cleartoship 0.4.0

package/dist/utils/detect.js

@@ -0,0 +1,77 @@
+import { join } from 'node:path';
+import { exists, read } from './files.js';
+function hasDep(pkg, name) {
+    if (!pkg)
+        return false;
+    return Boolean(pkg.dependencies?.[name] ||
+        pkg.devDependencies?.[name] ||
+        pkg.peerDependencies?.[name]);
+}
+export function detectFramework(root, files) {
+    let pkg = null;
+    const raw = read(join(root, 'package.json'));
+    if (raw) {
+        try {
+            pkg = JSON.parse(raw);
+        }
+        catch {
+            /* malformed package.json is reported by the dependency scanner */
+        }
+    }
+    const hasApp = exists(join(root, 'app')) ||
+        exists(join(root, 'src/app')) ||
+        files.some((f) => /\/(src\/)?app\/.*\/(page|layout|route)\.(t|j)sx?$/.test(f));
+    const hasPages = exists(join(root, 'pages')) || exists(join(root, 'src/pages'));
+    const isNext = hasDep(pkg, 'next') || hasApp || hasPages;
+    let nextjs = null;
+    if (isNext) {
+        if (hasApp && hasPages)
+            nextjs = 'both';
+        else if (hasApp)
+            nextjs = 'app-router';
+        else if (hasPages)
+            nextjs = 'pages-router';
+        else
+            nextjs = 'app-router';
+    }
+    const supabase = hasDep(pkg, '@supabase/supabase-js') ||
+        hasDep(pkg, '@supabase/ssr') ||
+        hasDep(pkg, '@supabase/auth-helpers-nextjs') ||
+        exists(join(root, 'supabase'));
+    const info = {
+        nextjs,
+        supabase,
+        prisma: hasDep(pkg, '@prisma/client') || exists(join(root, 'prisma')),
+        drizzle: hasDep(pkg, 'drizzle-orm'),
+        clerk: hasDep(pkg, '@clerk/nextjs') || hasDep(pkg, '@clerk/clerk-sdk-node'),
+        nextAuth: hasDep(pkg, 'next-auth') || hasDep(pkg, '@auth/core'),
+        stripe: hasDep(pkg, 'stripe'),
+        python: exists(join(root, 'requirements.txt')) ||
+            exists(join(root, 'pyproject.toml')),
+        describe() {
+            const parts = [];
+            if (this.nextjs === 'app-router')
+                parts.push('Next.js (App Router)');
+            else if (this.nextjs === 'pages-router')
+                parts.push('Next.js (Pages Router)');
+            else if (this.nextjs === 'both')
+                parts.push('Next.js (App + Pages Router)');
+            if (this.supabase)
+                parts.push('Supabase');
+            if (this.prisma)
+                parts.push('Prisma');
+            if (this.drizzle)
+                parts.push('Drizzle');
+            if (this.clerk)
+                parts.push('Clerk');
+            if (this.nextAuth)
+                parts.push('NextAuth');
+            if (this.stripe)
+                parts.push('Stripe');
+            if (this.python)
+                parts.push('Python');
+            return parts.length ? parts.join(' + ') : 'generic JavaScript/TypeScript';
+        },
+    };
+    return info;
+}

package/dist/utils/entropy.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Shannon entropy in bits per character. Real credentials are near-random and
+ * score high; words, paths and placeholders score low. gitleaks ships a
+ * threshold with many of its rules, and applying it is most of what keeps a
+ * broad credential ruleset from drowning a report in noise.
+ */
+export declare function shannonEntropy(value: string): number;

package/dist/utils/entropy.js

@@ -0,0 +1,19 @@
+/**
+ * Shannon entropy in bits per character. Real credentials are near-random and
+ * score high; words, paths and placeholders score low. gitleaks ships a
+ * threshold with many of its rules, and applying it is most of what keeps a
+ * broad credential ruleset from drowning a report in noise.
+ */
+export function shannonEntropy(value) {
+    if (value.length === 0)
+        return 0;
+    const counts = new Map();
+    for (const ch of value)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}

