okmodel 0.5.1 → 0.6.0

package/dist/runtime/tenancy/index.js

@@ -1,17 +1,34 @@
+import {
+  markPathEndpoint
+} from "../../shared/rhs3xe4k.js";
+import {
+  tenantPolicyExpression,
+  unscopedPolicyExpression,
+  policyObject
+} from "../../shared/bdk4sty6.js";
+import {
+  isRelationCall
+} from "../../shared/k68eedmy.js";
 import {
   uuid2
-} from "../../shared/dyj86cmj.js";
+} from "../../shared/2jd1sn0e.js";
+import {
+  index2,
+  snakeCase
+} from "../../shared/rpycarcr.js";
 import {
   ColumnBuilder2,
   retarget
-} from "../../shared/c9z5g0fm.js";
+} from "../../shared/ywr8hmey.js";
 import {
-  definition,
-  unavailable
+  definition
 } from "../../shared/tmbdywx0.js";
+import {
+  quoteLiteral
+} from "../../shared/94ez8kzh.js";
 import {
   quote
-} from "../../shared/gbtcc2d7.js";
+} from "../../shared/2z7wv5tj.js";
 import {
   assertIdentifier2
 } from "../../shared/nfzc5z0w.js";
@@ -19,6 +36,1438 @@ import {
   OkmError2
 } from "../../shared/52szzakm.js";
 
+// src/runtime/tenancy/composite.ts
+function compositeTenancy(input) {
+  if (input === undefined || typeof input !== "object") {
+    definition("compositeTenancy() needs { key, type }.");
+  }
+  if (input.type !== "uuid") {
+    definition(`compositeTenancy() type ${String(input.type)} must be uuid.`);
+  }
+  const keys = readKeys(input.key);
+  const key = keys[0] ?? "";
+  const columns = keys.map(() => uuid2().guarded());
+  const encodes = columns.map((column) => column.state.encode);
+  const tenants = new Set;
+  const globals = new Map;
+  const exemptions = new Map;
+  const encodeKey = (name, value) => {
+    const at = keys.indexOf(name);
+    const encode = at < 0 ? undefined : encodes[at];
+    return encode === undefined ? value : encode(value);
+  };
+  const api = {
+    key,
+    keys,
+    type: "uuid",
+    strategy: "composite",
+    rewrite(tables) {
+      tenants.clear();
+      globals.clear();
+      exemptions.clear();
+      return rewriteTables(keys, columns, encodes, api, tables, tenants, globals, exemptions);
+    },
+    column: () => columns[0] ?? uuid2().guarded(),
+    predicate(spec) {
+      return writePredicate(keys, tenants, spec, encodeKey);
+    },
+    guard(table, field, kind) {
+      if (!tenants.has(table) || !keys.includes(field))
+        return;
+      refuseKey(kind, table, field);
+    },
+    stamp(table, rows, scope) {
+      if (!tenants.has(table))
+        return;
+      stampRows(keys, table, rows, scope);
+    },
+    client(spec) {
+      const names = spec.scoped ? spec.names : spec.names.filter((name) => !tenants.has(name));
+      if (spec.scoped)
+        return { names };
+      return { names, ...bindClient(keys, encodes, spec.open) };
+    },
+    rules(table, source, scope) {
+      return tenancyRules(table, source, scope, tenants, globals, exemptions);
+    },
+    scopeView(name) {
+      tenants.add(name);
+    },
+    hook(target, ctx) {
+      if (ctx.tables === undefined || ctx.names === undefined || ctx.open === undefined || ctx.scoped === undefined) {
+        return;
+      }
+      const view = api.client({ names: ctx.names, scoped: ctx.scoped, open: ctx.open });
+      if (!ctx.scoped) {
+        for (const name of ctx.names) {
+          if (view.names.includes(name))
+            continue;
+          delete ctx.tables[name];
+          delete target[name];
+        }
+      }
+      if (view.for !== undefined)
+        target.for = view.for;
+      if (view.unscoped !== undefined)
+        target.unscoped = view.unscoped;
+    },
+    missing(table) {
+      throw new OkmError2("OKM1701", `Table ${table} is tenant-scoped. Call for({ ${keys.join(", ")} }) or unscoped("reason").`);
+    }
+  };
+  return api;
+}
+function rewriteTables(keys, columns, encodes, api, tables, tenants, globals, exemptions) {
+  const kind = new Map;
+  const swapped = new Map;
+  const extras = new Map;
+  for (const item of tables) {
+    const options = item.options;
+    const mark = options?.tenancy;
+    if (mark === undefined) {
