@synapsor/runner 1.6.3 → 1.6.4

package/dist/runtime.mjs

@@ -184,6 +184,7 @@ var PROTECTED_READ_KEYS = /* @__PURE__ */ new Set([
   "generation_lock_fingerprint",
   "predicates",
   "relationship",
+  "relationships",
   "row_order_by",
   "aggregate",
   "limits"
@@ -202,6 +203,19 @@ var PROTECTED_RELATIONSHIP_KEYS = /* @__PURE__ */ new Set([
   "cardinality",
   "max_fan_out"
 ]);
+var PROTECTED_RELATIONSHIP_PATH_KEYS = /* @__PURE__ */ new Set(["name", "links"]);
+var PROTECTED_RELATIONSHIP_LINK_KEYS = /* @__PURE__ */ new Set([
+  "schema",
+  "table",
+  "primary_key",
+  "tenant_key",
+  "principal_scope_key",
+  "local_key",
+  "target_key",
+  "cardinality",
+  "max_fan_out",
+  "unmatched_rows"
+]);
 var PROTECTED_ROW_ORDER_KEYS = /* @__PURE__ */ new Set(["field", "direction"]);
 var PROTECTED_AGGREGATE_KEYS = /* @__PURE__ */ new Set([
   "counted_entity",
@@ -666,7 +680,18 @@ function validateProtectedRead(capability, path3, errors) {
   const keptOut = new Set(Array.isArray(capability.kept_out_fields) ? capability.kept_out_fields.filter((field) => typeof field === "string") : []);
   const subject = isRecord(capability.subject) ? capability.subject : {};
   const trustedScopeFields = new Set([subject.tenant_key, subject.principal_scope_key].filter((field) => isSafeIdentifier(field)));
-  const relationshipName = validateProtectedRelationship(protectedRead.relationship, keptOut, trustedScopeFields, `${path3}.protected_read.relationship`, errors);
+  const relationshipNames = /* @__PURE__ */ new Set();
+  const legacyRelationshipName = validateProtectedRelationship(protectedRead.relationship, keptOut, trustedScopeFields, `${path3}.protected_read.relationship`, errors);
+  if (legacyRelationshipName)
+    relationshipNames.add(legacyRelationshipName);
+  if (protectedRead.relationship !== void 0 && protectedRead.relationships !== void 0) {
+    errors.push({
+      path: `${path3}.protected_read`,
+      code: "PROTECTED_RELATIONSHIP_FORMS_CONFLICT",
+      message: "protected_read must use either legacy relationship or reviewed relationships, not both."
+    });
+  }
+  validateProtectedRelationshipPaths(protectedRead.relationships, keptOut, trustedScopeFields, `${path3}.protected_read.relationships`, relationshipNames, errors);
   if (!isRecord(capability.evidence) || capability.evidence.required !== true || capability.evidence.query_audit !== true) {
     errors.push({
       path: `${path3}.evidence`,
@@ -685,7 +710,7 @@ function validateProtectedRead(capability, path3, errors) {
           return;
         }
         checkUnknownKeys(predicate, PROTECTED_PREDICATE_KEYS, predicatePath, errors);
-        validateProtectedFieldReference(predicate.field, predicate.relationship, relationshipName, keptOut, trustedScopeFields, predicatePath, errors);
+        validateProtectedFieldReference(predicate.field, predicate.relationship, relationshipNames, keptOut, trustedScopeFields, predicatePath, errors);
         if (!["eq", "neq", "lt", "lte", "gt", "gte", "in"].includes(String(predicate.operator))) {
           errors.push({ path: `${predicatePath}.operator`, code: "INVALID_PROTECTED_PREDICATE_OPERATOR", message: "protected predicate operator must be eq, neq, lt, lte, gt, gte, or in." });
         }
@@ -745,7 +770,7 @@ function validateProtectedRead(capability, path3, errors) {
     validateProtectedAggregate(protectedRead.aggregate, {
       args,
       referencedArgs,
-      relationshipName,
+      relationshipNames,
       keptOut,
       trustedScopeFields,
       maxGroups: isRecord(protectedRead.limits) ? protectedRead.limits.max_groups : void 0,
@@ -788,6 +813,65 @@ function validateProtectedRelationship(value, keptOut, trustedScopeFields, path3
   }
   return isSafeIdentifier(value.name) ? value.name : void 0;
 }
+function validateProtectedRelationshipPaths(value, keptOut, trustedScopeFields, path3, relationshipNames, errors) {
+  if (value === void 0)
+    return;
+  if (!Array.isArray(value) || value.length < 1 || value.length > 3) {
+    errors.push({
+      path: path3,
+      code: "INVALID_PROTECTED_RELATIONSHIP_PATHS",
+      message: "protected relationships must contain 1 through 3 reviewed paths."
