-- name: GetNameRuleForLabel :one
-- Exact-label policy lookup, root-scoped first then global (root_claim_id
-- NULL). A NULL root_claim_id argument matches global rules only, since
-- `root_claim_id = NULL` is never true.
SELECT * FROM domains.name_rules
WHERE label = $1
  AND (root_claim_id = sqlc.narg(root_claim_id) OR root_claim_id IS NULL)
ORDER BY root_claim_id NULLS LAST
LIMIT 1;