safegres 1.15.2 → 1.15.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/commands/audit.js +2 -2
  2. package/esm/commands/audit.js +2 -2
  3. package/esm/index.d.ts +8 -8
  4. package/esm/index.js +4 -4
  5. package/esm/perf/explain.d.ts +1 -1
  6. package/esm/report/sarif.js +1 -1
  7. package/index.d.ts +8 -8
  8. package/index.js +21 -21
  9. package/package.json +7 -7
  10. package/perf/explain.d.ts +1 -1
package/commands/audit.js CHANGED
@@ -11,15 +11,15 @@ const anti_patterns_1 = require("../checks/anti-patterns");
11
11
  const coverage_1 = require("../checks/coverage");
12
12
  const indexes_1 = require("../checks/indexes");
13
13
  const policy_index_1 = require("../checks/policy-index");
14
- const stats_1 = require("../checks/stats");
15
14
  const rls_flags_1 = require("../checks/rls-flags");
16
15
  const role_trust_1 = require("../checks/role-trust");
16
+ const stats_1 = require("../checks/stats");
17
17
  const resolve_1 = require("../config/resolve");
18
+ const explain_1 = require("../perf/explain");
18
19
  const exposure_1 = require("../pg/exposure");
19
20
  const functions_1 = require("../pg/functions");
20
21
  const indexes_2 = require("../pg/indexes");
21
22
  const introspect_1 = require("../pg/introspect");
22
- const explain_1 = require("../perf/explain");
23
23
  const proc_1 = require("../pg/proc");
24
24
  const roles_1 = require("../pg/roles");
25
25
  const stats_2 = require("../pg/stats");
package/esm/commands/audit.js CHANGED
@@ -8,15 +8,15 @@ import { checkSessionUserGating, checkTriviallyPermissive, checkVolatileFunction
8
8
  import { checkCoverageGaps, checkUpdateWithCheckCoverage } from '../checks/coverage';
9
9
  import { checkMissingPrimaryKey, checkRedundantIndexes, checkUnindexedForeignKeys, checkUnindexedSearchColumns, checkUnindexedSortColumns } from '../checks/indexes';
10
10
  import { checkNonLeakproofPolicyFunctions, checkPolicyColumnCasts, checkUnindexedPolicyColumns, collectPredicateColumns } from '../checks/policy-index';
11
- import { checkStats, DEFAULT_STATS_THRESHOLDS } from '../checks/stats';
12
11
  import { checkGrantsWithoutRls, checkRlsEnabledNoPolicies, checkRlsNotForced } from '../checks/rls-flags';
13
12
  import { checkPublicGrants, checkUntrustedRolePolicies, checkUntrustedRoleWrites } from '../checks/role-trust';
13
+ import { checkStats, DEFAULT_STATS_THRESHOLDS } from '../checks/stats';
14
14
  import { allAstRulesDisabled, applyRulesToFindings, matchTablePattern, resolveRules, rulesForTable } from '../config/resolve';
15
+ import { proveFindings } from '../perf/explain';
15
16
  import { resolveExposure } from '../pg/exposure';
16
17
  import { introspectFunctions } from '../pg/functions';
17
18
  import { introspectIndexes } from '../pg/indexes';
18
19
  import { asExecutor, introspectTables } from '../pg/introspect';
19
- import { proveFindings } from '../perf/explain';
20
20
  import { lookupVolatility } from '../pg/proc';
21
21
  import { listAuditableRoles, resolveRoles } from '../pg/roles';
22
22
  import { introspectStats } from '../pg/stats';
package/esm/index.d.ts CHANGED
@@ -12,11 +12,11 @@ export type { CallGraphEdge, CallGraphNode, CallGraphOptions, CallGraphReport, C
12
12
  export { buildCallGraph } from './callgraph/graph';
