safegres 1.5.0 → 1.8.0

package/README.md

@@ -28,20 +28,131 @@ Per-field overrides (`--host`, `--port`, `--user`, `--password`, `--database`) a
 
 ## What it checks
 
-| Code | Severity | Category | Check |
-| --- | --- | --- | --- |
-| A1 | critical | flags | RLS enabled but **0 policies** (effectively deny-all) |
-| A2 | high | flags | Grants exist on a table with **RLS disabled** |
-| A3 | medium | flags | RLS enabled but **`FORCE ROW LEVEL SECURITY` not set** (table owner bypass) |
-| A4 | high | coverage | INSERT / UPDATE / DELETE grant with **no covering policy** for that verb |
-| A5 | medium | coverage | SELECT grant with **no policy** (silent empty result) |
-| A6 | info | coverage | UPDATE has `USING` but **no `WITH CHECK`** (row-smuggling surface) |
-| A7 | high | anti-pattern | Trivially-permissive policy (`USING (true)` / `WITH CHECK (true)`) |
-| P1 | high | anti-pattern | Policy body calls a **VOLATILE function** (per-row evaluation) |
-| P5 | high | anti-pattern | Policy body references **`session_user`** / `current_user` / `pg_has_role(...)` |
+| Code | Severity | Direction | Category | Check |
+| --- | --- | --- | --- | --- |
+| A1 | low | fail-closed | flags | RLS enabled but **0 policies** (deny-all — confirm the lock is intended) |
+| A2 | high | fail-open | flags | Grants exist on a table with **RLS disabled** |
+| A3 | low | fail-open | flags | RLS enabled but **`FORCE ROW LEVEL SECURITY` not set** (table owner bypass) |
+| A4 | low | fail-closed | coverage | INSERT / UPDATE / DELETE grant with **no covering policy** — writes are denied at runtime |
+| A5 | low | fail-closed | coverage | SELECT grant with **no policy** — queries silently return 0 rows |
+| A6 | info | fail-closed | coverage | UPDATE has `USING` but **no `WITH CHECK`** (row-smuggling surface) |
+| A7 | critical | fail-open | anti-pattern | Trivially-permissive **WRITE** policy (INSERT/UPDATE/DELETE/ALL with literal `true`) |
+| A8 | low | fail-open | anti-pattern | Trivially-permissive **SELECT** policy (`USING (true)` — confirm public-read is intended) |
+| P1 | high | neutral | anti-pattern | Policy body calls a **VOLATILE function** (per-row evaluation) |
+| P5 | high | fail-open | anti-pattern | Policy body references **`session_user`** / `current_user` / `pg_has_role(...)` |
+| R1 | critical | fail-open | anti-pattern | An **untrusted role** (options: `{ roles: [...] }`) holds a write privilege |
+| R2 | high | fail-open | anti-pattern | A permissive write policy applies to an untrusted role or PUBLIC |
+| R3 | medium | fail-open | anti-pattern | An RLS table has grants **TO PUBLIC** (includes all current/future roles) |
+| W1 | medium | — | meta | No exposure surface configured — whole database assumed reachable, score capped |
+
+**Direction matters**: `fail-open` findings are actual exposure (the untrusted side can reach more than intended). `fail-closed` findings are denied at runtime — an availability/hygiene concern, not a leak — and contribute **nothing to the score** by default (tune with `scoring.failClosedWeight`).
 
 Coverage is aggregated `(table, role) → { hasUsing, hasWithCheck }` across every applicable permissive policy (FOR ALL + PUBLIC-role policies considered). Roles with `BYPASSRLS` are suppressed.
 
