permdock 0.6.0 → 0.8.0

package/dist/{verify-BaAKx7t6.js → verify-DZeqoWu5.js}

@@ -1,43 +1,46 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
-import { a as hasConditionOp, c as isConditionRef } from "./refs-K6eWUJ0H.js";
-import { E as memoryCustomRoleSource, g as memoryRelationSource } from "./src-Cu2m75uo.js";
-import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { f as nowMillis, u as isoAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { d as scopeList } from "./scopes-CUPSjo9q.js";
-import { o as requiresStandIn } from "./delegation-j6-rc37o.js";
-import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { p as scopeField } from "./tenancy-DN2QAx9z.js";
-import { s as policyLevels } from "./policy-DbM5YYtV.js";
+import { l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { A as memoryCustomRoleSource, b as memoryRelationSource } from "./src-DZ0l9UAg.js";
+import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { f as nowMillis, u as isoAt } from "./time-nR1JesoH.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { f as scopeList, l as rootScope, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
+import { o as requiresStandIn } from "./delegation-CDB6_keF.js";
+import { p as scopeField } from "./tenancy-5d1zVBvK.js";
+import { l as policyLevels, t as coveredLevels } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-CNClBvcj.js";
-import { t as getPermDock } from "./permdock-BrAscV28.js";
-import { a as describeError, i as configError, u as usageResult } from "./errors-CWTY6uih.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
-import { o as loadPolicyAt } from "./load-DFS_ry0W.js";
-import { c as relationArmSql, u as restrictedRowsSql } from "./compile-CMqMx_IN.js";
-import "./budget-NbEtbJC_.js";
-import { i as qualifySqlTable, n as defaultSqlCommand } from "./sql-B5T1IL83.js";
-import "./sources-vs5dGOsS.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-Dd8Ta0Ie.js";
+import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
+import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
+import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
+import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
+import "./budget-BELja5A9.js";
+import "./sources-CMAM-2A3.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
-import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as helperSchema, r as HELPERS, v as subjectClaimSql, w as arrayColumnsOf } from "./shared-BAK8t4Uo.js";
-import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-DP2nqRoF.js";
-import { $ as activeUserSql, A as collectGrants, F as CLOSURE, I as graphHelper, L as graphSqlName, M as compileConditionSql, N as contextRefs, O as breakGlassHolder, P as sqlFunctionNames, R as graphSqlText, T as apiKeyAllowsCall, V as linkHelper, Y as restrictedHelper, Z as scopeTable, _ as capabilityAccessSql, k as breakGlassKey, m as accessSql, p as requiresSql } from "./ownership-DqaJNJPn.js";
-import { s as viewName, t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
+import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
+import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-Afctg7B0.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DeMNEy6V.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-B4L59T9u.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
+import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts
 /** Postgres truncates identifiers longer than this, in bytes. */
 const MAX_IDENT = 63;
 /**
-* The row fields `condition` compares with the subject, a claim or a
-* membership (`ownerId: principal.id`, `memberOf`), through `and` and `or`:
-* the selective comparisons an index serves. A comparison with a constant
-* (`status: 'sent'`) narrows rows the scope key already found, a negation
-* scans anyway, and a dotted field is a JSON path a plain index does not serve.
+* The row fields `condition` compares with the subject, a claim or a membership
+* (`ownerId: principal.id`, `memberOf`), through `and` and `or`: the selective
+* comparisons an index serves. A comparison with a constant (`status: 'sent'`)
+* narrows rows the scope key already found, a negation scans anyway, and a
+* dotted field is a JSON path a plain index does not serve.
 */
 function indexedFields(condition) {
 	if (condition === void 0) return [];
@@ -67,9 +70,9 @@ function plainField(field) {
 	return field.includes(".") ? [] : [field];
 }
 /**
-* Every index the generated SQL reads through: the row columns policies
-* filter on (scope keys and selective condition fields), and the membership
-* tables' user column, followed by the scope column the helpers select.
+* Every index the generated SQL reads through: the row columns policies filter
+* on (scope keys and selective condition fields), and the membership tables'
+* user column, followed by the scope column the helpers select.
 */
 function indexTargets(ctx, rowColumns) {
 	const targets = /* @__PURE__ */ new Map();
@@ -102,7 +105,10 @@ function indexName(target) {
 function indexesSql(targets) {
 	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
 }
-/** Every live column of the tables in `$1` (`schema.table`), as `target` and `name`. */
+/**
+* Every live column of the tables in `$1` (`schema.table`), as `target` and
+* `name`.
+*/
 const COLUMNS_SQL = `select n.nspname || '.' || c.relname as target, a.attname as name
 from pg_attribute a
 join pg_class c on c.oid = a.attrelid
@@ -187,25 +193,30 @@ function levelReachOf(policy, keys) {
 		const { item } = entry;
 		const { grant } = item;
 		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || grant.level !== void 0) continue;
-		const levels = policyLevels(policy, grant.permission.resource);
+		const resource = grant.permission.resource;
+		const levels = policyLevels(policy, resource);
 		if (levels.length > 0) {
 			const set = reach.get(grantKey) ?? /* @__PURE__ */ new Set();
-			for (const name of reachedLevels(grant.where, levels)) set.add(name);
+			const reached = coveredLevels(policy, resource, reachedLevels(grant.where, levels));
+			for (const name of reached) set.add(name);
 			reach.set(grantKey, set);
 		}
 	}
+	const resourceOf = new Map([...keys].map(([entry, grantKey]) => [grantKey, entry.item.grant.permission.resource]));
 	const out = [];
 	for (const grantKey of new Set(keys.values())) {
 		const at = grantKey.lastIndexOf("@");
 		const base = at === -1 ? grantKey : grantKey.slice(0, at);
 		const level = at === -1 ? void 0 : grantKey.slice(at + 1);
-		for (const name of reach.get(base) ?? []) if (level === void 0 || level === name) out.push([grantKey, name]);
+		const covered = level === void 0 ? void 0 : coveredLevels(policy, resourceOf.get(grantKey) ?? "", [level]);
+		for (const name of reach.get(base) ?? []) if (covered === void 0 || covered.includes(name)) out.push([grantKey, name]);
 	}
 	return out.toSorted(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
 }
 /**
-* The SQL command `action` compiles to: `rls.actions` first, then the six default verbs.
-* Any other verb is `undefined`, as `'none'` is: no policy, and its grants are still seeded.
+* The SQL command `action` compiles to: `rls.actions` first, then the six
+* default verbs. Any other verb is `undefined`, as `'none'` is: no policy, and
+* its grants are still seeded.
 */
 function commandFor(action, actions) {
 	if (actions !== void 0 && Object.hasOwn(actions, action)) {
@@ -214,7 +225,7 @@ function commandFor(action, actions) {
 	}
 	return defaultSqlCommand(action);
 }
-function tableFor$1(resource, tables) {
+function tableFor(resource, tables) {
 	return tables?.[resource] ?? resource;
 }
 function ancestorsOf(policy, name) {
@@ -262,8 +273,8 @@ function resourceCondition(item, policy, ctx) {
 }
 /**
 * The access a link capability has to a resource-scoped grant, over the same
-* holders as `resourceCondition`. It reads the claim, so ancestor hops need
-* no memberships table. `undefined` when no holder is on the row's chain.
+* holders as `resourceCondition`. It reads the claim, so ancestor hops need no
+* memberships table. `undefined` when no holder is on the row's chain.
