easyvibegate 0.4.4 → 0.6.2

package/dist/engine/checkers/static/rls-migrations.js

@@ -1,183 +1,590 @@
 import { lineAt } from '../../util/text.js';
-const IDENT = '(?:"[^"]+"|`[^`]+`|[A-Za-z_][A-Za-z0-9_$]*)';
-const QUALIFIED = `(?:(${IDENT})\\s*\\.\\s*)?(${IDENT})`;
-const CREATE_TABLE = new RegExp(`create\\s+table\\s+(if\\s+not\\s+exists\\s+)?${QUALIFIED}`, 'gi');
-const RLS_STMT = new RegExp(`alter\\s+table\\s+(?:only\\s+)?${QUALIFIED}\\s+(enable|disable)\\s+row\\s+level\\s+security`, 'gi');
-const DROP_TABLE = new RegExp(`drop\\s+table\\s+(?:if\\s+exists\\s+)?${QUALIFIED}`, 'gi');
-// SELECT ... INTO <table> also creates a table.
-const SELECT_INTO = new RegExp(`\\bselect\\b[^;]{0,400}?\\binto\\s+${QUALIFIED}`, 'gis');
+import { lexSql } from '../../util/sql-lex.js';
 /** Normalize one SQL identifier: quoted keeps case, unquoted folds to lowercase. */
-function normIdent(raw) {
-    if (raw.startsWith('"') && raw.endsWith('"'))
-        return raw.slice(1, -1);
-    if (raw.startsWith('`') && raw.endsWith('`'))
-        return raw.slice(1, -1);
-    return raw.toLowerCase();
+function normIdent(raw, quoted) {
+    return quoted ? raw : raw.toLowerCase();
 }
-const keyOf = (schema, table) => `${schema ? normIdent(schema) : 'public'}.${normIdent(table)}`;
-const displayOf = (schema, table) => (schema ? `${schema}.${table}` : table);
 /**
- * Blank out comments and string literals (keeping newlines and offsets) so that
- * SQL inside a string — e.g. SELECT 'ALTER TABLE x ENABLE ROW LEVEL SECURITY' —
- * or inside a comment is never mistaken for an executed statement.
- * Handles -- and block comments, '...' with '' escapes (and E'...'), and
- * $$ / $tag$ dollar-quoted strings. Double-quoted identifiers are kept.
+ * A table key is `schema NUL table`. Joining with `.` let `public."a.b"` and
+ * `"public.a".b` collide into one string; NUL can never occur in an identifier.
  */
-export function maskSql(sql) {
-    const out = sql.split('');
-    const n = sql.length;
-    const blank = (from, to) => {
-        for (let k = from; k < to && k < n; k++)
-            if (out[k] !== '\n')
-                out[k] = ' ';
+const SEP = '\u0000';
+/**
+ * Session-private namespace. PostgreSQL looks in pg_temp FIRST for an existing
+ * table, so after `CREATE TEMP TABLE orders` an unqualified `DROP TABLE orders`
+ * removes the temp one and leaves the permanent `public.orders` — and its RLS
+ * state — untouched. Temp tables are modelled for that shadowing only; they are
+ * never reported (PostgREST cannot see them).
+ */
+const TEMP_SCHEMA = 'pg_temp';
+const keyFor = (schema, table) => `${schema}${SEP}${table}`;
+const isTempKey = (key) => key.startsWith(TEMP_SCHEMA + SEP);
+const isWord = (t, w) => !!t && t.type === 'word' && t.value.toUpperCase() === w;
+const isWordIn = (t, ws) => !!t && t.type === 'word' && ws.includes(t.value.toUpperCase());
+const isPunct = (t, p) => !!t && t.type === 'punct' && t.value === p;
+const isName = (t) => !!t && (t.type === 'word' || t.type === 'quotedIdent');
+const isLiteral = (t) => !!t && (t.type === 'string' || t.type === 'dollarString');
+const nameOf = (t) => ({ text: t.value, quoted: t.type === 'quotedIdent' });
+/** Read `[schema .] table` at `i`; returns the names and the index after them. */
+function readQualified(ts, i) {
+    const first = ts[i];
+    if (!isName(first))
+        return null;
+    const dot = ts[i + 1];
+    const second = ts[i + 2];
+    if (dot && dot.type === 'punct' && dot.value === '.' && isName(second)) {
+        return { schema: nameOf(first), table: nameOf(second), next: i + 3 };
+    }
+    return { table: nameOf(first), next: i + 1 };
+}
+/** Skip an optional `IF EXISTS` / `IF NOT EXISTS`; returns [nextIndex, seen]. */
+function skipIfExists(ts, i) {
+    if (!isWord(ts[i], 'IF'))
+        return [i, false];
+    if (isWord(ts[i + 1], 'NOT') && isWord(ts[i + 2], 'EXISTS'))
+        return [i + 3, true];
+    if (isWord(ts[i + 1], 'EXISTS'))
+        return [i + 2, true];
+    return [i, false];
+}
+/**
+ * Token spans inside a DO body whose statements are not known to take effect.
+ * No interpreter is needed to know that a branch may not be taken, a loop may
+ * run zero times, nothing after `RETURN` in the same block runs, and a block
+ * with an `EXCEPTION` section is rolled back entirely if the handler fires.
+ * Constructs nest, so they are matched with a stack. Returns index ranges.
+ */
+function guardedRanges(ts) {
+    const ranges = [];
+    const stack = [];
+    const close = (f, i) => {
+        // A plain BEGIN block is straight-line code; only an EXCEPTION section
+        // turns its whole body (and the handlers) into a maybe.
+        if (f.kind !== 'BEGIN' || f.exception)
+            ranges.push([f.at, i]);
+        if (f.returnAt !== undefined)
+            ranges.push([f.returnAt, i]);
     };
-    let i = 0;
-    while (i < n) {
-        const ch = sql[i];
-        const next = sql[i + 1];
-        if (ch === '-' && next === '-') {
-            let j = i;
-            while (j < n && sql[j] !== '\n')
-                j++;
-            blank(i, j);
-            i = j;
+    for (let i = 0; i < ts.length; i++) {
+        const t = ts[i];
+        if (!t || t.type !== 'word')
+            continue;
+        const W = t.value.toUpperCase();
+        if (W === 'END') {
+            // `END IF` / `END LOOP` / `END CASE` name what they close; a bare END
+            // closes the innermost BEGIN block or CASE expression.
