permdock 0.6.0 → 0.8.0

package/dist/supautils-BU-pAEpf.js

@@ -0,0 +1,808 @@
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
+import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { l as policyLevels } from "./policy-CLQ8__GF.js";
+import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
+import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
+import "./budget-BELja5A9.js";
+import { l as roleColumn } from "./sources-CMAM-2A3.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
+import { b as resolveAuthorize } from "./supabase-hook-B-yXnzUl.js";
+import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DeMNEy6V.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
+import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { d as orSql, h as branchClauses } from "./fields-D0vUI6dq.js";
+import { m as tableFor } from "./verify-DZeqoWu5.js";
+//#region src/cli/rls/custom-role-rebuild.ts
+const PREFIX = "PermDock CLI";
+/** A column of the roles-table row `r`. */
+function col(name) {
+	return `r.${quoteIdent(name)}`;
+}
+function schemaOf(table) {
+	return table.includes(".") ? beforeFirst(table, ".") : "public";
+}
+/**
+* The roles-table column a reference joins on, after checking it points at
+* `roles`.
+*/
+function roleRef(role, table, roles, label) {
+	const pairs = Object.entries(role.on);
+	const [pair] = pairs;
+	if (pair === void 0 || pairs.length !== 1) throw configError(`${PREFIX}: ${label}.on must map exactly one column of ${table} to ${role.through}, for example { role_id: 'id' }`);
+	const through = role.through.includes(".") ? role.through : `${schemaOf(table)}.${role.through}`;
+	if (qualifySqlTable(through) !== qualifySqlTable(roles.table)) throw configError(`${PREFIX}: ${label}.through must be rls.customRoleWrites.roles.table (${roles.table}), got ${role.through}`);
+	if (role.column !== roles.key) throw configError(`${PREFIX}: ${label}.column must be rls.customRoleWrites.roles.key (${roles.key}), got ${role.column}`);
+	const [ref, id] = pair;
+	return {
+		ref,
+		id
+	};
+}
+/**
+* A legacy key as SQL the way `mapKey` maps it: `rls.migrate.keys`, then
+* `renamed`, then the longest `rls.migrate.prefixes` match, and a former key
+* read as its current key.
+*/
+function legacyKeySql(expr, migrate, renamed) {
+	const exact = new Map(Object.entries(renamed));
+	for (const [from, to] of Object.entries(migrate?.keys ?? {})) exact.set(from, to);
+	const prefixes = Object.entries(migrate?.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length || byCodeUnit(a, b));
+	const prefixed = prefixes.length === 0 ? expr : `(case ${prefixes.map(([from, to]) => `when left(${expr}, ${String(from.length)}) = ${quoteLiteral(from)} then ${quoteLiteral(to)} || substr(${expr}, ${String(from.length + 1)})`).join(" ")} else ${expr} end)`;
+	const mapped = exact.size === 0 ? prefixed : `(case ${expr} ${[...exact.entries()].toSorted(byKey).map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else ${prefixed} end)`;
+	const renames = Object.entries(renamed).toSorted(byKey);
+	return currentKeyExpr(renames, mapped);
+}
+function sourceSql(source, table, label) {
+	return roleColumn(source, table, "x", {
+		label,
+		prefix: PREFIX
+	}).lookup;
+}
+function rebuildPlan(ctx, from, migrate) {
+	const custom = ctx.customRoles;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || root === void 0) throw configError(`${PREFIX}: rls.customRoles.from needs custom roles on`);
+	if (ctx.authorize !== "database") throw configError(`${PREFIX}: rls.customRoles.from needs database mode; in jwt mode custom roles ride the token, so build the grants claim with customRoleClaim`);
+	const roles = custom.table;
+	if (roles === void 0) throw configError(`${PREFIX}: rls.customRoles.from needs rls.customRoleWrites.roles, the roles table each row belongs to`);
+	const leveled = custom.levels === true;
+	if (from.permissions.level !== void 0 && !leveled) throw configError(`${PREFIX}: rls.customRoles.from.permissions.level is set, but no resource declares levels`);
+	const tenantType = tenantTypeOf(ctx);
+	const rolesTable = quoteQualified(roles.table);
+	const tenant = roles.tenant === void 0 ? `null::${tenantType}` : `${col(roles.tenant)}::${tenantType}`;
+	const scope = rolesTableScope(roles, tenant, root, col);
+	const scopeId = roles.id === void 0 || roles.tenant === void 0 ? "null::text" : `case when ${tenant} is null then null else ${col(roles.id)}::text end`;
+	const skipped = roles.skip === void 0 || roles.tenant === void 0 ? "false" : `(${tenant} is not null and coalesce(${col(roles.skip)}, false))`;
+	const renamed = custom.renamed ?? {};
+	const renames = Object.entries(renamed).toSorted(byKey);
+	const current = (expr) => currentKeyExpr(renames, expr);
+	const known = sqlTextArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
+	const declared = sqlTextArray(custom.declared);
+	const scopes = sqlTextArray(ctx.scopes.map((item) => item.name));
+	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
