run402 4.82.0 → 4.84.0

package/sdk/dist/node/source-scan.js

@@ -0,0 +1,552 @@
+import { collectLocalFileReferences } from "./deploy-manifest.js";
+/**
+ * `run402 doctor` source-scan module (auth-aware-ssr Section 9).
+ *
+ * Walks the project's `src/` directory and reports patterns the
+ * auth-aware-ssr design specifies as deploy-failing OR runtime warnings:
+ *
+ *   - **Hallucinated SDK names.** `getUser`, `getSession`, `currentUser`,
+ *     `getCurrentUser`, `getServerSession`, `auth.protect`, `auth.signIn`,
+ *     `auth.logout`, `auth.middleware`, etc. Each hit emits
+ *     `R402_AUTH_UNKNOWN_EXPORT` with a structured fix-it (attempted name,
+ *     canonical replacement, import line, docs URL).
+ *
+ *   - **State-changing GET handlers.** Astro pages that export a GET
+ *     handler containing DB-mutation patterns (`db().insert`, `db().update`,
+ *     `db().delete`, `adminDb().sql("UPDATE"`, etc.). Emit
+ *     `R402_AUTH_STATE_CHANGING_GET`.
+ *
+ *   - **`auth.*` calls in prerendered pages.** Astro pages declaring
+ *     `export const prerender = true` that also call `auth.*` helpers.
+ *     Emit `R402_AUTH_PRERENDERED`.
+ *
+ *   - **Direct `internal.sessions.authz_version` mutation.** Consumer
+ *     migrations that try to `UPDATE internal.sessions SET authz_version`
+ *     manually. Emit `R402_AUTH_AUTHZ_VERSION_PROHIBITED`.
+ *
+ * The scanner is regex-based — fast, dependency-free, and good enough
+ * for the canonical patterns. The `run402 doctor --json` mode emits the
+ * structured envelope; the default mode prints a readable per-finding
+ * summary. Wired into `run402 deploy` pre-flight as a deploy-failing
+ * gate for the error severities; non-blocking for warning severities.
+ *
+ * @see the auth-aware-ssr OpenSpec change (functions-sdk-auth-model)
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { extname, join, relative } from "node:path";
+/** Severity ladder for scanner findings. `error` blocks deploy; `warn`
+ *  reports but doesn't block. The `run402 doctor` exit code is non-zero
+ *  whenever any `error`-severity finding is present. */
+export const SCAN_SEVERITY = Object.freeze({
+    ERROR: "error",
+    WARN: "warn",
+});
+/** File extensions scanned. Astro frontmatter + TS/JS are the primary
+ *  surface; the regex matchers fire equally on all of them. `.astro`
+ *  matters because consumers write SSR pages there. */
+const SCANNED_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".astro"]);
+/** Directories the scanner refuses to descend into. We never report
+ *  on platform-generated code or vendored dependencies. */
+const SKIPPED_DIRECTORIES = new Set([
+    "node_modules",
+    ".git",
+    ".vscode",
+    ".idea",
+    "dist",
+    "build",
+    "out",
+    ".astro",
+    ".next",
+    ".vercel",
+    ".netlify",
+    "coverage",
+]);
+/** Hallucinated-name registry from the auth-aware-ssr spec. Each entry
+ *  carries the canonical replacement so the fix-it is actionable. The
+ *  list is intentionally exhaustive — every name flagged here came up
+ *  in pre-launch LLM hallucination samples. */
+const HALLUCINATED_NAMES = [
+    // ESM named imports — caught by regex on import lines AND by call-site
+    // matching when consumers paste from training-data examples.
