permdock 0.3.1 → 0.5.0

package/dist/rls-P-BeBx0n.js

@@ -1,238 +0,0 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/rls.ts
-function rls(ctx) {
-	return defineCommand({
-		meta: {
-			name: "rls",
-			description: COMMAND_DESCRIPTIONS.rls
-		},
-		args: {
-			...globalArgs,
-			action: {
-				type: "positional",
-				required: false,
-				description: "generate, import, verify or migrate"
-			},
-			target: {
-				type: "enum",
-				options: [
-					"sql",
-					"drizzle",
-					"prisma"
-				],
-				description: "generate: output form"
-			},
-			dialect: {
-				type: "enum",
-				options: [
-					"supabase",
-					"neon",
-					"guc"
-				],
-				description: "How the database reads the subject (default rls.dialect)"
-			},
-			out: {
-				type: "string",
-				description: "File to write",
-				valueHint: "file"
-			},
-			from: {
-				type: "string",
-				description: "Module exporting the policy, instead of the config",
-				valueHint: "module"
-			},
-			sql: {
-				type: "string",
-				description: "import / migrate: SQL file or folder to read",
-				valueHint: "path"
-			},
-			db: {
-				type: "string",
-				description: "Postgres connection string",
-				valueHint: "url"
-			},
-			fixtures: {
-				type: "string",
-				description: "verify: fixtures file",
-				valueHint: "file"
-			},
-			schema: {
-				type: "string",
-				description: "import: schema library, or the helper schema",
-				valueHint: "name"
-			},
-			memberships: {
-				type: "string",
-				description: "import: membership table",
-				valueHint: "table"
-			},
-			format: {
-				type: "string",
-				description: "verify: node or pgtap",
-				valueHint: "format"
-			},
-			emit: {
-				type: "string",
-				description: "Alias of --format",
-				valueHint: "format"
-			},
-			rbac: {
-				type: "enum",
-				options: ["supabase"],
-				description: "generate: scaffold the role tables for this provider"
-			},
-			"rbac-scaffold": {
-				type: "boolean",
-				description: "generate: scaffold the role tables"
-			},
-			"rbac-schema": {
-				type: "string",
-				description: "Schema for the scaffolded role tables",
-				valueHint: "name"
-			},
-			authorize: {
-				type: "string",
-				description: "Where roles are read: 'jwt' or 'database'",
-				valueHint: "mode"
-			},
-			check: {
-				type: "boolean",
-				description: "Exit 1 when the files on disk are stale; write nothing"
-			},
-			"skip-closures": {
-				type: "boolean",
-				description: "Skip grants with closures instead of failing"
-			},
-			"inline-functions": {
-				type: "boolean",
-				description: "Inline helper calls into the policies"
-			},
-			force: {
-				type: "boolean",
-				description: "Overwrite an existing file"
-			},
-			"guc-prefix": {
-				type: "string",
-				description: "guc dialect: setting prefix",
-				valueHint: "prefix"
-			},
-			"policy-per-role": {
-				type: "boolean",
-				description: "One policy per role instead of one per command"
-			},
-			"policy-name": {
-				type: "string",
-				description: "Policy name template",
-				valueHint: "template"
-			},
-			"tenant-type": {
-				type: "string",
-				description: "Postgres type of the tenant column",
-				valueHint: "type"
-			},
-			"custom-roles": {
-				type: "boolean",
-				description: "Emit the custom role tables and helpers"
-			},
-			capabilities: {
-				type: "boolean",
-				description: "Emit the link capability helpers"
-			},
-			fields: {
-				type: "string",
-				description: "Field security: 'views'",
-				valueHint: "mode"
-			},
-			"revoke-columns": {
-				type: "boolean",
-				description: "Revoke restricted columns on the table"
-			},
-			tree: {
-				type: "boolean",
-				description: "verify: check the relationship closure"
-			},
-			introspect: {
-				type: "boolean",
-				description: "verify: compare against the live database"
-			},
-			advisors: {
-				type: "boolean",
-				description: "verify: run the Supabase security advisors"
-			},
-			split: {
-				type: "string",
-				description: "Write helpers, seeds, policies and hook as separate parts",
-				valueHint: "parts"
-			},
-			"grants-out": {
-				type: "string",
-				description: "File for the helper and hook privileges db diff drops",
-				valueHint: "file"
-			},
