permdock 0.9.0 → 0.11.0

package/dist/{powersync-CJrT1DSc.js → powersync-CD8-Ypao.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { c as isConditionDate, l as isConditionRef } from "./refs-C8BKxc_e.js";
+import { c as isConditionDate, l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { g as localSnapshotManifest, j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
@@ -10,16 +10,16 @@ import { u as usageResult } from "./errors-Vpu6rKHl.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
-import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
-import { r as tableNames } from "./tables-BqrxBCir.js";
-import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-DA5YdYTm.js";
+import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
+import { r as tableNames } from "./tables-DimBcVWY.js";
+import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-DlUcTDBz.js";
+import { m as tableFor, t as canFixture } from "./verify-6EauWrkP.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {
@@ -87,7 +87,7 @@ function scopeSourcesOf(sources, name) {
 /** The source's stream form, or why its rows cannot filter a stream. */
 function streamOf(source) {
 	const { stream } = source.sql;
-	if (stream === void 0) return `the ${source.sql.table} membership source has no stream form: build it with tableMembershipSource or junctionMembershipSource`;
+	if (stream === void 0) return `the ${source.sql.table} membership source has no stream form: build it with tableMembershipSource, junctionMembershipSource or blockMembershipSource`;
 	if (stream.expiresAt !== void 0) return `the ${stream.table} membership source has no stream: it has an expiry`;
 	if (stream.disabledAt !== void 0) return `the ${stream.table} membership source has no stream: it has disabledAt`;
 	return stream;
@@ -399,6 +399,65 @@ function customRoleItems(ctx, grants, resource, key, table) {
 	}) };
 }
 //#endregion
+//#region src/cli/powersync/tables.ts
+/**
+* One stream per `powersync.tables` entry: the user's own rows, and the rows
+* that point at a resource row the user reads. A stream of the user's own rows
+* alone carries `user`, so `verify` checks it holds no other user's row.
+*/
+function tableStreams(tables, dialect, taken, permitted) {
+	const streams = [];
+	const warnings = [];
+	const omitted = [];
+	for (const [source, spec] of Object.entries(tables)) {
+		const table = bare(source, dialect);
+		const from = fromTable(source, dialect);
+		const queries = [];
+		const follows = spec.follow ?? [];
+		const invalid = [...spec.user === void 0 ? [] : [spec.user], ...follows.flatMap((follow) => [follow.field, ...Object.keys(follow.match ?? {})])].find((column) => !SQL_IDENT.test(column));
+		if (taken.has(table) || invalid !== void 0) {
+			omitted.push({
+				resource: source,
+				reason: invalid === void 0 ? `a resource stream is named ${table}` : `${invalid} is not a column name`
+			});
+			continue;
+		}
+		if (spec.user !== void 0) queries.push(`SELECT * FROM ${from} WHERE ${dialect.column(table, spec.user)} = ${dialect.user}`);
+		for (const follow of follows) {
+			const { ids, gaps } = permitted(follow.resource);
+			for (const gap of gaps) warnings.push(`${source} under-syncs: ${gap}`);
+			if (ids === void 0) {
+				warnings.push(`${source} does not sync the rows of ${follow.resource}: no grant of its read permission compiles, or it has a deny grant`);
+				continue;
+			}
+			const match = Object.entries(follow.match ?? {}).map(([column, value]) => `${dialect.column(table, column)} = ${dialect.literal(value)}`);
+			for (const query of ids) queries.push(`SELECT * FROM ${from} WHERE ${[`${dialect.column(table, follow.field)} IN (${query})`, ...match].join(" AND ")}`);
+		}
+		if (queries.length === 0) {
+			omitted.push({
+				resource: source,