+    { name: "getUser", canonical: "auth.user() / auth.requireUser()", origin: "supabase / clerk / nextauth legacy" },
+    { name: "getUserId", canonical: "(await auth.user())?.id", origin: "run402 v0.x" },
+    { name: "getRole", canonical: "auth.requireRole(role)", origin: "run402 v0.x" },
+    { name: "getSession", canonical: "auth.user()", origin: "next-auth / nextauth" },
+    { name: "currentUser", canonical: "auth.user()", origin: "clerk" },
+    { name: "currentSession", canonical: "auth.user()", origin: "clerk" },
+    { name: "getCurrentUser", canonical: "auth.user()", origin: "generic" },
+    { name: "getCurrentSession", canonical: "auth.user()", origin: "generic" },
+    { name: "getServerSession", canonical: "auth.user()", origin: "next-auth" },
+    { name: "getAuth", canonical: "auth.user() / auth.requireUser()", origin: "clerk" },
+    { name: "requireAuth", canonical: "auth.requireUser()", origin: "generic" },
+    { name: "withAuth", canonical: "auth.requireUser() inside the handler", origin: "next-auth-style HOC" },
+    { name: "protectRoute", canonical: "auth.requireUser() inside the handler", origin: "generic" },
+    { name: "useUser", canonical: "auth.user() (note: server-only; not a React hook)", origin: "clerk / supabase" },
+    { name: "useSession", canonical: "auth.user() (note: server-only)", origin: "next-auth / clerk" },
+    { name: "createServerClient", canonical: "db() (use the bundled SDK; no client setup needed)", origin: "supabase" },
+    { name: "clerkClient", canonical: "auth.user() + db()", origin: "clerk" },
+];
+/** Property-access hallucinations on the `auth` object. The SDK's
+ *  Proxy catches these at runtime, but the source scanner fires
+ *  earlier so the deploy fails before the bundle ships. */
+const HALLUCINATED_AUTH_PROPERTIES = [
+    { name: "auth.session", canonical: "auth.user() then read .sessionId" },
+    { name: "auth.getSession", canonical: "auth.user()" },
+    { name: "auth.currentUser", canonical: "auth.user()" },
+    { name: "auth.currentSession", canonical: "auth.user()" },
+    { name: "auth.requireAuth", canonical: "auth.requireUser()" },
+    { name: "auth.middleware", canonical: "auth.csrfField() / @run402/astro middleware" },
+    { name: "auth.signIn", canonical: "POST /auth/sign-in or auth.sessions.createResponseFromIdentity({...})" },
+    { name: "auth.signOut", canonical: "auth.sessions.endResponse()" },
+    { name: "auth.signout", canonical: "auth.sessions.endResponse()" },
+    { name: "auth.logout", canonical: "auth.sessions.endResponse()" },
+    { name: "auth.login", canonical: "auth.sessions.createResponseFromIdentity({...})" },
+    { name: "auth.redirectToSignIn", canonical: "auth.requireUser() — platform handles redirect" },
+    { name: "auth.getUser", canonical: "auth.user()" },
+    { name: "auth.getToken", canonical: "auth.requireUser() then read .sessionId (tokens not exposed)" },
+    { name: "auth.protect", canonical: "auth.requireUser() / auth.requireRole(...)" },
+];
+/** Browser-only patterns that should NEVER appear in SSR / Lambda code.
+ *  These are caught at scan time because the SDK doesn't ship a
+ *  shim — the line just fails to execute. */
+const BROWSER_ONLY_PATTERNS = [
+    {
+        pattern: /localStorage\.getItem\(\s*['"]wl_session['"]\s*\)/g,
+        name: "localStorage.wl_session",
+        canonical: "auth.user() (browser sessions are HttpOnly cookies; no localStorage)",
+    },
+    {
+        // Matches: `Authorization: "Bearer ..."` (bare key + string value)
+        //          `"Authorization": "Bearer ..."` (string key + string value)
+        //          `'Authorization': 'Bearer ...'` (single quotes)
+        pattern: /['"]?Authorization['"]?\s*[:,]\s*['"]Bearer\s/g,
+        name: "Authorization: Bearer (in browser code)",
+        canonical: "Browser code doesn't carry JWTs. Use auth.fetch() for same-origin SSR fetches.",
+        severity: SCAN_SEVERITY.WARN, // Bearer is fine in server-side machine code; gated by file path.
+    },
+];
+/** Scan a single file's content. Returns the array of findings (zero
+ *  or more). Pure / no I/O — tests pass strings directly. */
+export function scanFileContent(content, opts = {}) {
+    const filePath = opts.filePath ?? "<inline>";
+    const findings = [];
+    // 1) Hallucinated bare names — import { getSession } from ... OR
+    //    bare call sites `await getSession(...)`.
+    for (const entry of HALLUCINATED_NAMES) {
+        // Match in an `import { … }` statement OR a bare function-call site.
+        // Negative-lookahead: don't fire on `auth.getSession` etc. (caught
+        // separately by the auth-property scanner below).
+        const importRegex = new RegExp(`import\\s*\\{[^}]*\\b${escapeRegex(entry.name)}\\b[^}]*\\}\\s*from\\s*['"]@run402/functions['"]`, "g");
+        const callRegex = new RegExp(`(?<![.\\w])${escapeRegex(entry.name)}\\s*\\(`, "g");
+        let match;
+        while ((match = importRegex.exec(content)) !== null) {
+            findings.push({
+                code: "R402_AUTH_UNKNOWN_EXPORT",
+                severity: SCAN_SEVERITY.ERROR,
+                file: filePath,
+                line: lineNumberFor(content, match.index),
+                attempted_name: entry.name,
+                canonical_name: entry.canonical,
+                import_line: 'import { auth } from "@run402/functions"',
+                docs: "https://docs.run402.com/auth/sdk",
+                message: `Import '${entry.name}' from @run402/functions is not a working export (origin: ${entry.origin}). Use ${entry.canonical}.`,
+            });
+        }
+        while ((match = callRegex.exec(content)) !== null) {
+            findings.push({
+                code: "R402_AUTH_UNKNOWN_EXPORT",
+                severity: SCAN_SEVERITY.ERROR,
+                file: filePath,
+                line: lineNumberFor(content, match.index),
+                attempted_name: entry.name,
+                canonical_name: entry.canonical,
+                import_line: 'import { auth } from "@run402/functions"',
+                docs: "https://docs.run402.com/auth/sdk",
+                message: `Call to '${entry.name}()' will throw R402_AUTH_UNKNOWN_EXPORT at runtime. Use ${entry.canonical}.`,
+            });
+        }
+    }
+    // 2) Hallucinated property access on `auth.*`. The SDK Proxy catches
+    //    these at runtime; we catch earlier at deploy.
