permdock 0.4.0 → 0.5.0

package/dist/ownership-BgnbOJFT.js

@@ -1,851 +0,0 @@
-import { l as scopeChain, o as resolveScope } from "./scopes-tvpa34ep.js";
-import { m as findRole } from "./grantee-CXY-0C87.js";
-import { r as qualifySqlTable } from "./sql-t8teWOfo.js";
-import { l as roleColumn } from "./sources-B1-b-R0t.js";
-import { A as declaredArray, F as quoteQualified, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, f as kindFilterSql, h as roleKindSql, m as memberVia, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, y as subjectIdSql } from "./shared-1uhI-e-b.js";
-import { G as scopeSources, K as scopeTable, R as memberForSources, V as memberRoleOf, d as memberColumn, f as sourceFilters, g as roleRows, h as membershipRows, l as claimKeptLines, m as globalRoleRows, p as sourcesKeep, u as disabledColumn, y as hasCustomRoleChecksFor, z as memberForTable } from "./permission-keys-B26jeyUv.js";
-//#region src/cli/rls/ownership-names.ts
-/** Objects the ownership rules add next to the helpers. Names are part of the SQL contract. */
-const OWNERSHIP = {
-	canAssign: "permdock_can_assign",
-	canAssignFor: "permdock_can_assign_for",
-	canAssignAny: "permdock_can_assign_any",
-	canAssignAnyFor: "permdock_can_assign_any_for",
-	holders: "permdock_holders",
-	transferOnly: "permdock_transfer_only"
-};
-/** Objects `rls.assignments` adds. Names are part of the SQL contract. */
-const ASSIGNMENTS = {
-	custom: "permdock_can_assign_custom_role",
-	customFor: "permdock_can_assign_custom_role_for",
-	trigger: "permdock_assignment"
-};
-//#endregion
-//#region src/cli/rls/assignments.ts
-/** The client roles whose writes the assignment triggers check; any other role is a trusted path. */
-const CLIENT_ROLES = [
-	"anon",
-	"anonymous",
-	"authenticated"
-];
-/** The mapped membership tables, `rls.assignments.tables` and the global-roles table `rls.roles`. */
-function assignedTables(ctx) {
-	const out = [];
-	for (const { name } of ctx.scopes) {
-		const mapped = scopeTable(ctx, name);
-		if (mapped === void 0) continue;
-		out.push({
-			table: mapped.table.table,
-			scope: name,
-			id: mapped.column,
-			tenant: mapped.tenantColumn ?? mapped.column,
-			role: mapped.table.role,
-			user: mapped.table.user
-		});
-	}
-	if (ctx.roles !== void 0) out.push({
-		table: ctx.roles.table,
-		scope: "global",
-		role: ctx.roles.role ?? "role",
-		user: ctx.roles.user ?? "user_id"
-	});
-	for (const extra of ctx.assignments?.tables ?? []) {
-		const scope = resolveScope(ctx.scopes, extra.scope);
-		if (scope === void 0) throw new Error(`PermDock CLI: rls.assignments.tables names scope '${extra.scope}', which the policy does not declare`);
-		if (scope !== ctx.scopes[0]?.name && extra.tenant === void 0) throw new Error(`PermDock CLI: rls.assignments.tables entry ${extra.table} assigns at ${scope}, below the first scope: name its tenant column`);
-		out.push({
-			table: extra.table,
-			scope,
-			id: extra.id,
-			tenant: extra.tenant ?? extra.id,
-			role: extra.role,
-			...extra.user === void 0 ? {} : { user: extra.user }
-		});
-	}
-	return out;
-}
-/** The tables `rls.assignments.ownRole` refuses a caller's own rows on, by table key. */
-function ownRoleTables(ctx, tables) {
-	const own = ctx.assignments?.ownRole;
-	if (own === void 0) return /* @__PURE__ */ new Set();
-	if (own === "refuse") return new Set(tables.filter((entry) => entry.user !== void 0).map((entry) => qualifySqlTable(entry.table)));
-	const out = /* @__PURE__ */ new Set();
-	for (const [name, value] of Object.entries(own)) {
-		const entry = tables.find((table) => qualifySqlTable(table.table) === qualifySqlTable(name));
-		if (entry === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which no assignment trigger guards`);
-		if (value !== "refuse") throw new Error(`PermDock CLI: rls.assignments.ownRole.${name} must be 'refuse'`);
-		if (entry.user === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which has no user column: set its user in rls.assignments.tables`);
-		out.add(qualifySqlTable(entry.table));
-	}
-	return out;
-}
-/**
-* The tables `rls.assignments` guards, schema-qualified: each scope's mapped
-* membership table, the global-roles table (`rls.roles`, else
-* `supabase.hook.roles`) and `rls.assignments.tables`. Empty without
-* `rls.assignments`.