+            const f = stack.pop();
+            if (f)
+                close(f, i);
+            if (isWordIn(ts[i + 1], ['IF', 'LOOP', 'CASE']))
+                i++;
             continue;
         }
-        if (ch === '/' && next === '*') {
-            const close = sql.indexOf('*/', i + 2);
-            const end = close === -1 ? n : close + 2;
-            blank(i, end);
-            i = end;
+        if (W === 'IF') {
+            // `IF EXISTS` / `IF NOT EXISTS` is a DDL clause, not a branch — reading it
+            // as one would leave a guard open to the end of the body.
+            if (isWord(ts[i + 1], 'EXISTS') || (isWord(ts[i + 1], 'NOT') && isWord(ts[i + 2], 'EXISTS')))
+                continue;
+            stack.push({ kind: 'IF', at: i });
             continue;
         }
-        if (ch === "'") {
-            let j = i + 1;
-            while (j < n) {
-                if (sql[j] === "'") {
-                    if (sql[j + 1] === "'") {
-                        j += 2;
-                        continue;
-                    }
+        if (W === 'LOOP' || W === 'CASE' || W === 'BEGIN') {
+            stack.push({ kind: W, at: i });
+            continue;
+        }
+        if (W === 'EXCEPTION' && !isWord(ts[i - 1], 'RAISE')) {
+            // The section belongs to the innermost BEGIN block, not to an IF inside it.
+            for (let d = stack.length - 1; d >= 0; d--) {
+                const f = stack[d];
+                if (f && f.kind === 'BEGIN') {
+                    f.exception = true;
                     break;
                 }
-                j++;
             }
-            const end = Math.min(j + 1, n);
-            blank(i, end);
-            i = end;
             continue;
         }
-        if (ch === '$') {
-            const m = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i, i + 64));
-            if (m) {
-                const tag = m[0];
-                const close = sql.indexOf(tag, i + tag.length);
-                const end = close === -1 ? n : close + tag.length;
-                // `DO $$ ... $$` is executed procedural code: its DDL is real, so keep the
-                // body visible. Other dollar-quoted strings (EXECUTE format(...)) are blanked.
-                const isDoBlock = /\bdo\s*$/i.test(sql.slice(Math.max(0, i - 8), i));
-                if (isDoBlock) {
-                    const bodyStart = i + tag.length;
-                    const bodyEnd = close === -1 ? n : close;
-                    // Mask inside the body too (a string literal there is still a string),
-                    // then jump past the CLOSING delimiter — scanning from just after the
-                    // opening one would read that closing `$$` as a new opening tag and
-                    // blank the entire rest of the file, hiding every later statement.
-                    const inner = maskSql(sql.slice(bodyStart, bodyEnd));
-                    for (let k = 0; k < inner.length; k++)
-                        out[bodyStart + k] = inner[k];
-                    blank(i, bodyStart);
-                    blank(bodyEnd, end);
-                    i = end;
-                    continue;
-                }
-                blank(i, end);
-                i = end;
-                continue;
-            }
+        if (W === 'RETURN') {
+            const f = stack[stack.length - 1];
+            if (f && f.returnAt === undefined)
+                f.returnAt = i;
         }
-        i++;
     }
-    return out.join('');
+    while (stack.length)
+        close(stack.pop(), ts.length);
+    return ranges;
 }
 /**
- * Blank out only comments, preserving length and the `$$` delimiters that
- * `maskSql` removes. Guard analysis needs the delimiters to find DO blocks, but
- * must not read `-- end if` in a comment as a real block terminator.
+ * Flatten a file into tokens, splicing every `DO … ` body in place so its DDL
+ * is analyzed as executed code while the surrounding file keeps its own order.
+ * Returns the tokens plus the guarded index ranges.
  */
-function maskSqlComments(sql) {
-    const out = sql.split('');
-    const n = sql.length;
-    const blank = (from, to) => {
-        for (let k = from; k < to && k < n; k++)
-            if (out[k] !== '\n')
-                out[k] = ' ';
-    };
-    let i = 0;
-    while (i < n) {
-        if (sql[i] === '-' && sql[i + 1] === '-') {
-            let j = i;
-            while (j < n && sql[j] !== '\n')
-                j++;
-            blank(i, j);
-            i = j;
-            continue;
-        }
-        if (sql[i] === '/' && sql[i + 1] === '*') {
-            const c = sql.indexOf('*/', i + 2);
-            const end = c === -1 ? n : c + 2;
-            blank(i, end);
-            i = end;
+function flatten(sql) {
+    const top = lexSql(sql).filter((t) => t.type !== 'comment');
+    const ts = [];
+    const guards = [];
+    /** Token index ranges that came from a DO body — plpgsql, not plain SQL. */
+    const bodies = [];
+    for (let i = 0; i < top.length; i++) {
+        const t = top[i];
+        // A DO body is executed procedural code whether it is dollar-quoted or a
+        // plain `'…'` literal: lex it and inline it. `DO $$…$$`, `DO 'BEGIN … END'`,
+        // `DO LANGUAGE plpgsql $$…$$` — the language clause may come first.
+        const beforeBody = isWord(top[i - 2], 'LANGUAGE') && top[i - 1]?.type === 'word' ? i - 3 : i - 1;
+        if (isLiteral(t) && isWord(top[beforeBody], 'DO')) {
+            // In a plain literal a quote is written doubled; undo that so the body
+            // lexes as the SQL PostgreSQL will actually run.
+            const body = t.type === 'string' ? t.value.replace(/''/g, "'") : t.value;
+            const inner = lexSql(body, t.bodyStart ?? t.start).filter((x) => x.type !== 'comment');
+            const base = ts.length;
+            for (const [a, b] of guardedRanges(inner))
+                guards.push([base + a, base + b]);
+            ts.push(...inner);
+            bodies.push([base, ts.length]);
             continue;
         }
-        i++;
+        ts.push(t);
     }
-    return out.join('');
+    return { ts, guards, bodies };
 }
 /**
- * Spans inside a `DO $$ … $$` body that sit between an `IF … THEN` and its
- * `END IF`. DDL there runs only when the condition holds, and deciding that
- * needs an interpreter — so statements in these spans are reported as
- * "cannot be confirmed" rather than assumed to have run.
- *
- * IFs nest, so this matches them with a stack: taking the first `END IF` as the
- * outer block's terminator ends the guard early and lets a statement after the
- * inner `END IF` look unconditional. `ELSIF` is not an opener (`\bif\b` does not
- * match inside it). Offsets are preserved, so they line up with `maskSql` output.