+    for (const entry of HALLUCINATED_AUTH_PROPERTIES) {
+        const regex = new RegExp(`(?<![\\w.])${escapeRegex(entry.name)}\\b`, "g");
+        let match;
+        while ((match = regex.exec(content)) !== null) {
+            findings.push({
+                code: "R402_AUTH_UNKNOWN_EXPORT",
+                severity: SCAN_SEVERITY.ERROR,
+                file: filePath,
+                line: lineNumberFor(content, match.index),
+                attempted_name: entry.name,
+                canonical_name: entry.canonical,
+                import_line: 'import { auth } from "@run402/functions"',
+                docs: "https://docs.run402.com/auth/sdk",
+                message: `'${entry.name}' is not a valid auth.* helper. Use ${entry.canonical}.`,
+            });
+        }
+    }
+    // 3) Browser-only / wrong-environment patterns.
+    for (const entry of BROWSER_ONLY_PATTERNS) {
+        let match;
+        while ((match = entry.pattern.exec(content)) !== null) {
+            findings.push({
+                code: "R402_AUTH_UNKNOWN_EXPORT",
+                severity: entry.severity ?? SCAN_SEVERITY.ERROR,
+                file: filePath,
+                line: lineNumberFor(content, match.index),
+                attempted_name: entry.name,
+                canonical_name: entry.canonical,
+                message: `'${entry.name}' is not supported. ${entry.canonical}.`,
+            });
+        }
+    }
+    // 4) Prerendered pages calling auth.*. The Astro adapter throws
+    //    R402_AUTH_PRERENDERED at build time; this catches earlier.
+    if (filePath.endsWith(".astro") || filePath.endsWith(".ts") || filePath.endsWith(".tsx")) {
+        const declaresPrerender = /export\s+const\s+prerender\s*=\s*true/.test(content);
+        if (declaresPrerender) {
+            const authCallRegex = /\bauth\.(user|requireUser|requireRole|requireMembership|requireFresh|fetch|csrfToken|csrfField|sessions|identities)\b/g;
+            let match;
+            while ((match = authCallRegex.exec(content)) !== null) {
+                findings.push({
+                    code: "R402_AUTH_PRERENDERED",
+                    severity: SCAN_SEVERITY.ERROR,
+                    file: filePath,
+                    line: lineNumberFor(content, match.index),
+                    message: `auth.${match[1]} called from a prerendered page. Convert to SSR (\`export const prerender = false\`) or use a server island.`,
+                    docs: "https://docs.run402.com/auth/rendering-modes",
+                });
+            }
+        }
+    }
+    // 5) State-changing GET handlers. Heuristic: an Astro `export const GET`
+    //    or a `GET` Web-handler containing db-mutation patterns.
+    const getHandlerRegex = /export\s+(?:async\s+)?(?:const\s+|function\s+)GET\s*[=(]/g;
+    const mutationInGetRegex = /\b(?:db|adminDb)\s*\(\s*\)?[^)]*\)?\s*\.(?:insert|update|delete)\s*\(/g;
+    const sqlMutationRegex = /\.sql\s*\(\s*['"`]\s*(?:UPDATE|INSERT|DELETE)\b/gi;
+    if (getHandlerRegex.test(content)) {
+        let match;
+        while ((match = mutationInGetRegex.exec(content)) !== null) {
+            findings.push({
+                code: "R402_AUTH_STATE_CHANGING_GET",
+                severity: SCAN_SEVERITY.ERROR,
+                file: filePath,
+                line: lineNumberFor(content, match.index),
+                message: "GET handler mutates state. Move the mutation to POST.",
+                docs: "https://docs.run402.com/auth/hosted-ui#post-only",
+            });
+        }
+        while ((match = sqlMutationRegex.exec(content)) !== null) {
+            findings.push({
+                code: "R402_AUTH_STATE_CHANGING_GET",
+                severity: SCAN_SEVERITY.ERROR,
+                file: filePath,
+                line: lineNumberFor(content, match.index),
+                message: "GET handler runs UPDATE/INSERT/DELETE SQL. Move the mutation to POST.",
+                docs: "https://docs.run402.com/auth/hosted-ui#post-only",
+            });
+        }
+    }
+    // 6) Direct mutation of internal.sessions.authz_version in consumer
+    //    migrations or SQL strings. The platform is the sole writer.
+    const authzVersionRegex = /UPDATE\s+internal\.sessions\s+SET\s+authz_version\b/gi;
+    let m;
+    while ((m = authzVersionRegex.exec(content)) !== null) {
+        findings.push({
+            code: "R402_AUTH_AUTHZ_VERSION_PROHIBITED",
+            severity: SCAN_SEVERITY.ERROR,
+            file: filePath,
+            line: lineNumberFor(content, m.index),
+            message: "Consumer code may not mutate internal.sessions.authz_version directly. Register your grants table in the authz manifest so the platform installs the bump trigger.",
+            docs: "https://docs.run402.com/auth/db-actor-context#authz-version",
+        });
+    }
+    // 7) Redundant `.eq("user_id", user.id)` against RLS-bound tables.
