permdock 0.5.0 → 0.7.0

package/dist/{verify-DbCL9bnB.js → verify-pe8rL_Qw.js}

@@ -1,33 +1,37 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
-import { a as hasConditionOp, c as isConditionRef } from "./refs-K6eWUJ0H.js";
-import { E as memoryCustomRoleSource, g as memoryRelationSource } from "./src-DLfUWFAI.js";
-import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { l as isConditionRef, o as hasConditionOp } from "./refs-CNJBiTFo.js";
+import { A as memoryCustomRoleSource, b as memoryRelationSource } from "./src-DLFrtrrC.js";
+import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { f as nowMillis, u as isoAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { d as scopeList } from "./scopes-CUPSjo9q.js";
-import { o as requiresStandIn } from "./delegation-DaXVdDhM.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { p as scopeField } from "./tenancy-DN2QAx9z.js";
-import { s as policyLevels } from "./policy-DLZJ5gAp.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { f as scopeList, l as rootScope, o as normalizeMemberships } from "./scopes-BHsc-wp-.js";
+import { o as requiresStandIn } from "./delegation-C5rOdTp5.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-C6P1Tvol.js";
+import { p as scopeField } from "./tenancy-CmeBQ6Nv.js";
+import { c as policyLevels } from "./policy-DaJy4nK4.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { _ as membershipsClaim, c as andWhere, g as leveled, p as customRoleScope } from "./evaluate-_R8QkWaf.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
-import { a as describeError, i as configError, u as usageResult } from "./errors-CWTY6uih.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-B_oqFbWC.js";
+import { t as getPermDock } from "./permdock-BfWEeMqk.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
-import { o as loadPolicyAt } from "./load-DFS_ry0W.js";
-import { c as relationArmSql, u as restrictedRowsSql } from "./compile-CMqMx_IN.js";
+import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
+import { o as loadPolicyAt } from "./load-DxroEzH1.js";
+import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-B96movIM.js";
+import { c as relationArmSql, i as scopeMembershipTable, r as scopeColumn, u as restrictedRowsSql } from "./compile-BAEO5bOk.js";
 import "./budget-NbEtbJC_.js";
-import { i as qualifySqlTable, n as defaultSqlCommand } from "./sql-B5T1IL83.js";
-import "./sources-vs5dGOsS.js";
+import "./sources-B-zYB4GS.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
-import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as helperSchema, r as HELPERS, v as subjectClaimSql, w as arrayColumnsOf } from "./shared-CD11nBbC.js";
-import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-CO1oOymN.js";
-import { B as linkHelper, D as breakGlassHolder, F as graphHelper, I as graphSqlName, J as restrictedHelper, L as graphSqlText, M as contextRefs, N as sqlFunctionNames, O as breakGlassKey, P as CLOSURE, Q as activeUserSql, X as scopeTable, j as compileConditionSql, k as collectGrants, m as accessSql, p as requiresSql, v as capabilityAccessSql, w as apiKeyAllowsCall } from "./ownership-BatFgAA4.js";
-import { s as viewName, t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-BTMW6zgU.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-fMKOv8hP.js";
+import { B as sqlFunctionNames, F as collectGrants, H as graphHelper, N as breakGlassHolder, P as breakGlassKey, R as compileConditionSql, U as graphSqlName, V as CLOSURE, W as graphSqlText, at as activeUserSql, et as permittedIdsHelper, h as accessSql, k as apiKeyAllowsCall, m as requiresSql, q as linkHelper, rt as scopeTable, tt as restrictedHelper, x as capabilityAccessSql, y as tokenScopeAllowsCall, z as contextRefs } from "./ownership-Z2LpxsGa.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-B2lZIurj.js";
+import { s as viewName, t as FIELD_VIEWS } from "./fields-ClcQLrVc.js";
+import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts
 /** Postgres truncates identifiers longer than this, in bytes. */
@@ -279,7 +283,7 @@ function capabilityAccess(item, policy, ctx) {
 	if (hops.length === 0) return;
 	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
 }
-function prepare(item, tables, warnings, skipClosures, actions, rowActions = false) {
+function prepare(item, tables, warnings, skipClosures, sql, rowActions = false) {
 	const { grant, label } = item;
 	if (grant.breakGlass !== void 0) {
 		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
@@ -304,9 +308,14 @@ function prepare(item, tables, warnings, skipClosures, actions, rowActions = fal
 		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
 		return;
 	}
-	const command = commandFor(grant.permission.action, actions);
+	const tableless = sql.tableless?.has(grant.permission.resource) === true;
+	const command = tableless ? void 0 : commandFor(grant.permission.action, sql.actions);
 	const table = tableFor$1(grant.permission.resource, tables);
 	if (command === void 0) {
+		if (tableless && item.access.kind !== "role") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: rls.tables.${grant.permission.resource} is false, so the resource has no table, and only role grants are seeded`);
+			return;
+		}
 		if (item.access.kind !== "role" && rowActions) return {
 			item,
 			command: "none",
@@ -384,19 +393,19 @@ function groupOf(permission, list) {
 	return names[0];
 }
 /**
-* One entry per level for every allow of an assignable role on a resource
-* with levels, keyed `<grant key>@<level>`. Only `permdock_custom_keys`
-* hands these keys out, to a custom role whose stored allow names the level.
