permdock 0.3.0 → 0.4.0

package/dist/{rls-verify-CVQTHTh5.js → verify-BztUB3GX.js}

@@ -1,41 +1,652 @@
-import { _ as listPermissions, d as isEdgeRelation, f as isFieldRelation, i as findPermission, m as isPrincipalRelation } from "./permissions-DVoF6dMt.js";
-import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
-import { _ as memoryRoleSource } from "./src-BDwEZWrZ.js";
-import { d as scopeList } from "./scopes-CVdPrWN-.js";
-import { g as customRoleScope, t as createPermDock, v as membershipsClaim } from "./permdock-CbgvLnuo.js";
-import { t as memoryRelations } from "./relations-cjOL01hZ.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { a as hasConditionOp } from "./refs-f3imMjNW.js";
+import { f as memoryRelations, g as memoryRoleSource } from "./src-Bb7no-hS.js";
+import { d as scopeList } from "./scopes-tvpa34ep.js";
+import { c as listPermissions, n as findPermission } from "./permission-registry-BsblpB-z.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
+import { o as flattenGrantee } from "./grantee-CXY-0C87.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-MQs5NIuX.js";
+import { g as customRoleScope, t as createPermDock, v as membershipsClaim } from "./permdock-L26udHSk.js";
 import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DWtg0gGR.js";
+import { o as loadPolicyAt } from "./load-C3_oTHyO.js";
+import { c as relationArmSql, u as restrictedRowsSql } from "./compile-CcEu2ZQ1.js";
 import "./budget-NbEtbJC_.js";
-import "./sources-4p0-4xQm.js";
-import { G as quoteIdent, K as quoteLiteral, b as columnTypesOf, q as quoteTable } from "./rls-shared-Cewd_-zI.js";
-import { p as commandFor, s as viewName, t as FIELD_VIEWS, w as connectPg } from "./rls-fields-74oZPXWL.js";
-import { a as HELPER_TABLE_POLICIES_SQL, d as rowConditionMessage, n as graphPlan, u as helperTablePoliciesFromRows } from "./rls-graph-CHwx0V8q.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
-import { resolve } from "node:path";
+import { r as qualifySqlTable } from "./sql-t8teWOfo.js";
+import "./sources-B1-b-R0t.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-h2eG2OZV.js";
+import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, a as customRolesOn, j as helperSchema, r as HELPERS } from "./shared-1uhI-e-b.js";
+import { I as linkHelper, J as activeUserSql, M as graphHelper, N as graphSqlName, P as graphSqlText, W as restrictedHelper, Z as pgConnector, j as CLOSURE } from "./permission-keys-B26jeyUv.js";
+import { p as commandFor, s as viewName, t as FIELD_VIEWS } from "./fields-fwfXN01n.js";
 import { randomUUID } from "node:crypto";
-//#region src/cli/rls-verify-tree.ts
-const SUBJECTS = 3;
-function tableSql(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
+//#region src/cli/sql/helper-calls.ts
+/**
+* Tables whose policies other packages write by calling the SQL helpers
+* directly (storage buckets and realtime topics).
+*/
+const HELPER_TABLES = ["storage.objects", "realtime.messages"];
+const HELPER_CALL = new RegExp(String.raw`\b(${HELPERS.has}(?:_permission)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?)\s*\(\s*'((?:[^']|'')+)'(\s*,\s*(false\b)?)?`, "giu");
+const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}(?:_permission)?(?:_for)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?(?:_for)?|member_[a-z][a-z0-9_]*_ids(?:_for)?)\s*\(`, "iu");
+/** Whether a policy expression calls any generated helper, the key-less `member_<scope>_ids` included. */
+function callsHelper(sql) {
+	return ANY_HELPER.test(sql);
+}
+/**
+* The permission keys a policy expression passes to `permdock_has`,
+* `permitted_<scope>_ids` or their permission-key forms, `#n` stripped. With
+* `blind`, only the calls that ignore row conditions: the grant-key forms,
+* and a permission-key form asked for conditioned allows. A plain
+* `permdock_has_permission(key)` or `permitted_<scope>_ids_by_permission(key)`
+* counts only allows without a row condition, so it never grants more than
+* the application does.
+*/
+function helperCallKeys(sql, blind = false) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [, name = "", literal = "", extra, falsy] of sql.matchAll(HELPER_CALL)) {
+		const byPermission = /_permission$/iu.test(name);
+		if (blind && byPermission && (extra === void 0 || falsy !== void 0)) continue;
+		const key = literal.replaceAll("''", "'").split("#")[0] ?? "";
+		if (key !== "") keys.add(key);
+	}
+	return [...keys];
+}
+const CREATE_POLICY = /\bcreate\s+policy\s+("(?:[^"]|"")+"|\w+)\s+on\s+((?:"[^"]+"|\w+)\.(?:"[^"]+"|\w+))([\s\S]*?);/giu;
+function tableName(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+function helperTable(name) {
+	const table = tableName(name);
+	return HELPER_TABLES.find((candidate) => candidate === table);
+}
+/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their condition-blind helper calls pass. */
+function helperTablePolicies(sql) {
+	const text = sql.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+	const found = [];
+	for (const [, name = "", target = "", body = ""] of text.matchAll(CREATE_POLICY)) {
+		const table = helperTable(target);
+		const keys = helperCallKeys(body, true);
+		if (table !== void 0 && keys.length > 0) found.push({
+			table,
+			name: name.replaceAll("\"", ""),
+			keys
+		});
+	}
+	return found;
+}
+/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db`. */
+const HELPER_TABLE_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, coalesce(qual, '') || ' ' || coalesce(with_check, '') as body
+from pg_policies
+where (schemaname, tablename) in (('storage', 'objects'), ('realtime', 'messages'))`;
+/** The same rows as {@link helperTablePolicies}, from `pg_policies`. */
+function helperTablePoliciesFromRows(rows) {
+	const found = [];
+	for (const row of rows) {
+		const table = helperTable(String(row["target"] ?? ""));
+		const keys = helperCallKeys(String(row["body"] ?? ""), true);
+		if (table !== void 0 && keys.length > 0) found.push({
+			table,
+			name: String(row["policyname"] ?? ""),
+			keys
+		});
+	}
+	return found;
 }
-function idFactory(node) {
+/** The message PD037 and `rls verify --db` report for one policy. */
+function rowConditionMessage(policy, keys) {
+	return `${policy.table} policy '${policy.name}' calls the SQL helpers with ${keys.join(", ")}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`;
+}
+const ROW_CONDITION_FIX = "call permitted_<scope>_ids_by_permission('<key>') or permdock_has_permission('<key>'), which count only the allows without a row condition (a relationship grant never reaches a topic or a folder), or use a permission whose catalog entry has rowConditions: false";
+//#endregion
+//#region src/cli/rls/verify-pgtap.ts
+/** A custom role's scope and pinned instance, as the `custom_role_*` tables store them. */
+function customRoleAt(role, scopes) {
+	return {
+		scope: customRoleScope(role, scopes),
+		id: role.scope === void 0 ? role.team : role.id
+	};
+}
+function columnsOf(row) {
+	return isRecord(row) ? Object.entries(row).filter(([, value]) => value !== void 0 && typeof value !== "object") : [];
+}
+/**
+* The statement a fixture runs: `create` inserts the whole row, `update` writes
+* `newRow` when given. Each reads back only the key, so `--revoke-columns`
+* (which keeps only unrestricted columns readable) does not reject it.
