select auth.jwt()) -> 'app_metadata' ->> '<claim>'\n",
+      `--
+-- drop policy "${policy.replace(/"/g, '""')}" on ${full};
+`,
+      `-- create policy "${policy.replace(/"/g, '""')}" on ${full} ... using (...);
+`,
+      "\n-- Then set the claim where the user cannot reach it, from a server with the service role:\n",
+      "--   await admin.auth.admin.updateUserById(id, { app_metadata: { is_admin: true } });\n"
+    ].join(""),
+    summary: `Move the claim behind "${policy}" from user_metadata to app_metadata`,
+    rationale: "user_metadata is written by the user themselves with supabase.auth.updateUser({ data }), and it is copied into their next access token without review, so a policy that reads it grants itself. app_metadata can only be set with the service role. This fix is a template rather than a finished statement: the predicate belongs to your policy, and moving the claim only helps once something server-side actually sets app_metadata."
+  };
+}
+function sqlFixFor(finding4, model) {
+  switch (finding4.ruleId) {
+    case "supabase.security-definer-function-without-caller-check":
+      return sqlFunctionFix(finding4, model);
+    case "supabase.table-without-rls":
+      return enableRlsFix(finding4, model, true);
+    case "supabase.policies-without-rls-enabled":
+      return enableRlsFix(finding4, model, false);
+    case "supabase.anon-write-policy":
+      return anonWriteFix(finding4, model);
+    case "supabase.rls-policy-trusts-user-metadata":
+      return userMetadataFix(finding4);
+    default:
+      return null;
+  }
+}
+function addFileDiff(path, body) {
+  const lines = body.replace(/\n$/, "").split("\n");
+  return [
+    `diff --git a/${path} b/${path}`,
+    "new file mode 100644",
+    "--- /dev/null",
+    `+++ b/${path}`,
+    `@@ -0,0 +1,${lines.length} @@`,
+    ...lines.map((l) => `+${l}`),
+    ""
+  ].join("\n");
+}
+function deterministicFix(finding4, model, migrationsDir = "supabase/migrations") {
+  const fix = sqlFixFor(finding4, model);
+  if (!fix)
+    return null;
+  const stamp = (finding4.createdAt ?? "").replace(/\D/g, "").slice(0, 14) || "00000000000000";
+  const path = `${migrationsDir}/${stamp}_${fix.file}`;
+  return {
+    summary: fix.summary,
+    diff: addFileDiff(path, fix.sql),
+    touchedFiles: [path],
+    rationale: fix.rationale
+  };
+}
+
 // packages/graph/src/graph.ts
 var SecurityGraph = class {
   nodes = /* @__PURE__ */ new Map();
@@ -221,10 +444,10 @@ var SecurityGraph = class {
 function buildGraph(model) {
   const g = new SecurityGraph();
   const tableInfo = new Map(model.tables.map((t) => [t.table, t]));
-  const tableNode = (table) => {
-    const info = tableInfo.get(table.toLowerCase());
+  const tableNode = (table2) => {
+    const info = tableInfo.get(table2.toLowerCase());
     const data = {
-      table,
+      table: table2,
       known: info !== void 0,
       rlsEnabled: info?.rlsEnabled ?? false,
       policies: info?.policies ?? [],
@@ -233,19 +456,19 @@ function buildGraph(model) {
     };
     const node = g.addNode(
       info ? {
-        id: `table:${table}`,
+        id: `table:${table2}`,
         kind: "Table",
-        label: `public.${table}`,
+        label: `public.${table2}`,
         data: { ...data },
         location: info.location
-      } : { id: `table:${table}`, kind: "Table", label: `public.${table}`, data: { ...data } }
+      } : { id: `table:${table2}`, kind: "Table", label: `public.${table2}`, data: { ...data } }
     );
     for (const p of data.policies) {
       const pn = g.addNode({
-        id: `policy:${table}:${p}`,
+        id: `policy:${table2}:${p}`,
         kind: "RLSPolicy",
         label: p,
-        data: { table, name: p }
+        data: { table: table2, name: p }
       });
       g.addEdge(node.id, pn.id, "GUARDED_BY");
     }
@@ -746,11 +969,11 @@ function walkOwn(body, visit) {
   };
   go(body);
 }
-function ownReturns(fn) {
-  if (!fn.body) return [];
-  if (!ts.isBlock(fn.body)) return [fn.body];
+function ownReturns(fn2) {
+  if (!fn2.body) return [];
+  if (!ts.isBlock(fn2.body)) return [fn2.body];
   const out = [];
-  walkOwn(fn.body, (n) => {
+  walkOwn(fn2.body, (n) => {
     if (ts.isReturnStatement(n) && n.expression) out.push(n.expression);
   });
   return out;
@@ -921,10 +1144,10 @@ function growNames(decls, scope) {
     if (scope.names.size === before) break;
   }
 }
-function ownDeclarations(fn) {
+function ownDeclarations(fn2) {
   const out = [];
-  if (fn.body) {
-    walkOwn(fn.body, (n) => {
+  if (fn2.body) {
+    walkOwn(fn2.body, (n) => {
       if (ts3.isVariableDeclaration(n)) out.push(n);
     });
   }
@@ -953,14 +1176,29 @@ function moduleSecretScope(sf) {
   moduleScopes.set(sf, scope);
   return scope;
 }
-function secretScopeFor(fn, sf) {
+function secretScopeFor(fn2, sf) {
   const mod = moduleSecretScope(sf);
   const scope = { names: new Set(mod.names), fns: mod.fns };
-  growNames(ownDeclarations(fn), scope);
+  growNames(ownDeclarations(fn2), scope);
   return scope;
 }
+var STORED_SECRET_FIELD = /(^|_)(secret|signing_key|api_key|key_hash|token_hash|hmac_key)$/;
+function readsStoredSecret(e) {
+  let hit = false;
+  const visit = (n) => {
+    if (hit) return;
+    if (ts3.isPropertyAccessExpression(n) && STORED_SECRET_FIELD.test(n.name.text.toLowerCase())) {
+      hit = true;
+      return;
+    }
+    n.forEachChild(visit);
+  };
+  visit(e);
+  return hit;
+}
 function isSecretish(e, scope) {
   if (envNamesIn(e).some(isSecretEnvName)) return true;
+  if (readsStoredSecret(e)) return true;
   for (const id of identifiersIn(e)) if (scope.names.has(id)) return true;
   let calls = false;
