avorelo 0.3.8 → 0.4.0-rc.2

package/scripts/lib/data-permissions-guard.js

@@ -0,0 +1,1187 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const { ensureCcoDirs, nowIso, safeReadJson, safeWriteJson } = require("./fsx");
+
+const CONTRACT = "avorelo.dataPermissionsGuard.v1";
+const REPORT_DIR_REL = ".claude/cco/reports/data-permissions-guard";
+const REPORT_JSON_REL = `${REPORT_DIR_REL}/latest-report.json`;
+
+const TEXT_FILE_RE = /\.(cjs|cts|env|ini|js|json|jsx|md|mjs|mts|prisma|sql|toml|ts|tsx|txt|yaml|yml)$/i;
+const SQL_FILE_RE = /\.sql$/i;
+const ENV_FILE_RE = /(^|\/)\.env(?:\.[^/]+)?$|(^|\/)\.env\.example$|(^|\/)env\.example$/i;
+const PRISMA_FILE_RE = /(^|\/)schema\.prisma$/i;
+const DRIZZLE_CONFIG_RE = /(^|\/)drizzle\.config\.(cjs|js|json|mjs|mts|ts)$/i;
+const SKIP_DIRS = new Set([
+  ".claude",
+  ".git",
+  ".next",
+  ".nuxt",
+  ".turbo",
+  ".wasp",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+]);
+const SENSITIVE_NAME_RE = /\b(user|account|session|tenant|organization|org|customer|invoice|payment|order|profile|document|contract|medical|patient|admin)\b/i;
+const SENSITIVE_BUCKET_RE = /\b(invoice|invoices|billing|contract|contracts|document|documents|doc|docs|medical|patient|patients|private|upload|uploads|statement|statements)\b/i;
+const LOWER_RISK_BUCKET_RE = /\b(avatar|avatars|image|images|photo|photos|public-assets)\b/i;
+const CLIENT_PATH_RE = /(^|\/)(app\/(?!api\/)|browser\/|client\/|components\/|pages\/(?!api\/)|public\/|src\/client\/)/i;
+const SERVER_PATH_RE = /(^|\/)(app\/api\/|pages\/api\/|server\/|src\/server\/|middleware\.(cjs|cts|js|mjs|mts|ts))|(^|\/)route\.(js|jsx|ts|tsx)$/i;
+const API_ROUTE_RE = /(^|\/)(app\/api\/.*\/route\.(js|jsx|ts|tsx)|pages\/api\/.*\.(js|jsx|ts|tsx)|server\/routes\/.*\.(js|jsx|ts|tsx))$/i;
+
+function unique(values) {
+  return [...new Set((values || []).filter(Boolean))];
+}
+
+function toPosix(value) {
+  return String(value || "").replace(/\\/g, "/");
+}
+
+function sanitizeText(value, max = 220) {
+  const text = String(value || "")
+    .replace(/\s+/g, " ")
+    .replace(/(?:sk-[A-Za-z0-9_-]{16,}|gh[ps]_[A-Za-z0-9]{12,}|npm_[A-Za-z0-9]{12,}|AKIA[0-9A-Z]{16})/g, "[redacted-token]")
+    .replace(/(bearer\s+)[A-Za-z0-9._-]{8,}/ig, "$1[redacted]")
+    .replace(/((?:api[_ -]?key|token|password|secret|authorization)\s*[:=]\s*)([^\s'"]+)/ig, "$1[redacted]")
+    .trim();
+  if (!text) return null;
+  return text.length > max ? `${text.slice(0, max - 3).trimEnd()}...` : text;
+}
+
+function sanitizeRef(ref) {
+  const text = String(ref || "").trim().replace(/\\/g, "/");
+  if (!text || text.startsWith("..")) return null;
+  return text;
+}
+
+function makeEvidenceRef(relPath, lineNumber, label) {
+  const base = sanitizeRef(relPath);
+  if (!base) return null;
+  const suffix = Number.isFinite(lineNumber) && lineNumber > 0 ? `:${lineNumber}` : "";
+  const note = label ? ` (${sanitizeText(label, 80)})` : "";
+  return `${base}${suffix}${note}`;
+}
+
+function severityRank(severity) {
+  if (severity === "block") return 3;
+  if (severity === "warn") return 2;
+  return 1;
+}
+
+function surfaceRiskRank(risk) {
+  return {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    blocked: 4,
+    unknown: 1,
+  }[risk] ?? 0;
+}
+
+function pickHigherRisk(current, next) {
+  return surfaceRiskRank(next) > surfaceRiskRank(current) ? next : current;
+}
+
+function walkWorkspace(cwd) {
+  const files = [];
+
+  function visit(current, depth) {
+    if (depth > 8 || files.length >= 2200) return;
+    let entries = [];
+    try {
+      entries = fs.readdirSync(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+
+    for (const entry of entries) {
+      if (files.length >= 2200) return;
+      const absPath = path.join(current, entry.name);
+      const relPath = toPosix(path.relative(cwd, absPath));
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        visit(absPath, depth + 1);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      files.push({
+        absPath,
+        relPath,
+        text: undefined,
+      });
+    }
+  }
+
+  visit(cwd, 0);
+  return files;
+}
+
+function readText(file) {
+  if (file.text !== undefined) return file.text;
+  if (!(TEXT_FILE_RE.test(file.relPath) || ENV_FILE_RE.test(file.relPath))) {
+    file.text = null;
+    return file.text;
+  }
+  try {
+    const stat = fs.statSync(file.absPath);
+    if (stat.size > 256 * 1024) {
+      file.text = null;
+      return file.text;
+    }
+    file.text = fs.readFileSync(file.absPath, "utf8");
+    return file.text;
+  } catch {
+    file.text = null;
+    return file.text;
+  }
+}
+
+function findLineNumber(text, index) {
+  const prefix = text.slice(0, index);
+  return prefix.split(/\r?\n/).length;
+}
+
+function collectPatternRefs(file, regex, options = {}) {
+  const text = readText(file);
+  if (!text) return [];
+  const limit = options.limit || 5;
+  const refs = [];
+  const flags = regex.flags.includes("g") ? regex.flags : `${regex.flags}g`;
+  const matcher = new RegExp(regex.source, flags);
+  let match;
+  while ((match = matcher.exec(text)) && refs.length < limit) {
+    const lineNumber = findLineNumber(text, match.index);
+    refs.push(makeEvidenceRef(file.relPath, lineNumber, options.label ? options.label(match) : null));
+    if (match.index === matcher.lastIndex) matcher.lastIndex += 1;
+  }
+  return refs.filter(Boolean);
+}
+
+function collectLineRefs(file, matcher, options = {}) {
+  const text = readText(file);
+  if (!text) return [];
+  const limit = options.limit || 5;
+  const refs = [];
+  const lines = text.split(/\r?\n/);
+  for (let index = 0; index < lines.length && refs.length < limit; index += 1) {
+    const line = lines[index];
+    const value = typeof matcher === "function" ? matcher(line, index + 1) : (matcher.test(line) ? true : false);
+    if (!value) continue;
+    const label = typeof value === "string"
+      ? value
+      : options.label