+R1/R2 are no-ops until a role list is configured — e.g. `"R1": ["critical", { "roles": ["anonymous"] }]` — so they cost nothing on databases without an untrusted-role model. The `safegres:constructive` preset configures them for `anonymous`.
+
+## Exposure surface
+
+A database-wide score is meaningless if most of the database isn't reachable through the app's APIs. Declare (or auto-resolve) the **exposure surface** and safegres partitions findings:
+
+- **Exposed** findings (on API-reachable schemas) drive the score.
+- **Internal** findings are reported as unscored *internal advisories* (hide entirely with `--exposed-only`).
+- **No exposure configured** → a `W1` warning is emitted and the score is capped at 80/B (`scoring.unknownExposureCap`).
+
+```jsonc
+{
+  "exposure": {
+    "schemas": ["app_public", "app_hidden"]      // static surface
+    // or, on a Constructive database:
+    // "resolver": "constructive"                 // introspects routing_public.apis → api_schemas
+  }
+}
+```
+
+CLI: `--exposure-schemas <csv>`, `--exposed-only`. The `safegres:constructive` preset sets `exposure.resolver: "constructive"` so the surface is discovered automatically from the routing plane (including API roles from `role_name`/`anon_role`).
+
+## Declared public surface
+
+Some open reads are deliberate — pricing tables, reference data, a public user directory. Declare them and safegres treats them as intent instead of findings:
+
+```jsonc
+{
+  "public": {
+    "read": [
+      "app_public.plans*",        // schema.table globs
+      "app_public.event_types",
+      "app_public.users"          // deliberate public directory
+    ]
+  }
+}
+```
+
+- An open SELECT policy (`USING (true)` — rule A8) on a declared table is **acknowledged**: reported as info, excluded from the score.
+- An open read on any *undeclared* table stays a scored finding — even in a `*_public`-named schema. Naming is never treated as intent; the config declaration is.
+- `safegres doctor` warns about stale `public.read` patterns that no longer match any table.
+
+## Configuration
+
+safegres is configurable like a linter. Config is discovered by walking up from the current directory: `safegres.config.{ts,js,mjs,cjs}`, `.safegresrc{,.json,.yaml,.yml,.js}`, `safegres.json`, or a `"safegres"` key in package.json (via [confstash](https://github.com/constructive-io/dev-utils/tree/main/packages/confstash)).
+
+```jsonc
+// .safegresrc.json
+{
+  "extends": "safegres:recommended",
+  "excludeSchemas": ["archive"],
+  "rules": {
+    "A3": "off",            // disable a rule
+    "A5": "high",           // retune a severity
+    "P*": "medium"          // prefix wildcards
+  },
+  "overrides": [
+    { "tables": ["public.audit_*"], "rules": { "A2": "off" } }
+  ],
+  "scoring": { "weights": { "medium": 2 } },
+  "failOn": { "severity": "high", "grade": "B" }
+}
+```
+
+Or typed:
+
+```ts
+// safegres.config.ts
+import { defineConfig } from 'confstash';
+
+export default defineConfig({
+  extends: 'safegres:constructive',
+  rules: { A6: 'low' }
+});
+```
+
+### Presets
+
+| Preset | Behavior |
+| --- | --- |
+| `safegres:recommended` | Every rule at its default severity (the no-config behavior) |
+| `safegres:strict` | Everything escalated; fail-closed findings count 25% toward the score, `failOn: high` |
+| `safegres:constructive` | Auto-resolves exposure from the routing plane; R1/R2 watch `anonymous`; leak surfaces (A2, P5) critical; A3 off (API roles never own tables) |
+| `safegres:minimal` | Structural flags only (A1–A3) — fast CI smoke check |
+
+CLI: `--config <path>`, `--preset <name>`, `--rule CODE=off|severity` (repeatable).
+
+### Scoring
+
+Every report includes a config-driven score (0–100 + grade). The default **density** model normalizes by the exposed surface so large schemas don't saturate to 0/F:
+
+```
+score = 100 · exp(−k · riskPoints / exposedTables)
+```
+
+where `riskPoints` is the severity-weighted sum (critical 25, high 10, medium 4, low 1, info 0) of *exposed, fail-open* findings, and `k` defaults to 0.17 (≈ one critical per 10 exposed tables lands at a C). Non-exposed findings score 0; fail-closed findings score 0 unless `scoring.failClosedWeight` is raised; unknown exposure caps the score (`scoring.unknownExposureCap`, default 80). Any exposed critical floors the grade at C (`scoring.floorOnCritical`). The legacy flat-deduction model is available via `scoring.model: "weighted"`. Tune via `scoring.weights`, `scoring.perRuleWeights`, `scoring.densityK`, `scoring.gradeBands`. Gate CI with `--fail-on-score <n>` / `--fail-on-grade <g>` or `failOn` in config.
+
+### Other commands
+
+```bash
+safegres doctor        # diagnose config, parser, connection, catalog access, blind spots
+safegres print-config  # show the resolved effective config (--explain for per-key provenance)
+```
+
 ## Library use
 
 ```ts
@@ -60,6 +171,40 @@ console.log(renderPretty(report));
 console.log(`${report.findings.length} findings`);
 ```
 