+ * Text in a dynamic-SQL literal that can change what this checker models: a
+ * table's existence, its RLS state, its name, or how unqualified names resolve.
  */
-function conditionalRanges(sql) {
-    const src = maskSqlComments(sql);
-    const ranges = [];
-    for (const m of src.matchAll(/\bdo\s*(\$[A-Za-z_][A-Za-z0-9_]*\$|\$\$)/gi)) {
-        const tag = m[1];
-        const bodyStart = (m.index ?? 0) + m[0].length;
-        const close = src.indexOf(tag, bodyStart);
-        const bodyEnd = close === -1 ? src.length : close;
-        const body = src.slice(bodyStart, bodyEnd);
-        const open = [];
-        for (const t of body.matchAll(/\bend\s+if\b|\bif\b/gi)) {
-            const at = t.index ?? 0;
-            if (/^end/i.test(t[0])) {
-                const from = open.pop();
-                if (from !== undefined)
-                    ranges.push([bodyStart + from, bodyStart + at]);
+const STATE_TEXT = /row\s+level\s+security|create\s+(?:\w+\s+)*table\b|drop\s+table\b|alter\s+table\b|search_path/i;
+/**
+ * Extract CREATE / ENABLE / DISABLE / DROP / RENAME / SELECT INTO events from
+ * one file, statement by statement. Anything that could change a table's
+ * existence, name or RLS state and is NOT understood is returned in `unparsed`
+ * — it must surface as partial coverage, never vanish into a `continue`.
+ */
+function readStatements(sql) {
+    const { ts, guards, bodies } = flatten(sql);
+    const events = [];
+    const unparsed = [];
+    const guarded = (i) => guards.some(([a, b]) => i >= a && i < b);
+    const inBody = (i) => bodies.some(([a, b]) => i >= a && i < b);
+    // Inside plpgsql, `BEGIN ALTER TABLE …` and `IF x THEN ALTER TABLE …` are one
+    // `;`-terminated run whose real statement starts after the structure word.
+    // Only inside DO bodies: plain SQL uses THEN/ELSE/END in CASE expressions.
+    const PLPGSQL_BOUNDARY = ['BEGIN', 'DECLARE', 'THEN', 'ELSE', 'ELSIF', 'LOOP', 'END'];
+    const isBoundary = (i) => isPunct(ts[i], ';') || (inBody(i) && isWordIn(ts[i], PLPGSQL_BOUNDARY));
+    const mentionsWord = (from, to, w) => {
+        for (let m = from; m < to; m++)
+            if (isWord(ts[m], w))
+                return true;
+        return false;
+    };
+    // --- Name resolution ------------------------------------------------------
+    // An unqualified name resolves to the first schema of search_path: `public`
+    // until a `SET search_path` earlier in this file says otherwise. SET LOCAL
+    // lasts to the end of the transaction. Two `orders` tables in different
+    // schemas used to merge into one state because everything resolved to public.
+    // An EMPTY search_path (`SET search_path = ''`, what `pg_dump` emits) is a
+    // known state too: every name must then be qualified, so an unqualified one
+    // cannot be resolved and is reported rather than guessed.
+    let sessionSchema = 'public';
+    let localSchema = null;
+    const currentSchema = () => localSchema ?? sessionSchema;
+    /** TEMP tables created so far in this file: normalized name → created under a guard. */
+    const tempTables = new Map();
+    const resolve = (q, at, opts = {}) => {
+        const table = normIdent(q.table.text, q.table.quoted);
+        if (q.schema) {
+            const schema = normIdent(q.schema.text, q.schema.quoted);
+            return { key: keyFor(schema, table), schema, table, display: `${q.schema.text}.${q.table.text}`, shadowed: false };
+        }
+        if (opts.temp)
+            return { key: keyFor(TEMP_SCHEMA, table), schema: TEMP_SCHEMA, table, display: q.table.text, shadowed: false };
+        // An existing temp table shadows the permanent one for DROP/ALTER (CREATE
+        // always targets the search_path schema). If the temp CREATE itself was
+        // guarded, which table this statement hits cannot be known.
+        const tempGuarded = tempTables.get(table);
+        if (!opts.forCreate && tempGuarded === false) {
+            return { key: keyFor(TEMP_SCHEMA, table), schema: TEMP_SCHEMA, table, display: q.table.text, shadowed: false };
+        }
+        const schema = currentSchema();
+        if (schema === '')
+            unparsed.push({ offset: at, why: `unqualified table name "${q.table.text}" with an empty search_path cannot be resolved to a schema` });
+        const display = schema === 'public' ? q.table.text : `${schema}.${q.table.text}`;
+        return { key: keyFor(schema, table), schema, table, display, shadowed: tempGuarded === true };
+    };
+    const add = (kind, r, at, idx, extra = {}) => {
+        events.push({
+            kind, key: r.key, ifNotExists: false, display: r.display, offset: at,
+            conditional: guarded(idx) || r.shadowed, ...extra,
+        });
+    };
+    const noteTemp = (r, idx) => { if (isTempKey(r.key))
+        tempTables.set(r.table, guarded(idx)); };
+    // --- Transactions ---------------------------------------------------------
+    // Top-level `BEGIN … ROLLBACK` undoes every statement in between; a
+    // transaction still open at end of file is committed by some runners and
+    // rolled back by others (psql). Either way those statements are "unconfirmed",
+    // not a confident PASS and not a confident critical.
+    let txStart = null; // index into `events`
+    const savepoints = new Map();
+    const undoSince = (i) => { for (let m = i; m < events.length; m++)
+        events[m].conditional = true; };
+    const endTx = () => { txStart = null; savepoints.clear(); localSchema = null; };
+    /**
+     * Adopt a new search_path given as its schema list (`''` entries are what
+     * `SET search_path = ''` leaves: an empty path). `"$user"` depends on the
+     * connecting role and a leading pg_temp would make every unqualified CREATE
+     * a temp table — neither is decidable here, so those become partial.