-*/
-function guardedTables(config, scopes) {
-	const rls = config.rls;
-	if (rls?.assignments === void 0) return [];
-	const hook = config.supabase?.hook?.roles;
-	const roles = rls.roles ?? (hook === false ? void 0 : hook);
-	const tables = [
-		...scopes.flatMap((scope) => {
-			const mapped = memberForTable({
-				scopes,
-				...rls.memberships === void 0 ? {} : { memberships: rls.memberships }
-			}, scope.name);
-			return mapped === void 0 ? [] : [mapped.table];
-		}),
-		...roles === void 0 ? [] : [roles.table],
-		...(rls.assignments === true ? [] : rls.assignments.tables ?? []).map((entry) => entry.table)
-	];
-	return [...new Set(tables.map(qualifySqlTable))];
-}
-function isRoleList(role) {
-	return Array.isArray(role);
-}
-/** The role keys a row variable holds, one scalar per role source. */
-function rowRoles(entry, row) {
-	return (isRoleList(entry.role) ? entry.role : [entry.role]).map((part) => roleColumn(part, qualifySqlTable(entry.table), row, {
-		label: `rls.assignments ${entry.table} role`,
-		prefix: "PermDock CLI"
-	}).lookup);
-}
-/**
-* `permdock_can_assign_custom_role`: whether the signed-in caller may assign a
-* custom role of the tenant at the instance, by the checks the custom-role
-* write functions run on its stored definition.
-*/
-function canAssignCustomSql(ctx, forUser = false) {
-	const tenantType = tenantTypeOf(ctx);
-	const fn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
-	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
-	const includes = qualified(ctx, CUSTOM_ROLES.includes);
-	const guard = qualified(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
-	const userParam = forUser ? "p_user uuid, " : "";
-	const userArg = forUser ? "uuid, " : "";
-	const stored = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.role = p_role and (c.scope_id is null or c.scope_id = p_scope_id)`;
-	const grants = forUser ? `revoke execute on function ${fn}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(${tenantType}, text, text, text) from public, anon;
-grant execute on function ${fn}(${tenantType}, text, text, text) to authenticated;`;
-	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign custom role p_role at instance p_scope_id (a platform role: null tenant, scope global): the custom-role write checks on its stored definition${forUser ? "; no client role may execute it" : ""}
-create or replace function ${fn}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
-returns boolean
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  v_scope_id text;
-  v_found boolean := false;
-begin
-  select true, c.scope_id into v_found, v_scope_id
-  from (
-    select c.scope_id from ${perms} c where ${stored}
-    union all
-    select c.scope_id from ${includes} c where ${stored}
-  ) c
-  order by c.scope_id nulls first
-  limit 1;
-  if not coalesce(v_found, false) then
-    return false;
-  end if;
-  perform ${guard}(${forUser ? "p_user, " : ""}p_tenant, p_scope, v_scope_id, p_role);
-  return true;
-exception
-  when insufficient_privilege or invalid_parameter_value then
-    return false;
-end;
-$$;
-${grants}`;
-}
-/**
-* The assignment triggers (\`rls.assignments\`): before a client role inserts,
-* updates or deletes a row that assigns a role, every role the old and new
-* row hold must be one the caller may assign at that instance, by
-* \`permdock_can_assign\` for a declared role and
-* \`permdock_can_assign_custom_role\` for a custom one. The functions run as
-* the invoker, so \`current_user\` tells a client write from a trusted one.
