permdock 0.7.0 → 0.8.0

package/dist/{rls-CxBZb4rZ.js → rls-CNEH2_BG.js}

@@ -1,29 +1,32 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { c as listPermissions, u as renamedKeys } from "./permission-registry-DpPtSKNZ.js";
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { p as scopeField } from "./tenancy-CmeBQ6Nv.js";
-import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-DpP_U6Bf.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { o as sqlFiles } from "./files-D_JIzUrP.js";
-import { c as requirePolicy } from "./load-DxroEzH1.js";
-import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-B96movIM.js";
-import "./sources-B-zYB4GS.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-DFWYkNdu.js";
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { p as scopeField } from "./tenancy-5d1zVBvK.js";
+import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
+import { o as sqlFiles } from "./files-BSjrtIHw.js";
+import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
+import "./sources-CMAM-2A3.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-CJgOm6aq.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-C6joDI3o.js";
-import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-12Q5I_RH.js";
-import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
-import { t as fetchProjectPolicy } from "./pull-CN5OLxrF.js";
+import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
+import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
+import { t as fetchProjectPolicy } from "./pull-CwpGaQSi.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-CCMdcFWb.js";
-import { b as rbacScaffold, c as approvalsSql, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as permissionHoldersSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-Dg0SrQWR.js";
-import { A as quoteQualified, D as qualified$1, F as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-fMKOv8hP.js";
-import { D as byKey, F as collectGrants, H as graphHelper, N as breakGlassHolder, P as breakGlassKey, Z as memberIdsHelper, _ as seedSql, a as assignmentSql, d as permissionHelpersSql, et as permittedIdsHelper, g as helpersSql, h as accessSql, n as ownershipSql, nt as scopeSources, p as permittedByPermissionHelper, rt as scopeTable } from "./ownership-Z2LpxsGa.js";
-import { a as splitUndiffed } from "./deciding-columns-DRo2QM6E.js";
-import { a as readOnlyActorKinds, d as connectPgPool, n as actorMayWriteSql, o as readOnlyActorPolicies, r as assemblePolicies, t as ACTOR_MAY_WRITE } from "./policies-B2lZIurj.js";
-import { C as INDEX_COLUMNS_SQL, D as readTableIndexFacts, E as pruneIndexTargets, S as COLUMNS_SQL, T as indexesSql, a as graphSql, b as compileGrants, c as verifyResult, d as tableNames, g as helperCallKeys, h as callsHelper, n as runRlsVerify, o as rlsFinding, p as HELPER_TABLES, s as verifyIgnores, w as indexTargets, x as tableFor } from "./verify-pe8rL_Qw.js";
-import { a as fieldViewsSql, i as fieldViews, n as columnGrantSql, o as rowBranches, r as columnRevokeSql } from "./fields-ClcQLrVc.js";
-import { a as generateOptions, c as buildContext, i as rowHelpersSql, l as DROPPED_LIST, n as inheritTargets, o as isRefusal, r as levelKeys, s as splitsPart, t as supautilsRejections, u as rebuildPlan } from "./supautils-MESd81bF.js";
+import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
+import { d as schemasRefusal, f as declarativeSql, l as isSupabaseSchemas, o as supabaseHookSql, s as approvalsSql, t as grantsLabel, u as resolveSchemas, v as parseRbacAuthorize, y as rbacScaffold } from "./supabase-hook-B-yXnzUl.js";
+import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-Afctg7B0.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DeMNEy6V.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-B4L59T9u.js";
+import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
+import { t as connectPgPool } from "./pg-DQTqRrou.js";
+import { n as permissionHoldersSql } from "./resolve-names-CF7xXLSG.js";
+import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-D0vUI6dq.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DZeqoWu5.js";
+import { a as generateOptions, c as buildContext, i as rowHelpersSql, l as DROPPED_LIST, n as inheritTargets, o as isRefusal, r as levelKeys, s as splitsPart, t as supautilsRejections, u as rebuildPlan } from "./supautils-BU-pAEpf.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -136,7 +139,7 @@ async function runRlsAdvisors(input) {
 		const message = [text(error, "message"), text(error, "suggestion")].filter((part) => part !== "").join(" ");
 		return {
 			code: 2,
-			output: `supabase db advisors failed: ${message === "" ? result.stderr.trim() || `exit ${String(result.status)}` : message}`
+			output: `supabase db advisors failed: ${message === "" ? nonEmptyOr(result.stderr.trim(), `exit ${String(result.status)}`) : message}`
 		};
 	}
 	const failing = findings.filter((finding) => finding.level === "WARN" || finding.level === "ERROR");
@@ -161,8 +164,8 @@ async function runRlsAdvisors(input) {
 //#endregion
 //#region src/cli/rls/bindings.ts
 /**
-* The table each resource with row policies binds to. With `helpersOnly`,
-* a resource `rls.tables` does not name has no table and no binding.
+* The table each resource with row policies binds to. With `helpersOnly`, a
+* resource `rls.tables` does not name has no table and no binding.
 */
 function tableBindings(resources, tables, helpersOnly) {
 	const out = [];
@@ -177,16 +180,19 @@ function tableBindings(resources, tables, helpersOnly) {
 	}
 	return out;
 }
-/** The generate notes for `bindings`: the inferred ones, and where to see them all. */
+/**
+* The generate notes for `bindings`: the inferred ones, and where to see them
+* all.
