permdock 0.3.0 → 0.4.0

package/dist/{rls-ownership-RuFqaqGz.js → ownership-BgnbOJFT.js}

@@ -1,9 +1,10 @@
-import { l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { S as findRole } from "./grantee-Cv5Sogfv.js";
-import { l as roleColumn } from "./sources-4p0-4xQm.js";
-import { B as memberVia, G as quoteIdent, I as memberForSources, K as quoteLiteral, L as memberForTable, M as kindFilterSql, S as globalKindFilterSql, W as qualifiedTable, X as scopeSources, Y as roleKindSql, Z as scopeTable, at as tenantTypeOf, c as signedIn, o as qualified, q as quoteTable, rt as subjectIdSql, t as CUSTOM_ROLES, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
-import { D as claimKeptLines, I as sourceFilters, L as sourcesKeep, M as membershipRows, N as membershipTable, O as disabledColumn, P as roleRows, R as hasCustomRoleChecksFor, j as memberColumn, k as globalRoleRows } from "./rls-fields-74oZPXWL.js";
-//#region src/cli/rls-ownership.ts
+import { l as scopeChain, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { m as findRole } from "./grantee-CXY-0C87.js";
+import { r as qualifySqlTable } from "./sql-t8teWOfo.js";
+import { l as roleColumn } from "./sources-B1-b-R0t.js";
+import { A as declaredArray, F as quoteQualified, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, f as kindFilterSql, h as roleKindSql, m as memberVia, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, y as subjectIdSql } from "./shared-1uhI-e-b.js";
+import { G as scopeSources, K as scopeTable, R as memberForSources, V as memberRoleOf, d as memberColumn, f as sourceFilters, g as roleRows, h as membershipRows, l as claimKeptLines, m as globalRoleRows, p as sourcesKeep, u as disabledColumn, y as hasCustomRoleChecksFor, z as memberForTable } from "./permission-keys-B26jeyUv.js";
+//#region src/cli/rls/ownership-names.ts
 /** Objects the ownership rules add next to the helpers. Names are part of the SQL contract. */
 const OWNERSHIP = {
 	canAssign: "permdock_can_assign",
@@ -13,62 +14,234 @@ const OWNERSHIP = {
 	holders: "permdock_holders",
 	transferOnly: "permdock_transfer_only"
 };
-function roleScope(policy, scopes, name) {
-	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
-	return typeof on === "string" ? resolveScope(scopes, on) : void 0;
-}
-function isGlobalRole(policy, name) {
-	const binding = policy.rolesByName.get(name);
-	if (binding !== void 0) return binding.on === void 0;
-	const leaf = findRole(policy.vocabulary.roles, name);
-	return leaf !== void 0 && leaf.on === void 0;
-}
-/** The rules `rls generate` enforces; `undefined` when no role declares one. */
-function ownershipRules(policy, scopes) {
-	const kinds = {};
-	const assigns = [];
-	const counted = [];
-	for (const binding of policy.roles) {
-		const scope = roleScope(policy, scopes, binding.name);
-		if (binding.for !== void 0) kinds[binding.name] = binding.for;
-		const assigner = scope ?? (binding.on === void 0 ? "global" : void 0);
-		for (const target of binding.assigns ?? []) {
-			const at = roleScope(policy, scopes, target);
-			if (assigner !== void 0 && at !== void 0 && (assigner === "global" || scopeChain(scopes, at).includes(assigner))) assigns.push({
-				assigner: binding.name,
-				scope: assigner,
-				role: target,
-				at
-			});
-			else if (assigner === "global" && isGlobalRole(policy, target)) assigns.push({
-				assigner: binding.name,
-				scope: "global",
-				role: target,
-				at: "global"
-			});
-		}
-		const min = binding.min ?? 0;
-		const transferOnly = binding.transferOnly === true;
-		if (scope !== void 0 && (min > 0 || binding.max !== void 0 || transferOnly)) counted.push(binding.max === void 0 ? {
-			role: binding.name,
-			scope,
-			min,
-			transferOnly
-		} : {
-			role: binding.name,
+/** Objects `rls.assignments` adds. Names are part of the SQL contract. */
+const ASSIGNMENTS = {
+	custom: "permdock_can_assign_custom_role",
+	customFor: "permdock_can_assign_custom_role_for",
+	trigger: "permdock_assignment"
+};
+//#endregion
+//#region src/cli/rls/assignments.ts
+/** The client roles whose writes the assignment triggers check; any other role is a trusted path. */
+const CLIENT_ROLES = [
+	"anon",
+	"anonymous",
+	"authenticated"
+];
+/** The mapped membership tables, `rls.assignments.tables` and the global-roles table `rls.roles`. */
+function assignedTables(ctx) {
+	const out = [];
+	for (const { name } of ctx.scopes) {
+		const mapped = scopeTable(ctx, name);
+		if (mapped === void 0) continue;
+		out.push({
+			table: mapped.table.table,
+			scope: name,
+			id: mapped.column,
+			tenant: mapped.tenantColumn ?? mapped.column,
+			role: mapped.table.role,
+			user: mapped.table.user
+		});
+	}
+	if (ctx.roles !== void 0) out.push({
+		table: ctx.roles.table,
+		scope: "global",
+		role: ctx.roles.role ?? "role",
+		user: ctx.roles.user ?? "user_id"
+	});
+	for (const extra of ctx.assignments?.tables ?? []) {
+		const scope = resolveScope(ctx.scopes, extra.scope);
+		if (scope === void 0) throw new Error(`PermDock CLI: rls.assignments.tables names scope '${extra.scope}', which the policy does not declare`);