-*/
-function assignmentSql(ctx) {
-	const own = ctx.ownership;
-	if (ctx.assignments === void 0 || own === void 0 || own.assigns.length === 0) return "";
-	const canAssign = qualified(ctx, OWNERSHIP.canAssign);
-	const custom = ctx.customRoles !== void 0 && ctx.authorize === "database";
-	const declared = ctx.customRoles?.declared;
-	const tenantType = tenantTypeOf(ctx);
-	const chunks = [];
-	const clients = `current_user::text = any(array[${CLIENT_ROLES.map(quoteLiteral).join(", ")}])`;
-	const tables = assignedTables(ctx);
-	const ownRole = ownRoleTables(ctx, tables);
-	for (const entry of tables) {
-		const table = quoteQualified(entry.table);
-		const suffix = entry.table.replaceAll(/[^a-z0-9_]/gu, "_");
-		const fn = qualified(ctx, quoteIdent(`${ASSIGNMENTS.trigger}_${suffix}`));
-		const ownUser = entry.user !== void 0 && ownRole.has(qualifySqlTable(entry.table)) ? entry.user : void 0;
-		const ownCheck = (row, reason) => ownUser === void 0 ? "" : `    if ${row}.${quoteIdent(ownUser)}::text = (${subjectIdSql(ctx)})::text then
-      raise exception using
-        errcode = '42501',
-        message = 'permdock: the caller may not change their own roles',
-        hint = '${reason}';
-    end if;
-`;
-		const check = (row) => {
-			const id = entry.id === void 0 ? "null::text" : `${row}.${quoteIdent(entry.id)}::text`;
-			const customFn = qualified(ctx, ASSIGNMENTS.custom);
-			let allowed = `${canAssign}(v_role, ${id})`;
-			if (custom && declared !== void 0) {
-				const platform = `${customFn}(null, 'global', null, v_role)`;
-				allowed = entry.id === void 0 || entry.tenant === void 0 ? `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) else ${platform} end` : `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) when ${id} is null then ${platform} else ${customFn}(${row}.${quoteIdent(entry.tenant)}::${tenantType}, ${quoteLiteral(entry.scope)}, ${id}, v_role) end`;
-			}
-			return `    foreach v_role in array array[${rowRoles(entry, row).join(", ")}]::text[] loop
-      if v_role is not null and not coalesce(${allowed}, false) then
-        raise exception using
-          errcode = '42501',
-          message = 'permdock: the caller may not assign ' || v_role || ' in ' || coalesce(${id}, 'null'),
-          hint = 'not-assignable-by';
-      end if;
-    end loop;`;
-		};
-		const what = entry.id === void 0 ? "global roles" : `${entry.scope} roles`;
-		chunks.push(`-- ${entry.table}: a client role may write only the ${what} it may assign${ownUser === void 0 ? "" : ", and none on its own rows"}
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-volatile
-set search_path = ''
-as $$
-declare
-  v_role text;
-begin
-  if not (${clients}) then
-    return coalesce(new, old);
-  end if;
-  if tg_op in ('UPDATE', 'DELETE') then
-${ownCheck("old", "self-demotion")}${check("old")}
-  end if;
-  if tg_op in ('INSERT', 'UPDATE') then
-${ownCheck("new", "not-assignable-by")}${check("new")}
-  end if;
-  return coalesce(new, old);
-end;
-$$;
-revoke execute on function ${fn}() from public, anon, authenticated;
-drop trigger if exists "permdock_assignment" on ${table};
-create trigger "permdock_assignment"
-  before insert or update or delete on ${table}
-  for each row execute function ${fn}();`);
-	}
-	return `${chunks.join("\n\n")}\n`;
-}
-//#endregion
-//#region src/cli/rls/ownership-triggers.ts
-function objectName(prefix, scope) {
-	return quoteIdent(`${prefix}_${scope}`);
-}
-/** Live holders of `roleExpr` in instance `idExpr`, with the same kind and expiry rules as the helpers. */
-function holdersSql(ctx, table, column, idExpr, role, into) {
-	const roleExpr = typeof role === "string" ? quoteLiteral(role) : role.expr;
-	const held = memberRoleOf(table, "m", "      ");
-	const filters = [`m.${quoteIdent(column)} = ${idExpr}`, `${held.sql} = ${roleExpr}`];
-	if (table.expiresAt !== void 0) {
-		const expires = memberColumn(table.expiresAt);
-		filters.push(`(${expires} is null or ${expires} > now())`);
-	}
-	const disabled = disabledColumn(table);
-	if (disabled !== void 0) filters.push(`${disabled} is null`);
-	const via = memberVia(table);
-	const kind = typeof role === "string" ? roleKindSql(ctx, role, via) : kindFilterSql(ctx, roleExpr, via);
-	if (kind !== void 0) filters.push(kind);
-	return `select count(distinct m.${quoteIdent(table.user)}) into ${into}
-      from ${quoteQualified(table.table)} m${held.join}
-      where ${filters.join("\n        and ")}`;
-}
-/**
-* `min` and `max` as a deferred constraint trigger: checked at commit, so a
-* transfer (demote one holder, promote another) passes in one transaction. An
-* instance with no memberships left is being torn down and skips `min`.