+## pgpm projects
+
+For pgpm workspaces, safegres can deploy the workspace into an ephemeral test
+database and audit it — no running database or connection flags required
+(needs the optional peer dependency `pgsql-test`):
+
+```bash
+safegres audit --pgpm            # nearest pgpm module/workspace from cwd
+safegres audit --pgpm ./packages/my-db
+```
+
+Or as a jest test via the `safegres/pgpm-test` entrypoint:
+
+```ts
+import { auditPgpmWorkspace } from 'safegres/pgpm-test';
+
+it('passes the security audit', async () => {
+  const report = await auditPgpmWorkspace();
+  expect(report.score.grade).toBe('A+');
+});
+```
+
+Both discover the project's safegres config (`safegres.config.js`,
+`.safegresrc*`, …) by walking up from the workspace directory. pgpm projects
+usually don't have Constructive routing metadata, so declare the exposed
+surface statically:
+
+```json
+{
+  "extends": "safegres:recommended",
+  "exposure": { "schemas": ["app_public"] }
+}
+```
+
 ---
 
 ## Education and Tutorials

package/checks/anti-patterns.d.ts

@@ -21,16 +21,22 @@ export declare function checkVolatileFunctions(table: TableSnapshot, expr: PgAst
  */
 export declare function checkSessionUserGating(table: TableSnapshot, expr: PgAstNode, policyName: string): Finding[];
 /**
- * Anti-pattern A7: trivially-permissive policy body.
+ * Anti-patterns A7 / A8: trivially-permissive policy body.
  *
- * A permissive policy whose body is the literal `true` (and has no tightening
- * `WITH CHECK` clause) adds zero security — it's equivalent to not having RLS
- * at all for the covered command. This is different from an intentional
- * *restrictive* `true` (which would require all rows to satisfy it). We only
- * flag `permissive = true` here because Postgres defaults to PERMISSIVE and
- * `USING (true)` is the most common accidental "fail-open" shape.
+ * A permissive policy whose body is the literal `true` adds zero security —
+ * it's equivalent to not having RLS at all for the covered command. This is
+ * different from an intentional *restrictive* `true` (which would require
+ * all rows to satisfy it). We only flag `permissive = true` here because
+ * Postgres defaults to PERMISSIVE and `USING (true)` is the most common
+ * accidental "fail-open" shape.
  *
- * Severity: HIGH — any auditor should see this as RLS-not-actually-enforced.
+ * The verb matters enormously:
+ *   - A7 (critical): a WRITE verb (INSERT/UPDATE/DELETE/ALL) with literal
+ *     `true` lets every applicable role mutate every row — and, because
+ *     permissive policies OR together, it silently defeats any carefully
+ *     scoped policies on the same table.
+ *   - A8 (low): a SELECT-only `USING (true)` is the standard public-read
+ *     reference-table pattern; flag it for confirmation, not alarm.
  *
  * Input: the parsed USING and WITH CHECK ASTs (may be null if empty).
  */