package/dist/utils/files.d.ts

@@ -0,0 +1,13 @@
+export declare function walk(root: string): string[];
+export declare function read(file: string): string | null;
+export declare function rel(root: string, file: string): string;
+export declare function exists(p: string): boolean;
+/** 1-indexed line number for a character offset. */
+export declare function lineAt(source: string, index: number): number;
+export declare function snippetAt(source: string, line: number): string;
+export declare function isScript(file: string): boolean;
+export declare function isSql(file: string): boolean;
+/** Prose and agent-instruction files, where install commands get copy-pasted from. */
+export declare function isProse(file: string): boolean;
+/** Language tokens the vendored community rules match on. */
+export declare function languagesFor(file: string): string[];

package/dist/utils/files.js

@@ -0,0 +1,154 @@
+import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', '.next', '.turbo', '.vercel', '.wrangler',
+    'dist', 'build', 'out', 'coverage', '.venv', 'venv', '__pycache__',
+    '.cache', '.pnpm-store', 'vendor', 'target', '.svelte-kit', '.nuxt',
+    '.cts-cache', '_reference',
+]);
+const SCAN_EXTS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts', '.sql',
+    '.json', '.txt', '.toml', '.env', '.yaml', '.yml',
+    // Prose files matter: AI agents copy `npm install <hallucination>` out of
+    // READMEs and agent instruction files long before it reaches a manifest.
+    '.md', '.mdc', '.mdx',
+    // Reachable by the vendored community ruleset, which covers more ecosystems
+    // than the AST scanners do.
+    '.py', '.go', '.sh', '.bash', '.tf', '.tfvars', '.rb', '.php',
+]);
+/** Extensionless files worth reading. */
+const NAMED_FILES = new Set(['Dockerfile', 'Makefile', 'Procfile']);
+/** Instruction files read by coding agents. No extension, but high signal. */
+const AGENT_FILES = new Set([
+    '.cursorrules', '.windsurfrules', '.clinerules', '.aiderrules', '.goosehints',
+]);
+/** Files bigger than this are almost certainly bundles or fixtures, not source. */
+const MAX_FILE_BYTES = 2_000_000;
+export function walk(root) {
+    const found = [];
+    const stack = [root];
+    while (stack.length) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const full = join(dir, entry);
+            let st;
+            try {
+                st = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory()) {
+                if (SKIP_DIRS.has(entry))
+                    continue;
+                stack.push(full);
+                continue;
+            }
+            if (!st.isFile() || st.size > MAX_FILE_BYTES)
+                continue;
+            const dot = entry.lastIndexOf('.');
+            const ext = dot === -1 ? '' : entry.slice(dot);
+            // .env, .env.local, requirements.txt and friends have no useful extension.
+            if (SCAN_EXTS.has(ext) ||
+                AGENT_FILES.has(entry) ||
+                NAMED_FILES.has(entry) ||
+                entry.startsWith('Dockerfile') ||
+                entry.startsWith('.env') ||
+                entry === 'requirements.txt') {
+                found.push(full);
+            }
+        }
+    }
+    return found.sort();
+}
+export function read(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+export function rel(root, file) {
+    const r = relative(root, file);
+    return r === '' ? '.' : r.split(sep).join('/');
+}
+export function exists(p) {
+    return existsSync(p);
+}
+/** 1-indexed line number for a character offset. */
+export function lineAt(source, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < source.length; i++) {
+        if (source.charCodeAt(i) === 10)
+            line++;
+    }
+    return line;
+}
+export function snippetAt(source, line) {
+    const text = source.split('\n')[line - 1] ?? '';
+    const trimmed = text.trim();
+    return trimmed.length > 160 ? trimmed.slice(0, 157) + '...' : trimmed;
+}
+const SCRIPT_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
+export function isScript(file) {
+    const dot = file.lastIndexOf('.');
+    return dot !== -1 && SCRIPT_EXTS.has(file.slice(dot));
+}
+export function isSql(file) {
+    return file.endsWith('.sql');
+}
+/** Prose and agent-instruction files, where install commands get copy-pasted from. */
+export function isProse(file) {
+    const base = file.slice(file.lastIndexOf('/') + 1);
+    return /\.(md|mdc|mdx|txt)$/.test(base) || AGENT_FILES.has(base);
+}
+/** Language tokens the vendored community rules match on. */
+export function languagesFor(file) {
+    const base = file.slice(file.lastIndexOf('/') + 1);
+    const ext = base.includes('.') ? base.slice(base.lastIndexOf('.')) : '';
+    if (base.startsWith('Dockerfile'))
+        return ['dockerfile'];
+    switch (ext) {
+        case '.ts':
+        case '.tsx':
+        case '.mts':
+        case '.cts':
+            return ['typescript', 'javascript'];
+        case '.js':
+        case '.jsx':
+        case '.mjs':
+        case '.cjs':
+            return ['javascript'];
+        case '.json':
+            return base === 'vercel.json' ? ['json', 'vercel-config'] : ['json'];
+        case '.sql':
+            return ['sql'];
+        case '.yml':
+        case '.yaml':
+            return ['yaml'];
+        case '.py':
+            return ['python'];
+        case '.go':
+            return ['go'];
+        case '.sh':
+        case '.bash':
+            return ['shell'];
+        case '.tf':
+        case '.tfvars':
+            return ['terraform'];
+        case '.rb':
+            return ['ruby'];
+        case '.php':
+            return ['php'];
+        default:
+            return [];
+    }
+}