+     */
+    const setSearchPath = (names, local, at, why) => {
+        const first = names.map((n) => n.trim()).filter((n) => n !== '')[0] ?? '';
+        if (first.startsWith('$') || first === TEMP_SCHEMA) {
+            unparsed.push({ offset: at, why });
+            return;
+        }
+        if (local)
+            localSchema = first;
+        else
+            sessionSchema = first;
+    };
+    /** `SET [LOCAL|SESSION] search_path {TO|=} a [, b …]`. Anything fancier → partial. */
+    const applySearchPath = (from, to) => {
+        const at = ts[from].start;
+        const why = 'SET search_path in a form the analyzer cannot follow; unqualified table names can no longer be resolved';
+        const bail = () => unparsed.push({ offset: at, why });
+        let j = from + 1;
+        const local = isWord(ts[j], 'LOCAL');
+        if (local || isWord(ts[j], 'SESSION'))
+            j++;
+        j++; // search_path
+        if (!(isWord(ts[j], 'TO') || isPunct(ts[j], '=')))
+            return bail();
+        j++;
+        const names = [];
+        if (isWord(ts[j], 'DEFAULT') && j + 1 === to)
+            names.push('public');
+        else {
+            for (;;) {
+                const t = ts[j];
+                if (isName(t))
+                    names.push(normIdent(t.value, t.type === 'quotedIdent'));
+                // `'a, b'` as one literal is a whole list PostgreSQL would split; do not guess it.
+                else if (t && t.type === 'string' && !t.value.includes(','))
+                    names.push(t.value);
+                else
+                    return bail();
+                j++;
+                if (j >= to)
+                    break;
+                if (!isPunct(ts[j], ','))
+                    return bail();
+                j++;
+            }
+        }
+        setSearchPath(names, local, at, why);
+    };
+    /**
+     * `[SELECT] [pg_catalog.]set_config('search_path', '<list>', is_local)` — the
+     * form `pg_dump` emits. A literal list is followed like SET; any other value
+     * expression is unknown → partial.
+     */
+    const applySetConfig = (from, to) => {
+        const at = ts[from].start;
+        const why = 'search_path changed via set_config(); unqualified table names can no longer be resolved';
+        let m = from;
+        while (m < to && !isWord(ts[m], 'SET_CONFIG'))
+            m++;
+        const [open, key, comma, val, comma2, flag, close] = ts.slice(m + 1, m + 8);
+        const literal = isPunct(open, '(') && key?.type === 'string' && isPunct(comma, ',') && val?.type === 'string' && isPunct(comma2, ',')
+            && isWordIn(flag, ['TRUE', 'FALSE']) && isPunct(close, ')');
+        if (!literal || !val)
+            return unparsed.push({ offset: at, why });
+        // Only the list is unquoted and split; a quoted entry inside it is left as
+        // written, the same way `SET search_path TO "App"` keeps case.
+        const names = val.value.split(',').map((n) => n.trim()).map((n) => (n.startsWith('"') && n.endsWith('"') ? n.slice(1, -1) : n.toLowerCase()));
+        setSearchPath(names, isWord(flag, 'TRUE'), at, why);
+    };
+    /** ENABLE|DISABLE ROW LEVEL SECURITY at `m`? Returns the verb or null. */
+    const rlsVerbAt = (m) => {
+        const v = ts[m];
+        if (!v || v.type !== 'word')
+            return null;
+        const V = v.value.toUpperCase();
+        if (V !== 'ENABLE' && V !== 'DISABLE')
+            return null;
+        return isWord(ts[m + 1], 'ROW') && isWord(ts[m + 2], 'LEVEL') && isWord(ts[m + 3], 'SECURITY') ? (V === 'DISABLE' ? 'disable' : 'enable') : null;
+    };
+    const mentionsRls = (from, to) => {
+        for (let m = from; m + 2 < to; m++)
+            if (isWord(ts[m], 'ROW') && isWord(ts[m + 1], 'LEVEL') && isWord(ts[m + 2], 'SECURITY'))
+                return true;
+        return false;
+    };
+    /** `set_config('search_path', …)` anywhere in the statement. */
+    const callsSetConfigSearchPath = (from, to) => {
+        if (!mentionsWord(from, to, 'SET_CONFIG'))
+            return false;
+        for (let m = from; m < to; m++) {
+            const t = ts[m];
+            if (t.type === 'string' && t.value.trim().toLowerCase() === 'search_path')
+                return true;
+        }
+        return false;
+    };
+    const interpret = (from, to) => {
+        const first = ts[from];
+        const w = first.type === 'word' ? first.value.toUpperCase() : '';
+        const body = inBody(from);
+        // From here on unqualified names resolve differently — or, inside a DO
+        // block whose control flow is not followed, unknowably.
+        if (callsSetConfigSearchPath(from, to)) {
+            if (body)
+                return unparsed.push({ offset: first.start, why: 'search_path changed via set_config() inside a DO block; unqualified table names can no longer be resolved' });
+            return applySetConfig(from, to);
+        }
+        if (w === 'SET') {
+            if (!mentionsWord(from, to, 'SEARCH_PATH'))
+                return; // other GUCs do not affect the model
+            if (body)
+                return unparsed.push({ offset: first.start, why: 'SET search_path inside a DO block; unqualified table names can no longer be resolved' });
+            return applySearchPath(from, to);
+        }
+        if (w === 'RESET' && !body) {
+            if (isWordIn(ts[from + 1], ['SEARCH_PATH', 'ALL'])) {
+                sessionSchema = 'public';
+                localSchema = null;
             }
-            else {
-                open.push(at);
+            return;
+        }
+        if (!body) {
+            if (w === 'BEGIN' || (w === 'START' && isWord(ts[from + 1], 'TRANSACTION'))) {
+                if (txStart === null)
+                    txStart = events.length;
+                return;
+            }
+            if (w === 'COMMIT' || w === 'END') {
+                endTx();
+                return;
+            } // top-level END is COMMIT
+            if (w === 'SAVEPOINT' && isName(ts[from + 1])) {
+                const n = ts[from + 1];
+                savepoints.set(normIdent(n.value, n.type === 'quotedIdent'), events.length);
+                return;
+            }
+            if (w === 'ROLLBACK' || w === 'ABORT') {
+                if (isWord(ts[from + 1], 'TO')) {
+                    // ROLLBACK TO [SAVEPOINT] name keeps the transaction open; only the
+                    // work after the savepoint is undone. Unknown savepoint → undo all.
