permdock 0.8.0 → 0.9.0

package/dist/{supabase-BL1qJzzY.js → supabase-DnMMg5Fn.js}

@@ -8,7 +8,7 @@ import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
 import { d as keptKeys, l as roleColumn } from "./sources-CMAM-2A3.js";
-import { t as callRpc } from "./postgrest-D4nuPXIQ.js";
+import { t as callRpc } from "./postgrest-5Dr3W64L.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;

package/dist/{supabase-D39cuGPt.js → supabase-SBs3MYUE.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-H-MtE9Wd.js");
+		const { runSupabase } = await import("./supabase-hook-C0FyEACZ.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-H-MtE9Wd.js");
+		const { runSupabase } = await import("./supabase-hook-C0FyEACZ.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/supabase-hook-C0FyEACZ.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-CrgU06WH.js";

package/dist/{supabase-hook-B-yXnzUl.js → supabase-hook-CrgU06WH.js}

@@ -8,22 +8,22 @@ import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-BL1qJzzY.js";
+import { t as authorizeSql } from "./supabase-DnMMg5Fn.js";
 import "./budget-BELja5A9.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-CMAM-2A3.js";
-import { o as readMemberships } from "./postgrest-D4nuPXIQ.js";
+import { o as readMemberships } from "./postgrest-5Dr3W64L.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-BeHZ4x9Q.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
 import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-Afctg7B0.js";
-import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-DeMNEy6V.js";
-import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
+import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-BqrxBCir.js";
+import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-DA5YdYTm.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-NB4wcyBf.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-ConCSj1y.js";
 import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-D0vUI6dq.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";

