permdock 0.7.0 → 0.9.0

package/dist/{supautils-MESd81bF.js → supautils-ByezN3b8.js}

@@ -1,20 +1,22 @@
-import { c as listPermissions, u as renamedKeys } from "./permission-registry-DpPtSKNZ.js";
-import { f as scopeList, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { c as policyLevels } from "./policy-DaJy4nK4.js";
-import { a as describeError, i as configError } from "./errors-DpP_U6Bf.js";
-import { d as sqlTextArray, i as qualifySqlTable } from "./sql-B96movIM.js";
-import "./budget-NbEtbJC_.js";
-import { l as roleColumn } from "./sources-B-zYB4GS.js";
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
+import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { l as policyLevels } from "./policy-CLQ8__GF.js";
+import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
+import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
+import "./budget-BELja5A9.js";
+import { l as roleColumn } from "./sources-CMAM-2A3.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { c as parseSplit } from "./output-files-CCMdcFWb.js";
-import { x as resolveAuthorize } from "./supabase-hook-Dg0SrQWR.js";
-import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, L as tenantTypeOf, O as quoteIdent, a as customRolesOn, j as quoteTable, k as quoteLiteral, t as CUSTOM_ROLES } from "./shared-fMKOv8hP.js";
-import { D as byKey, E as byCodeUnit, I as roleNames, M as assignableRoles, T as rolesTableScope, U as graphSqlName, b as tokenScopesPlan, j as apiKeysPlan, ot as checkSuspension, r as unsatisfiedKinds, t as ownershipRules, w as currentKeyExpr } from "./ownership-Z2LpxsGa.js";
+import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
+import { b as resolveAuthorize } from "./supabase-hook-CrgU06WH.js";
+import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-BqrxBCir.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-DA5YdYTm.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { i as group, o as sqlStatements } from "./deciding-columns-DRo2QM6E.js";
-import { c as branchClauses, i as orSql } from "./policies-B2lZIurj.js";
-import { d as tableNames, f as tablelessResources, i as graphPlan, l as resolveVias, r as closureDepths, x as tableFor } from "./verify-pe8rL_Qw.js";
+import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
+import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
+import { d as orSql, h as branchClauses } from "./fields-D0vUI6dq.js";
+import { m as tableFor } from "./verify-DlUcTDBz.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -24,7 +26,10 @@ function col(name) {
 function schemaOf(table) {
 	return table.includes(".") ? beforeFirst(table, ".") : "public";
 }
-/** The roles-table column a reference joins on, after checking it points at `roles`. */
+/**
+* The roles-table column a reference joins on, after checking it points at
+* `roles`.
+*/
 function roleRef(role, table, roles, label) {
 	const pairs = Object.entries(role.on);
 	const [pair] = pairs;
@@ -104,9 +109,9 @@ function rebuildPlan(ctx, from, migrate) {
 	const iRef = i === void 0 || iTable === void 0 ? void 0 : roleRef(i.role, i.table, roles, "rls.customRoles.from.includes.role");
 	const included = i === void 0 || iTable === void 0 ? void 0 : sourceSql(i.include, iTable, "rls.customRoles.from.includes.include");
 	const refs = [`${col(pRef.id)} as permissions_ref`, ...iRef === void 0 ? [] : [`${col(iRef.id)} as includes_ref`]].join(", ");
-	const includeBlock = i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 ? "    v_include := null;" : `    with raw as (
+	const includeBlock = (rows) => i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 || rows === void 0 ? "    v_include := null;" : `    with raw as (
       select ${included} as role
-      from ${quoteTable(iTable)} x
+      from ${rows}
       where x.${quoteIdent(iRef.ref)} = v.includes_ref
     ),
     judged as (
@@ -125,9 +130,9 @@ function rebuildPlan(ctx, from, migrate) {
     into v_include, v_lost
     from judged j;