+				reason: "no query compiles"
+			});
+			continue;
+		}
+		streams.push(spec.user !== void 0 && follows.length === 0 ? {
+			name: table,
+			table,
+			user: spec.user,
+			queries
+		} : {
+			name: table,
+			table,
+			queries
+		});
+	}
+	return {
+		streams,
+		warnings,
+		omitted
+	};
+}
+//#endregion
 //#region src/cli/powersync/streams.ts
 const POWERSYNC = {
 	user: "auth.user_id()",
@@ -419,6 +478,8 @@ const POSTGRES = {
 * than truncated.
 */
 const MAX_QUERIES = 32;
+/** Nested `inherit()` grants a stream follows; a longer chain syncs nothing. */
+const MAX_INHERIT_DEPTH = 4;
 /** Every combination of one clause list from each input, ANDed. */
 function product(lists) {
 	let out = [[]];
@@ -502,15 +563,85 @@ function conditionSql(condition, table, ctx) {
 			return membershipSql(scope, left, condition.roles, ctx);
 		}
 		case "sqlFunction": return conditionSql(condition.twin, table, ctx);
+		case "related": return relatedSql(condition, table, ctx);
 		case "not":
 		case "contains":
-		case "related":
 		case "opaque":
 		case "liveSession": return;
 		default: return condition;
 	}
 }
 /**
+* An `inherit()` condition: the row's `field` among the ids of the `resource`
+* rows the user reaches with `permission`, one nested `IN (SELECT …)` per link
+* hop. A relation reads the closure table, which Sync Streams cannot.
+*/
+function relatedSql(condition, table, ctx) {
+	const { permission } = condition;
+	if (permission === void 0 || condition.relation !== "" || condition.ids !== void 0 || condition.depth > 0 || condition.restrictedAncestors !== void 0 || ctx.depth >= MAX_INHERIT_DEPTH || !SQL_IDENT.test(condition.field)) return;
+	let ids = permittedSql(condition.resource, permission, {
+		...ctx,
+		depth: ctx.depth + 1
+	});
+	const hops = condition.hops ?? [];
+	for (let index = hops.length - 1; index > 0 && ids !== void 0; index -= 1) {
+		const hop = hops[index];
+		const node = ctx.policy.resources.get(hops[index - 1]?.resource ?? "");
+		const link = hop !== void 0 && node !== void 0 && Object.hasOwn(node.links, hop.link) ? node.links[hop.link] : void 0;
+		if (node === void 0 || link === void 0 || !SQL_IDENT.test(node.id) || !SQL_IDENT.test(link.field)) return;
+		const source = tableFor(node.name, tableNames(ctx.config.rls?.tables));
+		const name = bare(source, ctx.dialect);
+		ids = ids.map((query) => `SELECT ${ctx.dialect.column(name, node.id)} FROM ${fromTable(source, ctx.dialect)} WHERE ${ctx.dialect.column(name, link.field)} IN (${query})`);
+	}
+	const open = condition.restricted === void 0 ? [[]] : conditionSql({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: condition.restricted,
+			value: true
+		}, {
+			op: "eq",
+			field: condition.restricted,
+			value: false
+		}]
+	}, table, ctx);
+	if (ids === void 0 || open === void 0) return;
+	const left = ctx.dialect.column(table, condition.field);
+	return product([ids.map((query) => [`${left} IN (${query})`]), open]);
+}
+/**
+* The `SELECT`s of the ids of the `resource` rows the user reaches with `key`:
+* `[]` when no grant gives it, `undefined` when a deny grant could subtract
+* rows or no grant compiles. A grant that does not compile leaves its rows out,
+* which the caller reports as an under-sync.
+*/
+function permittedSql(resource, key, ctx) {
+	const node = ctx.policy.resources.get(resource);
+	const items = ctx.grants.filter((item) => item.grant.permission.key === key);
+	if (node === void 0 || !SQL_IDENT.test(node.id) || items.some((item) => item.grant.effect === "deny")) return;
+	const source = tableFor(resource, tableNames(ctx.config.rls?.tables));
+	const table = bare(source, ctx.dialect);
+	const custom = customRoleItems(ctx, ctx.grants, resource, key, table);
+	if (custom.skipped !== void 0) ctx.gaps.push(custom.skipped);