+*/
 function bindingNotes(bindings, withDatabase) {
 	const inferred = bindings.filter((binding) => binding.inferred);
 	if (inferred.length === 0) return [];
 	return [`table bindings (no rls.tables entry, so the table is named after the resource): ${inferred.map((binding) => `${binding.resource} -> ${binding.table}`).join(", ")}${withDatabase ? "" : "; run permdock rls explain, or generate with --db-url-stdin, to check each table exists"}`];
 }
 /**
-* The generate notes for the bindings whose table no project SQL file
-* creates. A project with no `create table` in those files gets none: its
-* schema lives elsewhere (an ORM, another repository).
+* The generate notes for the bindings whose table no project SQL file creates.
+* A project with no `create table` in those files gets none: its schema lives
+* elsewhere (an ORM, another repository).
 */
 function unknownTableNotes(bindings, created) {
 	if (created.size === 0) return [];
@@ -205,6 +211,7 @@ function unquote(name) {
 function reasonOf(name) {
 	if (name === "permdock_custom_role_name_guard") return "customRoleWrites.roles: a tenant role cannot take a declared or shared role's name";
 	if (name === "permdock_custom_role_cascade") return "customRoleWrites.roles: a rename or delete of a role carries its grants";
+	if (name.startsWith("permdock_sync_custom_role_guard")) return "customRoles.from.sync: a signed-in caller writes only entries they may hand out";
 	if (name.startsWith("permdock_sync_custom_role")) return "customRoles.from.sync: each write to the legacy table rebuilds the role's grants";
 	if (name.startsWith("permdock_holders") || name.startsWith("permdock_transfer_only")) return "ownershipTriggers; set rls.ownershipTriggers.<scope>: false to skip";
 	if (name === "permdock_assignment") return "assignments: a role assignment is checked against the caller's own roles";
@@ -351,7 +358,10 @@ function splitRefusal(mode, plan) {
 		default: return mode;
 	}
 }
-/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants under migra. */
+/**
+* The files `generate` writes: one, or one per `--split` part, plus the hook's
+* grants under migra.
+*/
 function outputFiles(plan) {
 	const { input } = plan;
 	const split = parseSplit(input.split);
@@ -481,12 +491,11 @@ function outputFiles(plan) {
 //#endregion
 //#region src/cli/rls/backfill.ts
 /**
-* The `--backfill-out` migration: every custom role in the application's
-* roles table that has no rows in `custom_role_permissions` or
-* `custom_role_includes` yet is saved through
-* `permdock_trusted_replace_custom_role_grants`, with the entries PermDock
-* cannot hold left out and listed in one warning. Running it again copies
-* nothing, so a role edited after the copy keeps its edits.
+* The `--backfill-out` migration: every custom role in the application's roles
+* table that has no rows in `custom_role_permissions` or `custom_role_includes`
+* yet is saved through `permdock_trusted_replace_custom_role_grants`, with the
+* entries PermDock cannot hold left out and listed in one warning. Running it
+* again copies nothing, so a role edited after the copy keeps its edits.
 */
 function backfillSql(ctx, from, migrate) {
 	const plan = rebuildPlan(ctx, from, migrate);
@@ -542,7 +551,10 @@ $permdock$;
 }
 //#endregion
 //#region src/cli/rls/break-glass.ts
-/** The audit table every generated break-glass read writes to. Part of the SQL contract. */
+/**
+* The audit table every generated break-glass read writes to. Part of the SQL
+* contract.
+*/
 const BREAK_GLASS_AUDIT = "permdock_break_glass_audit";
 const IDENT$2 = /^[a-z][a-z0-9_]*$/u;
 /**
@@ -583,10 +595,10 @@ function breakGlassEntries(policy, tables) {
 	}));
 }
 /**
-* Rows the subject's roles reach for `p_permission`: a break-glass grant
-* lifts denies, never the tenant boundary. A grant to no role reads the rows
-* of the root scopes the subject is a member of, or every row when the
-* policy declares no scopes.
+* Rows the subject's roles reach for `p_permission`: a break-glass grant lifts
+* denies, never the tenant boundary. A grant to no role reads the rows of the
+* root scopes the subject is a member of, or every row when the policy declares
+* no scopes.
 */
 function rowsFilter(ctx, entry) {
 	const arms = entry.grants.flatMap((grant) => {
@@ -661,12 +673,12 @@ revoke execute on function ${fn}(text) from public, anon;
 grant execute on function ${fn}(text) to authenticated;`;
 }
 /**
-* The `security definer` read path for every `breakGlass` grant: an audit
-* table and one `permdock_break_glass_<resource>(permission)` per resource
-* that checks a signed break-glass session, writes an audit row and returns
-* the rows in the scope instances where the subject holds a role with the
-* break-glass grant (bypassing the table's policies as the definer). Empty
-* when the policy has no break-glass grant.
+* The `security definer` read path for every `breakGlass` grant: an audit table
+* and one `permdock_break_glass_<resource>(permission)` per resource that
+* checks a signed break-glass session, writes an audit row and returns the rows
+* in the scope instances where the subject holds a role with the break-glass
+* grant (bypassing the table's policies as the definer). Empty when the policy
+* has no break-glass grant.