   const visit = (n) => {
@@ -984,7 +1222,7 @@ var EQUALITY = /* @__PURE__ */ new Set([
   ts3.SyntaxKind.EqualsEqualsToken,
   ts3.SyntaxKind.ExclamationEqualsToken
 ]);
-var COMPARE_CALLEE = /^(timingSafeEqual|safeCompare|secureCompare|safeEqual|constantTimeEqual|constantTimeCompare|timingSafeCompare|compare|compareSync|isEqual|equals?)$/i;
+var COMPARE_CALLEE = /^(timingSafeEqual|safeCompare|secureCompare|safeEqual|constantTimeEqual|constantTimeCompare|timingSafeCompare|compare|compareSync|isEqual|equals?|secretsMatch|secretMatch|matchesSecret|tokensMatch|tokenMatches|sameSecret|checkSecret|validSecret|isValidSecret)$/i;
 var VERIFY_CALLEE = /^(verify|verifySync|jwtVerify|constructEvent|constructEventAsync|verifySignature|verifyWebhook|validateSignature)$/i;
 var THROWING_VERIFIER = /^(jwtVerify|constructEvent|constructEventAsync)$/;
 var THROWING_VERIFY_RECEIVER = /jwt|jose|jsonwebtoken/i;
@@ -1035,11 +1273,39 @@ function gates(node, fnBody) {
   }
   return false;
 }
-function secretChecksIn(fn, sf) {
-  if (!fn.body) return [];
-  const body = fn.body;
-  const secrets = secretScopeFor(fn, sf);
+function receiverSecret(callee, secretish, builtFromSecret) {
+  if (!ts3.isPropertyAccessExpression(callee)) return false;
+  const recv = callee.expression;
+  if (ts3.isNewExpression(recv)) return (recv.arguments ?? []).some(secretish);
+  if (ts3.isIdentifier(recv) && builtFromSecret.has(recv.text)) return true;
+  return secretish(recv);
+}
+function instancesBuiltFromSecret(body, secretish) {
+  const out = /* @__PURE__ */ new Set();
+  for (const d of collect(body, ts3.isVariableDeclaration)) {
+    if (!d.initializer || !ts3.isIdentifier(d.name) || !ts3.isNewExpression(d.initializer)) continue;
+    if ((d.initializer.arguments ?? []).some(secretish)) out.add(d.name.text);
+  }
+  return out;
+}
+function gatesByThrow(node, fnBody) {
+  let child = node;
+  let cur = node.parent;
+  while (cur && cur !== fnBody && !isFunctionLikeNode(cur)) {
+    if (ts3.isTryStatement(cur) && cur.tryBlock === child && cur.catchClause) {
+      return exitKind(cur.catchClause.block) !== null;
+    }
+    child = cur;
+    cur = cur.parent;
+  }
+  return false;
+}
+function secretChecksIn(fn2, sf) {
+  if (!fn2.body) return [];
+  const body = fn2.body;
+  const secrets = secretScopeFor(fn2, sf);
   const secretish = (e) => isSecretish(e, secrets);
+  const builtFromSecret = instancesBuiltFromSecret(body, secretish);
   const out = [];
   const push = (n) => {
     out.push({ node: n, text: n.getText(sf).replace(/\s+/g, " ").slice(0, 160) });
@@ -1058,8 +1324,9 @@ function secretChecksIn(fn, sf) {
     const verify = VERIFY_CALLEE.test(name);
     if (!compare && !verify) return;
     const secretArgs = n.arguments.filter(secretish).length;
-    if (secretArgs === 0 || secretArgs === n.arguments.length) return;
-    if (verify && throwsOnBadCredential(n) || gates(n, body)) push(n);
+    const receiverHoldsSecret = verify && receiverSecret(n.expression, secretish, builtFromSecret);
+    if (!receiverHoldsSecret && (secretArgs === 0 || secretArgs === n.arguments.length)) return;
+    if (verify && throwsOnBadCredential(n) || gates(n, body) || gatesByThrow(n, body)) push(n);
   });
   return out;
 }
@@ -1086,7 +1353,7 @@ function nextAuthSessionNames(stmt, nextAuthLocal) {
   }
   return out;
 }
-var CREDENTIAL_COLUMN = /(keyhash|tokenhash|hashedkey|hashedtoken|secrethash|apikey|apikeyhash|apitoken|accesstoken|sessiontoken|secret)$/;
+var CREDENTIAL_COLUMN = /(keyhash|tokenhash|hashedkey|hashedtoken|secrethash|apikey|apikeyhash|apitoken|accesstoken|sessiontoken|secret|token|sessioncode|invitecode|accesscode|sharecode)$/;
 function isCredentialColumn(column) {
   return column !== null && CREDENTIAL_COLUMN.test(column.toLowerCase().replace(/_/g, ""));
 }
@@ -1149,8 +1416,8 @@ function mentions(cond, names) {
   return false;
 }
 function ifsAfter(node) {
-  const fn = enclosingFunction(node);
-  const scope = fn ? fn.body : node.getSourceFile();
+  const fn2 = enclosingFunction(node);
+  const scope = fn2 ? fn2.body : node.getSourceFile();
   const out = [];
   if (!scope) return out;
   walkOwn(scope, (n) => {
@@ -2417,7 +2684,9 @@ function applyCreateFunction(reg, stmt, file) {
   if (!isWord(tk[i], "function")) return;
   const q = readQualifiedName(tk, i + 1);
   if (!q || !isPunct(tk[q.next], "(")) return;
-  i = groupEnd(tk, q.next) + 1;
+  const argsEnd = groupEnd(tk, q.next);
+  const args = argumentTypes(stmt, tk, q.next, argsEnd);
+  i = argsEnd + 1;
   let securityDefiner = false;
   let returns = null;
   let body = "";
@@ -2450,17 +2719,122 @@ function applyCreateFunction(reg, stmt, file) {
   }
   const key = qualifiedKey(q);
   const code = maskSqlComments(body);
-  const fn = {
+  const fn2 = {
     schema: q.schema,
     name: q.name,
     securityDefiner,
     returns,
+    args,
     body: code,
     directCheck: CALLER_CHECKS.some((re) => re.test(code)),
     acl: reg.byKey.get(key)?.acl ?? initialAcl(reg, q.schema),
     location: { file, line: stmt.line }
   };
-  reg.byKey.set(key, fn);
+  reg.byKey.set(key, fn2);
+}
+var TYPE_WORD = /* @__PURE__ */ new Set([
+  "anyarray",
+  "anyelement",
+  "bigint",
+  "bigserial",
+  "bit",
+  "bool",
+  "boolean",
+  "box",
+  "bytea",
+  "char",
+  "character",
+  "cidr",
+  "circle",
+  "date",
+  "decimal",
+  "double",
+  "float",
+  "float4",
+  "float8",
+  "inet",
+  "int",
+  "int2",
+  "int4",
+  "int8",
+  "integer",
+  "interval",
+  "json",
+  "jsonb",
+  "line",
+  "lseg",
+  "macaddr",
+  "money",
+  "name",
+  "numeric",
+  "oid",
+  "path",
+  "point",
+  "polygon",
+  "real",
+  "record",