-			"seeds-out": {
-				type: "string",
-				description: "File for the role_permissions seeds",
-				valueHint: "file"
-			},
-			"helpers-only": {
-				type: "boolean",
-				description: "Write the helpers and keep the policies hand-written"
-			},
-			shims: {
-				type: "boolean",
-				description: "Wrap each rls.migrate helper under its legacy name"
-			},
-			write: {
-				type: "boolean",
-				description: "migrate: rewrite the files instead of a dry run"
-			}
-		},
-		async run({ args: parsed }) {
-			const result = await (await import("./rls-DiinlRML.js")).runRls({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				target: parsed.target,
-				dialect: parsed.dialect,
-				out: stringArg(parsed.out),
-				from: stringArg(parsed.from),
-				sql: stringArg(parsed.sql),
-				db: stringArg(parsed.db),
-				fixtures: stringArg(parsed.fixtures),
-				schema: stringArg(parsed.schema),
-				memberships: stringArg(parsed.memberships),
-				format: stringArg(parsed.format) ?? stringArg(parsed.emit),
-				rbac: parsed["rbac-scaffold"] === true || parsed.rbac === "supabase",
-				rbacSchema: stringArg(parsed["rbac-schema"]),
-				authorize: stringArg(parsed.authorize),
-				check: parsed.check === true,
-				skipClosures: parsed["skip-closures"] === true,
-				inlineFunctions: parsed["inline-functions"] === true,
-				force: parsed.force === true,
-				gucPrefix: stringArg(parsed["guc-prefix"]),
-				policyPerRole: parsed["policy-per-role"] === true,
-				policyName: stringArg(parsed["policy-name"]),
-				tenantType: stringArg(parsed["tenant-type"]),
-				customRoles: parsed["custom-roles"] === true,
-				capabilities: parsed.capabilities === true,
-				fields: stringArg(parsed.fields),
-				revokeColumns: parsed["revoke-columns"] === true,
-				tree: parsed.tree === true,
-				introspect: parsed.introspect === true,
-				advisors: parsed.advisors === true,
-				split: stringArg(parsed.split),
-				grantsOut: stringArg(parsed["grants-out"]),
-				seedsOut: stringArg(parsed["seeds-out"]),
-				helpersOnly: parsed["helpers-only"] === true,
-				shims: parsed.shims === true,
-				write: parsed.write === true,
-				json: ctx.json,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { rls };

package/dist/rls-graph-CHwx0V8q.js

@@ -1,435 +0,0 @@
-import { S as restrictedFor, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, l as groupEntries, m as isPrincipalRelation, r as expandRelation } from "./permissions-DVoF6dMt.js";
-import { d as scopeList } from "./scopes-CVdPrWN-.js";
-import { l as inheritCondition, m as relationCondition, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { c as relationArmSql, u as restrictedRowsSql } from "./compile-Ba4blROR.js";
-import "./sources-4p0-4xQm.js";
-import { E as graphSqlText, G as quoteIdent, J as restrictedHelper, K as quoteLiteral, N as linkHelper, T as graphSqlName, W as qualifiedTable, _ as activeUserSql, d as CLOSURE, q as quoteTable, r as HELPERS, w as graphHelper } from "./rls-shared-Cewd_-zI.js";
-//#region src/cli/helper-calls.ts
-/**
-* Tables whose policies other packages write by calling the SQL helpers
-* directly (storage buckets and realtime topics).
-*/
-const HELPER_TABLES = ["storage.objects", "realtime.messages"];
-const HELPER_CALL = new RegExp(String.raw`\b(${HELPERS.has}(?:_permission)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?)\s*\(\s*'((?:[^']|'')+)'(\s*,\s*(false\b)?)?`, "giu");
-const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}(?:_permission)?(?:_for)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?(?:_for)?|member_[a-z][a-z0-9_]*_ids(?:_for)?)\s*\(`, "iu");
-/** Whether a policy expression calls any generated helper, the key-less `member_<scope>_ids` included. */
-function callsHelper(sql) {
-	return ANY_HELPER.test(sql);
-}
-/**
-* The permission keys a policy expression passes to `permdock_has`,
-* `permitted_<scope>_ids` or their permission-key forms, `#n` stripped. With
-* `blind`, only the calls that ignore row conditions: the grant-key forms,
-* and a permission-key form asked for conditioned allows. A plain
-* `permdock_has_permission(key)` or `permitted_<scope>_ids_by_permission(key)`
-* counts only allows without a row condition, so it never grants more than
-* the application does.