+		if (scope !== ctx.scopes[0]?.name && extra.tenant === void 0) throw new Error(`PermDock CLI: rls.assignments.tables entry ${extra.table} assigns at ${scope}, below the first scope: name its tenant column`);
+		out.push({
+			table: extra.table,
 			scope,
-			min,
-			max: binding.max,
-			transferOnly
+			id: extra.id,
+			tenant: extra.tenant ?? extra.id,
+			role: extra.role,
+			...extra.user === void 0 ? {} : { user: extra.user }
 		});
 	}
-	if (Object.keys(kinds).length === 0 && assigns.length === 0 && counted.length === 0) return;
-	return {
-		kinds,
-		assigns,
-		counted
-	};
+	return out;
+}
+/** The tables `rls.assignments.ownRole` refuses a caller's own rows on, by table key. */
+function ownRoleTables(ctx, tables) {
+	const own = ctx.assignments?.ownRole;
+	if (own === void 0) return /* @__PURE__ */ new Set();
+	if (own === "refuse") return new Set(tables.filter((entry) => entry.user !== void 0).map((entry) => qualifySqlTable(entry.table)));
+	const out = /* @__PURE__ */ new Set();
+	for (const [name, value] of Object.entries(own)) {
+		const entry = tables.find((table) => qualifySqlTable(table.table) === qualifySqlTable(name));
+		if (entry === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which no assignment trigger guards`);
+		if (value !== "refuse") throw new Error(`PermDock CLI: rls.assignments.ownRole.${name} must be 'refuse'`);
+		if (entry.user === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which has no user column: set its user in rls.assignments.tables`);
+		out.add(qualifySqlTable(entry.table));
+	}
+	return out;
+}
+/**
+* The tables `rls.assignments` guards, schema-qualified: each scope's mapped
+* membership table, the global-roles table (`rls.roles`, else
+* `supabase.hook.roles`) and `rls.assignments.tables`. Empty without
+* `rls.assignments`.
+*/
+function guardedTables(config, scopes) {
+	const rls = config.rls;
+	if (rls?.assignments === void 0) return [];
+	const hook = config.supabase?.hook?.roles;
+	const roles = rls.roles ?? (hook === false ? void 0 : hook);
+	const tables = [
+		...scopes.flatMap((scope) => {
+			const mapped = memberForTable({
+				scopes,
+				...rls.memberships === void 0 ? {} : { memberships: rls.memberships }
+			}, scope.name);
+			return mapped === void 0 ? [] : [mapped.table];
+		}),
+		...roles === void 0 ? [] : [roles.table],
+		...(rls.assignments === true ? [] : rls.assignments.tables ?? []).map((entry) => entry.table)
+	];
+	return [...new Set(tables.map(qualifySqlTable))];
+}
+function isRoleList(role) {
+	return Array.isArray(role);
+}
+/** The role keys a row variable holds, one scalar per role source. */
+function rowRoles(entry, row) {
+	return (isRoleList(entry.role) ? entry.role : [entry.role]).map((part) => roleColumn(part, qualifySqlTable(entry.table), row, {
+		label: `rls.assignments ${entry.table} role`,
+		prefix: "PermDock CLI"
+	}).lookup);
+}
+/**
+* `permdock_can_assign_custom_role`: whether the signed-in caller may assign a
+* custom role of the tenant at the instance, by the checks the custom-role
+* write functions run on its stored definition.
+*/
+function canAssignCustomSql(ctx, forUser = false) {
+	const tenantType = tenantTypeOf(ctx);
+	const fn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const guard = qualified(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
+	const userParam = forUser ? "p_user uuid, " : "";
+	const userArg = forUser ? "uuid, " : "";
+	const stored = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.role = p_role and (c.scope_id is null or c.scope_id = p_scope_id)`;
+	const grants = forUser ? `revoke execute on function ${fn}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(${tenantType}, text, text, text) from public, anon;
+grant execute on function ${fn}(${tenantType}, text, text, text) to authenticated;`;
+	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign custom role p_role at instance p_scope_id (a platform role: null tenant, scope global): the custom-role write checks on its stored definition${forUser ? "; no client role may execute it" : ""}
+create or replace function ${fn}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_scope_id text;
+  v_found boolean := false;
+begin
+  select true, c.scope_id into v_found, v_scope_id
+  from (
+    select c.scope_id from ${perms} c where ${stored}
+    union all
+    select c.scope_id from ${includes} c where ${stored}
+  ) c
+  order by c.scope_id nulls first
+  limit 1;
+  if not coalesce(v_found, false) then
+    return false;
+  end if;
+  perform ${guard}(${forUser ? "p_user, " : ""}p_tenant, p_scope, v_scope_id, p_role);
+  return true;
+exception
+  when insufficient_privilege or invalid_parameter_value then
+    return false;
+end;
+$$;
+${grants}`;
+}
+/**
+* The assignment triggers (\`rls.assignments\`): before a client role inserts,
+* updates or deletes a row that assigns a role, every role the old and new
+* row hold must be one the caller may assign at that instance, by
+* \`permdock_can_assign\` for a declared role and
+* \`permdock_can_assign_custom_role\` for a custom one. The functions run as
+* the invoker, so \`current_user\` tells a client write from a trusted one.