+    });
+    return;
+  }
+  value.forEach((candidate, pathIndex) => {
+    const candidatePath = `${path3}[${pathIndex}]`;
+    if (!isRecord(candidate)) {
+      errors.push({ path: candidatePath, code: "PROTECTED_RELATIONSHIP_PATH_NOT_OBJECT", message: "protected relationship path must be an object." });
+      return;
+    }
+    checkUnknownKeys(candidate, PROTECTED_RELATIONSHIP_PATH_KEYS, candidatePath, errors);
+    if (!isSafeIdentifier(candidate.name)) {
+      errors.push({ path: `${candidatePath}.name`, code: "INVALID_PROTECTED_RELATIONSHIP_IDENTIFIER", message: "relationship path name must be a fixed safe identifier." });
+    } else if (relationshipNames.has(candidate.name)) {
+      errors.push({ path: `${candidatePath}.name`, code: "DUPLICATE_PROTECTED_RELATIONSHIP", message: "protected relationship names must be unique." });
+    } else {
+      relationshipNames.add(candidate.name);
+    }
+    if (!Array.isArray(candidate.links) || candidate.links.length < 1 || candidate.links.length > 2) {
+      errors.push({ path: `${candidatePath}.links`, code: "INVALID_PROTECTED_RELATIONSHIP_LINKS", message: "a protected relationship path requires one or two reviewed many-to-one links." });
+      return;
+    }
+    candidate.links.forEach((link, linkIndex) => {
+      const linkPath = `${candidatePath}.links[${linkIndex}]`;
+      if (!isRecord(link)) {
+        errors.push({ path: linkPath, code: "PROTECTED_RELATIONSHIP_LINK_NOT_OBJECT", message: "protected relationship link must be an object." });
+        return;
+      }
+      checkUnknownKeys(link, PROTECTED_RELATIONSHIP_LINK_KEYS, linkPath, errors);
+      for (const key of ["schema", "table", "primary_key", "tenant_key", "local_key", "target_key"]) {
+        if (!isSafeIdentifier(link[key]))
+          errors.push({ path: `${linkPath}.${key}`, code: "INVALID_PROTECTED_RELATIONSHIP_IDENTIFIER", message: `${key} must be a fixed safe identifier.` });
+      }
+      if (link.principal_scope_key !== void 0 && !isSafeIdentifier(link.principal_scope_key)) {
+        errors.push({ path: `${linkPath}.principal_scope_key`, code: "INVALID_PROTECTED_RELATIONSHIP_IDENTIFIER", message: "principal_scope_key must be a fixed safe identifier." });
+      }
+      if (link.cardinality !== "many_to_one" || link.max_fan_out !== 1) {
+        errors.push({ path: linkPath, code: "PROTECTED_RELATIONSHIP_CARDINALITY_FORBIDDEN", message: "every protected relationship link must be reviewed many-to-one with max_fan_out 1." });
+      }
+      if (link.unmatched_rows !== "exclude" && link.unmatched_rows !== "keep_null") {
+        errors.push({ path: `${linkPath}.unmatched_rows`, code: "PROTECTED_RELATIONSHIP_NULL_SEMANTICS_REQUIRED", message: "every protected relationship link must freeze exclude or keep_null unmatched-row semantics." });
+      }
+      if (linkIndex === 0 && isSafeIdentifier(link.local_key) && (keptOut.has(link.local_key) || trustedScopeFields.has(link.local_key))) {
+        errors.push({
+          path: `${linkPath}.local_key`,
+          code: "PROTECTED_RELATIONSHIP_LOCAL_KEY_FORBIDDEN",
+          message: "the reviewed relationship cannot join through a kept-out or trusted-scope subject field."
+        });
+      }
+    });
+  });
+}
 function validateProtectedAggregate(value, input) {
   const { path: path3, errors } = input;
   if (!isRecord(value)) {
@@ -811,14 +895,14 @@ function validateProtectedAggregate(value, input) {
       validateUniqueIdentifier(measure.name, measureNames, `${measurePath}.name`, "DUPLICATE_PROTECTED_MEASURE_NAME", errors);
       if (!["count", "count_distinct", "sum", "avg"].includes(String(measure.function)))
         errors.push({ path: `${measurePath}.function`, code: "INVALID_PROTECTED_MEASURE_FUNCTION", message: "measure function must be count, count_distinct, sum, or avg." });
-      validateProtectedRelationshipReference(measure.relationship, input.relationshipName, `${measurePath}.relationship`, errors);
+      validateProtectedRelationshipReference(measure.relationship, input.relationshipNames, `${measurePath}.relationship`, errors);
       if (measure.function === "count") {
         if (measure.field !== void 0)
           errors.push({ path: `${measurePath}.field`, code: "PROTECTED_COUNT_FIELD_FORBIDDEN", message: "count measures count scoped subject rows and must not declare a field." });
         if (measure.relationship !== void 0)
           errors.push({ path: `${measurePath}.relationship`, code: "PROTECTED_COUNT_RELATIONSHIP_FORBIDDEN", message: "count measures count the scoped subject entity, not a joined relation." });
       } else {
-        validateProtectedFieldReference(measure.field, measure.relationship, input.relationshipName, input.keptOut, input.trustedScopeFields, measurePath, errors);
+        validateProtectedFieldReference(measure.field, measure.relationship, input.relationshipNames, input.keptOut, input.trustedScopeFields, measurePath, errors);
       }
     });
   }
@@ -835,7 +919,7 @@ function validateProtectedAggregate(value, input) {
         }
         checkUnknownKeys(dimension, PROTECTED_DIMENSION_KEYS, dimensionPath, errors);
         validateUniqueIdentifier(dimension.name, dimensionNames, `${dimensionPath}.name`, "DUPLICATE_PROTECTED_DIMENSION_NAME", errors);
-        validateProtectedFieldReference(dimension.field, dimension.relationship, input.relationshipName, input.keptOut, input.trustedScopeFields, dimensionPath, errors);
+        validateProtectedFieldReference(dimension.field, dimension.relationship, input.relationshipNames, input.keptOut, input.trustedScopeFields, dimensionPath, errors);
       });
     }
   }
@@ -849,7 +933,7 @@ function validateProtectedAggregate(value, input) {
         errors.push({ path: `${bucketPath}.name`, code: "INVALID_PROTECTED_TIME_BUCKET_NAME", message: "time bucket name must be a safe identifier." });
       if (value.time_bucket.bucket !== "day" && value.time_bucket.bucket !== "week" && value.time_bucket.bucket !== "month")
         errors.push({ path: `${bucketPath}.bucket`, code: "INVALID_PROTECTED_TIME_BUCKET", message: "time bucket must be day, week, or month." });
-      validateProtectedFieldReference(value.time_bucket.field, value.time_bucket.relationship, input.relationshipName, input.keptOut, input.trustedScopeFields, bucketPath, errors);
+      validateProtectedFieldReference(value.time_bucket.field, value.time_bucket.relationship, input.relationshipNames, input.keptOut, input.trustedScopeFields, bucketPath, errors);
     }
   }
   if (value.comparison !== void 0) {
@@ -858,7 +942,7 @@ function validateProtectedAggregate(value, input) {
       errors.push({ path: comparisonPath, code: "PROTECTED_COMPARISON_NOT_OBJECT", message: "comparison must be an object." });