+	const rp = qualified(ctx, "role_permissions");
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const replace = qualified(ctx, CUSTOM_ROLES.trustedReplace);
+	const p = from.permissions;
+	const pTable = qualifySqlTable(p.table);
+	const pRef = roleRef(p.role, p.table, roles, "rls.customRoles.from.permissions.role");
+	const legacy = sourceSql(p.permission, pTable, "rls.customRoles.from.permissions.permission");
+	const effect = p.effect === void 0 ? "'allow'" : `coalesce(lower(x.${quoteIdent(p.effect)}::text), 'allow')`;
+	const level = p.level === void 0 ? "null::text" : `nullif(x.${quoteIdent(p.level)}::text, '')`;
+	const inCeiling = (key) => `exists (select 1 from ${ceiling} c where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = ${key})`;
+	const hasLevels = (key) => `exists (select 1 from ${ceiling} c where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = ${key} and position('@' in c.grant_key) > 0)`;
+	const levelCheck = leveled ? `
+          when m.effect = 'allow' and m.level is not null and ${hasLevels("m.key")} and not exists (
+            select 1 from ${ceiling} c
+            where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = m.key
+              and split_part(c.grant_key, '@', 2) = m.level
+          ) then 'level ' || m.level || ' is not declared'` : "";
+	const allowEntry = leveled ? "j.key || coalesce('@' || j.level, '')" : "j.key";
+	const i = from.includes;
+	const iTable = i === void 0 ? void 0 : qualifySqlTable(i.table);
+	const iRef = i === void 0 || iTable === void 0 ? void 0 : roleRef(i.role, i.table, roles, "rls.customRoles.from.includes.role");
+	const included = i === void 0 || iTable === void 0 ? void 0 : sourceSql(i.include, iTable, "rls.customRoles.from.includes.include");
+	const refs = [`${col(pRef.id)} as permissions_ref`, ...iRef === void 0 ? [] : [`${col(iRef.id)} as includes_ref`]].join(", ");
+	const includeBlock = (rows) => i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 || rows === void 0 ? "    v_include := null;" : `    with raw as (
+      select ${included} as role
+      from ${rows}
+      where x.${quoteIdent(iRef.ref)} = v.includes_ref
+    ),
+    judged as (
+      select n.role, case
+          when n.role is null or not (n.role = any(${declared})) then 'not a declared role'
+          when exists (
+            select 1 from ${rp} rp
+            where rp.role = n.role and rp.effect = 'allow'
+              and not ${inCeiling(current("rp.permission"))}
+          ) then 'allows permissions outside the ceiling of ' || v.scope
+        end as dropped
+      from raw n
+    )
+    select array_agg(distinct j.role) filter (where j.dropped is null),
+      array_agg(v.role || ': includes ' || coalesce(j.role, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
+    into v_include, v_lost
+    from judged j;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
+	const permissionsBlock = (rows) => `    with raw as (
+      select ${legacy} as legacy, ${effect} as effect, ${level} as level
+      from ${rows}
+      where x.${quoteIdent(pRef.ref)} = v.permissions_ref
+    ),
+    mapped as (
+      select n.legacy, ${legacyKeySql("n.legacy", migrate, renamed)} as key, n.effect, n.level
+      from raw n
+    ),
+    judged as (
+      select m.legacy, m.key, m.effect, ${leveled ? `case when ${hasLevels("m.key")} then m.level end` : "m.level"} as level, case
+          when m.effect not in ('allow', 'deny') then 'effect ' || m.effect || ' is not allow or deny'
+          when m.key is null or not (m.key = any(${known})) then 'not a declared permission'
+          when m.effect = 'allow' and not ${inCeiling("m.key")} then 'outside the ceiling of ' || v.scope${levelCheck}
+        end as dropped
+      from mapped m
+    )
+    select array_agg(distinct ${allowEntry}) filter (where j.dropped is null and j.effect = 'allow'),
+      array_agg(distinct j.key) filter (where j.dropped is null and j.effect = 'deny'),
+      array_agg(v.role || ': ' || coalesce(j.legacy, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
+    into v_allow, v_deny, v_lost
+    from judged j;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
+	const legacyRows = iTable === void 0 ? void 0 : `${quoteTable(iTable)} x`;
+	const newRow = "(select new.*) x";
+	return {
+		rolesTable,
+		identity: `select ${tenant} as tenant_id, ${scope} as scope, ${scopeId} as scope_id, ${col(roles.key)}::text as role, ${refs}`,
+		eligible: `not ${skipped} and not (${col(roles.key)}::text = any(${declared}))`,
+		permsRef: pRef,
+		includesRef: iRef,
+		scopes,
+		collect: `${permissionsBlock(`${quoteTable(pTable)} x`)}
+${includeBlock(legacyRows)}`,
+		collectNew: {
+			permissions: `${permissionsBlock(newRow)}
+    v_include := null;`,
+			includes: `    v_allow := null;
+    v_deny := null;
+${includeBlock(newRow)}`
+		},
+		replace,
+		perms,
+		includes,
+		declared,
+		roles
+	};
+}
+/**
+* `v_dropped` grouped per legacy role (`role: a, b; other: c`), capped at 50
+* entries.