+      kind.set(item.name, "tenant");
+      continue;
+    }
+    if (isGlobal(mark)) {
+      kind.set(item.name, "global");
+      globals.set(item.name, mark.reason);
+      continue;
+    }
+    if (isRecord(mark) && typeof mark.rewrite === "function") {
+      const ctx = { tables, keys, encodes, api, extras };
+      swapped.set(item.name, mark.rewrite(item, ctx));
+      kind.set(item.name, "path");
+      continue;
+    }
+    definition(`Table ${item.name} tenancy must be global("reason") or via().`);
+  }
+  return tables.map((item) => {
+    const next = swapped.get(item.name);
+    if (next !== undefined)
+      return next;
+    if (kind.get(item.name) === "global") {
+      refuseGlobalReference(item, kind);
+      return item;
+    }
+    return rewriteTenant(keys, columns, item, tables, kind, tenants, exemptions, extras);
+  });
+}
+function refuseGlobalReference(item, kind) {
+  for (const [field, builder] of Object.entries(item.columns)) {
+    if (!(builder instanceof ColumnBuilder2))
+      continue;
+    const reference = builder.state.references;
+    if (reference !== undefined && kind.get(reference.table) === "tenant") {
+      throw new OkmError2("OKM1705", `Table ${item.name}.${field} is global and references tenant table ${reference.table}. Drop the reference, or make ${item.name} a tenant table.`);
+    }
+  }
+}
+function rewriteTenant(keys, keyColumns, item, tables, kind, tenants, exemptions, extras) {
+  for (const key of keys) {
+    if (Object.hasOwn(item.columns, key)) {
+      throw new OkmError2("OKM1012", `Table ${item.name} already declares ${key}, which tenancy adds. Rename the field or drop it from the table.`);
+    }
+  }
+  const options = item.options;
+  const columns = {};
+  const unique = {};
+  const named = options?.unique;
+  if (named !== undefined) {
+    for (const [name, fields] of Object.entries(named)) {
+      unique[name] = covers(fields, keys) ? fields : [...keys, ...fields];
+    }
+  }
+  const notes = [];
+  for (const [field, builder] of Object.entries(item.columns)) {
+    if (!(builder instanceof ColumnBuilder2)) {
+      columns[field] = builder;
+      continue;
+    }
+    const patch = {};
+    if (builder.state.primaryKey === true)
+      patch.dropPrimary = true;
+    const flag = builder.state.unique;
+    if (flag !== undefined) {
+      if (flag.global === true) {
+        const reason = flag.reason?.trim() ?? "";
+        if (reason.length === 0) {
+          definition(`Unique ${item.name}.${field} sets global and needs a reason.`);
+        }
+        notes.push({ name: field, reason });
+      } else {
+        patch.dropUnique = true;
+        unique[field] = [...keys, field];
+      }
+    }
+    const reference = builder.state.references;
+    if (reference !== undefined) {
+      const widened = widenReference(keys, item.name, field, reference, tables, kind);
+      if (widened !== undefined)
+        patch.references = widened;
+    }
+    const changed = patch.dropUnique === true || patch.dropPrimary === true || patch.references !== undefined;
+    columns[field] = changed ? retarget(builder, patch) : builder;
+  }
+  const primary = primaryFields(item);
+  const primaryKey = primary.length > 0 && !covers(primary, keys) ? [...primary, ...keys] : undefined;
+  if (primaryKey !== undefined)
+    unique[`${primary.join("_")}_${keys.join("_")}`] = primaryKey;
+  const declared = extras.get(item.name);
+  if (declared !== undefined && declared.length > 0 && unique[declared.join("_")] === undefined) {
+    unique[declared.join("_")] = declared;
+  }
+  for (let index = 0;index < keys.length; index += 1) {
+    const name = keys[index];
+    const column = keyColumns[index];
+    if (name !== undefined && column !== undefined)
+      columns[name] = column;
+  }
+  tenants.add(item.name);
+  if (notes.length > 0)
+    exemptions.set(item.name, notes);
+  const indexes = wrapIndexes(keys[0] ?? "", item.name, options?.indexes);
+  const rewritten = {
+    ...item,
+    columns,
+    options: {
+      ...options,