     } else {
       checkUnknownKeys(value.comparison, PROTECTED_COMPARISON_KEYS, comparisonPath, errors);
-      validateProtectedFieldReference(value.comparison.field, value.comparison.relationship, input.relationshipName, input.keptOut, input.trustedScopeFields, comparisonPath, errors);
+      validateProtectedFieldReference(value.comparison.field, value.comparison.relationship, input.relationshipNames, input.keptOut, input.trustedScopeFields, comparisonPath, errors);
       if (!Array.isArray(value.comparison.ranges) || value.comparison.ranges.length < 1 || value.comparison.ranges.length > 2) {
         errors.push({ path: `${comparisonPath}.ranges`, code: "INVALID_PROTECTED_COMPARISON_RANGES", message: "comparison requires one or two bounded time ranges." });
       } else {
@@ -949,19 +1033,20 @@ function validateProtectedValue(value, args, referencedArgs, path3, errors) {
     }
   }
 }
-function validateProtectedFieldReference(field, relationship, relationshipName, keptOut, trustedScopeFields, path3, errors) {
+function validateProtectedFieldReference(field, relationship, relationshipNames, keptOut, trustedScopeFields, path3, errors) {
   if (!isSafeIdentifier(field)) {
     errors.push({ path: `${path3}.field`, code: "INVALID_PROTECTED_FIELD", message: "protected field must be a fixed safe identifier." });
   } else if (relationship === void 0 && (keptOut.has(field) || trustedScopeFields.has(field))) {
     errors.push({ path: `${path3}.field`, code: "PROTECTED_FIELD_FORBIDDEN", message: "kept-out and trusted-scope fields cannot be selected, filtered, grouped, sorted, joined, aggregated, or counted distinctly." });
   }
-  validateProtectedRelationshipReference(relationship, relationshipName, `${path3}.relationship`, errors);
+  validateProtectedRelationshipReference(relationship, relationshipNames, `${path3}.relationship`, errors);
 }
-function validateProtectedRelationshipReference(value, relationshipName, path3, errors) {
+function validateProtectedRelationshipReference(value, relationshipNames, path3, errors) {
   if (value === void 0)
     return;
-  if (!isSafeIdentifier(value) || value !== relationshipName)
-    errors.push({ path: path3, code: "UNKNOWN_PROTECTED_RELATIONSHIP", message: "relationship must reference the capability's one reviewed many-to-one relationship." });
+  if (!isSafeIdentifier(value) || !relationshipNames.has(value)) {
+    errors.push({ path: path3, code: "UNKNOWN_PROTECTED_RELATIONSHIP", message: "relationship must reference one of the capability's reviewed many-to-one paths." });
+  }
 }
 function validateUniqueIdentifier(value, seen, path3, code, errors) {
   if (!isSafeIdentifier(value)) {
@@ -2191,7 +2276,7 @@ function validateRunnerCapabilityConfig(input) {
   );
   validateNotifications(input.notifications, strict, errors);
   validateSupervisedWorker(input.supervised_worker, input, strict, errors);
-  validateProposalFreshness(input.proposal_freshness, input.capabilities, strict, errors);
+  validateProposalFreshness(input.proposal_freshness, input.capabilities, strict, errors, hasContracts);
   validateEffectiveContextCompatibility(input.trusted_context, input.contexts, input.capabilities, errors);
   validateApprovalPolicyReferences(input.capabilities, input.policies, errors);
   validateWritebackReadiness(input.sources, input.capabilities, input.mode, errors, warnings);
@@ -3597,7 +3682,7 @@ function validateCapabilities2(value, sources, contexts, executors, mode, strict
     capabilityNames.set(capability.name, index);
   });
 }
-function validateProposalFreshness(value, capabilitiesValue, strict, errors) {
+function validateProposalFreshness(value, capabilitiesValue, strict, errors, hasContracts = false) {
   if (value === void 0) return;
   if (!isRecord2(value)) {
     errors.push({
@@ -3625,7 +3710,9 @@ function validateProposalFreshness(value, capabilitiesValue, strict, errors) {
     }
     const proposal = byName.get(proposalName);
     if (!proposal) {
-      errors.push({ path: path3, code: "FRESHNESS_PROPOSAL_UNKNOWN", message: `Freshness policy references unknown proposal capability ${proposalName}.` });
+      if (!hasContracts) {
+        errors.push({ path: path3, code: "FRESHNESS_PROPOSAL_UNKNOWN", message: `Freshness policy references unknown proposal capability ${proposalName}.` });
+      }
       continue;
     }
     if (proposal.kind !== "proposal") {
@@ -3675,7 +3762,9 @@ function validateProposalFreshness(value, capabilitiesValue, strict, errors) {
       }
       const dependency = byName.get(String(rawDependency.capability));
       if (!dependency) {
-        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_UNKNOWN", message: `Unknown supporting capability ${String(rawDependency.capability)}.` });
+        if (!hasContracts) {
+          errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_UNKNOWN", message: `Unknown supporting capability ${String(rawDependency.capability)}.` });
+        }
         continue;
       }
       if (dependency.kind !== "read" || dependency.protected_read !== void 0 || dependency.aggregate !== void 0) {
@@ -6246,10 +6335,16 @@ function quotePostgresIdentifier(identifier) {
   return `"${identifier}"`;
 }
 async function inspectPostgresRlsTarget(client, input) {
+  return inspectPostgresRlsTargetInternal(client, input, /* @__PURE__ */ new Set());
+}
+async function inspectPostgresRlsTargetInternal(client, input, ancestors) {
+  const targetKey = `${input.schema}.${input.table}`;
   const metadata = await client.query(
     `SELECT
        current_user AS role,
        c.oid::text AS table_oid,
+       c.relkind AS relation_kind,
+       c.reloptions AS relation_options,
        c.relrowsecurity AS row_security_enabled,
        c.relforcerowsecurity AS force_row_security,
        owner.rolname = current_user AS role_is_table_owner,
@@ -6259,19 +6354,26 @@ async function inspectPostgresRlsTarget(client, input) {
      JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
      JOIN pg_catalog.pg_roles owner ON owner.oid = c.relowner
      JOIN pg_catalog.pg_roles current_role_info ON current_role_info.rolname = current_user
-     WHERE n.nspname = $1 AND c.relname = $2 AND c.relkind IN ('r', 'p')
+     WHERE n.nspname = $1 AND c.relname = $2 AND c.relkind IN ('r', 'p', 'v')
      LIMIT 1`,
     [input.schema, input.table]
   );
   const row = metadata.rows[0];
+  const relationKind = row?.relation_kind === "v" ? "view" : row?.relation_kind === "p" ? "partitioned_table" : "table";
+  const relationOptions = Array.isArray(row?.relation_options) ? row.relation_options.filter((value) => typeof value === "string") : [];