     v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
-	const collect = `    with raw as (
+	const permissionsBlock = (rows) => `    with raw as (
       select ${legacy} as legacy, ${effect} as effect, ${level} as level
-      from ${quoteTable(pTable)} x
+      from ${rows}
       where x.${quoteIdent(pRef.ref)} = v.permissions_ref
     ),
     mapped as (
@@ -147,8 +152,9 @@ function rebuildPlan(ctx, from, migrate) {
       array_agg(v.role || ': ' || coalesce(j.legacy, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
     into v_allow, v_deny, v_lost
     from judged j;
-    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);
-${includeBlock}`;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
+	const legacyRows = iTable === void 0 ? void 0 : `${quoteTable(iTable)} x`;
+	const newRow = "(select new.*) x";
 	return {
 		rolesTable,
 		identity: `select ${tenant} as tenant_id, ${scope} as scope, ${scopeId} as scope_id, ${col(roles.key)}::text as role, ${refs}`,
@@ -156,7 +162,15 @@ ${includeBlock}`;
 		permsRef: pRef,
 		includesRef: iRef,
 		scopes,
-		collect,
+		collect: `${permissionsBlock(`${quoteTable(pTable)} x`)}
+${includeBlock(legacyRows)}`,
+		collectNew: {
+			permissions: `${permissionsBlock(newRow)}
+    v_include := null;`,
+			includes: `    v_allow := null;
+    v_deny := null;
+${includeBlock(newRow)}`
+		},
 		replace,
 		perms,
 		includes,
@@ -164,7 +178,10 @@ ${includeBlock}`;
 		roles
 	};
 }
-/** `v_dropped` grouped per legacy role (`role: a, b; other: c`), capped at 50 entries. */
+/**
+* `v_dropped` grouped per legacy role (`role: a, b; other: c`), capped at 50
+* entries.
+*/
 const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order by g.role)
     from (
       select split_part(l.d, ': ', 1) as role, string_agg(substr(l.d, strpos(l.d, ': ') + 2), ', ' order by l.d) as items
@@ -176,14 +193,20 @@ const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order b
 /**
 * `rls.customRoles.from.sync: 'trigger'`: after-row triggers on the legacy
 * permissions table, and on the includes table when mapped, rebuild each
-* affected role through `permdock_trusted_replace_custom_role_grants`, with
-* the same reads the backfill uses. An entry outside the ceiling is dropped
-* with a warning rather than aborting the legacy write, and a tenant role
-* whose name a shared role holds is skipped with a warning (`name-taken`).
+* affected role through `permdock_trusted_replace_custom_role_grants`, with the
+* same reads the backfill uses. An entry outside the ceiling is dropped with a
+* warning rather than aborting the legacy write, and a tenant role whose name a
+* shared role holds is skipped with a warning (`name-taken`). Before-row
+* triggers hold a signed-in caller at trigger depth 1 to the checks of
+* `permdock_replace_custom_role_grants`: `permdock_custom_role_guard` on each
+* role the row names, then `permdock_custom_role_beyond` on the entry it adds;
+* a refusal aborts the write.
 */
 function customRoleSyncSql(ctx, from, migrate) {
 	const plan = rebuildPlan(ctx, from, migrate);
 	const shared = qualified(ctx, CUSTOM_ROLES.shared);
+	const guard = qualified(ctx, CUSTOM_ROLES.guard);
+	const beyond = qualified(ctx, CUSTOM_ROLES.beyond);
 	const keepIncludes = plan.includesRef === void 0 ? `
     v_include := array(select c.include_role from ${plan.includes} c where c.tenant_id is not distinct from v.tenant_id and c.scope = v.scope and c.scope_id is not distinct from v.scope_id and c.role = v.role);` : "";
 	const one = (name, table, ref) => {
@@ -238,13 +261,317 @@ create trigger ${quoteIdent(trigger)}
   after insert or update or delete on ${target}
   for each row execute function ${fn}();`;
 	};
-	const chunks = [`-- rls.customRoles.from.sync: a write to the application's role tables rebuilds the role's PermDock grants`, one("permissions", from.permissions.table, plan.permsRef)];
-	if (from.includes !== void 0 && plan.includesRef !== void 0) chunks.push(one("includes", from.includes.table, plan.includesRef));