+        ? options.label(line, index + 1)
+        : null;
+    refs.push(makeEvidenceRef(file.relPath, index + 1, label));
+  }
+  return refs.filter(Boolean);
+}
+
+function isClientFile(file) {
+  const relPath = file.relPath;
+  const text = readText(file) || "";
+  if (API_ROUTE_RE.test(relPath)) return false;
+  if (/^\s*["']use client["'];?/m.test(text)) return true;
+  return CLIENT_PATH_RE.test(relPath);
+}
+
+function isServerFile(file) {
+  if (API_ROUTE_RE.test(file.relPath)) return true;
+  if (SERVER_PATH_RE.test(file.relPath)) return true;
+  const text = readText(file) || "";
+  return /\bimport\s+["']server-only["']/.test(text);
+}
+
+function isApiRouteFile(file) {
+  return API_ROUTE_RE.test(file.relPath);
+}
+
+function isAdminRoute(file) {
+  return /(^|\/)(admin|admins)(\/|[-_.])/i.test(file.relPath);
+}
+
+function routeSensitivity(text) {
+  let score = 0;
+  if (/\b(delete|remove|destroy|drop|truncate)\b/i.test(text)) score += 2;
+  if (/\b(update|insert|upsert|create)\b/i.test(text)) score += 1;
+  if (SENSITIVE_NAME_RE.test(text)) score += 1;
+  return score;
+}
+
+function hasDbAccess(text) {
+  return /\b(prisma|drizzle|db|database|sql|supabase)\b/.test(text)
+    && (
+      /\b(prisma\.\w+|db\.\w+|sql`|supabase\.(from|rpc|schema|storage)|\.(select|insert|update|delete|upsert)\s*\(|execute\s*\(|query\s*\()/i.test(text)
+      || /\bfrom\s*\(\s*["'`][a-z0-9_]+["'`]\s*\)/i.test(text)
+    );
+}
+
+function hasAuthEvidence(text) {
+  return /\b(getServerSession|requireAuth|requireUser|auth\(\)|currentUser\(|clerkMiddleware|authMiddleware|supabase\.auth\.getUser|verifyAuth|getSession|session\.user|request\.user|ctx\.user)\b/i.test(text);
+}
+
+function hasTenantScope(text) {
+  return /\b(userId|tenantId|organizationId|accountId|orgId|user_id|tenant_id|organization_id|account_id)\b/i.test(text)
+    || /\bwhere\s*:\s*\{[\s\S]{0,120}\b(userId|tenantId|organizationId|accountId|orgId)\b/i.test(text)
+    || /\beq\s*\(\s*["'`](user_id|tenant_id|organization_id|account_id|userId|tenantId|organizationId|accountId)["'`]/i.test(text);
+}
+
+function dbClientImportRef(file, text) {
+  const match = text.match(/\b(import|require)\b[\s\S]{0,160}(@prisma\/client|drizzle-orm|postgres|pg|supabase|\/db\b|\/server\b|server\/db|lib\/db|prisma|drizzle|service-role|service_role)/i);
+  if (!match) return null;
+  const refs = collectPatternRefs(file, /(@prisma\/client|drizzle-orm|postgres|pg|supabase|\/db\b|\/server\b|server\/db|lib\/db|prisma|drizzle|service-role|service_role)/i, { limit: 1 });
+  return refs[0] || makeEvidenceRef(file.relPath, 1, null);
+}
+
+function isSensitiveName(name) {
+  return SENSITIVE_NAME_RE.test(name);
+}
+
+function parseSqlTableName(fragment) {
+  const match = String(fragment || "").match(/\b(?:table|policy)\s+["']?([a-zA-Z0-9_.-]+)["']?/i);
+  return match ? match[1].replace(/^public\./i, "") : null;
+}
+
+function extractPolicyTable(text, startIndex) {
+  const slice = text.slice(startIndex, startIndex + 260);
+  const onMatch = slice.match(/\bon\s+["']?([a-zA-Z0-9_.-]+)["']?/i);
+  if (onMatch) return onMatch[1].replace(/^public\./i, "");
+  return parseSqlTableName(slice);
+}
+
+function collectSqlInsights(file) {
+  const text = readText(file);
+  if (!text) {
+    return {
+      rlsEnableRefs: [],
+      rlsDisableRefs: [],
+      policyRefs: [],
+      broadPolicyRefs: [],
+      broadWritePolicyRefs: [],
+      grantPublicRefs: [],
+      grantAnonRefs: [],
+      grantAllRefs: [],
+      tablesSeen: [],
+      sensitiveTables: [],
+      storagePublicRefs: [],
+    };
+  }
+
+  const tablesSeen = new Set();
+  const sensitiveTables = new Set();
+  const tablePattern = /\b(create|alter)\s+table\s+(?:if\s+not\s+exists\s+)?["']?([a-zA-Z0-9_.-]+)["']?/ig;
+  let tableMatch;
+  while ((tableMatch = tablePattern.exec(text))) {
+    const tableName = (tableMatch[2] || "").replace(/^public\./i, "");
+    if (!tableName) continue;
+    tablesSeen.add(tableName);
+    if (isSensitiveName(tableName)) sensitiveTables.add(tableName);
+  }
+
+  const policyRefs = collectPatternRefs(file, /\b(create|alter)\s+policy\b/ig, { limit: 8 });
+  const rlsEnableRefs = collectPatternRefs(file, /\balter\s+table\b[\s\S]{0,160}\benable\s+row\s+level\s+security\b/ig, { limit: 8 });
+  const rlsDisableRefs = collectPatternRefs(file, /\balter\s+table\b[\s\S]{0,160}\bdisable\s+row\s+level\s+security\b/ig, { limit: 8 });
+
+  const broadPolicyRefs = [];
+  const broadWritePolicyRefs = [];
+  const policyPattern = /\b(create|alter)\s+policy\b[\s\S]{0,500}?(using\s*\(\s*true\s*\)|with\s+check\s*\(\s*true\s*\))/ig;
+  let policyMatch;
+  while ((policyMatch = policyPattern.exec(text))) {
+    const lineNumber = findLineNumber(text, policyMatch.index);
+    const tableName = extractPolicyTable(text, policyMatch.index);
+    const label = tableName || null;
+    const ref = makeEvidenceRef(file.relPath, lineNumber, label);
+    if (!ref) continue;
+    broadPolicyRefs.push(ref);
+    const nearby = text.slice(policyMatch.index, policyMatch.index + 320);
+    if (/\bfor\s+(all|insert|update|delete)\b/i.test(nearby) || /with\s+check\s*\(\s*true\s*\)/i.test(nearby)) {
+      broadWritePolicyRefs.push(ref);
+    }
+  }
+
+  const grantPublicRefs = collectPatternRefs(file, /\bgrant\b[\s\S]{0,180}\bto\s+public\b/ig, { limit: 8 });
+  const grantAnonRefs = collectPatternRefs(file, /\bgrant\b[\s\S]{0,180}\bto\s+anon\b/ig, { limit: 8 });
+  const grantAllRefs = collectPatternRefs(file, /\bgrant\s+all\b/ig, { limit: 8 });
+  const storagePublicRefs = collectPatternRefs(file, /\b(storage\.buckets|storage\.objects|bucket)\b[\s\S]{0,220}\b(public|anon)\b/ig, { limit: 8 });
+
+  return {
+    rlsEnableRefs,
+    rlsDisableRefs,
+    policyRefs,
+    broadPolicyRefs,
+    broadWritePolicyRefs,
+    grantPublicRefs,
+    grantAnonRefs,
+    grantAllRefs,
+    tablesSeen: [...tablesSeen],
+    sensitiveTables: [...sensitiveTables],
+    storagePublicRefs,
+  };
+}
+