+	const reaches = [...items.map((item) => ({
+		item,
+		access: unsupported(item) ?? accessSql(item, table, ctx)
+	})), ...custom.items.map((entry) => ({
+		item: entry.item,
+		access: entry.access
+	}))];
+	const queries = /* @__PURE__ */ new Set();
+	for (const { item, access } of reaches) {
+		const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+		if (typeof access === "string" || where === void 0) {
+			ctx.gaps.push(`inherit() of ${key} leaves out ${item.label}: ${typeof access === "string" ? access : "its condition has no Sync Streams form"}`);
+			continue;
+		}
+		for (const clauses of product([access, where])) queries.add(`SELECT ${ctx.dialect.column(table, node.id)} FROM ${fromTable(source, ctx.dialect)}${clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`}`);
+	}
+	return queries.size === 0 && reaches.length > 0 ? void 0 : [...queries];
+}
+/**
 * One `IN (SELECT …)` per role source of the membership table: the row's `left`
 * is an instance the user holds `roles` in.
 */
@@ -758,6 +889,7 @@ function powersyncPlan(policy, config, dialect = POWERSYNC) {
 }
 function planWith(policy, config, dialect) {
 	const scopes = scopeList(policy.scopes);
+	const grants = collectGrants(policy);
 	const ctx = {
 		policy,
 		config,
@@ -765,10 +897,11 @@ function planWith(policy, config, dialect) {
 		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
 		dialect,
 		sources: guardedSources(policy, config),
+		grants,
+		depth: 0,
 		gaps: []
 	};
 	const action = config.powersync?.action ?? "read";
-	const grants = collectGrants(policy);
 	const resources = config.powersync?.resources ?? [...policy.resources.keys()].filter((name) => grants.some((item) => item.grant.permission.resource === name && item.grant.permission.action === action));
 	const streams = [];
 	const omitted = [];
@@ -849,11 +982,22 @@ function planWith(policy, config, dialect) {
 			queries: [...queries]
 		});
 	}
+	const tables = tableStreams(config.powersync?.tables ?? {}, dialect, new Set(streams.map((stream) => stream.name)), (resource) => ({
+		ids: permittedSql(resource, `${resource}.${action}`, ctx),
+		gaps: [...new Set(ctx.gaps.splice(0))]
+	}));
+	warnings.push(...tables.warnings);
+	omitted.push(...tables.omitted);
 	const subject = subjectStreams(ctx);
-	const outside = [...new Set([...streams, ...subject].flatMap((stream) => stream.queries.flatMap((query) => [...query.matchAll(QUOTED_TABLE)].map(([, schema, name]) => `${schema ?? ""}.${name ?? ""}`))))].toSorted();
+	const outside = [...new Set([
+		...streams,
+		...subject,
+		...tables.streams
+	].flatMap((stream) => stream.queries.flatMap((query) => [...query.matchAll(QUOTED_TABLE)].map(([, schema, name]) => `${schema ?? ""}.${name ?? ""}`))))].toSorted();
 	return {
 		streams,
 		subject,
+		tables: tables.streams,
 		omitted,
 		warnings,
 		unsynced,
@@ -862,31 +1006,6 @@ function planWith(policy, config, dialect) {
 		...outside.length === 0 ? {} : { publication: `alter publication powersync add table ${outside.join(", ")};` }
 	};
 }
-/**
-* A YAML scalar quoted as oxfmt and Prettier write it: single quotes around a
-* `"`, unless a backslash needs a double-quoted escape.
-*/
-function yamlString(text) {
-	return text.includes("\"") && !text.includes("\\") ? `'${text.replaceAll("'", "''")}'` : JSON.stringify(text);
-}
-/**
-* `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per
-* synced resource.
-*/
-function powersyncYaml(plan) {
-	const lines = [
-		"# Generated by permdock powersync generate from the policy. Do not edit.",
-		...plan.publication === void 0 ? [] : ["# Tables outside public must be in the powersync publication:", `# ${plan.publication}`],
-		"config:",
-		"  edition: 3",
-		"",
-		"streams:"
-	];
-	if (plan.streams.length === 0 && plan.subject.length === 0) lines[lines.length - 1] = "streams: {}";