+	const guardOne = (name, table, ref) => {
+		const fn = qualified(ctx, `${CUSTOM_ROLES.syncGuard}_${name}`);
+		const target = quoteTable(qualifySqlTable(table));
+		const trigger = `${CUSTOM_ROLES.syncGuard}_${name}`;
+		return `create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+declare
+  v record;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_lost text[];
+  v_dropped text[];
+  v_beyond text;
+  v_refs text[] := array[
+    case when tg_op <> 'INSERT' then old.${quoteIdent(ref.ref)}::text end,
+    case when tg_op <> 'DELETE' then new.${quoteIdent(ref.ref)}::text end
+  ];
+begin
+  if not (${signedIn(ctx)} and pg_trigger_depth() = 1) then
+    return coalesce(new, old);
+  end if;
+  for v in
+    ${plan.identity}
+    from ${plan.rolesTable} r
+    where ${plan.eligible} and r.${quoteIdent(ref.id)}::text = any(v_refs)
+  loop
+    if v.role is null or not (v.scope = 'global' or v.scope = any(${plan.scopes})) then
+      continue;
+    end if;
+    if v.tenant_id is not null and ${shared}(v.scope, v.role) then
+      continue;
+    end if;
+    perform ${guard}(v.tenant_id, v.scope, v.scope_id, v.role);
+    if tg_op = 'DELETE' then
+      continue;
+    end if;
+    v_dropped := '{}'::text[];
+${plan.collectNew[name]}
+    select string_agg(b, ', ' order by b) into v_beyond
+    from ${beyond}(v.tenant_id, v.scope, v.scope_id, v_allow, v_deny, v_include) b;
+    if v_beyond is not null then
+${raiseSql("      ", "42501", `'permdock: ' || v.role || ' would allow ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
+    end if;
+  end loop;
+  return coalesce(new, old);
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists ${quoteIdent(trigger)} on ${target};
+create trigger ${quoteIdent(trigger)}
+  before insert or update or delete on ${target}
+  for each row execute function ${fn}();`;
+	};
+	const chunks = [
+		`-- rls.customRoles.from.sync: a write to the application's role tables rebuilds the role's PermDock grants`,
+		one("permissions", from.permissions.table, plan.permsRef),
+		`-- a signed-in caller writes only what the guarded replace would accept`,
+		guardOne("permissions", from.permissions.table, plan.permsRef)
+	];
+	if (from.includes !== void 0 && plan.includesRef !== void 0) chunks.push(one("includes", from.includes.table, plan.includesRef), guardOne("includes", from.includes.table, plan.includesRef));
 	return `${chunks.join("\n\n")}\n`;
 }
 //#endregion
+//#region src/cli/rls/rows.ts
+/**
+* `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject
+* may act on with one permission.
+*/
+function rowsHelper(resource) {
+	const name = graphSqlName(resource);
+	const helper = `permitted_${name ?? resource}_rows`;
+	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
+	return helper;
+}
+/**
+* Every declared `<permission>@<level>` of an instance permission on a resource
+* with levels.
+*/
+function levelKeys(policy) {
+	const out = [];
+	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
+		if (leaf.kind !== "instance") continue;
+		for (const [level, condition] of policyLevels(policy, leaf.resource)) out.push({
+			key: `${leaf.key}@${level}`,
+			permission: leaf.key,
+			conditioned: !(condition.op === "and" && condition.conditions.length === 0),
+			rowHelper: `permitted_${graphSqlName(leaf.resource) ?? leaf.resource}_row`
+		});
+	}
+	return out;
+}
+/**
+* The branches a row check of a permission reads: its allows and denies,
+* inserts included, for signed-in callers.
+*/
+function rowBranchesOf(branches, resource) {
+	const out = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.resource !== resource || branch.coverage === true || !branch.roles.includes("authenticated")) continue;
+		out.set(branch.permissionKey, [...out.get(branch.permissionKey) ?? [], branch]);
+	}
+	return out;
+}
+/**
+* What a branch asks of a row: the `with check` of an insert, which sees the
+* new row, the `using` of every other command.
