@everystack/cli 0.4.44 → 0.4.46

package/src/cli/authz-canonical.ts

@@ -0,0 +1,178 @@
+/**
+ * authz-canonical — ONE definition of "these two authorization states are the same".
+ *
+ * Three surfaces answer that question and they must never answer it differently:
+ *
+ *   - `authz-reconcile`  — emits the SQL that closes the gap (statements == 0 means same)
+ *   - `authz-contract`   — reports drift (no findings means same)
+ *   - `schema-fingerprint` — content-addresses the state (equal hashes means same)
+ *
+ * They were two-and-a-half hand-mirrored copies, and that is exactly how the identity broke:
+ * the reconciler learned to exempt an ungoverned grantee, the fingerprint did not, and every
+ * brownfield adopter landed on "nothing to do" and "you have drifted" at the same time. The
+ * fingerprint is not a third opinion — it is this equivalence relation, cached. When the
+ * relation changes, the cache format changes with it.
+ *
+ * Two normalizations live here, and both are load-bearing:
+ *
+ * ROLE EXPANSION. A policy `TO a, b` and two identical-predicate policies `TO a` and `TO b`
+ * are applicable to precisely the same sessions, because Postgres selects policies per session
+ * role by membership. Expanding every policy to one entry per role makes those two states hash
+ * equal, which is what makes the reconciler's adoption of a role split legible to the gate.
+ *
+ * PUBLIC NEVER EXPANDS. It is an open set — every role that exists or ever will. Enumerating
+ * it at hash time against today's roles would rebuild, inside the fingerprint, exactly the
+ * contingent equivalence the matcher refuses: equal today, silently wrong the moment a role is
+ * created. It stays a single sentinel entry.
+ *
+ * MULTISET, NEVER A SET. Entries carry counts. If duplicates collapsed, two live policies with
+ * the same rule and different names would hash as one, the fingerprint would report MATCH, and
+ * the matcher — which adopts one and drops the other — would still emit statements. That is
+ * the same identity break in the opposite direction, and it is the harder one to notice.
+ */
+
+import type { PolicyContract, TableContract } from './authz-contract.js';
+import { effectivePolicyCheck, isPolicyDead, isPolicySubsumed } from './authz-contract.js';
+
+/** PostgreSQL's open role set, kept whole. */
+const PUBLIC_ROLE = 'public';
+
+/**
+ * One policy as (role, rule) entries — the form in which two equivalent states look equal.
+ * A PUBLIC policy yields exactly one entry; every other policy yields one per named role.
+ */
+function expandPolicy(p: PolicyContract): string[] {
+  const rule = stableRule(p);
+  if (p.roles.includes(PUBLIC_ROLE)) return [`${PUBLIC_ROLE}|${rule}`];
+  return [...p.roles].sort().map((r) => `${r}|${rule}`);
+}
+
+/**
+ * The rule, with the NAME deliberately absent.
+ *
+ * Names were the policy's identity in the v3 format, on the reasoning that the compiler emits
+ * them deterministically. That is true of a greenfield database and false of every brownfield
+ * one, where the previous migration tool chose the names. Hashing them made a live policy that
+ * carries the declared authorization under its own name read as a different state — so an
+ * adopter could reach zero statements and never reach MATCH.
+ *
+ * The check goes through the server's own defaulting rule, so a live `FOR ALL USING (true)`
+ * and a compiled `FOR ALL USING (true) WITH CHECK (true)` — the same authorization, written
+ * two ways — hash the same.
+ */
+function stableRule(p: PolicyContract): string {
+  return JSON.stringify([
+    p.command,
+    p.permissive,
+    p.using ?? '',
+    effectivePolicyCheck(p) ?? '',
+  ]);
+}
+
+/** Sorted multiset: every entry kept, duplicates counted, order irrelevant. */
+function multiset(entries: string[]): Array<[string, number]> {
+  const counts = new Map<string, number>();
+  for (const e of entries) counts.set(e, (counts.get(e) ?? 0) + 1);
+  return [...counts.entries()].sort(([a], [b]) => (a < b ? -1 : 1));
+}
+
+/**
+ * The canonical policy form: every policy expanded across its roles, as a sorted multiset.
+ *
+ * When a governed set is supplied (hashing a LIVE contract), per-role entries for roles the
+ * models do not govern are dropped — the SAME choice the reconciler makes when it leaves an