-	for (const stream of [...plan.streams, ...plan.subject]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${yamlString(query)}`));
-	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
-	return `${lines.join("\n")}\n`;
-}
 //#endregion
 //#region src/cli/powersync/verify-gaps.ts
 function heldRoles(subject) {
@@ -911,6 +1030,37 @@ function warnedFor(unsynced, permission, subject, customRoles) {
 	});
 }
 //#endregion
+//#region src/cli/powersync/yaml.ts
+/**
+* A YAML scalar quoted as oxfmt and Prettier write it: single quotes around a
+* `"`, unless a backslash needs a double-quoted escape.
+*/
+function yamlString(text) {
+	return text.includes("\"") && !text.includes("\\") ? `'${text.replaceAll("'", "''")}'` : JSON.stringify(text);
+}
+/**
+* `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per
+* synced resource.
+*/
+function powersyncYaml(plan) {
+	const lines = [
+		"# Generated by permdock powersync generate from the policy. Do not edit.",
+		...plan.publication === void 0 ? [] : ["# Tables outside public must be in the powersync publication:", `# ${plan.publication}`],
+		"config:",
+		"  edition: 3",
+		"",
+		"streams:"
+	];
+	if (plan.streams.length === 0 && plan.subject.length === 0 && plan.tables.length === 0) lines[lines.length - 1] = "streams: {}";
+	for (const stream of [
+		...plan.streams,
+		...plan.subject,
+		...plan.tables
+	]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${yamlString(query)}`));
+	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
 //#region src/cli/powersync/powersync.ts
 const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
 permdock powersync verify [--db-url-stdin] [--fixtures rls.fixtures.json]`;
@@ -997,6 +1147,7 @@ async function synced(query, stream, fixture) {
 }
 async function verifyStreams(input) {
 	const plan = powersyncPlan(input.policy, input.config, POSTGRES);
+	const inherited = new Set(collectGrants(input.policy).filter((item) => hasConditionOp(item.where, "related")).map((item) => item.grant.permission.key));
 	const mismatches = [];
 	const notes = [];
 	const client = await input.connect(input.db);
@@ -1007,7 +1158,7 @@ async function verifyStreams(input) {
 		for (const fixture of input.fixtures) {
 			if (checked.has(fixture.subject.id)) continue;
 			checked.add(fixture.subject.id);
-			for (const stream of plan.subject) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
+			for (const stream of [...plan.subject, ...plan.tables]) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
 		}
 		for (const fixture of input.fixtures) {
 			const permission = findPermission(input.policy.permissions, fixture.action);
@@ -1021,6 +1172,7 @@ async function verifyStreams(input) {
 			const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
 			const holds = await synced(query, stream, fixture);
 			if (holds === void 0) notes.push(`${fixture.action} for ${fixture.subject.id}: not checked against stream ${stream.name}: the fixture row has no ${stream.id}`);
+			else if (holds && !granted && inherited.has(permission.key)) notes.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs the row through inherit(), which verify does not check: can() here has no relation source`);
 			else if (holds && !granted) mismatches.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs a row the policy denies`);
 			else if (granted && !holds && warnedFor(plan.unsynced, permission.key, fixture.subject, input.customRoles)) notes.push(`${fixture.action} for ${fixture.subject.id}: granted, not synced (the app reads it from the server)`);
 			else if (granted && !holds) mismatches.push(`${fixture.action} for ${fixture.subject.id}: granted, but stream ${stream.name} does not sync the row and generate gave no warning for it`);