+*/
+function clauseOf(branch) {
+	const clauses = branchClauses(branch);
+	return (branch.command === "insert" ? clauses.check : clauses.using) ?? "true";
+}
+function usingOf(branches) {
+	const parts = branches.map(clauseOf);
+	return parts.length === 0 ? void 0 : orSql(parts);
+}
+function permissionCase(key, branches) {
+	const allow = usingOf(branches.filter((branch) => branch.effect === "allow"));
+	if (allow === void 0) return;
+	const deny = usingOf(branches.filter((branch) => branch.effect === "deny"));
+	const granted = `coalesce((${allow}), false)`;
+	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
+}
+function forUserSql(ctx, fn, helper) {
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const signature = `${user}, text, jsonb`;
+	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
+returns setof text
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$`;
+	const tail = `revoke execute on function ${fn}(${signature}) from public, anon, authenticated;`;
+	if (ctx.dialect === "supabase") return `${head}
+declare
+  v_claims text := pg_catalog.current_setting('request.jwt.claims', true);
+begin
+  perform pg_catalog.set_config(
+    'request.jwt.claims',
+    (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
+    true
+  );
+  return query select r.id from ${helper}(p_permission) r(id);
+  perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
+end
+$$;
+${tail}`;
+	const prefix = ctx.gucPrefix;
+	return `${head}
+declare
+  v_saved jsonb := '{}'::jsonb;
+  v_key text;
+  v_value text;
+begin
+  for v_key, v_value in
+    select 'user_id', p_user
+    union all
+    select c.key, c.value from pg_catalog.jsonb_each_text(coalesce(p_claims, '{}'::jsonb)) c where c.key <> 'user_id'
+  loop
+    v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+  return query select r.id from ${helper}(p_permission) r(id);
+  for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+end
+$$;
+${tail}`;
+}
+function inheritTargets(policy) {
+	const out = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) for (const item of flattenGrantee(grant.to)) if (item.kind === "inherit") out.add(item.resource);
+	return [...out].toSorted();
+}
+const CANDIDATES = "permdock_candidates";
+function stubSql(ctx, resource) {
+	const fn = qualified(ctx, rowsHelper(resource));
+	return ["p_permission text", "p_permission text, p_ids text[]"].map((parameters) => `create or replace function ${fn}(${parameters})
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select null::text where false
+$$;`).join("\n");
+}
+function rowSql(ctx, rows, table, where) {
+	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
+	return `create or replace function ${fn}(p_row ${table}, p_permission text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  with ${CANDIDATES} as (select (p_row).*)
+  select exists (select 1 from ${CANDIDATES} where ${where})
+$$;
+revoke execute on function ${fn}(${table}, text) from public, anon;
+grant execute on function ${fn}(${table}, text) to authenticated;`;
+}
+function whereOf(branches) {
+	const cases = [...branches.keys()].toSorted().flatMap((key) => {
+		const sql = permissionCase(key, branches.get(key) ?? []);
+		return sql === void 0 ? [] : [sql];
+	});
+	return cases.length === 0 ? "false" : `case p_permission\n${cases.join("\n")}\n    else false\n  end`;
+}
+function candidatesSql(fn, table, id, where) {
+	const assign = (indent) => `${indent}v_row.${id} := v_id;\n${indent}v_rows := pg_catalog.array_append(v_rows, v_row);`;
+	return `create or replace function ${fn}(p_permission text, p_ids text[])
+returns setof text
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_row ${table};
+  v_rows ${table}[] := '{}';
+  v_id text;
+begin
+  begin
+    foreach v_id in array coalesce(p_ids, '{}') loop
+${assign("      ")}
+    end loop;
+  exception when data_exception then
+    v_rows := '{}';
+    foreach v_id in array p_ids loop
+      begin
+${assign("        ")}
+      exception when data_exception then
+        null;
+      end;
+    end loop;
+  end;
+  return query
+  with ${CANDIDATES} as materialized (
+    select * from ${table} where ${id} = any (array(select (r).${id} from pg_catalog.unnest(v_rows) r))
+  )
+  select ${id}::text from ${CANDIDATES}
+  where ${where};
+end
+$$;
+revoke execute on function ${fn}(text, text[]) from public, anon;
+grant execute on function ${fn}(text, text[]) to authenticated;`;
+}
+function resourceSql(ctx, node, branches, narrowed, tables) {
+	const name = rowsHelper(node.name);
+	const fn = qualified(ctx, name);
+	const table = quoteQualified(tableFor(node.name, tables));
+	const where = whereOf(branches);
+	const near = whereOf(narrowed);
+	const rows = `-- ${node.name}: ids of the rows the caller may act on with p_permission, as the table's policies decide it
+create or replace function ${fn}(p_permission text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${quoteIdent(node.id)}::text from ${table}
+  where ${where}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;
+${candidatesSql(fn, table, quoteIdent(node.id), near)}
+${rowSql(ctx, name, table, near)}`;
+	if (ctx.dialect === "neon") return rows;
+	return `${rows}
+-- the same rows for a user the caller names, with claims it supplies; no client role may execute it
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
+}
+/**
+* `permitted_<resource>_rows(p_permission)` for each resource `select` names
+* (or every resource a grant reaches with `true`): the ids of its rows the
+* caller may read, update or delete with that permission, from the same
+* compiled allows and denies the table policies use, so closure walks, link
+* hops, the restricted stop, `includes`, groups and `requires` all apply. A
+* `security definer` helper, so hand-written policies and functions call it
+* without restating the graph. Outside the `neon` dialect a
+* `permitted_<resource>_rows_for(p_user, p_permission, p_claims)` form runs it
+* as the named user, with the claims the caller supplies, for trusted SQL.