-*/
-function holdersTriggerSql(ctx, scope, table, column, counted) {
-	const fn = qualified(ctx, `${OWNERSHIP.holders}_${scope}`);
-	const col = quoteIdent(column);
-	const checks = counted.map((rule) => {
-		const lines = [`    select count(*) into v_total from ${quoteQualified(table.table)} m where m.${col} = v_key;`, `    ${holdersSql(ctx, table, column, "v_key", rule.role, "v_count")};`];
-		if (rule.min > 0) lines.push(`    if v_total > 0 and v_count < ${String(rule.min)} then
-      raise exception using
-        errcode = '23514',
-        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` keeps at least ${String(rule.min)} ${rule.role}`)},
-        hint = 'last-holder';
-    end if;`);
-		if (rule.max !== void 0) lines.push(`    if v_count > ${String(rule.max)} then
-      raise exception using
-        errcode = '23514',
-        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` has at most ${String(rule.max)} ${rule.role}`)},
-        hint = 'max-holders';
-    end if;`);
-		return lines.join("\n");
-	});
-	return `-- ${scope}: holder counts (min / max), checked at commit
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_ids text[] := '{}';
-  v_id text;
-  v_key ${quoteQualified(table.table)}.${col}%type;
-  v_total bigint;
-  v_count bigint;
-begin
-  if tg_op in ('UPDATE', 'DELETE') then
-    v_ids := v_ids || old.${col}::text;
-  end if;
-  if tg_op in ('INSERT', 'UPDATE') then
-    v_ids := v_ids || new.${col}::text;
-  end if;
-  foreach v_id in array v_ids loop
-    continue when v_id is null;
-    v_key := v_id;
-${checks.join("\n")}
-  end loop;
-  return null;
-end;
-$$;
-drop trigger if exists ${objectName(OWNERSHIP.holders, scope)} on ${quoteQualified(table.table)};
-create constraint trigger ${objectName(OWNERSHIP.holders, scope)}
-  after insert or update or delete on ${quoteQualified(table.table)}
-  deferrable initially deferred
-  for each row execute function ${fn}();`;
-}
-/**
-* `transferOnly` as statement triggers over transition tables: a statement
-* that changes a role's holder count in an instance that had holders before
-* and still has some after is refused. Creating the first holder and removing
-* the last (which `min` guards) are not transfers.
-*/
-function transferTriggerSql(ctx, scope, table, column, roles) {
-	const fn = qualified(ctx, `${OWNERSHIP.transferOnly}_${scope}`);
-	const col = quoteIdent(column);
-	const list = `array[${roles.map(quoteLiteral).join(", ")}]::text[]`;
-	const rows = (alias, source, delta) => {
-		const role = memberRoleOf(table, alias);
-		return `select ${alias}.${col} as id, ${role.sql} as role, ${delta} as delta from ${source} ${alias}${role.join} where ${role.sql} = any(${list})`;
-	};
-	const loop = (source) => `    for v_change in
-      select c.id, c.role, sum(c.delta) as delta
-      from (${source}) c
-      group by c.id, c.role
-    loop
-      continue when v_change.delta = 0 or v_change.id is null;
-      ${holdersSql(ctx, table, column, "v_change.id", { expr: "v_change.role" }, "v_after")};
-      if v_after > 0 and v_after - v_change.delta > 0 then
-        raise exception using
-          errcode = '23514',
-          message = 'permdock: ' || v_change.role || ${quoteLiteral(` in ${scope} `)} || v_change.id || ' moves only by transfer',
-          hint = 'transfer-only';
-      end if;
-    end loop;`;
-	const inserted = rows("n", "permdock_new", "1");
-	const deleted = rows("o", "permdock_old", "-1");
-	const target = quoteQualified(table.table);
-	const trigger = (op) => {
-		const name = quoteIdent(`${OWNERSHIP.transferOnly}_${scope}_${op}`);
-		return `drop trigger if exists ${name} on ${target};
-create trigger ${name}
-  after ${op} on ${target}
-  referencing ${op === "insert" ? "new table as permdock_new" : op === "delete" ? "old table as permdock_old" : "old table as permdock_old new table as permdock_new"}
-  for each statement execute function ${fn}();`;
-	};
-	return `-- ${scope}: transfer-only roles (${roles.join(", ")}) keep their holder count per statement
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_change record;
-  v_after bigint;
-begin
-  if tg_op = 'INSERT' then
-${loop(inserted)}
-  elsif tg_op = 'DELETE' then
-${loop(deleted)}
-  else
-${loop(`${inserted} union all ${deleted}`)}
-  end if;
-  return null;
-end;
-$$;
-${trigger("insert")}
-${trigger("update")}
-${trigger("delete")}`;
-}
-//#endregion
-//#region src/cli/rls/ownership-sources.ts
-/**
-* The membership sources holding scope `name`: `undefined` when there are
-* none, `'not-tables'` when one of them carries no table to put a trigger on.