package/checks/anti-patterns.js

@@ -5,9 +5,9 @@ exports.checkSessionUserGating = checkSessionUserGating;
 exports.checkTriviallyPermissive = checkTriviallyPermissive;
 exports.collectFunctionNames = collectFunctionNames;
 exports.parseOrNull = parseOrNull;
+const helpers_1 = require("../ast/helpers");
 const parse_1 = require("../ast/parse");
 const walk_1 = require("../ast/walk");
-const helpers_1 = require("../ast/helpers");
 /**
  * Function names we consider "safe" (stable) for policy predicates, even when
  * pg_proc marks them volatile. These are the well-known Postgres session
@@ -139,16 +139,22 @@ function checkSessionUserGating(table, expr, policyName) {
     return out;
 }
 /**
- * Anti-pattern A7: trivially-permissive policy body.
+ * Anti-patterns A7 / A8: trivially-permissive policy body.
  *
- * A permissive policy whose body is the literal `true` (and has no tightening
- * `WITH CHECK` clause) adds zero security — it's equivalent to not having RLS
- * at all for the covered command. This is different from an intentional
- * *restrictive* `true` (which would require all rows to satisfy it). We only
- * flag `permissive = true` here because Postgres defaults to PERMISSIVE and
- * `USING (true)` is the most common accidental "fail-open" shape.
+ * A permissive policy whose body is the literal `true` adds zero security —
+ * it's equivalent to not having RLS at all for the covered command. This is
+ * different from an intentional *restrictive* `true` (which would require
+ * all rows to satisfy it). We only flag `permissive = true` here because
+ * Postgres defaults to PERMISSIVE and `USING (true)` is the most common
+ * accidental "fail-open" shape.
  *
- * Severity: HIGH — any auditor should see this as RLS-not-actually-enforced.
+ * The verb matters enormously:
+ *   - A7 (critical): a WRITE verb (INSERT/UPDATE/DELETE/ALL) with literal
+ *     `true` lets every applicable role mutate every row — and, because
+ *     permissive policies OR together, it silently defeats any carefully
+ *     scoped policies on the same table.
+ *   - A8 (low): a SELECT-only `USING (true)` is the standard public-read
+ *     reference-table pattern; flag it for confirmation, not alarm.
  *
  * Input: the parsed USING and WITH CHECK ASTs (may be null if empty).
  */
@@ -181,17 +187,30 @@ function checkTriviallyPermissive(table, policy, usingAst, withCheckAst) {
     if (trivialClauses.length !== presentClauses.length)
         return null;
     const clauseList = trivialClauses.join(' and ');
-    return {
-        code: 'A7',
-        severity: 'high',
-        category: 'anti-pattern',
-        schema: table.schema,
-        table: table.name,
-        policy: policy.name,
-        message: `Policy "${policy.name}" on ${table.schema}.${table.name} is trivially permissive (${clauseList} = true)`,
-        hint: 'A permissive policy whose body is the literal `true` imposes no constraint. Either tighten the predicate (reference the authenticated user / membership) or drop the policy and use a GRANT REVOKE model.',
-        context: { cmd: policy.cmd, clauses: trivialClauses }
-    };
+    const isWrite = policy.cmd !== 'SELECT';
+    return isWrite
+        ? {
+            code: 'A7',
+            severity: 'critical',
+            category: 'anti-pattern',
+            schema: table.schema,
+            table: table.name,
+            policy: policy.name,
+            message: `Policy "${policy.name}" (FOR ${policy.cmd}) on ${table.schema}.${table.name} is trivially permissive (${clauseList} = true) — every applicable role can write every row`,
+            hint: 'Permissive policies OR together, so a literal-true write policy defeats every scoped policy on the table. Tighten the predicate or drop the policy.',
+            context: { cmd: policy.cmd, clauses: trivialClauses }
+        }
+        : {
+            code: 'A8',
+            severity: 'low',
+            category: 'anti-pattern',
+            schema: table.schema,
+            table: table.name,
+            policy: policy.name,
+            message: `Policy "${policy.name}" (FOR SELECT) on ${table.schema}.${table.name} is trivially permissive (${clauseList} = true) — all rows readable by applicable roles`,
+            hint: 'This is the standard public-read reference-table pattern. Confirm the table holds no per-tenant data; otherwise tighten the predicate.',
+            context: { cmd: policy.cmd, clauses: trivialClauses }
+        };
 }
 /**
  * Walk a policy expression, collecting unique function `(schema, name)` tuples