+      ...primaryKey !== undefined ? { primaryKey } : {},
+      ...Object.keys(unique).length > 0 ? { unique } : {},
+      ...indexes !== undefined ? { indexes } : {}
+    }
+  };
+  return declared !== undefined && declared.length > 0 ? markPathEndpoint(rewritten) : rewritten;
+}
+function covers(fields, keys) {
+  for (const key of keys)
+    if (!fields.includes(key))
+      return false;
+  return true;
+}
+function widenReference(keys, table, field, reference, tables, kind) {
+  const targetKind = kind.get(reference.table);
+  if (targetKind !== "tenant")
+    return;
+  const action = [reference.onDelete, reference.onUpdate].find((item) => item === "set null" || item === "set default");
+  if (action !== undefined) {
+    definition(`Foreign key ${table}.${field} includes ${keys.join(", ")}, so ${action} cannot clear it. Accepted actions: cascade, restrict, no action.`);
+  }
+  const target = tables.find((item) => item.name === reference.table);
+  const remote = reference.columns ?? (target === undefined ? undefined : primaryFields(target));
+  if (remote === undefined || remote.length === 0)
+    return;
+  const along = [...reference.along ?? []];
+  let columns = remote;
+  if (!covers(remote, keys))
+    columns = [...remote, ...keys];
+  for (const key of keys)
+    if (!along.includes(key))
+      along.push(key);
+  if (covers(remote, keys) && covers(reference.along ?? [], keys))
+    return;
+  return { ...reference, columns, along };
+}
+function primaryFields(item) {
+  const listed = item.options?.primaryKey;
+  if (listed !== undefined && listed.length > 0)
+    return [...listed];
+  const fields = [];
+  for (const [field, builder] of Object.entries(item.columns)) {
+    if (builder instanceof ColumnBuilder2 && builder.state.primaryKey === true)
+      fields.push(field);
+  }
+  return fields;
+}
+function wrapIndexes(key, table, build) {
+  if (build === undefined)
+    return;
+  return (columns) => {
+    const calls = build(columns);
+    const tenantSql = columns[key]?.name;
+    if (!Array.isArray(calls) || tenantSql === undefined)
+      return calls;
+    for (const call of calls) {
+      if (call.columns[0] === tenantSql)
+        continue;
+      throw new OkmError2("OKM1706", `Index on ${table} starts with ${call.columns[0] ?? "no column"}. Put ${tenantSql} first.`);
+    }
+    return calls;
+  };
+}
+function writePredicate(keys, tenants, input, encodeKey) {
+  if (!tenants.has(input.table))
+    return false;
+  const scope = input.scope;
+  if (scope === undefined) {
+    throw new OkmError2("OKM1701", `Table ${input.table} is tenant-scoped. Call for({ ${keys.join(", ")} }) or unscoped("reason").`);
+  }
+  if ("unscoped" in scope) {
+    input.sink.mark("unscoped|");
+    return false;
+  }
+  for (let index = 0;index < keys.length; index += 1) {
+    const key = keys[index];
+    if (key === undefined)
+      continue;
+    const sql = input.fieldSql(key);
+    if (sql === undefined) {
+      throw new OkmError2("OKM1701", `Table ${input.table} is missing its tenant key ${key}.`);
+    }
+    input.sink.text(index === 0 ? input.appended ? " and " : " where " : " and ");
+    input.sink.text(input.alias);
+    input.sink.text(".");
+    input.sink.text(quote(sql));
+    input.sink.text(" = ");
+    const raw = scope.values?.[key] ?? scope.value;
+    const encoded = keys.length === 1 && input.encode !== undefined ? input.encode(raw) : encodeKey(key, raw);
+    input.sink.param(encoded);
+  }
+  input.sink.mark("tenant|");
+  return true;
+}
+function refuseKey(kind, table, field) {
+  if (kind === "insert") {
+    throw new OkmError2("OKM1190", `Field ${table}.${field} is the tenant key. The scope sets it. Input cannot.`);
+  }
+  if (kind === "update") {
+    throw new OkmError2("OKM1704", `Field ${table}.${field} is the tenant key. An update cannot change it.`);
+  }
+  throw new OkmError2("OKM1704", `Field ${table}.${field} is the tenant key. A filter cannot set it.`);
+}
+function stampRows(keys, table, rows, scope) {