package/dist/utils/osv.d.ts

@@ -0,0 +1,26 @@
+export interface OsvQuery {
+    name: string;
+    version: string;
+    ecosystem: 'npm' | 'PyPI';
+}
+export interface OsvVulnerability {
+    id: string;
+    summary: string;
+    details?: string;
+    aliases: string[];
+    /** Highest CVSS base score found on the record, when it publishes one. */
+    cvss: number | null;
+    /** Lowest version that is not affected, when the record states one. */
+    fixedIn: string | null;
+}
+/**
+ * Returns, per input query index, the vulnerabilities affecting that exact
+ * version. Failures resolve to an empty list: a database outage must never be
+ * reported as "no vulnerabilities", so the caller is told separately.
+ */
+export declare function queryOsv(queries: OsvQuery[]): Promise<{
+    results: OsvVulnerability[][];
+    failed: boolean;
+}>;
+/** Maps a CVSS base score onto our severity vocabulary. */
+export declare function severityFromCvss(cvss: number | null): 'critical' | 'high' | 'medium' | 'low';

package/dist/utils/osv.js

@@ -0,0 +1,123 @@
+/**
+ * Vulnerability lookups against OSV.dev — Google's Open Source Vulnerabilities
+ * database, the same data source behind osv-scanner (Apache-2.0). This is a
+ * public HTTP API, so nothing is vendored and no licence attaches; ClearToShip
+ * simply queries it.
+ *
+ * Authoritative CVE data replaces hand-maintained version regexes: a rule that
+ * hard-codes "next before 14.1.1" is stale the week after it is written.
+ */
+const OSV_BATCH = 'https://api.osv.dev/v1/querybatch';
+const OSV_QUERY = 'https://api.osv.dev/v1/query';
+const TIMEOUT_MS = 15_000;
+function highestCvss(vuln) {
+    let best = null;
+    for (const s of vuln?.severity ?? []) {
+        // CVSS vectors are published as strings; the numeric score lives in
+        // database_specific or has to be derived. Prefer an explicit score.
+        const score = Number(s?.score);
+        if (Number.isFinite(score))
+            best = best === null ? score : Math.max(best, score);
+    }
+    const explicit = Number(vuln?.database_specific?.cvss?.score);
+    if (Number.isFinite(explicit))
+        best = best === null ? explicit : Math.max(best, explicit);
+    return best;
+}
+function firstFixed(vuln) {
+    for (const affected of vuln?.affected ?? []) {
+        for (const range of affected?.ranges ?? []) {
+            for (const event of range?.events ?? []) {
+                if (event?.fixed)
+                    return String(event.fixed);
+            }
+        }
+    }
+    return null;
+}
+function normalise(vuln) {
+    return {
+        id: String(vuln?.id ?? 'unknown'),
+        summary: String(vuln?.summary ?? vuln?.details ?? 'No summary published.').split('\n')[0],
+        details: typeof vuln?.details === 'string' ? vuln.details : undefined,
+        aliases: Array.isArray(vuln?.aliases) ? vuln.aliases.map(String) : [],
+        cvss: highestCvss(vuln),
+        fixedIn: firstFixed(vuln),
+    };
+}
+/**
+ * Returns, per input query index, the vulnerabilities affecting that exact
+ * version. Failures resolve to an empty list: a database outage must never be
+ * reported as "no vulnerabilities", so the caller is told separately.
+ */
+export async function queryOsv(queries) {
+    if (queries.length === 0)
+        return { results: [], failed: false };
+    const body = {
+        queries: queries.map((q) => ({
+            version: q.version,
+            package: { name: q.name, ecosystem: q.ecosystem },
+        })),
+    };
+    let batch;
+    try {
+        // cleartoship-ignore VG120 — OSV_BATCH is a module constant naming a