+*/
+const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order by g.role)
+    from (
+      select split_part(l.d, ': ', 1) as role, string_agg(substr(l.d, strpos(l.d, ': ') + 2), ', ' order by l.d) as items
+      from (select u.d from unnest(v_dropped) as u(d) order by u.d limit 50) l
+      group by 1
+    ) g)`;
+//#endregion
+//#region src/cli/rls/custom-role-sync.ts
+/**
+* `rls.customRoles.from.sync: 'trigger'`: after-row triggers on the legacy
+* permissions table, and on the includes table when mapped, rebuild each
+* affected role through `permdock_trusted_replace_custom_role_grants`, with the
+* same reads the backfill uses. An entry outside the ceiling is dropped with a
+* warning rather than aborting the legacy write, and a tenant role whose name a
+* shared role holds is skipped with a warning (`name-taken`). Before-row
+* triggers hold a signed-in caller at trigger depth 1 to the checks of
+* `permdock_replace_custom_role_grants`: `permdock_custom_role_guard` on each
+* role the row names, then `permdock_custom_role_beyond` on the entry it adds;
+* a refusal aborts the write.
+*/
+function customRoleSyncSql(ctx, from, migrate) {
+	const plan = rebuildPlan(ctx, from, migrate);
+	const shared = qualified(ctx, CUSTOM_ROLES.shared);
+	const guard = qualified(ctx, CUSTOM_ROLES.guard);
+	const beyond = qualified(ctx, CUSTOM_ROLES.beyond);
+	const keepIncludes = plan.includesRef === void 0 ? `
+    v_include := array(select c.include_role from ${plan.includes} c where c.tenant_id is not distinct from v.tenant_id and c.scope = v.scope and c.scope_id is not distinct from v.scope_id and c.role = v.role);` : "";
+	const one = (name, table, ref) => {
+		const fn = qualified(ctx, `${CUSTOM_ROLES.sync}_${name}`);
+		const target = quoteTable(qualifySqlTable(table));
+		const trigger = `${CUSTOM_ROLES.sync}_${name}`;
+		return `create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+declare
+  v record;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_lost text[];
+  v_dropped text[];
+  v_refs text[] := array[
+    case when tg_op <> 'INSERT' then old.${quoteIdent(ref.ref)}::text end,
+    case when tg_op <> 'DELETE' then new.${quoteIdent(ref.ref)}::text end
+  ];
+begin
+  for v in
+    ${plan.identity}
+    from ${plan.rolesTable} r
+    where ${plan.eligible} and r.${quoteIdent(ref.id)}::text = any(v_refs)
+  loop
+    if v.role is null or not (v.scope = 'global' or v.scope = any(${plan.scopes})) then
+      raise warning 'permdock sync: % has scope %, which is not declared', coalesce(v.role, 'null'), coalesce(v.scope, 'null');
+      continue;
+    end if;
+    if v.tenant_id is not null and ${shared}(v.scope, v.role) then
+      raise warning 'permdock sync: % is the name of a shared custom role (name-taken); the legacy write is not copied', v.role;
+      continue;
+    end if;
+    v_dropped := '{}'::text[];
+${plan.collect}${keepIncludes}
+    perform ${plan.replace}(v.tenant_id, v.scope, v.scope_id, v.role, v_allow, v_deny, v_include);
+    if cardinality(v_dropped) > 0 then
+      raise warning 'permdock sync: dropped % entr(ies) PermDock cannot hold: %', cardinality(v_dropped), ${DROPPED_LIST};
+    end if;
+  end loop;
+  return null;
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists ${quoteIdent(trigger)} on ${target};
+create trigger ${quoteIdent(trigger)}
+  after insert or update or delete on ${target}
+  for each row execute function ${fn}();`;
+	};
+	const guardOne = (name, table, ref) => {
+		const fn = qualified(ctx, `${CUSTOM_ROLES.syncGuard}_${name}`);
+		const target = quoteTable(qualifySqlTable(table));
+		const trigger = `${CUSTOM_ROLES.syncGuard}_${name}`;
+		return `create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+declare
+  v record;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_lost text[];
+  v_dropped text[];
+  v_beyond text;
+  v_refs text[] := array[
+    case when tg_op <> 'INSERT' then old.${quoteIdent(ref.ref)}::text end,
+    case when tg_op <> 'DELETE' then new.${quoteIdent(ref.ref)}::text end
+  ];
+begin
+  if not (${signedIn(ctx)} and pg_trigger_depth() = 1) then
+    return coalesce(new, old);