+  "regclass",
+  "serial",
+  "smallint",
+  "smallserial",
+  "text",
+  "time",
+  "timestamp",
+  "timestamptz",
+  "timetz",
+  "trigger",
+  "tsquery",
+  "tsvector",
+  "uuid",
+  "varbit",
+  "varchar",
+  "void",
+  "xml"
+]);
+function argumentTypes(stmt, tokens, open, close) {
+  if (close <= open + 1) return "";
+  const parts = [];
+  let depth = 0;
+  let start = open + 1;
+  const pieces = [];
+  for (let i = open + 1; i < close; i++) {
+    const t = tokens[i];
+    if (isPunct(t, "(") || isPunct(t, "[")) depth += 1;
+    else if (isPunct(t, ")") || isPunct(t, "]")) depth -= 1;
+    else if (depth === 0 && isPunct(t, ",")) {
+      pieces.push([start, i]);
+      start = i + 1;
+    }
+  }
+  pieces.push([start, close]);
+  for (const [from, to] of pieces) {
+    const words = [];
+    for (let i = from; i < to; i++) {
+      const t = tokens[i];
+      if (!t) continue;
+      if (isWord(t, "default")) break;
+      if (t.kind === "punct" && t.value === "=") break;
+      words.push(t);
+    }
+    if (words.length === 0) return null;
+    let k = 0;
+    if (isWord(words[k], "in") || isWord(words[k], "out") || isWord(words[k], "inout")) {
+      if (isWord(words[k], "out")) continue;
+      k += 1;
+    } else if (isWord(words[k], "variadic")) {
+      k += 1;
+    }
+    const firstWord = words[k];
+    const named = firstWord !== void 0 && firstWord.kind === "word" && !TYPE_WORD.has(firstWord.value.toLowerCase()) && words.slice(k + 1).some((w) => w.kind === "word");
+    const typeStart = named ? k + 1 : k;
+    const first = words[typeStart];
+    const last = words[words.length - 1];
+    if (!first || !last) return null;
+    parts.push(
+      stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase()
+    );
+  }
+  return parts.join(", ");
 }
 function readFunctionList(tokens, from) {
   const keys = [];
@@ -2486,28 +2860,28 @@ function applyAlterFunction(reg, stmt) {
   const tk = stmt.tokens;
   const list = readFunctionList(tk, 2);
   const key = list.keys[0];
-  const fn = key === void 0 ? void 0 : reg.byKey.get(key);
-  if (!fn || key === void 0) return;
+  const fn2 = key === void 0 ? void 0 : reg.byKey.get(key);
+  if (!fn2 || key === void 0) return;
   let i = list.next;
   if (isWord(tk[i], "external")) i += 1;
   if (isWord(tk[i], "security")) {
-    if (isWord(tk[i + 1], "definer")) fn.securityDefiner = true;
-    else if (isWord(tk[i + 1], "invoker")) fn.securityDefiner = false;
+    if (isWord(tk[i + 1], "definer")) fn2.securityDefiner = true;
+    else if (isWord(tk[i + 1], "invoker")) fn2.securityDefiner = false;
     return;
   }
   let moved = null;
   if (isWord(tk[i], "rename") && isWord(tk[i + 1], "to")) {
     const name = identOf(tk[i + 2]);
-    if (name) moved = { schema: fn.schema, name, next: 0 };
+    if (name) moved = { schema: fn2.schema, name, next: 0 };
   } else if (isWord(tk[i], "set") && isWord(tk[i + 1], "schema")) {
     const schema = identOf(tk[i + 2]);
-    if (schema) moved = { schema, name: fn.name, next: 0 };
+    if (schema) moved = { schema, name: fn2.name, next: 0 };
   }
   if (!moved) return;
   reg.byKey.delete(key);
-  fn.schema = moved.schema;
-  fn.name = moved.name;
-  reg.byKey.set(qualifiedKey(moved), fn);
+  fn2.schema = moved.schema;
+  fn2.name = moved.name;
+  reg.byKey.set(qualifiedKey(moved), fn2);
 }
 function readRoles(tokens, from) {
   const roles = [];
@@ -2562,8 +2936,8 @@ function applyGrantRevoke(reg, stmt) {
   if (isWord(tk[i], "function") || isWord(tk[i], "routine")) {
     const list = readFunctionList(tk, i + 1);
     targets = list.keys.flatMap((k) => {
-      const fn = reg.byKey.get(k);
-      return fn ? [fn] : [];
+      const fn2 = reg.byKey.get(k);
+      return fn2 ? [fn2] : [];
     });
     i = list.next;
   } else if (isWord(tk[i], "all") && (isWord(tk[i + 1], "functions") || isWord(tk[i + 1], "routines")) && isWord(tk[i + 2], "in") && isWord(tk[i + 3], "schema")) {
@@ -2578,7 +2952,7 @@ function applyGrantRevoke(reg, stmt) {
       i += 1;
     }
     targets = [...reg.byKey.values()].filter(
-      (fn) => schemas.includes((fn.schema ?? "public").toLowerCase())
+      (fn2) => schemas.includes((fn2.schema ?? "public").toLowerCase())
     );
   } else {
     return;
@@ -2586,7 +2960,7 @@ function applyGrantRevoke(reg, stmt) {
   const [start, end] = roleClause(tk, i, grant ? "to" : "from");
   if (start < 0) return;
   const roles = readRoles(tk.slice(0, end), start);
-  for (const fn of targets) applyToAcl(fn.acl, grant, roles);
+  for (const fn2 of targets) applyToAcl(fn2.acl, grant, roles);
 }
 function applyDefaultPrivileges(reg, stmt) {
   const tk = stmt.tokens;
@@ -2683,6 +3057,7 @@ function finishFunctions(reg) {
       location: f.location
     };
     if (f.returns !== null) info.returns = f.returns;
+    if (f.args !== null) info.args = f.args;
     return info;
   });
 }
@@ -2882,9 +3257,9 @@ function sync(state, key) {
 function findColumn(meta, name) {
   return meta.columns.find((c) => c.name === name);
 }
-function pkOf(state, table) {
-  if (table === "auth.users") return ["id"];
-  return state.meta.get(table)?.pk ?? [];
+function pkOf(state, table2) {
+  if (table2 === "auth.users") return ["id"];
+  return state.meta.get(table2)?.pk ?? [];
 }
 function resolveRefs(state, meta) {
   for (const col of meta.columns) {
@@ -2893,12 +3268,12 @@ function resolveRefs(state, meta) {
     }
   }
 }
-function clearRefsTo(state, table, column) {
+function clearRefsTo(state, table2, column) {
   for (const [key, meta] of state.meta) {
     let touched = false;
     for (const col of meta.columns) {
       const r = col.references;