 */
 function capabilityAccess(item, policy, ctx) {
 	if (item.access.kind !== "resource") return;
@@ -279,7 +290,7 @@ function capabilityAccess(item, policy, ctx) {
 	if (hops.length === 0) return;
 	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
 }
-function prepare(item, tables, warnings, skipClosures, actions, rowActions = false) {
+function prepare(item, tables, warnings, skipClosures, sql, rowActions = false) {
 	const { grant, label } = item;
 	if (grant.breakGlass !== void 0) {
 		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
@@ -304,9 +315,14 @@ function prepare(item, tables, warnings, skipClosures, actions, rowActions = fal
 		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
 		return;
 	}
-	const command = commandFor(grant.permission.action, actions);
-	const table = tableFor$1(grant.permission.resource, tables);
+	const tableless = sql.tableless?.has(grant.permission.resource) === true;
+	const command = tableless ? void 0 : commandFor(grant.permission.action, sql.actions);
+	const table = tableFor(grant.permission.resource, tables);
 	if (command === void 0) {
+		if (tableless && item.access.kind !== "role") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: rls.tables.${grant.permission.resource} is false, so the resource has no table, and only role grants are seeded`);
+			return;
+		}
 		if (item.access.kind !== "role" && rowActions) return {
 			item,
 			command: "none",
@@ -350,9 +366,9 @@ function signature(entry, byFields) {
 /**
 * Grant keys per permission: the key is the permission, split into
 * `permission#n` when role grants carry different portable conditions (or
-* effects), one key per condition group; a group whose grants set `group`
-* is `permission#<group>` instead. With field views, grants that differ
-* only in `fields` get their own keys too, so a view can tell them apart.
+* effects), one key per condition group; a group whose grants set `group` is
+* `permission#<group>` instead. With field views, grants that differ only in
+* `fields` get their own keys too, so a view can tell them apart.
 */
 function assignKeys(entries, byFields) {
 	const groups = /* @__PURE__ */ new Map();
@@ -372,7 +388,7 @@ function assignKeys(entries, byFields) {
 			const group = groupOf(permission, list);
 			if (group !== void 0 && named.has(group)) throw configError(`PermDock CLI: grants of ${permission} with different conditions share group '${group}'; a group names one condition`);
 			if (group !== void 0) named.add(group);
-			const grantKey = group !== void 0 ? `${permission}#${group}` : lists.length === 1 ? permission : `${permission}#${index + 1}`;
+			const grantKey = group === void 0 ? lists.length === 1 ? permission : `${permission}#${index + 1}` : `${permission}#${group}`;
 			for (const entry of list) keys.set(entry, grantKey);
 		}
 	}
@@ -384,19 +400,19 @@ function groupOf(permission, list) {
 	return names[0];
 }
 /**
-* One entry per level for every allow of an assignable role on a resource
-* with levels, keyed `<grant key>@<level>`. Only `permdock_custom_keys`
-* hands these keys out, to a custom role whose stored allow names the level.
+* One entry per level for every allow of a role on a resource with levels,
+* keyed `<grant key>@<level>`, whether or not the role is assignable: every
+* role holds the same leveled keys, and `permdock_ceiling` keeps only the
+* assignable roles'. Only `permdock_custom_keys` hands these keys out, to a
+* custom role whose stored allow names the level.
 */
 function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
-	const custom = ctx.customRoles;
-	if (custom?.levels !== true) return [];
-	const assignable = new Set(custom.assignable);
+	if (ctx.customRoles?.levels !== true) return [];
 	const out = [];
 	for (const [entry, grantKey] of Array.from(keys)) {
 		const { item } = entry;
 		const { grant } = item;
-		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || !assignable.has(item.access.role)) continue;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance") continue;
 		if (grant.permission.key.includes("@")) throw configError(`PermDock CLI: permission key '${grant.permission.key}' holds '@', which separates a level in custom-role grant keys`);
 		for (const [level, condition] of policyLevels(policy, grant.permission.resource)) {
 			const where = andWhere(item.where, condition);
@@ -404,7 +420,7 @@ function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
 				...item,
 				grant: leveled(grant, level, condition),
 				...where === void 0 ? {} : { where }
-			}, tables, warnings, skipClosures, ctx.actions);
+			}, tables, warnings, skipClosures, ctx);
 			if (prepared !== void 0) {
 				keys.set(prepared, `${grantKey}@${level}`);
 				out.push(prepared);
@@ -423,19 +439,22 @@ function noteConditions(entry, warnings) {
 	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
 }
 /**
-* Compiles every grant (role and top-level) to branches whose role check is
-* a helper call keyed by grant key. Nothing in a branch is per-row except the
+* Compiles every grant (role and top-level) to branches whose role check is a
+* helper call keyed by grant key. Nothing in a branch is per-row except the
 * portable row condition and resource-membership joins.
 */
-/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
+/**
+* A Supabase token from a permanent user: anonymous sign-ins carry
+* `is_anonymous: true`.
+*/
 const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
 function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
 	const items = collectGrants(policy);
 	const entries = items.flatMap((item) => {
-		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions, rowActions);
+		const entry = prepare(item, tables, warnings, skipClosures, ctx, rowActions);
 		return entry === void 0 ? [] : [entry];
 	});
-	const keys = assignKeys(entries, ctx.fields === "views");
+	const keys = assignKeys(entries, ctx.fields !== void 0);
 	entries.push(...levelEntries(policy, ctx, keys, tables, warnings, skipClosures));
 	const conditionedKeys = /* @__PURE__ */ new Set();
 	for (const [entry, grantKey] of keys) if (entry.using !== void 0 || entry.check !== void 0 || entry.item.grant.validity !== void 0 || entry.item.grant.requires !== void 0) conditionedKeys.add(grantKey);
@@ -492,7 +511,7 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 				};
 				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
 			}
-			if (!rowActions) continue;
+			if (!rowActions || ctx.tableless?.has(grant.permission.resource) === true) continue;
 		}
 		const actionOnly = entry.command === "none";
 		const command = actionOnly ? "select" : entry.command;
@@ -506,8 +525,10 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 		const grantKey = keys.get(entry);
 		let accessExpr;
 		if (access.kind === "role" && grantKey !== void 0) {
-			const column = access.scope === "global" ? void 0 : scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
-			accessExpr = accessSql(ctx, access.scope, grantKey, column);
+			const via = ctx.vias?.[grant.permission.resource];
+			if (via !== void 0 && access.scope !== "global" && access.scope !== via.scope) throw configError(`PermDock CLI: ${label}/${grant.permission.key} is granted at scope ${access.scope}, but rls.tables.${grant.permission.resource}.via reaches ${via.scope}; map the scope with via.scope or grant at ${via.scope}`);
+			const column = access.scope === "global" ? void 0 : via?.key ?? scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
+			accessExpr = accessSql(ctx, access.scope, grantKey, column, access.scope === "global" ? void 0 : via?.helper);
 			if (column !== void 0) filters(grant.permission.resource, table, column);
 			const row = {
 				role: access.role,
@@ -529,8 +550,10 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 		accessExpr = andSql(accessExpr, validity);
 		for (const key of grant.requires ?? []) accessExpr = andSql(accessExpr, requiresSql(ctx, key, policy.resources.get(grant.permission.resource)));
 		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
-		if (ctx.apiKeys !== void 0 && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
-			const calls = (requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []]).map((key) => `(select ${apiKeyAllowsCall(ctx, quoteLiteral(key))})`);
+		if ((ctx.apiKeys !== void 0 || ctx.tokenScopes !== void 0) && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
+			const covered = requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []];
+			const ceilings = [...ctx.apiKeys === void 0 ? [] : [apiKeyAllowsCall], ...ctx.tokenScopes === void 0 ? [] : [tokenScopeAllowsCall]];
+			const calls = covered.flatMap((key) => ceilings.map((call) => `(select ${call(ctx, quoteLiteral(key))})`));
 			accessExpr = andSql(accessExpr, calls.length === 1 ? calls[0] ?? "" : `(${calls.join(" and ")})`);
 		}
 		const using = compileOptional(entry.using, rowCtx);
@@ -576,8 +599,8 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 }
 /**
 * Each row again under every key its permission was renamed from, so SQL that
-* still calls `permdock_has('<old key>')` keeps the access the current key
-* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
+* still calls `permdock_has('<old key>')` keeps the access the current key has.