package/checks/role-trust.d.ts

@@ -0,0 +1,31 @@
+import type { TableSnapshot } from '../pg/introspect';
+import type { Finding } from '../types';
+/**
+ * Role-trust rules (R-series): findings driven by *who* is granted access,
+ * not just whether coverage exists. R1/R2 take a configurable list of
+ * untrusted roles (e.g. `anonymous`) via rule options; with no roles
+ * configured they are no-ops, so they cost nothing on databases without
+ * such a role model.
+ */
+export interface RoleTrustOptions {
+    /** Role names considered untrusted (exact match). */
+    roles?: string[];
+}
+/**
+ * R1: an untrusted role holds a write privilege on a table. Even with
+ * airtight policies, write access for e.g. `anonymous` is almost always a
+ * grant mistake — unauthenticated actors can INSERT/UPDATE/DELETE.
+ */
+export declare function checkUntrustedRoleWrites(table: TableSnapshot, options?: RoleTrustOptions): Finding[];
+/**
+ * R2: a permissive policy makes write operations pass RLS for an untrusted
+ * role (directly or via PUBLIC). Pairs with R1: the grant is the door, the
+ * policy is the unlocked latch.
+ */
+export declare function checkUntrustedRolePolicies(table: TableSnapshot, options?: RoleTrustOptions): Finding[];
+/**
+ * R3: a table with RLS enabled has grants TO PUBLIC. PUBLIC includes every
+ * present and future role, which silently widens access as roles are added
+ * and defeats role-scoped policy reasoning.
+ */
+export declare function checkPublicGrants(table: TableSnapshot): Finding[];