-*/
-function holderSources(ctx, name) {
-	const sources = memberForSources(ctx, name);
-	if (sources.length === 0) return;
-	const held = [];
-	for (const source of sources) {
-		if (source.sql.holders === void 0) return "not-tables";
-		held.push({
-			table: source.sql.table,
-			holders: source.sql.holders
-		});
-	}
-	return held;
-}
-function indent(sql, by) {
-	return sql.replaceAll(/^/gmu, by);
-}
-/** Every source's rows of one instance, each compared with its own typed `v_key_<n>`. */
-function sourceRowsOf(scope, sources) {
-	return sources.map((source, index) => indent(source.holders.rows(scope, { id: `v_key_${String(index)}` }), "        ")).join("\n        union all\n");
-}
-function sourceKeys(sources) {
-	return {
-		declare: sources.map((source, index) => `  v_key_${String(index)} ${source.holders.idType};`).join("\n"),
-		assign: (value, by) => sources.map((_, index) => `${by}v_key_${String(index)} := ${value};`).join("\n")
-	};
-}
-function regclassOf(table) {
-	return `${quoteLiteral(quoteQualified(table))}::regclass`;
-}
-function sourceTables(sources) {
-	return [...new Set(sources.map((source) => quoteQualified(source.table)))];
-}
-/** `min` and `max` over membership sources: the same commit-time check as on a mapped table, counted over every source of the scope. */
-function sourceHoldersTriggerSql(ctx, scope, sources, counted) {
-	const fn = qualified(ctx, `${OWNERSHIP.holders}_${scope}`);
-	const keys = sourceKeys(sources);
-	const rows = sourceRowsOf(scope, sources);
-	const collect = sources.map((source) => `  if tg_relid = ${regclassOf(source.table)} then
-    if tg_op in ('UPDATE', 'DELETE') then
-      v_ids := v_ids || ${source.holders.id(scope, "old")};
-    end if;
-    if tg_op in ('INSERT', 'UPDATE') then
-      v_ids := v_ids || ${source.holders.id(scope, "new")};
-    end if;
-  end if;`);
-	const checks = counted.map((rule) => {
-		const filters = ["h.live", `h.role = ${quoteLiteral(rule.role)}`];
-		const kind = roleKindSql(ctx, rule.role, "h.via");
-		if (kind !== void 0) filters.push(kind);
-		const lines = [`    select count(distinct h.user_id) into v_count
-      from (
-${rows}
-      ) h
-      where ${filters.join("\n        and ")};`];
-		if (rule.min > 0) lines.push(`    if v_total > 0 and v_count < ${String(rule.min)} then
-      raise exception using
-        errcode = '23514',
-        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` keeps at least ${String(rule.min)} ${rule.role}`)},
-        hint = 'last-holder';
-    end if;`);
-		if (rule.max !== void 0) lines.push(`    if v_count > ${String(rule.max)} then
-      raise exception using
-        errcode = '23514',
-        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` has at most ${String(rule.max)} ${rule.role}`)},
-        hint = 'max-holders';
-    end if;`);
-		return lines.join("\n");
-	});
-	const triggers = sourceTables(sources).map((table) => `drop trigger if exists ${objectName(OWNERSHIP.holders, scope)} on ${table};
-create constraint trigger ${objectName(OWNERSHIP.holders, scope)}
-  after insert or update or delete on ${table}
-  deferrable initially deferred
-  for each row execute function ${fn}();`);
-	return `-- ${scope}: holder counts (min / max) over the membership sources, checked at commit
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_ids text[] := '{}';
-  v_id text;
-${keys.declare}
-  v_total bigint;
-  v_count bigint;
-begin
-${collect.join("\n")}
-  foreach v_id in array v_ids loop
-    continue when v_id is null;
-${keys.assign("v_id", "    ")}
-    select count(*) into v_total
-      from (
-${rows}
-      ) h;
-${checks.join("\n")}
-  end loop;
-  return null;
-end;
-$$;
-${triggers.join("\n")}`;
-}
-function collectChangesSql(changed) {
-	return `      v_changes := v_changes || coalesce((select jsonb_agg(to_jsonb(c)) from (${changed}) c), '[]'::jsonb);`;
-}
-/** `transferOnly` over membership sources: each source table's statement triggers diff its transition tables, and the count after reads every source. */
-function sourceTransferTriggerSql(ctx, scope, sources, roles) {
-	const fn = qualified(ctx, `${OWNERSHIP.transferOnly}_${scope}`);
-	const keys = sourceKeys(sources);
-	const list = `array[${roles.map(quoteLiteral).join(", ")}]::text[]`;
-	const kind = kindFilterSql(ctx, "h.role", "h.via");
-	const changes = (source, from, delta) => `select h.id, h.role, ${delta} as delta from (${source.holders.rows(scope, { from }).replaceAll("\n", " ")}) h where h.role = any(${list})`;
-	const branches = sources.map((source) => `  if tg_relid = ${regclassOf(source.table)} then
-    if tg_op in ('INSERT', 'UPDATE') then
-${collectChangesSql(changes(source, "permdock_new", "1"))}