+* A split grant key (`key#n`) keeps its suffix; break-glass rows are not
 * copied.
 */
 function withAliasRows(policy, rows) {
@@ -596,8 +619,8 @@ function withAliasRows(policy, rows) {
 }
 /**
 * Postgres needs SELECT access to find rows for UPDATE / DELETE and for
-* RETURNING, so a table with only update or delete grants gets matching
-* SELECT branches.
+* RETURNING, so a table with only update or delete grants gets matching SELECT
+* branches.
 */
 function ensureSelectCoverage(branches, warnings) {
 	const extra = [];
@@ -627,18 +650,21 @@ function ensureSelectCoverage(branches, warnings) {
 const HELPER_TABLES = ["storage.objects", "realtime.messages"];
 const HELPER_CALL = new RegExp(String.raw`\b(${HELPERS.has}(?:_permission)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?)\s*\(\s*'((?:[^']|'')+)'(\s*,\s*(false\b)?)?`, "giu");
 const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}(?:_permission)?(?:_for)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?(?:_for)?|member_[a-z][a-z0-9_]*_ids(?:_for)?)\s*\(`, "iu");
-/** Whether a policy expression calls any generated helper, the key-less `member_<scope>_ids` included. */
+/**
+* Whether a policy expression calls any generated helper, the key-less
+* `member_<scope>_ids` included.
+*/
 function callsHelper(sql) {
 	return ANY_HELPER.test(sql);
 }
 /**
 * The permission keys a policy expression passes to `permdock_has`,
 * `permitted_<scope>_ids` or their permission-key forms, `#n` stripped. With
-* `blind`, only the calls that ignore row conditions: the grant-key forms,
-* and a permission-key form asked for conditioned allows. A plain
+* `blind`, only the calls that ignore row conditions: the grant-key forms, and
+* a permission-key form asked for conditioned allows. A plain
 * `permdock_has_permission(key)` or `permitted_<scope>_ids_by_permission(key)`
-* counts only allows without a row condition, so it never grants more than
-* the application does.
+* counts only allows without a row condition, so it never grants more than the
+* application does.
 */
 function helperCallKeys(sql, blind = false) {
 	const keys = /* @__PURE__ */ new Set();
@@ -658,7 +684,10 @@ function helperTable(name) {
 	const table = tableName(name);
 	return HELPER_TABLES.find((candidate) => candidate === table);
 }
-/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their condition-blind helper calls pass. */
+/**
+* `create policy` statements on {@link HELPER_TABLES} in migration SQL, with
+* the keys their condition-blind helper calls pass.
+*/
 function helperTablePolicies(sql) {
 	const text = sql.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
 	const found = [];
@@ -673,19 +702,25 @@ function helperTablePolicies(sql) {
 	}
 	return found;
 }
-/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db-url-stdin`. */
+/**
+* `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify
+* --db-url-stdin`.
+*/
 const HELPER_TABLE_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, coalesce(qual, '') || ' ' || coalesce(with_check, '') as body
 from pg_policies
 where (schemaname, tablename) in (('storage', 'objects'), ('realtime', 'messages'))`;
+function textOf(value) {
+	return typeof value === "string" ? value : "";
+}
 /** The same rows as {@link helperTablePolicies}, from `pg_policies`. */
 function helperTablePoliciesFromRows(rows) {
 	const found = [];
 	for (const row of rows) {
-		const table = helperTable(String(row["target"] ?? ""));
-		const keys = helperCallKeys(String(row["body"] ?? ""), true);
+		const table = helperTable(textOf(row["target"]));
+		const keys = helperCallKeys(textOf(row["body"]), true);
 		if (table !== void 0 && keys.length > 0) found.push({
 			table,
-			name: String(row["policyname"] ?? ""),
+			name: textOf(row["policyname"]),
 			keys
 		});
 	}
@@ -697,8 +732,196 @@ function rowConditionMessage(policy, keys) {
 }
 const ROW_CONDITION_FIX = "call permitted_<scope>_ids_by_permission('<key>') or permdock_has_permission('<key>'), which count only the allows without a row condition (a relationship grant never reaches a topic or a folder), or use a permission whose catalog entry has rowConditions: false";
 //#endregion
+//#region src/cli/rls/verify-findings.ts
+const VERIFY_DOCS = `${DOCS_BASE}/rls#verify`;
+function rlsFinding(code, table, key, message, severity = "error") {
+	return {
+		code,
+		table,
+		key,
+		message,
+		severity
+	};
+}
+/** `<code>:<table>:<key>`: what `--ignore` and `rls.verify.ignore` name. */
+function findingId(finding) {
+	return `${finding.code}:${finding.table}:${finding.key}`;
+}
+/** `rls.verify.ignore`, checked, then one entry per `--ignore` id. */
+function verifyIgnores(config, flags = []) {
+	const entries = config.rls?.verify?.ignore ?? [];
+	if (!Array.isArray(entries)) throw configError("PermDock CLI: rls.verify.ignore must be a list of { id, reason }");
+	const out = [];
+	for (const [index, entry] of entries.entries()) {
+		if (!isRecord(entry) || typeof entry["id"] !== "string" || entry["id"] === "" || typeof entry["reason"] !== "string" || entry["reason"].trim() === "") throw configError(`PermDock CLI: rls.verify.ignore[${String(index)}] needs an id and a non-empty reason`);
+		out.push({
+			id: entry["id"],
+			reason: entry["reason"]
+		});
+	}
+	for (const id of flags) out.push({
+		id,
+		reason: "--ignore"
+	});
+	return out;
+}
+/**
+* Splits `findings` by `ignores`; an id listed twice counts once, with its
+* first reason.
+*/
+function applyIgnores(findings, ignores) {
+	const reasons = /* @__PURE__ */ new Map();
+	for (const entry of ignores) if (!reasons.has(entry.id)) reasons.set(entry.id, entry.reason);
+	const matched = /* @__PURE__ */ new Set();
+	const kept = [];
+	const ignored = [];
+	for (const finding of findings) {
+		const id = findingId(finding);
+		const reason = reasons.get(id);
+		if (reason === void 0) kept.push({
+			...finding,
+			id
+		});
+		else {
+			matched.add(id);
+			ignored.push({
+				id,
+				reason,
+				message: finding.message
+			});
+		}
+	}
+	return {
+		findings: kept,
+		ignored,
+		stale: [...reasons].filter(([id]) => !matched.has(id)).map(([id, reason]) => ({
+			id,
+			reason
+		}))
+	};
+}
+function prefixOf(severity) {
+	switch (severity) {
+		case "error": return "";
+		case "warning": return "warning: ";
+		case "info": return "info: ";
+		default: return severity;
+	}
+}
+/**
+* The `rls verify` result: exit 1 when an error finding is left after the
+* ignores. Text lines carry each finding's id; `--json` data is `{ findings,
+* ignored, stale }`; `--format github|sarif` renders `findings`.