+* One entry per level for every allow of a role on a resource with levels,
+* keyed `<grant key>@<level>`, whether or not the role is assignable: every
+* role holds the same leveled keys, and `permdock_ceiling` keeps only the
+* assignable roles'. Only `permdock_custom_keys` hands these keys out, to a
+* custom role whose stored allow names the level.
 */
 function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
-	const custom = ctx.customRoles;
-	if (custom?.levels !== true) return [];
-	const assignable = new Set(custom.assignable);
+	if (ctx.customRoles?.levels !== true) return [];
 	const out = [];
 	for (const [entry, grantKey] of Array.from(keys)) {
 		const { item } = entry;
 		const { grant } = item;
-		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || !assignable.has(item.access.role)) continue;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance") continue;
 		if (grant.permission.key.includes("@")) throw configError(`PermDock CLI: permission key '${grant.permission.key}' holds '@', which separates a level in custom-role grant keys`);
 		for (const [level, condition] of policyLevels(policy, grant.permission.resource)) {
 			const where = andWhere(item.where, condition);
@@ -404,7 +413,7 @@ function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
 				...item,
 				grant: leveled(grant, level, condition),
 				...where === void 0 ? {} : { where }
-			}, tables, warnings, skipClosures, ctx.actions);
+			}, tables, warnings, skipClosures, ctx);
 			if (prepared !== void 0) {
 				keys.set(prepared, `${grantKey}@${level}`);
 				out.push(prepared);
@@ -432,10 +441,10 @@ const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct fro
 function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
 	const items = collectGrants(policy);
 	const entries = items.flatMap((item) => {
-		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions, rowActions);
+		const entry = prepare(item, tables, warnings, skipClosures, ctx, rowActions);
 		return entry === void 0 ? [] : [entry];
 	});
-	const keys = assignKeys(entries, ctx.fields === "views");
+	const keys = assignKeys(entries, ctx.fields !== void 0);
 	entries.push(...levelEntries(policy, ctx, keys, tables, warnings, skipClosures));
 	const conditionedKeys = /* @__PURE__ */ new Set();
 	for (const [entry, grantKey] of keys) if (entry.using !== void 0 || entry.check !== void 0 || entry.item.grant.validity !== void 0 || entry.item.grant.requires !== void 0) conditionedKeys.add(grantKey);
@@ -492,7 +501,7 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 				};
 				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
 			}
-			if (!rowActions) continue;
+			if (!rowActions || ctx.tableless?.has(grant.permission.resource)) continue;
 		}
 		const actionOnly = entry.command === "none";
 		const command = actionOnly ? "select" : entry.command;
@@ -506,8 +515,10 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 		const grantKey = keys.get(entry);
 		let accessExpr;
 		if (access.kind === "role" && grantKey !== void 0) {
-			const column = access.scope === "global" ? void 0 : scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
-			accessExpr = accessSql(ctx, access.scope, grantKey, column);
+			const via = ctx.vias?.[grant.permission.resource];
+			if (via !== void 0 && access.scope !== "global" && access.scope !== via.scope) throw configError(`PermDock CLI: ${label}/${grant.permission.key} is granted at scope ${access.scope}, but rls.tables.${grant.permission.resource}.via reaches ${via.scope}; map the scope with via.scope or grant at ${via.scope}`);
+			const column = access.scope === "global" ? void 0 : via?.key ?? scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
+			accessExpr = accessSql(ctx, access.scope, grantKey, column, access.scope === "global" ? void 0 : via?.helper);
 			if (column !== void 0) filters(grant.permission.resource, table, column);
 			const row = {
 				role: access.role,
@@ -529,8 +540,10 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 		accessExpr = andSql(accessExpr, validity);
 		for (const key of grant.requires ?? []) accessExpr = andSql(accessExpr, requiresSql(ctx, key, policy.resources.get(grant.permission.resource)));
 		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
-		if (ctx.apiKeys !== void 0 && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
-			const calls = (requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []]).map((key) => `(select ${apiKeyAllowsCall(ctx, quoteLiteral(key))})`);
+		if ((ctx.apiKeys !== void 0 || ctx.tokenScopes !== void 0) && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
+			const covered = requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []];
+			const ceilings = [...ctx.apiKeys === void 0 ? [] : [apiKeyAllowsCall], ...ctx.tokenScopes === void 0 ? [] : [tokenScopeAllowsCall]];