+ * ungoverned role's policy alone (the `reconcilePolicies` ungoverned escape). Hashing them
+ * would keep MATCH unreachable on any brownfield database whose previous stack left a policy
+ * TO a migrator/resolver role: zero statements, mismatched hash, forever. PUBLIC is a
+ * governed sentinel and always kept.
+ */
+export function canonicalPolicies(
+  policies: readonly PolicyContract[],
+  governed?: ReadonlySet<string>,
+): Array<[string, number]> {
+  const entries = policies.flatMap(expandPolicy);
+  const kept = governed
+    ? entries.filter((e) => {
+        const role = e.slice(0, e.indexOf('|'));
+        return governed.has(role) || role === PUBLIC_ROLE || (role.toUpperCase() === 'PUBLIC' && governed.has('PUBLIC'));
+      })
+    : entries;
+  return multiset(kept);
+}
+
+/**
+ * Keep only the grantees the models actually govern.
+ *
+ * The reconciler leaves an ungoverned grantee alone — a migrator, ETL or BI role the model
+ * vocabulary cannot name must not have its access destroyed by a plan nobody read. The hash
+ * has to make the same choice or it contradicts the plan: a live grant nothing will ever
+ * reconcile is not part of the state the models describe.
+ *
+ * `PUBLIC` compares case-insensitively (a pseudo-role with two catalog spellings); every other
+ * name compares exactly, because PostgreSQL role names are case-sensitive and `CREATE ROLE
+ * "Public"` is a real, distinct role.
+ */
+function governedOnly<T>(
+  map: Record<string, T> | undefined,
+  governed: ReadonlySet<string> | undefined,
+): Record<string, T> {
+  if (!map) return {};
+  if (!governed) return map;
+  return Object.fromEntries(
+    Object.entries(map).filter(([grantee]) =>
+      governed.has(grantee) || (grantee.toUpperCase() === 'PUBLIC' && governed.has('PUBLIC'))),
+  );
+}
+
+/**
+ * The canonical authorization form for one table.
+ *
+ * `governed` is the set the models declare. Pass it whenever hashing a LIVE contract, or the
+ * hash counts grants the reconciler will never touch and the state can never converge.
+ */
+export function canonicalAuthz(
+  contract: TableContract,
+  governed?: ReadonlySet<string>,
+): Record<string, unknown> {
+  const grants = governedOnly(contract.grants, governed);
+  const columnGrants = governedOnly(contract.columnGrants, governed);
+  return {
+    table: contract.table,
+    rls: { enabled: contract.rls.enabled, forced: contract.rls.forced },
+    grants: Object.fromEntries(
+      Object.entries(grants)
+        .map(([role, privs]) => [role, [...(privs as string[])].sort()] as const)
+        .sort(([a], [b]) => (a < b ? -1 : 1)),
+    ),
+    ...(Object.keys(columnGrants).length > 0
+      ? {
+          columnGrants: Object.fromEntries(
+            Object.entries(columnGrants)
+              .map(([role, byPriv]) => [
+                role,
+                Object.fromEntries(
+                  Object.entries(byPriv as Record<string, string[]>)
+                    .map(([priv, cols]) => [priv, [...cols].sort()] as const)
+                    .sort(([a], [b]) => (a < b ? -1 : 1)),
+                ),
+              ] as const)
+              .sort(([a], [b]) => (a < b ? -1 : 1)),
+          ),
+        }
+      : {}),
+    // A DEAD policy is not part of the state. It authorizes nothing (Postgres refuses at the
+    // GRANT before consulting it), and the reconciler now leaves it alone — so counting it
+    // here would keep MATCH unreachable on exactly the databases that have them: brownfield
+    // ones, where a previous stack left policies behind after its grants were revoked. Both
+    // surfaces make the same choice, from the same function. Deadness is recomputed against
+    // these grants every time, so the policy re-enters the state the moment a grant revives it.
+    // …and neither is a SUBSUMED one: a permissive policy whose rule an identical PUBLIC
+    // policy already applies to every role admits no session the other does not. Both
+    // exclusions are the same idea — a policy that changes no access is not part of the
+    // state — and both are made in lockstep with the reconciler, from the same functions.
+    policies: canonicalPolicies(
+      contract.policies.filter((p) => !isPolicyDead(contract, p) && !isPolicySubsumed(contract, p)),
+      governed,
+    ),
+  };
+}