+*/
+function rowHelpersSql(ctx, policy, branches, select, tables, warnings, narrowed = branches) {
+	const names = select === true ? [...new Set(branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(select)];
+	const called = inheritTargets(policy);
+	for (const name of called) if (!names.includes(name)) names.push(name);
+	const chunks = called.map((name) => stubSql(ctx, name));
+	for (const name of names) {
+		const node = policy.resources.get(name);
+		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
+		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), rowBranchesOf(narrowed, name), tables));
+	}
+	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
+	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
+}
+//#endregion
 //#region src/cli/rls/generate-context.ts
-/** The scopes an `rls.migrate` `role` helper names, so `rls generate` writes their role-filtered member helper. */
+/**
+* The scopes an `rls.migrate` `role` helper names, so `rls generate` writes
+* their role-filtered member helper.
+*/
 function roleMemberScopesOf(migrate) {
 	const scopes = [...new Set(Object.values(migrate?.helpers ?? {}).flatMap((helper) => helper.form === "role" ? [helper.scope] : []))].toSorted();
 	return scopes.length === 0 ? {} : { roleMemberScopes: scopes };
@@ -285,7 +612,10 @@ function skippedOwnershipTriggers(triggers, scopes) {
 		return name;
 	});
 }
-/** The SQL context every emitter reads, from the flags, `rls` config and the policy. */
+/**
+* The SQL context every emitter reads, from the flags, `rls` config and the
+* policy.
+*/
 function buildContext(input, policy, options) {
 	const rls = input.config.rls;
 	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
@@ -342,8 +672,7 @@ function buildContext(input, policy, options) {
 		schema,
 		authorize,
 		roleClaim: rls?.roleClaim ?? "user_role",
-		tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
-		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+		tenantType: input.tenantType ?? firstScopeType(rls?.scopeTypes, scopes),
 		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
 		...memberships === void 0 ? {} : { memberships },
 		...sources === void 0 || sources.length === 0 ? {} : { sources },
@@ -368,7 +697,7 @@ function buildContext(input, policy, options) {
 		} },
 		...options.fieldsMode === void 0 ? {} : { fields: options.fieldsMode },
 		...vias === void 0 ? {} : { vias },
-		...graph.size === 0 ? {} : { graph: {
+		...graph.size === 0 && inheritTargets(policy).length === 0 ? {} : { graph: {
 			closures: closureDepths(graph),
 			resources: policy.resources,
 			...rls?.tables === void 0 ? {} : { tables: tableNames(rls.tables) ?? {} }
@@ -388,8 +717,14 @@ function buildContext(input, policy, options) {
 	}
 	const [unsatisfied] = unsatisfiedKinds(ctx, policy);
 	if (unsatisfied !== void 0) return { refusal: `role ${unsatisfied.role} is for ${unsatisfied.for.join(", ")}, but its membership sources hold ${unsatisfied.sources.join(", ")}: no membership can hold it; set via on a source to one of those kinds` };
+	const names = resolveNames(policy, input.config, {
+		schema,
+		gucPrefix: ctx.gucPrefix,
+		tenantClaim: ctx.tenantClaim
+	});
 	return {
 		ctx,
+		names,
 		graph,
 		ownership,
 		schema,
@@ -413,192 +748,20 @@ function generateOptions(input) {
 		revokeColumns
 	};
 }
-/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
+/**
+* Whether `--split` names `part`, which then leaves the helpers or the
+* warnings.