-*/
-function helperCallKeys(sql, blind = false) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const [, name = "", literal = "", extra, falsy] of sql.matchAll(HELPER_CALL)) {
-		const byPermission = /_permission$/iu.test(name);
-		if (blind && byPermission && (extra === void 0 || falsy !== void 0)) continue;
-		const key = literal.replaceAll("''", "'").split("#")[0] ?? "";
-		if (key !== "") keys.add(key);
-	}
-	return [...keys];
-}
-const CREATE_POLICY = /\bcreate\s+policy\s+("(?:[^"]|"")+"|\w+)\s+on\s+((?:"[^"]+"|\w+)\.(?:"[^"]+"|\w+))([\s\S]*?);/giu;
-function tableName(name) {
-	return name.replaceAll("\"", "").toLowerCase();
-}
-function helperTable(name) {
-	const table = tableName(name);
-	return HELPER_TABLES.find((candidate) => candidate === table);
-}
-/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their condition-blind helper calls pass. */
-function helperTablePolicies(sql) {
-	const text = sql.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
-	const found = [];
-	for (const [, name = "", target = "", body = ""] of text.matchAll(CREATE_POLICY)) {
-		const table = helperTable(target);
-		const keys = helperCallKeys(body, true);
-		if (table !== void 0 && keys.length > 0) found.push({
-			table,
-			name: name.replaceAll("\"", ""),
-			keys
-		});
-	}
-	return found;
-}
-/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db`. */
-const HELPER_TABLE_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, coalesce(qual, '') || ' ' || coalesce(with_check, '') as body
-from pg_policies
-where (schemaname, tablename) in (('storage', 'objects'), ('realtime', 'messages'))`;
-/** The same rows as {@link helperTablePolicies}, from `pg_policies`. */
-function helperTablePoliciesFromRows(rows) {
-	const found = [];
-	for (const row of rows) {
-		const table = helperTable(String(row["target"] ?? ""));
-		const keys = helperCallKeys(String(row["body"] ?? ""), true);
-		if (table !== void 0 && keys.length > 0) found.push({
-			table,
-			name: String(row["policyname"] ?? ""),
-			keys
-		});
-	}
-	return found;
-}
-/** The message PD037 and `rls verify --db` report for one policy. */
-function rowConditionMessage(policy, keys) {
-	return `${policy.table} policy '${policy.name}' calls the SQL helpers with ${keys.join(", ")}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`;
-}
-const ROW_CONDITION_FIX = "call permitted_<scope>_ids_by_permission('<key>') or permdock_has_permission('<key>'), which count only the allows without a row condition (a relationship grant never reaches a topic or a folder), or use a permission whose catalog entry has rowConditions: false";
-//#endregion
-//#region src/cli/rls-graph.ts
-function qualified(ctx, name) {
-	return `${quoteIdent(ctx.schema ?? "permdock")}.${name}`;
-}
-function tableFor(resource, tables) {
-	return tables?.[resource] ?? resource;
-}
-/** Every `related` condition the policy's grants compile to, with the resource graph they need, groups included. */
-function graphPlan(policy) {
-	const scopes = scopeList(policy.scopes);
-	const plan = /* @__PURE__ */ new Map();
-	const entryFor = (node) => {
-		const entry = plan.get(node.name) ?? {
-			node,
-			relations: /* @__PURE__ */ new Set(),
-			links: /* @__PURE__ */ new Set()
-		};
-		plan.set(node.name, entry);
-		return entry;
-	};
-	const addRelation = (node, relation) => {
-		const entry = entryFor(node);
-		if (entry.relations.has(relation)) return;
-		entry.relations.add(relation);
-		for (const name of expandRelation(node, relation)) {
-			const spec = node.relations[name];
-			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
-			for (const { resource, relation: groupRelation } of groupEntries(spec)) {
-				const target = policy.resources.get(resource);
-				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
-			}
-		}
-	};
-	const addLinks = (hops) => {
-		for (let index = 1; index < hops.length; index += 1) {
-			const from = policy.resources.get(hops[index - 1]?.resource ?? "");
-			const hop = hops[index];
-			if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
-		}
-	};
-	const addAbove = (above) => {
-		const node = above === void 0 ? void 0 : policy.resources.get(above.resource);
-		if (above === void 0 || node === void 0) return;
-		const entry = entryFor(node);
-		entry.closure = Math.max(entry.closure ?? 0, above.depth);