+function parseEnvVariableNames(file) {
+  const text = readText(file);
+  if (!text) return [];
+  return text.split(/\r?\n/).flatMap((line, index) => {
+    const match = line.match(/^\s*([A-Z0-9_]+)\s*=/);
+    if (!match) return [];
+    return [{
+      name: match[1],
+      ref: makeEvidenceRef(file.relPath, index + 1, match[1]),
+    }];
+  });
+}
+
+function makeBaseSurface() {
+  return {
+    risk: "none",
+  };
+}
+
+function buildEmptyReport() {
+  return {
+    schemaVersion: CONTRACT,
+    generatedAt: nowIso(),
+    status: "no_data",
+    redacted: true,
+    summary: {
+      surfacesInspected: 0,
+      risksFound: 0,
+      blockers: 0,
+      needsReview: 0,
+      safeNextAction: "No local data surface was detected. Re-run after adding database, storage, or API code.",
+    },
+    surfaces: {
+      supabase: {
+        detected: false,
+        migrations: [],
+        rlsEvidence: [],
+        policyEvidence: [],
+        storageEvidence: [],
+        risk: "none",
+      },
+      postgres: {
+        detected: false,
+        migrations: [],
+        grants: [],
+        risk: "none",
+      },
+      prisma: {
+        detected: false,
+        schemaRefs: [],
+        clientExposureRefs: [],
+        risk: "none",
+      },
+      drizzle: {
+        detected: false,
+        schemaRefs: [],
+        migrationRefs: [],
+        risk: "none",
+      },
+      apiRoutes: {
+        detected: false,
+        routeRefs: [],
+        authEvidence: [],
+        missingAuthSignals: [],
+        risk: "none",
+      },
+      storage: {
+        detected: false,
+        bucketRefs: [],
+        publicAccessSignals: [],
+        risk: "none",
+      },
+      envAndSecrets: {
+        detected: false,
+        secretNameRefs: [],
+        clientExposureSignals: [],
+        risk: "none",
+      },
+    },
+    findings: [],
+    rollup: {
+      readySignals: [],
+      needsReview: [],
+      blockedItems: [],
+      notEnoughEvidence: [],
+    },
+    integrationRefs: {
+      productionConfidence: [REPORT_JSON_REL],
+      productHome: [REPORT_JSON_REL],
+      radar: [REPORT_JSON_REL],
+      status: [REPORT_JSON_REL],
+      dashboard: [REPORT_JSON_REL],
+      support: [REPORT_JSON_REL],
+    },
+    privacy: {
+      localOnly: true,
+      remoteFetch: false,
+      dbConnection: false,
+      rawSecretValuesStored: false,
+      rawPromptStored: false,
+      rawCodeStored: false,
+      fullLogsStored: false,
+      privatePathsStored: false,
+      redacted: true,
+    },
+    claimSafety: {
+      productionCertified: false,
+      securityGuaranteed: false,
+      liveDatabaseScanned: false,
+      rlsAutoFixed: false,
+      cloudScanner: false,
+      launchReadyClaim: false,
+    },
+  };
+}
+
+function addFinding(report, finding) {
+  const normalized = {
+    id: finding.id,
+    severity: finding.severity,
+    category: finding.category,
+    title: sanitizeText(finding.title, 120),
+    evidenceRef: sanitizeRef(finding.evidenceRef),
+    reasonCodes: unique(finding.reasonCodes || []),
+    safeNextAction: sanitizeText(finding.safeNextAction, 220) || "Review the local data boundary before shipping.",
+  };
+  report.findings.push(normalized);
+}
+
+function pushInfoFinding(report, fields) {
+  addFinding(report, {
+    severity: "info",
+    ...fields,
+  });
+}
+
+function pushWarnFinding(report, fields) {
+  addFinding(report, {
+    severity: "warn",
+    ...fields,
+  });
+}
+
+function pushBlockFinding(report, fields) {
+  addFinding(report, {
+    severity: "block",
+    ...fields,
+  });
+}
+
+function buildDataPermissionsGuard(cwd = process.cwd(), options = {}) {
+  const report = buildEmptyReport();
+  const files = walkWorkspace(cwd);
+
+  const sqlFiles = files.filter((file) => SQL_FILE_RE.test(file.relPath));
+  const envFiles = files.filter((file) => ENV_FILE_RE.test(file.relPath));
+  const prismaFiles = files.filter((file) => PRISMA_FILE_RE.test(file.relPath));
+  const drizzleFiles = files.filter((file) => DRIZZLE_CONFIG_RE.test(file.relPath) || /(^|\/)(drizzle|db|database)\/.*schema\.(js|ts)$/i.test(file.relPath));
+  const apiRouteFiles = files.filter((file) => isApiRouteFile(file));
+  const supabaseFiles = files.filter((file) => /(^|\/)supabase\//i.test(file.relPath));
+  const sourceFiles = files.filter((file) => /\.(cjs|cts|js|jsx|mjs|mts|ts|tsx)$/i.test(file.relPath));
+  const workspaceMiddlewareAuthRefs = unique(sourceFiles.flatMap((file) => {
+    if (!/(^|\/)middleware\.(cjs|cts|js|mjs|mts|ts)$/i.test(file.relPath)) return [];
+    const text = readText(file) || "";
+    if (!hasAuthEvidence(text)) return [];
+    return collectPatternRefs(file, /\b(getServerSession|requireAuth|requireUser|auth\(\)|currentUser\(|clerkMiddleware|authMiddleware|supabase\.auth\.getUser|verifyAuth|getSession|session\.user|request\.user|ctx\.user)\b/i, { limit: 1 });
+  })).slice(0, 4);
+
+  const supabaseSurface = report.surfaces.supabase;
+  const postgresSurface = report.surfaces.postgres;
+  const prismaSurface = report.surfaces.prisma;
+  const drizzleSurface = report.surfaces.drizzle;
+  const apiSurface = report.surfaces.apiRoutes;
+  const storageSurface = report.surfaces.storage;
+  const envSurface = report.surfaces.envAndSecrets;
+
+  if (supabaseFiles.length > 0) {
+    supabaseSurface.detected = true;
+    supabaseSurface.migrations = unique(
+      supabaseFiles
+        .filter((file) => /(^|\/)supabase\/migrations\/.*\.sql$/i.test(file.relPath))
+        .map((file) => sanitizeRef(file.relPath))
+    ).slice(0, 8);
+  }
+
+  const sqlInsights = sqlFiles.map((file) => ({
+    file,
+    insights: collectSqlInsights(file),
+  }));
+
+  for (const entry of sqlInsights) {
+    const file = entry.file;
+    const insights = entry.insights;
+    const isSupabase = /(^|\/)supabase\/migrations\/.*\.sql$/i.test(file.relPath);
+    const isMigration = /(^|\/)(db\/migrations|migrations|sql|supabase\/migrations)\//i.test(file.relPath) || /schema\.sql$/i.test(file.relPath);