package/dist/{supautils-BU-pAEpf.js → supautils-ByezN3b8.js}

@@ -8,15 +8,15 @@ import "./budget-BELja5A9.js";
 import { l as roleColumn } from "./sources-CMAM-2A3.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { b as resolveAuthorize } from "./supabase-hook-B-yXnzUl.js";
+import { b as resolveAuthorize } from "./supabase-hook-CrgU06WH.js";
 import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
-import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DeMNEy6V.js";
-import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-BqrxBCir.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-DA5YdYTm.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
-import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
 import { d as orSql, h as branchClauses } from "./fields-D0vUI6dq.js";
-import { m as tableFor } from "./verify-DZeqoWu5.js";
+import { m as tableFor } from "./verify-DlUcTDBz.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -330,6 +330,243 @@ create trigger ${quoteIdent(trigger)}
 	return `${chunks.join("\n\n")}\n`;
 }
 //#endregion
+//#region src/cli/rls/rows.ts
+/**
+* `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject
+* may act on with one permission.
+*/
+function rowsHelper(resource) {
+	const name = graphSqlName(resource);
+	const helper = `permitted_${name ?? resource}_rows`;
+	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
+	return helper;
+}
+/**
+* Every declared `<permission>@<level>` of an instance permission on a resource
+* with levels.
+*/
+function levelKeys(policy) {
+	const out = [];
+	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
+		if (leaf.kind !== "instance") continue;
+		for (const [level, condition] of policyLevels(policy, leaf.resource)) out.push({
+			key: `${leaf.key}@${level}`,
+			permission: leaf.key,
+			conditioned: !(condition.op === "and" && condition.conditions.length === 0),
+			rowHelper: `permitted_${graphSqlName(leaf.resource) ?? leaf.resource}_row`
+		});
+	}
+	return out;
+}
+/**
+* The branches a row check of a permission reads: its allows and denies,
+* inserts included, for signed-in callers.
+*/
+function rowBranchesOf(branches, resource) {
+	const out = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.resource !== resource || branch.coverage === true || !branch.roles.includes("authenticated")) continue;
+		out.set(branch.permissionKey, [...out.get(branch.permissionKey) ?? [], branch]);
+	}
+	return out;
+}
+/**
+* What a branch asks of a row: the `with check` of an insert, which sees the
+* new row, the `using` of every other command.
+*/
+function clauseOf(branch) {
+	const clauses = branchClauses(branch);
+	return (branch.command === "insert" ? clauses.check : clauses.using) ?? "true";
+}
+function usingOf(branches) {
+	const parts = branches.map(clauseOf);
+	return parts.length === 0 ? void 0 : orSql(parts);
+}
+function permissionCase(key, branches) {
+	const allow = usingOf(branches.filter((branch) => branch.effect === "allow"));
+	if (allow === void 0) return;
+	const deny = usingOf(branches.filter((branch) => branch.effect === "deny"));
+	const granted = `coalesce((${allow}), false)`;
+	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
+}
+function forUserSql(ctx, fn, helper) {
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const signature = `${user}, text, jsonb`;
+	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
+returns setof text
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$`;
+	const tail = `revoke execute on function ${fn}(${signature}) from public, anon, authenticated;`;
+	if (ctx.dialect === "supabase") return `${head}
+declare
+  v_claims text := pg_catalog.current_setting('request.jwt.claims', true);
+begin
+  perform pg_catalog.set_config(
+    'request.jwt.claims',
+    (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
+    true
+  );
+  return query select r.id from ${helper}(p_permission) r(id);
+  perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
+end
+$$;
+${tail}`;
+	const prefix = ctx.gucPrefix;
+	return `${head}
+declare
+  v_saved jsonb := '{}'::jsonb;
+  v_key text;
+  v_value text;
+begin
+  for v_key, v_value in
+    select 'user_id', p_user
+    union all
+    select c.key, c.value from pg_catalog.jsonb_each_text(coalesce(p_claims, '{}'::jsonb)) c where c.key <> 'user_id'
+  loop
+    v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+  return query select r.id from ${helper}(p_permission) r(id);
+  for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+end
+$$;
+${tail}`;
+}
+function inheritTargets(policy) {
+	const out = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) for (const item of flattenGrantee(grant.to)) if (item.kind === "inherit") out.add(item.resource);
+	return [...out].toSorted();
+}
+const CANDIDATES = "permdock_candidates";
+function stubSql(ctx, resource) {
+	const fn = qualified(ctx, rowsHelper(resource));
+	return ["p_permission text", "p_permission text, p_ids text[]"].map((parameters) => `create or replace function ${fn}(${parameters})
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select null::text where false
+$$;`).join("\n");
+}
+function rowSql(ctx, rows, table, where) {
+	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
+	return `create or replace function ${fn}(p_row ${table}, p_permission text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  with ${CANDIDATES} as (select (p_row).*)
+  select exists (select 1 from ${CANDIDATES} where ${where})
+$$;
+revoke execute on function ${fn}(${table}, text) from public, anon;
+grant execute on function ${fn}(${table}, text) to authenticated;`;
+}
+function whereOf(branches) {
+	const cases = [...branches.keys()].toSorted().flatMap((key) => {
+		const sql = permissionCase(key, branches.get(key) ?? []);
+		return sql === void 0 ? [] : [sql];
+	});
+	return cases.length === 0 ? "false" : `case p_permission\n${cases.join("\n")}\n    else false\n  end`;