-		entry.restrictedAncestors = above;
-	};
-	for (const grant of policy.grants) {
-		const row = policy.resources.get(grant.permission.resource);
-		for (const item of flattenGrantee(grant.to)) {
-			if (item.kind === "inherit") {
-				const inherited = inheritCondition(item, row, policy.resources);
-				addLinks(inherited?.hops ?? []);
-				addAbove(inherited?.restrictedAncestors);
-				continue;
-			}
-			if (item.kind !== "relation") continue;
-			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
-			if (condition?.op !== "related") continue;
-			const node = policy.resources.get(condition.resource);
-			if (node === void 0) continue;
-			addRelation(node, condition.relation);
-			const entry = entryFor(node);
-			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
-			addLinks(condition.hops ?? []);
-			addAbove(condition.restrictedAncestors);
-		}
-	}
-	return plan;
-}
-/** The closure depth per walked resource, as `RlsSqlContext.graph` carries it. */
-function closureDepths(plan) {
-	const out = {};
-	for (const [name, entry] of plan) if (entry.closure !== void 0) out[name] = entry.closure;
-	return out;
-}
-function tableSql(name) {
-	return quoteTable(qualifiedTable(name));
-}
-/**
-* The `permitted_<resource>_ids(relation)` arm for one concrete relation:
-* ids of `resource` the subject holds it on, directly or through a group.
-* `asked` are the relation names that include it, so a call for any of them
-* (or for all, with null) reads this arm.
-*/
-function relationArm(ctx, plan, node, relation, asked, tables) {
-	const spec = node.relations[relation];
-	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw new Error(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
-	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
-	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
-		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
-		...tables === void 0 ? {} : { tables },
-		qualify: qualifiedTable,
-		holders: (resource, groupRelation) => [{ text: `select ${qualified(ctx, graphHelper(resource))}(${quoteLiteral(groupRelation)})` }]
-	}), ctx)}) a\n  where ${guard}${activeUserSql(ctx).map((part) => ` and ${part}`).join("")}`;
-}
-function permittedSql(ctx, plan, entry, tables) {
-	const fn = qualified(ctx, graphHelper(entry.node.name));
-	const asked = [...entry.relations].toSorted();
-	const arms = [...new Set(asked.flatMap((name) => expandRelation(entry.node, name)))].toSorted().map((relation) => relationArm(ctx, plan, entry.node, relation, asked.filter((name) => expandRelation(entry.node, name).includes(relation)), tables));
-	if (arms.length === 0) arms.push("  select null::text where false");
-	return `-- ${entry.node.name}: ids the subject holds a relation on (all relations when p_relation is null)
-create or replace function ${fn}(p_relation text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-${arms.join("\n  union\n")}
-$$;
-revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;`;
-}
-/** `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points into `ids`, read past the table's own policies. */
-function linkSql(ctx, node, link, tables) {
-	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
-	if (spec === void 0) throw new Error(`PermDock CLI: ${node.name} has no link '${link}'`);
-	const fn = qualified(ctx, linkHelper(node.name, link));
-	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
-create or replace function ${fn}(p_ids text[])
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select t.${quoteIdent(node.id)}::text from ${tableSql(tableFor(node.name, tables))} t
-  where t.${quoteIdent(spec.field)}::text = any(p_ids)
-$$;
-revoke execute on function ${fn}(text[]) from public, anon;
-grant execute on function ${fn}(text[]) to authenticated;`;
-}
-function closureTableSql(ctx) {
-	const table = qualified(ctx, CLOSURE.table);
-	return `-- the object graph: one row per (ancestor, descendant) within each walked resource's depth,
--- never crossing a restricted row; kept current by statement triggers on each self-parented table
-create table if not exists ${table} (
-  resource text not null,
-  ancestor text not null,
-  descendant text not null,
-  depth integer not null check (depth >= 0),
-  primary key (resource, descendant, ancestor)
-);
-create index if not exists ${quoteIdent(`${CLOSURE.table}_ancestor`)} on ${table} (resource, ancestor);