+*/
+function verifyResult(input) {
+	const report = applyIgnores(input.findings, input.ignore);
+	const failed = report.findings.some((item) => item.severity === "error");
+	const lines = [
+		...report.findings.map((item) => `${prefixOf(item.severity)}${item.message} [${item.id}]`),
+		...report.ignored.map((item) => `ignored ${item.id}: ${item.reason}`),
+		...report.stale.map((item) => `warning: ignore entry ${item.id} matches no finding; remove it from rls.verify.ignore`),
+		...failed ? [] : [input.summary],
+		...input.notes ?? []
+	];
+	return {
+		code: failed ? 1 : 0,
+		output: lines.join("\n"),
+		data: report,
+		findings: [...report.findings.map((item) => ({
+			code: item.code,
+			id: item.id,
+			severity: item.severity,
+			message: item.message,
+			docs: VERIFY_DOCS
+		})), ...report.stale.map((item) => ({
+			code: "ignore-stale",
+			id: `ignore-stale:${item.id}`,
+			severity: "warning",
+			message: `ignore entry ${item.id} matches no finding`,
+			fix: "remove it from rls.verify.ignore",
+			docs: VERIFY_DOCS
+		}))]
+	};
+}
+//#endregion
+//#region src/cli/rls/verify-pgtap-memberships.ts
+function insert(table, columns) {
+	return `insert into ${quoteTable(table)} (${columns.map(([name]) => quoteIdent(name)).join(", ")}) values (${columns.map(([, value]) => quoteLiteral(value)).join(", ")}) on conflict do nothing;`;
+}
+/**
+* The rows of a table mapped by `rls.memberships`: one per role, for a plain
+* role column.
+*/
+function mappedRows(config, scopes, user, membership) {
+	const { scope, id } = membership;
+	if (scope === void 0 || id === void 0) return [];
+	const table = scopeMembershipTable(config.rls?.memberships, scopes, scope);
+	const idColumn = table === void 0 ? void 0 : scopeColumn(table, scopes, scope);
+	const roleColumn = table?.role;
+	if (table === void 0 || idColumn === void 0 || typeof roleColumn !== "string") return [];
+	const rootName = rootScope(scopes);
+	const tenantColumn = rootName === void 0 || rootName === scope ? void 0 : scopeColumn(table, scopes, rootName);
+	const tenant = rootName === void 0 ? void 0 : membership.within?.[rootName];
+	const extra = [];
+	for (const [name, value] of Object.entries(membership.within ?? {})) {
+		const column = scopeColumn(table, scopes, name);
+		if (column !== void 0 && name !== scope) extra.push([column, value]);
+	}
+	if (tenantColumn !== void 0 && tenant !== void 0 && !extra.some(([column]) => column === tenantColumn)) extra.push([tenantColumn, tenant]);
+	return membership.roles.map((role) => insert(table.table, [
+		[table.user, user],
+		[idColumn, id],
+		...extra,
+		[roleColumn, role]
+	]));
+}
+/**
+* The rows of a `membershipSources` source: only a source whose columns are
+* plain, never a `through` or `map`.
+*/
+function sourceRows(source, scopes, user, membership) {
+	const { scope, id } = membership;
+	if (scope === void 0 || id === void 0) return [];
+	const names = new Set(scopes.map((entry) => entry.name));
+	if ("through" in source.user || !names.has(scope) || "value" in source.scope && source.scope.value !== scope) return [];
+	const role = source.role;
+	const roleColumns = Array.isArray(role) || !("column" in role) || "through" in role ? void 0 : "map" in role ? void 0 : role.column;
+	const fixed = "value" in source.scope ? [] : [[source.scope.column, scope]];
+	const within = source.within;
+	const ancestors = within === void 0 || !("columns" in within) ? [] : Object.entries(within.columns).flatMap(([name, column]) => {
+		const value = membership.within?.[name];
+		return value === void 0 ? [] : [[column, value]];
+	});
+	const base = [
+		[source.user.column, user],
+		[source.id.column, id],
+		...fixed,
+		...ancestors
+	];
+	if (roleColumns === void 0) return [];
+	return membership.roles.map((value) => insert(source.table, [...base, [roleColumns, value]]));
+}
+/**
+* The statements that put a fixture's memberships into the configured
+* membership tables and sources, so the helpers of `authorize: 'database'` find
+* them. A membership no plain table or source can hold (a `through` or mapped
+* role column, an `on` membership) is listed in a comment.
+*/
+function fixtureMembershipSql(config, scopes, fixture, sources) {
+	const lines = [];
+	for (const membership of normalizeMemberships(fixture.subject.memberships ?? [], scopes)) {
+		const rows = [...mappedRows(config, scopes, fixture.subject.id, membership), ...sources.flatMap((source) => sourceRows(source, scopes, fixture.subject.id, membership))];
+		if (rows.length === 0) lines.push(`-- no membership table holds ${membership.scope ?? "on"} ${membership.id ?? ""}: not seeded`);
+		lines.push(...rows);
+	}
+	return lines;
+}
+//#endregion
 //#region src/cli/rls/verify-pgtap.ts
-/** A custom role's scope and pinned instance, as the `custom_role_*` tables store them. */
+/**
+* A custom role's scope and pinned instance, as the `custom_role_*` tables
+* store them.
+*/
 function customRoleAt(role, scopes) {
 	return {
 		scope: customRoleScope(role, scopes),
@@ -751,7 +974,10 @@ function statementFor(fixture, action, table) {
 function rowId(row) {
 	if (isRecord(row) && "id" in row) return row["id"];
 }
-/** A fixture value as a SQL literal; untyped, so it coerces to the column like a bound parameter. */
+/**
+* A fixture value as a SQL literal; untyped, so it coerces to the column like a
+* bound parameter.
+*/
 function sqlValue(value) {
 	if (value === null || value === void 0) return "null";
 	return quoteLiteral(typeof value === "string" ? value : JSON.stringify(value));
@@ -784,12 +1010,24 @@ function subjectOf(config, customRoles, scopes) {
 		scopes
 	};
 }
-/** The settings that bind a fixture's subject: the GUCs, or the Supabase JWT claims. */
+/**
+* The settings that bind a fixture's subject: the GUCs, or the Supabase JWT
+* claims.
+*/
 function subjectSettings(fixture, subject) {
 	const roles = fixture.subject.roles ?? [];
 	const memberships = membershipsClaim(fixture.subject.memberships ?? [], subject.customRoles, subject.scopes);
 	if (subject.dialect === "guc") {
+		const fixed = /* @__PURE__ */ new Set([
+			"user_id",
+			"sub",
+			"role",
+			"memberships",
+			subject.roleClaim,
+			subject.tenantClaim
+		]);
 		const settings = [
+			...Object.entries(fixture.subject.claims ?? {}).flatMap(([name, value]) => fixed.has(name) || !SQL_IDENT.test(name) ? [] : [[`${subject.gucPrefix}.${name}`, typeof value === "string" ? value : JSON.stringify(value)]]),
 			[`${subject.gucPrefix}.user_id`, fixture.subject.id],
 			[`${subject.gucPrefix}.${subject.roleClaim}`, roles.join(",")],
 			[`${subject.gucPrefix}.memberships`, JSON.stringify(memberships)]
@@ -807,7 +1045,10 @@ function subjectSettings(fixture, subject) {
 	};
 	return [["request.jwt.claims", JSON.stringify(claims)]];
 }
-/** The `custom_role_*` rows for the fixtures' custom roles; existing rows are kept. */
+/**
+* The `custom_role_*` rows for the fixtures' custom roles; existing rows are
+* kept.
+*/
 function customRoleRows(schema, customRoles, scopes) {
 	const table = (name) => `${quoteIdent(schema)}.${quoteIdent(name)}`;
 	const rows = [];
@@ -839,16 +1080,19 @@ function customRoleRows(schema, customRoles, scopes) {
 	}
 	return rows;
 }
-function seedsCustomRoleTables(config) {
+function databaseMode(config) {
 	const rls = config.rls;
-	return customRolesOn(rls) && (rls?.authorize ?? rls?.rbac?.authorize ?? "jwt") === "database";
+	return (rls?.authorize ?? rls?.rbac?.authorize ?? "jwt") === "database";
+}
+function seedsCustomRoleTables(config) {
+	return customRolesOn(config.rls) && databaseMode(config);
 }
 function customRoleSchema(config) {
 	return config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
 }
 /**
-* A pgTAP script that runs each fixture's statement under the fixture's
-* subject and asserts the outcome `can()` gave in-process.