+  requireScope(keys, table, scope);
+  if (scope === undefined || "unscoped" in scope)
+    return;
+  for (const row of rows) {
+    for (const key of keys)
+      row[key] = scope.values?.[key] ?? scope.value;
+  }
+}
+function requireScope(keys, table, scope) {
+  if (scope === undefined || "unscoped" in scope) {
+    throw new OkmError2("OKM1701", `insert on ${table} has no tenant. Call for({ ${keys.join(", ")} }) so the scope can set it.`);
+  }
+}
+function bindClient(keys, encodes, openScope) {
+  const list = keys.join(", ");
+  return {
+    for: (input) => {
+      if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        throw new OkmError2("OKM1701", `for() needs { ${list} }.`);
+      }
+      const record = input;
+      const values = {};
+      for (let index = 0;index < keys.length; index += 1) {
+        const key = keys[index];
+        if (key === undefined)
+          continue;
+        const value = record[key];
+        if (typeof value !== "string" || value.length === 0) {
+          throw new OkmError2("OKM1701", `for() needs { ${list} } as a uuid.`);
+        }
+        const encode = encodes[index];
+        if (encode !== undefined)
+          encode(value);
+        values[key] = value;
+      }
+      for (const name of Object.keys(record)) {
+        if (keys.includes(name))
+          continue;
+        throw new OkmError2("OKM1701", `for() accepts ${list}. ${name} is not the tenant key.`);
+      }
+      const first = keys[0] ?? "";
+      return openScope(keys.length === 1 ? { value: values[first] ?? "" } : { value: values[first] ?? "", values });
+    },
+    unscoped: (reason) => {
+      if (typeof reason !== "string" || reason.trim().length === 0) {
+        throw new OkmError2("OKM1701", "unscoped() needs a reason.");
+      }
+      return openScope({ unscoped: reason.trim() });
+    }
+  };
+}
+function tenancyRules(table, source, scope, tenants, globals, exemptions) {
+  const rules = [];
+  const reason = globals.get(table);
+  if (reason !== undefined) {
+    rules.push({
+      rule: "tenancy",
+      contribution: `global ${reason}`,
+      provenance: "catalog",
+      ...source !== undefined ? { source } : {}
+    });
+  }
+  const notes = exemptions.get(table);
+  if (notes !== undefined) {
+    for (const item of notes) {
+      rules.push({
+        rule: "tenancy",
+        contribution: `unique ${item.name} global ${item.reason}`,
+        provenance: "catalog",
+        ...source !== undefined ? { source } : {}
+      });
+    }
+  }
+  if (tenants.has(table) && scope !== undefined && "value" in scope) {
+    rules.push({ rule: "tenancy", contribution: "scoped", provenance: "planner" });
+  }
+  if (scope !== undefined && "unscoped" in scope) {
+    rules.push({
+      rule: "tenancy",
+      contribution: `unscoped ${scope.unscoped}`,
+      provenance: "caller"
+    });
+  }
+  return rules;
+}
+function readKeys(key) {
+  if (!Array.isArray(key) || key.length === 0) {
+    definition('compositeTenancy() key must be a list of field names, such as ["organizationId", "workspaceId"].');
+  }
+  const keys = [];
+  for (const name of key) {
+    if (typeof name !== "string" || name.length === 0) {
+      definition("compositeTenancy() key must be a field name.");
+    }
+    if (keys.includes(name))
+      definition(`compositeTenancy() key repeats ${name}.`);
+    assertIdentifier2(name, "tenancy key");
+    keys.push(name);
+  }
+  const first = keys[0];
+  if (first === undefined)
+    definition("compositeTenancy() key needs a field name.");
+  return keys;
+}
+function isGlobal(value) {
+  return isRecord(value) && value.kind === "global" && typeof value.reason === "string";
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// src/runtime/tenancy/path.ts
+var MAX_HOPS = 3;
+function compilePaths(tables, kind) {
+  const chains = new Map;
+  const endpoints = new Map;
+  for (const item of tables) {
+    if (kind.get(item.name) !== "path")
+      continue;
+    const via = viaOf(item);