   const requiredOperations = [...new Set(input.operations)].sort();
   const report = {
     schema: input.schema,
     table: input.table,
+    ...row ? { target_kind: relationKind } : {},
     role: typeof row?.role === "string" ? row.role : "unknown",
     table_exists: Boolean(row),
     row_security_enabled: row?.row_security_enabled === true,
     force_row_security: row?.force_row_security === true,
+    ...relationKind === "view" && row ? {
+      security_invoker: relationOptions.includes("security_invoker=true"),
+      security_barrier: relationOptions.includes("security_barrier=true")
+    } : {},
     role_is_superuser: row?.role_is_superuser === true,
     role_has_bypassrls: row?.role_has_bypassrls === true,
     role_is_table_owner: row?.role_is_table_owner === true,
@@ -6286,6 +6388,70 @@ async function inspectPostgresRlsTarget(client, input) {
     report.errors.push("POSTGRES_RLS_TARGET_NOT_FOUND");
     return report;
   }
+  if (relationKind === "view") {
+    if (ancestors.has(targetKey)) {
+      report.errors.push("POSTGRES_RLS_VIEW_DEPENDENCY_CYCLE");
+      return report;
+    }
+    if (requiredOperations.some((operation) => operation !== "SELECT")) {
+      report.errors.push("POSTGRES_RLS_VIEW_READ_ONLY_REQUIRED");
+    }
+    if (!report.security_invoker) report.errors.push("POSTGRES_RLS_VIEW_SECURITY_INVOKER_REQUIRED");
+    if (!report.security_barrier) report.errors.push("POSTGRES_RLS_VIEW_SECURITY_BARRIER_REQUIRED");
+    if (report.role_is_superuser) report.errors.push("POSTGRES_RLS_ROLE_SUPERUSER");
+    if (report.role_has_bypassrls) report.errors.push("POSTGRES_RLS_ROLE_BYPASSRLS");
+    if (report.role_is_table_owner) report.errors.push("POSTGRES_RLS_ROLE_TABLE_OWNER");
+    const dependencies = await client.query(
+      `SELECT DISTINCT
+         dependency_namespace.nspname AS schema_name,
+         dependency_relation.relname AS relation_name,
+         dependency_relation.relkind AS relation_kind
+       FROM pg_catalog.pg_rewrite rewrite
+       JOIN pg_catalog.pg_depend dependency
+         ON dependency.classid = 'pg_rewrite'::regclass
+        AND dependency.objid = rewrite.oid
+        AND dependency.refclassid = 'pg_class'::regclass
+       JOIN pg_catalog.pg_class dependency_relation
+         ON dependency_relation.oid = dependency.refobjid
+       JOIN pg_catalog.pg_namespace dependency_namespace
+         ON dependency_namespace.oid = dependency_relation.relnamespace
+       WHERE rewrite.ev_class = $1::oid
+         AND dependency.deptype = 'n'
+         AND dependency.refobjid <> rewrite.ev_class
+         AND dependency_relation.relkind IN ('r', 'p', 'v')
+       ORDER BY dependency_namespace.nspname, dependency_relation.relname`,
+      [row.table_oid]
+    );
+    if (!dependencies.rows.length) report.errors.push("POSTGRES_RLS_VIEW_DEPENDENCIES_UNVERIFIED");
+    const nextAncestors = new Set(ancestors);
+    nextAncestors.add(targetKey);
+    report.referenced_relations = [];
+    for (const dependency of dependencies.rows) {
+      if (typeof dependency.schema_name !== "string" || typeof dependency.relation_name !== "string") {
+        report.errors.push("POSTGRES_RLS_VIEW_DEPENDENCIES_UNVERIFIED");
+        continue;
+      }
+      const dependencyReport = await inspectPostgresRlsTargetInternal(client, {
+        schema: dependency.schema_name,
+        table: dependency.relation_name,
+        scope: input.scope,
+        operations: ["SELECT"]
+      }, nextAncestors);
+      report.referenced_relations.push({
+        schema: dependencyReport.schema,
+        table: dependencyReport.table,
+        ...dependencyReport.target_kind ? { target_kind: dependencyReport.target_kind } : {},
+        ok: dependencyReport.ok,
+        errors: dependencyReport.errors
+      });
+      for (const error of dependencyReport.errors) {
+        report.errors.push(`POSTGRES_RLS_VIEW_DEPENDENCY_FAILED:${dependencyReport.schema}.${dependencyReport.table}:${error}`);
+      }
+    }
+    report.errors = [...new Set(report.errors)];
+    report.ok = report.errors.length === 0;
+    return report;
+  }
   const policies = await client.query(
     `SELECT
        p.polname AS name,
@@ -13435,10 +13601,22 @@ var HIGH_CONFIDENCE_RULES = [
       "paymentmethod",
       "paymentinstrument",
       "paymentdetails",
+      "paymentcard",
+      "cardonfile",
+      "cardholder",
+      "cardholdername",
+      "cardexpiry",
+      "cardexpiration",
       "cardnumber",
+      "fullpan",
       "creditcard",
       "debitcard",
       "cardtoken",
+      "card",
+      "cc",
+      "ccnumber",
+      "ccnum",
+      "pan",
       "cvv",
       "cvc",
       "bankaccount",
@@ -13493,6 +13671,7 @@ var HIGH_CONFIDENCE_RULES = [
       "phone",
       "phonenumber",
       "telephone",
+      "address",
       "streetaddress",
       "homeaddress",
       "mailingaddress",
@@ -13596,7 +13775,15 @@ function rule(code, reason, patterns) {
   return {
     code,
     reason,
-    matches: (value) => patterns.some((pattern) => value.compact.includes(pattern) || value.descriptionCompact.includes(pattern))
+    matches: (value) => patterns.some((pattern) => {
+      if (pattern === "pan" || pattern === "cc" || pattern === "card") {
+        return value.compact === pattern || value.descriptionTokens.has(pattern);
+      }
+      if (pattern.length <= 4) {
+        return value.compact === pattern || value.tokens.has(pattern) || value.descriptionTokens.has(pattern);
+      }
+      return value.compact.includes(pattern) || value.descriptionCompact.includes(pattern);
+    })
   };
 }
 function normalizeEvidence(input) {
@@ -13606,6 +13793,7 @@ function normalizeEvidence(input) {
     compact: identifier.replaceAll("_", ""),
     tokens: new Set(identifier.split("_").filter(Boolean)),
     descriptionCompact: description.replaceAll("_", ""),
+    descriptionTokens: new Set(description.split("_").filter(Boolean)),
     dataType: String(input.dataType ?? "").trim().toLowerCase()
   };
 }
@@ -13669,7 +13857,22 @@ function rolePostureFingerprint(inspection) {
     }))
   });
 }
-var TENANT_COLUMNS = /* @__PURE__ */ new Set(["tenant_id", "account_id", "organization_id", "org_id", "workspace_id", "customer_id"]);
+var TENANT_COLUMNS = /* @__PURE__ */ new Set([
+  "tenant_id",
+  "account_id",
+  "organization_id",
+  "org_id",
+  "workspace_id",
+  "customer_id",
+  "merchant_id",
+  "store_id",
+  "company_id",
+  "team_id",
+  "facility_id",
+  "property_id",
+  "clinic_id",
+  "project_id"
+]);
 var CONFLICT_COLUMNS = /* @__PURE__ */ new Set(["updated_at", "modified_at", "row_version", "version", "lock_version", "etag"]);
 var IMMUTABLE_COLUMNS = /* @__PURE__ */ new Set(["id", "uuid", "created_at", "created_by"]);