+
+    if (insights.tablesSeen.length > 0 || insights.policyRefs.length > 0 || insights.grantPublicRefs.length > 0 || insights.grantAnonRefs.length > 0) {
+      postgresSurface.detected = true;
+      postgresSurface.migrations.push(sanitizeRef(file.relPath));
+    }
+    if (isSupabase) {
+      supabaseSurface.detected = true;
+      supabaseSurface.rlsEvidence.push(...insights.rlsEnableRefs);
+      supabaseSurface.policyEvidence.push(...insights.policyRefs);
+      supabaseSurface.storageEvidence.push(...insights.storagePublicRefs);
+    }
+
+    postgresSurface.grants.push(...insights.grantPublicRefs, ...insights.grantAnonRefs, ...insights.grantAllRefs);
+
+    if (insights.rlsEnableRefs.length > 0) {
+      pushInfoFinding(report, {
+        id: `rls-enabled-${file.relPath}`,
+        category: "rls",
+        title: "Row-level security evidence found",
+        evidenceRef: insights.rlsEnableRefs[0],
+        reasonCodes: ["rls_enabled_detected", "local_static_scan_only", "safe_next_action_available"],
+        safeNextAction: "Keep the visible RLS and policy evidence current as schema changes land.",
+      });
+      if (isSupabase) supabaseSurface.risk = pickHigherRisk(supabaseSurface.risk, "low");
+      if (isMigration) postgresSurface.risk = pickHigherRisk(postgresSurface.risk, "low");
+    }
+
+    if (insights.policyRefs.length > 0) {
+      pushInfoFinding(report, {
+        id: `policy-${file.relPath}`,
+        category: "policy",
+        title: "Policy evidence found",
+        evidenceRef: insights.policyRefs[0],
+        reasonCodes: ["policy_detected", "local_static_scan_only", "safe_next_action_available"],
+        safeNextAction: "Review policy changes alongside any new table or route changes.",
+      });
+      if (isSupabase) supabaseSurface.risk = pickHigherRisk(supabaseSurface.risk, "low");
+    }
+
+    for (const ref of insights.rlsDisableRefs.slice(0, 3)) {
+      pushBlockFinding(report, {
+        id: `rls-disabled-${ref}`,
+        category: "rls",
+        title: "Row-level security is disabled locally",
+        evidenceRef: ref,
+        reasonCodes: ["rls_disabled_detected", "blocked_data_exposure", "production_data_risk", "safe_next_action_available"],
+        safeNextAction: "Re-enable RLS or document a narrower server-only data path before shipping.",
+      });
+      if (isSupabase) supabaseSurface.risk = pickHigherRisk(supabaseSurface.risk, "blocked");
+      postgresSurface.risk = pickHigherRisk(postgresSurface.risk, "blocked");
+    }
+
+    for (const ref of insights.broadPolicyRefs.slice(0, 3)) {
+      pushWarnFinding(report, {
+        id: `policy-broad-${ref}`,
+        category: "policy",
+        title: "Broad policy condition needs review",
+        evidenceRef: ref,
+        reasonCodes: ["broad_policy_detected", "policy_true_condition_detected", "not_enough_evidence", "safe_next_action_available"],
+        safeNextAction: "Review broad policy conditions and tighten the user or tenant boundary before shipping.",
+      });
+      if (isSupabase) supabaseSurface.risk = pickHigherRisk(supabaseSurface.risk, "medium");
+      postgresSurface.risk = pickHigherRisk(postgresSurface.risk, "medium");
+    }
+
+    for (const ref of insights.broadWritePolicyRefs.slice(0, 3)) {
+      pushBlockFinding(report, {
+        id: `policy-broad-write-${ref}`,
+        category: "policy",
+        title: "Broad write or delete policy is exposed locally",
+        evidenceRef: ref,
+        reasonCodes: ["broad_policy_detected", "policy_true_condition_detected", "blocked_data_exposure", "safe_next_action_available"],
+        safeNextAction: "Tighten the write or delete policy so it is scoped to the right user or tenant before shipping.",
+      });
+      if (isSupabase) supabaseSurface.risk = pickHigherRisk(supabaseSurface.risk, "blocked");
+      postgresSurface.risk = pickHigherRisk(postgresSurface.risk, "blocked");
+    }
+
+    for (const ref of insights.grantPublicRefs.slice(0, 3)) {
+      pushBlockFinding(report, {
+        id: `grant-public-${ref}`,
+        category: "grant",
+        title: "Public database grant is visible locally",
+        evidenceRef: ref,
+        reasonCodes: ["grant_public_detected", "blocked_data_exposure", "production_data_risk", "safe_next_action_available"],
+        safeNextAction: "Remove or narrow the public grant before treating the data boundary as safe.",
+      });
+      postgresSurface.risk = pickHigherRisk(postgresSurface.risk, "blocked");
+    }
+
+    for (const ref of insights.grantAllRefs.slice(0, 3)) {
+      pushBlockFinding(report, {
+        id: `grant-all-${ref}`,
+        category: "grant",
+        title: "Broad GRANT ALL is visible locally",
+        evidenceRef: ref,
+        reasonCodes: ["grant_all_detected", "blocked_data_exposure", "production_data_risk", "safe_next_action_available"],
+        safeNextAction: "Replace broad grants with the narrowest roles needed before shipping.",
+      });
+      postgresSurface.risk = pickHigherRisk(postgresSurface.risk, "blocked");
+    }
+
+    for (const ref of insights.grantAnonRefs.slice(0, 3)) {
+      const severity = insights.sensitiveTables.length > 0 ? "block" : "warn";
+      addFinding(report, {
+        id: `grant-anon-${ref}`,
+        severity,
+        category: "grant",
+        title: insights.sensitiveTables.length > 0
+          ? "Anon access to a sensitive table is visible locally"
+          : "Anon grant needs review",
+        evidenceRef: ref,
+        reasonCodes: [
+          "grant_anon_detected",
+          ...(insights.sensitiveTables.length > 0 ? ["sensitive_table_detected", "production_data_risk"] : ["not_enough_evidence"]),
+          "safe_next_action_available",
+        ],
+        safeNextAction: insights.sensitiveTables.length > 0
+          ? "Narrow or remove anon access before shipping sensitive data paths."