+    //    db() propagates the actor via the run402.actor.* settings — PostgREST
+    //    enforces ownership in RLS. Filtering on user_id again is at best a
+    //    no-op and at worst a code smell that suggests the developer doesn't
+    //    trust RLS. Catch the most common shapes:
+    //
+    //      .eq("user_id", user.id)
+    //      .eq('user_id', actor.id)
+    //      .eq("user_id", await auth.user()).id   (rare; covered by the suffix)
+    //
+    //    Opt-out via inline annotation comment on the preceding or same line:
+    //      // run402-allow-user-filter: <reason>
+    //      .eq("user_id", joinedRowOwner)
+    //
+    //    Pattern is intentionally narrow (`user_id` literal column name + a
+    //    value expression matching `<ident>.id`) to keep the false-positive
+    //    rate low. Heuristic — RLS-binding is unknown at scan time; the rule
+    //    fires on the shape, and the operator either annotates or fixes.
+    const redundantFilterRegex = /\.eq\s*\(\s*['"]user_id['"]\s*,\s*([a-zA-Z_$][\w$]*)\.id\s*\)/g;
+    const lines = content.split(/\r?\n/);
+    const cumulativeOffsets = (() => {
+        const offsets = [0];
+        for (let i = 0; i < lines.length; i++) {
+            // +1 for the trailing newline we split on
+            offsets.push(offsets[i] + lines[i].length + 1);
+        }
+        return offsets;
+    })();
+    function lineIndexFor(charIndex) {
+        // Binary search would be faster; lines are typically <2k.
+        for (let i = 0; i < cumulativeOffsets.length - 1; i++) {
+            if (charIndex < cumulativeOffsets[i + 1])
+                return i;
+        }
+        return cumulativeOffsets.length - 2;
+    }
+    let f;
+    while ((f = redundantFilterRegex.exec(content)) !== null) {
+        const lineIdx = lineIndexFor(f.index);
+        const thisLine = lines[lineIdx] ?? "";
+        const prevLine = lineIdx > 0 ? (lines[lineIdx - 1] ?? "") : "";
+        const annotated = /\/\/\s*run402-allow-user-filter/i.test(thisLine) ||
+            /\/\/\s*run402-allow-user-filter/i.test(prevLine);
+        if (annotated)
+            continue;
+        findings.push({
+            code: "R402_AUTH_REDUNDANT_USER_FILTER",
+            severity: SCAN_SEVERITY.WARN,
+            file: filePath,
+            line: lineIdx + 1,
+            message: `Redundant '.eq(\"user_id\", ${f[1]}.id)'. db() propagates the actor — PostgREST RLS enforces ownership server-side. ` +
+                `If this is intentional (e.g., the table's RLS scopes on something else and you want to filter additionally), ` +
+                `silence with: // run402-allow-user-filter: <reason>`,
+            docs: "https://run402.com/errors/#R402_AUTH_REDUNDANT_USER_FILTER",
+        });
+    }
+    // 8) Tenant-assertion session-mint call without the declared capability.
+    //    `auth.sessions.createResponseFromTenantAssertion(...)` mints a browser
+    //    session from a tenant's vouching. It works ONLY in a function whose
+    //    deploy/apply spec declares `capabilities: ["auth.sessionMint"]`
+    //    (FunctionSpec.capabilities — sibling to `config`, since the platform
+    //    has no code-export metadata channel). Service-key presence is NOT
+    //    sufficient. Without the capability the gateway returns
+    //    R402_AUTH_UNTRUSTED_CONTEXT at runtime and mints no session.
+    //
+    //    The pure file scanner can't see the per-function spec, so the caller
+    //    threads `opts.declaredCapabilities` (the union of capabilities declared
+    //    across run402.config.json function entries — see readDeclaredCapabilities).
+    //    We suppress the finding when "auth.sessionMint" is present anywhere in
+    //    that union. Global-union (not per-file) is a deliberate precision
+    //    trade-off: the file→function-entry mapping isn't reliable from source,
+    //    and the runtime gate catches the rare "function A declared it, function
+    //    B forgot" case. WARN severity (never block deploy): an inline/SDK spec
+    //    the doctor can't read might declare the capability.