-alter table ${table} enable row level security;
-revoke all on table ${table} from anon, authenticated, public;
-grant select on table ${table} to authenticated;`;
-}
-function closureObjectsSql(ctx, entry, depth, tables) {
-	const { node } = entry;
-	const parent = node.parent;
-	if (parent === void 0) return "";
-	const name = node.name;
-	const sqlName = graphSqlName(name) ?? name;
-	const closure = qualified(ctx, CLOSURE.table);
-	const table = tableSql(tableFor(name, tables));
-	const id = quoteIdent(node.id);
-	const up = quoteIdent(parent.field);
-	const restricted = restrictedFor(node, "parent");
-	const stop = restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(restricted)}, false)`;
-	const stopParent = restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(restricted)}, false)`;
-	const refresh = qualified(ctx, `${CLOSURE.table}_${sqlName}`);
-	const changed = qualified(ctx, `${CLOSURE.table}_${sqlName}_changed`);
-	const literal = quoteLiteral(name);
-	const restrictedChanged = restricted === void 0 ? "" : ` or n.${quoteIdent(restricted)} is distinct from o.${quoteIdent(restricted)}`;
-	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${sqlName}_${suffix}`);
-	return `-- ${name}: ${restricted === void 0 ? `rows reach their ancestors up to depth ${String(depth)}` : `rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row`}
-drop policy if exists ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure};
-create policy ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure}
-  for select to authenticated
-  using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
-create or replace function ${refresh}(p_ids text[])
-returns void
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_cycle text;
-  v_affected text[];
-begin
-  with recursive walk(start, next, path) as (
-    select t.${id}, t.${up}, array[t.${id}::text]
-    from ${table} t
-    where t.${id}::text = any(p_ids)
-    union all
-    select walk.start, t.${up}, walk.path || t.${id}::text
-    from walk join ${table} t on t.${id} = walk.next
-    where not (walk.next::text = any(walk.path))
-  )
-  select walk.start::text into v_cycle
-  from walk
-  where walk.next::text = any(walk.path)
-  limit 1;
-  if v_cycle is not null then
-    raise exception 'permdock: % % is its own ancestor', ${literal}, v_cycle
-      using errcode = 'check_violation';
-  end if;
-  with recursive down(id, level) as (
-    select t.${id}, 0
-    from ${table} t
-    where t.${id}::text = any(p_ids) or t.${up}::text = any(p_ids)
-    union
-    select t.${id}, down.level + 1
-    from down join ${table} t on t.${up} = down.id
-    where down.level < ${String(depth)}
-  )
-  select coalesce(array_agg(distinct down.id::text), '{}') into v_affected from down;
-  delete from ${closure} c
-  where c.resource = ${literal}
-    and (c.descendant = any(p_ids) or c.descendant = any(v_affected));
-  insert into ${closure} (resource, ancestor, descendant, depth)
-  with recursive walk(descendant, ancestor, parent, depth, stop) as (
-    select t.${id}::text, t.${id}, t.${up}, 0, ${stop}
-    from ${table} t
-    where t.${id}::text = any(v_affected)
-    union all
-    select walk.descendant, p.${id}, p.${up}, walk.depth + 1, ${stopParent}
-    from walk join ${table} p on p.${id} = walk.parent
-    where not walk.stop and walk.depth < ${String(depth)}
-  )
-  select ${literal}, walk.ancestor::text, walk.descendant, walk.depth from walk
-  on conflict do nothing;
-end
-$$;
-revoke execute on function ${refresh}(text[]) from public, anon, authenticated;
-create or replace function ${changed}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-begin
-  if tg_op = 'TRUNCATE' then
-    delete from ${closure} where resource = ${literal};
-  elsif tg_op = 'INSERT' then
-    perform ${refresh}(array(select n.${id}::text from new_rows n));
-  elsif tg_op = 'DELETE' then
-    perform ${refresh}(array(select o.${id}::text from old_rows o));
-  else
-    perform ${refresh}(array(
-      select n.${id}::text
-      from new_rows n left join old_rows o on o.${id} = n.${id}
-      where o.${id} is null or n.${up} is distinct from o.${up}${restrictedChanged}
-      union
-      select o.${id}::text
-      from old_rows o left join new_rows n on n.${id} = o.${id}
-      where n.${id} is null