-      if (!r || r.table !== table || column !== void 0 && r.column !== column) continue;
+      if (!r || r.table !== table2 || column !== void 0 && r.column !== column) continue;
       col.references = null;
       col.fkName = null;
       touched = true;
@@ -3748,9 +4123,9 @@ function analyzeModule(rel, sf) {
       if (!ts9.isCallExpression(init) && !ts9.isNewExpression(init)) continue;
       if (ts9.isCallExpression(init)) {
         const callee = init.expression;
-        const fn = ts9.isIdentifier(callee) ? callee.text : ts9.isPropertyAccessExpression(callee) ? callee.name.text : "";
+        const fn2 = ts9.isIdentifier(callee) ? callee.text : ts9.isPropertyAccessExpression(callee) ? callee.name.text : "";
         const tableName = stringLiteralValue(init.arguments[0]);
-        if ((DRIZZLE_TABLE_FNS.has(fn) || fn === "table") && tableName !== null) {
+        if ((DRIZZLE_TABLE_FNS.has(fn2) || fn2 === "table") && tableName !== null) {
           drizzleTables.set(d.name.text, tableName);
           continue;
         }
@@ -3838,10 +4213,20 @@ var LOGICAL = /* @__PURE__ */ new Set([
   ts10.SyntaxKind.BarBarToken,
   ts10.SyntaxKind.AmpersandAmpersandToken
 ]);
+var SCHEMA_PARSE = /^(parse|safeParse|parseAsync|safeParseAsync)$/;
+function isSchemaParse(call, cx) {
+  const callee = call.expression;
+  if (!ts10.isPropertyAccessExpression(callee) || !SCHEMA_PARSE.test(callee.name.text)) return false;
+  const recv = callee.expression;
+  if (isWholeInput(recv, cx)) return false;
+  return cx.strippingSchema(recv);
+}
 function isWholeInput(e, cx) {
   const u = unwrap(e);
   if (ts10.isIdentifier(u)) return cx.wholeName(u.text);
   if (ts10.isPropertyAccessExpression(u) || ts10.isElementAccessExpression(u)) {
+    const inner = unwrap(u.expression);
+    if (ts10.isCallExpression(inner) && isSchemaParse(inner, cx)) return false;
     return isWholeInput(u.expression, cx);
   }
   if (ts10.isObjectLiteralExpression(u)) {
@@ -3861,6 +4246,7 @@ function isWholeInput(e, cx) {
 }
 function isWholeCall(call, cx) {
   if (cx.requestBody(call)) return true;
+  if (isSchemaParse(call, cx)) return false;
   const callee = call.expression;
   if (ts10.isPropertyAccessExpression(callee)) {
     const method = callee.name.text;
@@ -3882,7 +4268,8 @@ function callbackKeepsWhole(cb, receiverWhole, cx) {
   const inner = {
     wholeName: (n) => elementNames.has(n) || cx.wholeName(n),
     requestBody: cx.requestBody,
-    requestName: cx.requestName
+    requestName: cx.requestName,
+    strippingSchema: cx.strippingSchema
   };
   return ownReturns(f).some((r) => isWholeInput(r, inner));
 }
@@ -3940,12 +4327,12 @@ var NO_ARG = {
   whole: false,
   isRequest: false
 };
-function ownFunctionSym(facts, name, fn) {
+function ownFunctionSym(facts, name, fn2) {
   const factory = facts.clientFactories.find((c) => c.name === name);
   if (factory) return { kind: "factory", factory };
   const helper = facts.authHelpers.find((a) => a.name === name);
-  if (helper) return { kind: "auth", helper, fn, facts };
-  return { kind: "function", name, fn, facts };
+  if (helper) return { kind: "auth", helper, fn: fn2, facts };
+  return { kind: "function", name, fn: fn2, facts };
 }
 function exportedSym(p, tf, name, depth) {
   if (depth > 5) return null;
@@ -3992,7 +4379,7 @@ function scopeOf(p, facts) {
   for (const [name, v] of facts.moduleVars) {
     scope.set(name, { kind: "var", name, init: v.init, facts });
   }
-  for (const [name, table] of facts.drizzleTables) scope.set(name, { kind: "table", table });
+  for (const [name, table2] of facts.drizzleTables) scope.set(name, { kind: "table", table: table2 });
   for (const [name, v] of facts.authVars) scope.set(name, { kind: "auth", helper: v.helper });
   for (const [local, ref] of facts.imports) {
     const target = p.resolver.resolve(ref.spec, facts.file);
@@ -4018,9 +4405,9 @@ function scopeOf(p, facts) {
     }
     if (!/^[.~]|^@\//.test(ref.spec)) continue;
     for (const f of p.registry.values()) {
-      const fn = f.functions.get(ref.imported);
-      if (!fn?.exported) continue;
-      const sym = ownFunctionSym(f, ref.imported, fn.fn);
+      const fn2 = f.functions.get(ref.imported);
+      if (!fn2?.exported) continue;
+      const sym = ownFunctionSym(f, ref.imported, fn2.fn);
       if (sym.kind === "factory" || sym.kind === "auth") {
         scope.set(local, sym);
         p.warnings.push(
@@ -4040,10 +4427,10 @@ function symOfCallee(p, callee, scope) {
   }
   return void 0;
 }
-function returnedExpressions(fn) {
-  if (!fn.body) return [];
-  if (!ts11.isBlock(fn.body)) return [fn.body];
-  return collect(fn.body, ts11.isReturnStatement).map((r) => r.expression).filter((e) => e !== void 0);
+function returnedExpressions(fn2) {
+  if (!fn2.body) return [];
+  if (!ts11.isBlock(fn2.body)) return [fn2.body];
+  return collect(fn2.body, ts11.isReturnStatement).map((r) => r.expression).filter((e) => e !== void 0);
 }
 function factoryOfFunction(p, sym, depth) {
   const key = `${sym.facts.file}#${sym.name}`;
@@ -4207,6 +4594,7 @@ function usesInput(frame, e) {
   });
   return hit;
 }
+var CALLER_READ = /\b(?:await\s+)?cookies\(\)\s*(?:\.|$)|cookieStore\s*\.\s*get\s*\(|\bcookies\s*\.\s*get\s*\(|\b(?:await\s+)?headers\(\)\s*\.\s*get\s*\(/;
 var REQUEST_MEMBER = /^(json|formData|text|arrayBuffer|blob|body|headers|cookies|url|nextUrl|query|params|ip|geo)$/;
 var REQUEST_CLIENT_CALLEE = /client|supabase|prisma|drizzle/i;
 function handsOverRequest(frame, call) {
@@ -4275,13 +4663,28 @@ function isRequestBodyCall(frame, call) {
   if (frame.reqNames.has(recv.text)) return true;
   return frame.depth === 0 && frame.reqNames.size === 0 && REQUEST_NAME.test(recv.text);