+}
+function candidatesSql(fn, table, id, where) {
+	const assign = (indent) => `${indent}v_row.${id} := v_id;\n${indent}v_rows := pg_catalog.array_append(v_rows, v_row);`;
+	return `create or replace function ${fn}(p_permission text, p_ids text[])
+returns setof text
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_row ${table};
+  v_rows ${table}[] := '{}';
+  v_id text;
+begin
+  begin
+    foreach v_id in array coalesce(p_ids, '{}') loop
+${assign("      ")}
+    end loop;
+  exception when data_exception then
+    v_rows := '{}';
+    foreach v_id in array p_ids loop
+      begin
+${assign("        ")}
+      exception when data_exception then
+        null;
+      end;
+    end loop;
+  end;
+  return query
+  with ${CANDIDATES} as materialized (
+    select * from ${table} where ${id} = any (array(select (r).${id} from pg_catalog.unnest(v_rows) r))
+  )
+  select ${id}::text from ${CANDIDATES}
+  where ${where};
+end
+$$;
+revoke execute on function ${fn}(text, text[]) from public, anon;
+grant execute on function ${fn}(text, text[]) to authenticated;`;
+}
+function resourceSql(ctx, node, branches, narrowed, tables) {
+	const name = rowsHelper(node.name);
+	const fn = qualified(ctx, name);
+	const table = quoteQualified(tableFor(node.name, tables));
+	const where = whereOf(branches);
+	const near = whereOf(narrowed);
+	const rows = `-- ${node.name}: ids of the rows the caller may act on with p_permission, as the table's policies decide it
+create or replace function ${fn}(p_permission text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${quoteIdent(node.id)}::text from ${table}
+  where ${where}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;
+${candidatesSql(fn, table, quoteIdent(node.id), near)}
+${rowSql(ctx, name, table, near)}`;
+	if (ctx.dialect === "neon") return rows;
+	return `${rows}
+-- the same rows for a user the caller names, with claims it supplies; no client role may execute it
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
+}
+/**
+* `permitted_<resource>_rows(p_permission)` for each resource `select` names
+* (or every resource a grant reaches with `true`): the ids of its rows the
+* caller may read, update or delete with that permission, from the same
+* compiled allows and denies the table policies use, so closure walks, link
+* hops, the restricted stop, `includes`, groups and `requires` all apply. A
+* `security definer` helper, so hand-written policies and functions call it
+* without restating the graph. Outside the `neon` dialect a
+* `permitted_<resource>_rows_for(p_user, p_permission, p_claims)` form runs it
+* as the named user, with the claims the caller supplies, for trusted SQL.
+*/
+function rowHelpersSql(ctx, policy, branches, select, tables, warnings, narrowed = branches) {
+	const names = select === true ? [...new Set(branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(select)];
+	const called = inheritTargets(policy);
+	for (const name of called) if (!names.includes(name)) names.push(name);
+	const chunks = called.map((name) => stubSql(ctx, name));
+	for (const name of names) {
+		const node = policy.resources.get(name);
+		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
+		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), rowBranchesOf(narrowed, name), tables));
+	}
+	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
+	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
+}
+//#endregion
 //#region src/cli/rls/generate-context.ts
 /**
 * The scopes an `rls.migrate` `role` helper names, so `rls generate` writes
@@ -460,7 +697,7 @@ function buildContext(input, policy, options) {
 		} },
 		...options.fieldsMode === void 0 ? {} : { fields: options.fieldsMode },
 		...vias === void 0 ? {} : { vias },
-		...graph.size === 0 ? {} : { graph: {
+		...graph.size === 0 && inheritTargets(policy).length === 0 ? {} : { graph: {
 			closures: closureDepths(graph),
 			resources: policy.resources,
 			...rls?.tables === void 0 ? {} : { tables: tableNames(rls.tables) ?? {} }
@@ -520,196 +757,6 @@ function splitsPart(raw, part) {
 	return typeof split !== "string" && split?.includes(part) === true;
 }
 //#endregion
-//#region src/cli/rls/rows.ts
-/**
-* `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject
-* may act on with one permission.
-*/
-function rowsHelper(resource) {
-	const name = graphSqlName(resource);
-	const helper = `permitted_${name ?? resource}_rows`;
-	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
-	return helper;
-}
-/**
-* Every declared `<permission>@<level>` of an instance permission on a resource
-* with levels.
-*/
-function levelKeys(policy) {
-	const out = [];
-	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
-		if (leaf.kind !== "instance") continue;
-		for (const [level, condition] of policyLevels(policy, leaf.resource)) out.push({
-			key: `${leaf.key}@${level}`,
-			permission: leaf.key,
-			conditioned: !(condition.op === "and" && condition.conditions.length === 0),
-			rowHelper: `permitted_${graphSqlName(leaf.resource) ?? leaf.resource}_row`
-		});
-	}
-	return out;
-}
-/**
-* The branches a row check of a permission reads: its allows and denies,
-* inserts included, for signed-in callers.
-*/
-function rowBranchesOf(branches, resource) {
-	const out = /* @__PURE__ */ new Map();
-	for (const branch of branches) {
-		if (branch.resource !== resource || branch.coverage === true || !branch.roles.includes("authenticated")) continue;
-		out.set(branch.permissionKey, [...out.get(branch.permissionKey) ?? [], branch]);
-	}
-	return out;
-}
-/**
-* What a branch asks of a row: the `with check` of an insert, which sees the
-* new row, the `using` of every other command.
-*/
-function clauseOf(branch) {
-	const clauses = branchClauses(branch);
-	return (branch.command === "insert" ? clauses.check : clauses.using) ?? "true";
-}
-function usingOf(branches) {