package/src/cli/authz-compile.ts

@@ -20,7 +20,7 @@
  * Input is a `@everystack/model` ModelDescriptor (type-only — no runtime dep).
  */
 
-import type { ModelDescriptor, Ability } from '@everystack/model';
+import { isColumnAbility, type ModelDescriptor, type Ability } from '@everystack/model';
 import type { PolicyContract, TableContract, PolicyCommand } from './authz-contract.js';
 import { parenthesizeOnce } from './authz-contract.js';
 
@@ -198,32 +198,50 @@ function softDeleteColumn(model: ModelDescriptor): string | null {
 }
 
 /**
- * A column-scoped self read — `can('read', { owner, columns })`. It compiles to a COLUMN
- * grant (`GRANT SELECT (cols)`) plus a `<table>_select_self` policy, NOT a table grant and
- * NOT a `_select_own` policy: the row is scoped by the owner predicate, the fields by the
- * column list (`auth.users` → id/email/role to the owner, never the password hash). It is
- * excluded from the table-grant and owner-read paths so the two never double-emit.
+ * `can(…, { role: 'public' })` names PostgreSQL's PUBLIC pseudo-role, and the two catalogs
+ * that describe it spell it differently — both correctly:
+ *
+ *   - `pg_policies.roles` renders it as the literal `{public}` (lowercase)
+ *   - `aclexplode()` yields grantee OID 0, which GRANTS_SQL renders as `'PUBLIC'`
+ *
+ * So the compiler speaks each catalog's spelling on its own axis. Saying `public` on both
+ * made the grant set-difference see `public` and `PUBLIC` as two grantees and emit a REVOKE
+ * and a GRANT that cancel out — on every run, converging never.
+ *
+ * The fold is COMPILE-TIME ONLY, applied to the author's declared role. Nothing folds at
+ * comparison time: `CREATE ROLE "Public"` is a legal, distinct role, and a case-insensitive
+ * compare against a live grantee would silently conflate it with the pseudo-role. (The cost
+ * of that choice: a real role named `Public` cannot be named by `role:`, because a model
+ * string carries no way to say "quoted identifier".)
  */
-function isColumnRead(a: Ability): boolean {
-  return a.action === 'read' && Boolean(a.condition.owner) && Boolean(a.condition.columns?.length);
-}
+const isPseudoPublic = (role: string): boolean => role.toLowerCase() === 'public';
+
+/** The grant-side spelling of a declared role — what `aclexplode` would report. */
+const granteeKey = (role: string): string => (isPseudoPublic(role) ? 'PUBLIC' : role);
+
+/** The policy-side spelling of a declared role — what `pg_policies` would report. */
+const policyRole = (role: string): string => (isPseudoPublic(role) ? 'public' : role);
 