 */
 function breakGlassSql(ctx, entries) {
 	if (entries.length === 0) return "";
@@ -677,7 +689,7 @@ function breakGlassSql(ctx, entries) {
 const HEADER = "-- generated by permdock rls generate\n-- fail-closed: never target a bypass role\n";
 const TRUSTED_READER_GRANT = /^grant usage on schema "[^"\n]+" to [^\n;]+;\ngrant execute on function [^\n]+\.permdock_trusted_role_permissions(?:_by_id)?\([^)\n]*\) to [^\n;]+;$/gmu;
 function assertNoServiceRole(text) {
-	if (/\bservice_role\b/iu.test(text.replace(TRUSTED_READER_GRANT, ""))) throw new Error("PermDock CLI: generated RLS must never emit service_role");
+	if (/\bservice_role\b/iu.test(text.replaceAll(TRUSTED_READER_GRANT, ""))) throw new Error("PermDock CLI: generated RLS must never emit service_role");
 }
 function assertSupautilsSafe(text) {
 	const [first] = supautilsRejections(text);
@@ -685,8 +697,8 @@ function assertSupautilsSafe(text) {
 }
 /**
 * Neon's Data API and `pg_session_jwt` name the anonymous role `anonymous`;
-* Supabase, PostgREST and the GUC pattern use `anon`. Role lists end a line
-* or a statement after `to` or `from`, so only those are renamed.
+* Supabase, PostgREST and the GUC pattern use `anon`. Role lists end a line or
+* a statement after `to` or `from`, so only those are renamed.
 */
 function dialectRoles(text, dialect) {
 	if (dialect !== "neon") return text;
@@ -695,7 +707,10 @@ function dialectRoles(text, dialect) {
 function tablesOf(policies) {
 	return [...new Set(policies.map((item) => item.table))];
 }
-/** Enable (and force) row level security, then the table grants for the commands a policy allows. */
+/**
+* Enable (and force) row level security, then the table grants for the commands
+* a policy allows.
+*/
 function tableSql(table, policies, force, views) {
 	const closed = views.find((view) => view.table === table && view.companion !== void 0);
 	const target = quoteQualified(table);
@@ -716,7 +731,10 @@ function tableSql(table, policies, force, views) {
 	if (closed !== void 0) lines.push(columnRevokeSql(closed));
 	return lines.join("\n");
 }
-/** `drop policy if exists` and `create policy` for one policy, without the table's grants. */
+/**
+* `drop policy if exists` and `create policy` for one policy, without the
+* table's grants.
+*/
 function policySql(item) {
 	const target = quoteQualified(item.table);
 	const lines = [
@@ -743,8 +761,9 @@ function emitSql(policies, preamble, force = false, views = []) {
 	return text;
 }
 /**
-* The SQL a Drizzle or Prisma schema cannot declare: helpers, grants, `force` and field views.
-* `rls generate` writes it next to `out` for a custom migration.
+* The SQL a Drizzle or Prisma schema cannot declare: helpers, grants, `force`
+* and field views. `rls generate` writes it next to `out` for a custom
+* migration.
 */
 function migrationSql(policies, preamble, force, views) {
 	const parts = [
@@ -762,7 +781,7 @@ function helpersNote(helpers, how) {
 	return helpers === void 0 ? [] : [`// run ${helpers} ${how}`];
 }
 function camelCase(name) {
-	return name.replace(/[_-]+([a-z0-9])/gi, (_, char) => char.toUpperCase());
+	return name.replaceAll(/[_-]+([a-z0-9])/giu, (_, char) => char.toUpperCase());
 }
 function tableName(table) {
 	return table.slice(table.lastIndexOf(".") + 1);
@@ -771,16 +790,16 @@ function pascalCase(name) {
 	const camel = camelCase(name);
 	return camel.charAt(0).toUpperCase() + camel.slice(1);
 }
-const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/u;
 function identifier(name, what) {
 	if (!IDENTIFIER.test(name)) throw configError(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
 	return name;
 }
 function quoted(text) {
-	return `'${text.replace(/[\\']/g, (match) => `\\${match}`)}'`;
+	return `'${text.replaceAll(/[\\']/gu, (match) => `\\${match}`)}'`;
 }
 function templateText(text) {
-	return text.replace(/[\\`]|\$\{/g, (match) => `\\${match}`);
+	return text.replaceAll(/[\\`]|\$\{/gu, (match) => `\\${match}`);
 }
 const AUTH_UID = "(select auth.uid())";
 function drizzleRoles(list) {
@@ -825,7 +844,10 @@ function emitDrizzle(policies, options) {
 	assertNoServiceRole(text);
 	return text;
 }
-/** Prisma 8 `policy_<command>` blocks; each target model declares `@@rls` itself. */
+/**
+* Prisma 8 `policy_<command>` blocks; each target model declares `@@rls`
+* itself.
+*/
 function emitPrisma(policies, options = {}) {
 	const modelOf = (table) => identifier(options.models?.[table] ?? pascalCase(tableName(table)), "model");
 	const models = [...new Set(policies.map((item) => modelOf(item.table)))];
@@ -882,9 +904,9 @@ function declaredScope(facts, scope, where) {
 	return scope;
 }
 /**
-* The ids of `scope` where the subject holds `key` through an allow without
-* a row condition, minus a deny of it, as text: `<value> in (…)`. A
-* relationship or a `where` on the same permission never widens it.