package/checks/role-trust.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkUntrustedRoleWrites = checkUntrustedRoleWrites;
+exports.checkUntrustedRolePolicies = checkUntrustedRolePolicies;
+exports.checkPublicGrants = checkPublicGrants;
+const WRITE_PRIVILEGES = ['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE'];
+/**
+ * R1: an untrusted role holds a write privilege on a table. Even with
+ * airtight policies, write access for e.g. `anonymous` is almost always a
+ * grant mistake — unauthenticated actors can INSERT/UPDATE/DELETE.
+ */
+function checkUntrustedRoleWrites(table, options = {}) {
+    const untrusted = new Set(options.roles ?? []);
+    if (untrusted.size === 0)
+        return [];
+    const out = [];
+    for (const grant of table.grants) {
+        if (!untrusted.has(grant.role))
+            continue;
+        if (!WRITE_PRIVILEGES.includes(grant.privilege))
+            continue;
+        out.push({
+            code: 'R1',
+            severity: 'critical',
+            category: 'anti-pattern',
+            schema: table.schema,
+            table: table.name,
+            role: grant.role,
+            privilege: grant.privilege,
+            message: `Untrusted role ${grant.role} has ${grant.privilege} grant on ${table.schema}.${table.name}`,
+            hint: `Revoke ${grant.privilege} from ${grant.role} unless unauthenticated writes to this table are intentional (e.g. a public signup or event-ingest table).`
+        });
+    }
+    return out;
+}
+/**
+ * R2: a permissive policy makes write operations pass RLS for an untrusted
+ * role (directly or via PUBLIC). Pairs with R1: the grant is the door, the
+ * policy is the unlocked latch.
+ */
+function checkUntrustedRolePolicies(table, options = {}) {
+    const untrusted = new Set(options.roles ?? []);
+    if (untrusted.size === 0 || !table.rlsEnabled)
+        return [];
+    const out = [];
+    for (const policy of table.policies) {
+        if (!policy.permissive)
+            continue;
+        if (policy.cmd === 'SELECT')
+            continue;
+        const applies = policy.roles.filter((r) => r === 'PUBLIC' || untrusted.has(r));
+        if (applies.length === 0)
+            continue;
+        const via = policy.roles.includes('PUBLIC') ? 'PUBLIC (all roles)' : applies.join(', ');
+        out.push({
+            code: 'R2',
+            severity: 'high',
+            category: 'anti-pattern',
+            schema: table.schema,
+            table: table.name,
+            policy: policy.name,
+            message: `Permissive ${policy.cmd} policy ${policy.name} on ${table.schema}.${table.name} applies to untrusted role via ${via}`,
+            hint: 'Scope the policy TO specific trusted roles instead of PUBLIC/untrusted roles, or verify unauthenticated writes are intended.'
+        });
+    }
+    return out;
+}
+/**
+ * R3: a table with RLS enabled has grants TO PUBLIC. PUBLIC includes every
+ * present and future role, which silently widens access as roles are added
+ * and defeats role-scoped policy reasoning.
+ */
+function checkPublicGrants(table) {
+    if (!table.rlsEnabled)
+        return [];
+    const publicPrivs = table.grants.filter((g) => g.role === 'PUBLIC').map((g) => g.privilege);
+    if (publicPrivs.length === 0)
+        return [];
+    return [
+        {
+            code: 'R3',
+            severity: 'medium',
+            category: 'anti-pattern',
+            schema: table.schema,
+            table: table.name,
+            role: 'PUBLIC',
+            message: `Table ${table.schema}.${table.name} has RLS enabled but grants ${publicPrivs.join(', ')} to PUBLIC`,
+            hint: 'Grant to specific roles instead of PUBLIC — PUBLIC includes every current and future role, including untrusted ones.'
+        }
+    ];
+}

package/cli/audit.js

@@ -1,19 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const logger_1 = require("@pgpmjs/logger");
-const pg_1 = require("pg");
-const pg_env_1 = require("pg-env");
 const audit_1 = require("../commands/audit");
+const loader_1 = require("../config/loader");
 const json_1 = require("../report/json");
 const pretty_1 = require("../report/pretty");
+const score_1 = require("../score/score");
 const types_1 = require("../types");
+const shared_1 = require("./shared");
 const log = new logger_1.Logger('safegres');
+/**
+ * `--pgpm` mode needs the optional peer dependency `pgsql-test`, so the
+ * helper module is loaded lazily with a friendly error when it's missing.
+ */
+function importPgpmTest() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        return require('../pgpm-test');
+    }
+    catch (err) {
+        if (err.code === 'MODULE_NOT_FOUND') {
+            log.error('--pgpm requires the optional peer dependency "pgsql-test" — install it (e.g. `npm i -D pgsql-test`) and retry');
+            process.exit(2);
+        }
+        throw err;
+    }
+}
 const usage = `
 safegres audit — pure-PostgreSQL RLS auditor
 
   safegres audit [OPTIONS]
 
 Connection (priority order, top wins):
+  --pgpm [dir]             No connection needed: deploy the pgpm workspace at
+                           [dir] (default: nearest from cwd) into an ephemeral
+                           test database and audit it (requires pgsql-test)
   --connection <url>       Full PostgreSQL connection string
   --host <host>            PostgreSQL host        (else PGHOST,    default localhost)
   --port <port>            PostgreSQL port        (else PGPORT,    default 5432)
@@ -21,6 +42,17 @@ Connection (priority order, top wins):
   --password <pw>          PostgreSQL password    (else PGPASSWORD,default password)
   --database <db>          PostgreSQL database    (else PGDATABASE,default postgres)
 