+        // fixed https://api.osv.dev endpoint; nothing user-controlled reaches it.
+        const res = await fetch(OSV_BATCH, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return { results: queries.map(() => []), failed: true };
+        batch = await res.json();
+    }
+    catch {
+        return { results: queries.map(() => []), failed: true };
+    }
+    // querybatch returns ids only. Re-query the few packages that actually have
+    // hits to get summaries and fixed versions.
+    const results = queries.map(() => []);
+    const affected = [];
+    (batch?.results ?? []).forEach((r, i) => {
+        if (Array.isArray(r?.vulns) && r.vulns.length > 0)
+            affected.push(i);
+    });
+    await Promise.all(affected.map(async (i) => {
+        const q = queries[i];
+        try {
+            // cleartoship-ignore VG120 — OSV_QUERY is a module constant naming a
+            // fixed https://api.osv.dev endpoint; nothing user-controlled reaches it.
+            const res = await fetch(OSV_QUERY, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    version: q.version,
+                    package: { name: q.name, ecosystem: q.ecosystem },
+                }),
+                signal: AbortSignal.timeout(TIMEOUT_MS),
+            });
+            if (!res.ok)
+                return;
+            const detail = await res.json();
+            results[i] = (detail?.vulns ?? []).map(normalise);
+        }
+        catch {
+            /* keep the empty list for this package */
+        }
+    }));
+    return { results, failed: false };
+}
+/** Maps a CVSS base score onto our severity vocabulary. */
+export function severityFromCvss(cvss) {
+    if (cvss === null)
+        return 'high';
+    if (cvss >= 9)
+        return 'critical';
+    if (cvss >= 7)
+        return 'high';
+    if (cvss >= 4)
+        return 'medium';
+    return 'low';
+}

package/dist/utils/registry.d.ts

@@ -0,0 +1,44 @@
+export interface PackageFacts {
+    name: string;
+    ecosystem: 'npm' | 'pypi';
+    exists: boolean;
+    /** ISO date the package was first published. */
+    created?: string;
+    /** Downloads in the last week (npm only). */
+    weeklyDownloads?: number;
+    versions?: string[];
+    repository?: string;
+    maintainers?: number;
+    deprecated?: boolean;
+    /**
+     * npm removed the package for malware and serves HTTP 451. This is a much
+     * stronger signal than "does not exist" — the name was actively weaponised.
+     */
+    securityHold?: boolean;
+    /**
+     * The package is gone from the registry but still has download traffic,
+     * meaning it was published, then unpublished. The name is free for anyone to
+     * take over and inherit those installs.
+     */
+    unpublished?: boolean;
+    /** Set when the lookup itself failed (offline, rate limited, ...). */
+    error?: string;
+}
+export declare class Registry {
+    private readonly dir;
+    private readonly memo;
+    offline: boolean;
+    networkErrors: number;
+    constructor(cacheDir: string, offline?: boolean);
+    private cachePath;
+    private readCache;
+    private writeCache;
+    private getJson;
+    /** Weekly downloads, or undefined when the endpoint has nothing to say. */
+    private downloadsFor;
+    lookup(name: string, ecosystem: 'npm' | 'pypi'): Promise<PackageFacts>;
+    private lookupNpm;
+    private lookupPypi;
+}
+/** Runs `worker` over `items` with bounded concurrency, preserving order. */
+export declare function pool<T, R>(items: T[], limit: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;