+    const declaredCaps = opts.declaredCapabilities instanceof Set
+        ? opts.declaredCapabilities
+        : new Set(Array.isArray(opts.declaredCapabilities) ? opts.declaredCapabilities : []);
+    if (!declaredCaps.has("auth.sessionMint")) {
+        const mintCallRegex = /\bcreateResponseFromTenantAssertion\s*\(/g;
+        let mintMatch;
+        while ((mintMatch = mintCallRegex.exec(content)) !== null) {
+            findings.push({
+                code: "R402_DOCTOR_AUTH_SESSION_MINT_CAPABILITY_MISSING",
+                severity: SCAN_SEVERITY.WARN,
+                file: filePath,
+                line: lineNumberFor(content, mintMatch.index),
+                message: "createResponseFromTenantAssertion (tenant-assertion session mint) requires the " +
+                    '"auth.sessionMint" capability, which no function declares in run402.config.json. ' +
+                    "Without it the gateway returns R402_AUTH_UNTRUSTED_CONTEXT at runtime and mints no session.",
+                fix: 'Add "capabilities": ["auth.sessionMint"] to this function\'s entry in run402.config.json ' +
+                    '(under functions.replace.<name>, a sibling to "config"). A service key is NOT sufficient.',
+                docs: "https://docs.run402.com/auth/tenant-assertion#capability",
+            });
+        }
+    }
+    return findings;
+}
+/** Recursively walk `srcDir` and scan every file with a relevant
+ *  extension. Returns the combined findings list, sorted by file +
+ *  line for stable output. */
+export function scanSourceTree(srcDir, opts = {}) {
+    const findings = [];
+    // Capability picture for the tenant-assertion mint check (#8). Read from
+    // run402.config.json unless the caller passed it explicitly (tests do).
+    const declaredCapabilities = opts.declaredCapabilities ?? readDeclaredCapabilities(opts.cwd ?? srcDir);
+    walk(srcDir, (filePath) => {
+        if (!SCANNED_EXTENSIONS.has(extname(filePath)) || opts.excludeFiles?.has(filePath))
+            return;
+        let content;
+        try {
+            content = readFileSync(filePath, "utf8");
+        }
+        catch (err) {
+            findings.push({
+                code: "R402_AUTH_SOURCE_SCAN_ERROR",
+                severity: SCAN_SEVERITY.WARN,
+                file: relative(opts.cwd ?? srcDir, filePath),
+                message: `failed to read file: ${err instanceof Error ? err.message : String(err)}`,
+            });
+            return;
+        }
+        findings.push(...scanFileContent(content, {
+            filePath: relative(opts.cwd ?? srcDir, filePath),
+            declaredCapabilities,
+        }));
+    });
+    findings.sort((a, b) => {
+        if (a.file !== b.file)
+            return a.file < b.file ? -1 : 1;
+        return (a.line ?? 0) - (b.line ?? 0);
+    });
+    return findings;
+}
+/** Scan an explicit list of on-disk file paths — no directory walk.
+ *  Used by `run402 deploy apply` for manifest/spec/stdin deploys, where
+ *  the artifact is exactly the set of files the manifest references, NOT
+ *  whatever happens to live under cwd/src. Files without a
+ *  scannable extension are ignored; unreadable files become a WARN
+ *  finding (never throw). Returns the combined findings list, sorted by
+ *  file + line for stable output, exactly like `scanSourceTree`. */
+export function scanSourceFiles(filePaths, opts = {}) {
+    const findings = [];
+    const cwd = opts.cwd ?? process.cwd();
+    // Same capability picture as scanSourceTree (#8 mint check).
+    const declaredCapabilities = opts.declaredCapabilities ?? readDeclaredCapabilities(cwd);
+    for (const filePath of filePaths) {
+        if (!SCANNED_EXTENSIONS.has(extname(filePath)))
+            continue;
+        let content;
+        try {
+            content = readFileSync(filePath, "utf8");
+        }
+        catch (err) {
+            findings.push({
+                code: "R402_AUTH_SOURCE_SCAN_ERROR",
+                severity: SCAN_SEVERITY.WARN,
+                file: relative(cwd, filePath),
+                message: `failed to read file: ${err instanceof Error ? err.message : String(err)}`,
+            });
+            continue;
+        }
+        findings.push(...scanFileContent(content, {
+            filePath: relative(cwd, filePath),
+            declaredCapabilities,
+        }));
+    }
+    findings.sort((a, b) => {
+        if (a.file !== b.file)
+            return a.file < b.file ? -1 : 1;
+        return (a.line ?? 0) - (b.line ?? 0);
+    });
+    return findings;
+}
+function walk(dir, visitor) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (SKIPPED_DIRECTORIES.has(entry.name))
+                continue;
+            const child = join(dir, entry.name);
+            if (existsSync(join(child, ".git")) || ["run402.json", "run402.deploy.json", "app.json"].some((name) => existsSync(join(child, name))))
+                continue;
+            walk(child, visitor);
+        }
+        else if (entry.isFile()) {
+            visitor(join(dir, entry.name));
+        }
+    }
+}
+function lineNumberFor(content, index) {
+    let line = 1;
+    for (let i = 0; i < index; i++) {
+        if (content.charCodeAt(i) === 10)
+            line++;
+    }
+    return line;
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Convenience for tests: synchronous, no FS access. */
+export function _testOnly_hallucinatedNames() {
+    return HALLUCINATED_NAMES.slice();
+}
+export function _testOnly_authProperties() {
+    return HALLUCINATED_AUTH_PROPERTIES.slice();
+}
+/** Read the union of `capabilities` declared across all function entries in
+ *  `run402.config.json` (the apply spec). Used by the tenant-assertion mint
+ *  check (#8) to suppress the warning when "auth.sessionMint" is declared.