+*/
+function assignmentSql(ctx) {
+	const own = ctx.ownership;
+	if (ctx.assignments === void 0 || own === void 0 || own.assigns.length === 0) return "";
+	const canAssign = qualified(ctx, OWNERSHIP.canAssign);
+	const custom = ctx.customRoles !== void 0 && ctx.authorize === "database";
+	const declared = ctx.customRoles?.declared;
+	const tenantType = tenantTypeOf(ctx);
+	const chunks = [];
+	const clients = `current_user::text = any(array[${CLIENT_ROLES.map(quoteLiteral).join(", ")}])`;
+	const tables = assignedTables(ctx);
+	const ownRole = ownRoleTables(ctx, tables);
+	for (const entry of tables) {
+		const table = quoteQualified(entry.table);
+		const suffix = entry.table.replaceAll(/[^a-z0-9_]/gu, "_");
+		const fn = qualified(ctx, quoteIdent(`${ASSIGNMENTS.trigger}_${suffix}`));
+		const ownUser = entry.user !== void 0 && ownRole.has(qualifySqlTable(entry.table)) ? entry.user : void 0;
+		const ownCheck = (row, reason) => ownUser === void 0 ? "" : `    if ${row}.${quoteIdent(ownUser)}::text = (${subjectIdSql(ctx)})::text then
+      raise exception using
+        errcode = '42501',
+        message = 'permdock: the caller may not change their own roles',
+        hint = '${reason}';
+    end if;
+`;
+		const check = (row) => {
+			const id = entry.id === void 0 ? "null::text" : `${row}.${quoteIdent(entry.id)}::text`;
+			const customFn = qualified(ctx, ASSIGNMENTS.custom);
+			let allowed = `${canAssign}(v_role, ${id})`;
+			if (custom && declared !== void 0) {
+				const platform = `${customFn}(null, 'global', null, v_role)`;
+				allowed = entry.id === void 0 || entry.tenant === void 0 ? `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) else ${platform} end` : `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) when ${id} is null then ${platform} else ${customFn}(${row}.${quoteIdent(entry.tenant)}::${tenantType}, ${quoteLiteral(entry.scope)}, ${id}, v_role) end`;
+			}
+			return `    foreach v_role in array array[${rowRoles(entry, row).join(", ")}]::text[] loop
+      if v_role is not null and not coalesce(${allowed}, false) then
+        raise exception using
+          errcode = '42501',
+          message = 'permdock: the caller may not assign ' || v_role || ' in ' || coalesce(${id}, 'null'),
+          hint = 'not-assignable-by';
+      end if;
+    end loop;`;
+		};
+		const what = entry.id === void 0 ? "global roles" : `${entry.scope} roles`;
+		chunks.push(`-- ${entry.table}: a client role may write only the ${what} it may assign${ownUser === void 0 ? "" : ", and none on its own rows"}
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+set search_path = ''
+as $$
+declare
+  v_role text;
+begin
+  if not (${clients}) then
+    return coalesce(new, old);
+  end if;
+  if tg_op in ('UPDATE', 'DELETE') then
+${ownCheck("old", "self-demotion")}${check("old")}
+  end if;
+  if tg_op in ('INSERT', 'UPDATE') then
+${ownCheck("new", "not-assignable-by")}${check("new")}
+  end if;
+  return coalesce(new, old);
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists "permdock_assignment" on ${table};
+create trigger "permdock_assignment"
+  before insert or update or delete on ${table}
+  for each row execute function ${fn}();`);
+	}
+	return `${chunks.join("\n\n")}\n`;
 }
+//#endregion
+//#region src/cli/rls/ownership-triggers.ts
 function objectName(prefix, scope) {
 	return quoteIdent(`${prefix}_${scope}`);
 }
@@ -87,7 +260,7 @@ function holdersSql(ctx, table, column, idExpr, role, into) {
 	const kind = typeof role === "string" ? roleKindSql(ctx, role, via) : kindFilterSql(ctx, roleExpr, via);
 	if (kind !== void 0) filters.push(kind);
 	return `select count(distinct m.${quoteIdent(table.user)}) into ${into}
-      from ${membershipTable(table.table)} m${held.join}
+      from ${quoteQualified(table.table)} m${held.join}
       where ${filters.join("\n        and ")}`;
 }
 /**
@@ -99,7 +272,7 @@ function holdersTriggerSql(ctx, scope, table, column, counted) {
 	const fn = qualified(ctx, `${OWNERSHIP.holders}_${scope}`);
 	const col = quoteIdent(column);
 	const checks = counted.map((rule) => {
-		const lines = [`    select count(*) into v_total from ${membershipTable(table.table)} m where m.${col} = v_key;`, `    ${holdersSql(ctx, table, column, "v_key", rule.role, "v_count")};`];
+		const lines = [`    select count(*) into v_total from ${quoteQualified(table.table)} m where m.${col} = v_key;`, `    ${holdersSql(ctx, table, column, "v_key", rule.role, "v_count")};`];
 		if (rule.min > 0) lines.push(`    if v_total > 0 and v_count < ${String(rule.min)} then
       raise exception using
         errcode = '23514',
@@ -124,7 +297,7 @@ as $$
 declare
   v_ids text[] := '{}';
   v_id text;
-  v_key ${membershipTable(table.table)}.${col}%type;
+  v_key ${quoteQualified(table.table)}.${col}%type;
   v_total bigint;
   v_count bigint;
 begin
@@ -142,9 +315,9 @@ ${checks.join("\n")}
   return null;
 end;
 $$;
-drop trigger if exists ${objectName(OWNERSHIP.holders, scope)} on ${membershipTable(table.table)};
+drop trigger if exists ${objectName(OWNERSHIP.holders, scope)} on ${quoteQualified(table.table)};
 create constraint trigger ${objectName(OWNERSHIP.holders, scope)}
-  after insert or update or delete on ${membershipTable(table.table)}
+  after insert or update or delete on ${quoteQualified(table.table)}
   deferrable initially deferred
   for each row execute function ${fn}();`;
 }
@@ -178,7 +351,7 @@ function transferTriggerSql(ctx, scope, table, column, roles) {
     end loop;`;
 	const inserted = rows("n", "permdock_new", "1");
 	const deleted = rows("o", "permdock_old", "-1");
-	const target = membershipTable(table.table);
+	const target = quoteQualified(table.table);
 	const trigger = (op) => {
 		const name = quoteIdent(`${OWNERSHIP.transferOnly}_${scope}_${op}`);
 		return `drop trigger if exists ${name} on ${target};
@@ -212,6 +385,8 @@ ${trigger("insert")}
 ${trigger("update")}
 ${trigger("delete")}`;
 }
+//#endregion
+//#region src/cli/rls/ownership-sources.ts
 /**
 * The membership sources holding scope `name`: `undefined` when there are
 * none, `'not-tables'` when one of them carries no table to put a trigger on.