package/dist/utils/registry.js

@@ -0,0 +1,195 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const TIMEOUT_MS = 8000;
+export class Registry {
+    dir;
+    memo = new Map();
+    offline;
+    networkErrors = 0;
+    constructor(cacheDir, offline = false) {
+        this.dir = cacheDir;
+        this.offline = offline;
+        if (!offline) {
+            try {
+                mkdirSync(this.dir, { recursive: true });
+            }
+            catch {
+                /* cache is an optimisation; carry on without it */
+            }
+        }
+    }
+    cachePath(key) {
+        return join(this.dir, createHash('sha256').update(key).digest('hex').slice(0, 40) + '.json');
+    }
+    readCache(key) {
+        try {
+            const raw = readFileSync(this.cachePath(key), 'utf8');
+            const parsed = JSON.parse(raw);
+            if (Date.now() - parsed.at > CACHE_TTL_MS)
+                return null;
+            return parsed.facts;
+        }
+        catch {
+            return null;
+        }
+    }
+    writeCache(key, facts) {
+        if (facts.error)
+            return;
+        try {
+            writeFileSync(this.cachePath(key), JSON.stringify({ at: Date.now(), facts }));
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    async getJson(url, accept) {
+        // cleartoship-ignore VG120 — the URL is built from a package name against a
+        // fixed registry host a few lines below; fetching it is this class's purpose.
+        const res = await fetch(url, {
+            headers: {
+                'user-agent': 'cleartoship (+https://cleartoship.app)',
+                ...(accept ? { accept } : {}),
+            },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return res.status;
+        return await res.json();
+    }
+    /** Weekly downloads, or undefined when the endpoint has nothing to say. */
+    async downloadsFor(encoded) {
+        try {
+            const dl = await this.getJson(`https://api.npmjs.org/downloads/point/last-week/${encoded}`);
+            if (typeof dl === 'object' && dl && typeof dl.downloads === 'number')
+                return dl.downloads;
+        }
+        catch {
+            /* the downloads API is flaky and non-essential */
+        }
+        return undefined;
+    }
+    async lookup(name, ecosystem) {
+        const key = `${ecosystem}:${name}`;
+        const memo = this.memo.get(key);
+        if (memo)
+            return memo;
+        const cached = this.readCache(key);
+        if (cached) {
+            this.memo.set(key, cached);
+            return cached;
+        }
+        if (this.offline) {
+            const facts = { name, ecosystem, exists: true, error: 'offline' };
+            this.memo.set(key, facts);
+            return facts;
+        }
+        let facts;
+        try {
+            facts = ecosystem === 'npm' ? await this.lookupNpm(name) : await this.lookupPypi(name);
+        }
+        catch (err) {
+            this.networkErrors++;
+            facts = {
+                name,
+                ecosystem,
+                exists: true, // fail open: never claim a package is fake because the network blipped
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        this.memo.set(key, facts);
+        this.writeCache(key, facts);
+        return facts;
+    }
+    async lookupNpm(name) {
+        const encoded = name.replace('/', '%2f');
+        const doc = await this.getJson(`https://registry.npmjs.org/${encoded}`, 'application/vnd.npm.install-v1+json');
+        // 451 is npm's "removed for malware" response. Never conflate it with 404.
+        if (doc === 451) {
+            return { name, ecosystem: 'npm', exists: false, securityHold: true };
+        }
+        if (doc === 404) {
+            // A name with no packument but real install traffic was published and then
+            // pulled, which leaves it open to takeover rather than merely invented.
+            const downloads = await this.downloadsFor(encoded);
+            return {
+                name,
+                ecosystem: 'npm',
+                exists: false,
+                weeklyDownloads: downloads,
+                unpublished: downloads !== undefined && downloads > 0,
+            };