+* The ids of `scope` where the subject holds `key` through an allow without a
+* row condition, minus a deny of it, as text: `<value> in (…)`. A relationship
+* or a `where` on the same permission never widens it.
 */
 function permitted(ctx, value, scope, key) {
 	return `${value} in (select x::text from ${qualified$1(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
@@ -988,9 +1010,9 @@ function storagePolicies(ctx, facts, storage, warnings) {
 * The `realtime.messages` and `storage.objects` policies `rls.realtime` and
 * `rls.storage` describe. Each one admits a row only where the subject holds
 * the permission in the scope instance its topic segment or folder names,
-* through an allow without a row condition, so the helpers' API-key ceiling
-* and suspension rules apply and a relationship grant on the same permission
-* never reaches a topic or a folder.
+* through an allow without a row condition, so the helpers' API-key ceiling and
+* suspension rules apply and a relationship grant on the same permission never
+* reaches a topic or a folder.
 */
 function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 	if (config.realtime === void 0 && config.storage === void 0) return [];
@@ -1007,10 +1029,9 @@ function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 //#region src/cli/rls/generate-policies.ts
 const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
 /**
-* A `realtime.messages` or `storage.objects` policy that applies only where
-* the table exists. The Realtime and Storage services create those tables, so
-* a local stack with the service off, and pg-delta's shadow database, have
-* none.
+* A `realtime.messages` or `storage.objects` policy that applies only where the
+* table exists. The Realtime and Storage services create those tables, so a
+* local stack with the service off, and pg-delta's shadow database, have none.
 */
 function guardedPolicySql(item) {
 	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
@@ -1023,7 +1044,10 @@ end
 $permdock$;
 `;
 }
-/** Appends the `realtime.messages` and `storage.objects` policies, which never get `tableSql`. */
+/**
+* Appends the `realtime.messages` and `storage.objects` policies, which never
+* get `tableSql`.
+*/
 function withHelperTables(sql, helperTables) {
 	if (helperTables === void 0) return sql;
 	const tables = `${helperTables.trimEnd()}\n`;
@@ -1033,7 +1057,10 @@ function databaseModeWarnings(policy, { ctx }, warnings) {
 	if (ctx.authorize !== "database") return;
 	for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
 }
-/** The grants compiled into table policies, and the Realtime and Storage policies beside them. */
+/**
+* The grants compiled into table policies, and the Realtime and Storage
+* policies beside them.
+*/
 function generatePolicies(input, policy, options, built, warnings) {
 	const rls = input.config.rls;
 	const { ctx } = built;
@@ -1090,8 +1117,8 @@ function generatePolicies(input, policy, options, built, warnings) {
 //#region src/cli/rls/shims.ts
 const NAME$1 = /^[a-z_][a-z0-9_]*$/u;
 /**
-* The key a legacy caller passes, mapped the way `rls migrate` maps it:
-* `keys` and `renamed` exactly, then the longest `prefixes` entry.
+* The key a legacy caller passes, mapped the way `rls migrate` maps it: `keys`
+* and `renamed` exactly, then the longest `prefixes` entry.
 */
 function mappedKey(config, renamed) {
 	const exact = {
@@ -1112,10 +1139,10 @@ function addKey(list, key) {
 }
 /**
 * The grant keys behind each permission, per scope: the keys of its
-* unconditional allows, and every deny key. A shim cannot apply a row
-* condition or a validity window, so a conditional allow answers nothing and
-* a conditional deny always subtracts; the conditioned keys are listed apart.
-* A break-glass key answers only the break-glass read, so it is left out too.
+* unconditional allows, and every deny key. A shim cannot apply a row condition
+* or a validity window, so a conditional allow answers nothing and a
+* conditional deny always subtracts; the conditioned keys are listed apart. A
+* break-glass key answers only the break-glass read, so it is left out too.
 * Rows seeded under a former key are left out; the shim maps a former key to
 * the current one first.
 */
@@ -1169,7 +1196,10 @@ grant execute on function ${name}(${argTypes}) to authenticated;`;
 function grantKeys(keys, scope, effect) {
 	return `pg_catalog.jsonb_array_elements_text(coalesce(${keys.map(scope)} -> (${keys.key}) -> ${quoteLiteral(effect)}, '[]'::jsonb)) g(grant_key)`;
 }
-/** The instances of `scope` the caller holds an unconditional allow of the key in, minus those it holds a deny in. */
+/**
+* The instances of `scope` the caller holds an unconditional allow of the key
+* in, minus those it holds a deny in.
+*/
 function idsSql(ctx, keys, scope) {
 	const helper = qualified$1(ctx, permittedIdsHelper(scope));
 	return `  select a.id
@@ -1223,10 +1253,10 @@ function shim(ctx, config, keys, fn, helper) {
 * One wrapper per `rls.migrate.helpers` entry under its legacy name, so SQL
 * that `rls migrate` has not rewritten yet (function bodies, views, triggers)
 * answers from the PermDock helpers. A wrapper maps the legacy key to the
-* permission key, then to the grant keys `grants` lists for the helper's
-* scope, so a permission whose grants are split by condition still answers.
-* Each is `security definer` with an empty `search_path`, so a caller needs
-* `execute` on the wrapper only, not usage on the helper schema.
+* permission key, then to the grant keys `grants` lists for the helper's scope,
+* so a permission whose grants are split by condition still answers. Each is
+* `security definer` with an empty `search_path`, so a caller needs `execute`
+* on the wrapper only, not usage on the helper schema.