 var LARGE_OR_BINARY_TYPES = /* @__PURE__ */ new Set([
@@ -13906,7 +14109,7 @@ async function inspectMysql(options) {
     const [versionRows] = await connection.query("SELECT VERSION() AS version, CURRENT_USER() AS `current_user`");
     const schemaParam = options.schema ?? null;
     const [schemaRows] = await connection.query(
-      `SELECT schema_name FROM information_schema.schemata
+      `SELECT schema_name AS schema_name FROM information_schema.schemata
        WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys')
        ORDER BY schema_name`
     );
@@ -13922,8 +14125,8 @@ async function inspectMysql(options) {
     );
     const [columnRows] = await connection.query(
       `SELECT table_schema AS \`schema\`, table_name AS table_name, column_name AS name,
-              data_type, column_type AS udt_name, is_nullable,
-              column_default, extra AS is_generated, extra AS is_identity,
+              data_type AS data_type, column_type AS udt_name, is_nullable AS is_nullable,
+              column_default AS column_default, extra AS is_generated, extra AS is_identity,
               ordinal_position AS ordinal_position, column_comment AS comment
        FROM information_schema.columns
        WHERE table_schema NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys')
@@ -17430,8 +17633,8 @@ async function preflightPostgresDatabaseScope(inputConfig, env = process.env, cr
     }
   }
 }
-var SUPPORTED_GENERATED_AUTHORITY_COMPILER_VERSIONS = /* @__PURE__ */ new Set(["1.6.0", "1.6.3"]);
-var SUPPORTED_GENERATED_AUTHORITY_SPEC_VERSIONS = /* @__PURE__ */ new Set(["1.5.0", "1.5.1", "1.6.0"]);
+var SUPPORTED_GENERATED_AUTHORITY_COMPILER_VERSIONS = /* @__PURE__ */ new Set(["1.6.0", "1.6.3", "1.6.4"]);
+var SUPPORTED_GENERATED_AUTHORITY_SPEC_VERSIONS = /* @__PURE__ */ new Set(["1.5.0", "1.5.1", "1.6.0", "1.7.0"]);
 async function preflightGeneratedAuthority(inputConfig, env = process.env, inspect = inspectDatabase) {
   const config = resolveRuntimeConfig(inputConfig);
   const protectedCapabilities = localCapabilities(config).filter((capability) => capability.protected_read);
@@ -17472,20 +17675,37 @@ async function preflightGeneratedAuthority(inputConfig, env = process.env, inspe
   const inspection = await inspect({
     engine: lock.engine,
     databaseUrlEnv: lock.source_env,
+    ...lock.inspected_schema ? { schema: lock.inspected_schema } : {},
     statementTimeoutMs: Math.min(...protectedCapabilities.map((capability) => capability.protected_read.limits.statement_timeout_ms)),
     env
   });
-  const schemaFingerprint = schemaFingerprintForInspection(inspection);
-  const postureFingerprint = rolePostureFingerprint(inspection);
-  const changes = [
-    ...schemaFingerprint !== lock.schema_fingerprint ? ["schema metadata"] : [],
-    ...postureFingerprint !== lock.role_posture_fingerprint ? ["database role, grants, ownership, or RLS posture"] : []
-  ];
-  if (changes.length > 0) {
-    throw new McpRuntimeError(
-      "GENERATED_AUTHORITY_DRIFT",
-      `Generated protected authority is stale because ${changes.join(" and ")} changed. Rescan, review the semantic diff, regenerate, and activate a new digest.`
-    );
+  if (lock.authority_dependencies) {
+    if (credentialPostureFingerprintForGeneratedAuthority(inspection) !== lock.authority_dependencies.credential_posture_fingerprint) {
+      throw new McpRuntimeError(
+        "GENERATED_AUTHORITY_DRIFT",
+        "Generated protected authority is stale because the database credential posture changed. Rescan, review, and activate a new digest."
+      );
+    }
+    for (const capability of protectedCapabilities) {
+      assertProtectedCapabilityDependenciesCurrent(
+        capability,
+        lock.authority_dependencies,
+        inspection
+      );
+    }
+  } else {
+    const schemaFingerprint = schemaFingerprintForInspection(inspection);
+    const postureFingerprint = rolePostureFingerprint(inspection);
+    const changes = [
+      ...schemaFingerprint !== lock.schema_fingerprint ? ["schema metadata"] : [],
+      ...postureFingerprint !== lock.role_posture_fingerprint ? ["database role, grants, ownership, or RLS posture"] : []
+    ];
+    if (changes.length > 0) {
+      throw new McpRuntimeError(
+        "GENERATED_AUTHORITY_DRIFT",
+        `Generated protected authority is stale because ${changes.join(" and ")} changed. Rescan, review the semantic diff, regenerate, and activate a new digest.`
+      );
+    }
   }
   const role = inspection.role_posture;
   if (!role?.verified || !role.read_only || role.superuser !== false || role.bypass_rls !== false || role.writable_relations.length > 0 || role.owned_relations.length > 0) {
@@ -17497,13 +17717,194 @@ async function preflightGeneratedAuthority(inputConfig, env = process.env, inspe
 }
 function assertGeneratedAuthorityLockShape(value) {
   const digest = /^sha256:[a-f0-9]{64}$/;
-  if (!value || value.schema_version !== "synapsor.generation-lock.v1" || !SUPPORTED_GENERATED_AUTHORITY_COMPILER_VERSIONS.has(value.compiler_version) || !SUPPORTED_GENERATED_AUTHORITY_SPEC_VERSIONS.has(value.spec_version) || value.engine !== "postgres" && value.engine !== "mysql" || !/^[A-Z_][A-Z0-9_]*$/.test(value.source_env) || !digest.test(value.schema_fingerprint) || !digest.test(value.role_posture_fingerprint) || !digest.test(value.evidence_fingerprint) || !digest.test(value.generated_contract_digest) || !digest.test(value.reviewed_overrides_digest) || !Array.isArray(value.protected_authority) || value.protected_authority.some((item) => typeof item !== "string")) {
+  if (!value || value.schema_version !== "synapsor.generation-lock.v1" || !SUPPORTED_GENERATED_AUTHORITY_COMPILER_VERSIONS.has(value.compiler_version) || !SUPPORTED_GENERATED_AUTHORITY_SPEC_VERSIONS.has(value.spec_version) || value.engine !== "postgres" && value.engine !== "mysql" || !/^[A-Z_][A-Z0-9_]*$/.test(value.source_env) || value.inspected_schema !== void 0 && (typeof value.inspected_schema !== "string" || !value.inspected_schema) || !digest.test(value.schema_fingerprint) || !digest.test(value.role_posture_fingerprint) || !digest.test(value.evidence_fingerprint) || !digest.test(value.generated_contract_digest) || !digest.test(value.reviewed_overrides_digest) || !Array.isArray(value.protected_authority) || value.protected_authority.some((item) => typeof item !== "string") || value.authority_dependencies !== void 0 && !generatedAuthorityDependenciesValid(value.authority_dependencies, digest)) {
     throw new McpRuntimeError(
       "GENERATION_LOCK_INVALID",
       "The generated-authority lock is malformed or belongs to an unsupported compiler/spec version."