+                    let j = from + 2;
+                    if (isWord(ts[j], 'SAVEPOINT'))
+                        j++;
+                    const n = ts[j];
+                    const at = isName(n) ? savepoints.get(normIdent(n.value, n.type === 'quotedIdent')) : undefined;
+                    undoSince(at ?? txStart ?? events.length);
+                    return;
+                }
+                undoSince(txStart ?? events.length);
+                endTx();
+                return;
+            }
+        }
+        if (w === 'CREATE') {
+            let j = from + 1;
+            let temp = false;
+            while (isWordIn(ts[j], ['UNLOGGED', 'TEMP', 'TEMPORARY', 'GLOBAL', 'LOCAL'])) {
+                if (/^TEMP/i.test(ts[j].value))
+                    temp = true;
+                j++;
+            }
+            if (!isWord(ts[j], 'TABLE'))
+                return dynamic(from, to); // CREATE INDEX/POLICY/… — not a table
+            const [k, ine] = skipIfExists(ts, j + 1);
+            const q = readQualified(ts, k);
+            if (!q)
+                return unparsed.push({ offset: first.start, why: 'CREATE TABLE with a table name the analyzer cannot read' });
+            const r = resolve(q, first.start, { forCreate: true, temp });
+            noteTemp(r, from);
+            add('create', r, first.start, from, { ifNotExists: ine });
+            return;
+        }
+        if (w === 'DROP' && isWord(ts[from + 1], 'TABLE')) {
+            let [k] = skipIfExists(ts, from + 2);
+            // DROP TABLE takes a list: every name in it is gone, not only the first.
+            for (;;) {
+                const q = readQualified(ts, k);
+                if (!q)
+                    return unparsed.push({ offset: first.start, why: 'DROP TABLE with a table name the analyzer cannot read' });
+                const r = resolve(q, first.start);
+                add('drop', r, first.start, from);
+                if (isTempKey(r.key) && !guarded(from))
+                    tempTables.delete(r.table);
+                k = q.next;
+                if (!isPunct(ts[k], ','))
+                    break;
+                k++;
+            }
+            while (isWordIn(ts[k], ['CASCADE', 'RESTRICT']))
+                k++;
+            if (k < to)
+                unparsed.push({ offset: first.start, why: 'DROP TABLE has a trailing clause the analyzer cannot read' });
+            return;
+        }
+        if (w === 'ALTER' && isWord(ts[from + 1], 'TABLE')) {
+            // ALTER TABLE [IF EXISTS] [ONLY] name [*] action [, action ...]
+            let [j] = skipIfExists(ts, from + 2);
+            if (isWord(ts[j], 'ONLY'))
+                j++;
+            const q = readQualified(ts, j);
+            if (!q)
+                return unparsed.push({ offset: first.start, why: 'ALTER TABLE with a table name the analyzer cannot read' });
+            const r = resolve(q, first.start);
+            let k = q.next;
+            if (isPunct(ts[k], '*'))
+                k++;
+            // RENAME TO / SET SCHEMA move the table's identity. The state must follow
+            // it, or a later DISABLE under the new name is never matched to the table.
+            if (isWord(ts[k], 'RENAME') && isWord(ts[k + 1], 'TO')) {
+                const nq = readQualified(ts, k + 2);
+                if (!nq || nq.schema || nq.next !== to)
+                    return unparsed.push({ offset: first.start, why: 'ALTER TABLE RENAME TO with a name the analyzer cannot read' });
+                const table = normIdent(nq.table.text, nq.table.quoted);
+                const toDisplay = r.schema === 'public' || r.schema === TEMP_SCHEMA ? nq.table.text : `${r.schema}.${nq.table.text}`;
+                add('rename', r, first.start, from, { toKey: keyFor(r.schema, table), toDisplay });
+                if (isTempKey(r.key) && !guarded(from)) {
+                    tempTables.delete(r.table);
+                    tempTables.set(table, false);
+                }
+                return;
+            }
+            if (isWord(ts[k], 'SET') && isWord(ts[k + 1], 'SCHEMA')) {
+                const s = ts[k + 2];
+                if (!isName(s) || k + 3 !== to)
+                    return unparsed.push({ offset: first.start, why: 'ALTER TABLE SET SCHEMA with a name the analyzer cannot read' });
+                const schema = normIdent(s.value, s.type === 'quotedIdent');
+                add('rename', r, first.start, from, { toKey: keyFor(schema, r.table), toDisplay: `${s.value}.${q.table.text}` });
+                return;
+            }
+            // Actions are comma-separated; an RLS toggle may be any of them, so scan
+            // the whole statement rather than only the first action.
+            let handled = false;
+            for (let m = k; m < to; m++) {
+                const verb = rlsVerbAt(m);
+                if (verb) {
+                    add(verb, r, first.start, from);
+                    handled = true;
+                    m += 3;
+                    continue;
+                }
+                // FORCE / NO FORCE ROW LEVEL SECURITY change owner bypass, not whether RLS is on.
+                if (isWord(ts[m], 'FORCE') && isWord(ts[m + 1], 'ROW')) {
+                    handled = true;
+                    m += 3;
+                }
+            }
+            if (!handled && mentionsRls(k, to)) {
+                unparsed.push({ offset: first.start, why: 'ALTER TABLE mentions ROW LEVEL SECURITY in a form the analyzer does not understand' });
+            }
+            return;
+        }
+        // A role- or database-level default applies to every LATER session, i.e.
+        // to the migrations that follow this one.
+        if (w === 'ALTER' && isWordIn(ts[from + 1], ['ROLE', 'USER', 'DATABASE']) && mentionsWord(from, to, 'SEARCH_PATH')) {
+            return unparsed.push({ offset: first.start, why: 'ALTER ROLE/DATABASE … SET search_path changes name resolution for later migrations; unqualified table names can no longer be resolved' });
+        }
+        if (w === 'SELECT') {
+            // Top-level `SELECT … INTO <table>` creates a table. Inside plpgsql the
+            // same syntax is ALWAYS a variable assignment (a table is made with
+            // CREATE TABLE AS), so there it must not be read as a table.
+            if (body)
+                return;
+            for (let m = from + 1; m < to; m++) {
+                const u = ts[m];
+                if (isWord(u, 'FROM'))
+                    break;
+                if (isWord(u, 'INTO')) {
+                    let n = m + 1;
+                    let temp = false;
+                    while (isWordIn(ts[n], ['TEMP', 'TEMPORARY', 'UNLOGGED', 'TABLE'])) {
+                        if (/^TEMP/i.test(ts[n].value))
+                            temp = true;
+                        n++;
+                    }
+                    const q = readQualified(ts, n);
+                    if (q) {
+                        const r = resolve(q, first.start, { forCreate: true, temp });
+                        noteTemp(r, from);
+                        add('create', r, first.start, from);
+                    }
+                    break;
+                }
+            }
+            return;
+        }
+        return dynamic(from, to);
+    };
+    /**
+     * Dynamic SQL — `EXECUTE 'ALTER TABLE …'`, `EXECUTE cmd`, `EXECUTE format(…)`
+     * — builds the statement at run time. A single literal can at least be read
+     * and is flagged only when it talks about tables, RLS or search_path. A
+     * variable, a `||` concatenation or a function call is unknown by
+     * construction: whatever it does to table/RLS state cannot be known here, so
+     * it is always missing coverage.