@@ -243,10 +418,10 @@ function sourceKeys(sources) {
 	};
 }
 function regclassOf(table) {
-	return `${quoteLiteral(membershipTable(table))}::regclass`;
+	return `${quoteLiteral(quoteQualified(table))}::regclass`;
 }
 function sourceTables(sources) {
-	return [...new Set(sources.map((source) => membershipTable(source.table)))];
+	return [...new Set(sources.map((source) => quoteQualified(source.table)))];
 }
 /** `min` and `max` over membership sources: the same commit-time check as on a mapped table, counted over every source of the scope. */
 function sourceHoldersTriggerSql(ctx, scope, sources, counted) {
@@ -398,6 +573,8 @@ function sourceRowsSql(sources, user) {
 	const keep = sources.some((source) => source.sql.keeps);
 	return sources.map((source) => source.sql.select(user(source), keep).replaceAll(/^/gmu, "        ")).join("\n        union all\n");
 }
+//#endregion
+//#region src/cli/rls/can-assign.ts
 /** Whether the signed-in user (or `p_user` in the `_for` form) holds, in instance `p_scope_id`, a role whose `assigns` lists `p_role`. */
 function canAssignSql(base, own, forUser = false) {
 	const ctx = forUser ? {
@@ -470,7 +647,7 @@ ${sourceRowsSql(sources, userOf)}
 			const kind = kindFilterSql(ctx, role.sql, memberVia(table));
 			if (kind !== void 0) filters.push(kind);
 			parts.push(`exists (
-      select 1 from ${membershipTable(table.table)} m${role.join}
+      select 1 from ${quoteQualified(table.table)} m${role.join}
       where ${filters.join("\n        and ")}
     )`);
 		} else {
@@ -507,337 +684,168 @@ begin
   return ${signedIn(ctx)} and (
     ${body}
   );
-end;
-$$;`;
-	if (forUser) {
-		const user = ctx.dialect === "supabase" ? "uuid" : "text";
-		return `-- who may assign, for a user the caller names: trusted SQL acting later for a stored user; no client role may execute it
-create or replace function ${fn}(p_user ${user}, p_role text, p_scope_id text)
-returns boolean
-${language}
-revoke execute on function ${fn}(${user}, text, text) from public, anon, authenticated;`;
-	}
-	return `-- who may assign: a held role whose assigns lists p_role, in instance p_scope_id (its scope or an ancestor's); a null p_scope_id assigns a global role, which only global assigners may
-create or replace function ${fn}(p_role text, p_scope_id text)
-returns boolean
-${language}
-revoke execute on function ${fn}(text, text) from public, anon;
-grant execute on function ${fn}(text, text) to authenticated;`;
-}
-/**
-* The ownership objects: holder-count and transfer-only triggers on each
-* scope's membership table, and `permdock_can_assign` for the application's
-* own policies on those tables. Empty when no role declares a rule.