+			const calls = covered.flatMap((key) => ceilings.map((call) => `(select ${call(ctx, quoteLiteral(key))})`));
 			accessExpr = andSql(accessExpr, calls.length === 1 ? calls[0] ?? "" : `(${calls.join(" and ")})`);
 		}
 		const using = compileOptional(entry.using, rowCtx);
@@ -697,6 +710,229 @@ function rowConditionMessage(policy, keys) {
 }
 const ROW_CONDITION_FIX = "call permitted_<scope>_ids_by_permission('<key>') or permdock_has_permission('<key>'), which count only the allows without a row condition (a relationship grant never reaches a topic or a folder), or use a permission whose catalog entry has rowConditions: false";
 //#endregion
+//#region src/cli/sql/tables.ts
+/** The `schema.table` an `rls.tables` entry names, or `resource` when it names none or is `false`. */
+function tableNameOf(entry, resource) {
+	if (entry === void 0 || entry === false) return resource;
+	return typeof entry === "string" ? entry : entry.table ?? resource;
+}
+/** `rls.tables` as resource to table name, the `via` objects reduced to their `table` and the `false` entries left out. */
+function tableNames(tables) {
+	return tables === void 0 ? void 0 : Object.fromEntries(Object.entries(tables).filter(([, entry]) => entry !== false).map(([resource, entry]) => [resource, tableNameOf(entry, resource)]));
+}
+/** The resources `rls.tables` marks `false`: no table, so no policies. */
+function tablelessResources(tables) {
+	return new Set(Object.entries(tables ?? {}).filter(([, entry]) => entry === false).map(([resource]) => resource));
+}
+function singular(name) {
+	if (name.endsWith("ies")) return `${name.slice(0, -3)}y`;
+	if (name.endsWith("sses")) return name.slice(0, -2);
+	return name.endsWith("s") && !name.endsWith("ss") ? name.slice(0, -1) : name;
+}
+/** The `via` entries of `rls.tables`, by resource. */
+function resolveVias(tables, scopes, dialect) {
+	const out = {};
+	for (const [resource, entry] of Object.entries(tables ?? {})) {
+		if (typeof entry === "string" || entry === false) continue;
+		const { via } = entry;
+		const scope = via.scope ?? scopes[0]?.name;
+		if (scope === void 0 || !scopes.some((item) => item.name === scope)) throw configError(`PermDock CLI: rls.tables.${resource}.via.scope '${scope ?? ""}' is not a scope of the policy (${scopes.map((item) => item.name).join(", ")})`);
+		const name = singular(via.table.slice(via.table.lastIndexOf(".") + 1));
+		out[resource] = {
+			helper: permittedIdsHelper(name),
+			key: via.key ?? `${name}_id`,
+			scope,
+			table: via.table.includes(".") ? via.table : `public.${via.table}`,
+			column: via.column,
+			id: via.id ?? "id",
+			type: via.type ?? (dialect === "supabase" ? "uuid" : "text")
+		};
+	}
+	const helpers = /* @__PURE__ */ new Map();
+	for (const [resource, via] of Object.entries(out)) {
+		const seen = helpers.get(via.helper);
+		if (seen !== void 0 && (seen.table !== via.table || seen.column !== via.column || seen.id !== via.id || seen.scope !== via.scope || seen.type !== via.type)) throw configError(`PermDock CLI: rls.tables.${resource}.via names ${via.helper}, which another resource defines over a different parent; give the parents different table names`);
+		helpers.set(via.helper, via);
+	}
+	return Object.keys(out).length === 0 ? void 0 : out;
+}
+//#endregion
+//#region src/cli/rls/verify-findings.ts
+const VERIFY_DOCS = `${DOCS_BASE}/rls#verify`;
+function rlsFinding(code, table, key, message, severity = "error") {
+	return {
+		code,
+		table,
+		key,
+		message,
+		severity
+	};
+}
+/** `<code>:<table>:<key>`: what `--ignore` and `rls.verify.ignore` name. */
+function findingId(finding) {
+	return `${finding.code}:${finding.table}:${finding.key}`;
+}
+/** `rls.verify.ignore`, checked, then one entry per `--ignore` id. */
+function verifyIgnores(config, flags = []) {
+	const entries = config.rls?.verify?.ignore ?? [];
+	if (!Array.isArray(entries)) throw configError("PermDock CLI: rls.verify.ignore must be a list of { id, reason }");
+	const out = [];
+	for (const [index, entry] of entries.entries()) {
+		if (!isRecord(entry) || typeof entry["id"] !== "string" || entry["id"] === "" || typeof entry["reason"] !== "string" || entry["reason"].trim() === "") throw configError(`PermDock CLI: rls.verify.ignore[${String(index)}] needs an id and a non-empty reason`);
+		out.push({
+			id: entry["id"],
+			reason: entry["reason"]
+		});
+	}
+	for (const id of flags) out.push({
+		id,
+		reason: "--ignore"
+	});
+	return out;
+}
+/** Splits `findings` by `ignores`; an id listed twice counts once, with its first reason. */
+function applyIgnores(findings, ignores) {
+	const reasons = /* @__PURE__ */ new Map();
+	for (const entry of ignores) if (!reasons.has(entry.id)) reasons.set(entry.id, entry.reason);
+	const matched = /* @__PURE__ */ new Set();
+	const kept = [];
+	const ignored = [];
+	for (const finding of findings) {
+		const id = findingId(finding);
+		const reason = reasons.get(id);