-    end if;
-    if tg_op in ('UPDATE', 'DELETE') then
-${collectChangesSql(changes(source, "permdock_old", "-1"))}
-    end if;
-  end if;`);
-	const triggers = sourceTables(sources).flatMap((table) => [
-		"insert",
-		"update",
-		"delete"
-	].map((op) => {
-		const name = quoteIdent(`${OWNERSHIP.transferOnly}_${scope}_${op}`);
-		return `drop trigger if exists ${name} on ${table};
-create trigger ${name}
-  after ${op} on ${table}
-  referencing ${op === "insert" ? "new table as permdock_new" : op === "delete" ? "old table as permdock_old" : "old table as permdock_old new table as permdock_new"}
-  for each statement execute function ${fn}();`;
-	}));
-	return `-- ${scope}: transfer-only roles (${roles.join(", ")}) keep their holder count per statement, over the membership sources
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_changes jsonb := '[]'::jsonb;
-  v_change record;
-  v_after bigint;
-${keys.declare}
-begin
-${branches.join("\n")}
-  for v_change in
-    select x.id, x.role, sum(x.delta) as delta
-    from jsonb_to_recordset(v_changes) x(id text, role text, delta bigint)
-    group by x.id, x.role
-  loop
-    continue when v_change.delta = 0 or v_change.id is null;
-${keys.assign("v_change.id", "    ")}
-    select count(distinct h.user_id) into v_after
-      from (
-${sourceRowsOf(scope, sources)}
-      ) h
-      where h.live
-        and h.role = v_change.role${kind === void 0 ? "" : `\n        and ${kind}`};
-    if v_after > 0 and v_after - v_change.delta > 0 then
-      raise exception using
-        errcode = '23514',
-        message = 'permdock: ' || v_change.role || ${quoteLiteral(` in ${scope} `)} || v_change.id || ' moves only by transfer',
-        hint = 'transfer-only';
-    end if;
-  end loop;
-  return null;
-end;
-$$;
-${triggers.join("\n")}`;
-}
-function pairsSql(pairs) {
-	return `values ${pairs.map((pair) => `(${quoteLiteral(pair.assigner)}, ${quoteLiteral(pair.role)})`).join(", ")}`;
-}
-/**
-* Membership rows of the membership sources for scope `name`, each source's
-* `select` comparing its user column with a variable `user` names.
-*/
-function sourceRowsSql(sources, user) {
-	const keep = sources.some((source) => source.sql.keeps);
-	return sources.map((source) => source.sql.select(user(source), keep).replaceAll(/^/gmu, "        ")).join("\n        union all\n");
-}
-//#endregion
-//#region src/cli/rls/can-assign.ts
-/** Whether the signed-in user (or `p_user` in the `_for` form) holds, in instance `p_scope_id`, a role whose `assigns` lists `p_role`. */
-function canAssignSql(base, own, forUser = false) {
-	const ctx = forUser ? {
-		...base,
-		subjectId: "p_user",
-		tenants: "all"
-	} : base;
-	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
-	const parts = [];
-	const used = [];
-	const userOf = (source) => {
-		const index = used.includes(source) ? used.indexOf(source) : used.push(source) - 1;
-		return `v_user_${String(index)}`;
-	};
-	const global = own.assigns.filter((pair) => pair.scope === "global");
-	for (const [instance, pairs] of [["p_scope_id is not null", global.filter((pair) => pair.at !== "global")], ["p_scope_id is null", global.filter((pair) => pair.at === "global")]]) {
-		if (pairs.length === 0) continue;
-		if (ctx.authorize === "database") {
-			const ur = globalRoleRows(ctx);
-			const kind = globalKindFilterSql(ctx, ur.roleSql);
-			parts.push(`${instance} and exists (
-      select 1 from ${ur.from}
-      where ${ur.userSql} = ${subjectIdSql(ctx)}
-        and (${ur.roleSql}, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
-    )`);
-		} else {
-			const kind = globalKindFilterSql(ctx, "r.role");
-			parts.push(`${instance} and exists (
-      select 1 from ${roleRows(ctx)}
-      where (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
-    )`);
-		}
-	}
-	for (const { name } of ctx.scopes) {
-		const pairs = own.assigns.filter((pair) => pair.scope === name);
-		if (pairs.length === 0) continue;
-		const sources = scopeSources(ctx, name);
-		if (sources.length > 0) {
-			const kind = kindFilterSql(ctx, "r.role", "ms.via");
-			parts.push(`exists (
-      select 1
-      from (
-${sourceRowsSql(sources, userOf)}
-      ) ms
-      cross join lateral jsonb_array_elements_text(
-        case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
-      ) r(role)
-      where ms.scope = ${quoteLiteral(name)}
-        and ms.id = p_scope_id
-        and (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}${sourceFilters(ctx, name, void 0, void 0, sourcesKeep(sources)).replaceAll("\n    and ", "\n        and ")}
-    )`);
-			continue;
-		}
-		if (ctx.authorize === "database") {
-			const mapped = scopeTable(ctx, name);