 }
-function wholeContext(frame) {
+function wholeContext(p, frame) {
   return {
     wholeName: (n) => frame.wholeNames.has(n),
     requestBody: (c) => isRequestBodyCall(frame, c),
-    requestName: (n) => frame.reqNames.has(n)
+    requestName: (n) => frame.reqNames.has(n),
+    strippingSchema: (e) => isStrippingSchema(p, frame, e)
   };
 }
+var OBJECT_SCHEMA = /\b(?:z|zod|v|valibot|yup)\s*\.\s*object\s*\(/;
+var SCHEMA_KEEPS_UNKNOWN = /\.\s*(?:passthrough|catchall|nonstrict|unknown)\s*\(/;
+function isStrippingSchema(p, frame, e) {
+  const u = unwrap(e);
+  if (ts11.isCallExpression(u) || ts11.isPropertyAccessExpression(u)) {
+    const text2 = u.getText();
+    return OBJECT_SCHEMA.test(text2) && !SCHEMA_KEEPS_UNKNOWN.test(text2);
+  }
+  if (!ts11.isIdentifier(u)) return false;
+  const sym = scopeOf(p, frame.facts).get(u.text);
+  if (sym?.kind !== "var") return false;
+  const text = sym.init.getText();
+  return OBJECT_SCHEMA.test(text) && !SCHEMA_KEEPS_UNKNOWN.test(text);
+}
 function receiverTainted(frame, call) {
   const callee = call.expression;
   if (!ts11.isPropertyAccessExpression(callee) && !ts11.isElementAccessExpression(callee)) return false;
@@ -4336,7 +4739,7 @@ function argBinding(p, arg, frame) {
     client,
     instance,
     tainted: derivedIn(frame, arg),
-    whole: isWholeInput(arg, wholeContext(frame)),
+    whole: isWholeInput(arg, wholeContext(p, frame)),
     isRequest
   };
 }
@@ -4405,10 +4808,10 @@ function callTarget(p, call, frame, scope) {
   return null;
 }
 function bindDeclarations(p, frame, acc) {
-  const { rel, sf, fn } = frame;
+  const { rel, sf, fn: fn2 } = frame;
   const scope = scopeOf(p, frame.facts);
   const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
-  const body = fn.body ?? fn;
+  const body = fn2.body ?? fn2;
   for (const [name, sym] of scope) {
     if (sym.kind !== "var" || frame.clients.has(name) || frame.instances.has(name)) continue;
     const vb = varBinding(p, sym);
@@ -4466,6 +4869,11 @@ function bindDeclarations(p, frame, acc) {
         continue;
       }
     }
+    if (CALLER_READ.test(text)) {
+      if (frame.depth === 0) handlerInput("header", names, decl);
+      else bindInput(names, false);
+      continue;
+    }
     if (ts11.isCallExpression(init)) {
       const inst = instanceOfCall(p, init, frame, scope);
       if (inst && ts11.isIdentifier(decl.name)) {
@@ -4478,7 +4886,7 @@ function bindDeclarations(p, frame, acc) {
       if (args.some((a) => a.tainted || a.isRequest) || receiverTainted(frame, init)) {
         const rt = returnTaint(p, init, frame, scope, 0);
         if (rt === null || rt.tainted && rt.props === null) {
-          bindInput(names, isWholeInput(init, wholeContext(frame)));
+          bindInput(names, isWholeInput(init, wholeContext(p, frame)));
         } else if (rt.tainted && rt.props !== null) {
           if (ts11.isIdentifier(decl.name))
             frame.partialInputs.set(decl.name.text, new Set(rt.props));
@@ -4515,7 +4923,7 @@ function bindDeclarations(p, frame, acc) {
         } else if (partial) bindPatternFrom(frame, decl.name, partial);
       }
     } else if (!isChainWithQuery(init) && derivedIn(frame, init)) {
-      bindInput(names, isWholeInput(init, wholeContext(frame)));
+      bindInput(names, isWholeInput(init, wholeContext(p, frame)));
     }
   }
   if (frame.depth === 0) {
@@ -4528,10 +4936,10 @@ function bindDeclarations(p, frame, acc) {
   }
 }
 function analyzeFrame(p, frame, acc) {
-  const { rel, sf, fn } = frame;
+  const { rel, sf, fn: fn2 } = frame;
   const scope = scopeOf(p, frame.facts);
   const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
-  const body = fn.body ?? fn;
+  const body = fn2.body ?? fn2;
   bindDeclarations(p, frame, acc);
   for (const call of collect(body, ts11.isCallExpression)) {
     const callee = call.expression;
@@ -4539,8 +4947,8 @@ function analyzeFrame(p, frame, acc) {
       continue;
     if (!ts11.isIdentifier(callee.expression)) continue;
     const outer = frame.clients.get(callee.expression.text);
-    const fn2 = call.arguments.map((a) => unwrap(a)).find((a) => ts11.isArrowFunction(a) || ts11.isFunctionExpression(a));
-    const param = fn2 && (ts11.isArrowFunction(fn2) || ts11.isFunctionExpression(fn2)) ? fn2.parameters[0] : void 0;
+    const fn3 = call.arguments.map((a) => unwrap(a)).find((a) => ts11.isArrowFunction(a) || ts11.isFunctionExpression(a));
+    const param = fn3 && (ts11.isArrowFunction(fn3) || ts11.isFunctionExpression(fn3)) ? fn3.parameters[0] : void 0;
     if (outer && param && ts11.isIdentifier(param.name)) frame.clients.set(param.name.text, outer);
   }
   const isSessionCall = (call) => /\.auth\.(getUser|getSession|getClaims)$/.test(call.expression.getText(sf)) || symOfCallee(p, call.expression, scope)?.kind === "auth";
@@ -4555,7 +4963,7 @@ function analyzeFrame(p, frame, acc) {
       text: gate.node.expression.getText(sf).replace(/\s+/g, " ").slice(0, 160)
     });
   }
-  for (const check of secretChecksIn(fn, sf)) {
+  for (const check of secretChecksIn(fn2, sf)) {
     acc.authChecks.push({ ...loc2(check.node), kind: "secret" });
   }
   for (const pa of collect(body, ts11.isPropertyAccessExpression)) {
@@ -4619,7 +5027,7 @@ function analyzeFrame(p, frame, acc) {
   const payloadOf = (arg) => arg ? {
     text: arg.getText(sf).replace(/\s+/g, " ").slice(0, 200),
     inputDerived: derivedIn(frame, arg),
-    wholeInput: isWholeInput(arg, wholeContext(frame))
+    wholeInput: isWholeInput(arg, wholeContext(p, frame))
   } : null;
   const storageHandles = storageBindingsIn(body);
   let callerScope = null;
