feat(safegres): consume @pgsql/lint instead of the bundled linter copy

[pyramation]

Summary

Repoint safegres's source-level convention linter at the now-published standalone package @pgsql/[email protected] (extracted in constructive-io/pgsql-parser#335), removing the duplicated copy that shipped in packages/safegres/src/lint/*. This is step two of "extract, then repoint" — the code was ported verbatim into @pgsql/lint, so this is a dependency swap, not a behavior change.

src/lint/index.ts becomes a thin re-export so nothing else in safegres changes — src/commands/audit.ts and the tests keep importing the same symbols from ../lint:

// packages/safegres/src/lint/index.ts  (was ~8 local files, now:)
export type { LintOptions, LintProblem, SuppressedProblem, /* … */ } from '@pgsql/lint';
export { LINT_RULES, LINT_RULES_BY_CODE, LINT_RULES_BY_ID,
         lintDefinition, parseUnit, Suppressions } from '@pgsql/lint';

Deleted (now sourced from @pgsql/lint): engine.ts, parse-unit.ts, suppressions.ts, types.ts, util.ts, rules/*. The audit.ts call site is unchanged:

const { problems, suppressed } = await lintDefinition(fn.definition, fn.language, subject, { rules: lintRuleIds });

@pgsql/lint's default suppression keywords are ['pgsql-lint', 'safegres'], so existing safegres-disable … waivers keep working (superset). The new severity field it attaches to problems is ignored by safegres, which maps findings through its own registry as before.

What stays in safegres

Everything database-dependent: catalog introspection (pg/*, pg_get_functiondef), audit orchestration, exposure/ACL/RLS analysis, scoring, preset/severity config, and finding mapping. safegres is now "the catalog adapter" over the shared engine.

Testing

• packages/safegres full suite: 399 tests pass (Postgres up via pgpm docker), including lint.test.ts (15, pure) and lint-audit.test.ts (6, end-to-end audit wiring) now running against @pgsql/lint.
• pnpm --filter safegres build + lint clean (2 pre-existing unrelated warnings in config/loader.ts).
• Lockfile diff is exactly the @pgsql/[email protected] entries (prettier-formatted to match repo style); its transitive deps reuse existing resolved versions.

Follow-up

None outstanding — this completes the extract-then-repoint arc (pgsql-parser#334 @pgsql/semantics, #335 @pgsql/lint, this PR).

Link to Devin session: https://app.devin.ai/sessions/af81a09043504701874ca63e67a9cd4b
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​pgsql/​lint@​18.1.0

View full report