+*/
 function splitsPart(raw, part) {
 	const split = parseSplit(raw);
 	return typeof split !== "string" && split?.includes(part) === true;
 }
 //#endregion
-//#region src/cli/rls/rows.ts
-/** `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject may act on with one permission. */
-function rowsHelper(resource) {
-	const name = graphSqlName(resource);
-	const helper = `permitted_${name ?? resource}_rows`;
-	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
-	return helper;
-}
-/** Every declared `<permission>@<level>` of an instance permission on a resource with levels. */
-function levelKeys(policy) {
-	const out = [];
-	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
-		if (leaf.kind !== "instance") continue;
-		for (const [level, condition] of policyLevels(policy, leaf.resource)) out.push({
-			key: `${leaf.key}@${level}`,
-			permission: leaf.key,
-			conditioned: !(condition.op === "and" && condition.conditions.length === 0),
-			rowHelper: `permitted_${graphSqlName(leaf.resource) ?? leaf.resource}_row`
-		});
-	}
-	return out;
-}
-/** The branches a row check of a permission reads: its allows and denies, inserts included, for signed-in callers. */
-function rowBranchesOf(branches, resource) {
-	const out = /* @__PURE__ */ new Map();
-	for (const branch of branches) {
-		if (branch.resource !== resource || branch.coverage === true || !branch.roles.includes("authenticated")) continue;
-		out.set(branch.permissionKey, [...out.get(branch.permissionKey) ?? [], branch]);
-	}
-	return out;
-}
-/** What a branch asks of a row: the `with check` of an insert, which sees the new row, the `using` of every other command. */
-function clauseOf(branch) {
-	const clauses = branchClauses(branch);
-	return (branch.command === "insert" ? clauses.check : clauses.using) ?? "true";
-}
-function usingOf(branches) {
-	const parts = branches.map(clauseOf);
-	return parts.length === 0 ? void 0 : orSql(parts);
-}
-function permissionCase(key, branches) {
-	const allow = usingOf(branches.filter((branch) => branch.effect === "allow"));
-	if (allow === void 0) return;
-	const deny = usingOf(branches.filter((branch) => branch.effect === "deny"));
-	const granted = `coalesce((${allow}), false)`;
-	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
-}
-function forUserSql(ctx, fn, helper) {
-	const user = ctx.dialect === "supabase" ? "uuid" : "text";
-	const signature = `${user}, text, jsonb`;
-	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
-returns setof text
-language plpgsql
-volatile
-security definer
-set search_path = ''
-as $$`;
-	const tail = `revoke execute on function ${fn}(${signature}) from public, anon, authenticated;`;
-	if (ctx.dialect === "supabase") return `${head}
-declare
-  v_claims text := pg_catalog.current_setting('request.jwt.claims', true);
-begin
-  perform pg_catalog.set_config(
-    'request.jwt.claims',
-    (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
-    true
-  );
-  return query select r.id from ${helper}(p_permission) r(id);
-  perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
-end
-$$;
-${tail}`;
-	const prefix = ctx.gucPrefix;
-	return `${head}
-declare
-  v_saved jsonb := '{}'::jsonb;
-  v_key text;
-  v_value text;
-begin
-  for v_key, v_value in
-    select 'user_id', p_user
-    union all
-    select c.key, c.value from pg_catalog.jsonb_each_text(coalesce(p_claims, '{}'::jsonb)) c where c.key <> 'user_id'
-  loop
-    v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
-    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
-  end loop;
-  return query select r.id from ${helper}(p_permission) r(id);
-  for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
-    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
-  end loop;
-end
-$$;
-${tail}`;
-}
-function inheritTargets(policy) {
-	const out = /* @__PURE__ */ new Set();
-	for (const grant of policy.grants) for (const item of flattenGrantee(grant.to)) if (item.kind === "inherit") out.add(item.resource);
-	return [...out].toSorted();
-}
-function stubSql(ctx, resource) {
-	return `create or replace function ${qualified(ctx, rowsHelper(resource))}(p_permission text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select null::text where false
-$$;`;
-}
-function rowSql(ctx, rows, table, where) {
-	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
-	return `create or replace function ${fn}(p_row ${table}, p_permission text)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select exists (select 1 from (select (p_row).*) r where ${where})