+          : "Review whether anon access is intentional and bounded before shipping.",
+      });
+      postgresSurface.risk = pickHigherRisk(postgresSurface.risk, insights.sensitiveTables.length > 0 ? "blocked" : "medium");
+    }
+
+    for (const ref of insights.storagePublicRefs.slice(0, 3)) {
+      storageSurface.detected = true;
+      storageSurface.bucketRefs.push(ref);
+      storageSurface.publicAccessSignals.push(ref);
+      if (isSupabase) {
+        supabaseSurface.storageEvidence.push(ref);
+      }
+      const severity = SENSITIVE_BUCKET_RE.test(readText(file) || "") ? "block" : "warn";
+      addFinding(report, {
+        id: `storage-sql-${ref}`,
+        severity,
+        category: "storage",
+        title: severity === "block"
+          ? "Sensitive storage bucket appears public"
+          : "Public storage bucket needs review",
+        evidenceRef: ref,
+        reasonCodes: [
+          "storage_detected",
+          "storage_public_bucket_detected",
+          ...(severity === "block" ? ["sensitive_storage_public_risk", "production_data_risk"] : ["not_enough_evidence"]),
+          "safe_next_action_available",
+        ],
+        safeNextAction: severity === "block"
+          ? "Restrict the sensitive bucket or move the files behind a narrower policy before shipping."
+          : "Review whether the bucket should stay public and keep sensitive files out of that path.",
+      });
+      storageSurface.risk = pickHigherRisk(storageSurface.risk, severity === "block" ? "blocked" : "medium");
+    }
+  }
+
+  supabaseSurface.rlsEvidence = unique(supabaseSurface.rlsEvidence).slice(0, 8);
+  supabaseSurface.policyEvidence = unique(supabaseSurface.policyEvidence).slice(0, 8);
+  supabaseSurface.storageEvidence = unique(supabaseSurface.storageEvidence).slice(0, 8);
+  postgresSurface.migrations = unique(postgresSurface.migrations).slice(0, 8);
+  postgresSurface.grants = unique(postgresSurface.grants).slice(0, 8);
+
+  const supabaseConfig = files.find((file) => /(^|\/)supabase\/config\.toml$/i.test(file.relPath));
+  if (supabaseConfig) {
+    supabaseSurface.detected = true;
+  }
+
+  if ((supabaseSurface.detected || postgresSurface.detected) && supabaseSurface.rlsEvidence.length === 0 && supabaseSurface.policyEvidence.length === 0) {
+    pushWarnFinding(report, {
+      id: "rls-missing-or-unclear",
+      category: "rls",
+      title: "Data boundary needs evidence",
+      evidenceRef: supabaseSurface.migrations[0] || postgresSurface.migrations[0] || sanitizeRef(supabaseConfig?.relPath),
+      reasonCodes: ["rls_missing_or_unclear", "not_enough_evidence", "local_static_scan_only", "safe_next_action_available"],
+      safeNextAction: "Add visible RLS or policy evidence before treating the local data boundary as safe.",
+    });
+    if (supabaseSurface.detected) supabaseSurface.risk = pickHigherRisk(supabaseSurface.risk, "medium");
+    if (postgresSurface.detected) postgresSurface.risk = pickHigherRisk(postgresSurface.risk, "medium");
+  }
+
+  if (prismaFiles.length > 0) {
+    prismaSurface.detected = true;
+    prismaSurface.schemaRefs = prismaFiles.map((file) => sanitizeRef(file.relPath)).filter(Boolean).slice(0, 8);
+    for (const file of prismaFiles) {
+      const text = readText(file) || "";
+      const modelPattern = /\bmodel\s+([A-Za-z0-9_]+)\s*\{([\s\S]*?)\n\}/g;
+      let modelMatch;
+      let foundScopedModel = false;
+      let foundSensitiveModel = false;
+      while ((modelMatch = modelPattern.exec(text))) {
+        const modelName = modelMatch[1];
+        const body = modelMatch[2] || "";
+        if (!isSensitiveName(modelName)) continue;
+        foundSensitiveModel = true;
+        const lineNumber = findLineNumber(text, modelMatch.index);
+        const ref = makeEvidenceRef(file.relPath, lineNumber, modelName);
+        if (/\b(userId|tenantId|organizationId|accountId|orgId)\b/.test(body)) {
+          foundScopedModel = true;
+          pushInfoFinding(report, {
+            id: `prisma-scope-${modelName}-${lineNumber}`,
+            category: "tenant_scope",
+            title: "Schema scope field found",
+            evidenceRef: ref,
+            reasonCodes: ["prisma_detected", "tenant_scope_evidence_detected", "safe_next_action_available"],
+            safeNextAction: "Keep user or tenant scope fields aligned with the corresponding route and policy checks.",
+          });
+          prismaSurface.risk = pickHigherRisk(prismaSurface.risk, "low");
+        }
+      }
+      if (foundSensitiveModel && !foundScopedModel) {
+        const ref = collectPatternRefs(file, /\bmodel\s+([A-Za-z0-9_]+)\s*\{/i, { limit: 1, label: (match) => match[1] || null })[0];
+        pushWarnFinding(report, {
+          id: `prisma-sensitive-${file.relPath}`,
+          category: "tenant_scope",
+          title: "Sensitive Prisma model needs access evidence",
+          evidenceRef: ref,
+          reasonCodes: ["prisma_detected", "sensitive_model_detected", "tenant_scope_missing_or_unclear", "not_enough_evidence", "safe_next_action_available"],
+          safeNextAction: "Add visible route, policy, or tenant-scoping evidence before treating sensitive Prisma models as safe to ship.",
+        });
+        prismaSurface.risk = pickHigherRisk(prismaSurface.risk, "medium");
+      }
+      if (foundSensitiveModel && prismaSurface.risk === "none") {
+        prismaSurface.risk = pickHigherRisk(prismaSurface.risk, "medium");
+      }
+    }
+  }
+
+  if (drizzleFiles.length > 0) {
+    drizzleSurface.detected = true;
+    drizzleSurface.schemaRefs = unique(
+      drizzleFiles
+        .filter((file) => /schema\.(js|ts)$/i.test(file.relPath))
+        .map((file) => sanitizeRef(file.relPath))
+    ).slice(0, 8);
+    drizzleSurface.migrationRefs = unique(
+      files
+        .filter((file) => /(^|\/)drizzle\/.*\.(sql|js|ts)$/i.test(file.relPath))
+        .map((file) => sanitizeRef(file.relPath))
+    ).slice(0, 8);
+    let drizzleHasScope = false;
+    for (const file of drizzleFiles) {
+      const text = readText(file) || "";
+      if (/\bpgTable\s*\(/.test(text) && /\b(userId|tenantId|organizationId|accountId|orgId)\b/.test(text)) {
+        drizzleHasScope = true;
+        const ref = collectPatternRefs(file, /\b(userId|tenantId|organizationId|accountId|orgId)\b/i, { limit: 1 })[0];
+        pushInfoFinding(report, {
+          id: `drizzle-scope-${file.relPath}`,
+          category: "tenant_scope",