+ *
+ *  Functions live under `functions.replace.<name>` / `functions.set.<name>`
+ *  with `capabilities?: string[]` as a sibling to `config`. Best-effort:
+ *  a missing or malformed config returns an empty set (the scanner then
+ *  warns, which is the safe default — the runtime gate is the hard
+ *  enforcement). Returns a `Set<string>`. */
+export function readDeclaredCapabilities(cwd = process.cwd()) {
+    const caps = new Set();
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(cwd, "run402.config.json"), "utf8"));
+    }
+    catch {
+        return caps; // no config / unreadable / malformed → nothing declared
+    }
+    const fns = parsed?.functions;
+    if (!fns || typeof fns !== "object")
+        return caps;
+    for (const bucket of ["replace", "set", "patch"]) {
+        const entries = fns[bucket];
+        if (!entries || typeof entries !== "object")
+            continue;
+        for (const entry of Object.values(entries)) {
+            const declared = entry?.capabilities;
+            if (Array.isArray(declared)) {
+                for (const cap of declared)
+                    if (typeof cap === "string")
+                        caps.add(cap);
+            }
+        }
+    }
+    return caps;
+}
+/** Resolve the project's src/ directory. Astro convention is `<root>/src`;
+ *  bare Node projects use `<root>/src` or `<root>`. We prefer `src/` if
+ *  it exists. */
+export function resolveScanRoot(cwd = process.cwd()) {
+    const srcDir = join(cwd, "src");
+    try {
+        if (statSync(srcDir).isDirectory())
+            return srcDir;
+    }
+    catch {
+        // Fall through.
+    }
+    return cwd;
+}
+/** The same selected-app scope gates up/apply and is reported by doctor. */
+export function scanDeploymentSources(spec, appRoot, sourceRoot) {
+    const scanRoot = sourceRoot ?? resolveScanRoot(appRoot);
+    const generated = new Set();
+    for (const bucket of [spec.functions?.replace, spec.functions?.patch?.set]) {
+        for (const fn of Object.values(bucket ?? {})) {
+            if (fn.capabilities?.includes("astro.ssr.v1") && fn.source && typeof fn.source === "object" && "path" in fn.source)
+                generated.add(fn.source.path);
+        }
+    }
+    const references = collectLocalFileReferences(spec).filter((ref) => ref.expects === "file" && !generated.has(ref.path));
+    // Generated SSR bundles must not be re-scanned as consumer source. Their
+    // original source remains in the selected application's source tree.
+    const files = new Set();
+    if (sourceRoot || scanRoot !== appRoot)
+        walk(scanRoot, (path) => {
+            if (SCANNED_EXTENSIONS.has(extname(path)) && !generated.has(path))
+                files.add(path);
+        });
+    for (const reference of references)
+        if (SCANNED_EXTENSIONS.has(extname(reference.path)))
+            files.add(reference.path);
+    const findings = scanSourceFiles([...files], { cwd: appRoot });
+    return { app_root: appRoot, scan_root: scanRoot, checked_files: files.size, explicit_references: references.length, findings, errors: findings.filter((finding) => finding.severity === SCAN_SEVERITY.ERROR) };
+}
+//# sourceMappingURL=source-scan.js.map

package/sdk/dist/node/source-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-scan.js","sourceRoot":"","sources":["../../src/node/source-scan.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEpD;;wDAEwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACb,CAAC,CAAC;AAEH;;uDAEuD;AACvD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7F;2DAC2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,OAAO;IACP,SAAS;IACT,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH;;;+CAG+C;AAC/C,MAAM,kBAAkB,GAAG;IACzB,uEAAuE;IACvE,6DAA6D;IAC7D,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,kCAAkC,EAAE,MAAM,EAAE,oCAAoC,EAAE;IAChH,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,EAAE,aAAa,EAAE;IAClF,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,EAAE,aAAa,EAAE;IAC/E,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAChF,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE;IAClE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE;IACrE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE;IACvE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE;IAC1E,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE;IAC3E,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,kCAAkC,EAAE,MAAM,EAAE,OAAO,EAAE;IACnF,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE;IAC3E,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,uCAAuC,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACvG,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,uCAAuC,EAAE,MAAM,EAAE,SAAS,EAAE;IAC/F,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,mDAAmD,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC/G,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,iCAAiC,EAAE,MAAM,EAAE,mBAAmB,EAAE;IACjG,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,oDAAoD,EAAE,MAAM,EAAE,UAAU,EAAE;IACnH,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE;CAC1E,CAAC;AAEF;;2DAE2D;AAC3D,MAAM,4BAA4B,GAAG;IACnC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,kCAAkC,EAAE;IACvE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE;IACrD,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,aAAa,EAAE;IACtD,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,aAAa,EAAE;IACzD,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,oBAAoB,EAAE;IAC7D,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,6CAA6C,EAAE;IACrF,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,uEAAuE,EAAE;IAC3G,