 */
 function shimsSql(ctx, config, shims, renamed, grants) {
 	const schema = shims.schema ?? "public";
@@ -1307,8 +1337,8 @@ function triggersSql(triggers, schema, tables) {
 }
 /**
 * `rls.audit`: one call of the audit function per generated table, which
-* registers the table with the application's audit module. Statements that
-* run code, so they travel with the seeds.
+* registers the table with the application's audit module. Statements that run
+* code, so they travel with the seeds.
 */
 function auditSql(audit, schema, tables) {
 	if (audit === void 0) return "";
@@ -1327,7 +1357,10 @@ ${targets.map((table) => `select ${fn}(${quoteLiteral(`${quoteIdent$1(schema)}.$
 }
 //#endregion
 //#region src/cli/rls/generate-sql.ts
-/** The checks that need the SQL context: `--backfill-out`, `rls.anonymousSignIns`, `rls.jsonSchema`. */
+/**
+* The checks that need the SQL context: `--backfill-out`,
+* `rls.anonymousSignIns`, `rls.jsonSchema`.
+*/
 function preflight(input, { ctx }) {
 	const rls = input.config.rls;
 	const from = typeof rls?.customRoles === "object" ? rls.customRoles.from : void 0;
@@ -1397,7 +1430,10 @@ function sectionsSql(input, policy, options, built, generated, jsonSchema, warni
 		rowHelpers === "" ? void 0 : rowHelpers
 	];
 }
-/** Whether `anon` calls a helper: `rls.anonExecute`, an anon field view or an anon branch reading the user id. */
+/**
+* Whether `anon` calls a helper: `rls.anonExecute`, an anon field view or an
+* anon branch reading the user id.
+*/
 function anonExecutes(input, { compiled, views }) {
 	return input.config.rls?.anonExecute === true || views.some((view) => view.roles.includes("anon")) || compiled.branches.some((branch) => branch.roles.includes("anon") && [
 		branch.access,
@@ -1405,7 +1441,10 @@ function anonExecutes(input, { compiled, views }) {
 		branch.check
 	].some((sql) => sql?.includes("permdock_user_id") === true));
 }
-/** Everything before the table policies: helpers, sections, shims, scaffold and triggers. */
+/**
+* Everything before the table policies: helpers, sections, shims, scaffold and
+* triggers.
+*/
 function preambleSql(input, policy, options, built, generated, jsonSchema, warnings) {
 	const rls = input.config.rls;
 	const { ctx } = built;
@@ -1437,7 +1476,7 @@ function preambleSql(input, policy, options, built, generated, jsonSchema, warni
 			...rls?.trustedReaders === void 0 ? {} : { trustedReaders: rls.trustedReaders }
 		}),
 		permissionHelpersSql(ctx, grants, renamed, anonExecute),
-		permissionHoldersSql(ctx) || void 0,
+		nonEmptyOr(permissionHoldersSql(ctx), void 0),
 		actorKinds === void 0 ? void 0 : actorMayWriteSql(ctx, actorKinds),
 		usesLiveSession ? sessionLiveHelperSql(ctx) : void 0,
 		...sections,
@@ -1478,9 +1517,9 @@ function forceWarnings({ graph }, warnings) {
 	}
 }
 /**
-* The row columns that belong to a table. With `rls.tables` set, a resource
-* it does not name is a table only when generated policies are written for
-* it; with `--helpers-only` it has none, so it gets no index.
+* The row columns that belong to a table. With `rls.tables` set, a resource it
+* does not name is a table only when generated policies are written for it;
+* with `--helpers-only` it has none, so it gets no index.
 */
 function tableColumns(rowColumns, tables, helpersOnly, warnings) {
 	if (tables === void 0) return rowColumns;
@@ -1530,7 +1569,10 @@ function emitTarget(input, built, generated, preamble) {
 		outRel
 	};
 }
-/** The generated SQL for one run, before `--db-url-stdin` prunes the index targets. */
+/**
+* The generated SQL for one run, before `--db-url-stdin` prunes the index
+* targets.
+*/
 function generateSql(input, policy, options, built, warnings) {
 	const rls = input.config.rls;
 	const { ctx } = built;
@@ -1564,7 +1606,11 @@ function generateSql(input, policy, options, built, warnings) {
 }
 //#endregion
 //#region src/cli/rls/index-scan.ts
-/** An index PermDock generated (`permdock_<table>_<columns>_idx`), in the indexes part or in a migration derived from it: it never counts as serving its own target. */
+/**
+* An index PermDock generated (`permdock_<table>_<columns>_idx`), in the
+* indexes part or in a migration derived from it: it never counts as serving
+* its own target.
+*/
 const GENERATED_INDEX = /\bcreate\s+index\s+(?:if\s+not\s+exists\s+)?"?permdock_\w*_idx"?[^;]*;/giu;
 const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
 const NAME = String.raw`${IDENT}(?:\s*\.\s*${IDENT})?`;
@@ -1587,7 +1633,10 @@ function qualified(raw) {
 function stripComments(sql) {
 	return sql.replaceAll(/\/\*[\s\S]*?\*\//gu, " ").replaceAll(/--[^\n]*/gu, " ");
 }
-/** The text between the `(` that ends `match` and its closing `)`, and the index after it. */
+/**
+* The text between the `(` that ends `match` and its closing `)`, and the index
+* after it.