+  end if;
+  for v in
+    ${plan.identity}
+    from ${plan.rolesTable} r
+    where ${plan.eligible} and r.${quoteIdent(ref.id)}::text = any(v_refs)
+  loop
+    if v.role is null or not (v.scope = 'global' or v.scope = any(${plan.scopes})) then
+      continue;
+    end if;
+    if v.tenant_id is not null and ${shared}(v.scope, v.role) then
+      continue;
+    end if;
+    perform ${guard}(v.tenant_id, v.scope, v.scope_id, v.role);
+    if tg_op = 'DELETE' then
+      continue;
+    end if;
+    v_dropped := '{}'::text[];
+${plan.collectNew[name]}
+    select string_agg(b, ', ' order by b) into v_beyond
+    from ${beyond}(v.tenant_id, v.scope, v.scope_id, v_allow, v_deny, v_include) b;
+    if v_beyond is not null then
+${raiseSql("      ", "42501", `'permdock: ' || v.role || ' would allow ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
+    end if;
+  end loop;
+  return coalesce(new, old);
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists ${quoteIdent(trigger)} on ${target};
+create trigger ${quoteIdent(trigger)}
+  before insert or update or delete on ${target}
+  for each row execute function ${fn}();`;
+	};
+	const chunks = [
+		`-- rls.customRoles.from.sync: a write to the application's role tables rebuilds the role's PermDock grants`,
+		one("permissions", from.permissions.table, plan.permsRef),
+		`-- a signed-in caller writes only what the guarded replace would accept`,
+		guardOne("permissions", from.permissions.table, plan.permsRef)
+	];
+	if (from.includes !== void 0 && plan.includesRef !== void 0) chunks.push(one("includes", from.includes.table, plan.includesRef), guardOne("includes", from.includes.table, plan.includesRef));
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls/generate-context.ts
+/**
+* The scopes an `rls.migrate` `role` helper names, so `rls generate` writes
+* their role-filtered member helper.
+*/
+function roleMemberScopesOf(migrate) {
+	const scopes = [...new Set(Object.values(migrate?.helpers ?? {}).flatMap((helper) => helper.form === "role" ? [helper.scope] : []))].toSorted();
+	return scopes.length === 0 ? {} : { roleMemberScopes: scopes };
+}
+/** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
+function writeRequirement(policy, requires) {
+	if (requires === void 0) return {};
+	const leaves = listPermissions(policy.permissions);
+	const keys = requires === "manageRoles" ? leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key) : [...requires];
+	if (keys.length === 0) return { error: requires === "manageRoles" ? "rls.customRoleWrites.requires is 'manageRoles', but no permission declares meta.manageRoles" : "rls.customRoleWrites.requires names no permission" };
+	const known = new Set(leaves.map((leaf) => leaf.key));
+	const unknown = keys.filter((key) => !known.has(key));
+	if (unknown.length > 0) return { error: `rls.customRoleWrites.requires names undeclared permissions: ${unknown.join(", ")}` };
+	return { keys: [...new Set(keys)].toSorted() };
+}
+/** Declared role names, and those a tenant admin may compose into custom roles. */
+function customRoleNames(policy, requires) {
+	const declared = [...roleNames(policy)].toSorted();
+	const assignable = assignableRoles(policy);
+	const renamed = renamedKeys(policy.vocabulary.permissions);
+	const leaves = listPermissions(policy.permissions);
+	const manage = leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key);
+	return {
+		declared,
+		assignable,
+		...renamed.size === 0 ? {} : { renamed: Object.fromEntries(renamed) },
+		permissions: leaves.map((leaf) => leaf.key).toSorted(),
+		...manage.length === 0 ? {} : { manage: manage.toSorted() },
+		...requires === void 0 ? {} : { requires },
+		...policy.levels === void 0 ? {} : { levels: true }
+	};
+}
+function skippedOwnershipTriggers(triggers, scopes) {
+	if (triggers === false) return "all";
+	return Object.keys(triggers).map((key) => {
+		const name = resolveScope(scopes, key);
+		if (name === void 0) throw configError(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
+		return name;
+	});
+}
+/**
+* The SQL context every emitter reads, from the flags, `rls` config and the
+* policy.