+*/
+function statementFor(fixture, action, table) {
+	const quoted = quoteTable(table);
+	const id = quoteIdent("id");
+	const key = rowId(fixture.row);
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return {
+			sql: `select ${id} from ${quoted} where ${id} = $1`,
+			values: [key]
+		};
+		case "update": {
+			const next = columnsOf(fixture.newRow).filter(([name]) => name !== "id");
+			return {
+				sql: `update ${quoted} set ${next.length === 0 ? `${id} = ${id}` : next.map(([name], index) => `${quoteIdent(name)} = $${index + 2}`).join(", ")} where ${id} = $1 returning ${id}`,
+				values: [key, ...next.map(([, value]) => value)]
+			};
+		}
+		case "create": {
+			const cols = columnsOf(fixture.row);
+			if (cols.length === 0) return {
+				sql: `insert into ${quoted} (${id}) values ($1) returning ${id}`,
+				values: [key]
+			};
+			return {
+				sql: `insert into ${quoted} (${cols.map(([name]) => quoteIdent(name)).join(", ")}) values (${cols.map((_, index) => `$${index + 1}`).join(", ")}) returning ${id}`,
+				values: cols.map(([, value]) => value)
+			};
+		}
+		case "delete": return {
+			sql: `delete from ${quoted} where ${id} = $1 returning ${id}`,
+			values: [key]
+		};
+		default: return {
+			sql: `select ${id} from ${quoted} where ${id} = $1`,
+			values: [key]
+		};
+	}
+}
+function rowId(row) {
+	if (isRecord(row) && "id" in row) return row["id"];
+}
+/** A fixture value as a SQL literal; untyped, so it coerces to the column like a bound parameter. */
+function sqlValue(value) {
+	if (value === null || value === void 0) return "null";
+	return quoteLiteral(typeof value === "string" ? value : JSON.stringify(value));
+}
+function inlineStatement(statement) {
+	return statement.sql.replaceAll(/\$(\d+)/gu, (_, index) => sqlValue(statement.values[Number(index) - 1]));
+}
+const PGTAP_DECISION = "pg_temp.permdock_decision";
+const PGTAP_DECISION_SQL = `create function ${PGTAP_DECISION}(statement text) returns text
+language plpgsql
+as $$
+declare
+  affected bigint;
+begin
+  execute statement;
+  get diagnostics affected = row_count;
+  return case when affected > 0 then 'granted' else 'denied' end;
+exception
+  when others then
+    return 'denied';
+end;
+$$;`;
+function subjectOf(config, customRoles, scopes) {
+	return {
+		dialect: config.rls?.dialect ?? "supabase",
+		gucPrefix: config.rls?.gucPrefix ?? "app",
+		tenantClaim: config.rls?.tenantClaim ?? "tenant_id",
+		roleClaim: config.rls?.roleClaim ?? "user_role",
+		customRoles,
+		scopes
+	};
+}
+/** The settings that bind a fixture's subject: the GUCs, or the Supabase JWT claims. */
+function subjectSettings(fixture, subject) {
+	const roles = fixture.subject.roles ?? [];
+	const memberships = membershipsClaim(fixture.subject.memberships ?? [], subject.customRoles, subject.scopes);
+	if (subject.dialect === "guc") {
+		const settings = [
+			[`${subject.gucPrefix}.user_id`, fixture.subject.id],
+			[`${subject.gucPrefix}.${subject.roleClaim}`, roles.join(",")],
+			[`${subject.gucPrefix}.memberships`, JSON.stringify(memberships)]
+		];
+		if (fixture.subject.tenant !== void 0) settings.push([`${subject.gucPrefix}.${subject.tenantClaim}`, fixture.subject.tenant]);
+		return settings;
+	}
+	const claims = {
+		...fixture.subject.claims,
+		sub: fixture.subject.id,
+		role: "authenticated",
+		[subject.roleClaim]: roles.length === 1 ? roles[0] : roles,
+		[subject.tenantClaim]: fixture.subject.tenant,
+		memberships
+	};
+	return [["request.jwt.claims", JSON.stringify(claims)]];
+}
+/** The `custom_role_*` rows for the fixtures' custom roles; existing rows are kept. */
+function customRoleRows(schema, customRoles, scopes) {
+	const table = (name) => `${quoteIdent(schema)}.${quoteIdent(name)}`;
+	const rows = [];
+	for (const role of customRoles) {
+		const at = customRoleAt(role, scopes);
+		if (at.scope === void 0) continue;
+		for (const grant of role.grants ?? []) rows.push({
+			sql: grant.level === void 0 ? `insert into ${table("custom_role_permissions")} (tenant_id, scope, scope_id, role, permission, effect) values ($1, $2, $3, $4, $5, $6) on conflict do nothing` : `insert into ${table("custom_role_permissions")} (tenant_id, scope, scope_id, role, permission, effect, level) values ($1, $2, $3, $4, $5, $6, $7) on conflict do nothing`,
+			values: [
+				role.tenant ?? null,
+				at.scope,
+				at.id ?? null,
+				role.name,
+				grant.permission,
+				grant.effect ?? "allow",
+				...grant.level === void 0 ? [] : [grant.level]
+			]
+		});
+		for (const name of role.includes ?? []) rows.push({
+			sql: `insert into ${table("custom_role_includes")} (tenant_id, scope, scope_id, role, include_role) values ($1, $2, $3, $4, $5) on conflict do nothing`,
+			values: [
+				role.tenant ?? null,
+				at.scope,
+				at.id ?? null,
+				role.name,
+				name
+			]
+		});
+	}
+	return rows;
+}
+function seedsCustomRoleTables(config) {
+	const rls = config.rls;
+	return customRolesOn(rls) && (rls?.authorize ?? rls?.rbac?.authorize ?? "jwt") === "database";
+}
+function customRoleSchema(config) {
+	return config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
+}
+/**
+* A pgTAP script that runs each fixture's statement under the fixture's
+* subject and asserts the outcome `can()` gave in-process.