+*/
 function group(text, open) {
 	let depth = 1;
 	for (let index = open; index < text.length; index += 1) {
@@ -1641,7 +1690,10 @@ function keyColumns(body) {
 	}
 	return columns;
 }
-/** Key columns of each index, unique constraint and primary key the SQL creates, per `schema.table`. */
+/**
+* Key columns of each index, unique constraint and primary key the SQL creates,
+* per `schema.table`.
+*/
 function indexKeysFromSql(sql) {
 	const text = stripComments(sql);
 	const keys = {};
@@ -1665,7 +1717,10 @@ function indexKeysFromSql(sql) {
 	}
 	return keys;
 }
-/** The index keys of the SQL files under the migration and schema folders of `cwd`. */
+/**
+* The index keys of the SQL files under the migration and schema folders of
+* `cwd`.
+*/
 function indexKeysFromProject(cwd) {
 	const all = {};
 	for (const file of sqlFiles(cwd, [...MIGRATION_DIRS])) {
@@ -1678,13 +1733,19 @@ function indexKeysFromProject(cwd) {
 function tablesFromSql(sql) {
 	return new Set([...stripComments(sql).matchAll(TABLE_NAME)].map((match) => qualified(captured(match))));
 }
-/** Every `schema.table` the SQL files under the migration and schema folders of `cwd` create. */
+/**
+* Every `schema.table` the SQL files under the migration and schema folders of
+* `cwd` create.
+*/
 function tablesFromProject(cwd) {
 	const all = /* @__PURE__ */ new Set();
 	for (const file of sqlFiles(cwd, [...MIGRATION_DIRS])) for (const table of tablesFromSql(readFileSync(file, "utf8"))) all.add(table);
 	return all;
 }
-/** The targets no index in `keys` leads with: its key columns start with the target's, as `pruneIndexTargets` reads a database. */
+/**
+* The targets no index in `keys` leads with: its key columns start with the
+* target's, as `pruneIndexTargets` reads a database.
+*/
 function withoutServedTargets(targets, keys) {
 	return targets.filter((target) => !(keys[target.table] ?? []).some((key) => target.columns.every((column, at) => key[at] === column)));
 }
@@ -1696,8 +1757,8 @@ function loadPolicy(cwd, config, from) {
 }
 const PROJECT_COMMAND = "permdock rls generate";
 /**
-* The policy `policyFromCatalog` rebuilds from the project's pushed catalog
-* and policy; a project with no pushed policy fails with `policy-not-published`.
+* The policy `policyFromCatalog` rebuilds from the project's pushed catalog and
+* policy; a project with no pushed policy fails with `policy-not-published`.
 */
 async function projectPolicyOf(input, project) {
 	const fetched = await fetchProjectPolicy({
@@ -1876,7 +1937,10 @@ async function runRlsGenerate(input) {
 //#endregion
 //#region src/cli/rls/introspect.ts
 const ROLES = ["anon", "authenticated"];
-/** Neon's `anonymous` is the role `rls generate` writes as `anon` for the other dialects. */
+/**
+* Neon's `anonymous` is the role `rls generate` writes as `anon` for the other
+* dialects.
+*/
 function liveRole(role) {
 	return role === "anonymous" ? "anon" : role;
 }
@@ -1892,14 +1956,107 @@ function normalizeTableName(table) {
 	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
 }
 const FUNCTION_HEADER = /create or replace function ("?)([A-Za-z_][\w$]*)\1\.("?)([A-Za-z_][\w$]*)\3\s*\(([\s\S]*?)\nas \$/gu;
+const TYPE_ALIASES = {
+	int: "integer",
+	int4: "integer",
+	int2: "smallint",
+	int8: "bigint",
+	bool: "boolean",
+	varchar: "character varying",
+	char: "character",
+	float4: "real",
+	float8: "double precision",
+	timestamp: "timestamp without time zone",
+	timestamptz: "timestamp with time zone",
+	time: "time without time zone",
+	timetz: "time with time zone"
+};
+/**
+* A parameter type as `oidvectortypes` prints it: lower case, no quotes, no
+* schema, no type modifier, aliases spelled out. A `%type` reference is `*`,
+* which matches any type.
+*/
+function normalizeParameterType(type) {
+	const text = type.trim().toLowerCase().replaceAll("\"", "");
+	if (text.endsWith("%type")) return "*";
+	const array = /(?:\[\d*\])+$/u.exec(text)?.[0] ?? "";
+	const base = text.slice(0, text.length - array.length).replaceAll(/\([^)]*\)/gu, "").replaceAll(/\s+/gu, " ").trim();
+	const unqualified = /^[\w$]+(?:\.[\w$]+)+$/u.test(base) ? base.split(".").at(-1) ?? base : base;
+	return `${TYPE_ALIASES[unqualified] ?? unqualified}${"[]".repeat(array.split("[").length - 1)}`;
+}
+function splitTopLevel(text) {
+	const parts = [];
+	let depth = 0;
+	let quoted = false;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "'") quoted = !quoted;
+		else if (!quoted && char === "(") depth += 1;
+		else if (!quoted && char === ")") depth -= 1;
+		else if (!quoted && depth === 0 && char === ",") {
+			parts.push(text.slice(start, index));
+			start = index + 1;
+		}
+	}
+	parts.push(text.slice(start));
+	return parts.map((part) => part.trim()).filter((part) => part !== "");
+}
+/**
+* The input parameter types of a function header that starts after its opening
+* parenthesis. Every generated parameter is named, so the first word of a
+* parameter with more than one is its name.