-    ));
-  end if;
-  return null;
-end
-$$;
-revoke execute on function ${changed}() from public, anon, authenticated;
-drop trigger if exists ${trigger("insert")} on ${table};
-create trigger ${trigger("insert")} after insert on ${table}
-  referencing new table as new_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("update")} on ${table};
-create trigger ${trigger("update")} after update on ${table}
-  referencing old table as old_rows new table as new_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("delete")} on ${table};
-create trigger ${trigger("delete")} after delete on ${table}
-  referencing old table as old_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("truncate")} on ${table};
-create trigger ${trigger("truncate")} after truncate on ${table}
-  for each statement execute function ${changed}();
-select ${refresh}(array(select t.${id}::text from ${table} t));`;
-}
-function restrictedRowsHelperSql(ctx, plan, entry, tables) {
-	const above = entry.restrictedAncestors;
-	if (above === void 0) return "";
-	const fn = qualified(ctx, restrictedHelper(entry.node.name));
-	const body = graphSqlText(restrictedRowsSql(above, {
-		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
-		...tables === void 0 ? {} : { tables },
-		qualify: qualifiedTable,
-		closure: `${ctx.schema ?? "permdock"}.${CLOSURE.table}`,
-		closureDepths: closureDepths(plan)
-	}), ctx);
-	return `-- ${entry.node.name}: rows a stopped link does not reach below: restricted, under a restricted row within ${String(above.depth - 1)} levels, or deeper
-create or replace function ${fn}()
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  ${body}
-$$;
-revoke execute on function ${fn}() from public, anon;
-grant execute on function ${fn}() to authenticated;`;
-}
-/** Group resources a resource's asked relations name, other than itself. */
-function groupTargets(entry) {
-	const out = /* @__PURE__ */ new Set();
-	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
-		const spec = entry.node.relations[name];
-		const resources = isEdgeRelation(spec) ? groupEntries(spec).map((group) => group.resource) : [];
-		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
-	}
-	return [...out].toSorted();
-}
-/** Plan entries by name, each after the group resources its helper calls (SQL function bodies are checked on create). */
-function dependencyOrder(plan) {
-	const out = [];
-	const done = /* @__PURE__ */ new Set();
-	const visit = (name) => {
-		const entry = plan.get(name);
-		if (entry === void 0 || done.has(name)) return;
-		done.add(name);
-		for (const target of groupTargets(entry)) visit(target);
-		out.push(entry);
-	};
-	for (const name of [...plan.keys()].toSorted()) visit(name);
-	return out;
-}
-/**
-* The graph preamble: `permitted_<resource>_ids` for every resource a graph
-* grant reads, and the closure table with its triggers for every
-* self-parented resource a grant walks. Empty when no grant is a graph grant.
-*/
-function graphSql(ctx, plan, tables) {
-	if (plan.size === 0) return "";
-	const sqlNames = /* @__PURE__ */ new Map();
-	for (const name of plan.keys()) {
-		const helper = graphHelper(name);
-		const sql = graphSqlName(name) ?? name;
-		if (ctx.scopes.some((scope) => scope.name === sql)) throw new Error(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
-		const other = sqlNames.get(sql);
-		if (other !== void 0) throw new Error(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
-		sqlNames.set(sql, name);
-	}
-	const entries = dependencyOrder(plan);
-	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 && entry.closure === void 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
-	const walked = entries.filter((entry) => entry.closure !== void 0);
-	if (walked.length > 0) {
-		chunks.push(closureTableSql(ctx));
-		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
-		for (const entry of walked) {
-			const helper = restrictedRowsHelperSql(ctx, plan, entry, tables);
-			if (helper !== "") chunks.push(helper);
-		}
-	}
-	return `${chunks.join("\n\n")}\n`;
-}
-//#endregion
-export { HELPER_TABLE_POLICIES_SQL as a, helperCallKeys as c, rowConditionMessage as d, HELPER_TABLES as i, helperTablePolicies as l, graphPlan as n, ROW_CONDITION_FIX as o, graphSql as r, callsHelper as s, closureDepths as t, helperTablePoliciesFromRows as u };