package/dist/{pull-2nJr0qg_.js → pull-CAeaAioC.js}

@@ -5,9 +5,9 @@ import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
 import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as parseSupabaseManifest } from "./manifest-wg8WkkpD.js";
+import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/pull-DfJALUbS.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-CAeaAioC.js";

package/dist/{push-Bn-lMEmI.js → push-Dq_ca4-j.js}

@@ -4,7 +4,7 @@ import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
 import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
 import { i as loadConfiguredPolicy } from "./load-DjSU5KXO.js";
-import { n as parseSupabaseManifest } from "./manifest-wg8WkkpD.js";
+import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
 import { r as pushedPolicy } from "./pushed-policy-CDuOL2de.js";
 import { n as runCatalog } from "./catalog-CGlSwU6j.js";

package/dist/{resolve-names-ConCSj1y.js → resolve-names-Y1Cb22cp.js}

@@ -3,10 +3,10 @@ import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { f as scopeList } from "./scopes-0Up_UA2t.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import "./budget-BELja5A9.js";
-import "./sources-CMAM-2A3.js";
-import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-Afctg7B0.js";
-import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-BqrxBCir.js";
-import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import "./sources-C4vkzZJV.js";
+import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-DrGLwM3s.js";
+import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-DimBcVWY.js";
+import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 //#region src/cli/rls/permission-holders.ts
 /**
 * `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL

package/dist/{rls-Ba9wN0SP.js → rls-BYHN5bcJ.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-Cx0dtsB7.js")).runRls(input);
+	return (await import("./rls-CtRaRrn3.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{rls-Cx0dtsB7.js → rls-CtRaRrn3.js}

@@ -7,26 +7,26 @@ import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { o as sqlFiles } from "./files-BSjrtIHw.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-2nJr0qg_.js";
+import { t as fetchProjectPolicy } from "./pull-CAeaAioC.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { d as schemasRefusal, f as declarativeSql, l as isSupabaseSchemas, o as supabaseHookSql, s as approvalsSql, t as grantsLabel, u as resolveSchemas, v as parseRbacAuthorize, y as rbacScaffold } from "./supabase-hook-CrgU06WH.js";
-import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-Afctg7B0.js";
-import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-BqrxBCir.js";
-import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-DA5YdYTm.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-CyuD9Wau.js";
+import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
 import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
-import { n as permissionHoldersSql } from "./resolve-names-ConCSj1y.js";
-import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-D0vUI6dq.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DlUcTDBz.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-ByezN3b8.js";
+import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
+import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-6EauWrkP.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-C-_jqylY.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -1409,7 +1409,7 @@ function sectionsSql(input, policy, options, built, generated, jsonSchema, warni
 	if (ctx.assignments !== void 0 && (ownership === void 0 || ownership.assigns.length === 0)) warnings.push("rls.assignments needs a role that declares assigns: no assignment trigger is written");
 	let approvals;
 	try {
-		approvals = approvalsSql(ctx, rls?.approvals, jsonSchema ?? false);
+		approvals = approvalsSql(ctx, rls?.approvals, jsonSchema ?? false, readOnlyActorKinds(rls?.readOnlyActors) !== void 0);
 	} catch (cause) {
 		return { refusal: describeError(cause) };
 	}
@@ -2232,6 +2232,13 @@ const WRITES = [
 	"delete"
 ];
 /**
+* `rls generate` inlines the check in its `<table>_<command>_read_only_actors`
+* policies.
+*/
+function inlinesActorCheck(expression) {
+	return expression.includes("'act'") && expression.includes("'read_only'");
+}
+/**
 * Each table and write command whose permissive policies reach `authenticated`
 * (or `public`) without the read-only actor check: no restrictive policy for
 * the command calls `permdock_actor_may_write()`, and some permissive one does
@@ -2245,7 +2252,7 @@ function unguardedWrites(policies, fn) {
 		const permissive = applying.filter((policy) => policy.restrictive !== true && (policy.roles ?? []).some((role) => role === "authenticated" || role === "public"));
 		if (permissive.length === 0) continue;
 		const calls = (expression) => expression.includes(fn);
-		if (!(applying.some((policy) => policy.restrictive === true && calls(policy.expression)) || permissive.every((policy) => calls(policy.expression)))) out.push(rlsFinding("write-unguarded", table, command, `${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`));
+		if (!(applying.some((policy) => policy.restrictive === true && (calls(policy.expression) || inlinesActorCheck(policy.expression))) || permissive.every((policy) => calls(policy.expression)))) out.push(rlsFinding("write-unguarded", table, command, `${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`));
 	}
 	return out;
 }
@@ -2474,7 +2481,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd, PGSQL_PARSER_MAJOR);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-B7oP_sQU.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-BJHxQqT5.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2590,7 +2597,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd, PGSQL_PARSER_MAJOR);
-			const { runRlsImport } = await import("./import-CST57XLp.js");
+			const { runRlsImport } = await import("./import-CNBF96hB.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,