+*/
+function emitPgtap(input) {
+	const scopes = scopeList(input.policy.scopes);
+	const subject = subjectOf(input.config, input.customRoles, scopes);
+	const lines = [
+		"begin;",
+		`select plan(${String(input.fixtures.length)});`,
+		PGTAP_DECISION_SQL
+	];
+	if (seedsCustomRoleTables(input.config)) for (const row of customRoleRows(customRoleSchema(input.config), input.customRoles, scopes)) lines.push(`${inlineStatement(row)};`);
+	for (const [index, fixture] of input.fixtures.entries()) {
+		const permission = findPermission(input.policy.permissions, fixture.action);
+		const status = input.inProcess[index];
+		const label = `fixture ${String(index)} ${fixture.action}`;
+		if (permission === void 0 || status === void 0) continue;
+		if (status.kind === "opaque") {
+			lines.push(`select skip(${quoteLiteral(`${label}: opaque grant untestable app-side`)}, 1);`);
+			continue;
+		}
+		const outcome = status.granted ? "granted" : "denied";
+		const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
+		const statement = inlineStatement(statementFor(fixture, permission.action, table));
+		lines.push(`-- ${label}`, "savepoint permdock_fixture;", "set local role \"authenticated\";", ...subjectSettings(fixture, subject).map(([name, value]) => `select set_config(${quoteLiteral(name)}, ${quoteLiteral(value)}, true);`), `select is(${PGTAP_DECISION}(${quoteLiteral(statement)}), ${quoteLiteral(outcome)}, ${quoteLiteral(`${label} ${outcome}`)});`, "rollback to savepoint permdock_fixture;");
+	}
+	lines.push("select * from finish();", "rollback;");
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls/graph.ts
+function tableFor(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+/** Every `related` condition the policy's grants compile to, with the resource graph they need, groups included. */
+function graphPlan(policy) {
+	const scopes = scopeList(policy.scopes);
+	const plan = /* @__PURE__ */ new Map();
+	const entryFor = (node) => {
+		const entry = plan.get(node.name) ?? {
+			node,
+			relations: /* @__PURE__ */ new Set(),
+			links: /* @__PURE__ */ new Set()
+		};
+		plan.set(node.name, entry);
+		return entry;
+	};
+	const addRelation = (node, relation) => {
+		const entry = entryFor(node);
+		if (entry.relations.has(relation)) return;
+		entry.relations.add(relation);
+		for (const name of expandRelation(node, relation)) {
+			const spec = node.relations[name];
+			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
+			for (const { resource, relation: groupRelation } of groupEntries(spec)) {
+				const target = policy.resources.get(resource);
+				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
+			}
+		}
+	};
+	const addLinks = (hops) => {
+		for (let index = 1; index < hops.length; index += 1) {
+			const from = policy.resources.get(hops[index - 1]?.resource ?? "");
+			const hop = hops[index];
+			if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
+		}
+	};
+	const addAbove = (above) => {
+		const node = above === void 0 ? void 0 : policy.resources.get(above.resource);
+		if (above === void 0 || node === void 0) return;
+		const entry = entryFor(node);
+		entry.closure = Math.max(entry.closure ?? 0, above.depth);
+		entry.restrictedAncestors = above;
+	};
+	for (const grant of policy.grants) {
+		const row = policy.resources.get(grant.permission.resource);
+		for (const item of flattenGrantee(grant.to)) {
+			if (item.kind === "inherit") {
+				const inherited = inheritCondition(item, row, policy.resources);
+				addLinks(inherited?.hops ?? []);
+				addAbove(inherited?.restrictedAncestors);
+				continue;
+			}
+			if (item.kind !== "relation") continue;
+			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
+			if (condition?.op !== "related") continue;
+			const node = policy.resources.get(condition.resource);
+			if (node === void 0) continue;
+			addRelation(node, condition.relation);
+			const entry = entryFor(node);
+			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
+			addLinks(condition.hops ?? []);
+			addAbove(condition.restrictedAncestors);
+		}
+	}
+	return plan;
+}
+/** The closure depth per walked resource, as `RlsSqlContext.graph` carries it. */
+function closureDepths(plan) {
+	const out = {};
+	for (const [name, entry] of plan) if (entry.closure !== void 0) out[name] = entry.closure;
+	return out;
+}
+/**
+* The `permitted_<resource>_ids(relation)` arm for one concrete relation:
+* ids of `resource` the subject holds it on, directly or through a group.