+    const hops = resolve(item, via, tables, kind, new Set([item.name]));
+    chains.set(item.name, { via, hops });
+    const last = hops[hops.length - 1];
+    if (last === undefined)
+      continue;
+    const parent = tables.find((table) => table.name === last.parent);
+    const declared = parent === undefined ? [] : declaredPrimary(parent);
+    if (declared.length === 0) {
+      pathError(`Table ${item.name} tenancy via "${via}" ends at ${last.parent}, which has no primary key.`);
+    }
+    endpoints.set(last.parent, declared);
+  }
+  return {
+    endpoints,
+    isPath: (name) => chains.has(name),
+    hops: (name) => chains.get(name)?.hops,
+    adjust: (item) => adjust(item, chains.get(item.name), kind, tables),
+    writeExists: (input) => writeExists(chains.get(input.table), input)
+  };
+}
+function viaOf(item) {
+  const mark = item.options?.tenancy;
+  if (!isRecord2(mark) || typeof mark.via !== "string" || mark.via.trim().length === 0) {
+    pathError(`Table ${item.name} tenancy via needs a relation path.`);
+  }
+  return mark.via.trim();
+}
+function resolve(item, via, tables, kind, seen) {
+  const segments = via.split(".");
+  if (segments.length > MAX_HOPS) {
+    pathError(`Table ${item.name} tenancy via "${via}" is longer than 3 hops.`);
+  }
+  const hops = [];
+  let current = item;
+  for (const segment of segments) {
+    if (segment.length === 0) {
+      pathError(`Table ${item.name} tenancy via "${via}" has an empty step.`);
+    }
+    const relations = current.options?.relations;
+    const call = relations?.[segment];
+    if (!isRelationCall(call) || call.kind !== "one") {
+      pathError(`Table ${current.name} tenancy via "${via}" has no to-one relation ${segment}.`);
+    }
+    if (seen.has(call.table)) {
+      pathError(`Table ${item.name} tenancy via "${via}" cycles at ${call.table}.`);
+    }
+    const parent = tables.find((table) => table.name === call.table);
+    if (parent === undefined) {
+      pathError(`Table ${current.name} tenancy via "${via}" names ${call.table}, which is not in the schema.`);
+    }
+    const localField = localOf(current, call.field, parent.name, segment, via);
+    const remoteField = remoteOf(parent, localField, current, via);
+    seen.add(parent.name);
+    hops.push({
+      child: current.name,
+      parent: parent.name,
+      localField,
+      remoteField,
+      localSql: sqlNameOf(current, localField),
+      remoteSql: sqlNameOf(parent, remoteField),
+      parentSql: parent.options?.sqlName,
+      encode: encodeOf(current, localField)
+    });
+    current = parent;
+  }
+  const end = kind.get(current.name);
+  if (end !== "tenant") {
+    pathError(`Table ${item.name} tenancy via "${via}" ends at ${current.name}, which is not a tenant table.`);
+  }
+  return hops;
+}
+function localOf(table, field, parent, segment, via) {
+  if (field !== undefined) {
+    if (!Object.hasOwn(table.columns, field)) {
+      pathError(`Table ${table.name} relation ${segment} names ${field}, which is not a column.`);
+    }
+    return field;
+  }
+  const found = [];
+  for (const [name, builder] of Object.entries(table.columns)) {
+    if (!(builder instanceof ColumnBuilder2))
+      continue;
+    if (builder.state.references?.table === parent)
+      found.push(name);
+  }
+  const only = found.length === 1 ? found[0] : undefined;
+  if (only === undefined) {
+    pathError(`Table ${table.name} tenancy via "${via}" cannot tell which column points at ${parent}. Name it on ${segment}.`);
+  }
+  return only;
+}
+function remoteOf(parent, localField, child, via) {
+  const builder = child.columns[localField];
+  const named = builder instanceof ColumnBuilder2 ? builder.state.references?.columns : undefined;
+  if (named !== undefined && named.length === 1 && named[0] !== undefined)
+    return named[0];
+  if (named !== undefined && named.length !== 1) {
+    pathError(`Table ${child.name} tenancy via "${via}" points ${localField} at ${String(named.length)} columns on ${parent.name}.`);
+  }
+  const declared = declaredPrimary(parent);