+		if (reason === void 0) kept.push({
+			...finding,
+			id
+		});
+		else {
+			matched.add(id);
+			ignored.push({
+				id,
+				reason,
+				message: finding.message
+			});
+		}
+	}
+	return {
+		findings: kept,
+		ignored,
+		stale: [...reasons].filter(([id]) => !matched.has(id)).map(([id, reason]) => ({
+			id,
+			reason
+		}))
+	};
+}
+function prefixOf(severity) {
+	switch (severity) {
+		case "error": return "";
+		case "warning": return "warning: ";
+		case "info": return "info: ";
+		default: return severity;
+	}
+}
+/**
+* The `rls verify` result: exit 1 when an error finding is left after the
+* ignores. Text lines carry each finding's id; `--json` data is
+* `{ findings, ignored, stale }`; `--format github|sarif` renders `findings`.
+*/
+function verifyResult(input) {
+	const report = applyIgnores(input.findings, input.ignore);
+	const failed = report.findings.some((item) => item.severity === "error");
+	const lines = [
+		...report.findings.map((item) => `${prefixOf(item.severity)}${item.message} [${item.id}]`),
+		...report.ignored.map((item) => `ignored ${item.id}: ${item.reason}`),
+		...report.stale.map((item) => `warning: ignore entry ${item.id} matches no finding; remove it from rls.verify.ignore`),
+		...failed ? [] : [input.summary],
+		...input.notes ?? []
+	];
+	return {
+		code: failed ? 1 : 0,
+		output: lines.join("\n"),
+		data: report,
+		findings: [...report.findings.map((item) => ({
+			code: item.code,
+			id: item.id,
+			severity: item.severity,
+			message: item.message,
+			docs: VERIFY_DOCS
+		})), ...report.stale.map((item) => ({
+			code: "ignore-stale",
+			id: `ignore-stale:${item.id}`,
+			severity: "warning",
+			message: `ignore entry ${item.id} matches no finding`,
+			fix: "remove it from rls.verify.ignore",
+			docs: VERIFY_DOCS
+		}))]
+	};
+}
+//#endregion
+//#region src/cli/rls/verify-pgtap-memberships.ts
+function insert(table, columns) {
+	return `insert into ${quoteTable(table)} (${columns.map(([name]) => quoteIdent(name)).join(", ")}) values (${columns.map(([, value]) => quoteLiteral(value)).join(", ")}) on conflict do nothing;`;
+}
+/** The rows of a table mapped by `rls.memberships`: one per role, for a plain role column. */
+function mappedRows(config, scopes, user, membership) {
+	const { scope, id } = membership;
+	if (scope === void 0 || id === void 0) return [];
+	const table = scopeMembershipTable(config.rls?.memberships, scopes, scope);
+	const idColumn = table === void 0 ? void 0 : scopeColumn(table, scopes, scope);
+	const roleColumn = table?.role;
+	if (table === void 0 || idColumn === void 0 || typeof roleColumn !== "string") return [];
+	const rootName = rootScope(scopes);
+	const tenantColumn = rootName === void 0 || rootName === scope ? void 0 : scopeColumn(table, scopes, rootName);
+	const tenant = rootName === void 0 ? void 0 : membership.within?.[rootName];
+	const extra = [];
+	for (const [name, value] of Object.entries(membership.within ?? {})) {
+		const column = scopeColumn(table, scopes, name);
+		if (column !== void 0 && name !== scope) extra.push([column, value]);
+	}
+	if (tenantColumn !== void 0 && tenant !== void 0 && !extra.some(([column]) => column === tenantColumn)) extra.push([tenantColumn, tenant]);
+	return membership.roles.map((role) => insert(table.table, [
+		[table.user, user],
+		[idColumn, id],
+		...extra,
+		[roleColumn, role]
+	]));
+}
+/** The rows of a `membershipSources` source: only a source whose columns are plain, never a `through` or `map`. */
+function sourceRows(source, scopes, user, membership) {
+	const { scope, id } = membership;
+	if (scope === void 0 || id === void 0) return [];
+	const names = new Set(scopes.map((entry) => entry.name));
+	if ("through" in source.user || !names.has(scope) || "value" in source.scope && source.scope.value !== scope) return [];
+	const role = source.role;
+	const roleColumns = Array.isArray(role) || !("column" in role) || "through" in role ? void 0 : "map" in role ? void 0 : role.column;
+	const fixed = "value" in source.scope ? [] : [[source.scope.column, scope]];
+	const within = source.within;
+	const ancestors = within === void 0 || !("columns" in within) ? [] : Object.entries(within.columns).flatMap(([name, column]) => {
+		const value = membership.within?.[name];
+		return value === void 0 ? [] : [[column, value]];
+	});
+	const base = [
+		[source.user.column, user],
+		[source.id.column, id],
+		...fixed,
+		...ancestors
+	];
+	if (roleColumns === void 0) return [];
+	return membership.roles.map((value) => insert(source.table, [...base, [roleColumns, value]]));
+}
+/**
+* The statements that put a fixture's memberships into the configured
+* membership tables and sources, so the helpers of `authorize: 'database'`
+* find them. A membership no plain table or source can hold (a `through`
+* or mapped role column, an `on` membership) is listed in a comment.