+* `asked` are the relation names that include it, so a call for any of them
+* (or for all, with null) reads this arm.
+*/
+function relationArm(ctx, plan, node, relation, asked, tables) {
+	const spec = node.relations[relation];
+	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw new Error(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
+	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
+	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifySqlTable,
+		holders: (resource, groupRelation) => [{ text: `select ${qualified(ctx, graphHelper(resource))}(${quoteLiteral(groupRelation)})` }]
+	}), ctx)}) a\n  where ${guard}${activeUserSql(ctx).map((part) => ` and ${part}`).join("")}`;
+}
+function permittedSql(ctx, plan, entry, tables) {
+	const fn = qualified(ctx, graphHelper(entry.node.name));
+	const asked = [...entry.relations].toSorted();
+	const arms = [...new Set(asked.flatMap((name) => expandRelation(entry.node, name)))].toSorted().map((relation) => relationArm(ctx, plan, entry.node, relation, asked.filter((name) => expandRelation(entry.node, name).includes(relation)), tables));
+	if (arms.length === 0) arms.push("  select null::text where false");
+	return `-- ${entry.node.name}: ids the subject holds a relation on (all relations when p_relation is null)
+create or replace function ${fn}(p_relation text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+${arms.join("\n  union\n")}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+}
+/** `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points into `ids`, read past the table's own policies. */
+function linkSql(ctx, node, link, tables) {
+	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
+	if (spec === void 0) throw new Error(`PermDock CLI: ${node.name} has no link '${link}'`);
+	const fn = qualified(ctx, linkHelper(node.name, link));
+	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
+create or replace function ${fn}(p_ids text[])
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select t.${quoteIdent(node.id)}::text from ${quoteQualified(tableFor(node.name, tables))} t
+  where t.${quoteIdent(spec.field)}::text = any(p_ids)
+$$;
+revoke execute on function ${fn}(text[]) from public, anon;
+grant execute on function ${fn}(text[]) to authenticated;`;
+}
+function closureTableSql(ctx) {
+	const table = qualified(ctx, CLOSURE.table);
+	return `-- the object graph: one row per (ancestor, descendant) within each walked resource's depth,
+-- never crossing a restricted row; kept current by statement triggers on each self-parented table
+create table if not exists ${table} (
+  resource text not null,
+  ancestor text not null,
+  descendant text not null,
+  depth integer not null check (depth >= 0),
+  primary key (resource, descendant, ancestor)
+);
+create index if not exists ${quoteIdent(`${CLOSURE.table}_ancestor`)} on ${table} (resource, ancestor);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;
+grant select on table ${table} to authenticated;`;
+}
+function closureObjectsSql(ctx, entry, depth, tables) {
+	const { node } = entry;
+	const parent = node.parent;
+	if (parent === void 0) return "";
+	const name = node.name;
+	const sqlName = graphSqlName(name) ?? name;
+	const closure = qualified(ctx, CLOSURE.table);
+	const table = quoteQualified(tableFor(name, tables));
+	const id = quoteIdent(node.id);
+	const up = quoteIdent(parent.field);
+	const restricted = restrictedFor(node, "parent");
+	const stop = restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(restricted)}, false)`;
+	const stopParent = restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(restricted)}, false)`;
+	const refresh = qualified(ctx, `${CLOSURE.table}_${sqlName}`);
+	const changed = qualified(ctx, `${CLOSURE.table}_${sqlName}_changed`);
+	const literal = quoteLiteral(name);
+	const restrictedChanged = restricted === void 0 ? "" : ` or n.${quoteIdent(restricted)} is distinct from o.${quoteIdent(restricted)}`;
+	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${sqlName}_${suffix}`);
+	return `-- ${name}: ${restricted === void 0 ? `rows reach their ancestors up to depth ${String(depth)}` : `rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row`}
+drop policy if exists ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure};
+create policy ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure}
+  for select to authenticated
+  using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
+create or replace function ${refresh}(p_ids text[])
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_cycle text;
+  v_affected text[];
+begin
+  with recursive walk(start, next, path) as (
+    select t.${id}, t.${up}, array[t.${id}::text]
+    from ${table} t
+    where t.${id}::text = any(p_ids)
+    union all
+    select walk.start, t.${up}, walk.path || t.${id}::text
+    from walk join ${table} t on t.${id} = walk.next
+    where not (walk.next::text = any(walk.path))
+  )
+  select walk.start::text into v_cycle
+  from walk
+  where walk.next::text = any(walk.path)
+  limit 1;
+  if v_cycle is not null then
+    raise exception 'permdock: % % is its own ancestor', ${literal}, v_cycle
+      using errcode = 'check_violation';
+  end if;
+  with recursive down(id, level) as (
+    select t.${id}, 0
+    from ${table} t
+    where t.${id}::text = any(p_ids) or t.${up}::text = any(p_ids)
+    union
+    select t.${id}, down.level + 1
+    from down join ${table} t on t.${up} = down.id
+    where down.level < ${String(depth)}
+  )
+  select coalesce(array_agg(distinct down.id::text), '{}') into v_affected from down;
+  delete from ${closure} c
+  where c.resource = ${literal}
+    and (c.descendant = any(p_ids) or c.descendant = any(v_affected));
+  insert into ${closure} (resource, ancestor, descendant, depth)