+*/
+function parameterTypes(header) {
+	let depth = 0;
+	let end = header.length;
+	for (let index = 0; index < header.length; index += 1) {
+		const char = header[index];
+		if (char === "(") depth += 1;
+		else if (char === ")") {
+			if (depth === 0) {
+				end = index;
+				break;
+			}
+			depth -= 1;
+		}
+	}
+	return splitTopLevel(header.slice(0, end)).flatMap((parameter) => {
+		const words = parameter.replace(/\s+(?:default\b|=)[\s\S]*$/iu, "").split(/\s+/u);
+		const mode = words[0]?.toLowerCase();
+		if (mode === "out") return [];
+		const rest = mode === "in" || mode === "inout" || mode === "variadic" ? words.slice(1) : words;
+		return [normalizeParameterType((rest.length > 1 ? rest.slice(1) : rest).join(" "))];
+	});
+}
+/** `schema.name(type, type)`, the key a helper is checked by. */
+function signatureOf(name, types) {
+	return `${name}(${types.join(", ")})`;
+}
 function helpersOf(sql) {
 	const found = /* @__PURE__ */ new Set();
 	for (const match of sql.matchAll(FUNCTION_HEADER)) {
-		const [header = "", , schema = "", , name = ""] = match;
-		if (/\bsecurity definer\b/u.test(header)) found.add(`${schema}.${name}`);
+		const [header = "", , schema = "", , name = "", rest = ""] = match;
+		if (/\bsecurity definer\b/u.test(header)) found.add(signatureOf(`${schema}.${name}`, parameterTypes(rest)));
 	}
 	return [...found];
 }
+function nameOfSignature(signature) {
+	return signature.slice(0, signature.indexOf("("));
+}
+function typesOfSignature(signature) {
+	return splitTopLevel(signature.slice(signature.indexOf("(") + 1, signature.lastIndexOf(")"))).map(normalizeParameterType);
+}
+/** The actual overload `expected` names; `*` matches any parameter type. */
+function matchHelper(expected, actual) {
+	if (Object.hasOwn(actual, expected)) return actual[expected];
+	const name = nameOfSignature(expected);
+	const want = typesOfSignature(expected);
+	for (const [signature, helper] of Object.entries(actual)) {
+		const have = typesOfSignature(signature);
+		if (nameOfSignature(signature) === name && have.length === want.length && want.every((type, index) => type === "*" || type === have[index])) return helper;
+	}
+}
 function expectedRls(policies, sql, indexes = []) {
 	const tables = [...new Set(policies.map((item) => normalizeTableName(item.table)))];
 	const grants = {};
@@ -1929,8 +2086,8 @@ function expectedRls(policies, sql, indexes = []) {
 	};
 }
 /**
-* One warning per index target no index starts with. A missing index slows
-* the policy down but grants nothing, so these do not fail `verify`.
+* One warning per index target no index starts with. A missing index slows the
+* policy down but grants nothing, so these do not fail `verify`.
 */
 function missingIndexes(expected, actual) {
 	return expected.indexes.flatMap((target) => {
@@ -1944,7 +2101,10 @@ function sameList(left, right) {
 	const b = right.toSorted();
 	return a.length === b.length && a.every((item, index) => item === b[index]);
 }
-/** One finding per difference; policy expressions are not compared, since Postgres rewrites their text. */
+/**
+* One finding per difference; policy expressions are not compared, since
+* Postgres rewrites their text.
+*/
 function diffRls(expected, actual, options = {}) {
 	const out = [];
 	const found = new Map(actual.policies.map((item) => [`${item.table}\u0000${item.name}`, item]));
@@ -1973,7 +2133,7 @@ function diffRls(expected, actual, options = {}) {
 		}
 	}
 	for (const helper of expected.helpers) {
-		const have = actual.helpers[helper];
+		const have = matchHelper(helper, actual.helpers);
 		if (have === void 0) {
 			out.push(rlsFinding("helper-missing", helper, "helper", `${helper}: helper is missing`));
 			continue;
@@ -1995,19 +2155,22 @@ from information_schema.role_table_grants
 where grantee in ('anon', 'anonymous', 'authenticated')
   and lower(privilege_type) in ('select', 'insert', 'update', 'delete')
   and table_schema || '.' || table_name = any($1::text[])`;
-const HELPERS_SQL = `select n.nspname || '.' || p.proname as target, p.prosecdef as definer,
+const HELPERS_SQL = `select n.nspname || '.' || p.proname || '(' || oidvectortypes(p.proargtypes) || ')' as target, p.prosecdef as definer,
   coalesce(array_to_string(p.proconfig, ','), '') as config
 from pg_proc p
 join pg_namespace n on n.oid = p.pronamespace
 where n.nspname || '.' || p.proname = any($1::text[])`;
 function commandOf(cmd) {
-	const text = String(cmd ?? "").toLowerCase();
+	const text = typeof cmd === "string" ? cmd.toLowerCase() : "";
 	return text === "*" ? "all" : text;
 }
 function connectIntrospect(db) {
 	return connectPgPool(db, "permdock rls verify --introspect");
 }
-/** Reads the catalogs for the tables and helpers `expected` names (postgres-meta's queries, trimmed). */
+/**
+* Reads the catalogs for the tables and helpers `expected` names
+* (postgres-meta's queries, trimmed).