 /**
- * Column grants from the column-scoped read abilities: the read role (`authenticated`, since
- * the ability is owner-scoped, not role-gated) gets `SELECT (cols)`. Field keys are snake_cased
- * to SQL columns and sorted, matching the introspected contract. Returns undefined when no
- * ability declares columns — an introspected contract omits the key rather than carry an empty
- * object, so the compiled one must too (or the round-trip diff would false-fire).
+ * Column grants from column abilities. The action determines the PostgreSQL verb; the named role
+ * (or authenticated for an owner-only ability) is the grantee. Field keys are snake-cased and
+ * deduplicated, matching the introspected contract.
  */
 function compileColumnGrants(abilities: readonly Ability[]): Record<string, Record<string, string[]>> | undefined {
-  const out: Record<string, Record<string, string[]>> = {};
+  const out: Record<string, Record<string, Set<string>>> = {};
   for (const a of abilities) {
-    if (!isColumnRead(a)) continue;
-    const role = a.condition.role ?? 'authenticated';
-    const cols = [...a.condition.columns!].map(toSnakeCase).sort();
-    (out[role] ??= {}).SELECT = cols;
+    if (!isColumnAbility(a)) continue;
+    const role = granteeKey(a.condition.role ?? 'authenticated');
+    const verb = a.action === 'read' ? 'SELECT' : 'UPDATE';
+    const cols = ((out[role] ??= {})[verb] ??= new Set<string>());
+    for (const column of a.condition.columns!) cols.add(toSnakeCase(column));
+  }
+  const grants: Record<string, Record<string, string[]>> = {};
+  for (const [role, verbs] of Object.entries(out)) {
+    grants[role] = {};
+    for (const [verb, columns] of Object.entries(verbs)) grants[role][verb] = [...columns].sort();
   }
-  return Object.keys(out).length ? out : undefined;
+  return Object.keys(grants).length ? grants : undefined;
 }
 
 /**
@@ -310,13 +328,13 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
    * every other role can see.
    */
   const isRoleRead = (a: Ability): boolean =>
-    a.action === 'read' && Boolean(a.condition.role) && !isColumnRead(a);
+    a.action === 'read' && Boolean(a.condition.role) && !isColumnAbility(a);
 
   // Author-supplied predicates, per action. `manage` carries no predicate of its own —
   // it is the admin bypass — so only the specific verbs are consulted.
   const predFor = (action: Ability['action']): string | null => {
     for (const a of model.abilities) {
-      if (a.action !== action || isRoleRead(a)) continue;
+      if (a.action !== action || isRoleRead(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('${action}')`);
       if (p) return p;
     }
@@ -342,7 +360,7 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   /** The predicate the OWNER read narrows ITSELF by — `can('read', { owner, sql })`. */
   const ownerReadPred = (): string | null => {
     for (const a of model.abilities) {
-      if (a.action !== 'read' || !rowScoped(a) || isColumnRead(a)) continue;
+      if (a.action !== 'read' || !rowScoped(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('read', { owner })`);
       if (p) return p;
     }
@@ -362,12 +380,18 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   const abilities = model.abilities;
   const hasAdminManage = abilities.some((a) => a.action === 'manage' && a.condition.role === 'admin');
   const hasPublicRead = abilities.some((a) => a.action === 'read' && !a.condition.role && !rowScoped(a));
+  // The audience is open when the public read says so. Read off the SAME abilities that make
+  // `hasPublicRead` true, so the two can never disagree about which read is being compiled.
+  const publicAudience = abilities.some(
+    (a) => a.action === 'read' && !a.condition.role && !rowScoped(a) && a.condition.policyRoles === 'public',
+  );
   // A column-scoped read is row-scoped but emits a self policy + column grant, not the
   // full-row owner read — so it is excluded here and handled by its own branch.
-  const hasOwnerRead = abilities.some((a) => a.action === 'read' && rowScoped(a) && !isColumnRead(a));
-  const hasColumnRead = abilities.some(isColumnRead);
+  const hasOwnerRead = abilities.some((a) => a.action === 'read' && rowScoped(a) && !isColumnAbility(a));
+  const hasColumnOwnerRead = abilities.some((a) => a.action === 'read' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
   const canCreate = abilities.some((a) => a.action === 'create');
-  const hasUpdateOwner = abilities.some((a) => a.action === 'update' && rowScoped(a));
+  const hasUpdateOwner = abilities.some((a) => a.action === 'update' && rowScoped(a) && !isColumnAbility(a));
+  const hasColumnUpdateOwner = abilities.some((a) => a.action === 'update' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
   const hasDeleteOwner = abilities.some((a) => a.action === 'delete' && rowScoped(a));
 
   const t = model.table;
@@ -387,7 +411,6 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     // also see their own (soft-deleted) rows, hence the OR'd owner check.
     const readPred = publicReadPred();
     const anonUsing = andPredicates(sdGuard, readPred) ?? 'true';
-    policy(`${t}_select_anon`, 'SELECT', ['anon'], anonUsing, null);
 