+  with recursive walk(descendant, ancestor, parent, depth, stop) as (
+    select t.${id}::text, t.${id}, t.${up}, 0, ${stop}
+    from ${table} t
+    where t.${id}::text = any(v_affected)
+    union all
+    select walk.descendant, p.${id}, p.${up}, walk.depth + 1, ${stopParent}
+    from walk join ${table} p on p.${id} = walk.parent
+    where not walk.stop and walk.depth < ${String(depth)}
+  )
+  select ${literal}, walk.ancestor::text, walk.descendant, walk.depth from walk
+  on conflict do nothing;
+end
+$$;
+revoke execute on function ${refresh}(text[]) from public, anon, authenticated;
+create or replace function ${changed}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'TRUNCATE' then
+    delete from ${closure} where resource = ${literal};
+  elsif tg_op = 'INSERT' then
+    perform ${refresh}(array(select n.${id}::text from new_rows n));
+  elsif tg_op = 'DELETE' then
+    perform ${refresh}(array(select o.${id}::text from old_rows o));
+  else
+    perform ${refresh}(array(
+      select n.${id}::text
+      from new_rows n left join old_rows o on o.${id} = n.${id}
+      where o.${id} is null or n.${up} is distinct from o.${up}${restrictedChanged}
+      union
+      select o.${id}::text
+      from old_rows o left join new_rows n on n.${id} = o.${id}
+      where n.${id} is null
+    ));
+  end if;
+  return null;
+end
+$$;
+revoke execute on function ${changed}() from public, anon, authenticated;
+drop trigger if exists ${trigger("insert")} on ${table};
+create trigger ${trigger("insert")} after insert on ${table}
+  referencing new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("update")} on ${table};
+create trigger ${trigger("update")} after update on ${table}
+  referencing old table as old_rows new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("delete")} on ${table};
+create trigger ${trigger("delete")} after delete on ${table}
+  referencing old table as old_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("truncate")} on ${table};
+create trigger ${trigger("truncate")} after truncate on ${table}
+  for each statement execute function ${changed}();
+select ${refresh}(array(select t.${id}::text from ${table} t));`;
+}
+function restrictedRowsHelperSql(ctx, plan, entry, tables) {
+	const above = entry.restrictedAncestors;
+	if (above === void 0) return "";
+	const fn = qualified(ctx, restrictedHelper(entry.node.name));
+	const body = graphSqlText(restrictedRowsSql(above, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifySqlTable,
+		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
+		closureDepths: closureDepths(plan)
+	}), ctx);
+	return `-- ${entry.node.name}: rows a stopped link does not reach below: restricted, under a restricted row within ${String(above.depth - 1)} levels, or deeper
+create or replace function ${fn}()
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  ${body}
+$$;
+revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;`;
+}
+/** Group resources a resource's asked relations name, other than itself. */
+function groupTargets(entry) {
+	const out = /* @__PURE__ */ new Set();
+	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
+		const spec = entry.node.relations[name];
+		const resources = isEdgeRelation(spec) ? groupEntries(spec).map((group) => group.resource) : [];
+		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
+	}
+	return [...out].toSorted();
+}
+/** Plan entries by name, each after the group resources its helper calls (SQL function bodies are checked on create). */
+function dependencyOrder(plan) {
+	const out = [];
+	const done = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		const entry = plan.get(name);
+		if (entry === void 0 || done.has(name)) return;
+		done.add(name);
+		for (const target of groupTargets(entry)) visit(target);
+		out.push(entry);
+	};
+	for (const name of [...plan.keys()].toSorted()) visit(name);
+	return out;
+}
+/**
+* The graph preamble: `permitted_<resource>_ids` for every resource a graph
+* grant reads, and the closure table with its triggers for every
+* self-parented resource a grant walks. Empty when no grant is a graph grant.
+*/
+function graphSql(ctx, plan, tables) {
+	if (plan.size === 0) return "";
+	const sqlNames = /* @__PURE__ */ new Map();
+	for (const name of plan.keys()) {
+		const helper = graphHelper(name);
+		const sql = graphSqlName(name) ?? name;
+		if (ctx.scopes.some((scope) => scope.name === sql)) throw new Error(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
+		const other = sqlNames.get(sql);
+		if (other !== void 0) throw new Error(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
+		sqlNames.set(sql, name);
+	}
+	const entries = dependencyOrder(plan);
+	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 && entry.closure === void 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
+	const walked = entries.filter((entry) => entry.closure !== void 0);
+	if (walked.length > 0) {
+		chunks.push(closureTableSql(ctx));
+		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
+		for (const entry of walked) {
+			const helper = restrictedRowsHelperSql(ctx, plan, entry, tables);
+			if (helper !== "") chunks.push(helper);
+		}
+	}
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls/verify-tree.ts
+const SYSTEM_ENTROPY = Object.freeze({
+	now: () => Date.now(),
+	randomUUID: () => randomUUID()
+});
+const SUBJECTS = 3;
+function idFactory(node, entropy) {
 	const type = columnTypesOf(jsonSchemaOf(node))[node.id];
 	let next = 9e5;
 	return type === "numeric" ? () => {
 		next += 1;
 		return next;
-	} : () => randomUUID();
+	} : () => entropy.randomUUID();
 }
 /**
 * Two spines one level deeper than the walk depth, so the depth cap is
 * crossed; side branches under the first levels alternate restricted, and
 * the second spine is restricted two levels down.