package/dist/run-0vOholnN.js

@@ -0,0 +1 @@
+export { t as run } from "./run-B5nyNKe8.js";

package/dist/{run-PbRlXTfh.js → run-B5nyNKe8.js}

@@ -1,13 +1,13 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { a as resolveCwd, i as readConfig } from "./config-BwPBfN0t.js";
+import { a as resolveCwd, i as readConfig } from "./config-BR23fL8m.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DV5dwOTs.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-CtyBwTNB.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/{run-ticket-Dv7aF7Dk.js → run-ticket-DfnZCh-u.js}

@@ -26,7 +26,8 @@ const RUN_TICKET_CLAIMS = Object.freeze([
 	"automation",
 	"tenant",
 	"trigger",
-	"binding"
+	"binding",
+	"resource"
 ]);
 const RUN_KINDS = [
 	"automation",
@@ -97,6 +98,14 @@ function parseAutomation(value) {
 		version: record["version"]
 	};
 }
+function parseResource(value) {
+	const record = ownRecord(value);
+	if (record === void 0 || !isId(record["type"]) || !isId(record["id"])) return;
+	return {
+		type: record["type"],
+		id: record["id"]
+	};
+}
 function parseBinding(value) {
 	const record = ownRecord(value);
 	if (record === void 0) return;
@@ -140,7 +149,8 @@ function parseBody(record) {
 	const automation = optional(record, "automation", parseAutomation);
 	const trigger = optional(record, "trigger", parseTrigger);
 	const binding = optional(record, "binding", parseBinding);
-	if (!act.ok || !details.ok || !automation.ok || !trigger.ok || !binding.ok || scope === void 0 && details.value === void 0 || kind === "automation" !== (automation.value !== void 0)) return;
+	const resource = optional(record, "resource", parseResource);
+	if (!act.ok || !details.ok || !automation.ok || !trigger.ok || !binding.ok || !resource.ok || scope === void 0 && details.value === void 0 || kind === "automation" !== (automation.value !== void 0)) return;
 	return compact({
 		v: 1,
 		sub,
@@ -151,7 +161,8 @@ function parseBody(record) {
 		automation: automation.value,
 		tenant,
 		trigger: trigger.value,
-		binding: binding.value
+		binding: binding.value,
+		resource: resource.value
 	});
 }
 /**
@@ -218,9 +229,10 @@ function signRunTicket(input, signer, options = {}) {
 		automation: input.automation,
 		tenant: input.tenant,
 		trigger: input.trigger,
-		binding: input.binding
+		binding: input.binding,
+		resource: input.resource
 	}));
-	if (body === void 0) invalid("is invalid: check principal, kind, automation, delegation, trigger and binding");
+	if (body === void 0) invalid("is invalid: check principal, kind, automation, delegation, trigger, binding and resource");
 	if (input.id !== void 0 && !isId(input.id)) invalid("id must be a non-empty string");
 	return signer.sign(body, compact({
 		typ: RUN_TICKET_TYP,
@@ -338,7 +350,8 @@ async function subjectFromRunTicket(token, options) {
 		id: ticket.jti,
 		kind: ticket.kind,
 		automation: ticket.automation,
-		binding: ticket.binding
+		binding: ticket.binding,
+		resource: ticket.resource
 	});
 	return Object.freeze(compact({
 		principal: Object.freeze({