     let authedUsing: string;
     if (hasOwnerRead && rowPred && anonUsing !== 'true') {
@@ -416,12 +439,34 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
         ? andPredicates(`(${sdGuard} OR ${rowPred})`, readPred)!
         : anonUsing;
     }
-    policy(`${t}_select_authenticated`, 'SELECT', ['authenticated'], authedUsing, null);
+    // ONE policy TO PUBLIC, when the model says the audience is open (B1).
+    //
+    // The two spellings are NOT equivalent and the difference is the whole point: PUBLIC is
+    // an open set, `{anon, authenticated}` is closed. A brownfield schema that wrote the
+    // ordinary Postgres idiom — one policy TO PUBLIC — had no way to say so, so every plan
+    // proposed dropping it for the role-scoped pair. That is a real narrowing: any role
+    // outside the pair loses the read.
+    //
+    // Emitted under the model's own name; identity-by-meaning adopts the live policy whose
+    // rule matches, whatever it is called, so a schema already carrying `<t>_read_public`
+    // reaches ZERO statements rather than a rename's DROP + CREATE.
+    //
+    // GRANTS ARE UNTOUCHED — they stay exactly as derived for anon/authenticated. An open
+    // audience over a closed grant set widens nothing: Postgres checks the GRANT first, so a
+    // role holding no SELECT still reads no rows no matter who the policy names.
+    if (publicAudience) {
+      policy(`${t}_select_public`, 'SELECT', ['public'], anonUsing, null);
+    } else {
+      policy(`${t}_select_anon`, 'SELECT', ['anon'], anonUsing, null);
+      policy(`${t}_select_authenticated`, 'SELECT', ['authenticated'], authedUsing, null);
+    }
   } else if (hasOwnerRead && rowPred) {
     // owner-scoped read — no anon visibility; you see only the rows you own
     // (directly, or transitively through a `via:` parent).
     policy(`${t}_select_own`, 'SELECT', ['authenticated'], andPredicates(rowPred, predFor('read'))!, null);
-  } else if (hasColumnRead && rowPred) {
+  }
+
+  if (hasColumnOwnerRead && rowPred) {
     // column-scoped self read — `authenticated` reads only its OWN row, and only the
     // granted columns (the GRANT scopes fields; this policy scopes rows). Named
     // `_select_self`, distinct from the full-row `_select_own`.
@@ -435,8 +480,11 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   // the model read as though it could see its own. The declared predicate was computed and
   // discarded. That is the same failure `rawPredicate` throws over, one level up: a predicate
   // that evaporates is an authorization hole wearing the costume of a working rule.
-  for (const a of abilities.filter(isRoleRead)) {
-    const role = a.condition.role!;
+  for (const a of abilities.filter((ability) => isRoleRead(ability) || (
+    isColumnAbility(ability) && ability.action === 'read' && Boolean(ability.condition.role)
+  ))) {
+    // The policy-side spelling, so `role: 'PUBLIC'` still matches what pg_policies reports.
+    const role = policyRole(a.condition.role!);
     const name = `${t}_select_${role}`;
     const where = `${table}: can('read', { role: '${role}' })`;
     if (policies.some((p) => p.name === name)) {
@@ -445,7 +493,16 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
         + `Declare one or the other: permissive policies OR together, so the role-scoped rule could only ever widen — never the narrowing it reads as.`,
       );
     }
-    policy(name, 'SELECT', [role], rawPredicate(a.condition.sql ?? a.condition.where, where) ?? 'true', null);
+    policy(
+      name,
+      'SELECT',
+      [role],
+      andPredicates(
+        rowScoped(a) ? rowPred : null,
+        rawPredicate(a.condition.sql ?? a.condition.where, where),
+      ) ?? 'true',
+      null,
+    );
   }
 