-*/
-function ownershipSql(ctx) {
-	const own = ctx.ownership;
-	if (own === void 0) return "";
-	const chunks = [];
-	const skipped = ctx.skipOwnershipTriggers;
-	for (const { name } of ctx.scopes) {
-		const counted = own.counted.filter((rule) => rule.scope === name);
-		if (counted.length === 0) continue;
-		if (skipped === "all" || skipped?.includes(name) === true) {
-			chunks.push(`-- ${name}: rls.ownershipTriggers leaves out the triggers, so min, max and transferOnly are checked only by decideRoleChange`);
-			continue;
-		}
-		const transfer = counted.filter((rule) => rule.transferOnly).map((rule) => rule.role);
-		const mapped = scopeTable(ctx, name);
-		if (mapped === void 0) {
-			const sources = holderSources(ctx, name);
-			if (sources === void 0) chunks.push(`-- ${name}: no memberships table configured, so min, max and transferOnly are checked only by decideRoleChange`);
-			else if (sources === "not-tables") chunks.push(`-- ${name}: a membership source is not a table, so min, max and transferOnly are checked only by decideRoleChange`);
-			else {
-				chunks.push(sourceHoldersTriggerSql(ctx, name, sources, counted));
-				if (transfer.length > 0) chunks.push(sourceTransferTriggerSql(ctx, name, sources, transfer));
-			}
-			continue;
-		}
-		chunks.push(holdersTriggerSql(ctx, name, mapped.table, mapped.column, counted));
-		if (transfer.length > 0) chunks.push(transferTriggerSql(ctx, name, mapped.table, mapped.column, transfer));
-	}
-	if (own.assigns.length > 0) {
-		chunks.push(canAssignSql(ctx, own));
-		if (ctx.authorize === "database") chunks.push(canAssignSql(ctx, own, true));
-		const custom = assignsCustomRoles(ctx);
-		if (custom) {
-			chunks.push(canAssignCustomSql(ctx));
-			if (hasCustomRoleChecksFor(ctx)) chunks.push(canAssignCustomSql(ctx, true));
-		}
-		chunks.push(canAssignAnySql(ctx, custom));
-		if (hasCanAssignAnyFor(ctx)) chunks.push(canAssignAnySql(ctx, custom, true));
-	}
-	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
-}
-/** Whether the helpers keep custom roles in tables, so assigning one is checked against its stored definition. */
-function assignsCustomRoles(ctx) {
-	return ctx.customRoles !== void 0 && ctx.authorize === "database";
-}
-/** Whether `permdock_can_assign_any_for` is written: every function it calls has a `_for` form. */
-function hasCanAssignAnyFor(ctx) {
-	return ctx.authorize === "database" && (!assignsCustomRoles(ctx) || hasCustomRoleChecksFor(ctx));
-}
-/**
-* `permdock_can_assign_any`: one check for a declared or a custom role, so
-* SQL that assigns roles calls one function: `permdock_can_assign` for a
-* declared role, `permdock_can_assign_custom_role` for a custom one. `p_scope`
-* `'global'` (no tenant, no instance) assigns a platform role.
-*/
-function canAssignAnySql(ctx, custom, forUser = false) {
-	const tenantType = tenantTypeOf(ctx);
-	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignAnyFor : OWNERSHIP.canAssignAny);
-	const declaredFn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
-	const customFn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
-	const userType = ctx.dialect === "supabase" ? "uuid" : "text";
-	const userParam = forUser ? `p_user ${userType}, ` : "";
-	const userArg = forUser ? `${userType}, ` : "";
-	const user = forUser ? "p_user, " : "";
-	const declared = `${declaredFn}(${user}p_role, case when p_scope = 'global' then null else p_scope_id end)`;
-	const body = custom && ctx.customRoles !== void 0 ? `case
-    when p_role = any(${declaredArray(ctx.customRoles.declared)}) then ${declared}
-    when p_scope = 'global' then ${customFn}(${user}null, 'global', null, p_role)
-    else ${customFn}(${user}p_tenant, p_scope, p_scope_id, p_role)
-  end` : declared;
-	const grants = forUser ? `revoke execute on function ${fn}(${userArg}text, ${tenantType}, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(text, ${tenantType}, text, text) from public, anon;
-grant execute on function ${fn}(text, ${tenantType}, text, text) to authenticated;`;
-	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign p_role at instance p_scope_id of p_scope in tenant p_tenant, declared or custom (p_scope 'global' for a platform role)${forUser ? "; no client role may execute it" : ""}
-create or replace function ${fn}(${userParam}p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select coalesce(${body}, false)
-$$;
-${grants}`;
-}
-/** Objects `rls.assignments` adds. Names are part of the SQL contract. */
-const ASSIGNMENTS = {
-	custom: "permdock_can_assign_custom_role",
-	customFor: "permdock_can_assign_custom_role_for",
-	trigger: "permdock_assignment"
-};
-/** The client roles whose writes the assignment triggers check; any other role is a trusted path. */
-const CLIENT_ROLES = [
-	"anon",
-	"anonymous",
-	"authenticated"
-];
-/** The mapped membership tables, `rls.assignments.tables` and the global-roles table `rls.roles`. */
-function assignedTables(ctx) {
-	const out = [];
-	for (const { name } of ctx.scopes) {
-		const mapped = scopeTable(ctx, name);
-		if (mapped === void 0) continue;
-		out.push({
-			table: mapped.table.table,
-			scope: name,
-			id: mapped.column,
-			tenant: mapped.tenantColumn ?? mapped.column,
-			role: mapped.table.role,
-			user: mapped.table.user
-		});
-	}
-	if (ctx.roles !== void 0) out.push({
-		table: ctx.roles.table,
-		scope: "global",
-		role: ctx.roles.role ?? "role",
-		user: ctx.roles.user ?? "user_id"
-	});
-	for (const extra of ctx.assignments?.tables ?? []) {
-		const scope = resolveScope(ctx.scopes, extra.scope);
-		if (scope === void 0) throw new Error(`PermDock CLI: rls.assignments.tables names scope '${extra.scope}', which the policy does not declare`);
-		if (scope !== ctx.scopes[0]?.name && extra.tenant === void 0) throw new Error(`PermDock CLI: rls.assignments.tables entry ${extra.table} assigns at ${scope}, below the first scope: name its tenant column`);
-		out.push({
-			table: extra.table,
-			scope,
-			id: extra.id,
-			tenant: extra.tenant ?? extra.id,
-			role: extra.role,
-			...extra.user === void 0 ? {} : { user: extra.user }
-		});
-	}
-	return out;
-}
-/** The tables `rls.assignments.ownRole` refuses a caller's own rows on, by table key. */
-function ownRoleTables(ctx, tables) {
-	const own = ctx.assignments?.ownRole;
-	if (own === void 0) return /* @__PURE__ */ new Set();
-	if (own === "refuse") return new Set(tables.filter((entry) => entry.user !== void 0).map((entry) => qualifiedTable(entry.table)));
-	const out = /* @__PURE__ */ new Set();
-	for (const [name, value] of Object.entries(own)) {
-		const entry = tables.find((table) => qualifiedTable(table.table) === qualifiedTable(name));
-		if (entry === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which no assignment trigger guards`);
-		if (value !== "refuse") throw new Error(`PermDock CLI: rls.assignments.ownRole.${name} must be 'refuse'`);
-		if (entry.user === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which has no user column: set its user in rls.assignments.tables`);
-		out.add(qualifiedTable(entry.table));
-	}
-	return out;
-}
-/**
-* The tables `rls.assignments` guards, schema-qualified: each scope's mapped
-* membership table, the global-roles table (`rls.roles`, else
-* `supabase.hook.roles`) and `rls.assignments.tables`. Empty without
-* `rls.assignments`.