package/dist/{run-ticket-B2o2Kxz8.d.ts → run-ticket-ylovhyFQ.d.ts}

@@ -24,6 +24,14 @@ type RunAutomation = {
   readonly id: string;
   readonly version: number | string;
 };
+/**
+ * The record a run is bound to. `authorization_details` carries the binding as
+ * `identifier`; this claim names it for the adapter and the audit trail.
+ */
+type RunResource = {
+  readonly type: string;
+  readonly id: string;
+};
 /**
  * The v1 claims of a `vnd.permdock.run+jwt`. At least one of `scope` and
  * `authorization_details` is present.
@@ -49,6 +57,7 @@ type RunTicket = {
    */
   readonly trigger?: Readonly<Record<string, unknown>>;
   readonly binding?: RunBinding;
+  readonly resource?: RunResource;
 };
 /**
  * Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps. A
@@ -70,6 +79,11 @@ type RunTicketInput = {
   readonly tenant?: string;
   readonly trigger?: Readonly<Record<string, unknown>>;
   readonly binding?: RunBinding;
+  /**
+   * The record the run is bound to. Narrow `delegation` to it with an
+   * `authorization_details` `identifier`; this claim grants nothing.
+   */
+  readonly resource?: RunResource;
   /** `jti`; a fresh UUID when absent. */
   readonly id?: string;
   /** Lifetime in whole seconds. Exactly one of `expiresIn` and `expiresAt`. */
@@ -113,6 +127,7 @@ type RunContext = {
   readonly kind: RunKind;
   readonly automation?: RunAutomation;
   readonly binding?: RunBinding;
+  readonly resource?: RunResource;
 };
 /** The principal of a run subject, with the verified ticket attached. */
 type RunPrincipal = Principal & {
@@ -141,4 +156,4 @@ declare function signRunTicket(input: RunTicketInput, signer: TokenSigner, optio
  */
 declare function subjectFromRunTicket(token: string | undefined | null, options: RunTicketSubjectOptions): Promise<Subject<RunPrincipal>>;
 //#endregion
-export { RunContext as a, RunTicket as c, RunTicketInput as d, RunTicketOptions as f, subjectFromRunTicket as g, signRunTicket as h, RunBinding as i, RunTicketAutomations as l, parseRunTicket as m, RunActClaim as n, RunKind as o, RunTicketSubjectOptions as p, RunAutomation as r, RunPrincipal as s, RUN_TICKET_CLAIMS as t, RunTicketFailureCause as u };
+export { subjectFromRunTicket as _, RunContext as a, RunResource as c, RunTicketFailureCause as d, RunTicketInput as f, signRunTicket as g, parseRunTicket as h, RunBinding as i, RunTicket as l, RunTicketSubjectOptions as m, RunActClaim as n, RunKind as o, RunTicketOptions as p, RunAutomation as r, RunPrincipal as s, RUN_TICKET_CLAIMS as t, RunTicketAutomations as u };

package/dist/{scan-CRTj6fke.js → scan-CvFWW_fU.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-Ch07MdxN.js");
+		const { runAdoptionScan } = await import("./adoption-scan-DKCOsfcF.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-BTsE1WRT.js → schema-CQzIJdEd.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";