+*/
+function buildContext(input, policy, options) {
+	const rls = input.config.rls;
+	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
+	if (input.rbac && input.dialect !== "supabase") return { refusal: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})` };
+	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
+	const authorize = resolveAuthorize(input.config, {
+		authorize: input.authorize,
+		rbac: input.rbac,
+		memberships
+	});
+	const writeTable = rls?.customRoleWrites?.roles;
+	const guard = writeTable?.tenant === void 0 ? void 0 : {
+		table: writeTable.table,
+		tenant: writeTable.tenant,
+		skip: writeTable.skip,
+		declared: [...roleNames(policy)].toSorted()
+	};
+	const memberSources = membershipSourcesOf(input.config).map((source) => guard === void 0 ? source : source.guarded?.(guard) ?? source);
+	const sources = authorize === "database" ? memberSources : void 0;
+	const scopes = scopeList(policy.scopes);
+	const suspension = checkSuspension(rls?.suspension, scopes);
+	const hookRoles = input.config.supabase?.hook?.roles;
+	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
+	if (roles !== void 0 && input.rbac) return { refusal: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag" };
+	const requires = writeRequirement(policy, rls?.customRoleWrites?.requires);
+	if (requires.error !== void 0) return { refusal: requires.error };
+	if (rls?.customRoleWrites?.audit !== void 0 && rls.customRoleWrites.roles?.primaryKey === void 0) return { refusal: "rls.customRoleWrites.audit needs rls.customRoleWrites.roles.primaryKey: only the by-id writers call it" };
+	const readers = rls?.trustedReaders;
+	if (readers !== void 0 && (!Array.isArray(readers) || !readers.every((name) => typeof name === "string" && name !== ""))) return { refusal: "rls.trustedReaders must list Postgres role names, such as ['service_role']" };
+	const ownership = ownershipRules(policy, scopes);
+	const graph = graphPlan(policy);
+	const apiKeys = apiKeysPlan(rls?.apiKeys, new Set(roleNames(policy)), Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
+	const tokenScopesSetting = rls?.tokenScopes;
+	if (tokenScopesSetting !== void 0 && typeof tokenScopesSetting !== "boolean") return { refusal: "rls.tokenScopes must be true or false" };
+	const tokenScopes = tokenScopesPlan(tokenScopesSetting, policy);
+	let vias;
+	try {
+		vias = resolveVias(rls?.tables, scopes, input.dialect);
+	} catch (cause) {
+		return { refusal: describeError(cause) };
+	}
+	const tableless = tablelessResources(rls?.tables);
+	let ctx = {
+		dialect: input.dialect,
+		scopes,
+		tenantClaim: rls?.tenantClaim ?? "tenant_id",
+		...roleMemberScopesOf(rls?.migrate),
+		...rls?.roleValues === void 0 ? {} : { roleValues: rls.roleValues },
+		...rls?.tenants === "all" ? { tenants: "all" } : {},
+		gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
+		...rls?.actions === void 0 ? {} : { actions: rls.actions },
+		...tableless.size === 0 ? {} : { tableless },
+		inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
+		schema,
+		authorize,
+		roleClaim: rls?.roleClaim ?? "user_role",
+		tenantType: input.tenantType ?? firstScopeType(rls?.scopeTypes, scopes),
+		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
+		...memberships === void 0 ? {} : { memberships },
+		...sources === void 0 || sources.length === 0 ? {} : { sources },
+		...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
+		...suspension === void 0 ? {} : { suspension },
+		...roles === void 0 ? {} : { roles },
+		...input.customRoles === true || customRolesOn(rls) ? { customRoles: {
+			...customRoleNames(policy, requires.keys),
+			...rls?.customRoleWrites?.roles === void 0 ? {} : { table: rls.customRoleWrites.roles },
+			...rls?.customRoleWrites?.audit === void 0 ? {} : { audit: rls.customRoleWrites.audit }
+		} } : {},