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,6BAA6B,EAAE;IAClE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,6BAA6B,EAAE;IAClE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,6BAA6B,EAAE;IACjE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,iDAAiD,EAAE;IACpF,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,gDAAgD,EAAE;IAC9F,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE;IAClD,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,8DAA8D,EAAE;IACpG,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,4CAA4C,EAAE;CAClF,CAAC;AAEF;;6CAE6C;AAC7C,MAAM,qBAAqB,GAAG;IAC5B;QACE,OAAO,EAAE,oDAAoD;QAC7D,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,mEAAmE;QACnE,uEAAuE;QACvE,2DAA2D;QAC3D,OAAO,EAAE,gDAAgD;QACzD,IAAI,EAAE,yCAAyC;QAC/C,SAAS,EAAE,gFAAgF;QAC3F,QAAQ,EAAE,aAAa,CAAC,IAAI,EAAE,kEAAkE;KACjG;CACF,CAAC;AAEF;6DAC6D;AAC7D,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAAoB,EAAE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC;IAC7C,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,iEAAiE;IACjE,8CAA8C;IAC9C,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;QACvC,qEAAqE;QACrE,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,wBAAwB,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,EACjG,GAAG,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,cAAc,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAC9C,GAAG,CACJ,CAAC;QACF,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,aAAa,CAAC,KAAK;gBAC7B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,cAAc,EAAE,KAAK,CAAC,IAAI;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,WAAW,EAAE,0CAA0C;gBACvD,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,WAAW,KAAK,CAAC,IAAI,6DAA6D,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,SAAS,GAAG;aACpI,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,aAAa,CAAC,KAAK;gBAC7B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,cAAc,EAAE,KAAK,CAAC,IAAI;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,WAAW,EAAE,0CAA0C;gBACvD,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,YAAY,KAAK,CAAC,IAAI,2DAA2D,KAAK,CAAC,SAAS,GAAG;aAC7G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mDAAmD;IACnD,KAAK,MAAM,KAAK,IAAI,4BAA4B,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,aAAa,CAAC,KAAK;gBAC7B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,cAAc,EAAE,KAAK,CAAC,IAAI;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,WAAW,EAAE,0CAA0C;gBACvD,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,IAAI,KAAK,CAAC,IAAI,uCAAuC,KAAK,CAAC,SAAS,GAAG;aACjF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC,KAAK;gBAC/C,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,cAAc,EAAE,KAAK,CAAC,IAAI;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,OAAO,EAAE,IAAI,KAAK,CAAC,IAAI,uBAAuB,KAAK,CAAC,SAAS,GAAG;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,MAAM,iBAAiB,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,wHAAwH,CAAC;YAC/I,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACtD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,aAAa,CAAC,KAAK;oBAC7B,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;oBACzC,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,8GAA8G;oBACvI,IAAI,EAAE,8CAA8C;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,eAAe,GAAG,2DAA2D,CAAC;IACpF,MAAM,kBAAkB,GAAG,wEAAwE,CAAC;IACpG,MAAM,gBAAgB,GAAG,mDAAmD,CAAC;IAC7E,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,aAAa,CAAC,KAAK;gBAC7B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,OAAO,EAAE,uDAAuD;gBAChE,IAAI,EAAE,kDAAkD;aACzD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,aAAa,CAAC,KAAK;gBAC7B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,kDAAkD;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,uDAAuD,CAAC;IAClF,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oCAAoC;YAC1C,QAAQ,EAAE,aAAa,CAAC,KAAK;YAC7B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;YACrC,OAAO,EAAE,oKAAoK;YAC7K,IAAI,EAAE,6DAA6D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,mEAAmE;IACnE,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,8CAA8C;IAC9C,EAAE;IACF,+BAA+B;IAC/B,gCAAgC;IAChC,4EAA4E;IAC5E,EAAE;IACF,0EAA0E;IAC1E,6CAA6C;IAC7C,sCAAsC;IACtC,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,oBAAoB,GACxB,gEAAgE,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE;QAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,0CAA0C;YAC1C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,EAAE,CAAC;IACL,SAAS,YAAY,CAAC,SAAiB;QACrC,0DAA0D;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACtD,IAAI,SAAS,GAAG,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GACb,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,SAAS;YAAE,SAAS;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EAAE,aAAa,CAAC,IAAI;YAC5B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO,GAAG,CAAC;YACjB,OAAO,EACL,+BAA+B,CAAC,CAAC,CAAC,CAAC,mFAAmF;gBACtH,+GAA+G;gBAC/G,qDAAqD;YACvD,IAAI,EAAE,4DAA4D;SACnE,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,4DAA4D;IAC5D,kEAAkE;IAClE,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,iFAAiF;IACjF,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,YAAY,GAChB,IAAI,CAAC,oBAAoB,YAAY,GAAG;QACtC,CAAC,CAAC,IAAI,CAAC,oBAAoB;QAC3B,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,2CAA2C,CAAC;QAClE,IAAI,SAAS,CAAC;QACd,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kDAAkD;gBACxD,QAAQ,EAAE,aAAa,CAAC,IAAI;gBAC5B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC7C,OAAO,EACL,iFAAiF;oBACjF,mFAAmF;oBACnF,6FAA6F;gBAC/F,GAAG,EACD,2FAA2F;oBAC3F,2FAA2F;gBAC7F,IAAI,EAAE,0DAA0D;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;8BAE8B;AAC9B,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAoB,EAAE;IACnE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,oBAAoB,GACxB,IAAI,CAAC,oBAAoB,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;QACxB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC3F,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,aAAa,CAAC,IAAI;gBAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,QAAQ,CAAC;gBAC5C,OAAO,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACpF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,GAAG,eAAe,CAAC,OAAO,EAAE;YAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,QAAQ,CAAC;YAChD,oBAAoB;SACrB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;oEAMoE;AACpE,MAAM,UAAU,eAAe,CAAC,SAAmB,EAAE,OAAoB,EAAE;IACzE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,6DAA6D;IAC7D,MAAM,oBAAoB,GACxB,IAAI,CAAC,oBAAoB,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAAE,SAAS;QACzD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,aAAa,CAAC,IAAI;gBAC5B,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAC7B,OAAO,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACpF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,GAAG,eAAe,CAAC,OAAO,EAAE;YAC1B,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;YACjC,oBAAoB;SACrB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,OAA+B;IACxD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjJ,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,2BAA2B;IACzC,OAAO,kBAAkB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,4BAA4B,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;6CAQ6C;AAC7C,MAAM,UAAU,wBAAwB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,wDAAwD;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,SAAS,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAsC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,KAAK,EAAE,YAAY,CAAC;YACrC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ;oBAAE,IAAI,OAAO,GAAG,KAAK,QAAQ;wBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;iBAEiB;AACjB,MAAM,UAAU,eAAe,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,IAA0B,EAAE,OAAe,EAAE,UAAmB;IACpG,MAAM,QAAQ,GAAG,UAAU,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,EAAE,CAAC,MAAM;gBAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxH,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,UAAU,IAAI,QAAQ,KAAK,OAAO;QAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9D,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,SAAS,IAAI,UAAU;QAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnH,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,mBAAmB,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AACjN,CAAC"}

package/sdk/dist/rest-diagnostics.d.ts

@@ -0,0 +1,15 @@
+import { ApiError, type Run402Error } from "./errors.js";
+/** Client diagnostic only: the original PostgREST body/status remain available. */
+export declare class RestPermissionDenied extends ApiError {
+    readonly code = "REST_PERMISSION_DENIED";
+    readonly details: {
+        source: "postgrest";
+        upstream_status: number | null;
+        upstream_code: "42501";
+        method: string;
+        relation: string;
+    };
+    constructor(error: Run402Error, method: string, relation: string);
+}
+export declare function restDiagnostic(error: unknown, method: string, relation: string): unknown;
+//# sourceMappingURL=rest-diagnostics.d.ts.map

package/sdk/dist/rest-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest-diagnostics.d.ts","sourceRoot":"","sources":["../src/rest-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAiB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAExE,mFAAmF;AACnF,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,SAAkB,IAAI,4BAA4B;IAClD,SAAkB,OAAO,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;gBACjI,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAIjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMxF"}

package/sdk/dist/rest-diagnostics.js

@@ -0,0 +1,19 @@
+import { ApiError, isRun402Error } from "./errors.js";
+/** Client diagnostic only: the original PostgREST body/status remain available. */
+export class RestPermissionDenied extends ApiError {
+    code = "REST_PERMISSION_DENIED";
+    details;
+    constructor(error, method, relation) {
+        super("PostgREST denied this operation; check grants and policies for the request role.", error.status, error.body, error.context);
+        this.details = { source: "postgrest", upstream_status: error.status, upstream_code: "42501", method, relation };
+    }
+}
+export function restDiagnostic(error, method, relation) {
+    if (!isRun402Error(error))
+        return error;
+    const body = error.body;
+    // Only the public native SQLSTATE is interpreted. Never parse private schema
+    // names out of upstream text or infer exposure/RLS from permission denial.
+    return body?.code === "42501" ? new RestPermissionDenied(error, method, relation) : error;
+}
+//# sourceMappingURL=rest-diagnostics.js.map

package/sdk/dist/rest-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest-diagnostics.js","sourceRoot":"","sources":["../src/rest-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAC;AAExE,mFAAmF;AACnF,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAC9B,IAAI,GAAG,wBAAwB,CAAC;IAChC,OAAO,CAAoH;IAC7I,YAAY,KAAkB,EAAE,MAAc,EAAE,QAAgB;QAC9D,KAAK,CAAC,kFAAkF,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnI,IAAI,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClH,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,MAAc,EAAE,QAAgB;IAC7E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAiC,CAAC;IACrD,6EAA6E;IAC7E,2EAA2E;IAC3E,OAAO,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5F,CAAC"}