+*/
+function fixtureMembershipSql(config, scopes, fixture, sources) {
+	const lines = [];
+	for (const membership of normalizeMemberships(fixture.subject.memberships ?? [], scopes)) {
+		const rows = [...mappedRows(config, scopes, fixture.subject.id, membership), ...sources.flatMap((source) => sourceRows(source, scopes, fixture.subject.id, membership))];
+		if (rows.length === 0) lines.push(`-- no membership table holds ${membership.scope ?? "on"} ${membership.id ?? ""}: not seeded`);
+		lines.push(...rows);
+	}
+	return lines;
+}
+//#endregion
 //#region src/cli/rls/verify-pgtap.ts
 /** A custom role's scope and pinned instance, as the `custom_role_*` tables store them. */
 function customRoleAt(role, scopes) {
@@ -789,7 +1025,16 @@ function subjectSettings(fixture, subject) {
 	const roles = fixture.subject.roles ?? [];
 	const memberships = membershipsClaim(fixture.subject.memberships ?? [], subject.customRoles, subject.scopes);
 	if (subject.dialect === "guc") {
+		const fixed = /* @__PURE__ */ new Set([
+			"user_id",
+			"sub",
+			"role",
+			"memberships",
+			subject.roleClaim,
+			subject.tenantClaim
+		]);
 		const settings = [
+			...Object.entries(fixture.subject.claims ?? {}).flatMap(([name, value]) => fixed.has(name) || !SQL_IDENT.test(name) ? [] : [[`${subject.gucPrefix}.${name}`, typeof value === "string" ? value : JSON.stringify(value)]]),
 			[`${subject.gucPrefix}.user_id`, fixture.subject.id],
 			[`${subject.gucPrefix}.${subject.roleClaim}`, roles.join(",")],
 			[`${subject.gucPrefix}.memberships`, JSON.stringify(memberships)]
@@ -839,9 +1084,12 @@ function customRoleRows(schema, customRoles, scopes) {
 	}
 	return rows;
 }
-function seedsCustomRoleTables(config) {
+function databaseMode(config) {
 	const rls = config.rls;
-	return customRolesOn(rls) && (rls?.authorize ?? rls?.rbac?.authorize ?? "jwt") === "database";
+	return (rls?.authorize ?? rls?.rbac?.authorize ?? "jwt") === "database";
+}
+function seedsCustomRoleTables(config) {
+	return customRolesOn(config.rls) && databaseMode(config);
 }
 function customRoleSchema(config) {
 	return config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
@@ -859,6 +1107,7 @@ function emitPgtap(input) {
 		PGTAP_DECISION_SQL
 	];
 	if (seedsCustomRoleTables(input.config)) for (const row of customRoleRows(customRoleSchema(input.config), input.customRoles, scopes)) lines.push(`${inlineStatement(row)};`);
+	const sources = membershipSourcesOf(input.config).map((source) => source.sql.manifest);
 	for (const [index, fixture] of input.fixtures.entries()) {
 		const permission = findPermission(input.policy.permissions, fixture.action);
 		const status = input.inProcess[index];
@@ -868,10 +1117,14 @@ function emitPgtap(input) {
 			lines.push(`select skip(${quoteLiteral(`${label}: opaque grant untestable app-side`)}, 1);`);
 			continue;
 		}
+		if (input.config.rls?.tables?.[permission.resource] === false) {
+			lines.push(`select skip(${quoteLiteral(`${label}: rls.tables.${permission.resource} is false, so there is no table`)}, 1);`);
+			continue;
+		}
 		const outcome = status.granted ? "granted" : "denied";
-		const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
+		const table = tableNameOf(input.config.rls?.tables?.[permission.resource], permission.resource);
 		const statement = inlineStatement(statementFor(fixture, permission.action, table));
-		lines.push(`-- ${label}`, "savepoint permdock_fixture;", "set local role \"authenticated\";", ...subjectSettings(fixture, subject).map(([name, value]) => `select set_config(${quoteLiteral(name)}, ${quoteLiteral(value)}, true);`), `select is(${PGTAP_DECISION}(${quoteLiteral(statement)}), ${quoteLiteral(outcome)}, ${quoteLiteral(`${label} ${outcome}`)});`, "rollback to savepoint permdock_fixture;");
+		lines.push(`-- ${label}`, "savepoint permdock_fixture;", ...databaseMode(input.config) ? fixtureMembershipSql(input.config, scopes, fixture, sources) : [], "set local role \"authenticated\";", ...subjectSettings(fixture, subject).map(([name, value]) => `select set_config(${quoteLiteral(name)}, ${quoteLiteral(value)}, true);`), `select is(${PGTAP_DECISION}(${quoteLiteral(statement)}), ${quoteLiteral(outcome)}, ${quoteLiteral(`${label} ${outcome}`)});`, "rollback to savepoint permdock_fixture;");