+Configuration:
+  --config <path>          Explicit config file (else discovered: safegres.config.{ts,js,mjs,cjs},
+                           .safegresrc{,.json,.yaml,.yml,.js}, safegres.json, package.json "safegres")
+  --preset <name>          Apply a built-in preset (recommended|strict|constructive|minimal)
+  --rule <CODE=SETTING>    Retune a rule (repeatable), e.g. --rule A3=off --rule A5=high
+
+Exposure (what the score is computed against):
+  --exposure-schemas <csv> Declare the API-exposed schemas; findings outside
+                           them become unscored internal advisories
+  --exposed-only           Hide internal (non-exposed) findings from output
+
 Audit options:
   --schemas <csv>          Limit to these schemas (default: all non-system)
   --exclude-schemas <csv>  Skip these schemas
@@ -29,35 +61,12 @@ Audit options:
   --format <fmt>           "pretty" (default) | "json" | "json-pretty"
   --fail-on <severity>     Exit non-zero if any finding >= severity
                            (critical|high|medium|low|info; default: none)
+  --fail-on-score <n>      Exit non-zero if the score is below n (0-100)
+  --fail-on-grade <g>      Exit non-zero if the grade is below g (A+|A|B|C|D)
   --skip-ast               Skip AST-level anti-pattern checks (faster)
   --no-color               Disable ANSI colors in pretty output
   --help, -h               Show this help message
 `;
-function csvList(value) {
-    if (typeof value !== 'string' || value.length === 0)
-        return undefined;
-    return value
-        .split(',')
-        .map((p) => p.trim())
-        .filter(Boolean);
-}
-function buildClient(argv) {
-    if (typeof argv.connection === 'string' && argv.connection.length > 0) {
-        return new pg_1.Client({ connectionString: argv.connection });
-    }
-    const overrides = {};
-    if (typeof argv.host === 'string')
-        overrides.host = argv.host;
-    if (typeof argv.port === 'number')
-        overrides.port = argv.port;
-    if (typeof argv.user === 'string')
-        overrides.user = argv.user;
-    if (typeof argv.password === 'string')
-        overrides.password = argv.password;
-    if (typeof argv.database === 'string')
-        overrides.database = argv.database;
-    return new pg_1.Client((0, pg_env_1.getPgEnvOptions)(overrides));
-}
 exports.default = async (argv, _prompter, _options) => {
     if (argv.help || argv.h) {
         process.stdout.write(usage);
@@ -65,46 +74,75 @@ exports.default = async (argv, _prompter, _options) => {
     }
     // minimist parses `--no-color` as `color: false`.
     const colorEnabled = argv.color !== false;
-    const client = buildClient(argv);
-    await client.connect();
-    try {
-        const report = await (0, audit_1.audit)(client, {
-            schemas: csvList(argv.schemas),
-            excludeSchemas: csvList(argv['exclude-schemas']),
-            includeRoles: csvList(argv.roles),
-            excludeRoles: csvList(argv['exclude-roles']),
-            skipAstChecks: argv['skip-ast'] === true
-        });
-        const fmt = typeof argv.format === 'string' ? argv.format : 'pretty';
-        let output;
-        switch (fmt) {
-            case 'json':
-                output = (0, json_1.renderJson)(report);
-                break;
-            case 'json-pretty':
-                output = (0, json_1.renderJson)(report, { pretty: true });
-                break;
-            case 'pretty':
-                output = (0, pretty_1.renderPretty)(report, { color: colorEnabled });
-                break;
-            default:
-                log.error(`Unknown --format: ${fmt}`);
-                process.exit(2);