     );
   }
 }
+function generatedAuthorityDependenciesValid(value, digest) {
+  if (!value || value.schema_version !== "synapsor.authority-dependencies.v1" || !digest.test(value.credential_posture_fingerprint) || !isRecord5(value.resources) || !isRecord5(value.relationships)) {
+    return false;
+  }
+  for (const dependency of Object.values(value.resources)) {
+    if (!dependency || typeof dependency.schema !== "string" || typeof dependency.table !== "string" || !Array.isArray(dependency.fields) || dependency.fields.some((field) => typeof field !== "string") || !digest.test(dependency.fingerprint)) {
+      return false;
+    }
+  }
+  for (const dependency of Object.values(value.relationships)) {
+    if (!dependency || typeof dependency.root_resource !== "string" || typeof dependency.relationship_id !== "string" || !Array.isArray(dependency.links) || dependency.links.length < 1 || dependency.links.length > 2 || !digest.test(dependency.proof_digest) || canonicalJsonDigest(dependency.links) !== dependency.proof_digest) {
+      return false;
+    }
+  }
+  return true;
+}
+function credentialPostureFingerprintForGeneratedAuthority(inspection) {
+  const role = inspection.role_posture;
+  return canonicalJsonDigest({
+    engine: inspection.engine,
+    current_user: inspection.current_user,
+    role: role ? {
+      verified: role.verified,
+      superuser: role.superuser,
+      bypass_rls: role.bypass_rls,
+      read_only: role.read_only,
+      writable_relations: [...role.writable_relations].sort(),
+      owned_relations: [...role.owned_relations].sort()
+    } : null
+  });
+}
+function assertProtectedCapabilityDependenciesCurrent(capability, dependencies, inspection) {
+  const root = `${capability.target.schema}.${capability.target.table}`;
+  const resourceIds = /* @__PURE__ */ new Set([root]);
+  const protectedRead = capability.protected_read;
+  const paths = [
+    ...protectedRead.relationship ? [{
+      name: protectedRead.relationship.name,
+      links: [{
+        schema: protectedRead.relationship.schema,
+        table: protectedRead.relationship.table,
+        local_key: protectedRead.relationship.local_key,
+        target_key: protectedRead.relationship.target_key,
+        cardinality: protectedRead.relationship.cardinality,
+        max_fan_out: protectedRead.relationship.max_fan_out
+      }]
+    }] : [],
+    ...(protectedRead.relationships ?? []).map((path3) => ({
+      name: path3.name,
+      links: path3.links.map((link) => ({
+        schema: link.schema,
+        table: link.table,
+        local_key: link.local_key,
+        target_key: link.target_key,
+        cardinality: link.cardinality,
+        max_fan_out: link.max_fan_out
+      }))
+    }))
+  ];
+  for (const path3 of paths) {
+    const dependency = dependencies.relationships[`${root}::${path3.name}`];
+    if (!dependency || dependency.root_resource !== root || dependency.relationship_id !== path3.name || path3.links.length !== dependency.links.length) {
+      throw generatedDependencyDrift(capability, `relationship ${path3.name} is not bound to its generation-lock proof`);
+    }
+    let source = root;
+    for (const [index, link] of path3.links.entries()) {
+      const expected = dependency.links[index];
+      const target = `${link.schema}.${link.table}`;
+      if (expected.source_resource !== source || expected.target_resource !== target || expected.source_columns.length !== 1 || expected.source_columns[0] !== link.local_key || expected.target_columns.length !== 1 || expected.target_columns[0] !== link.target_key || link.cardinality !== "many_to_one" || link.max_fan_out !== 1) {
+        throw generatedDependencyDrift(capability, `relationship ${path3.name} no longer matches its reviewed structural path`);
+      }
+      resourceIds.add(source);
+      resourceIds.add(target);
+      source = target;
+    }
+    if (relationshipDependencyFingerprintForGeneratedAuthority(dependency, inspection) !== dependency.proof_digest) {
+      throw generatedDependencyDrift(capability, `relationship ${path3.name} foreign-key or uniqueness proof changed`);
+    }
+  }
+  for (const resourceId of resourceIds) {
+    const dependency = dependencies.resources[resourceId];
+    if (!dependency || resourceDependencyFingerprintForGeneratedAuthority(dependency, inspection) !== dependency.fingerprint) {
+      throw generatedDependencyDrift(capability, `resource ${resourceId} authority-bearing schema or RLS metadata changed`);
+    }
+  }
+}
+function generatedDependencyDrift(capability, reason) {
+  return new McpRuntimeError(
+    "GENERATED_AUTHORITY_DRIFT",
+    `Generated protected capability ${capability.name} is stale because ${reason}. Rescan, review, and activate a new digest.`
+  );
+}
+function resourceDependencyFingerprintForGeneratedAuthority(dependency, inspection) {
+  const table = inspection.tables.find((candidate) => candidate.schema === dependency.schema && candidate.name === dependency.table);
+  if (!table) return void 0;
+  const columns = new Map(table.columns.map((column) => [column.name, column]));
+  const selectedColumns = dependency.fields.map((name) => {
+    const column = columns.get(name);
+    if (!column) return void 0;
+    return {
+      name: column.name,
+      data_type: column.data_type,
+      nullable: column.nullable,
+      default: column.default ?? null,
+      generated: column.generated,
+      identity: column.identity ?? false,
+      enum_values: [...column.enum_values ?? []].sort()
+    };
+  });
+  if (selectedColumns.some((column) => !column)) return void 0;
+  return canonicalJsonDigest({
+    engine: inspection.engine,
+    schema: table.schema,
+    table: table.name,
+    type: table.type,
+    primary_key: [...table.primary_key],
+    columns: selectedColumns,
+    row_level_security: table.row_level_security ?? "unknown",
+    row_level_security_policies: [...table.row_level_security_policies ?? []].map((policy) => ({
+      name: policy.name,
+      command: policy.command,
+      permissive: policy.permissive,
+      roles: [...policy.roles].sort(),
+      using_expression: policy.using_expression ?? null,