13
13
  export { checkMissingPrimaryKey, checkRedundantIndexes, checkUnindexedForeignKeys, checkUnindexedSearchColumns, checkUnindexedSortColumns } from './checks/indexes';
14
14
  export type { PolicyClause, PredicateColumn } from './checks/policy-index';
15
- export type { StatsThresholds } from './checks/stats';
16
- export { checkDeadTuples, checkSeqScanDominant, checkStats, checkTopStatements, checkUnusedIndexes, DEFAULT_STATS_THRESHOLDS } from './checks/stats';
17
15
  export { checkNonLeakproofPolicyFunctions, checkPolicyColumnCasts, checkUnindexedPolicyColumns, collectPredicateColumns } from './checks/policy-index';
18
16
  export type { RoleTrustOptions } from './checks/role-trust';
19
17
  export { checkPublicGrants, checkUntrustedRolePolicies, checkUntrustedRoleWrites } from './checks/role-trust';
18
+ export type { StatsThresholds } from './checks/stats';
19
+ export { checkDeadTuples, checkSeqScanDominant, checkStats, checkTopStatements, checkUnusedIndexes, DEFAULT_STATS_THRESHOLDS } from './checks/stats';
20
20
  export type { AuditOptions } from './commands/audit';
21
21
  export { audit } from './commands/audit';
22
22
  export type { DoctorCheck, DoctorOptions, DoctorReport, DoctorStatus } from './commands/doctor';
@@ -27,20 +27,20 @@ export { constructive, minimal, PRESETS, recommended, strict } from './config/pr
27
27
  export type { ResolvedRule, ResolvedRules } from './config/resolve';
28
28
  export { allAstRulesDisabled, applyRulesToFindings, ConfigValidationError, defaultRuleMap, matchTablePattern, resolveRules, ruleCodesForDimension, rulesForTable } from './config/resolve';
29
29
  export type { ExposureConfig, FailOnConfig, Grade, OverrideEntry, PerfConfig, RulesConfig, RuleSetting, SafegresConfig, ScoringConfig } from './config/types';
30
+ export type { BaselineFinding, PerfBaseline, PerfDiff } from './perf/baseline';
31
+ export { diffPerf, findingKey, parsePerfBaseline, serializePerfBaseline, subjectOf, toBaselineFinding, toPerfBaseline } from './perf/baseline';
32
+ export type { ExplainOptions, ExplainReport } from './perf/explain';
33
+ export { proveFindings } from './perf/explain';
30
34
  export type { ResolvedExposure } from './pg/exposure';
31
35
  export { resolveConstructiveExposure, resolveExposure, UNKNOWN_EXPOSURE } from './pg/exposure';
32
36
  export type { FunctionGrant, FunctionSnapshot, IntrospectFunctionOptions } from './pg/functions';
33
37
  export { introspectFunctions } from './pg/functions';
34
38
  export type { ColumnInfo, ForeignKeyInfo, IndexInfo, TableIndexSnapshot } from './pg/indexes';
35
39
  export { introspectIndexes } from './pg/indexes';
36
- export type { IndexUsage, StatementUsage, StatsSnapshot, TableUsage } from './pg/stats';
37
- export { introspectStats } from './pg/stats';
38
- export type { ExplainOptions, ExplainReport } from './perf/explain';
39
- export { proveFindings } from './perf/explain';
40
40
  export { type IntrospectOptions, introspectTables, type PgPrivilege, type PolicyCmd, type PolicyInfo, type QueryExecutor, type TableSnapshot } from './pg/introspect';
41
41
  export { listAuditableRoles, resolveRoles } from './pg/roles';
42
- export type { BaselineFinding, PerfBaseline, PerfDiff } from './perf/baseline';
43