+		...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
+		...apiKeys === void 0 ? {} : { apiKeys },
+		...tokenScopes === void 0 ? {} : { tokenScopes },
+		...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
+		...ownership === void 0 ? {} : { ownership },
+		...rls?.seeds === void 0 ? {} : { seeds: rls.seeds },
+		...rls?.ownershipTriggers === void 0 ? {} : { skipOwnershipTriggers: skippedOwnershipTriggers(rls.ownershipTriggers, scopes) },
+		...rls?.assignments === void 0 ? {} : { assignments: rls.assignments === true ? { tables: [] } : {
+			tables: rls.assignments.tables ?? [],
+			...rls.assignments.ownRole === void 0 ? {} : { ownRole: rls.assignments.ownRole }
+		} },
+		...options.fieldsMode === void 0 ? {} : { fields: options.fieldsMode },
+		...vias === void 0 ? {} : { vias },
+		...graph.size === 0 ? {} : { graph: {
+			closures: closureDepths(graph),
+			resources: policy.resources,
+			...rls?.tables === void 0 ? {} : { tables: tableNames(rls.tables) ?? {} }
+		} }
+	};
+	const from = typeof rls?.customRoles === "object" ? rls.customRoles.from : void 0;
+	if (from?.sync === "trigger" && ctx.customRoles !== void 0) try {
+		ctx = {
+			...ctx,
+			customRoles: {
+				...ctx.customRoles,
+				sync: customRoleSyncSql(ctx, from, rls?.migrate)
+			}
+		};
+	} catch (cause) {
+		return { refusal: describeError(cause) };
+	}
+	const [unsatisfied] = unsatisfiedKinds(ctx, policy);
+	if (unsatisfied !== void 0) return { refusal: `role ${unsatisfied.role} is for ${unsatisfied.for.join(", ")}, but its membership sources hold ${unsatisfied.sources.join(", ")}: no membership can hold it; set via on a source to one of those kinds` };
+	const names = resolveNames(policy, input.config, {
+		schema,
+		gucPrefix: ctx.gucPrefix,
+		tenantClaim: ctx.tenantClaim
+	});
+	return {
+		ctx,
+		names,
+		graph,
+		ownership,
+		schema,
+		authorize
+	};
+}
+//#endregion
+//#region src/cli/rls/generate-options.ts
+function isRefusal(value) {
+	return "refusal" in value;
+}
+/** The checks that need no policy: `--fields` and `--revoke-columns`. */
+function generateOptions(input) {
+	const rls = input.config.rls;
+	const fieldsMode = input.fields ?? rls?.fields;
+	if (fieldsMode !== void 0 && fieldsMode !== "views" && fieldsMode !== "mask") return { refusal: `rls generate --fields must be views or mask (got ${fieldsMode})` };
+	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
+	if (revokeColumns && fieldsMode === void 0) return { refusal: "rls generate --revoke-columns needs --fields views or mask" };
+	return {
+		fieldsMode,
+		revokeColumns
+	};
+}
+/**
+* Whether `--split` names `part`, which then leaves the helpers or the
+* warnings.
+*/
+function splitsPart(raw, part) {
+	const split = parseSplit(raw);
+	return typeof split !== "string" && split?.includes(part) === true;
+}
+//#endregion
+//#region src/cli/rls/rows.ts
+/**
+* `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject
+* may act on with one permission.
+*/
+function rowsHelper(resource) {
+	const name = graphSqlName(resource);
+	const helper = `permitted_${name ?? resource}_rows`;
+	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
+	return helper;
+}
+/**
+* Every declared `<permission>@<level>` of an instance permission on a resource
+* with levels.
+*/
+function levelKeys(policy) {
+	const out = [];
+	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
+		if (leaf.kind !== "instance") continue;
+		for (const [level, condition] of policyLevels(policy, leaf.resource)) out.push({
+			key: `${leaf.key}@${level}`,
+			permission: leaf.key,
+			conditioned: !(condition.op === "and" && condition.conditions.length === 0),
+			rowHelper: `permitted_${graphSqlName(leaf.resource) ?? leaf.resource}_row`
+		});
+	}
+	return out;
+}
+/**
+* The branches a row check of a permission reads: its allows and denies,
+* inserts included, for signed-in callers.