-$$;
-revoke execute on function ${fn}(${table}, text) from public, anon;
-grant execute on function ${fn}(${table}, text) to authenticated;`;
-}
-function resourceSql(ctx, node, branches, tables) {
-	const name = rowsHelper(node.name);
-	const fn = qualified(ctx, name);
-	const table = quoteQualified(tableFor(node.name, tables));
-	const cases = [...branches.keys()].toSorted().flatMap((key) => {
-		const sql = permissionCase(key, branches.get(key) ?? []);
-		return sql === void 0 ? [] : [sql];
-	});
-	const where = cases.length === 0 ? "false" : `case p_permission\n${cases.join("\n")}\n    else false\n  end`;
-	const rows = `-- ${node.name}: ids of the rows the caller may act on with p_permission, as the table's policies decide it
-create or replace function ${fn}(p_permission text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select ${quoteIdent(node.id)}::text from ${table}
-  where ${where}
-$$;
-revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;
-${rowSql(ctx, name, table, where)}`;
-	if (ctx.dialect === "neon") return rows;
-	return `${rows}
--- the same rows for a user the caller names, with claims it supplies; no client role may execute it
-${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
-}
+//#region src/cli/sql/supautils.ts
 /**
-* `permitted_<resource>_rows(p_permission)` for each resource `select`
-* names (or every resource a grant reaches with `true`): the ids of its rows
-* the caller may read, update or delete with that permission, from the same
-* compiled allows and denies the table policies use, so closure walks, link
-* hops, the restricted stop, `includes`, groups and `requires` all apply. A
-* `security definer` helper, so hand-written policies and functions call it
-* without restating the graph. Outside the `neon` dialect a
-* `permitted_<resource>_rows_for(p_user, p_permission, p_claims)` form runs it
-* as the named user, with the claims the caller supplies, for trusted SQL.
+* `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils
+* 3.4.4).
 */
-function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
-	const names = select === true ? [...new Set(branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(select)];
-	const called = inheritTargets(policy);
-	for (const name of called) if (!names.includes(name)) names.push(name);
-	const chunks = called.map((name) => stubSql(ctx, name));
-	for (const name of names) {
-		const node = policy.resources.get(name);
-		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
-		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), tables));
-	}
-	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
-	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
-}
-//#endregion
-//#region src/cli/sql/supautils.ts
-/** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
 const RESERVED_ROLES = /* @__PURE__ */ new Set([
 	"supabase_admin",
 	"supabase_auth_admin",
@@ -615,7 +778,10 @@ const RESERVED_ROLES = /* @__PURE__ */ new Set([
 	"authenticated",
 	"anon"
 ]);
-/** The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset` their settings. */
+/**
+* The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset`
+* their settings.
+*/
 const CONFIGURABLE_ROLES = /* @__PURE__ */ new Set([
 	"service_role",
 	"authenticator",
@@ -672,9 +838,9 @@ function rejection(text) {
 	return role === void 0 ? void 0 : `grants membership in the reserved role ${role}`;
 }
 /**
-* The statements of `sql` that supautils rejects for a non-superuser:
-* changing or dropping a reserved role, other than `set` or `reset` on the
-* four API roles, and granting a reserved membership.
+* The statements of `sql` that supautils rejects for a non-superuser: changing
+* or dropping a reserved role, other than `set` or `reset` on the four API
+* roles, and granting a reserved membership.
 */
 function supautilsRejections(sql) {
 	return sqlStatements(sql).flatMap(({ line, text }) => {
@@ -686,4 +852,4 @@ function supautilsRejections(sql) {
 	});
 }
 //#endregion
-export { generateOptions as a, buildContext as c, rowHelpersSql as i, DROPPED_LIST as l, inheritTargets as n, isRefusal as o, levelKeys as r, splitsPart as s, supautilsRejections as t, rebuildPlan as u };
+export { buildContext as a, levelKeys as c, rebuildPlan as d, splitsPart as i, rowHelpersSql as l, generateOptions as n, CANDIDATES as o, isRefusal as r, inheritTargets as s, supautilsRejections as t, DROPPED_LIST as u };