- export { diffPerf, findingKey, parsePerfBaseline, serializePerfBaseline, subjectOf, toBaselineFinding, toPerfBaseline } from './perf/baseline';
42
+ export type { IndexUsage, StatementUsage, StatsSnapshot, TableUsage } from './pg/stats';
43
+ export { introspectStats } from './pg/stats';
44
44
  export { renderCallGraph, renderCallGraphDiff } from './report/callgraph';
45
45
  export { renderJson } from './report/json';
46
46
  export type { RenderMarkdownOptions } from './report/markdown';
package/esm/index.js CHANGED
@@ -9,22 +9,22 @@ export { parsePolicyExpression, PolicyParseError } from './ast/parse';
9
9
  export { boundaryKey, diffCallGraph, parseBaseline, serializeBaseline, toBaseline } from './callgraph/baseline';
10
10
  export { buildCallGraph } from './callgraph/graph';
11
11
  export { checkMissingPrimaryKey, checkRedundantIndexes, checkUnindexedForeignKeys, checkUnindexedSearchColumns, checkUnindexedSortColumns } from './checks/indexes';
12
- export { checkDeadTuples, checkSeqScanDominant, checkStats, checkTopStatements, checkUnusedIndexes, DEFAULT_STATS_THRESHOLDS } from './checks/stats';
13
12
  export { checkNonLeakproofPolicyFunctions, checkPolicyColumnCasts, checkUnindexedPolicyColumns, collectPredicateColumns } from './checks/policy-index';
14
13
  export { checkPublicGrants, checkUntrustedRolePolicies, checkUntrustedRoleWrites } from './checks/role-trust';
14
+ export { checkDeadTuples, checkSeqScanDominant, checkStats, checkTopStatements, checkUnusedIndexes, DEFAULT_STATS_THRESHOLDS } from './checks/stats';
15
15
  export { audit } from './commands/audit';
16
16
  export { doctor } from './commands/doctor';
17
17
  export { loadConfig, safegresConfigLoader } from './config/loader';
18
18
  export { constructive, minimal, PRESETS, recommended, strict } from './config/presets';
19
19
  export { allAstRulesDisabled, applyRulesToFindings, ConfigValidationError, defaultRuleMap, matchTablePattern, resolveRules, ruleCodesForDimension, rulesForTable } from './config/resolve';
20
+ export { diffPerf, findingKey, parsePerfBaseline, serializePerfBaseline, subjectOf, toBaselineFinding, toPerfBaseline } from './perf/baseline';
21
+ export { proveFindings } from './perf/explain';
20
22
  export { resolveConstructiveExposure, resolveExposure, UNKNOWN_EXPOSURE } from './pg/exposure';
21
23
  export { introspectFunctions } from './pg/functions';
22
24
  export { introspectIndexes } from './pg/indexes';
23
- export { introspectStats } from './pg/stats';
24
- export { proveFindings } from './perf/explain';
25
25
  export { introspectTables } from './pg/introspect';
26
26
  export { listAuditableRoles, resolveRoles } from './pg/roles';
27
- export { diffPerf, findingKey, parsePerfBaseline, serializePerfBaseline, subjectOf, toBaselineFinding, toPerfBaseline } from './perf/baseline';
27
+ export { introspectStats } from './pg/stats';
28
28
  export { renderCallGraph, renderCallGraphDiff } from './report/callgraph';
29
29
  export { renderJson } from './report/json';
30
30
  export { renderMarkdown } from './report/markdown';
package/esm/perf/explain.d.ts CHANGED
@@ -17,8 +17,8 @@
17
17
  * is executed, and no value has to be invented for a column whose domain we
18
18
  * know nothing about. That requires PostgreSQL 16+.