+      check_expression: policy.check_expression ?? null
+    })).sort((left, right) => left.name.localeCompare(right.name)),
+    role_posture: table.role_posture ? {
+      owner: table.role_posture.owner,
+      current_role_is_owner: table.role_posture.current_role_is_owner,
+      current_role_can_assume_owner: table.role_posture.current_role_can_assume_owner,
+      privileges: table.role_posture.privileges,
+      row_security_forced: table.role_posture.row_security_forced,
+      row_security_effective_for_current_role: table.role_posture.row_security_effective_for_current_role
+    } : null
+  });
+}
+function relationshipDependencyFingerprintForGeneratedAuthority(dependency, inspection) {
+  const tables = new Map(inspection.tables.map((table) => [`${table.schema}.${table.name}`, table]));
+  const links = [];
+  for (const expected of dependency.links) {
+    const source = tables.get(expected.source_resource);
+    const target = tables.get(expected.target_resource);
+    if (!source || !target) return void 0;
+    const foreignKey = source.foreign_keys.find((candidate) => candidate.name === expected.constraint_name && candidate.referenced_schema === target.schema && candidate.referenced_table === target.name && sameGeneratedColumns(candidate.columns, expected.source_columns) && sameGeneratedColumns(candidate.referenced_columns, expected.target_columns));
+    if (!foreignKey) return void 0;
+    const uniqueness = generatedRelationshipTargetUniqueness(target, expected.target_columns);
+    if (!uniqueness || uniqueness.kind !== expected.target_uniqueness.kind || uniqueness.name !== expected.target_uniqueness.name || !sameGeneratedColumns(uniqueness.columns, expected.target_uniqueness.columns)) {
+      return void 0;
+    }
+    links.push({
+      constraint_name: foreignKey.name,
+      source_resource: expected.source_resource,
+      target_resource: expected.target_resource,
+      source_columns: [...foreignKey.columns],
+      target_columns: [...foreignKey.referenced_columns],
+      target_uniqueness: uniqueness,
+      nullable: foreignKey.columns.some((name) => source.columns.find((column) => column.name === name)?.nullable !== false),
+      cardinality: "many_to_one",
+      max_fan_out: 1
+    });
+  }
+  return canonicalJsonDigest(links);
+}
+function generatedRelationshipTargetUniqueness(target, columns) {
+  const same = (candidate) => sameGeneratedColumns(candidate, columns);
+  if (same(target.primary_key)) {
+    const named = target.unique_constraints.find((constraint2) => same(constraint2.columns)) ?? target.indexes.find((index2) => index2.unique === true && same(index2.columns ?? []));
+    return {
+      kind: "primary_key",
+      name: named?.name ?? `${target.schema}.${target.name}.primary_key`,
+      columns: [...columns]
+    };
+  }
+  const constraint = target.unique_constraints.find((candidate) => same(candidate.columns));
+  if (constraint) return { kind: "unique_constraint", name: constraint.name, columns: [...columns] };
+  const index = target.indexes.find((candidate) => candidate.unique === true && same(candidate.columns ?? []));
+  return index ? { kind: "unique_index", name: index.name, columns: [...columns] } : void 0;
+}
+function sameGeneratedColumns(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
 function createDefaultRuntimeStore(config, env, storePath) {
   const sharedPostgres = config.storage?.shared_postgres;
   if (sharedPostgres?.mode === "runtime_store") {
@@ -20965,14 +21366,14 @@ var RuntimeDatabasePools = class {
           if (timeoutMs) await client.query(`SET LOCAL statement_timeout = ${timeoutMs}`);
           if (input.source.database_scope?.mode === "postgres_rls") {
             for (const target of protectedReadTargets(input.capability)) {
-              const preflightKey = `${poolKey}\0${target.schema}\0${target.table}\0SELECT`;
+              const preflightKey = `${poolKey}\0${target.schema}\0${target.table}\0SELECT\0${target.principalScoped ? "tenant+principal" : "tenant"}`;
               if (!this.postgresRlsPreflight.has(preflightKey)) {
                 await assertPostgresRlsTarget(client, {
                   schema: target.schema,
                   table: target.table,
                   scope: {
                     tenantSetting: input.source.database_scope.tenant_setting,
-                    principalSetting: input.source.database_scope.principal_setting
+                    ...target.principalScoped && input.source.database_scope.principal_setting ? { principalSetting: input.source.database_scope.principal_setting } : {}
                   },
                   operations: ["SELECT"]
                 });
@@ -21153,27 +21554,51 @@ function runtimeReadQuery(capability, placeholderStyle, args, context) {
 function buildProtectedReadQuery(capability, placeholderStyle, args, context) {
   const protectedRead = capability.protected_read;
   if (!protectedRead) throw new McpRuntimeError("PROTECTED_READ_REQUIRED", "Protected read authority is missing.");
-  const relationship = protectedRead.relationship;
+  const relationships = protectedRelationshipPaths(protectedRead);
   const values = [];
   const bind = (value) => {
     values.push(value);
     return placeholderStyle === "$" ? `$${values.length}` : "?";
   };
+  const relationshipAliases = /* @__PURE__ */ new Map();
+  for (const [pathIndex, relationship] of relationships.entries()) {
+    relationshipAliases.set(
+      relationship.name,
+      protectedRelationshipAlias(pathIndex, relationship.links.length - 1)
+    );
+  }
   const field = (name, relationshipName) => {
-    if (relationshipName !== void 0 && relationshipName !== relationship?.name) {
+    const alias = relationshipName === void 0 ? "t0" : relationshipAliases.get(relationshipName);
+    if (!alias) {
       throw new McpRuntimeError("PROTECTED_RELATIONSHIP_INVALID", "Protected field references an unreviewed relationship.");
     }
-    return `${relationshipName ? "t1" : "t0"}.${quoteIdentifier(name, placeholderStyle)}`;
+    return `${alias}.${quoteIdentifier(name, placeholderStyle)}`;
+  };
+  const fromClause = () => {
+    const joins = [];