-*/
-function guardedTables(config, scopes) {
-	const rls = config.rls;
-	if (rls?.assignments === void 0) return [];
-	const hook = config.supabase?.hook?.roles;
-	const roles = rls.roles ?? (hook === false ? void 0 : hook);
-	const tables = [
-		...scopes.flatMap((scope) => {
-			const mapped = memberForTable({
-				scopes,
-				...rls.memberships === void 0 ? {} : { memberships: rls.memberships }
-			}, scope.name);
-			return mapped === void 0 ? [] : [mapped.table];
-		}),
-		...roles === void 0 ? [] : [roles.table],
-		...(rls.assignments === true ? [] : rls.assignments.tables ?? []).map((entry) => entry.table)
-	];
-	return [...new Set(tables.map(qualifiedTable))];
+end;
+$$;`;
+	if (forUser) {
+		const user = ctx.dialect === "supabase" ? "uuid" : "text";
+		return `-- who may assign, for a user the caller names: trusted SQL acting later for a stored user; no client role may execute it
+create or replace function ${fn}(p_user ${user}, p_role text, p_scope_id text)
+returns boolean
+${language}
+revoke execute on function ${fn}(${user}, text, text) from public, anon, authenticated;`;
+	}
+	return `-- who may assign: a held role whose assigns lists p_role, in instance p_scope_id (its scope or an ancestor's); a null p_scope_id assigns a global role, which only global assigners may
+create or replace function ${fn}(p_role text, p_scope_id text)
+returns boolean
+${language}
+revoke execute on function ${fn}(text, text) from public, anon;
+grant execute on function ${fn}(text, text) to authenticated;`;
 }
-function isRoleList(role) {
-	return Array.isArray(role);
+/** Whether the helpers keep custom roles in tables, so assigning one is checked against its stored definition. */
+function assignsCustomRoles(ctx) {
+	return ctx.customRoles !== void 0 && ctx.authorize === "database";
 }
-/** The role keys a row variable holds, one scalar per role source. */
-function rowRoles(entry, row) {
-	return (isRoleList(entry.role) ? entry.role : [entry.role]).map((part) => roleColumn(part, qualifiedTable(entry.table), row, {
-		label: `rls.assignments ${entry.table} role`,
-		prefix: "PermDock CLI"
-	}).lookup);
+/** Whether `permdock_can_assign_any_for` is written: every function it calls has a `_for` form. */
+function hasCanAssignAnyFor(ctx) {
+	return ctx.authorize === "database" && (!assignsCustomRoles(ctx) || hasCustomRoleChecksFor(ctx));
 }
 /**
-* `permdock_can_assign_custom_role`: whether the signed-in caller may assign a
-* custom role of the tenant at the instance, by the checks the custom-role
-* write functions run on its stored definition.
+* `permdock_can_assign_any`: one check for a declared or a custom role, so
+* SQL that assigns roles calls one function: `permdock_can_assign` for a
+* declared role, `permdock_can_assign_custom_role` for a custom one. `p_scope`
+* `'global'` (no tenant, no instance) assigns a platform role.