+     */
+    const dynamic = (from, to) => {
+        // Only a leading EXECUTE (or `FOR … IN EXECUTE`) runs SQL; `CREATE TRIGGER
+        // … EXECUTE FUNCTION f()` merely names a function.
+        let ex = -1;
+        for (let m = from; m < to; m++) {
+            if (isWord(ts[m], 'EXECUTE') && (m === from || isWord(ts[m - 1], 'IN')) && !isWordIn(ts[m + 1], ['FUNCTION', 'PROCEDURE'])) {
+                ex = m;
+                break;
+            }
+        }
+        if (ex === -1)
+            return;
+        let end = to;
+        for (let m = ex + 1; m < to; m++)
+            if (isWordIn(ts[m], ['INTO', 'USING'])) {
+                end = m;
+                break;
             }
+        const arg = ts.slice(ex + 1, end);
+        const one = arg[0];
+        if (arg.length === 1 && one && isLiteral(one)) {
+            if (STATE_TEXT.test(one.value))
+                unparsed.push({ offset: one.start, why: 'dynamic SQL (EXECUTE with a string) changes table/RLS state and cannot be interpreted statically' });
+            return;
+        }
+        // Top-level EXECUTE runs a PREPAREd statement, which cannot be DDL.
+        if (!inBody(ex))
+            return;
+        // Joining the literal pieces of `'ALTER TABLE x DISABLE ROW ' || 'LEVEL
+        // SECURITY'` only sharpens the message; the verdict is the same.
+        const pieces = arg.filter(isLiteral).map((t) => t.value).join('');
+        unparsed.push({
+            offset: ts[ex].start,
+            why: STATE_TEXT.test(pieces)
+                ? 'dynamic SQL (EXECUTE with a run-time built string that mentions tables/RLS) cannot be interpreted statically'
+                : 'dynamic SQL (EXECUTE with a variable or expression) has an effect on table/RLS state that cannot be known statically',
+        });
+    };
+    // Split into statements and interpret each one.
+    let s = 0;
+    for (let i = 0; i <= ts.length; i++) {
+        if (i === ts.length || isBoundary(i)) {
+            if (i > s)
+                interpret(s, i);
+            s = i + 1;
         }
-        // An IF left unterminated guards everything to the end of the block.
-        for (const from of open)
-            ranges.push([bodyStart + from, bodyEnd]);
     }
-    return ranges;
+    // Left open at end of file: committed or rolled back depending on the runner.
+    if (txStart !== null)
+        undoSince(txStart);
+    return { events, unparsed };
 }
 /**
  * Flags each table whose latest state after replaying the migrations is
  * "created and RLS not enabled". Migrations are replayed in apply order
- * (files by name, statements by offset); CREATE / ENABLE / DISABLE / DROP are
- * all modeled; CREATE IF NOT EXISTS on an existing table is a no-op; comments
- * and string literals are ignored; quoted and schema-qualified names work.
+ * (files by name, statements by offset); CREATE / ENABLE / DISABLE / DROP /
+ * RENAME are all modeled; CREATE IF NOT EXISTS on an existing table is a
+ * no-op; comments and string literals are ignored; quoted and schema-qualified
+ * names work.
  */
 export const rlsMigrationsChecker = {
     id: 'rls-migrations',
@@ -185,45 +592,139 @@ export const rlsMigrationsChecker = {
     level: 0,
     run(ctx) {
         const sqlFiles = ctx.files.filter((f) => f.ext === '.sql').sort((a, b) => a.rel.localeCompare(b.rel));
-        if (sqlFiles.length === 0)
-            return [];
-        // RLS is a PostgreSQL feature. Do not tell a MySQL/SQLite project to enable it.
-        const allSql = sqlFiles.map((f) => f.content).join('\n');
-        const pkg = ctx.files.find((f) => f.rel === 'package.json')?.content ?? '';
-        const postgresish = ctx.detection.backends.includes('supabase') ||
-            /\b(pg|postgres|postgresql|@supabase\/|drizzle-orm|postgres\.js|node-postgres)\b/i.test(pkg) ||
-            /(enable\s+row\s+level\s+security|gen_random_uuid|\bserial\b|::\s*\w+|\bjsonb\b)/i.test(allSql) ||
-            /\b(psycopg|asyncpg|sqlalchemy\+postgres)\b/i.test(ctx.files.find((f) => f.rel === 'requirements.txt')?.content ?? '');
-        const otherEngine = /(engine\s*=\s*innodb|auto_increment|\bpragma\b|`\w+`\s*varchar)/i.test(allSql) ||
-            /\b(mysql2?|sqlite3|better-sqlite3|mariadb)\b/i.test(pkg);
-        if (otherEngine && !postgresish)
-            return [];
+        if (sqlFiles.length === 0) {
+            // A project that clearly talks to Supabase but ships no .sql migrations
+            // (schema managed from the dashboard, or migrations live in another repo)
+            // used to just say nothing — a silent, undeserved clean score on the exact
+            // check the tool exists for. Say what could not be checked instead.
+            const looksSupabase = ctx.detection.backends.includes('supabase') ||
+                ctx.files.some((f) => !/\.(md|mdx|txt|rst)$/i.test(f.rel) &&
+                    /(SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_|\/rest\/v1\b|postgrest)/i.test(f.content));
+            if (!looksSupabase)
+                return [];
+            return [{
+                    id: 'rls_unverifiable_no_migrations',
+                    severity: 'info',
+                    title: 'No SQL migrations found — RLS could not be checked statically',
+                    detail: 'This project talks to Supabase, but no .sql migration files exist in this repository (the schema may be managed from the dashboard, or migrations live in a different repo). A static scan can only see table/RLS state from files it can read, so no table here could be verified this way — this is missing information, not a clean result.',
+                    fix: 'Run the live probe (consent + --i-own-this) to enumerate which tables the anon key can read, or check pg_class.relrowsecurity and pg_policies directly in the Supabase SQL editor.',
+                    checker: 'rls-migrations',
+                    level: 0,
+                }];
+        }
+        // RLS is a PostgreSQL feature. The engine is decided per FILE, not per
+        // project: a monorepo can hold a Postgres schema next to a Cloudflare D1
+        // (SQLite) one, and a SQLite schema must never be told to enable RLS — that
+        // engine has no such thing. A real D1 project once got five "critical" RLS
+        // findings and a 0/100 because the old gate only knew MySQL's
+        // `auto_increment` (with the underscore) and never heard of D1/wrangler.