+* A pgTAP script that runs each fixture's statement under the fixture's subject
+* and asserts the outcome `can()` gave in-process.
 */
 function emitPgtap(input) {
 	const scopes = scopeList(input.policy.scopes);
@@ -859,6 +1103,7 @@ function emitPgtap(input) {
 		PGTAP_DECISION_SQL
 	];
 	if (seedsCustomRoleTables(input.config)) for (const row of customRoleRows(customRoleSchema(input.config), input.customRoles, scopes)) lines.push(`${inlineStatement(row)};`);
+	const sources = membershipSourcesOf(input.config).map((source) => source.sql.manifest);
 	for (const [index, fixture] of input.fixtures.entries()) {
 		const permission = findPermission(input.policy.permissions, fixture.action);
 		const status = input.inProcess[index];
@@ -868,359 +1113,19 @@ function emitPgtap(input) {
 			lines.push(`select skip(${quoteLiteral(`${label}: opaque grant untestable app-side`)}, 1);`);
 			continue;
 		}
+		if (input.config.rls?.tables?.[permission.resource] === false) {
+			lines.push(`select skip(${quoteLiteral(`${label}: rls.tables.${permission.resource} is false, so there is no table`)}, 1);`);
+			continue;
+		}
 		const outcome = status.granted ? "granted" : "denied";
-		const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
+		const table = tableNameOf(input.config.rls?.tables?.[permission.resource], permission.resource);
 		const statement = inlineStatement(statementFor(fixture, permission.action, table));
-		lines.push(`-- ${label}`, "savepoint permdock_fixture;", "set local role \"authenticated\";", ...subjectSettings(fixture, subject).map(([name, value]) => `select set_config(${quoteLiteral(name)}, ${quoteLiteral(value)}, true);`), `select is(${PGTAP_DECISION}(${quoteLiteral(statement)}), ${quoteLiteral(outcome)}, ${quoteLiteral(`${label} ${outcome}`)});`, "rollback to savepoint permdock_fixture;");
+		lines.push(`-- ${label}`, "savepoint permdock_fixture;", ...databaseMode(input.config) ? fixtureMembershipSql(input.config, scopes, fixture, sources) : [], "set local role \"authenticated\";", ...subjectSettings(fixture, subject).map(([name, value]) => `select set_config(${quoteLiteral(name)}, ${quoteLiteral(value)}, true);`), `select is(${PGTAP_DECISION}(${quoteLiteral(statement)}), ${quoteLiteral(outcome)}, ${quoteLiteral(`${label} ${outcome}`)});`, "rollback to savepoint permdock_fixture;");
 	}
 	lines.push("select * from finish();", "rollback;");
 	return `${lines.join("\n")}\n`;
 }
 //#endregion
-//#region src/cli/rls/graph.ts
-function tableFor(resource, tables) {
-	return tables?.[resource] ?? resource;
-}
-/** Every `related` condition the policy's grants compile to, with the resource graph they need, groups included. */
-function graphPlan(policy) {
-	const scopes = scopeList(policy.scopes);
-	const plan = /* @__PURE__ */ new Map();
-	const entryFor = (node) => {
-		const entry = plan.get(node.name) ?? {
-			node,
-			relations: /* @__PURE__ */ new Set(),
-			links: /* @__PURE__ */ new Set()
-		};
-		plan.set(node.name, entry);
-		return entry;
-	};
-	const addRelation = (node, relation) => {
-		const entry = entryFor(node);
-		if (entry.relations.has(relation)) return;
-		entry.relations.add(relation);
-		for (const name of expandRelation(node, relation)) {
-			const spec = node.relations[name];
-			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
-			for (const { resource, relation: groupRelation } of groupEntries(spec)) {
-				const target = policy.resources.get(resource);
-				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
-			}
-		}
-	};
-	const addLinks = (hops) => {
-		for (let index = 1; index < hops.length; index += 1) {
-			const from = policy.resources.get(hops[index - 1]?.resource ?? "");
-			const hop = hops[index];
-			if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
-		}
-	};
-	const addAbove = (above) => {
-		const node = above === void 0 ? void 0 : policy.resources.get(above.resource);
-		if (above === void 0 || node === void 0) return;
-		const entry = entryFor(node);
-		entry.closure = Math.max(entry.closure ?? 0, above.depth);
-		entry.restrictedAncestors = above;
-	};
-	for (const grant of policy.grants) {
-		const row = policy.resources.get(grant.permission.resource);
-		for (const item of flattenGrantee(grant.to)) {
-			if (item.kind === "inherit") {
-				const inherited = inheritCondition(item, row, policy.resources);
-				addLinks(inherited?.hops ?? []);
-				addAbove(inherited?.restrictedAncestors);
-				continue;
-			}
-			if (item.kind !== "relation") continue;
-			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
-			if (condition?.op !== "related") continue;
-			const node = policy.resources.get(condition.resource);
-			if (node === void 0) continue;
-			addRelation(node, condition.relation);
-			const entry = entryFor(node);
-			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
-			addLinks(condition.hops ?? []);
-			addAbove(condition.restrictedAncestors);
-		}
-	}
-	return plan;
-}
-/** The closure depth per walked resource, as `RlsSqlContext.graph` carries it. */
-function closureDepths(plan) {
-	const out = {};
-	for (const [name, entry] of plan) if (entry.closure !== void 0) out[name] = entry.closure;
-	return out;
-}
-/**
-* The `permitted_<resource>_ids(relation)` arm for one concrete relation:
-* ids of `resource` the subject holds it on, directly or through a group.
-* `asked` are the relation names that include it, so a call for any of them
-* (or for all, with null) reads this arm.