+  if (declared.length !== 1 || declared[0] === undefined) {
+    pathError(`Table ${child.name} tenancy via "${via}" needs one primary column on ${parent.name}.`);
+  }
+  return declared[0];
+}
+function adjust(item, chain, kind, tables) {
+  if (chain === undefined)
+    return item;
+  const first = chain.hops[0];
+  const options = item.options;
+  const columns = { ...item.columns };
+  for (const hop of chain.hops) {
+    if (hop.child !== item.name)
+      continue;
+    if (kind.get(hop.parent) !== "tenant")
+      continue;
+    const builder = columns[hop.localField];
+    if (!(builder instanceof ColumnBuilder2) || builder.state.references === undefined)
+      continue;
+    const parent = tables.find((table) => table.name === hop.parent);
+    const declared = parent === undefined ? [hop.remoteField] : declaredPrimary(parent);
+    columns[hop.localField] = retarget(builder, {
+      references: { ...builder.state.references, columns: declared }
+    });
+  }
+  const field = first?.localField;
+  const indexes = field === undefined ? options?.indexes : leadingIndex(item.name, field, options?.indexes);
+  return {
+    ...item,
+    columns,
+    options: {
+      ...options,
+      ...indexes !== undefined ? { indexes } : {}
+    }
+  };
+}
+function leadingIndex(table, field, previous) {
+  return (columns) => {
+    const handle = columns[field];
+    if (handle === undefined) {
+      throw new OkmError2("OKM1706", `Index on ${table} does not lead with ${field}. Put ${field} first.`);
+    }
+    const calls = previous === undefined ? [] : previous(columns);
+    if (!Array.isArray(calls))
+      return calls;
+    if (calls.some((call) => call.columns[0] === handle.name))
+      return calls;
+    return [index2(handle), ...calls];
+  };
+}
+function writeExists(chain, input) {
+  if (chain === undefined)
+    return false;
+  const scope = input.scope;
+  if (scope === undefined) {
+    throw new OkmError2("OKM1701", `Table ${input.table} is tenant-scoped. Call for({ ${input.keys.join(", ")} }) or unscoped("reason").`);
+  }
+  if ("unscoped" in scope) {
+    input.sink.mark("unscoped|");
+    return false;
+  }
+  input.sink.text(input.appended ? " and " : " where ");
+  const snake = snakeOn(chain, input.fieldSql);
+  emitHop(chain, 0, input, snake, scope);
+  input.sink.mark("tenant|");
+  return true;
+}
+function emitHop(chain, index, input, snake, scope) {
+  const hop = chain.hops[index];
+  if (hop === undefined)
+    return;
+  const parentAlias = `p${String(index)}`;
+  const last = index === chain.hops.length - 1;
+  input.sink.text("exists (select 1 from ");
+  input.sink.text(quote(tableSql(hop.parent, hop.parentSql, snake)));
+  input.sink.text(" ");
+  input.sink.text(parentAlias);
+  input.sink.text(" where ");
+  input.sink.text(parentAlias);
+  input.sink.text(".");
+  input.sink.text(quote(columnSql(hop.remoteField, hop.remoteSql, snake)));
+  input.sink.text(" = ");
+  const assigned = index === 0 ? input.assigned?.[hop.localField] : undefined;
+  if (assigned !== undefined) {
+    input.sink.param(assigned);
+  } else {
+    const qualifier = index === 0 ? input.alias : `p${String(index - 1)}`;
+    input.sink.text(qualifier);
+    input.sink.text(".");
+    input.sink.text(quote(columnSql(hop.localField, hop.localSql, snake)));
+  }
+  if (!last) {
+    input.sink.text(" and ");
+    emitHop(chain, index + 1, input, snake, scope);
+  } else {
+    for (const key of input.keys) {
+      input.sink.text(" and ");
+      input.sink.text(parentAlias);
+      input.sink.text(".");
+      input.sink.text(quote(columnSql(key, undefined, snake)));
+      input.sink.text(" = ");
+      const raw = scope.values?.[key] ?? scope.value;
+      input.sink.param(input.encodeKey(key, raw));
+    }
+    if (input.lock)
+      input.sink.text(" for share");
+  }
+  input.sink.text(")");
+}
+function snakeOn(chain, fieldSql) {
+  const hop = chain.hops[0];
+  if (hop === undefined || hop.localSql !== undefined)
+    return false;