 	}
 	lines.push("select * from finish();", "rollback;");
 	return `${lines.join("\n")}\n`;
@@ -1399,7 +1652,7 @@ async function seedRows(query, table, rows, given, entropy) {
 async function verifyTree(input) {
 	const { policy, query } = input;
 	const entropy = input.entropy ?? SYSTEM_ENTROPY;
-	const tables = input.config.rls?.tables;
+	const tables = tableNames(input.config.rls?.tables);
 	const treeValues = input.config.rls?.treeValues ?? {};
 	const seed = (table, list) => seedRows(query, table, list, treeValues[table] ?? {}, entropy);
 	const walked = [...graphPlan(policy).values()].filter((entry) => entry.closure !== void 0);
@@ -1506,7 +1759,7 @@ async function verifyTree(input) {
 				checked += 1;
 				const id = String(row[node.id]);
 				const allowed = permdock.can(permission, row);
-				if (allowed !== seen.has(id)) mismatches.push(`${permission.key} ${id}: in-process ${allowed ? "granted" : "denied"}, database ${seen.has(id) ? "allowed" : "filtered"}`);
+				if (allowed !== seen.has(id)) mismatches.push(rlsFinding("tree-mismatch", node.name, permission.key, `${permission.key} ${id}: in-process ${allowed ? "granted" : "denied"}, database ${seen.has(id) ? "allowed" : "filtered"}`));
 				else if (allowed) granted += 1;
 			}
 		}
@@ -1520,6 +1773,10 @@ async function verifyTree(input) {
 }
 //#endregion
 //#region src/cli/rls/verify-database.ts
+/** A fixture's part of a finding id: its subject and row. */
+function fixtureKey(fixture) {
+	return `${fixture.subject.id}/${String(rowId(fixture.row))}`;
+}
 /** Columns of `row` that hold a value; a masked column reads as null. */
 function valuedColumns(row) {
 	return isRecord(row) ? Object.keys(row).filter((name) => row[name] !== null && row[name] !== void 0).toSorted() : [];
@@ -1536,8 +1793,9 @@ function expectedFields(granted, picked, key, row) {
 }
 function fieldsMismatch(fixture, want, seen) {
 	const kept = want.join(", ");
-	if (typeof seen === "string") return [`${fixture.action}: field view read failed (${seen}), pick keeps [${kept}]`];
-	return seen.join(", ") === kept ? [] : [`${fixture.action} ${String(rowId(fixture.row))}: field view returns [${seen.join(", ")}], pick keeps [${kept}]`];
+	const mismatch = (message) => rlsFinding("field-mismatch", fixture.action, fixtureKey(fixture), message);
+	if (typeof seen === "string") return [mismatch(`${fixture.action}: field view read failed (${seen}), pick keeps [${kept}]`)];
+	return seen.join(", ") === kept ? [] : [mismatch(`${fixture.action} ${String(rowId(fixture.row))}: field view returns [${seen.join(", ")}], pick keeps [${kept}]`)];
 }
 /** The field view's columns for the fixture's row: the view, or the table itself when no grant limits its fields. */
 async function viewFields(query, table, key) {
@@ -1590,7 +1848,7 @@ async function verifyAgainstDatabase(input) {
 		const conditioned = policyRowConditionKeys(input.policy);
 		for (const found of helperTablePoliciesFromRows((await query(HELPER_TABLE_POLICIES_SQL)).rows)) {
 			const keys = found.keys.filter((key) => conditioned.has(key));
-			if (keys.length > 0) mismatches.push(`PD037 ${rowConditionMessage(found, keys)}`);
+			if (keys.length > 0) mismatches.push(rlsFinding("condition-blind", found.table, found.name, `PD037 ${rowConditionMessage(found, keys)}`));
 		}
 		for (const [index, fixture] of input.fixtures.entries()) {
 			const permission = findPermission(input.policy.permissions, fixture.action);
@@ -1600,7 +1858,11 @@ async function verifyAgainstDatabase(input) {
 				notes.push(`${fixture.action}: opaque grant untestable app-side`);
 				continue;
 			}
-			const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
+			if (input.config.rls?.tables?.[permission.resource] === false) {