-*/
-function relationArm(ctx, plan, node, relation, asked, tables) {
-	const spec = node.relations[relation];
-	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw configError(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
-	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
-	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
-		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
-		...tables === void 0 ? {} : { tables },
-		qualify: qualifySqlTable,
-		holders: (resource, groupRelation) => [{ text: `select ${qualified(ctx, graphHelper(resource))}(${quoteLiteral(groupRelation)})` }]
-	}), ctx)}) a\n  where ${guard}${activeUserSql(ctx).map((part) => ` and ${part}`).join("")}`;
-}
-function permittedSql(ctx, plan, entry, tables) {
-	const fn = qualified(ctx, graphHelper(entry.node.name));
-	const asked = [...entry.relations].toSorted();
-	const arms = [...new Set(asked.flatMap((name) => expandRelation(entry.node, name)))].toSorted().map((relation) => relationArm(ctx, plan, entry.node, relation, asked.filter((name) => expandRelation(entry.node, name).includes(relation)), tables));
-	if (arms.length === 0) arms.push("  select null::text where false");
-	return `-- ${entry.node.name}: ids the subject holds a relation on (all relations when p_relation is null)
-create or replace function ${fn}(p_relation text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-${arms.join("\n  union\n")}
-$$;
-revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;`;
-}
-/** `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points into `ids`, read past the table's own policies. */
-function linkSql(ctx, node, link, tables) {
-	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
-	if (spec === void 0) throw configError(`PermDock CLI: ${node.name} has no link '${link}'`);
-	const fn = qualified(ctx, linkHelper(node.name, link));
-	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
-create or replace function ${fn}(p_ids text[])
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select t.${quoteIdent(node.id)}::text from ${quoteQualified(tableFor(node.name, tables))} t
-  where t.${quoteIdent(spec.field)}::text = any(p_ids)
-$$;
-revoke execute on function ${fn}(text[]) from public, anon;
-grant execute on function ${fn}(text[]) to authenticated;`;
-}
-function closureTableSql(ctx) {
-	const table = qualified(ctx, CLOSURE.table);
-	return `-- the object graph: one row per (ancestor, descendant) within each walked resource's depth,
--- never crossing a restricted row; kept current by statement triggers on each self-parented table
-create table if not exists ${table} (
-  resource text not null,
-  ancestor text not null,
-  descendant text not null,
-  depth integer not null check (depth >= 0),
-  primary key (resource, descendant, ancestor)
-);
-create index if not exists ${quoteIdent(`${CLOSURE.table}_ancestor`)} on ${table} (resource, ancestor);
-alter table ${table} enable row level security;
-revoke all on table ${table} from anon, authenticated, public;
-grant select on table ${table} to authenticated;`;
-}
-function closureObjectsSql(ctx, entry, depth, tables) {
-	const { node } = entry;
-	const parent = node.parent;
-	if (parent === void 0) return "";
-	const name = node.name;
-	const sqlName = graphSqlName(name) ?? name;
-	const closure = qualified(ctx, CLOSURE.table);
-	const table = quoteQualified(tableFor(name, tables));
-	const id = quoteIdent(node.id);
-	const up = quoteIdent(parent.field);
-	const restricted = restrictedFor(node, "parent");
-	const stop = restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(restricted)}, false)`;
-	const stopParent = restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(restricted)}, false)`;
-	const refresh = qualified(ctx, `${CLOSURE.table}_${sqlName}`);
-	const changed = qualified(ctx, `${CLOSURE.table}_${sqlName}_changed`);
-	const literal = quoteLiteral(name);
-	const restrictedChanged = restricted === void 0 ? "" : ` or n.${quoteIdent(restricted)} is distinct from o.${quoteIdent(restricted)}`;
-	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${sqlName}_${suffix}`);
-	return `-- ${name}: ${restricted === void 0 ? `rows reach their ancestors up to depth ${String(depth)}` : `rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row`}
-drop policy if exists ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure};
-create policy ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure}
-  for select to authenticated
-  using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
-create or replace function ${refresh}(p_ids text[])
-returns void
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_cycle text;
-  v_affected text[];
-begin
-  with recursive walk(start, next, path) as (
-    select t.${id}, t.${up}, array[t.${id}::text]
-    from ${table} t
-    where t.${id}::text = any(p_ids)
-    union all
-    select walk.start, t.${up}, walk.path || t.${id}::text
-    from walk join ${table} t on t.${id} = walk.next
-    where not (walk.next::text = any(walk.path))
-  )
-  select walk.start::text into v_cycle
-  from walk
-  where walk.next::text = any(walk.path)
-  limit 1;
-  if v_cycle is not null then
-    raise exception 'permdock: % % is its own ancestor', ${literal}, v_cycle
-      using errcode = 'check_violation';
-  end if;
-  with recursive down(id, level) as (
-    select t.${id}, 0
-    from ${table} t
-    where t.${id}::text = any(p_ids) or t.${up}::text = any(p_ids)
-    union
-    select t.${id}, down.level + 1
-    from down join ${table} t on t.${up} = down.id
-    where down.level < ${String(depth)}
-  )
-  select coalesce(array_agg(distinct down.id::text), '{}') into v_affected from down;
-  delete from ${closure} c
-  where c.resource = ${literal}
-    and (c.descendant = any(p_ids) or c.descendant = any(v_affected));
-  insert into ${closure} (resource, ancestor, descendant, depth)
-  with recursive walk(descendant, ancestor, parent, depth, stop) as (
-    select t.${id}::text, t.${id}, t.${up}, 0, ${stop}
-    from ${table} t
-    where t.${id}::text = any(v_affected)
-    union all
-    select walk.descendant, p.${id}, p.${up}, walk.depth + 1, ${stopParent}
-    from walk join ${table} p on p.${id} = walk.parent
-    where not walk.stop and walk.depth < ${String(depth)}
-  )
-  select ${literal}, walk.ancestor::text, walk.descendant, walk.depth from walk
-  on conflict do nothing;
-end
-$$;
-revoke execute on function ${refresh}(text[]) from public, anon, authenticated;
-create or replace function ${changed}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-begin
-  if tg_op = 'TRUNCATE' then
-    delete from ${closure} where resource = ${literal};
-  elsif tg_op = 'INSERT' then
-    perform ${refresh}(array(select n.${id}::text from new_rows n));
-  elsif tg_op = 'DELETE' then
-    perform ${refresh}(array(select o.${id}::text from old_rows o));
-  else
-    perform ${refresh}(array(
-      select n.${id}::text
-      from new_rows n left join old_rows o on o.${id} = n.${id}
-      where o.${id} is null or n.${up} is distinct from o.${up}${restrictedChanged}
-      union
-      select o.${id}::text
-      from old_rows o left join new_rows n on n.${id} = o.${id}
-      where n.${id} is null
-    ));
-  end if;
-  return null;
-end
-$$;
-revoke execute on function ${changed}() from public, anon, authenticated;
-drop trigger if exists ${trigger("insert")} on ${table};
-create trigger ${trigger("insert")} after insert on ${table}
-  referencing new table as new_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("update")} on ${table};
-create trigger ${trigger("update")} after update on ${table}
-  referencing old table as old_rows new table as new_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("delete")} on ${table};
-create trigger ${trigger("delete")} after delete on ${table}
-  referencing old table as old_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("truncate")} on ${table};
-create trigger ${trigger("truncate")} after truncate on ${table}
-  for each statement execute function ${changed}();
-select ${refresh}(array(select t.${id}::text from ${table} t));`;
-}
-function restrictedRowsHelperSql(ctx, plan, entry, tables) {
-	const above = entry.restrictedAncestors;
-	if (above === void 0) return "";
-	const fn = qualified(ctx, restrictedHelper(entry.node.name));
-	const body = graphSqlText(restrictedRowsSql(above, {
-		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
-		...tables === void 0 ? {} : { tables },
-		qualify: qualifySqlTable,
-		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
-		closureDepths: closureDepths(plan)
-	}), ctx);
-	return `-- ${entry.node.name}: rows a stopped link does not reach below: restricted, under a restricted row within ${String(above.depth - 1)} levels, or deeper
-create or replace function ${fn}()
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  ${body}
-$$;
-revoke execute on function ${fn}() from public, anon;
-grant execute on function ${fn}() to authenticated;`;
-}
-/** Group resources a resource's asked relations name, other than itself. */
-function groupTargets(entry) {
-	const out = /* @__PURE__ */ new Set();
-	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
-		const spec = entry.node.relations[name];
-		const resources = isEdgeRelation(spec) ? groupEntries(spec).map((group) => group.resource) : [];
-		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
-	}
-	return [...out].toSorted();
-}
-/** Plan entries by name, each after the group resources its helper calls (SQL function bodies are checked on create). */
-function dependencyOrder(plan) {
-	const out = [];
-	const done = /* @__PURE__ */ new Set();
-	const visit = (name) => {
-		const entry = plan.get(name);
-		if (entry === void 0 || done.has(name)) return;
-		done.add(name);
-		for (const target of groupTargets(entry)) visit(target);
-		out.push(entry);
-	};
-	for (const name of [...plan.keys()].toSorted()) visit(name);
-	return out;
-}
-/**
-* The graph preamble: `permitted_<resource>_ids` for every resource a graph
-* grant reads, and the closure table with its triggers for every
-* self-parented resource a grant walks. Empty when no grant is a graph grant.