 */
-function canAssignCustomSql(ctx, forUser = false) {
+function canAssignAnySql(ctx, custom, forUser = false) {
 	const tenantType = tenantTypeOf(ctx);
-	const fn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
-	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
-	const includes = qualified(ctx, CUSTOM_ROLES.includes);
-	const guard = qualified(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
-	const userParam = forUser ? "p_user uuid, " : "";
-	const userArg = forUser ? "uuid, " : "";
-	const stored = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.role = p_role and (c.scope_id is null or c.scope_id = p_scope_id)`;
-	const grants = forUser ? `revoke execute on function ${fn}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(${tenantType}, text, text, text) from public, anon;
-grant execute on function ${fn}(${tenantType}, text, text, text) to authenticated;`;
-	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign custom role p_role at instance p_scope_id (a platform role: null tenant, scope global): the custom-role write checks on its stored definition${forUser ? "; no client role may execute it" : ""}
-create or replace function ${fn}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignAnyFor : OWNERSHIP.canAssignAny);
+	const declaredFn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
+	const customFn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
+	const userType = ctx.dialect === "supabase" ? "uuid" : "text";
+	const userParam = forUser ? `p_user ${userType}, ` : "";
+	const userArg = forUser ? `${userType}, ` : "";
+	const user = forUser ? "p_user, " : "";
+	const declared = `${declaredFn}(${user}p_role, case when p_scope = 'global' then null else p_scope_id end)`;
+	const body = custom && ctx.customRoles !== void 0 ? `case
+    when p_role = any(${declaredArray(ctx.customRoles.declared)}) then ${declared}
+    when p_scope = 'global' then ${customFn}(${user}null, 'global', null, p_role)
+    else ${customFn}(${user}p_tenant, p_scope, p_scope_id, p_role)
+  end` : declared;
+	const grants = forUser ? `revoke execute on function ${fn}(${userArg}text, ${tenantType}, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(text, ${tenantType}, text, text) from public, anon;
+grant execute on function ${fn}(text, ${tenantType}, text, text) to authenticated;`;
+	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign p_role at instance p_scope_id of p_scope in tenant p_tenant, declared or custom (p_scope 'global' for a platform role)${forUser ? "; no client role may execute it" : ""}
+create or replace function ${fn}(${userParam}p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text)
 returns boolean
-language plpgsql
+language sql
 stable
 security definer
 set search_path = ''
 as $$
-declare
-  v_scope_id text;
-  v_found boolean := false;
-begin
-  select true, c.scope_id into v_found, v_scope_id
-  from (
-    select c.scope_id from ${perms} c where ${stored}
-    union all
-    select c.scope_id from ${includes} c where ${stored}
-  ) c
-  order by c.scope_id nulls first
-  limit 1;
-  if not coalesce(v_found, false) then
-    return false;
-  end if;
-  perform ${guard}(${forUser ? "p_user, " : ""}p_tenant, p_scope, v_scope_id, p_role);
-  return true;
-exception
-  when insufficient_privilege or invalid_parameter_value then
-    return false;
-end;
+  select coalesce(${body}, false)
 $$;
 ${grants}`;
 }
+//#endregion
+//#region src/cli/rls/ownership.ts
+function roleScope(policy, scopes, name) {
+	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
+	return typeof on === "string" ? resolveScope(scopes, on) : void 0;
+}
+function isGlobalRole(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	if (binding !== void 0) return binding.on === void 0;
+	const leaf = findRole(policy.vocabulary.roles, name);
+	return leaf !== void 0 && leaf.on === void 0;
+}
+/** The rules `rls generate` enforces; `undefined` when no role declares one. */
+function ownershipRules(policy, scopes) {
+	const kinds = {};
+	const assigns = [];
+	const counted = [];
+	for (const binding of policy.roles) {
+		const scope = roleScope(policy, scopes, binding.name);
+		if (binding.for !== void 0) kinds[binding.name] = binding.for;
+		const assigner = scope ?? (binding.on === void 0 ? "global" : void 0);
+		for (const target of binding.assigns ?? []) {
+			const at = roleScope(policy, scopes, target);
+			if (assigner !== void 0 && at !== void 0 && (assigner === "global" || scopeChain(scopes, at).includes(assigner))) assigns.push({
+				assigner: binding.name,
+				scope: assigner,
+				role: target,
+				at
+			});
+			else if (assigner === "global" && isGlobalRole(policy, target)) assigns.push({
+				assigner: binding.name,
+				scope: "global",
+				role: target,
+				at: "global"
+			});
+		}
+		const min = binding.min ?? 0;
+		const transferOnly = binding.transferOnly === true;
+		if (scope !== void 0 && (min > 0 || binding.max !== void 0 || transferOnly)) counted.push(binding.max === void 0 ? {
+			role: binding.name,
+			scope,
+			min,
+			transferOnly
+		} : {
+			role: binding.name,
+			scope,
+			min,
+			max: binding.max,
+			transferOnly
+		});
+	}
+	if (Object.keys(kinds).length === 0 && assigns.length === 0 && counted.length === 0) return;
+	return {
+		kinds,
+		assigns,
+		counted
+	};
+}
 /**
-* The assignment triggers (\`rls.assignments\`): before a client role inserts,
-* updates or deletes a row that assigns a role, every role the old and new
-* row hold must be one the caller may assign at that instance, by
-* \`permdock_can_assign\` for a declared role and
-* \`permdock_can_assign_custom_role\` for a custom one. The functions run as
-* the invoker, so \`current_user\` tells a client write from a trusted one.
+* The ownership objects: holder-count and transfer-only triggers on each
+* scope's membership table, and `permdock_can_assign` for the application's
+* own policies on those tables. Empty when no role declares a rule.