+*/
+function rowBranchesOf(branches, resource) {
+	const out = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.resource !== resource || branch.coverage === true || !branch.roles.includes("authenticated")) continue;
+		out.set(branch.permissionKey, [...out.get(branch.permissionKey) ?? [], branch]);
+	}
+	return out;
+}
+/**
+* What a branch asks of a row: the `with check` of an insert, which sees the
+* new row, the `using` of every other command.
+*/
+function clauseOf(branch) {
+	const clauses = branchClauses(branch);
+	return (branch.command === "insert" ? clauses.check : clauses.using) ?? "true";
+}
+function usingOf(branches) {
+	const parts = branches.map(clauseOf);
+	return parts.length === 0 ? void 0 : orSql(parts);
+}
+function permissionCase(key, branches) {
+	const allow = usingOf(branches.filter((branch) => branch.effect === "allow"));
+	if (allow === void 0) return;
+	const deny = usingOf(branches.filter((branch) => branch.effect === "deny"));
+	const granted = `coalesce((${allow}), false)`;
+	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
+}
+function forUserSql(ctx, fn, helper) {
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const signature = `${user}, text, jsonb`;
+	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
+returns setof text
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$`;
+	const tail = `revoke execute on function ${fn}(${signature}) from public, anon, authenticated;`;
+	if (ctx.dialect === "supabase") return `${head}
+declare
+  v_claims text := pg_catalog.current_setting('request.jwt.claims', true);
+begin
+  perform pg_catalog.set_config(
+    'request.jwt.claims',
+    (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
+    true
+  );
+  return query select r.id from ${helper}(p_permission) r(id);
+  perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
+end
+$$;
+${tail}`;
+	const prefix = ctx.gucPrefix;
+	return `${head}
+declare
+  v_saved jsonb := '{}'::jsonb;
+  v_key text;
+  v_value text;
+begin
+  for v_key, v_value in
+    select 'user_id', p_user
+    union all
+    select c.key, c.value from pg_catalog.jsonb_each_text(coalesce(p_claims, '{}'::jsonb)) c where c.key <> 'user_id'
+  loop
+    v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+  return query select r.id from ${helper}(p_permission) r(id);
+  for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+end
+$$;
+${tail}`;
+}
+function inheritTargets(policy) {
+	const out = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) for (const item of flattenGrantee(grant.to)) if (item.kind === "inherit") out.add(item.resource);
+	return [...out].toSorted();
+}
+function stubSql(ctx, resource) {
+	return `create or replace function ${qualified(ctx, rowsHelper(resource))}(p_permission text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select null::text where false
+$$;`;
+}
+function rowSql(ctx, rows, table, where) {
+	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
+	return `create or replace function ${fn}(p_row ${table}, p_permission text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (select 1 from (select (p_row).*) r where ${where})
+$$;
+revoke execute on function ${fn}(${table}, text) from public, anon;
+grant execute on function ${fn}(${table}, text) to authenticated;`;
+}
+function resourceSql(ctx, node, branches, tables) {
+	const name = rowsHelper(node.name);
+	const fn = qualified(ctx, name);
+	const table = quoteQualified(tableFor(node.name, tables));
+	const cases = [...branches.keys()].toSorted().flatMap((key) => {
+		const sql = permissionCase(key, branches.get(key) ?? []);
+		return sql === void 0 ? [] : [sql];
+	});
+	const where = cases.length === 0 ? "false" : `case p_permission\n${cases.join("\n")}\n    else false\n  end`;
+	const rows = `-- ${node.name}: ids of the rows the caller may act on with p_permission, as the table's policies decide it
+create or replace function ${fn}(p_permission text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${quoteIdent(node.id)}::text from ${table}
+  where ${where}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;
+${rowSql(ctx, name, table, where)}`;
+	if (ctx.dialect === "neon") return rows;
+	return `${rows}
+-- the same rows for a user the caller names, with claims it supplies; no client role may execute it
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
+}
+/**
+* `permitted_<resource>_rows(p_permission)` for each resource `select` names
+* (or every resource a grant reaches with `true`): the ids of its rows the
+* caller may read, update or delete with that permission, from the same
+* compiled allows and denies the table policies use, so closure walks, link
+* hops, the restricted stop, `includes`, groups and `requires` all apply. A
+* `security definer` helper, so hand-written policies and functions call it
+* without restating the graph. Outside the `neon` dialect a
+* `permitted_<resource>_rows_for(p_user, p_permission, p_claims)` form runs it
+* as the named user, with the claims the caller supplies, for trusted SQL.