+          title: "Schema scope field found",
+          evidenceRef: ref,
+          reasonCodes: ["drizzle_detected", "tenant_scope_evidence_detected", "safe_next_action_available"],
+          safeNextAction: "Keep Drizzle scope fields aligned with the route-level auth and tenant checks.",
+        });
+        drizzleSurface.risk = pickHigherRisk(drizzleSurface.risk, "low");
+      }
+    }
+    if (!drizzleHasScope && drizzleSurface.detected) {
+      pushWarnFinding(report, {
+        id: "drizzle-scope-missing",
+        category: "tenant_scope",
+        title: "Tenant or user scope is unclear",
+        evidenceRef: drizzleSurface.schemaRefs[0] || drizzleSurface.migrationRefs[0],
+        reasonCodes: ["drizzle_detected", "tenant_scope_missing_or_unclear", "not_enough_evidence", "safe_next_action_available"],
+        safeNextAction: "Add visible tenant or user scoping evidence before treating the Drizzle data path as safe.",
+      });
+      drizzleSurface.risk = pickHigherRisk(drizzleSurface.risk, "medium");
+    }
+  }
+
+  for (const file of envFiles) {
+    const vars = parseEnvVariableNames(file);
+    if (vars.length > 0) envSurface.detected = true;
+    for (const item of vars) {
+      if (/(SERVICE_ROLE|DATABASE_URL|SECRET|TOKEN|ADMIN)/i.test(item.name)) {
+        envSurface.secretNameRefs.push(item.ref);
+      }
+      if (/^NEXT_PUBLIC_.*(SERVICE_ROLE|DATABASE_URL|SECRET|TOKEN|ADMIN)/i.test(item.name)) {
+        pushBlockFinding(report, {
+          id: `next-public-secret-${item.name}`,
+          category: "env",
+          title: "Public env name looks like a secret or admin path",
+          evidenceRef: item.ref,
+          reasonCodes: ["next_public_secret_like_name", "blocked_data_exposure", "production_data_risk", "safe_next_action_available"],
+          safeNextAction: "Rename the public env and move the secret or admin usage behind a server-only boundary before shipping.",
+        });
+        envSurface.clientExposureSignals.push(item.ref);
+        envSurface.risk = pickHigherRisk(envSurface.risk, "blocked");
+      }
+    }
+  }
+
+  for (const file of sourceFiles) {
+    const text = readText(file);
+    if (!text) continue;
+    const clientFile = isClientFile(file);
+    const serverFile = isServerFile(file);
+    const authEvidence = hasAuthEvidence(text);
+    const tenantEvidence = hasTenantScope(text);
+    const dbAccess = hasDbAccess(text);
+    const adminRoute = isAdminRoute(file);
+    const routeRef = makeEvidenceRef(file.relPath, 1, null);
+
+    if (/supabase\/config\.toml/i.test(file.relPath) || /createClient/i.test(text) && /supabase/i.test(text)) {
+      supabaseSurface.detected = true;
+    }
+
+    if (isApiRouteFile(file)) {
+      apiSurface.detected = true;
+      apiSurface.routeRefs.push(routeRef);
+      if (authEvidence) {
+        const ref = collectPatternRefs(file, /\b(getServerSession|requireAuth|requireUser|auth\(\)|currentUser\(|clerkMiddleware|authMiddleware|supabase\.auth\.getUser|verifyAuth|getSession|session\.user|request\.user|ctx\.user)\b/i, { limit: 1 })[0];
+        if (ref) apiSurface.authEvidence.push(ref);
+      } else if (workspaceMiddlewareAuthRefs.length > 0) {
+        apiSurface.authEvidence.push(workspaceMiddlewareAuthRefs[0]);
+      }
+      if (dbAccess && !authEvidence) {
+        const ref = collectPatternRefs(file, /\b(prisma\.\w+|db\.\w+|sql`|supabase\.(from|rpc|schema|storage)|\.(select|insert|update|delete|upsert)\s*\(|execute\s*\(|query\s*\()/i, { limit: 1 })[0] || routeRef;
+        apiSurface.missingAuthSignals.push(ref);
+        pushWarnFinding(report, {
+          id: `api-auth-${file.relPath}`,
+          category: "api_auth",
+          title: workspaceMiddlewareAuthRefs.length > 0
+            ? "API route uses data access without route-local auth evidence"
+            : "API route uses data access without clear auth evidence",
+          evidenceRef: ref,
+          reasonCodes: [
+            "api_route_detected",
+            "api_auth_missing_or_unclear",
+            ...(workspaceMiddlewareAuthRefs.length > 0 ? ["api_auth_evidence_detected"] : []),
+            "not_enough_evidence",
+            "safe_next_action_available",
+          ],
+          safeNextAction: workspaceMiddlewareAuthRefs.length > 0
+            ? "Keep middleware auth in place and add route-local auth or session evidence next to the data access before shipping."
+            : "Add visible auth or session checks next to the route's data access before shipping.",
+        });
+        apiSurface.risk = pickHigherRisk(apiSurface.risk, "medium");
+      }
+      if (dbAccess && authEvidence && !tenantEvidence && /organization|tenant|account|customer|team/i.test(text)) {
+        const ref = collectPatternRefs(file, /\b(prisma\.\w+|db\.\w+|sql`|supabase\.(from|rpc|schema|storage)|\.(select|insert|update|delete|upsert)\s*\(|execute\s*\(|query\s*\()/i, { limit: 1 })[0] || routeRef;
+        apiSurface.missingAuthSignals.push(ref);
+        pushWarnFinding(report, {
+          id: `api-scope-${file.relPath}`,
+          category: "tenant_scope",
+          title: "Tenant or user scoping is unclear",
+          evidenceRef: ref,
+          reasonCodes: ["api_route_detected", "tenant_scope_missing_or_unclear", "not_enough_evidence", "safe_next_action_available"],
+          safeNextAction: "Add visible user, tenant, organization, or account filters near the data access before shipping.",
+        });
+        apiSurface.risk = pickHigherRisk(apiSurface.risk, "medium");
+      }
+      if (dbAccess && authEvidence) {
+        const ref = collectPatternRefs(file, /\b(getServerSession|requireAuth|requireUser|auth\(\)|currentUser\(|clerkMiddleware|authMiddleware|supabase\.auth\.getUser|verifyAuth|getSession|session\.user|request\.user|ctx\.user)\b/i, { limit: 1 })[0] || routeRef;
+        pushInfoFinding(report, {
+          id: `api-auth-positive-${file.relPath}`,
+          category: "api_auth",
+          title: tenantEvidence
+            ? "Route auth and scope evidence found"
+            : "Route auth evidence found",
+          evidenceRef: ref,
+          reasonCodes: [
+            "api_route_detected",
+            "api_auth_evidence_detected",
+            ...(tenantEvidence ? ["tenant_scope_evidence_detected"] : []),
+            "safe_next_action_available",
+          ],
+          safeNextAction: tenantEvidence
+            ? "Keep the route auth and scope checks aligned with future data changes."