+        }
+        if (typeof doc === 'number')
+            throw new Error(`npm registry returned ${doc}`);
+        const versions = Object.keys(doc.versions ?? {});
+        const facts = { name, ecosystem: 'npm', exists: true, versions };
+        const downloads = await this.downloadsFor(encoded);
+        facts.weeklyDownloads = downloads;
+        // The full document carries publish dates and maintainer counts, but it is
+        // large. Only fetch it for packages that are not obviously well established.
+        if (downloads === undefined || downloads < 10_000) {
+            try {
+                const full = await this.getJson(`https://registry.npmjs.org/${encoded}`);
+                if (typeof full === 'object' && full) {
+                    facts.created = full.time?.created;
+                    facts.maintainers = Array.isArray(full.maintainers) ? full.maintainers.length : undefined;
+                    const repo = full.repository;
+                    facts.repository = typeof repo === 'string' ? repo : repo?.url;
+                    const latest = full['dist-tags']?.latest;
+                    facts.deprecated = Boolean(latest && full.versions?.[latest]?.deprecated);
+                }
+            }
+            catch {
+                /* keep the abbreviated facts */
+            }
+        }
+        return facts;
+    }
+    async lookupPypi(name) {
+        const doc = await this.getJson(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`);
+        if (doc === 404)
+            return { name, ecosystem: 'pypi', exists: false };
+        if (doc === 451)
+            return { name, ecosystem: 'pypi', exists: false, securityHold: true };
+        if (typeof doc === 'number')
+            throw new Error(`PyPI returned ${doc}`);
+        const releases = doc.releases ?? {};
+        let earliest;
+        for (const files of Object.values(releases)) {
+            for (const f of files ?? []) {
+                const t = f?.upload_time_iso_8601 ?? f?.upload_time;
+                if (t && (!earliest || t < earliest))
+                    earliest = t;
+            }
+        }
+        return {
+            name,
+            ecosystem: 'pypi',
+            exists: true,
+            created: earliest,
+            versions: Object.keys(releases),
+            repository: doc.info?.project_urls?.Source ??
+                doc.info?.project_urls?.Homepage ??
+                doc.info?.home_page ??
+                undefined,
+        };
+    }
+}
+/** Runs `worker` over `items` with bounded concurrency, preserving order. */
+export async function pool(items, limit, worker) {
+    const results = new Array(items.length);
+    let cursor = 0;
+    const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        for (;;) {
+            const i = cursor++;
+            if (i >= items.length)
+                return;
+            results[i] = await worker(items[i], i);
+        }
+    });
+    await Promise.all(runners);
+    return results;
+}

package/dist/utils/sql.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal PostgreSQL statement splitter. Deliberately not a full parser: it
+ * only needs to know where one statement ends, which means respecting string
+ * literals, dollar-quoted function bodies and both comment styles.
+ */
+export interface SqlStatement {
+    text: string;
+    /** 1-indexed line where the statement starts. */
+    line: number;
+}
+export declare function splitStatements(source: string): SqlStatement[];
+/** Reads a parenthesised group starting at `open` (index of the `(`). */
+export declare function readBalanced(text: string, open: number): string | null;
+/** Grabs the expression after a keyword such as USING or WITH CHECK. */
+export declare function clauseAfter(text: string, keyword: RegExp): string | null;
+/** Normalises `"public"."posts"` / `public.posts` / `posts` to `public.posts`. */
+export declare function normaliseTable(raw: string): string;
+export declare const QUALIFIED_NAME = "(?:\"[^\"]+\"|[A-Za-z_][A-Za-z0-9_$]*)(?:\\s*\\.\\s*(?:\"[^\"]+\"|[A-Za-z_][A-Za-z0-9_$]*))*";
+/** True when a policy predicate lets everything through. */
+export declare function isAlwaysTrue(expr: string | null): boolean;