19
19
  */
20
- import type { QueryExecutor } from '../pg/introspect';
21
20
  import type { TableIndexSnapshot } from '../pg/indexes';
21
+ import type { QueryExecutor } from '../pg/introspect';
22
22
  import type { Finding } from '../types';
23
23
  export interface ExplainOptions {
24
24
  /**
package/esm/report/sarif.js CHANGED
@@ -14,7 +14,7 @@
14
14
  import { readdirSync, readFileSync, statSync } from 'fs';
15
15
  import { join, relative, sep } from 'path';
16
16
  import { findingKey, subjectOf } from '../perf/baseline';
17
- import { RULES, dimensionOf } from '../rules/registry';
17
+ import { dimensionOf, RULES } from '../rules/registry';
18
18
  const SARIF_VERSION = '2.1.0';
19
19
  const SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json';
20
20
  /** SARIF has three visible levels; five severities have to fold into them. */
package/index.d.ts CHANGED
@@ -12,11 +12,11 @@ export type { CallGraphEdge, CallGraphNode, CallGraphOptions, CallGraphReport, C
12
12
  export { buildCallGraph } from './callgraph/graph';
13
13
  export { checkMissingPrimaryKey, checkRedundantIndexes, checkUnindexedForeignKeys, checkUnindexedSearchColumns, checkUnindexedSortColumns } from './checks/indexes';
14
14
  export type { PolicyClause, PredicateColumn } from './checks/policy-index';
15
- export type { StatsThresholds } from './checks/stats';
16
- export { checkDeadTuples, checkSeqScanDominant, checkStats, checkTopStatements, checkUnusedIndexes, DEFAULT_STATS_THRESHOLDS } from './checks/stats';
17
15
  export { checkNonLeakproofPolicyFunctions, checkPolicyColumnCasts, checkUnindexedPolicyColumns, collectPredicateColumns } from './checks/policy-index';
18
16
  export type { RoleTrustOptions } from './checks/role-trust';
19
17
  export { checkPublicGrants, checkUntrustedRolePolicies, checkUntrustedRoleWrites } from './checks/role-trust';
18
+ export type { StatsThresholds } from './checks/stats';
19
+ export { checkDeadTuples, checkSeqScanDominant, checkStats, checkTopStatements, checkUnusedIndexes, DEFAULT_STATS_THRESHOLDS } from './checks/stats';
20
20
  export type { AuditOptions } from './commands/audit';
21
21
  export { audit } from './commands/audit';
22
22
  export type { DoctorCheck, DoctorOptions, DoctorReport, DoctorStatus } from './commands/doctor';
@@ -27,20 +27,20 @@ export { constructive, minimal, PRESETS, recommended, strict } from './config/pr
27
27
  export type { ResolvedRule, ResolvedRules } from './config/resolve';
28
28
  export { allAstRulesDisabled, applyRulesToFindings, ConfigValidationError, defaultRuleMap, matchTablePattern, resolveRules, ruleCodesForDimension, rulesForTable } from './config/resolve';
29
29
  export type { ExposureConfig, FailOnConfig, Grade, OverrideEntry, PerfConfig, RulesConfig, RuleSetting, SafegresConfig, ScoringConfig } from './config/types';
30
+ export type { BaselineFinding, PerfBaseline, PerfDiff } from './perf/baseline';
31
+ export { diffPerf, findingKey, parsePerfBaseline, serializePerfBaseline, subjectOf, toBaselineFinding, toPerfBaseline } from './perf/baseline';
32
+ export type { ExplainOptions, ExplainReport } from './perf/explain';
33
+ export { proveFindings } from './perf/explain';
30
34
  export type { ResolvedExposure } from './pg/exposure';
31
35
  export { resolveConstructiveExposure, resolveExposure, UNKNOWN_EXPOSURE } from './pg/exposure';
32
36
  export type { FunctionGrant, FunctionSnapshot, IntrospectFunctionOptions } from './pg/functions';
33
37
  export { introspectFunctions } from './pg/functions';
34
38
  export type { ColumnInfo, ForeignKeyInfo, IndexInfo, TableIndexSnapshot } from './pg/indexes';
35
39
  export { introspectIndexes } from './pg/indexes';
36
- export type { IndexUsage, StatementUsage, StatsSnapshot, TableUsage } from './pg/stats';
37
- export { introspectStats } from './pg/stats';
38
- export type { ExplainOptions, ExplainReport } from './perf/explain';
39