+*/
+function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
+	const names = select === true ? [...new Set(branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(select)];
+	const called = inheritTargets(policy);
+	for (const name of called) if (!names.includes(name)) names.push(name);
+	const chunks = called.map((name) => stubSql(ctx, name));
+	for (const name of names) {
+		const node = policy.resources.get(name);
+		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
+		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), tables));
+	}
+	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
+	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/sql/supautils.ts
+/**
+* `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils
+* 3.4.4).
+*/
+const RESERVED_ROLES = /* @__PURE__ */ new Set([
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"supabase_privileged_role",
+	"dashboard_user",
+	"pgbouncer",
+	"service_role",
+	"authenticator",
+	"authenticated",
+	"anon"
+]);
+/**
+* The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset`
+* their settings.
+*/
+const CONFIGURABLE_ROLES = /* @__PURE__ */ new Set([
+	"service_role",
+	"authenticator",
+	"authenticated",
+	"anon"
+]);
+/** `supautils.reserved_memberships` of the same image. */
+const RESERVED_MEMBERSHIPS = /* @__PURE__ */ new Set([
+	"pg_read_server_files",
+	"pg_write_server_files",
+	"pg_execute_server_program",
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"dashboard_user",
+	"pgbouncer",
+	"authenticator"
+]);
+const ROLE = String.raw`(?:"[^"]+"|\w+)`;
+const ROLES = String.raw`${ROLE}(?:\s*,\s*${ROLE})*`;
+const ALTER_ROLE = new RegExp(String.raw`^alter\s+(role|user|group)\s+(${ROLE})\s+([\s\S]*)$`, "iu");
+const DROP_ROLE = new RegExp(String.raw`^drop\s+(?:role|user|group)\s+(?:if\s+exists\s+)?(${ROLES})\s*$`, "iu");
+const GRANT_ROLE = /^grant\s+([\s\S]+?)\s+to\s/iu;
+const CREATE_IN_ROLE = new RegExp(String.raw`^create\s+(?:role|user|group)\s+${ROLE}\b[\s\S]*?\bin\s+(?:role|group)\s+(${ROLES})`, "iu");
+const CONFIG_CHANGE = /^(?:in\s+database\s+\S+\s+)?(?:set|reset)\s/iu;
+function roleName(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+function roleList(list) {
+	return list.split(",").map((name) => roleName(name.trim()));
+}
+function rejection(text) {
+	const alter = ALTER_ROLE.exec(text);
+	if (alter !== null) {
+		const role = roleName(group(alter, 2));
+		const rest = group(alter, 3);
+		if (group(alter, 1).toLowerCase() === "group" && /^add\s/iu.test(rest)) return RESERVED_MEMBERSHIPS.has(role) ? `grants membership in the reserved role ${role}` : void 0;
+		if (!RESERVED_ROLES.has(role) || CONFIGURABLE_ROLES.has(role) && CONFIG_CHANGE.test(rest)) return;
+		return `changes the reserved role ${role}`;
+	}
+	const drop = DROP_ROLE.exec(text);
+	if (drop !== null) {
+		const role = roleList(group(drop, 1)).find((name) => RESERVED_ROLES.has(name));
+		return role === void 0 ? void 0 : `drops the reserved role ${role}`;
+	}
+	const grant = GRANT_ROLE.exec(text);
+	const granted = CREATE_IN_ROLE.exec(text)?.[1] ?? (grant === null || /\bon\b/iu.test(group(grant, 1)) ? void 0 : group(grant, 1));
+	if (granted === void 0) return;
+	const role = roleList(granted).find((name) => RESERVED_MEMBERSHIPS.has(name));
+	return role === void 0 ? void 0 : `grants membership in the reserved role ${role}`;
+}
+/**
+* The statements of `sql` that supautils rejects for a non-superuser: changing
+* or dropping a reserved role, other than `set` or `reset` on the four API
+* roles, and granting a reserved membership.
+*/
+function supautilsRejections(sql) {
+	return sqlStatements(sql).flatMap(({ line, text }) => {
+		const reason = rejection(text);
+		return reason === void 0 ? [] : [{
+			line,
+			reason
+		}];
+	});
+}
+//#endregion
+export { generateOptions as a, buildContext as c, rowHelpersSql as i, DROPPED_LIST as l, inheritTargets as n, isRefusal as o, levelKeys as r, splitsPart as s, supautilsRejections as t, rebuildPlan as u };