@@ -4864,7 +5272,7 @@ function childFrame(p, call, target, frame) {
     pathPos: [...frame.pathPos, call.getStart(frame.sf)],
     exitPropagates: frame.exitPropagates && callResultChecked(call)
   };
-  const cx = wholeContext(frame);
+  const cx = wholeContext(p, frame);
   target.fn.parameters.forEach((param, i) => {
     const arg = call.arguments[i];
     const ab = argBinding(p, arg, frame);
@@ -5060,16 +5468,16 @@ function enclosingCondition(node, body) {
   return null;
 }
 var normalizeColumn = (c) => (c ?? "").toLowerCase().replace(/_/g, "");
-function singular(table) {
-  if (table.endsWith("ies")) return `${table.slice(0, -3)}y`;
-  if (table.endsWith("ses") || table.endsWith("xes")) return table.slice(0, -2);
-  return table.endsWith("s") ? table.slice(0, -1) : table;
+function singular(table2) {
+  if (table2.endsWith("ies")) return `${table2.slice(0, -3)}y`;
+  if (table2.endsWith("ses") || table2.endsWith("xes")) return table2.slice(0, -2);
+  return table2.endsWith("s") ? table2.slice(0, -1) : table2;
 }
-function columnNamesTable(column, table) {
+function columnNamesTable(column, table2) {
   const c = normalizeColumn(column);
   if (!c.endsWith("id") || c === "id") return false;
   const stem = c.slice(0, -2);
-  const t = normalizeColumn(table);
+  const t = normalizeColumn(table2);
   return stem === t || stem === singular(t);
 }
 function guardMatch(q, g, tables) {
@@ -5157,8 +5565,53 @@ function calleePath(e) {
   if (ts11.isElementAccessExpression(u)) return `${calleePath(u.expression)}[]`;
   return "";
 }
+var EMPTY_GUARDS = { authChecks: [], roleChecks: [] };
+function layoutGuards(p, pageRel, cache) {
+  const parts = pageRel.split("/");
+  parts.pop();
+  const out = { authChecks: [], roleChecks: [] };
+  for (let i = parts.length; i > 0; i--) {
+    const g = layoutGuardsFor(p, parts.slice(0, i).join("/"), cache);
+    out.authChecks.push(...g.authChecks);
+    out.roleChecks.push(...g.roleChecks);
+  }
+  return out;
+}
+var LAYOUT_EXTENSIONS = ["tsx", "ts", "jsx", "js"];
+function layoutGuardsFor(p, dir, cache) {
+  const hit = cache.get(dir);
+  if (hit) return hit;
+  let guards = EMPTY_GUARDS;
+  for (const ext of LAYOUT_EXTENSIONS) {
+    const rel = `${dir}/layout.${ext}`;
+    const sf = p.sources.get(rel);
+    const facts = p.registry.get(rel);
+    if (!sf || !facts || isClientComponentFile(sf)) continue;
+    const fn2 = pageHandlerIn(sf);
+    if (!fn2) continue;
+    try {
+      const analysed = analyzeHandler(p, {
+        rel,
+        sf,
+        facts,
+        kind: "page",
+        route: dir,
+        method: "PAGE",
+        fn: fn2.fn,
+        node: fn2.node,
+        wrapper: fn2.wrapper
+      });
+      guards = { authChecks: analysed.authChecks, roleChecks: analysed.roleChecks ?? [] };
+    } catch {
+      guards = EMPTY_GUARDS;
+    }
+    break;
+  }
+  cache.set(dir, guards);
+  return guards;
+}
 function analyzeHandler(p, h) {
-  const { rel, sf, fn } = h;
+  const { rel, sf, fn: fn2 } = h;
   const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
   const acc = {
     inputs: [],
@@ -5173,7 +5626,7 @@ function analyzeHandler(p, h) {
     rel,
     sf,
     facts: h.facts,
-    fn,
+    fn: fn2,
     depth: 0,
     via: [],
     inputNames: /* @__PURE__ */ new Set(["params", "searchParams"]),
@@ -5191,13 +5644,13 @@ function analyzeHandler(p, h) {
     pathPos: [],
     exitPropagates: true
   };
-  const first = fn.parameters[0];
+  const first = fn2.parameters[0];
   if (h.kind === "route" && first) {
     if (ts11.isIdentifier(first.name)) frame.reqNames.add(first.name.text);
     else for (const nm of boundNames(first.name)) if (REQUEST_NAME.test(nm)) frame.reqNames.add(nm);
   }
   if (h.kind === "server_action") {
-    const params = h.wrapper ? fn.parameters.slice(0, 1) : fn.parameters;
+    const params = h.wrapper ? fn2.parameters.slice(0, 1) : fn2.parameters;
     for (const prm of params) {
       for (const nm of boundNames(prm.name)) {
         if (!acc.inputs.some((i) => i.kind === "action_arg" && i.name === nm)) {
@@ -5365,6 +5818,15 @@ function parseProject(rootInput, opts = {}) {
     storageBuckets: schema.storageBuckets
   };
 }
+var LAYOUT_CACHE = /* @__PURE__ */ new WeakMap();
+function layoutCacheOf(p) {
+  let m = LAYOUT_CACHE.get(p);
+  if (!m) {
+    m = /* @__PURE__ */ new Map();
+    LAYOUT_CACHE.set(p, m);
+  }
+  return m;
+}
 function analyzeFile(project, rel, sf, facts, out) {
   const { routes, exposures, fileIgnores } = out;
   {
@@ -5423,6 +5885,11 @@ function analyzeFile(project, rel, sf, facts, out) {
           node: handler.node,
           wrapper: handler.wrapper
         });
+        const guards = layoutGuards(project, rel, layoutCacheOf(project));
+        analysed.authChecks.push(...guards.authChecks);
+        if (guards.roleChecks.length > 0) {
+          analysed.roleChecks = [...analysed.roleChecks ?? [], ...guards.roleChecks];
+        }
         if (analysed.queries.length > 0 || analysed.inputs.length > 0) routes.push(analysed);
       }
     }
@@ -5442,7 +5909,7 @@ function callerCheckingFunctions(model) {
   );
 }
 var CALL2 = /(?:"?([A-Za-z_][A-Za-z0-9_$]*)"?\s*\.\s*)?"?([A-Za-z_][A-Za-z0-9_$]*)"?\s*\(/g;
-function qualified(schema, name) {
+function qualified2(schema, name) {
   const s = (schema ?? "public").toLowerCase();
   const n = (name ?? "").toLowerCase();
   return s === "public" ? n : `${s}.${n}`;
@@ -5450,7 +5917,7 @@ function qualified(schema, name) {
 function callsFunctionIn(expr, names) {
   if (names.size === 0) return false;
   for (const c of expr.replace(/'(?:[^']|'')*'/g, "''").matchAll(CALL2)) {