+            : "Keep route auth evidence visible and add tenant or user scoping where needed.",
+        });
+        apiSurface.risk = pickHigherRisk(apiSurface.risk, tenantEvidence ? "low" : "medium");
+      }
+      if (adminRoute && dbAccess && !authEvidence) {
+        const severity = routeSensitivity(text) >= 3 ? "block" : "warn";
+        addFinding(report, {
+          id: `admin-route-${file.relPath}`,
+          severity,
+          category: "api_auth",
+          title: severity === "block"
+            ? "Admin data route lacks visible auth guard"
+            : "Admin route needs visible auth evidence",
+          evidenceRef: routeRef,
+          reasonCodes: [
+            "api_route_detected",
+            "api_auth_missing_or_unclear",
+            "production_data_risk",
+            "safe_next_action_available",
+          ],
+          safeNextAction: "Add an explicit admin auth guard and visible authorization boundary before shipping the admin route.",
+        });
+        apiSurface.risk = pickHigherRisk(apiSurface.risk, severity === "block" ? "blocked" : "high");
+      }
+    }
+
+    const serviceRoleRef = collectPatternRefs(file, /\b(SUPABASE_SERVICE_ROLE_KEY|service_role|serviceRole|createServiceRoleClient|supabaseAdmin|adminClient)\b/i, { limit: 1 })[0];
+    if (serviceRoleRef) {
+      envSurface.detected = true;
+      envSurface.secretNameRefs.push(serviceRoleRef);
+      if (clientFile) {
+        pushBlockFinding(report, {
+          id: `service-role-client-${file.relPath}`,
+          category: "service_role",
+          title: "Service-role or admin client is exposed to client code",
+          evidenceRef: serviceRoleRef,
+          reasonCodes: ["service_role_reference_detected", "service_role_client_exposure", "blocked_data_exposure", "safe_next_action_available"],
+          safeNextAction: "Move the service-role or admin client behind a server-only boundary before shipping.",
+        });
+        envSurface.clientExposureSignals.push(serviceRoleRef);
+        envSurface.risk = pickHigherRisk(envSurface.risk, "blocked");
+      } else if (serverFile) {
+        pushWarnFinding(report, {
+          id: `service-role-server-${file.relPath}`,
+          category: "service_role",
+          title: "Service-role reference needs manual review",
+          evidenceRef: serviceRoleRef,
+          reasonCodes: ["service_role_reference_detected", "env_reference_detected", "not_enough_evidence", "safe_next_action_available"],
+          safeNextAction: "Confirm the service-role or admin key stays server-only and is not reachable from the browser path.",
+        });
+        envSurface.risk = pickHigherRisk(envSurface.risk, "medium");
+      }
+    }
+
+    const databaseUrlRef = collectPatternRefs(file, /\bDATABASE_URL\b/i, { limit: 1 })[0];
+    if (databaseUrlRef) {
+      envSurface.detected = true;
+      envSurface.secretNameRefs.push(databaseUrlRef);
+      if (clientFile) {
+        pushBlockFinding(report, {
+          id: `database-url-client-${file.relPath}`,
+          category: "env",
+          title: "DATABASE_URL is referenced from client-facing code",
+          evidenceRef: databaseUrlRef,
+          reasonCodes: ["env_reference_detected", "database_url_client_exposure", "blocked_data_exposure", "safe_next_action_available"],
+          safeNextAction: "Remove DATABASE_URL from client-facing code and keep database access behind a server-only path.",
+        });
+        envSurface.clientExposureSignals.push(databaseUrlRef);
+        envSurface.risk = pickHigherRisk(envSurface.risk, "blocked");
+      }
+    }
+
+    if (clientFile) {
+      const importRef = dbClientImportRef(file, text);
+      if (importRef) {
+        pushBlockFinding(report, {
+          id: `client-db-import-${file.relPath}`,
+          category: "service_role",
+          title: "Client-facing code imports a server or database client",
+          evidenceRef: importRef,
+          reasonCodes: ["blocked_data_exposure", "production_data_risk", "safe_next_action_available"],
+          safeNextAction: "Move database or server-only imports out of client-facing code before shipping.",
+        });
+        if (/@prisma\/client|prisma/i.test(importRef)) prismaSurface.clientExposureRefs.push(importRef);
+        if (/drizzle/i.test(importRef)) drizzleSurface.migrationRefs.push(importRef);
+        envSurface.clientExposureSignals.push(importRef);
+        envSurface.risk = pickHigherRisk(envSurface.risk, "blocked");
+      }
+    }
+
+    if (/storage\.(from|getBucket|createBucket|updateBucket)|createClient/i.test(text) && /storage/i.test(text)) {
+      storageSurface.detected = true;
+      storageSurface.bucketRefs.push(routeRef);
+    }
+
+    const publicBucketRefs = collectPatternRefs(file, /\b(public|anon)\b[\s\S]{0,80}\b(bucket|storage\.from|getBucket|createBucket|updateBucket)\b|\b(bucket|storage\.buckets)\b[\s\S]{0,120}\bpublic\b/ig, { limit: 2 });
+    for (const ref of publicBucketRefs) {
+      const label = String(ref || "");
+      const severity = SENSITIVE_BUCKET_RE.test(text) ? "block" : LOWER_RISK_BUCKET_RE.test(text) ? "warn" : "warn";
+      addFinding(report, {
+        id: `storage-public-${ref}`,
+        severity,
+        category: "storage",
+        title: severity === "block"
+          ? "Sensitive storage bucket appears public"
+          : "Public storage bucket needs review",
+        evidenceRef: ref,
+        reasonCodes: [
+          "storage_detected",
+          "storage_public_bucket_detected",
+          ...(SENSITIVE_BUCKET_RE.test(text) ? ["sensitive_storage_public_risk", "production_data_risk"] : ["not_enough_evidence"]),
+          "safe_next_action_available",
+        ],
+        safeNextAction: severity === "block"
+          ? "Restrict the sensitive bucket or move the files behind a narrower policy before shipping."