+*/
 async function introspectRls(db, expected, connect = connectIntrospect) {
 	const client = await connect(db);
 	try {
@@ -2017,7 +2180,7 @@ async function introspectRls(db, expected, connect = connectIntrospect) {
 			client.query(POLICIES_SQL, [tables]),
 			client.query(TABLES_SQL, [tables]),
 			client.query(GRANTS_SQL, [tables]),
-			client.query(HELPERS_SQL, [[...expected.helpers]]),
+			client.query(HELPERS_SQL, [[...new Set(expected.helpers.map(nameOfSignature))]]),
 			client.query(INDEX_COLUMNS_SQL, [indexed]),
 			client.query(COLUMNS_SQL, [indexed])
 		]);
@@ -2045,7 +2208,7 @@ async function introspectRls(db, expected, connect = connectIntrospect) {
 			})),
 			rlsEnabled: Object.fromEntries(enabled.rows.map((row) => [String(row["target"]), row["enabled"] === true])),
 			grants: byTable,
-			helpers: Object.fromEntries(helpers.rows.map((row) => [String(row["target"]), {
+			helpers: Object.fromEntries(helpers.rows.map((row) => [signatureOf(nameOfSignature(String(row["target"])), typesOfSignature(String(row["target"]))), {
 				securityDefiner: row["definer"] === true,
 				emptySearchPath: String(row["config"]).split(",").some((item) => item === "search_path=\"\"" || item === "search_path=''")
 			}])),
@@ -2062,10 +2225,10 @@ const WRITES = [
 	"delete"
 ];
 /**
-* Each table and write command whose permissive policies reach
-* `authenticated` (or `public`) without the read-only actor check: no
-* restrictive policy for the command calls `permdock_actor_may_write()`, and
-* some permissive one does not.
+* Each table and write command whose permissive policies reach `authenticated`
+* (or `public`) without the read-only actor check: no restrictive policy for
+* the command calls `permdock_actor_may_write()`, and some permissive one does
+* not.
 */
 function unguardedWrites(policies, fn) {
 	const out = [];
@@ -2107,7 +2270,10 @@ function seedLine(row) {
 function seedKey(line) {
 	return line.replace(" on ", " ").replaceAll(" ", "/");
 }
-/** Drift is an error; `info` names RLS tables whose policies call no PermDock helper. */
+/**
+* Drift is an error; `info` names RLS tables whose policies call no PermDock
+* helper.
+*/
 function diffMixed(expected, actual) {
 	const drift = [];
 	const seeds = `${expected.schema}.role_permissions`;
@@ -2147,7 +2313,10 @@ from pg_class c
 join pg_namespace n on n.oid = c.relnamespace
 where c.relkind in ('r', 'p') and c.relrowsecurity`;
 const quoteIdent = escapeSqlIdent;
-/** Reads `role_permissions`, `pg_policies` and the RLS-enabled tables for {@link diffMixed}. */
+/**
+* Reads `role_permissions`, `pg_policies` and the RLS-enabled tables for
+* {@link diffMixed}.
+*/
 async function introspectMixed(db, schema, connect = connectIntrospect) {
 	const client = await connect(db);
 	try {
@@ -2170,7 +2339,7 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 				expression: String(row["expression"]),
 				command: String(row["command"]),
 				restrictive: row["restrictive"] === true,
-				roles: String(row["roles"] ?? "").split(",").filter((role) => role !== "")
+				roles: (typeof row["roles"] === "string" ? row["roles"] : "").split(",").filter((role) => role !== "")
 			})).filter((row) => inScope(row.table)),
 			rlsTables: tables.rows.map((row) => String(row["target"])).filter(inScope).toSorted()
 		};
@@ -2298,7 +2467,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd, PGSQL_PARSER_MAJOR);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-Dodel0IJ.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-B7oP_sQU.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2314,7 +2483,10 @@ async function migrate(input) {
 		...input.io.now === void 0 ? {} : { now: input.io.now() }
 	});
 }
-/** `verify --introspect` with `--helpers-only`: helpers and seeds exactly, hand-written policies by their keys. */
+/**
+* `verify --introspect` with `--helpers-only`: helpers and seeds exactly,
+* hand-written policies by their keys.
+*/
 async function introspectHelpersOnly(db, expected, generated, connect, readOnlyActors, ignore) {
 	const schema = generated.schema ?? "permdock";
 	try {
@@ -2343,7 +2515,10 @@ async function introspectHelpersOnly(db, expected, generated, connect, readOnlyA
 		return usageResult(cause);
 	}
 }
-/** `verify --introspect`: the catalogs against what `generate` would write with the same flags. */
+/**
+* `verify --introspect`: the catalogs against what `generate` would write with
+* the same flags.
+*/
 async function introspect(input, ignore) {
 	if (input.db === void 0) return {
 		code: 2,
@@ -2408,7 +2583,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd, PGSQL_PARSER_MAJOR);
-			const { runRlsImport } = await import("./import-Bz0GefWg.js");
+			const { runRlsImport } = await import("./import-CST57XLp.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,