-    if (names.has(qualified(c[1], c[2]))) return true;
+    if (names.has(qualified2(c[1], c[2]))) return true;
   }
   return false;
 }
@@ -5518,14 +5985,14 @@ function handlerViews(ctx) {
 function queryViews(ctx, handler) {
   return ctx.graph.out(handler.id, "CALLS").map((query) => {
     const client = ctx.graph.out(query.id, "USES_CLIENT")[0];
-    const table = ctx.graph.out(query.id, "TARGETS")[0];
+    const table2 = ctx.graph.out(query.id, "TARGETS")[0];
     return {
       query,
       data: query.data,
       client,
       clientData: client?.data,
-      table,
-      tableData: table?.data
+      table: table2,
+      tableData: table2?.data
     };
   });
 }
@@ -5560,16 +6027,16 @@ function anonReadPolicy(t) {
     (p) => (p.command === "select" || p.command === "all") && (p.using ?? "").replace(/[\s()]/g, "").toLowerCase() === "true" && (p.roles.length === 0 || p.roles.some((r) => r === "anon" || r === "public"))
   );
 }
-function publicReadNote(p, table) {
-  return ` public.${table} is readable by the anon role through RLS policy "${p.name}" (${p.location.file}:${p.location.line}), so this read leaks nothing beyond what the anon key already returns; the repository may not have intended that policy, so the finding stays at medium.`;
+function publicReadNote(p, table2) {
+  return ` public.${table2} is readable by the anon role through RLS policy "${p.name}" (${p.location.file}:${p.location.line}), so this read leaks nothing beyond what the anon key already returns; the repository may not have intended that policy, so the finding stays at medium.`;
 }
 function adminOnly(ctx, h, t) {
   const check = h.roleChecks[0];
   if (!check || !t?.known || !singleTenantTable(ctx, t.table)) return void 0;
   return check;
 }
-function singleTenantTable(ctx, table) {
-  const info = ctx.model.tables.find((x) => x.table === table.toLowerCase());
+function singleTenantTable(ctx, table2) {
+  const info = ctx.model.tables.find((x) => x.table === table2.toLowerCase());
   if (!info || info.columns.some((c) => isScopeColumn(c))) return false;
   for (const col of info.columnInfo ?? []) {
     if (!col.references || col.nullable) continue;
@@ -5578,16 +6045,16 @@ function singleTenantTable(ctx, table) {
   }
   return true;
 }
-function adminOnlyNote(check, table) {
-  return ` Admin-only: the handler stops unless ${check.source} passes the role check at ${check.file}:${check.line} (${check.text}), and public.${table} has no tenant or owner column, so the row is shared site content rather than a tenant's; verify the admin check cannot be self-granted.`;
+function adminOnlyNote(check, table2) {
+  return ` Admin-only: the handler stops unless ${check.source} passes the role check at ${check.file}:${check.line} (${check.text}), and public.${table2} has no tenant or owner column, so the row is shared site content rather than a tenant's; verify the admin check cannot be self-granted.`;
 }
-function tableDataOf(ctx, table) {
-  return ctx.graph.nodes.get(`table:${table}`)?.data;
+function tableDataOf(ctx, table2) {
+  return ctx.graph.nodes.get(`table:${table2}`)?.data;
 }
 function callerCheck(checks) {
   return checks?.find((c) => isScopeColumn(c.column) && !c.inputDerived);
 }
-function guardTiesRowToCaller(guard, table, callerFns) {
+function guardTiesRowToCaller(guard, table2, callerFns) {
   const callerFilter = guard.filters.find((f) => isScopeColumn(f.column) && !f.inputDerived);
   if (callerFilter) {
     return {
@@ -5611,10 +6078,10 @@ function guardTiesRowToCaller(guard, table, callerFns) {
       why: `the read runs with a ${guard.client === "anon" ? "public anon" : "privileged"} client and filters by no owner column, so it returns the row for anyone`
     };
   }
-  const reads = (table?.policyDetails ?? []).filter(
+  const reads = (table2?.policyDetails ?? []).filter(
     (p) => p.command === "select" || p.command === "all"
   );
-  const scoped = table?.known === true && table.rlsEnabled && reads.length > 0 && reads.every((p) => policyScopesToCaller(p.using) || callsFunctionIn(p.using ?? "", callerFns));
+  const scoped = table2?.known === true && table2.rlsEnabled && reads.length > 0 && reads.every((p) => policyScopesToCaller(p.using) || callsFunctionIn(p.using ?? "", callerFns));
   return {
     tied: scoped,
     how: `through ${guard.clientName ?? "a user-scoped client"}, so RLS applied`,
@@ -5732,7 +6199,7 @@ var tableWithoutRls = {
           ],
           summary: `public.${t.table} has no "enable row level security" in migrations but is queried with a ${c.kind} client. Anyone holding the public anon key can read every row directly through PostgREST.`,
           title: `Table "${t.table}" is exposed without RLS`,
-          data: { deterministic: true, ruleId: this.id },
+          data: { deterministic: true, ruleId: this.id, table: t.table },
           tail: locations(v.table?.location)
         }));
         addReach(g, h, v, `supabase.${v.data.operation}:public.${t.table}`);
@@ -6576,7 +7043,7 @@ var storagePolicyWithoutOwnerCheck = {
     return out;
   }
 };
-var API_ROLES = /* @__PURE__ */ new Set(["anon", "authenticated", "public"]);
+var API_ROLES2 = /* @__PURE__ */ new Set(["anon", "authenticated", "public"]);
 var securityDefinerFunctionWithoutCallerCheck = {
   id: "supabase.security-definer-function-without-caller-check",
   title: "SECURITY DEFINER function without a caller check",
@@ -6593,22 +7060,22 @@ var securityDefinerFunctionWithoutCallerCheck = {
       rpcByName.set(key, [...rpcByName.get(key) ?? [], r]);
     }
     const out = [];
-    for (const fn of fns) {
-      if (!fn.securityDefiner || fn.checksCaller) continue;