- export { proveFindings } from './perf/explain';
40
40
  export { type IntrospectOptions, introspectTables, type PgPrivilege, type PolicyCmd, type PolicyInfo, type QueryExecutor, type TableSnapshot } from './pg/introspect';
41
41
  export { listAuditableRoles, resolveRoles } from './pg/roles';
42
- export type { BaselineFinding, PerfBaseline, PerfDiff } from './perf/baseline';
43
- export { diffPerf, findingKey, parsePerfBaseline, serializePerfBaseline, subjectOf, toBaselineFinding, toPerfBaseline } from './perf/baseline';
42
+ export type { IndexUsage, StatementUsage, StatsSnapshot, TableUsage } from './pg/stats';
43
+ export { introspectStats } from './pg/stats';
44
44
  export { renderCallGraph, renderCallGraphDiff } from './report/callgraph';
45
45
  export { renderJson } from './report/json';
46
46
  export type { RenderMarkdownOptions } from './report/markdown';
package/index.js CHANGED
@@ -21,8 +21,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
21
21
  for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
22
22
  };
23
23
  Object.defineProperty(exports, "__esModule", { value: true });
24
- exports.proveFindings = exports.introspectStats = exports.introspectIndexes = exports.introspectFunctions = exports.UNKNOWN_EXPOSURE = exports.resolveExposure = exports.resolveConstructiveExposure = exports.rulesForTable = exports.ruleCodesForDimension = exports.resolveRules = exports.matchTablePattern = exports.defaultRuleMap = exports.ConfigValidationError = exports.applyRulesToFindings = exports.allAstRulesDisabled = exports.strict = exports.recommended = exports.PRESETS = exports.minimal = exports.constructive = exports.safegresConfigLoader = exports.loadConfig = exports.doctor = exports.audit = exports.checkUntrustedRoleWrites = exports.checkUntrustedRolePolicies = exports.checkPublicGrants = exports.collectPredicateColumns = exports.checkUnindexedPolicyColumns = exports.checkPolicyColumnCasts = exports.checkNonLeakproofPolicyFunctions = exports.DEFAULT_STATS_THRESHOLDS = exports.checkUnusedIndexes = exports.checkTopStatements = exports.checkStats = exports.checkSeqScanDominant = exports.checkDeadTuples = exports.checkUnindexedSortColumns = exports.checkUnindexedSearchColumns = exports.checkUnindexedForeignKeys = exports.checkRedundantIndexes = exports.checkMissingPrimaryKey = exports.buildCallGraph = exports.toBaseline = exports.serializeBaseline = exports.parseBaseline = exports.diffCallGraph = exports.boundaryKey = exports.PolicyParseError = exports.parsePolicyExpression = void 0;
25
- exports.meetsGrade = exports.DEFAULT_WEIGHTS = exports.DEFAULT_GRADE_BANDS = exports.computeScore = exports.RULES_BY_CODE = exports.RULES = exports.isKnownRule = exports.expandRuleSelector = exports.dimensionOf = exports.renderSarif = exports.buildSourceIndex = exports.renderPretty = exports.renderMarkdown = exports.renderJson = exports.renderCallGraphDiff = exports.renderCallGraph = exports.toPerfBaseline = exports.toBaselineFinding = exports.subjectOf = exports.serializePerfBaseline = exports.parsePerfBaseline = exports.findingKey = exports.diffPerf = exports.resolveRoles = exports.listAuditableRoles = exports.introspectTables = void 0;
24
+ exports.toPerfBaseline = exports.toBaselineFinding = exports.subjectOf = exports.serializePerfBaseline = exports.parsePerfBaseline = exports.findingKey = exports.diffPerf = exports.rulesForTable = exports.ruleCodesForDimension = exports.resolveRules = exports.matchTablePattern = exports.defaultRuleMap = exports.ConfigValidationError = exports.applyRulesToFindings = exports.allAstRulesDisabled = exports.strict = exports.recommended = exports.PRESETS = exports.minimal = exports.constructive = exports.safegresConfigLoader = exports.loadConfig = exports.doctor = exports.audit = exports.DEFAULT_STATS_THRESHOLDS = exports.checkUnusedIndexes = exports.checkTopStatements = exports.checkStats = exports.checkSeqScanDominant = exports.checkDeadTuples = exports.checkUntrustedRoleWrites = exports.checkUntrustedRolePolicies = exports.checkPublicGrants = exports.collectPredicateColumns = exports.checkUnindexedPolicyColumns = exports.checkPolicyColumnCasts = exports.checkNonLeakproofPolicyFunctions = exports.checkUnindexedSortColumns = exports.checkUnindexedSearchColumns = exports.checkUnindexedForeignKeys = exports.checkRedundantIndexes = exports.checkMissingPrimaryKey = exports.buildCallGraph = exports.toBaseline = exports.serializeBaseline = exports.parseBaseline = exports.diffCallGraph = exports.boundaryKey = exports.PolicyParseError = exports.parsePolicyExpression = void 0;
25
+ exports.meetsGrade = exports.DEFAULT_WEIGHTS = exports.DEFAULT_GRADE_BANDS = exports.computeScore = exports.RULES_BY_CODE = exports.RULES = exports.isKnownRule = exports.expandRuleSelector = exports.dimensionOf = exports.renderSarif = exports.buildSourceIndex = exports.renderPretty = exports.renderMarkdown = exports.renderJson = exports.renderCallGraphDiff = exports.renderCallGraph = exports.introspectStats = exports.resolveRoles = exports.listAuditableRoles = exports.introspectTables = exports.introspectIndexes = exports.introspectFunctions = exports.UNKNOWN_EXPOSURE = exports.resolveExposure = exports.resolveConstructiveExposure = exports.proveFindings = void 0;
26
26
  var parse_1 = require("./ast/parse");
27
27
  Object.defineProperty(exports, "parsePolicyExpression", { enumerable: true, get: function () { return parse_1.parsePolicyExpression; } });
28
28
  Object.defineProperty(exports, "PolicyParseError", { enumerable: true, get: function () { return parse_1.PolicyParseError; } });
@@ -40,13 +40,6 @@ Object.defineProperty(exports, "checkRedundantIndexes", { enumerable: true, get:
40
40
  Object.defineProperty(exports, "checkUnindexedForeignKeys", { enumerable: true, get: function () { return indexes_1.checkUnindexedForeignKeys; } });
41
41
  Object.defineProperty(exports, "checkUnindexedSearchColumns", { enumerable: true, get: function () { return indexes_1.checkUnindexedSearchColumns; } });
42
42
  Object.defineProperty(exports, "checkUnindexedSortColumns", { enumerable: true, get: function () { return indexes_1.checkUnindexedSortColumns; } });
43
- var stats_1 = require("./checks/stats");
44
- Object.defineProperty(exports, "checkDeadTuples", { enumerable: true, get: function () { return stats_1.checkDeadTuples; } });
45
- Object.defineProperty(exports, "checkSeqScanDominant", { enumerable: true, get: function () { return stats_1.checkSeqScanDominant; } });
46
- Object.defineProperty(exports, "checkStats", { enumerable: true, get: function () { return stats_1.checkStats; } });
47
- Object.defineProperty(exports, "checkTopStatements", { enumerable: true, get: function () { return stats_1.checkTopStatements; } });
48
- Object.defineProperty(exports, "checkUnusedIndexes", { enumerable: true, get: function () { return stats_1.checkUnusedIndexes; } });
49
- Object.defineProperty(exports, "DEFAULT_STATS_THRESHOLDS", { enumerable: true, get: function () { return stats_1.DEFAULT_STATS_THRESHOLDS; } });
50
43
  var policy_index_1 = require("./checks/policy-index");
51
44
  Object.defineProperty(exports, "checkNonLeakproofPolicyFunctions", { enumerable: true, get: function () { return policy_index_1.checkNonLeakproofPolicyFunctions; } });
52
45
  Object.defineProperty(exports, "checkPolicyColumnCasts", { enumerable: true, get: function () { return policy_index_1.checkPolicyColumnCasts; } });
@@ -56,6 +49,13 @@ var role_trust_1 = require("./checks/role-trust");
56
49
  Object.defineProperty(exports, "checkPublicGrants", { enumerable: true, get: function () { return role_trust_1.checkPublicGrants; } });
57
50
  Object.defineProperty(exports, "checkUntrustedRolePolicies", { enumerable: true, get: function () { return role_trust_1.checkUntrustedRolePolicies; } });
58
51