-*/
-function graphSql(ctx, plan, tables) {
-	if (plan.size === 0) return "";
-	const sqlNames = /* @__PURE__ */ new Map();
-	for (const name of plan.keys()) {
-		const helper = graphHelper(name);
-		const sql = graphSqlName(name) ?? name;
-		if (ctx.scopes.some((scope) => scope.name === sql)) throw configError(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
-		const other = sqlNames.get(sql);
-		if (other !== void 0) throw configError(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
-		sqlNames.set(sql, name);
-	}
-	const entries = dependencyOrder(plan);
-	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 && entry.closure === void 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
-	const walked = entries.filter((entry) => entry.closure !== void 0);
-	if (walked.length > 0) {
-		chunks.push(closureTableSql(ctx));
-		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
-		for (const entry of walked) {
-			const helper = restrictedRowsHelperSql(ctx, plan, entry, tables);
-			if (helper !== "") chunks.push(helper);
-		}
-	}
-	return `${chunks.join("\n\n")}\n`;
-}
-//#endregion
 //#region src/cli/rls/verify-tree.ts
 const SYSTEM_ENTROPY = Object.freeze({
 	now: () => nowMillis(),
@@ -1236,9 +1141,9 @@ function idFactory(node, entropy) {
 	} : () => entropy.randomUUID();
 }
 /**
-* Two spines one level deeper than the walk depth, so the depth cap is
-* crossed; side branches under the first levels alternate restricted, and
-* the second spine is restricted two levels down.
+* Two spines one level deeper than the walk depth, so the depth cap is crossed;
+* side branches under the first levels alternate restricted, and the second
+* spine is restricted two levels down.
 */
 function generateTree(node, depth, entropy) {
 	const id = idFactory(node, entropy);
@@ -1359,9 +1264,9 @@ function asRequiredColumn(row) {
 	};
 }
 /**
-* Values for the required columns a generated row leaves out, such as a
-* tenant column or a name: an existing value of the referenced table for a
-* foreign key, a placeholder of the column's type otherwise.
+* Values for the required columns a generated row leaves out, such as a tenant
+* column or a name: an existing value of the referenced table for a foreign
+* key, a placeholder of the column's type otherwise.
 */
 async function requiredValues(query, table, set, entropy) {
 	const columns = (await query(REQUIRED_COLUMNS_SQL, [table])).rows.map(asRequiredColumn).filter((column) => column !== void 0 && !set.has(column.name));
@@ -1391,15 +1296,15 @@ async function seedRows(query, table, rows, given, entropy) {
 }
 /**
 * Parity between `decide` and RLS on a generated object graph: for every
-* self-parented resource a graph grant walks, a tree with restricted
-* branches and a chain past the walk depth, child rows under it, and edges
-* for a few generated principals. Everything runs in one transaction that
-* is rolled back.
+* self-parented resource a graph grant walks, a tree with restricted branches
+* and a chain past the walk depth, child rows under it, and edges for a few
+* generated principals. Everything runs in one transaction that is rolled
+* back.
 */
 async function verifyTree(input) {
 	const { policy, query } = input;
 	const entropy = input.entropy ?? SYSTEM_ENTROPY;
-	const tables = input.config.rls?.tables;
+	const tables = tableNames(input.config.rls?.tables);
 	const treeValues = input.config.rls?.treeValues ?? {};
 	const seed = (table, list) => seedRows(query, table, list, treeValues[table] ?? {}, entropy);
 	const walked = [...graphPlan(policy).values()].filter((entry) => entry.closure !== void 0);
@@ -1506,7 +1411,7 @@ async function verifyTree(input) {
 				checked += 1;
 				const id = String(row[node.id]);
 				const allowed = permdock.can(permission, row);
-				if (allowed !== seen.has(id)) mismatches.push(`${permission.key} ${id}: in-process ${allowed ? "granted" : "denied"}, database ${seen.has(id) ? "allowed" : "filtered"}`);
+				if (allowed !== seen.has(id)) mismatches.push(rlsFinding("tree-mismatch", node.name, permission.key, `${permission.key} ${id}: in-process ${allowed ? "granted" : "denied"}, database ${seen.has(id) ? "allowed" : "filtered"}`));
 				else if (allowed) granted += 1;
 			}
 		}
@@ -1520,6 +1425,10 @@ async function verifyTree(input) {
 }
 //#endregion
 //#region src/cli/rls/verify-database.ts
+/** A fixture's part of a finding id: its subject and row. */
+function fixtureKey(fixture) {
+	return `${fixture.subject.id}/${String(rowId(fixture.row))}`;
+}
 /** Columns of `row` that hold a value; a masked column reads as null. */
 function valuedColumns(row) {
 	return isRecord(row) ? Object.keys(row).filter((name) => row[name] !== null && row[name] !== void 0).toSorted() : [];
@@ -1536,10 +1445,14 @@ function expectedFields(granted, picked, key, row) {
 }
 function fieldsMismatch(fixture, want, seen) {
 	const kept = want.join(", ");
-	if (typeof seen === "string") return [`${fixture.action}: field view read failed (${seen}), pick keeps [${kept}]`];
-	return seen.join(", ") === kept ? [] : [`${fixture.action} ${String(rowId(fixture.row))}: field view returns [${seen.join(", ")}], pick keeps [${kept}]`];
+	const mismatch = (message) => rlsFinding("field-mismatch", fixture.action, fixtureKey(fixture), message);
+	if (typeof seen === "string") return [mismatch(`${fixture.action}: field view read failed (${seen}), pick keeps [${kept}]`)];
+	return seen.join(", ") === kept ? [] : [mismatch(`${fixture.action} ${String(rowId(fixture.row))}: field view returns [${seen.join(", ")}], pick keeps [${kept}]`)];
 }
-/** The field view's columns for the fixture's row: the view, or the table itself when no grant limits its fields. */
+/**
+* The field view's columns for the fixture's row: the view, or the table itself
+* when no grant limits its fields.
+*/
 async function viewFields(query, table, key) {
 	const view = quoteTable(viewName(table, FIELD_VIEWS.view));
 	const id = quoteIdent("id");
@@ -1551,7 +1464,10 @@ async function viewFields(query, table, key) {
 	const base = await query(`select * from ${quoteTable(table)} where ${id} = $1`, [key]);
 	return base.code ?? valuedColumns(base.rows[0]);
 }
-/** Writes the custom roles into the `database`-mode tables; the fixture transaction rolls them back. */
+/**
+* Writes the custom roles into the `database`-mode tables; the fixture
+* transaction rolls them back.
+*/
 async function seedCustomRoles(query, schema, customRoles, scopes) {
 	for (const row of customRoleRows(schema, customRoles, scopes)) {
 		const result = await query(row.sql, row.values);
@@ -1590,7 +1506,7 @@ async function verifyAgainstDatabase(input) {
 		const conditioned = policyRowConditionKeys(input.policy);
 		for (const found of helperTablePoliciesFromRows((await query(HELPER_TABLE_POLICIES_SQL)).rows)) {
 			const keys = found.keys.filter((key) => conditioned.has(key));
-			if (keys.length > 0) mismatches.push(`PD037 ${rowConditionMessage(found, keys)}`);
+			if (keys.length > 0) mismatches.push(rlsFinding("condition-blind", found.table, found.name, `PD037 ${rowConditionMessage(found, keys)}`));
 		}
 		for (const [index, fixture] of input.fixtures.entries()) {
 			const permission = findPermission(input.policy.permissions, fixture.action);
@@ -1600,7 +1516,11 @@ async function verifyAgainstDatabase(input) {
 				notes.push(`${fixture.action}: opaque grant untestable app-side`);
 				continue;
 			}
-			const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
+			if (input.config.rls?.tables?.[permission.resource] === false) {
+				notes.push(`${fixture.action}: rls.tables.${permission.resource} is false, so there is no table`);
+				continue;
+			}
+			const table = tableNameOf(input.config.rls?.tables?.[permission.resource], permission.resource);
 			await query("begin");
 			try {
 				if (seedsTables) await seedCustomRoles(query, schema, input.customRoles, scopes);
@@ -1609,7 +1529,7 @@ async function verifyAgainstDatabase(input) {
 				const result = await query(statement.sql, statement.values);
 				const count = result.rowCount ?? result.rows.length;
 				const database = result.code === "42501" ? "rejected" : count > 0 ? "allowed" : "filtered";
-				if (!(status.granted ? database === "allowed" : database === "filtered" || database === "rejected")) mismatches.push(`${fixture.action}: in-process ${status.granted ? "granted" : "denied"}, database ${database}`);
+				if (!(status.granted ? database === "allowed" : database === "filtered" || database === "rejected")) mismatches.push(rlsFinding("parity-mismatch", fixture.action, fixtureKey(fixture), `${fixture.action}: in-process ${status.granted ? "granted" : "denied"}, database ${database}`));
 				else if (status.kind === "sqlFunction") notes.push(`${fixture.action}: verified through twin`);
 				mismatches.push(...status.fields === void 0 ? [] : fieldsMismatch(fixture, status.fields, await viewFields(query, table, rowId(fixture.row))));
 			} finally {
@@ -1624,8 +1544,11 @@ async function verifyAgainstDatabase(input) {
 		notes
 	};
 }
-/** `--tree`: seeds a generated object graph in a rolled-back transaction and compares `can()` with RLS. */
-async function verifyTreeAgainstDatabase(db, policy, config, connect) {
+/**
+* `--tree`: seeds a generated object graph in a rolled-back transaction and
+* compares `can()` with RLS.