-      if (fn.name.includes(".")) continue;
-      if (fn.returns === "trigger" || fn.returns === "event_trigger") continue;
-      const roles = fn.grantedTo.filter((r) => API_ROLES.has(r));
+    for (const fn2 of fns) {
+      if (!fn2.securityDefiner || fn2.checksCaller) continue;
+      if (fn2.name.includes(".")) continue;
+      if (fn2.returns === "trigger" || fn2.returns === "event_trigger") continue;
+      const roles = fn2.grantedTo.filter((r) => API_ROLES2.has(r));
       if (roles.length === 0) continue;
       const anonymous = roles.includes("anon") || roles.includes("public");
-      const sites = rpcByName.get(fn.name) ?? [];
+      const sites = rpcByName.get(fn2.name) ?? [];
       const entries = unique(sites.map((s) => s.handlerData.entry));
-      const endpoint = `POST /rest/v1/rpc/${fn.name}`;
+      const endpoint = `POST /rest/v1/rpc/${fn2.name}`;
       const who = anonymous ? "Anonymous visitors can call it with the public anon key" : "Any signed-in user can call it";
-      const callNote = entries.length > 0 ? ` The app calls it with supabase.rpc("${fn.name}") from ${entries.join(", ")}.` : "";
+      const callNote = entries.length > 0 ? ` The app calls it with supabase.rpc("${fn2.name}") from ${entries.join(", ")}.` : "";
       const path = [
         entries[0] ?? endpoint,
-        `supabase.rpc("${fn.name}") (EXECUTE: ${roles.join(", ")})`,
-        `public.${fn.name}() SECURITY DEFINER (runs as its owner, RLS does not apply)`,
+        `supabase.rpc("${fn2.name}") (EXECUTE: ${roles.join(", ")})`,
+        `public.${fn2.name}() SECURITY DEFINER (runs as its owner, RLS does not apply)`,
         "no auth.uid() / auth.jwt() check"
       ];
       out.push(
@@ -6616,27 +7083,27 @@ var securityDefinerFunctionWithoutCallerCheck = {
           ctx,
           this,
           {
-            title: `${anonymous ? "Anonymous-callable " : ""}SECURITY DEFINER function "${fn.name}" without a caller check`,
+            title: `${anonymous ? "Anonymous-callable " : ""}SECURITY DEFINER function "${fn2.name}" without a caller check`,
             entrypoints: [...entries, endpoint],
             sources: unique([
               ...sites.flatMap((s) => s.inputs.map((i) => `${i.kind}:${i.name}`)),
               "rpc arguments"
             ]),
-            sinks: [`postgres.function:public.${fn.name}`],
+            sinks: [`postgres.function:public.${fn2.name}`],
             path,
             evidence: [
               {
                 kind: "rule",
-                summary: `public.${fn.name}() is SECURITY DEFINER: it runs with the rights of its owner and Row Level Security does not apply inside it. Its body never reads the caller's identity (auth.uid(), auth.jwt(), auth.email() or the request JWT), so whatever it returns or changes is available to every role that can execute it: ${roles.join(", ")}. ${who} at ${endpoint}.${callNote} Filter by auth.uid() inside the function, make it SECURITY INVOKER, or revoke EXECUTE from public, anon and authenticated.`,
+                summary: `public.${fn2.name}() is SECURITY DEFINER: it runs with the rights of its owner and Row Level Security does not apply inside it. Its body never reads the caller's identity (auth.uid(), auth.jwt(), auth.email() or the request JWT), so whatever it returns or changes is available to every role that can execute it: ${roles.join(", ")}. ${who} at ${endpoint}.${callNote} Filter by auth.uid() inside the function, make it SECURITY INVOKER, or revoke EXECUTE from public, anon and authenticated.`,
                 locations: locations3(
-                  fn.location,
+                  fn2.location,
                   ...sites.flatMap((s) => [s.handler.location, s.query.location])
                 ),
                 data: {
                   deterministic: false,
                   ruleId: this.id,
-                  function: fn.name,
-                  grantedTo: [...fn.grantedTo]
+                  function: fn2.name,
+                  grantedTo: [...fn2.grantedTo]
                 }
               },
               { kind: "trace", summary: path.join(" -> ") }
@@ -6689,9 +7156,9 @@ function applyPublicTables(findings, publicTables2, now) {
     if (f.sinks.length === 0) return f;
     const tables = [];
     for (const sink of f.sinks) {
-      const table = READ_SINK.exec(sink)?.[1];
-      if (table === void 0 || !declared.has(table.toLowerCase())) return f;
-      if (!tables.includes(table)) tables.push(table);
+      const table2 = READ_SINK.exec(sink)?.[1];
+      if (table2 === void 0 || !declared.has(table2.toLowerCase())) return f;
+      if (!tables.includes(table2)) tables.push(table2);
     }
     const command = f.evidence[0]?.data?.command;
     if (f.ruleId === "supabase.rls-policy-without-caller-predicate" && command !== "select") {
@@ -6914,7 +7381,13 @@ function runScan(path, opts = {}) {
   const graph = buildGraph(model);
   const publicTables2 = cfg.config.publicTables ?? [];
   const runOpts = { ...opts.now === void 0 ? {} : { now: opts.now }, publicTables: publicTables2 };
-  const findings = runRules(defaultRules, model, graph, runOpts);
+  const rulesFindings = runRules(defaultRules, model, graph, runOpts);
+  const migrationsDir = repoDirs.dirs[0] ?? "supabase/migrations";
+  const findings = rulesFindings.map((f) => {
+    if (f.status === "suppressed") return f;
+    const fix = deterministicFix(f, model, migrationsDir);
+    return fix ? { ...f, fix } : f;
+  });
   const coverage = summarizeCoverage(findings);
   const summary = summarize(model, defaultRules.length, publicTables2);
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",