   // owner-gated writes. INSERT checks ownership (you can only create rows you own);
@@ -465,6 +522,27 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   if ((hasUpdateOwner || predFor('update')) && updatePred) {
     policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, checkFor('update') ?? updatePred);
   }
+  else if (hasColumnUpdateOwner && updatePred) {
+    policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, updatePred);
+  }
+  for (const a of abilities.filter((ability) =>
+    isColumnAbility(ability) && ability.action === 'update' && Boolean(ability.condition.role),
+  )) {
+    const role = policyRole(a.condition.role!);
+    const name = `${t}_update_${role}`;
+    const where = `${table}: can('update', { role: '${role}' })`;
+    if (policies.some((p) => p.name === name)) {
+      throw new Error(
+        `${where} collides with the ${name} policy already compiled from this model. `
+        + `Declare one update ability for that role: permissive policies OR together, so separate rules could only widen.`,
+      );
+    }
+    const using = andPredicates(
+      rowScoped(a) ? rowPred : null,
+      rawPredicate(a.condition.sql ?? a.condition.where, where),
+    ) ?? 'true';
+    policy(name, 'UPDATE', [role], using, rawPredicate(a.condition.check, `${where}, { check }`) ?? using);
+  }
   if ((hasDeleteOwner || predFor('delete')) && deletePred) {
     policy(`${t}_delete_own`, 'DELETE', ['authenticated'], deletePred, null);
   }
@@ -478,7 +556,7 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     // write on the owner connection and bypass RLS -> ENABLE-not-FORCE (on RDS the
     // owner is not a superuser, so a FORCEd table would block the owner's own writes).
     rls: { enabled: true, forced: model.writtenBy === 'app' },
-    grants: compileGrants(abilities),
+    grants: compileGrants(abilities, model.privileges),
     ...(compileColumnGrants(abilities) ? { columnGrants: compileColumnGrants(abilities) } : {}),
     policies,
   };
@@ -517,27 +595,39 @@ function verbsFor(action: Ability['action']): string[] {
  * table grants nothing, an owner-only table grants no anon SELECT, an admin-managed
  * table grants admin CRUD only. Deterministic: roles and privilege lists sorted,
  * so the output is byte-comparable with an introspected contract.
+ *
+ * `privileges` is the model's beyond-CRUD key — REFERENCES/TRIGGER/TRUNCATE, the table
+ * privileges `can()` has no verb for. They are UNIONED in, never subtracted: an admin that
+ * `can('manage')` and holds TRUNCATE keeps both. Without it, `manage` meant exactly CRUD and
+ * every live REFERENCES/TRIGGER/TRUNCATE read as drift, so the first plan against an existing
+ * schema revoked all three on every table — our spelling, not their schema.
  */
-function compileGrants(abilities: readonly Ability[]): Record<string, string[]> {
+function compileGrants(
+  abilities: readonly Ability[],
+  privileges: Record<string, readonly string[]> = {},
+): Record<string, string[]> {
   const grants: Record<string, Set<string>> = {};
-  const add = (role: string, verbs: string[]): void => {
+  const add = (role: string, verbs: readonly string[]): void => {
     const set = (grants[role] ??= new Set<string>());
     for (const v of verbs) set.add(v);
   };
   for (const a of abilities) {
-    // A column-scoped read grants `SELECT (cols)` (a column grant), not a table-level
-    // privilege — emitted by compileColumnGrants, skipped here so it never leaks a
-    // whole-table grant that would defeat the column scoping.
-    if (isColumnRead(a)) continue;
+    // A column ability grants only its listed columns, never a table-level privilege.
+    if (isColumnAbility(a)) continue;
     const verbs = verbsFor(a.action);
     if (a.condition.role) {
-      add(a.condition.role, verbs);
+      add(granteeKey(a.condition.role), verbs);
     } else {
       add('authenticated', verbs);
       // A public read (no role, not owner/via-scoped) is anon-visible.
       if (a.action === 'read' && !a.condition.owner && !a.condition.via) add('anon', ['SELECT']);
     }
   }
+  // The role is spelled on the GRANT axis, so `privileges: { public: [...] }` reaches the
+  // same grantee `aclexplode` reports as `PUBLIC` — the fold the ability path already does.
+  for (const [role, privs] of Object.entries(privileges)) {
+    if (privs.length) add(granteeKey(role), privs);
+  }
   const out: Record<string, string[]> = {};
   for (const role of Object.keys(grants).sort()) out[role] = [...grants[role]].sort();
   return out;