+*/
+async function verifyTreeAgainstDatabase(db, policy, config, connect, ignore) {
 	const client = await connect(db);
 	const scopes = scopeList(policy.scopes);
 	const query = async (sql, values) => {
@@ -1647,15 +1570,12 @@ async function verifyTreeAgainstDatabase(db, policy, config, connect) {
 				action: "read"
 			}, subjectOf(config, [], scopes))
 		});
-		if (result.mismatches.length > 0) return {
-			code: 1,
-			output: [...result.mismatches, ...result.notes].join("\n")
-		};
-		const verified = `verified ${String(result.checked)} tree check(s) against the database (${String(result.granted)} granted)`;
-		return {
-			code: 0,
-			output: result.notes.length === 0 ? verified : `${verified}\n${result.notes.join("\n")}`
-		};
+		return verifyResult({
+			findings: result.mismatches,
+			ignore,
+			notes: result.notes,
+			summary: `verified ${String(result.checked)} tree check(s) against the database (${String(result.granted)} granted)`
+		});
 	} catch (cause) {
 		return {
 			code: 2,
@@ -1668,6 +1588,8 @@ async function verifyTreeAgainstDatabase(db, policy, config, connect) {
 }
 //#endregion
 //#region src/cli/rls/verify.ts
+/** Where `rls verify --kind pgtap` writes, the folder `supabase test db` reads. */
+const PGTAP_OUT = "supabase/tests/permdock_rls.test.sql";
 function canFixture(permdock, permission, row) {
 	if (permission.kind === "collection") return permdock.can(permission, row);
 	return permdock.can(permission, row);
@@ -1679,6 +1601,11 @@ function grantKind(policy, key) {
 	return "portable";
 }
 async function runRlsVerify(input) {
+	const ignore = input.ignore ?? [];
+	if (input.out !== void 0 && input.format !== "pgtap") return {
+		code: 2,
+		output: "PermDock CLI: rls verify --out needs --kind pgtap"
+	};
 	const connect = input.connect ?? pgConnector("permdock rls verify --db-url-stdin", input.cwd);
 	const policyPath = input.from ?? input.config.policy;
 	if (policyPath === void 0) return {
@@ -1692,7 +1619,7 @@ async function runRlsVerify(input) {
 			output: "PermDock CLI: rls verify --tree needs a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 		};
 		try {
-			return await verifyTreeAgainstDatabase(input.db, policy, input.config, connect);
+			return await verifyTreeAgainstDatabase(input.db, policy, input.config, connect, ignore);
 		} catch (cause) {
 			return usageResult(cause);
 		}
@@ -1702,11 +1629,11 @@ async function runRlsVerify(input) {
 	const mismatches = [];
 	const notes = [];
 	const inProcess = [];
-	const fieldsMode = input.config.rls?.fields === "views";
+	const fieldsMode = input.config.rls?.fields !== void 0;
 	for (const fixture of fixtures) {
 		const permission = findPermission(policy.permissions, fixture.action);
 		if (permission === void 0) {
-			mismatches.push(`${fixture.action}: unknown permission`);
+			mismatches.push(rlsFinding("unknown-permission", fixture.action, fixtureKey(fixture), `${fixture.action}: unknown permission`));
 			inProcess.push({
 				action: fixture.action,
 				granted: false,
@@ -1718,7 +1645,7 @@ async function runRlsVerify(input) {
 		const permdock = await getPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) });
 		const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
 		const outcome = granted ? "granted" : "denied";
-		if (fixture.expected !== void 0 && fixture.expected !== outcome) mismatches.push(`${fixture.action}: in-process ${outcome}, expected ${fixture.expected}`);
+		if (fixture.expected !== void 0 && fixture.expected !== outcome) mismatches.push(rlsFinding("expected-mismatch", fixture.action, fixtureKey(fixture), `${fixture.action}: in-process ${outcome}, expected ${fixture.expected}`));
 		if (kind === "opaque") notes.push(`${fixture.action}: opaque grant untestable app-side`);
 		const fields = fieldsMode && permission.kind === "instance" && commandFor(permission.action, input.config.rls?.actions) === "select" ? expectedFields(granted, permdock.pick(permission, fixture.row), policy.resources.get(permission.resource)?.id ?? "id", fixture.row) : void 0;
 		inProcess.push({
@@ -1728,19 +1655,23 @@ async function runRlsVerify(input) {
 			...fields === void 0 ? {} : { fields }
 		});
 	}
-	if (input.format === "pgtap") return mismatches.length > 0 ? {
-		code: 1,
-		output: mismatches.join("\n")
-	} : {
-		code: 0,
-		output: emitPgtap({
+	if (input.format === "pgtap") {
+		const outRel = input.out ?? PGTAP_OUT;
+		const result = verifyResult({
+			findings: mismatches,
+			ignore,
+			summary: `wrote ${outRel}`
+		});
+		if (result.code !== 0) return result;
+		writeFileEnsuringDir(resolve(input.cwd, outRel), emitPgtap({
 			fixtures,
 			inProcess,
 			policy,
 			config: input.config,
 			customRoles
-		})
-	};
+		}));
+		return result;
+	}
 	if (input.db !== void 0) try {
 		const database = await verifyAgainstDatabase({
 			db: input.db,
@@ -1756,15 +1687,12 @@ async function runRlsVerify(input) {
 	} catch (cause) {
 		return usageResult(cause);
 	}
-	if (mismatches.length > 0) return {
-		code: 1,
-		output: [...mismatches, ...notes].join("\n")
-	};
-	const verified = `verified ${String(fixtures.length)} fixture(s) ${input.db === void 0 ? "in-process" : "in-process and against the database"}`;
-	return {
-		code: 0,
-		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
-	};
+	return verifyResult({
+		findings: mismatches,
+		ignore,
+		notes,
+		summary: `verified ${String(fixtures.length)} fixture(s) ${input.db === void 0 ? "in-process" : "in-process and against the database"}`
+	});
 }
 //#endregion
-export { indexesSql as _, graphSql as a, callsHelper as c, rowConditionMessage as d, commandFor as f, indexTargets as g, COLUMNS_SQL as h, graphPlan as i, helperCallKeys as l, tableFor$1 as m, runRlsVerify as n, HELPER_TABLES as o, compileGrants as p, closureDepths as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u, pruneIndexTargets as v, readTableIndexFacts as y };
+export { indexTargets as _, verifyResult as a, readTableIndexFacts as b, callsHelper as c, rowConditionMessage as d, commandFor as f, INDEX_COLUMNS_SQL as g, COLUMNS_SQL as h, verifyIgnores as i, helperCallKeys as l, tableFor as m, runRlsVerify as n, HELPER_TABLES as o, compileGrants as p, rlsFinding as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u, indexesSql as v, pruneIndexTargets as y };