  Object.defineProperty(exports, "checkUntrustedRoleWrites", { enumerable: true, get: function () { return role_trust_1.checkUntrustedRoleWrites; } });
52
+ var stats_1 = require("./checks/stats");
53
+ Object.defineProperty(exports, "checkDeadTuples", { enumerable: true, get: function () { return stats_1.checkDeadTuples; } });
54
+ Object.defineProperty(exports, "checkSeqScanDominant", { enumerable: true, get: function () { return stats_1.checkSeqScanDominant; } });
55
+ Object.defineProperty(exports, "checkStats", { enumerable: true, get: function () { return stats_1.checkStats; } });
56
+ Object.defineProperty(exports, "checkTopStatements", { enumerable: true, get: function () { return stats_1.checkTopStatements; } });
57
+ Object.defineProperty(exports, "checkUnusedIndexes", { enumerable: true, get: function () { return stats_1.checkUnusedIndexes; } });
58
+ Object.defineProperty(exports, "DEFAULT_STATS_THRESHOLDS", { enumerable: true, get: function () { return stats_1.DEFAULT_STATS_THRESHOLDS; } });
59
59
  var audit_1 = require("./commands/audit");
60
60
  Object.defineProperty(exports, "audit", { enumerable: true, get: function () { return audit_1.audit; } });
61
61
  var doctor_1 = require("./commands/doctor");
@@ -78,6 +78,16 @@ Object.defineProperty(exports, "matchTablePattern", { enumerable: true, get: fun
78
78
  Object.defineProperty(exports, "resolveRules", { enumerable: true, get: function () { return resolve_1.resolveRules; } });
79
79
  Object.defineProperty(exports, "ruleCodesForDimension", { enumerable: true, get: function () { return resolve_1.ruleCodesForDimension; } });
80
80
  Object.defineProperty(exports, "rulesForTable", { enumerable: true, get: function () { return resolve_1.rulesForTable; } });
81
+ var baseline_2 = require("./perf/baseline");
82
+ Object.defineProperty(exports, "diffPerf", { enumerable: true, get: function () { return baseline_2.diffPerf; } });
83
+ Object.defineProperty(exports, "findingKey", { enumerable: true, get: function () { return baseline_2.findingKey; } });
84
+ Object.defineProperty(exports, "parsePerfBaseline", { enumerable: true, get: function () { return baseline_2.parsePerfBaseline; } });
85
+ Object.defineProperty(exports, "serializePerfBaseline", { enumerable: true, get: function () { return baseline_2.serializePerfBaseline; } });
86
+ Object.defineProperty(exports, "subjectOf", { enumerable: true, get: function () { return baseline_2.subjectOf; } });
87
+ Object.defineProperty(exports, "toBaselineFinding", { enumerable: true, get: function () { return baseline_2.toBaselineFinding; } });
88
+ Object.defineProperty(exports, "toPerfBaseline", { enumerable: true, get: function () { return baseline_2.toPerfBaseline; } });
89
+ var explain_1 = require("./perf/explain");
90
+ Object.defineProperty(exports, "proveFindings", { enumerable: true, get: function () { return explain_1.proveFindings; } });
81
91
  var exposure_1 = require("./pg/exposure");
82
92
  Object.defineProperty(exports, "resolveConstructiveExposure", { enumerable: true, get: function () { return exposure_1.resolveConstructiveExposure; } });
83
93
  Object.defineProperty(exports, "resolveExposure", { enumerable: true, get: function () { return exposure_1.resolveExposure; } });
@@ -86,23 +96,13 @@ var functions_1 = require("./pg/functions");
86
96
  Object.defineProperty(exports, "introspectFunctions", { enumerable: true, get: function () { return functions_1.introspectFunctions; } });
87
97
  var indexes_2 = require("./pg/indexes");
88
98
  Object.defineProperty(exports, "introspectIndexes", { enumerable: true, get: function () { return indexes_2.introspectIndexes; } });
89
- var stats_2 = require("./pg/stats");
90
- Object.defineProperty(exports, "introspectStats", { enumerable: true, get: function () { return stats_2.introspectStats; } });
91
- var explain_1 = require("./perf/explain");
92
- Object.defineProperty(exports, "proveFindings", { enumerable: true, get: function () { return explain_1.proveFindings; } });