+    for (const [pathIndex, relationship] of relationships.entries()) {
+      let sourceAlias = "t0";
+      let preserveUnmatched = false;
+      for (const [linkIndex, link] of relationship.links.entries()) {
+        const alias = protectedRelationshipAlias(pathIndex, linkIndex);
+        preserveUnmatched ||= link.unmatched_rows === "keep_null";
+        const conditions = [
+          `${sourceAlias}.${quoteIdentifier(link.local_key, placeholderStyle)} = ${alias}.${quoteIdentifier(link.target_key, placeholderStyle)}`,
+          `${alias}.${quoteIdentifier(link.tenant_key, placeholderStyle)} = ${bind(context.tenant_id)}`,
+          ...link.principal_scope_key ? [`${alias}.${quoteIdentifier(link.principal_scope_key, placeholderStyle)} = ${bind(context.principal)}`] : []
+        ];
+        joins.push(
+          ` ${preserveUnmatched ? "LEFT JOIN" : "JOIN"} ${quoteIdentifier(link.schema, placeholderStyle)}.${quoteIdentifier(link.table, placeholderStyle)} ${alias} ON ${conditions.join(" AND ")}`
+        );
+        sourceAlias = alias;
+      }
+    }
+    return `${quoteIdentifier(capability.target.schema, placeholderStyle)}.${quoteIdentifier(capability.target.table, placeholderStyle)} t0${joins.join("")}`;
   };
-  const join = relationship ? ` JOIN ${quoteIdentifier(relationship.schema, placeholderStyle)}.${quoteIdentifier(relationship.table, placeholderStyle)} t1 ON t0.${quoteIdentifier(relationship.local_key, placeholderStyle)} = t1.${quoteIdentifier(relationship.target_key, placeholderStyle)}` : "";
   const scopedWhere = () => {
     const where = [];
     if (capability.target.tenant_key) where.push(`t0.${quoteIdentifier(capability.target.tenant_key, placeholderStyle)} = ${bind(context.tenant_id)}`);
     if (capability.target.principal_scope_key) where.push(`t0.${quoteIdentifier(capability.target.principal_scope_key, placeholderStyle)} = ${bind(context.principal)}`);
-    if (relationship) {
-      where.push(`t1.${quoteIdentifier(relationship.tenant_key, placeholderStyle)} = ${bind(context.tenant_id)}`);
-      if (relationship.principal_scope_key) where.push(`t1.${quoteIdentifier(relationship.principal_scope_key, placeholderStyle)} = ${bind(context.principal)}`);
-    }
     for (const predicate of protectedRead.predicates ?? []) {
       const reference = field(predicate.field, predicate.relationship);
       if (predicate.operator === "in") {
@@ -21200,8 +21625,8 @@ function buildProtectedReadQuery(capability, placeholderStyle, args, context) {
     }
     return where;
   };
-  const from = `${quoteIdentifier(capability.target.schema, placeholderStyle)}.${quoteIdentifier(capability.target.table, placeholderStyle)} t0${join}`;
   if (protectedRead.mode === "rows") {
+    const from = fromClause();
     const columns = capability.visible_columns.map((column) => `t0.${quoteIdentifier(column, placeholderStyle)} AS ${quoteIdentifier(column, placeholderStyle)}`);
     const where = scopedWhere();
     const order = protectedRead.row_order_by?.length ? ` ORDER BY ${protectedRead.row_order_by.map((item) => `${field(item.field)} ${item.direction.toUpperCase()}`).join(", ")}` : ` ORDER BY t0.${quoteIdentifier(capability.target.primary_key, placeholderStyle)} ASC`;
@@ -21213,6 +21638,7 @@ function buildProtectedReadQuery(capability, placeholderStyle, args, context) {
   const aggregate = protectedRead.aggregate;
   if (!aggregate) throw new McpRuntimeError("PROTECTED_AGGREGATE_REQUIRED", "Protected aggregate authority is missing.");
   const aggregateQuery = (range, period) => {
+    const from = fromClause();
     const where = scopedWhere();
     if (range && aggregate.comparison) {
       const reference = field(aggregate.comparison.field, aggregate.comparison.relationship);
@@ -21273,10 +21699,61 @@ function protectedStatementTimeout(capability, sourceTimeout) {
   return sourceTimeout === void 0 ? protectedTimeout : Math.min(protectedTimeout, sourceTimeout);
 }
 function protectedReadTargets(capability) {
-  const targets = [{ schema: capability.target.schema, table: capability.target.table }];
+  const targets = /* @__PURE__ */ new Map();
+  const addTarget = (target) => {
+    const key = `${target.schema}\0${target.table}`;
+    const existing = targets.get(key);
+    targets.set(key, {
+      ...target,
+      principalScoped: target.principalScoped || Boolean(existing?.principalScoped)
+    });
+  };
+  addTarget({
+    schema: capability.target.schema,
+    table: capability.target.table,
+    principalScoped: Boolean(capability.target.principal_scope_key)
+  });
   const relationship = capability.protected_read?.relationship;
-  if (relationship) targets.push({ schema: relationship.schema, table: relationship.table });
-  return targets;
+  if (relationship) {
+    addTarget({
+      schema: relationship.schema,
+      table: relationship.table,
+      principalScoped: Boolean(relationship.principal_scope_key)
+    });
+  }
+  for (const path3 of capability.protected_read?.relationships ?? []) {
+    for (const link of path3.links) {
+      addTarget({
+        schema: link.schema,
+        table: link.table,
+        principalScoped: Boolean(link.principal_scope_key)
+      });
+    }
+  }
+  return [...targets.values()];
+}
+function protectedRelationshipPaths(protectedRead) {
+  if (protectedRead.relationships?.length) return protectedRead.relationships;
+  const relationship = protectedRead.relationship;
+  if (!relationship) return [];
+  return [{
+    name: relationship.name,
+    links: [{
+      schema: relationship.schema,
+      table: relationship.table,
+      primary_key: relationship.primary_key,
+      tenant_key: relationship.tenant_key,
+      ...relationship.principal_scope_key ? { principal_scope_key: relationship.principal_scope_key } : {},
+      local_key: relationship.local_key,
+      target_key: relationship.target_key,
+      cardinality: "many_to_one",
+      max_fan_out: 1,
+      unmatched_rows: "exclude"
+    }]
+  }];
+}
+function protectedRelationshipAlias(pathIndex, linkIndex) {
+  return `r${pathIndex + 1}_${linkIndex + 1}`;
 }
 function queryValues(capability, args, context) {
   if (capability.kind === "aggregate_read") return [