 */
-function generateTree(node, depth) {
-	const id = idFactory(node);
+function generateTree(node, depth, entropy) {
+	const id = idFactory(node, entropy);
 	const nodes = [];
 	for (const spine of [0, 1]) {
 		let parent = null;
@@ -72,7 +683,7 @@ function insertSql(table, rows) {
 		return `$${String(values.length)}`;
 	}).join(", ")})`);
 	return {
-		sql: `insert into ${tableSql(table)} (${columns.map(quoteIdent).join(", ")}) values ${tuples.join(", ")} returning *`,
+		sql: `insert into ${quoteQualified(table)} (${columns.map(quoteIdent).join(", ")}) values ${tuples.join(", ")} returning *`,
 		values
 	};
 }
@@ -119,20 +730,20 @@ function checkedValue(checks) {
 		}
 	}
 }
-function placeholder(column) {
+function placeholder(column, entropy) {
 	if (column.enumLabel !== null) return column.enumLabel;
 	const checked = checkedValue(column.checks);
 	if (checked !== void 0) return checked;
 	const type = column.type;
-	if (type === "uuid") return randomUUID();
+	if (type === "uuid") return entropy.randomUUID();
 	if (type === "boolean") return false;
 	if (/^(smallint|integer|bigint|numeric|real|double precision)/u.test(type)) return 0;
-	if (type.startsWith("timestamp") || type === "date") return (/* @__PURE__ */ new Date()).toISOString();
+	if (type.startsWith("timestamp") || type === "date") return new Date(entropy.now()).toISOString();
 	if (type === "json" || type === "jsonb") return {};
 	return "permdock-tree";
 }
-function distinctPlaceholder(column, index) {
-	const value = placeholder(column);
+function distinctPlaceholder(column, index, entropy) {
+	const value = placeholder(column, entropy);
 	if (column.enumLabel !== null) return value;
 	if (typeof value === "number") return value + index;
 	if (typeof value !== "string" || checkedValue(column.checks) !== void 0) return value;
@@ -157,7 +768,7 @@ function asRequiredColumn(row) {
 * tenant column or a name: an existing value of the referenced table for a
 * foreign key, a placeholder of the column's type otherwise.
 */
-async function requiredValues(query, table, set) {
+async function requiredValues(query, table, set, entropy) {
 	const columns = (await query(REQUIRED_COLUMNS_SQL, [table])).rows.map(asRequiredColumn).filter((column) => column !== void 0 && !set.has(column.name));
 	const unique = new Set(columns.length === 0 ? [] : (await query(UNIQUE_COLUMNS_SQL, [table])).rows.map((row) => String(row["name"])));
 	const values = {};
@@ -166,16 +777,16 @@ async function requiredValues(query, table, set) {
 		const existing = await query(`select ${quoteIdent(column.refColumn)} as value from ${column.refTable} limit 1`);
 		values[column.name] = existing.rows[0]?.["value"] ?? null;
 	} else if (unique.has(column.name)) distinct.push(column);
-	else values[column.name] = placeholder(column);
+	else values[column.name] = placeholder(column, entropy);
 	return (index) => {
 		const row = { ...values };
-		for (const column of distinct) row[column.name] = distinctPlaceholder(column, index);
+		for (const column of distinct) row[column.name] = distinctPlaceholder(column, index, entropy);
 		return row;
 	};
 }
 /** Inserts `rows` after filling the required columns they leave out. */
-async function seedRows(query, table, rows, given = {}) {
-	const fill = await requiredValues(query, tableSql(table), /* @__PURE__ */ new Set([...Object.keys(rows[0] ?? {}), ...Object.keys(given)]));
+async function seedRows(query, table, rows, given, entropy) {
+	const fill = await requiredValues(query, quoteQualified(table), /* @__PURE__ */ new Set([...Object.keys(rows[0] ?? {}), ...Object.keys(given)]), entropy);
 	const inserted = insertSql(table, rows.map((row, index) => ({
 		...fill(index),
 		...given,
@@ -192,9 +803,10 @@ async function seedRows(query, table, rows, given = {}) {
 */
 async function verifyTree(input) {
 	const { policy, query } = input;
+	const entropy = input.entropy ?? SYSTEM_ENTROPY;
 	const tables = input.config.rls?.tables;
 	const treeValues = input.config.rls?.treeValues ?? {};
-	const seed = (table, list) => seedRows(query, table, list, treeValues[table] ?? {});
+	const seed = (table, list) => seedRows(query, table, list, treeValues[table] ?? {}, entropy);
 	const walked = [...graphPlan(policy).values()].filter((entry) => entry.closure !== void 0);
 	if (walked.length === 0) return {
 		checked: 0,
@@ -202,15 +814,15 @@ async function verifyTree(input) {
 		mismatches: [],
 		notes: ["no graph grant walks a self-parented resource"]
 	};
-	const subjects = Array.from({ length: SUBJECTS }, () => randomUUID());
+	const subjects = Array.from({ length: SUBJECTS }, () => entropy.randomUUID());
 	const rows = {};
 	const edges = {};
-	const now = Date.now();
+	const now = entropy.now();
 	for (const entry of walked) {
 		const node = entry.node;
 		const parent = node.parent;
 		if (parent === void 0) continue;
-		const tree = generateTree(node, entry.closure ?? 0);
+		const tree = generateTree(node, entry.closure ?? 0, entropy);
 		const seeded = tree.map((item, index) => {
 			const row = {
 				[node.id]: item.id,
@@ -220,7 +832,7 @@ async function verifyTree(input) {
 			for (const name of entry.relations) {
 				const spec = node.relations[name];
 				const column = isFieldRelation(spec) ? spec.memberOf === void 0 ? spec.field : void 0 : isPrincipalRelation(spec) ? spec.principal : void 0;
-				if (column !== void 0 && column !== parent.field) row[column] = index % 4 === 0 ? subjects[index % SUBJECTS] : randomUUID();
+				if (column !== void 0 && column !== parent.field) row[column] = index % 4 === 0 ? subjects[index % SUBJECTS] : entropy.randomUUID();
 			}
 			return row;
 		});