-			if (mapped === void 0) continue;
-			const { table, column } = mapped;
-			const role = memberRoleOf(table, "m", "      ");
-			const filters = [
-				`${memberColumn(table.user)} = ${subjectIdSql(ctx)}`,
-				`${memberColumn(column)}::text = p_scope_id`,
-				`(${role.sql}, p_role) in (${pairsSql(pairs)})`
-			];
-			if (table.expiresAt !== void 0) {
-				const expires = memberColumn(table.expiresAt);
-				filters.push(`(${expires} is null or ${expires} > now())`);
-			}
-			const disabled = disabledColumn(table);
-			if (disabled !== void 0) filters.push(`${disabled} is null`);
-			const kind = kindFilterSql(ctx, role.sql, memberVia(table));
-			if (kind !== void 0) filters.push(kind);
-			parts.push(`exists (
-      select 1 from ${quoteQualified(table.table)} m${role.join}
-      where ${filters.join("\n        and ")}
-    )`);
-		} else {
-			const kind = kindFilterSql(ctx, "r.role", "m ->> 'via'");
-			parts.push(`exists (
-      select 1 from ${membershipRows(ctx)}
-      where m ->> 'scope' = ${quoteLiteral(name)}
-        and m ->> 'id' = p_scope_id
-        and (r.role, p_role) in (${pairsSql(pairs)})
-        and case jsonb_typeof(m -> 'expiresAt')
-          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
-          else true
-        end${kind === void 0 ? "" : `\n        and ${kind}`}${claimKeptLines(ctx, "        ").map((line) => `\n${line}`).join("")}
-    )`);
-		}
-	}
-	const body = parts.length === 0 ? "false" : parts.join("\n    or ");
-	const language = used.length === 0 ? `language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select ${signedIn(ctx)} and (
-    ${body}
-  )
-$$;` : `language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-${used.map((source, index) => `  v_user_${String(index)} ${source.sql.userType} := ${subjectIdSql(ctx)};`).join("\n")}
-begin
-  return ${signedIn(ctx)} and (
-    ${body}
-  );
-end;
-$$;`;
-	if (forUser) {
-		const user = ctx.dialect === "supabase" ? "uuid" : "text";
-		return `-- who may assign, for a user the caller names: trusted SQL acting later for a stored user; no client role may execute it
-create or replace function ${fn}(p_user ${user}, p_role text, p_scope_id text)
-returns boolean
-${language}
-revoke execute on function ${fn}(${user}, text, text) from public, anon, authenticated;`;
-	}
-	return `-- who may assign: a held role whose assigns lists p_role, in instance p_scope_id (its scope or an ancestor's); a null p_scope_id assigns a global role, which only global assigners may
-create or replace function ${fn}(p_role text, p_scope_id text)
-returns boolean
-${language}
-revoke execute on function ${fn}(text, text) from public, anon;
-grant execute on function ${fn}(text, text) to authenticated;`;
-}
-/** Whether the helpers keep custom roles in tables, so assigning one is checked against its stored definition. */
-function assignsCustomRoles(ctx) {
-	return ctx.customRoles !== void 0 && ctx.authorize === "database";
-}
-/** Whether `permdock_can_assign_any_for` is written: every function it calls has a `_for` form. */
-function hasCanAssignAnyFor(ctx) {
-	return ctx.authorize === "database" && (!assignsCustomRoles(ctx) || hasCustomRoleChecksFor(ctx));
-}
-/**
-* `permdock_can_assign_any`: one check for a declared or a custom role, so
-* SQL that assigns roles calls one function: `permdock_can_assign` for a
-* declared role, `permdock_can_assign_custom_role` for a custom one. `p_scope`
-* `'global'` (no tenant, no instance) assigns a platform role.
-*/
-function canAssignAnySql(ctx, custom, forUser = false) {
-	const tenantType = tenantTypeOf(ctx);
-	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignAnyFor : OWNERSHIP.canAssignAny);
-	const declaredFn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
-	const customFn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
-	const userType = ctx.dialect === "supabase" ? "uuid" : "text";
-	const userParam = forUser ? `p_user ${userType}, ` : "";
-	const userArg = forUser ? `${userType}, ` : "";
-	const user = forUser ? "p_user, " : "";
-	const declared = `${declaredFn}(${user}p_role, case when p_scope = 'global' then null else p_scope_id end)`;
-	const body = custom && ctx.customRoles !== void 0 ? `case
-    when p_role = any(${declaredArray(ctx.customRoles.declared)}) then ${declared}
-    when p_scope = 'global' then ${customFn}(${user}null, 'global', null, p_role)
-    else ${customFn}(${user}p_tenant, p_scope, p_scope_id, p_role)
-  end` : declared;
-	const grants = forUser ? `revoke execute on function ${fn}(${userArg}text, ${tenantType}, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(text, ${tenantType}, text, text) from public, anon;
-grant execute on function ${fn}(text, ${tenantType}, text, text) to authenticated;`;