+				notes.push(`${fixture.action}: rls.tables.${permission.resource} is false, so there is no table`);
+				continue;
+			}
+			const table = tableNameOf(input.config.rls?.tables?.[permission.resource], permission.resource);
 			await query("begin");
 			try {
 				if (seedsTables) await seedCustomRoles(query, schema, input.customRoles, scopes);
@@ -1609,7 +1871,7 @@ async function verifyAgainstDatabase(input) {
 				const result = await query(statement.sql, statement.values);
 				const count = result.rowCount ?? result.rows.length;
 				const database = result.code === "42501" ? "rejected" : count > 0 ? "allowed" : "filtered";
-				if (!(status.granted ? database === "allowed" : database === "filtered" || database === "rejected")) mismatches.push(`${fixture.action}: in-process ${status.granted ? "granted" : "denied"}, database ${database}`);
+				if (!(status.granted ? database === "allowed" : database === "filtered" || database === "rejected")) mismatches.push(rlsFinding("parity-mismatch", fixture.action, fixtureKey(fixture), `${fixture.action}: in-process ${status.granted ? "granted" : "denied"}, database ${database}`));
 				else if (status.kind === "sqlFunction") notes.push(`${fixture.action}: verified through twin`);
 				mismatches.push(...status.fields === void 0 ? [] : fieldsMismatch(fixture, status.fields, await viewFields(query, table, rowId(fixture.row))));
 			} finally {
@@ -1625,7 +1887,7 @@ async function verifyAgainstDatabase(input) {
 	};
 }
 /** `--tree`: seeds a generated object graph in a rolled-back transaction and compares `can()` with RLS. */
-async function verifyTreeAgainstDatabase(db, policy, config, connect) {
+async function verifyTreeAgainstDatabase(db, policy, config, connect, ignore) {
 	const client = await connect(db);
 	const scopes = scopeList(policy.scopes);
 	const query = async (sql, values) => {
@@ -1647,15 +1909,12 @@ async function verifyTreeAgainstDatabase(db, policy, config, connect) {
 				action: "read"
 			}, subjectOf(config, [], scopes))
 		});
-		if (result.mismatches.length > 0) return {
-			code: 1,
-			output: [...result.mismatches, ...result.notes].join("\n")
-		};
-		const verified = `verified ${String(result.checked)} tree check(s) against the database (${String(result.granted)} granted)`;
-		return {
-			code: 0,
-			output: result.notes.length === 0 ? verified : `${verified}\n${result.notes.join("\n")}`
-		};
+		return verifyResult({
+			findings: result.mismatches,
+			ignore,
+			notes: result.notes,
+			summary: `verified ${String(result.checked)} tree check(s) against the database (${String(result.granted)} granted)`
+		});
 	} catch (cause) {
 		return {
 			code: 2,
@@ -1668,6 +1927,8 @@ async function verifyTreeAgainstDatabase(db, policy, config, connect) {
 }
 //#endregion
 //#region src/cli/rls/verify.ts
+/** Where `rls verify --kind pgtap` writes, the folder `supabase test db` reads. */
+const PGTAP_OUT = "supabase/tests/permdock_rls.test.sql";
 function canFixture(permdock, permission, row) {
 	if (permission.kind === "collection") return permdock.can(permission, row);
 	return permdock.can(permission, row);
@@ -1679,6 +1940,11 @@ function grantKind(policy, key) {
 	return "portable";
 }
 async function runRlsVerify(input) {
+	const ignore = input.ignore ?? [];
+	if (input.out !== void 0 && input.format !== "pgtap") return {
+		code: 2,
+		output: "PermDock CLI: rls verify --out needs --kind pgtap"
+	};
 	const connect = input.connect ?? pgConnector("permdock rls verify --db-url-stdin", input.cwd);
 	const policyPath = input.from ?? input.config.policy;
 	if (policyPath === void 0) return {
@@ -1692,7 +1958,7 @@ async function runRlsVerify(input) {
 			output: "PermDock CLI: rls verify --tree needs a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 		};
 		try {
-			return await verifyTreeAgainstDatabase(input.db, policy, input.config, connect);
+			return await verifyTreeAgainstDatabase(input.db, policy, input.config, connect, ignore);
 		} catch (cause) {
 			return usageResult(cause);
 		}
@@ -1702,11 +1968,11 @@ async function runRlsVerify(input) {