@@ -259,7 +871,7 @@ async function verifyTree(input) {
 		}
 		for (const child of policy.resources.values()) {
 			if (child.name === node.name || child.parent?.resource !== node.name) continue;
-			const make = idFactory(child);
+			const make = idFactory(child, entropy);
 			const childRows = tree.map((item, index) => {
 				const row = {
 					[child.id]: make(),
@@ -293,7 +905,7 @@ async function verifyTree(input) {
 			const list = rows[permission.resource] ?? [];
 			if (node === void 0 || list.length === 0) continue;
 			const ids = list.map((row) => String(row[node.id]));
-			const visible = await query(`select ${quoteIdent(node.id)}::text as id from ${tableSql(tables?.[node.name] ?? node.name)} where ${quoteIdent(node.id)} = any($1)`, [ids]);
+			const visible = await query(`select ${quoteIdent(node.id)}::text as id from ${quoteQualified(tables?.[node.name] ?? node.name)} where ${quoteIdent(node.id)} = any($1)`, [ids]);
 			const seen = new Set(visible.rows.map((row) => String(row["id"])));
 			for (const row of list) {
 				checked += 1;
@@ -312,202 +924,7 @@ async function verifyTree(input) {
 	};
 }
 //#endregion
-//#region src/cli/rls-verify.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/** A custom role's scope and pinned instance, as the `custom_role_*` tables store them. */
-function customRoleAt(role, scopes) {
-	return {
-		scope: customRoleScope(role, scopes),
-		id: role.scope === void 0 ? role.team : role.id
-	};
-}
-function canFixture(permdock, permission, row) {
-	if (permission.kind === "collection") return permdock.can(permission, row);
-	return permdock.can(permission, row);
-}
-function grantKind(policy, key) {
-	const grants = policy.grants.filter((grant) => grant.permission.key === key);
-	if (grants.some((grant) => hasConditionOp(grant.where, "opaque") || hasConditionOp(grant.check, "opaque"))) return "opaque";
-	if (grants.some((grant) => hasConditionOp(grant.where, "sqlFunction") || hasConditionOp(grant.check, "sqlFunction"))) return "sqlFunction";
-	return "portable";
-}
-function columnsOf(row) {
-	return isRecord(row) ? Object.entries(row).filter(([, value]) => value !== void 0 && typeof value !== "object") : [];
-}
-/**
-* The statement a fixture runs: `create` inserts the whole row, `update` writes
-* `newRow` when given. Each reads back only the key, so `--revoke-columns`
-* (which keeps only unrestricted columns readable) does not reject it.
-*/
-function statementFor(fixture, action, table) {
-	const quoted = quoteTable(table);
-	const id = quoteIdent("id");
-	const key = rowId(fixture.row);
-	switch (action) {
-		case "read":
-		case "list":
-		case "get": return {
-			sql: `select ${id} from ${quoted} where ${id} = $1`,
-			values: [key]
-		};
-		case "update": {
-			const next = columnsOf(fixture.newRow).filter(([name]) => name !== "id");
-			return {
-				sql: `update ${quoted} set ${next.length === 0 ? `${id} = ${id}` : next.map(([name], index) => `${quoteIdent(name)} = $${index + 2}`).join(", ")} where ${id} = $1 returning ${id}`,
-				values: [key, ...next.map(([, value]) => value)]
-			};
-		}
-		case "create": {
-			const cols = columnsOf(fixture.row);
-			if (cols.length === 0) return {
-				sql: `insert into ${quoted} (${id}) values ($1) returning ${id}`,
-				values: [key]
-			};
-			return {
-				sql: `insert into ${quoted} (${cols.map(([name]) => quoteIdent(name)).join(", ")}) values (${cols.map((_, index) => `$${index + 1}`).join(", ")}) returning ${id}`,
-				values: cols.map(([, value]) => value)
-			};
-		}
-		case "delete": return {
-			sql: `delete from ${quoted} where ${id} = $1 returning ${id}`,
-			values: [key]
-		};
-		default: return {
-			sql: `select ${id} from ${quoted} where ${id} = $1`,
-			values: [key]
-		};
-	}
-}
-function rowId(row) {
-	if (isRecord(row) && "id" in row) return row["id"];
-}
-/** A fixture value as a SQL literal; untyped, so it coerces to the column like a bound parameter. */
-function sqlValue(value) {
-	if (value === null || value === void 0) return "null";
-	return quoteLiteral(typeof value === "string" ? value : JSON.stringify(value));
-}
-function inlineStatement(statement) {
-	return statement.sql.replaceAll(/\$(\d+)/gu, (_, index) => sqlValue(statement.values[Number(index) - 1]));
-}
-const PGTAP_DECISION = "pg_temp.permdock_decision";
-const PGTAP_DECISION_SQL = `create function ${PGTAP_DECISION}(statement text) returns text
-language plpgsql
-as $$
-declare
-  affected bigint;
-begin
-  execute statement;
-  get diagnostics affected = row_count;
-  return case when affected > 0 then 'granted' else 'denied' end;
-exception
-  when others then
-    return 'denied';
-end;
-$$;`;
-function subjectOf(config, customRoles, scopes) {
-	return {
-		dialect: config.rls?.dialect ?? "supabase",
-		gucPrefix: config.rls?.gucPrefix ?? "app",
-		tenantClaim: config.rls?.tenantClaim ?? "tenant_id",
-		roleClaim: config.rls?.roleClaim ?? "user_role",
-		customRoles,
-		scopes
-	};
-}
-/** The settings that bind a fixture's subject: the GUCs, or the Supabase JWT claims. */
-function subjectSettings(fixture, subject) {
-	const roles = fixture.subject.roles ?? [];
-	const memberships = membershipsClaim(fixture.subject.memberships ?? [], subject.customRoles, subject.scopes);
-	if (subject.dialect === "guc") {
-		const settings = [
-			[`${subject.gucPrefix}.user_id`, fixture.subject.id],
-			[`${subject.gucPrefix}.${subject.roleClaim}`, roles.join(",")],
-			[`${subject.gucPrefix}.memberships`, JSON.stringify(memberships)]
-		];
-		if (fixture.subject.tenant !== void 0) settings.push([`${subject.gucPrefix}.${subject.tenantClaim}`, fixture.subject.tenant]);