+        // A monorepo's dependencies often live in apps/*/package.json, not the
+        // workspace root. Reading only the root file missed a D1/SQLite worker's
+        // `wrangler`/`better-sqlite3` signal whenever the SQL itself carried no
+        // dialect marker either, and defaulted it to Postgres — a phantom critical
+        // on a database that has no RLS to enable.
+        const pkg = ctx.files.filter((f) => f.rel.endsWith('package.json')).map((f) => f.content).join('\n');
+        const reqs = ctx.files.filter((f) => f.rel === 'requirements.txt' || f.rel.endsWith('/requirements.txt')).map((f) => f.content).join('\n');
+        // Checked with .some() against the files themselves, not a pre-joined
+        // string: joining nearly the whole project's non-doc/non-SQL content into
+        // one string on every scan doubled peak memory for the full scanned corpus
+        // to answer what is, per project, a handful of existence checks that can
+        // each stop at the first matching file.
+        const codeFiles = ctx.files.filter((f) => !/\.(md|mdx|txt|rst|sql)$/i.test(f.rel));
+        const matchesAnyCodeFile = (re) => codeFiles.some((f) => re.test(f.content));
+        const pgProject = ctx.detection.backends.includes('supabase') ||
+            /\b(pg|postgres|postgresql|@supabase\/|postgres\.js|node-postgres|pg-promise)\b/i.test(pkg) ||
+            /\b(psycopg|asyncpg|sqlalchemy\+postgres)\b/i.test(reqs);
+        const hasD1 = ctx.files.some((f) => /(^|\/)wrangler\.(toml|jsonc?)$/.test(f.rel) && /d1_databases/.test(f.content));
+        const sqliteProject = hasD1 ||
+            /"(better-sqlite3|sqlite3|@libsql\/client)"/i.test(pkg) ||
+            matchesAnyCodeFile(/from\s+['"](bun:sqlite|drizzle-orm\/(d1|better-sqlite3|libsql))['"]/);
+        const mysqlProject = /"(mysql2?|mariadb)"/i.test(pkg);
+        const sqliteLabel = hasD1 ? 'Cloudflare D1 (SQLite)' : 'SQLite';
+        const PG_MARK = /(row\s+level\s+security|gen_random_uuid|\b(?:big)?serial\b|::\s*\w+|\bjsonb\b|\bplpgsql\b|create\s+policy|uuid_generate)/i;
+        const SQLITE_MARK = /(\bautoincrement\b|integer\s+primary\s+key|\bpragma\b|without\s+rowid)/i;
+        const MYSQL_MARK = /(engine\s*=\s*innodb|\bauto_increment\b|`\w+`\s*varchar)/i;
+        /** The engine a file is written for, or null when it is (or may as well be) PostgreSQL. */
+        const foreignEngine = (sql) => {
+            if (PG_MARK.test(sql))
+                return null;
+            if (SQLITE_MARK.test(sql))
+                return sqliteLabel;
+            if (MYSQL_MARK.test(sql))
+                return 'MySQL';
+            // No dialect marker in the file: fall back to what the project uses. With
+            // no signal either way this is treated as Postgres — the tool's home turf.
+            if (sqliteProject && !pgProject)
+                return sqliteLabel;
+            if (mysqlProject && !pgProject)
+                return 'MySQL';
+            return null;
+        };
+        const skipped = [];
+        const analyzed = sqlFiles.filter((f) => {
+            const engine = foreignEngine(f.content);
+            if (engine)
+                skipped.push({ file: f.rel, engine });
+            return !engine;
+        });
+        // Skipping is visible, not silent: an info finding names the files and says
+        // where access control lives for that engine. Info does not move the gate —
+        // the check does not apply, so the verdict must not become "incomplete".
+        const notApplicable = skipped.length === 0 ? [] : [{
+                id: 'rls_not_applicable',
+                severity: 'info',
+                title: `RLS check skipped for ${skipped.length} ${[...new Set(skipped.map((s) => s.engine))].join('/')} schema file(s) — Row Level Security is PostgreSQL-only`,
+                detail: `${skipped.slice(0, 5).map((s) => s.file).join(', ')}${skipped.length > 5 ? ` (+${skipped.length - 5} more)` : ''}: this engine has no row-level security, so "table without RLS" does not apply here. Access control for this data must live in your server/Worker code.`,
+                fix: 'Nothing to change in the schema. Make sure every query your API/Worker runs checks the caller\'s identity before reading or writing rows — that is where access control lives for this database.',
+                checker: 'rls-migrations',
+                level: 0,
+                file: skipped[0]?.file ?? '',
+                line: 1,
+            }];
+        if (analyzed.length === 0)
+            return notApplicable;
+        // "No RLS" is a hole only when untrusted clients reach the database directly
+        // (Supabase/PostgREST with the anon key, Hasura). A Postgres that only server
+        // code talks to has no RLS by default and is not exposed by that — a critical
+        // there would be noise. With no signal either way the exposed reading wins:
+        // the tool's audience is mostly Supabase, and unknown must not read as safe.
+        const exposed = ctx.detection.backends.includes('supabase') ||
+            /@supabase\//i.test(pkg) ||
+            matchesAnyCodeFile(/(\/rest\/v1\b|postgrest|hasura|SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_)/i);
+        const serverOnly = !exposed &&
+            (/"(pg|postgres|pg-promise|@prisma\/client|drizzle-orm|knex|kysely|typeorm|sequelize)"/i.test(pkg) ||
+                /\b(psycopg2?|asyncpg|sqlalchemy)\b/i.test(reqs));
+        const missingSeverity = exposed || !serverOnly ? 'critical' : 'warning';
         const events = [];
-        sqlFiles.forEach((f, fileIdx) => {
-            const masked = maskSql(f.content);
-            // Computed on the raw text: maskSql blanks the `$$` delimiters themselves,
-            // so the DO blocks are no longer findable there. It preserves length, so
-            // offsets from `masked` line up with these ranges exactly.