+    const pgpmCwd = typeof argv.pgpm === 'string' ? argv.pgpm : undefined;
+    const { config } = (0, loader_1.loadConfig)({ cwd: pgpmCwd, ...(0, shared_1.configParamsFromArgv)(argv) });
+    const exposureSchemas = (0, shared_1.csvList)(argv['exposure-schemas']);
+    const auditOptions = {
+        schemas: (0, shared_1.csvList)(argv.schemas),
+        excludeSchemas: (0, shared_1.csvList)(argv['exclude-schemas']),
+        includeRoles: (0, shared_1.csvList)(argv.roles),
+        excludeRoles: (0, shared_1.csvList)(argv['exclude-roles']),
+        skipAstChecks: argv['skip-ast'] === true,
+        exposure: exposureSchemas
+            ? { ...config.exposure, schemas: exposureSchemas }
+            : undefined,
+        config
+    };
+    let report;
+    if (argv.pgpm) {
+        const { auditPgpmWorkspace } = importPgpmTest();
+        report = await auditPgpmWorkspace({ ...auditOptions, cwd: pgpmCwd });
+    }
+    else {
+        const client = (0, shared_1.buildClient)(argv);
+        await client.connect();
+        try {
+            report = await (0, audit_1.audit)(client, auditOptions);
         }
-        process.stdout.write(output);
-        process.stdout.write('\n');
-        const failOn = typeof argv['fail-on'] === 'string' ? argv['fail-on'] : undefined;
-        if (failOn) {
-            if (!(failOn in types_1.SEVERITY_ORDER)) {
-                log.error(`Unknown --fail-on severity: ${failOn}`);
-                process.exit(2);
-            }
-            if (report.findings.some((f) => (0, types_1.meetsThreshold)(f.severity, failOn))) {
-                process.exit(1);
-            }
+        finally {
+            await client.end();
         }
     }
-    finally {
-        await client.end();
+    if (argv['exposed-only'] === true) {
+        report.findings = report.findings.filter((f) => f.exposed !== false);
+        report.summary = (0, types_1.summarize)(report.findings);
+    }
+    const fmt = typeof argv.format === 'string' ? argv.format : 'pretty';
+    let output;
+    switch (fmt) {
+        case 'json':
+            output = (0, json_1.renderJson)(report);
+            break;
+        case 'json-pretty':
+            output = (0, json_1.renderJson)(report, { pretty: true });
+            break;
+        case 'pretty':
+            output = (0, pretty_1.renderPretty)(report, { color: colorEnabled });
+            break;
+        default:
+            log.error(`Unknown --format: ${fmt}`);
+            process.exit(2);
+    }
+    process.stdout.write(output);
+    process.stdout.write('\n');
+    const failOnSeverity = typeof argv['fail-on'] === 'string' ? argv['fail-on'] : config.failOn?.severity;
+    if (failOnSeverity) {
+        if (!(failOnSeverity in types_1.SEVERITY_ORDER)) {
+            log.error(`Unknown --fail-on severity: ${failOnSeverity}`);
+            process.exit(2);
+        }
+        if (report.findings.some((f) => (0, types_1.meetsThreshold)(f.severity, failOnSeverity))) {
+            process.exit(1);
+        }
+    }
+    const failOnScore = typeof argv['fail-on-score'] === 'number' ? argv['fail-on-score'] : config.failOn?.score;
+    if (failOnScore != null && report.score && report.score.value < failOnScore) {
+        log.error(`score ${report.score.value} is below --fail-on-score ${failOnScore}`);
+        process.exit(1);
+    }
+    const failOnGrade = typeof argv['fail-on-grade'] === 'string' ? argv['fail-on-grade'] : config.failOn?.grade;
+    if (failOnGrade && report.score && !(0, score_1.meetsGrade)(report.score.grade, failOnGrade)) {
+        log.error(`grade ${report.score.grade} is below --fail-on-grade ${failOnGrade}`);
+        process.exit(1);
     }
 };