-		return settings;
-	}
-	const claims = {
-		...fixture.subject.claims,
-		sub: fixture.subject.id,
-		role: "authenticated",
-		[subject.roleClaim]: roles.length === 1 ? roles[0] : roles,
-		[subject.tenantClaim]: fixture.subject.tenant,
-		memberships
-	};
-	return [["request.jwt.claims", JSON.stringify(claims)]];
-}
-/** The `custom_role_*` rows for the fixtures' custom roles; existing rows are kept. */
-function customRoleRows(schema, customRoles, scopes) {
-	const table = (name) => `${quoteIdent(schema)}.${quoteIdent(name)}`;
-	const rows = [];
-	for (const role of customRoles) {
-		const at = customRoleAt(role, scopes);
-		if (at.scope === void 0) continue;
-		for (const grant of role.grants ?? []) rows.push({
-			sql: grant.level === void 0 ? `insert into ${table("custom_role_permissions")} (tenant_id, scope, scope_id, role, permission, effect) values ($1, $2, $3, $4, $5, $6) on conflict do nothing` : `insert into ${table("custom_role_permissions")} (tenant_id, scope, scope_id, role, permission, effect, level) values ($1, $2, $3, $4, $5, $6, $7) on conflict do nothing`,
-			values: [
-				role.tenant ?? null,
-				at.scope,
-				at.id ?? null,
-				role.name,
-				grant.permission,
-				grant.effect ?? "allow",
-				...grant.level === void 0 ? [] : [grant.level]
-			]
-		});
-		for (const name of role.includes ?? []) rows.push({
-			sql: `insert into ${table("custom_role_includes")} (tenant_id, scope, scope_id, role, include_role) values ($1, $2, $3, $4, $5) on conflict do nothing`,
-			values: [
-				role.tenant ?? null,
-				at.scope,
-				at.id ?? null,
-				role.name,
-				name
-			]
-		});
-	}
-	return rows;
-}
-function seedsCustomRoleTables(config) {
-	const rls = config.rls;
-	return rls?.customRoles === true && (rls.authorize ?? rls.rbac?.authorize ?? "jwt") === "database";
-}
-function customRoleSchema(config) {
-	return config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
-}
-/**
-* A pgTAP script that runs each fixture's statement under the fixture's
-* subject and asserts the outcome `can()` gave in-process.
-*/
-function emitPgtap(input) {
-	const scopes = scopeList(input.policy.scopes);
-	const subject = subjectOf(input.config, input.customRoles, scopes);
-	const lines = [
-		"begin;",
-		`select plan(${String(input.fixtures.length)});`,
-		PGTAP_DECISION_SQL
-	];
-	if (seedsCustomRoleTables(input.config)) for (const row of customRoleRows(customRoleSchema(input.config), input.customRoles, scopes)) lines.push(`${inlineStatement(row)};`);
-	for (const [index, fixture] of input.fixtures.entries()) {
-		const permission = findPermission(input.policy.permissions, fixture.action);
-		const status = input.inProcess[index];
-		const label = `fixture ${String(index)} ${fixture.action}`;
-		if (permission === void 0 || status === void 0) continue;
-		if (status.kind === "opaque") {
-			lines.push(`select skip(${quoteLiteral(`${label}: opaque grant untestable app-side`)}, 1);`);
-			continue;
-		}
-		const outcome = status.granted ? "granted" : "denied";
-		const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
-		const statement = inlineStatement(statementFor(fixture, permission.action, table));
-		lines.push(`-- ${label}`, "savepoint permdock_fixture;", "set local role \"authenticated\";", ...subjectSettings(fixture, subject).map(([name, value]) => `select set_config(${quoteLiteral(name)}, ${quoteLiteral(value)}, true);`), `select is(${PGTAP_DECISION}(${quoteLiteral(statement)}), ${quoteLiteral(outcome)}, ${quoteLiteral(`${label} ${outcome}`)});`, "rollback to savepoint permdock_fixture;");
-	}
-	lines.push("select * from finish();", "rollback;");
-	return `${lines.join("\n")}\n`;
-}
+//#region src/cli/rls/verify-database.ts
 /** Columns of `row` that hold a value; a masked column reads as null. */
 function valuedColumns(row) {
 	return isRecord(row) ? Object.keys(row).filter((name) => row[name] !== null && row[name] !== void 0).toSorted() : [];
@@ -654,14 +1071,26 @@ async function verifyTreeAgainstDatabase(db, policy, config, connect) {
 		await client.end();
 	}
 }
+//#endregion
+//#region src/cli/rls/verify.ts
+function canFixture(permdock, permission, row) {
+	if (permission.kind === "collection") return permdock.can(permission, row);
+	return permdock.can(permission, row);
+}
+function grantKind(policy, key) {
+	const grants = policy.grants.filter((grant) => grant.permission.key === key);
+	if (grants.some((grant) => hasConditionOp(grant.where, "opaque") || hasConditionOp(grant.check, "opaque"))) return "opaque";
+	if (grants.some((grant) => hasConditionOp(grant.where, "sqlFunction") || hasConditionOp(grant.check, "sqlFunction"))) return "sqlFunction";
+	return "portable";
+}
 async function runRlsVerify(input) {
-	const connect = input.connect ?? ((db) => connectPg(db, "permdock rls verify --db"));
+	const connect = input.connect ?? pgConnector("permdock rls verify --db");
 	const policyPath = input.from ?? input.config.policy;
 	if (policyPath === void 0) return {
 		code: 2,
 		output: "PermDock CLI: rls verify needs policy in the config or --from"
 	};
-	const policy = asPolicy(pickNamed(await loadModule(resolve(input.cwd, policyPath)), ["policy"]));
+	const policy = await loadPolicyAt(input.cwd, policyPath);
 	if (input.tree === true) {
 		if (input.db === void 0) return {
 			code: 2,
@@ -743,4 +1172,4 @@ async function runRlsVerify(input) {
 	};
 }
 //#endregion
-export { runRlsVerify as n, canFixture as t };
+export { graphSql as a, callsHelper as c, rowConditionMessage as d, graphPlan as i, helperCallKeys as l, runRlsVerify as n, HELPER_TABLES as o, closureDepths as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u };