-            const guards = conditionalRanges(f.content);
-            const push = (kind, schema, table, offset, ifNotExists = false) => events.push({
-                kind, key: keyOf(schema, table), ifNotExists, file: f.rel, line: lineAt(f.content, offset),
-                display: displayOf(schema, table), fileIdx, offset,
-                conditional: guards.some(([a, b]) => offset >= a && offset < b),
-            });
-            for (const m of masked.matchAll(CREATE_TABLE))
-                push('create', m[2], m[3] ?? '', m.index ?? 0, !!m[1]);
-            for (const m of masked.matchAll(RLS_STMT))
-                push((m[3] ?? '').toLowerCase() === 'disable' ? 'disable' : 'enable', m[1], m[2] ?? '', m.index ?? 0);
-            for (const m of masked.matchAll(DROP_TABLE))
-                push('drop', m[1], m[2] ?? '', m.index ?? 0);
-            for (const m of masked.matchAll(SELECT_INTO))
-                push('create', m[1], m[2] ?? '', m.index ?? 0);
+        const notUnderstood = [];
+        analyzed.forEach((f, fileIdx) => {
+            const { events: evs, unparsed } = readStatements(f.content);
+            for (const e of evs)
+                events.push({ ...e, file: f.rel, fileIdx, line: lineAt(f.content, e.offset) });
+            for (const u of unparsed)
+                notUnderstood.push(`${f.rel}:${lineAt(f.content, u.offset)} — ${u.why}`);
         });
         // True apply order: by migration file, then by statement position in the file.
         events.sort((a, b) => a.fileIdx - b.fileIdx || a.offset - b.offset);
         const state = new Map();
         for (const e of events) {
-            const cur = state.get(e.key) ?? { created: false, enabled: false, file: e.file, line: e.line, display: e.display, stateFile: e.file, guarded: false };
+            const cur = state.get(e.key) ?? { created: false, enabled: false, file: e.file, line: e.line, display: e.display, stateFile: e.file, guarded: false, keys: new Set([e.key]) };
+            if (e.kind === 'rename') {
+                const to = e.toKey;
+                cur.keys.add(to);
+                if (e.conditional) {
+                    // Which name the table ends up under is unknown: keep it under both, both in doubt.
+                    cur.guarded = true;
+                    cur.stateFile = e.file;
+                    state.set(e.key, cur);
+                    if (!state.has(to))
+                        state.set(to, { ...cur, keys: new Set(cur.keys), display: e.toDisplay ?? cur.display });
+                    continue;
+                }
+                state.delete(e.key);
+                state.set(to, { ...cur, display: e.toDisplay ?? cur.display, stateFile: e.file });
+                continue;
+            }
             // Doubt is a property of ANY guarded statement, not just a guarded ENABLE.
             // A conditional DROP used to delete the table from the model outright, so
             // a table left unprotected vanished from the report entirely. A later
@@ -290,35 +791,48 @@ export const rlsMigrationsChecker = {
         const turnsOff = (k) => k === 'disable' || k === 'create';
         const findings = [];
         for (const [key, s] of state) {
-            if (!s.created)
-                continue;
-            const ambiguous = events.some((e) => e.key === key && dirOf(e.file) !== dirOf(s.stateFile) && (s.enabled ? turnsOff(e.kind) : e.kind === 'enable'));
+            if (!s.created || isTempKey(key))
+                continue; // temp tables are session-only: PostgREST never sees them
+            const ambiguous = events.some((e) => s.keys.has(e.key) && dirOf(e.file) !== dirOf(s.stateFile) && (s.enabled ? turnsOff(e.kind) : e.kind === 'enable'));
             if (s.enabled && !ambiguous && !s.guarded)
                 continue; // provably protected
             // `guarded` means a statement we had to GUESS about decided this table's
-            // state — a conditional ENABLE, DISABLE, CREATE or DROP. Calling that
-            // "critical" would be the same false confidence as calling it clean, so it
-            // is reported as unconfirmed. A warning still fails CI (exit 1); it just
-            // does not claim to know what only the database can tell.
+            // state — a conditional ENABLE, DISABLE, CREATE, DROP or RENAME. Calling
+            // that "critical" would be the same false confidence as calling it clean,
+            // so it is reported as unconfirmed. A warning still fails CI (exit 1); it
+            // just does not claim to know what only the database can tell.
             const kind = ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
             findings.push({
                 id: 'rls_missing',
-                severity: kind === 'missing' ? 'critical' : 'warning',
-                title: kind === 'missing' ? `Table "${s.display}" created without RLS`
+                severity: kind === 'missing' ? missingSeverity : 'warning',
+                title: kind === 'missing'
+                    ? (missingSeverity === 'critical'
+                        ? `Table "${s.display}" created without RLS`
+                        : `Table "${s.display}" has no RLS (server-only database)`)
                     : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
                         : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
                 detail: kind === 'missing'
-                    ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. If this table holds user data on Supabase, the anon key can read every row.`
+                    ? (missingSeverity === 'critical'
+                        ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. On Supabase the anon role has full table privileges by default, so with RLS off the public key can READ, INSERT, UPDATE and DELETE every row through the REST API. Static view only: this covers tables created by migrations in this repository — tables created from the dashboard or elsewhere are not listed here; the live probe enumerates all of them.`
+                        : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
                     : kind === 'order'
                         ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
-                        : `"${s.display}" has RLS statements inside an "IF … THEN" guard in a DO block. Whether that branch runs cannot be decided without executing the migration, so its RLS state is NOT confirmed — check the deployed state.`,
-                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). This is a static hint — confirm the deployed state.`,
+                        : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
+                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). Until policies exist, stop the bleeding without breaking reads: REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM anon; This is a static hint — confirm the deployed state.`,
                 checker: 'rls-migrations',
                 level: 0,
                 file: s.file,
                 line: s.line,
             });
         }
-        return findings;
+        const all = [...findings, ...notApplicable];
+        if (notUnderstood.length === 0)
+            return all;
+        // Statements that can change table or RLS state and were not understood are
+        // missing coverage. Returning them as `partial` makes the verdict incomplete
+        // instead of letting an unknown construct read as clean.
+        const shown = notUnderstood.slice(0, 5).join('; ');
+        const more = notUnderstood.length > 5 ? ` (+${notUnderstood.length - 5} more)` : '';
+        return { findings: all, partial: `${notUnderstood.length} SQL statement(s) affecting table/RLS state could not be interpreted: ${shown}${more}` };
     },
 };