-	const parts = branches.map(clauseOf);
-	return parts.length === 0 ? void 0 : orSql(parts);
-}
-function permissionCase(key, branches) {
-	const allow = usingOf(branches.filter((branch) => branch.effect === "allow"));
-	if (allow === void 0) return;
-	const deny = usingOf(branches.filter((branch) => branch.effect === "deny"));
-	const granted = `coalesce((${allow}), false)`;
-	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
-}
-function forUserSql(ctx, fn, helper) {
-	const user = ctx.dialect === "supabase" ? "uuid" : "text";
-	const signature = `${user}, text, jsonb`;
-	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
-returns setof text
-language plpgsql
-volatile
-security definer
-set search_path = ''
-as $$`;
-	const tail = `revoke execute on function ${fn}(${signature}) from public, anon, authenticated;`;
-	if (ctx.dialect === "supabase") return `${head}
-declare
-  v_claims text := pg_catalog.current_setting('request.jwt.claims', true);
-begin
-  perform pg_catalog.set_config(
-    'request.jwt.claims',
-    (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
-    true
-  );
-  return query select r.id from ${helper}(p_permission) r(id);
-  perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
-end
-$$;
-${tail}`;
-	const prefix = ctx.gucPrefix;
-	return `${head}
-declare
-  v_saved jsonb := '{}'::jsonb;
-  v_key text;
-  v_value text;
-begin
-  for v_key, v_value in
-    select 'user_id', p_user
-    union all
-    select c.key, c.value from pg_catalog.jsonb_each_text(coalesce(p_claims, '{}'::jsonb)) c where c.key <> 'user_id'
-  loop
-    v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
-    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
-  end loop;
-  return query select r.id from ${helper}(p_permission) r(id);
-  for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
-    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
-  end loop;
-end
-$$;
-${tail}`;
-}
-function inheritTargets(policy) {
-	const out = /* @__PURE__ */ new Set();
-	for (const grant of policy.grants) for (const item of flattenGrantee(grant.to)) if (item.kind === "inherit") out.add(item.resource);
-	return [...out].toSorted();
-}
-function stubSql(ctx, resource) {
-	return `create or replace function ${qualified(ctx, rowsHelper(resource))}(p_permission text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select null::text where false
-$$;`;
-}
-function rowSql(ctx, rows, table, where) {
-	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
-	return `create or replace function ${fn}(p_row ${table}, p_permission text)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select exists (select 1 from (select (p_row).*) r where ${where})
-$$;
-revoke execute on function ${fn}(${table}, text) from public, anon;
-grant execute on function ${fn}(${table}, text) to authenticated;`;
-}
-function resourceSql(ctx, node, branches, tables) {
-	const name = rowsHelper(node.name);
-	const fn = qualified(ctx, name);
-	const table = quoteQualified(tableFor(node.name, tables));
-	const cases = [...branches.keys()].toSorted().flatMap((key) => {
-		const sql = permissionCase(key, branches.get(key) ?? []);
-		return sql === void 0 ? [] : [sql];
-	});
-	const where = cases.length === 0 ? "false" : `case p_permission\n${cases.join("\n")}\n    else false\n  end`;
-	const rows = `-- ${node.name}: ids of the rows the caller may act on with p_permission, as the table's policies decide it
-create or replace function ${fn}(p_permission text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select ${quoteIdent(node.id)}::text from ${table}
-  where ${where}
-$$;
-revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;
-${rowSql(ctx, name, table, where)}`;
-	if (ctx.dialect === "neon") return rows;
-	return `${rows}
--- the same rows for a user the caller names, with claims it supplies; no client role may execute it
-${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
-}
-/**
-* `permitted_<resource>_rows(p_permission)` for each resource `select` names
-* (or every resource a grant reaches with `true`): the ids of its rows the
-* caller may read, update or delete with that permission, from the same
-* compiled allows and denies the table policies use, so closure walks, link
-* hops, the restricted stop, `includes`, groups and `requires` all apply. A
-* `security definer` helper, so hand-written policies and functions call it
-* without restating the graph. Outside the `neon` dialect a
-* `permitted_<resource>_rows_for(p_user, p_permission, p_claims)` form runs it
-* as the named user, with the claims the caller supplies, for trusted SQL.
-*/
-function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
-	const names = select === true ? [...new Set(branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(select)];
-	const called = inheritTargets(policy);
-	for (const name of called) if (!names.includes(name)) names.push(name);
-	const chunks = called.map((name) => stubSql(ctx, name));
-	for (const name of names) {
-		const node = policy.resources.get(name);
-		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
-		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), tables));
-	}
-	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
-	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
-}
-//#endregion
 //#region src/cli/sql/supautils.ts
 /**
 * `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils
@@ -805,4 +852,4 @@ function supautilsRejections(sql) {
 	});
 }
 //#endregion
-export { generateOptions as a, buildContext as c, rowHelpersSql as i, DROPPED_LIST as l, inheritTargets as n, isRefusal as o, levelKeys as r, splitsPart as s, supautilsRejections as t, rebuildPlan as u };
+export { buildContext as a, levelKeys as c, rebuildPlan as d, splitsPart as i, rowHelpersSql as l, generateOptions as n, CANDIDATES as o, isRefusal as r, inheritTargets as s, supautilsRejections as t, DROPPED_LIST as u };