 */
-function assignmentSql(ctx) {
+function ownershipSql(ctx) {
 	const own = ctx.ownership;
-	if (ctx.assignments === void 0 || own === void 0 || own.assigns.length === 0) return "";
-	const canAssign = qualified(ctx, OWNERSHIP.canAssign);
-	const custom = ctx.customRoles !== void 0 && ctx.authorize === "database";
-	const declared = ctx.customRoles?.declared;
-	const tenantType = tenantTypeOf(ctx);
+	if (own === void 0) return "";
 	const chunks = [];
-	const clients = `current_user::text = any(array[${CLIENT_ROLES.map(quoteLiteral).join(", ")}])`;
-	const tables = assignedTables(ctx);
-	const ownRole = ownRoleTables(ctx, tables);
-	for (const entry of tables) {
-		const table = quoteTable(qualifiedTable(entry.table));
-		const suffix = entry.table.replaceAll(/[^a-z0-9_]/gu, "_");
-		const fn = qualified(ctx, quoteIdent(`${ASSIGNMENTS.trigger}_${suffix}`));
-		const ownUser = entry.user !== void 0 && ownRole.has(qualifiedTable(entry.table)) ? entry.user : void 0;
-		const ownCheck = (row, reason) => ownUser === void 0 ? "" : `    if ${row}.${quoteIdent(ownUser)}::text = (${subjectIdSql(ctx)})::text then
-      raise exception using
-        errcode = '42501',
-        message = 'permdock: the caller may not change their own roles',
-        hint = '${reason}';
-    end if;
-`;
-		const check = (row) => {
-			const id = entry.id === void 0 ? "null::text" : `${row}.${quoteIdent(entry.id)}::text`;
-			const customFn = qualified(ctx, ASSIGNMENTS.custom);
-			let allowed = `${canAssign}(v_role, ${id})`;
-			if (custom && declared !== void 0) {
-				const platform = `${customFn}(null, 'global', null, v_role)`;
-				allowed = entry.id === void 0 || entry.tenant === void 0 ? `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) else ${platform} end` : `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) when ${id} is null then ${platform} else ${customFn}(${row}.${quoteIdent(entry.tenant)}::${tenantType}, ${quoteLiteral(entry.scope)}, ${id}, v_role) end`;
+	const skipped = ctx.skipOwnershipTriggers;
+	for (const { name } of ctx.scopes) {
+		const counted = own.counted.filter((rule) => rule.scope === name);
+		if (counted.length === 0) continue;
+		if (skipped === "all" || skipped?.includes(name) === true) {
+			chunks.push(`-- ${name}: rls.ownershipTriggers leaves out the triggers, so min, max and transferOnly are checked only by decideRoleChange`);
+			continue;
+		}
+		const transfer = counted.filter((rule) => rule.transferOnly).map((rule) => rule.role);
+		const mapped = scopeTable(ctx, name);
+		if (mapped === void 0) {
+			const sources = holderSources(ctx, name);
+			if (sources === void 0) chunks.push(`-- ${name}: no memberships table configured, so min, max and transferOnly are checked only by decideRoleChange`);
+			else if (sources === "not-tables") chunks.push(`-- ${name}: a membership source is not a table, so min, max and transferOnly are checked only by decideRoleChange`);
+			else {
+				chunks.push(sourceHoldersTriggerSql(ctx, name, sources, counted));
+				if (transfer.length > 0) chunks.push(sourceTransferTriggerSql(ctx, name, sources, transfer));
 			}
-			return `    foreach v_role in array array[${rowRoles(entry, row).join(", ")}]::text[] loop
-      if v_role is not null and not coalesce(${allowed}, false) then
-        raise exception using
-          errcode = '42501',
-          message = 'permdock: the caller may not assign ' || v_role || ' in ' || coalesce(${id}, 'null'),
-          hint = 'not-assignable-by';
-      end if;
-    end loop;`;
-		};
-		const what = entry.id === void 0 ? "global roles" : `${entry.scope} roles`;
-		chunks.push(`-- ${entry.table}: a client role may write only the ${what} it may assign${ownUser === void 0 ? "" : ", and none on its own rows"}
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-volatile
-set search_path = ''
-as $$
-declare
-  v_role text;
-begin
-  if not (${clients}) then
-    return coalesce(new, old);
-  end if;
-  if tg_op in ('UPDATE', 'DELETE') then
-${ownCheck("old", "self-demotion")}${check("old")}
-  end if;
-  if tg_op in ('INSERT', 'UPDATE') then
-${ownCheck("new", "not-assignable-by")}${check("new")}
-  end if;
-  return coalesce(new, old);
-end;
-$$;
-revoke execute on function ${fn}() from public, anon, authenticated;
-drop trigger if exists "permdock_assignment" on ${table};
-create trigger "permdock_assignment"
-  before insert or update or delete on ${table}
-  for each row execute function ${fn}();`);
+			continue;
+		}
+		chunks.push(holdersTriggerSql(ctx, name, mapped.table, mapped.column, counted));
+		if (transfer.length > 0) chunks.push(transferTriggerSql(ctx, name, mapped.table, mapped.column, transfer));
 	}
-	return `${chunks.join("\n\n")}\n`;
-}
-function declaredArray(values) {
-	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
+	if (own.assigns.length > 0) {
+		chunks.push(canAssignSql(ctx, own));
+		if (ctx.authorize === "database") chunks.push(canAssignSql(ctx, own, true));
+		const custom = assignsCustomRoles(ctx);
+		if (custom) {
+			chunks.push(canAssignCustomSql(ctx));
+			if (hasCustomRoleChecksFor(ctx)) chunks.push(canAssignCustomSql(ctx, true));
+		}
+		chunks.push(canAssignAnySql(ctx, custom));
+		if (hasCanAssignAnyFor(ctx)) chunks.push(canAssignAnySql(ctx, custom, true));
+	}
+	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
 }
 //#endregion
-export { ownershipRules as a, guardedTables as i, OWNERSHIP as n, ownershipSql as o, assignmentSql as r, ASSIGNMENTS as t };
+export { ASSIGNMENTS as a, guardedTables as i, ownershipSql as n, OWNERSHIP as o, assignmentSql as r, ownershipRules as t };