93
99
  var introspect_1 = require("./pg/introspect");
94
100
  Object.defineProperty(exports, "introspectTables", { enumerable: true, get: function () { return introspect_1.introspectTables; } });
95
101
  var roles_1 = require("./pg/roles");
96
102
  Object.defineProperty(exports, "listAuditableRoles", { enumerable: true, get: function () { return roles_1.listAuditableRoles; } });
97
103
  Object.defineProperty(exports, "resolveRoles", { enumerable: true, get: function () { return roles_1.resolveRoles; } });
98
- var baseline_2 = require("./perf/baseline");
99
- Object.defineProperty(exports, "diffPerf", { enumerable: true, get: function () { return baseline_2.diffPerf; } });
100
- Object.defineProperty(exports, "findingKey", { enumerable: true, get: function () { return baseline_2.findingKey; } });
101
- Object.defineProperty(exports, "parsePerfBaseline", { enumerable: true, get: function () { return baseline_2.parsePerfBaseline; } });
102
- Object.defineProperty(exports, "serializePerfBaseline", { enumerable: true, get: function () { return baseline_2.serializePerfBaseline; } });
103
- Object.defineProperty(exports, "subjectOf", { enumerable: true, get: function () { return baseline_2.subjectOf; } });
104
- Object.defineProperty(exports, "toBaselineFinding", { enumerable: true, get: function () { return baseline_2.toBaselineFinding; } });
105
- Object.defineProperty(exports, "toPerfBaseline", { enumerable: true, get: function () { return baseline_2.toPerfBaseline; } });
104
+ var stats_2 = require("./pg/stats");
105
+ Object.defineProperty(exports, "introspectStats", { enumerable: true, get: function () { return stats_2.introspectStats; } });
106
106
  var callgraph_1 = require("./report/callgraph");
107
107
  Object.defineProperty(exports, "renderCallGraph", { enumerable: true, get: function () { return callgraph_1.renderCallGraph; } });
108
108
  Object.defineProperty(exports, "renderCallGraphDiff", { enumerable: true, get: function () { return callgraph_1.renderCallGraphDiff; } });
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "safegres",
3
- "version": "1.15.2",
3
+ "version": "1.15.4",
4
4
  "author": "Constructive <developers@constructive.io>",
5
5
  "description": "Pure-Postgres Row-Level Security auditor: grants, RLS enforcement, policy coverage, and risky SQL policy patterns, plus an optional index-hygiene performance score. No app framework required.",
6
6
  "main": "index.js",
@@ -44,16 +44,16 @@
44
44
  ],
45
45
  "dependencies": {
46
46
  "@inquirerer/utils": "^3.3.9",
47
- "@pgpmjs/logger": "^2.23.2",
48
- "@pgsql/traverse": "^18.4.0",
47
+ "@pgpmjs/logger": "^2.23.3",
48
+ "@pgsql/traverse": "^18.7.1",
49
49
  "@pgsql/types": "^18.0.0",
50
50
  "confstash": "^0.1.0",
51
51
  "inquirerer": "^4.9.1",
52
52
  "libpg-query": "^18.1.2",
53
53
  "pg": "^8.21.0",
54
54
  "pg-env": "^1.27.2",
55
- "pgsql-deparser": "^18.2.0",
56
- "pgsql-parser": "^18.1.2",
55
+ "pgsql-deparser": "^18.3.1",
56
+ "pgsql-parser": "^18.2.1",
57
57
  "yanse": "^0.2.1"
58
58
  },
59
59
  "peerDependencies": {
@@ -68,7 +68,7 @@
68
68
  "@types/node": "^22.0.0",
69
69
  "@types/pg": "^8.20.0",
70
70
  "makage": "^0.3.0",
71
- "pgsql-test": "^5.9.7"
71
+ "pgsql-test": "^5.9.9"
72
72
  },
73
- "gitHead": "6d3e25dc5c9f93421dba49ddedf93239f87213a8"
73
+ "gitHead": "e6a7a57f88c9deb2a4acecaba2451320d1be8203"
74
74
  }
package/perf/explain.d.ts CHANGED
@@ -17,8 +17,8 @@
17
17
  * is executed, and no value has to be invented for a column whose domain we
18
18
  * know nothing about. That requires PostgreSQL 16+.
19
19
  */
20
- import type { QueryExecutor } from '../pg/introspect';
21
20
  import type { TableIndexSnapshot } from '../pg/indexes';
21
+ import type { QueryExecutor } from '../pg/introspect';
22
22
  import type { Finding } from '../types';
23
23
  export interface ExplainOptions {
24
24
  /**