package/dist/svelte/index.d.ts

@@ -1,11 +1,11 @@
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe } from "../describe-ByS9LgHK.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe } from "../describe-BbFPBSms.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-djVzLlIV.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-C0Kta5Ft.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DZJvxFIZ.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-ByS9LgHK.js";
+import { n as DescribeMessages } from "../describe-BbFPBSms.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { g as ClientStore } from "../types-B_d_g7T3.js";
-import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-djVzLlIV.js";
+import { g as ClientStore } from "../types-tQB2CEnY.js";
+import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/source.d.ts

@@ -1,11 +1,11 @@
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe } from "../describe-ByS9LgHK.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe } from "../describe-BbFPBSms.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-djVzLlIV.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-C0Kta5Ft.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DZJvxFIZ.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { RequestEvent } from "@sveltejs/kit";
 //#region src/sveltekit/create.d.ts
 /**

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/sveltekit/create.ts
 const route = {
 	context: (event) => event,

package/dist/{tables-DeMNEy6V.js → tables-BqrxBCir.js}

@@ -4,7 +4,7 @@ import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } fr
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
 import { l as partitionsOf, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { a as delegatedScopeMap } from "./permdock-L-_I_3zP.js";
+import { a as delegatedScopeMap } from "./permdock-BvjivVb9.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { d as sqlTextArray, i as qualifySqlTable, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-EzEMB-7v.js";

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.d.ts
 type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;

package/dist/tanstack-start/index.js

@@ -1,5 +1,5 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
+import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.ts
 function createPermDock(policy, options) {