 	const mismatches = [];
 	const notes = [];
 	const inProcess = [];
-	const fieldsMode = input.config.rls?.fields === "views";
+	const fieldsMode = input.config.rls?.fields !== void 0;
 	for (const fixture of fixtures) {
 		const permission = findPermission(policy.permissions, fixture.action);
 		if (permission === void 0) {
-			mismatches.push(`${fixture.action}: unknown permission`);
+			mismatches.push(rlsFinding("unknown-permission", fixture.action, fixtureKey(fixture), `${fixture.action}: unknown permission`));
 			inProcess.push({
 				action: fixture.action,
 				granted: false,
@@ -1718,7 +1984,7 @@ async function runRlsVerify(input) {
 		const permdock = await getPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) });
 		const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
 		const outcome = granted ? "granted" : "denied";
-		if (fixture.expected !== void 0 && fixture.expected !== outcome) mismatches.push(`${fixture.action}: in-process ${outcome}, expected ${fixture.expected}`);
+		if (fixture.expected !== void 0 && fixture.expected !== outcome) mismatches.push(rlsFinding("expected-mismatch", fixture.action, fixtureKey(fixture), `${fixture.action}: in-process ${outcome}, expected ${fixture.expected}`));
 		if (kind === "opaque") notes.push(`${fixture.action}: opaque grant untestable app-side`);
 		const fields = fieldsMode && permission.kind === "instance" && commandFor(permission.action, input.config.rls?.actions) === "select" ? expectedFields(granted, permdock.pick(permission, fixture.row), policy.resources.get(permission.resource)?.id ?? "id", fixture.row) : void 0;
 		inProcess.push({
@@ -1728,19 +1994,23 @@ async function runRlsVerify(input) {
 			...fields === void 0 ? {} : { fields }
 		});
 	}
-	if (input.format === "pgtap") return mismatches.length > 0 ? {
-		code: 1,
-		output: mismatches.join("\n")
-	} : {
-		code: 0,
-		output: emitPgtap({
+	if (input.format === "pgtap") {
+		const outRel = input.out ?? PGTAP_OUT;
+		const result = verifyResult({
+			findings: mismatches,
+			ignore,
+			summary: `wrote ${outRel}`
+		});
+		if (result.code !== 0) return result;
+		writeFileEnsuringDir(resolve(input.cwd, outRel), emitPgtap({
 			fixtures,
 			inProcess,
 			policy,
 			config: input.config,
 			customRoles
-		})
-	};
+		}));
+		return result;
+	}
 	if (input.db !== void 0) try {
 		const database = await verifyAgainstDatabase({
 			db: input.db,
@@ -1756,15 +2026,12 @@ async function runRlsVerify(input) {
 	} catch (cause) {
 		return usageResult(cause);
 	}
-	if (mismatches.length > 0) return {
-		code: 1,
-		output: [...mismatches, ...notes].join("\n")
-	};
-	const verified = `verified ${String(fixtures.length)} fixture(s) ${input.db === void 0 ? "in-process" : "in-process and against the database"}`;
-	return {
-		code: 0,
-		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
-	};
+	return verifyResult({
+		findings: mismatches,
+		ignore,
+		notes,
+		summary: `verified ${String(fixtures.length)} fixture(s) ${input.db === void 0 ? "in-process" : "in-process and against the database"}`
+	});
 }
 //#endregion
-export { indexesSql as _, graphSql as a, callsHelper as c, rowConditionMessage as d, commandFor as f, indexTargets as g, COLUMNS_SQL as h, graphPlan as i, helperCallKeys as l, tableFor$1 as m, runRlsVerify as n, HELPER_TABLES as o, compileGrants as p, closureDepths as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u, pruneIndexTargets as v, readTableIndexFacts as y };
+export { INDEX_COLUMNS_SQL as C, readTableIndexFacts as D, pruneIndexTargets as E, COLUMNS_SQL as S, indexesSql as T, helperTablePolicies as _, graphSql as a, compileGrants as b, verifyResult as c, tableNames as d, tablelessResources as f, helperCallKeys as g, callsHelper as h, graphPlan as i, resolveVias as l, ROW_CONDITION_FIX as m, runRlsVerify as n, rlsFinding as o, HELPER_TABLES as p, closureDepths as r, verifyIgnores as s, canFixture as t, tableNameOf as u, rowConditionMessage as v, indexTargets as w, tableFor$1 as x, commandFor as y };