-	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign p_role at instance p_scope_id of p_scope in tenant p_tenant, declared or custom (p_scope 'global' for a platform role)${forUser ? "; no client role may execute it" : ""}
-create or replace function ${fn}(${userParam}p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select coalesce(${body}, false)
-$$;
-${grants}`;
-}
-//#endregion
-//#region src/cli/rls/ownership.ts
-function roleScope(policy, scopes, name) {
-	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
-	return typeof on === "string" ? resolveScope(scopes, on) : void 0;
-}
-function isGlobalRole(policy, name) {
-	const binding = policy.rolesByName.get(name);
-	if (binding !== void 0) return binding.on === void 0;
-	const leaf = findRole(policy.vocabulary.roles, name);
-	return leaf !== void 0 && leaf.on === void 0;
-}
-/** The rules `rls generate` enforces; `undefined` when no role declares one. */
-function ownershipRules(policy, scopes) {
-	const kinds = {};
-	const assigns = [];
-	const counted = [];
-	for (const binding of policy.roles) {
-		const scope = roleScope(policy, scopes, binding.name);
-		if (binding.for !== void 0) kinds[binding.name] = binding.for;
-		const assigner = scope ?? (binding.on === void 0 ? "global" : void 0);
-		for (const target of binding.assigns ?? []) {
-			const at = roleScope(policy, scopes, target);
-			if (assigner !== void 0 && at !== void 0 && (assigner === "global" || scopeChain(scopes, at).includes(assigner))) assigns.push({
-				assigner: binding.name,
-				scope: assigner,
-				role: target,
-				at
-			});
-			else if (assigner === "global" && isGlobalRole(policy, target)) assigns.push({
-				assigner: binding.name,
-				scope: "global",
-				role: target,
-				at: "global"
-			});
-		}
-		const min = binding.min ?? 0;
-		const transferOnly = binding.transferOnly === true;
-		if (scope !== void 0 && (min > 0 || binding.max !== void 0 || transferOnly)) counted.push(binding.max === void 0 ? {
-			role: binding.name,
-			scope,
-			min,
-			transferOnly
-		} : {
-			role: binding.name,
-			scope,
-			min,
-			max: binding.max,
-			transferOnly
-		});
-	}
-	if (Object.keys(kinds).length === 0 && assigns.length === 0 && counted.length === 0) return;
-	return {
-		kinds,
-		assigns,
-		counted
-	};
-}
-/**
-* The ownership objects: holder-count and transfer-only triggers on each
-* scope's membership table, and `permdock_can_assign` for the application's
-* own policies on those tables. Empty when no role declares a rule.
-*/
-function ownershipSql(ctx) {
-	const own = ctx.ownership;
-	if (own === void 0) return "";
-	const chunks = [];
-	const skipped = ctx.skipOwnershipTriggers;
-	for (const { name } of ctx.scopes) {
-		const counted = own.counted.filter((rule) => rule.scope === name);
-		if (counted.length === 0) continue;
-		if (skipped === "all" || skipped?.includes(name) === true) {
-			chunks.push(`-- ${name}: rls.ownershipTriggers leaves out the triggers, so min, max and transferOnly are checked only by decideRoleChange`);
-			continue;
-		}
-		const transfer = counted.filter((rule) => rule.transferOnly).map((rule) => rule.role);
-		const mapped = scopeTable(ctx, name);
-		if (mapped === void 0) {
-			const sources = holderSources(ctx, name);
-			if (sources === void 0) chunks.push(`-- ${name}: no memberships table configured, so min, max and transferOnly are checked only by decideRoleChange`);
-			else if (sources === "not-tables") chunks.push(`-- ${name}: a membership source is not a table, so min, max and transferOnly are checked only by decideRoleChange`);
-			else {
-				chunks.push(sourceHoldersTriggerSql(ctx, name, sources, counted));
-				if (transfer.length > 0) chunks.push(sourceTransferTriggerSql(ctx, name, sources, transfer));
-			}
-			continue;
-		}
-		chunks.push(holdersTriggerSql(ctx, name, mapped.table, mapped.column, counted));
-		if (transfer.length > 0) chunks.push(transferTriggerSql(ctx, name, mapped.table, mapped.column, transfer));
-	}
-	if (own.assigns.length > 0) {
-		chunks.push(canAssignSql(ctx, own));
-		if (ctx.authorize === "database") chunks.push(canAssignSql(ctx, own, true));
-		const custom = assignsCustomRoles(ctx);
-		if (custom) {
-			chunks.push(canAssignCustomSql(ctx));
-			if (hasCustomRoleChecksFor(ctx)) chunks.push(canAssignCustomSql(ctx, true));
-		}
-		chunks.push(canAssignAnySql(ctx, custom));
-		if (hasCanAssignAnyFor(ctx)) chunks.push(canAssignAnySql(ctx, custom, true));
-	}
-	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
-}
-//#endregion
-export { ASSIGNMENTS as a, guardedTables as i, ownershipSql as n, OWNERSHIP as o, assignmentSql as r, ownershipRules as t };