+          : "Review whether the bucket should stay public and keep sensitive files out of that path.",
+      });
+      storageSurface.publicAccessSignals.push(ref);
+      storageSurface.risk = pickHigherRisk(storageSurface.risk, severity === "block" ? "blocked" : "medium");
+    }
+  }
+
+  envSurface.secretNameRefs = unique(envSurface.secretNameRefs).slice(0, 8);
+  envSurface.clientExposureSignals = unique(envSurface.clientExposureSignals).slice(0, 8);
+  prismaSurface.clientExposureRefs = unique(prismaSurface.clientExposureRefs).slice(0, 8);
+  apiSurface.routeRefs = unique(apiSurface.routeRefs).slice(0, 8);
+  apiSurface.authEvidence = unique(apiSurface.authEvidence).slice(0, 8);
+  apiSurface.missingAuthSignals = unique(apiSurface.missingAuthSignals).slice(0, 8);
+  storageSurface.bucketRefs = unique(storageSurface.bucketRefs).slice(0, 8);
+  storageSurface.publicAccessSignals = unique(storageSurface.publicAccessSignals).slice(0, 8);
+
+  if (storageSurface.detected && storageSurface.publicAccessSignals.length === 0 && storageSurface.bucketRefs.length > 0) {
+    storageSurface.risk = pickHigherRisk(storageSurface.risk, "low");
+  }
+
+  if (apiSurface.detected && apiSurface.risk === "none") {
+    apiSurface.risk = apiSurface.authEvidence.length > 0 ? "low" : "medium";
+  }
+  if (supabaseSurface.detected && supabaseSurface.risk === "none") {
+    supabaseSurface.risk = supabaseSurface.rlsEvidence.length > 0 || supabaseSurface.policyEvidence.length > 0 ? "low" : "medium";
+  }
+  if (postgresSurface.detected && postgresSurface.risk === "none") {
+    postgresSurface.risk = postgresSurface.grants.length > 0 ? "medium" : "unknown";
+  }
+  if (prismaSurface.detected && prismaSurface.risk === "none") {
+    prismaSurface.risk = "medium";
+  }
+  if (drizzleSurface.detected && drizzleSurface.risk === "none") {
+    drizzleSurface.risk = "medium";
+  }
+  if (envSurface.detected && envSurface.risk === "none") {
+    envSurface.risk = envSurface.secretNameRefs.length > 0 ? "low" : "unknown";
+  }
+
+  report.findings.sort((left, right) => severityRank(right.severity) - severityRank(left.severity));
+  report.findings = report.findings.filter((finding, index, list) => {
+    const key = `${finding.severity}|${finding.category}|${finding.title}|${finding.evidenceRef || ""}`;
+    return list.findIndex((item) => `${item.severity}|${item.category}|${item.title}|${item.evidenceRef || ""}` === key) === index;
+  });
+
+  const blockers = report.findings.filter((finding) => finding.severity === "block");
+  const warns = report.findings.filter((finding) => finding.severity === "warn");
+  const infos = report.findings.filter((finding) => finding.severity === "info");
+  const detectedSurfaces = Object.values(report.surfaces).filter((surface) => surface.detected).length;
+
+  report.rollup.readySignals = infos.map((finding) => finding.title).slice(0, 6);
+  report.rollup.needsReview = warns.map((finding) => finding.title).slice(0, 6);
+  report.rollup.blockedItems = blockers.map((finding) => finding.title).slice(0, 6);
+  report.rollup.notEnoughEvidence = report.findings
+    .filter((finding) => finding.reasonCodes.includes("not_enough_evidence") || finding.reasonCodes.includes("rls_missing_or_unclear"))
+    .map((finding) => finding.title)
+    .slice(0, 6);
+
+  let safeNextAction = "Keep the local data boundary evidence current as the repo changes.";
+  if (blockers[0]?.safeNextAction) {
+    safeNextAction = blockers[0].safeNextAction;
+  } else if (warns[0]?.safeNextAction) {
+    safeNextAction = warns[0].safeNextAction;
+  } else if (infos[0]?.safeNextAction) {
+    safeNextAction = infos[0].safeNextAction;
+  } else if (detectedSurfaces === 0) {
+    safeNextAction = "No local data surface was detected. Re-run after adding database, storage, or API code.";
+  }
+
+  if (detectedSurfaces === 0) {
+    report.status = "no_data";
+  } else if (blockers.length > 0) {
+    report.status = "blocked";
+  } else if (warns.length > 0) {
+    report.status = "warn";
+  } else {
+    report.status = "pass";
+  }
+
+  report.generatedAt = nowIso();
+  report.summary = {
+    surfacesInspected: detectedSurfaces,
+    risksFound: report.findings.length,
+    blockers: blockers.length,
+    needsReview: warns.length,
+    safeNextAction,
+  };
+
+  if (options.write === true) {
+    ensureCcoDirs(cwd);
+    safeWriteJson(cwd, REPORT_JSON_REL, report);
+  }
+
+  return report;
+}
+
+function generateDataPermissionsGuard(cwd = process.cwd(), options = {}) {
+  const report = buildDataPermissionsGuard(cwd, { ...options, write: options.write !== false });
+  return {
+    report,
+    reportPath: path.join(cwd, REPORT_JSON_REL),
+  };
+}
+
+function loadDataPermissionsGuard(cwd = process.cwd()) {
+  return safeReadJson(cwd, REPORT_JSON_REL, null);
+}
+
+function formatDataPermissionsGuardText(report) {
+  const lines = [
+    "Avorelo Data & Permissions Guard",
+    `Status: ${String(report.status || "no_data").toUpperCase()} · redacted=${report.redacted === true ? "yes" : "no"}`,
+    `Surfaces: ${report.summary?.surfacesInspected || 0} · risks=${report.summary?.risksFound || 0} · blockers=${report.summary?.blockers || 0} · review=${report.summary?.needsReview || 0}`,
+    `Safe next action: ${report.summary?.safeNextAction || "Review the local data boundary before shipping."}`,
+    "",
+    "Findings:",
+  ];
+
+  const topFindings = (report.findings || []).slice(0, 6);
+  if (topFindings.length === 0) {
+    lines.push(report.summary?.surfacesInspected
+      ? "- No risky local data-permission findings were detected."
+      : "- No local data surface was detected.");
+  } else {
+    for (const finding of topFindings) {
+      lines.push(`- [${finding.severity}] ${finding.title}${finding.evidenceRef ? ` · ${finding.evidenceRef}` : ""}`);
+    }
+  }
+
+  return lines.join("\n");
+}
+
+function formatDataPermissionsGuardStatusLineFromReport(report) {
+  return `Data guard: ${String(report.status || "no_data").toUpperCase()}`
+    + ` · surfaces=${report.summary?.surfacesInspected || 0}`
+    + ` · blockers=${report.summary?.blockers || 0}`
+    + ` · next=${report.summary?.safeNextAction || "review local data evidence"}`;
+}
+
+function buildDataPermissionsGuardSurface(cwd = process.cwd(), options = {}) {
+  const report = loadDataPermissionsGuard(cwd) || (options.buildIfMissing ? buildDataPermissionsGuard(cwd, { write: false }) : null);
+  if (!report) {
+    return {
+      status: "not_run",
+      blockerCount: 0,
+      needsReviewCount: 0,
+      surfacesInspected: 0,
+      nextBestAction: "Run `avorelo data-guard --text` before treating a local data boundary as safe.",
+      statusLine: "Data guard: NOT RUN · run `avorelo data-guard --text`",
+      showInStatus: true,
+      showInDashboard: true,
+      evidenceRef: null,
+      limitations: [
+        "Local static scan only. No live database connection or cloud scanner.",
+      ],
+    };
+  }
+
+  return {
+    status: report.status,
+    blockerCount: report.summary?.blockers || 0,
+    needsReviewCount: report.summary?.needsReview || 0,
+    surfacesInspected: report.summary?.surfacesInspected || 0,
+    nextBestAction: report.summary?.safeNextAction,
+    statusLine: formatDataPermissionsGuardStatusLineFromReport(report),
+    showInStatus: true,
+    showInDashboard: true,
+    evidenceRef: REPORT_JSON_REL,
+    limitations: [
+      "Local static scan only. No live database connection or cloud scanner.",
+      "Absence of evidence stays bounded and reason-coded.",
+    ],
+  };
+}
+
+module.exports = {
+  CONTRACT,
+  REPORT_JSON_REL,
+  buildDataPermissionsGuard,
+  generateDataPermissionsGuard,
+  loadDataPermissionsGuard,
+  formatDataPermissionsGuardText,
+  buildDataPermissionsGuardSurface,
+  formatDataPermissionsGuardStatusLineFromReport,
+};