+  const live = fieldSql(hop.localField);
+  const snake = snakeCase(hop.localField);
+  return live !== undefined && live === snake && live !== hop.localField;
+}
+function columnSql(field, explicit, snake) {
+  if (explicit !== undefined)
+    return explicit;
+  return snake ? snakeCase(field) : field;
+}
+function tableSql(name, explicit, snake) {
+  if (explicit !== undefined)
+    return explicit;
+  return snake ? snakeCase(name) : name;
+}
+function declaredPrimary(item) {
+  const listed = item.options?.primaryKey;
+  if (listed !== undefined && listed.length > 0)
+    return [...listed];
+  const fields = [];
+  for (const [field, builder] of Object.entries(item.columns)) {
+    if (builder instanceof ColumnBuilder2 && builder.state.primaryKey === true)
+      fields.push(field);
+  }
+  return fields;
+}
+function sqlNameOf(table, field) {
+  const builder = table.columns[field];
+  if (!(builder instanceof ColumnBuilder2))
+    return;
+  return builder.state.sqlName;
+}
+function encodeOf(table, field) {
+  const builder = table.columns[field];
+  if (!(builder instanceof ColumnBuilder2))
+    return (value) => value;
+  const encode = builder.state.encode;
+  return (value) => encode(value);
+}
+function pathError(message) {
+  throw new OkmError2("OKM1705", message);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/runtime/tenancy/via.ts
+var slots = new WeakMap;
+var compiled = new WeakMap;
+function via(path) {
+  if (typeof path !== "string" || path.trim().length === 0) {
+    definition("via() needs a relation path.");
+  }
+  const text = path.trim();
+  return {
+    via: text,
+    rewrite(table, ctx) {
+      return planFor(ctx).adjust(table);
+    }
+  };
+}
+function planFor(ctx) {
+  const cached = compiled.get(ctx.extras);
+  if (cached !== undefined)
+    return cached;
+  const plan = compilePaths(ctx.tables, classify(ctx.tables));
+  for (const [name, declared] of plan.endpoints) {
+    if (declared.length > 0)
+      ctx.extras.set(name, declared);
+  }
+  const encodeKey = (name, value) => {
+    const at = ctx.keys.indexOf(name);
+    const encode = at < 0 ? undefined : ctx.encodes[at];
+    return encode === undefined ? value : encode(value);
+  };
+  let slot = slots.get(ctx.api);
+  if (slot === undefined) {
+    slot = { plan, keys: ctx.keys, encodeKey };
+    slots.set(ctx.api, slot);
+    install(ctx.api, slot);
+  } else {
+    slot.plan = plan;
+    slot.keys = ctx.keys;
+    slot.encodeKey = encodeKey;
+  }
+  compiled.set(ctx.extras, plan);
+  return plan;
+}
+function classify(tables) {
+  const kind = new Map;
+  for (const item of tables) {
+    const mark = item.options?.tenancy;
+    if (isGlobal2(mark)) {
+      kind.set(item.name, "global");
+      continue;
+    }
+    if (isRecord3(mark) && typeof mark.via === "string" && typeof mark.rewrite === "function") {
+      kind.set(item.name, "path");
+      continue;
+    }
+    kind.set(item.name, "tenant");
+  }
+  return kind;
+}
+function install(api, slot) {
+  const previousPredicate = api.predicate.bind(api);
+  const previousStamp = api.stamp.bind(api);
+  const previousClient = api.client.bind(api);
+  const previousRules = api.rules.bind(api);
+  const target = api;
+  target.predicate = (spec) => {
+    if (!slot.plan.isPath(spec.table))
+      return previousPredicate(spec);
+    return slot.plan.writeExists({
+      table: spec.table,
+      alias: spec.alias,
+      fieldSql: spec.fieldSql,
+      scope: spec.scope,
+      sink: spec.sink,
+      appended: spec.appended,
+      lock: false,
+      keys: slot.keys,
+      encodeKey: slot.encodeKey
+    }) === true;
+  };
+  target.isPath = (table) => slot.plan.isPath(table);
+  target.pathOf = (table) => slot.plan.hops(table)?.map((hop) => ({
+    child: hop.child,
+    parent: hop.parent,
+    localField: hop.localField,
+    remoteField: hop.remoteField
+  }));
+  target.lockPredicate = (spec) => {
+    if (!slot.plan.isPath(spec.table))
+      return false;
+    return slot.plan.writeExists({
+      table: spec.table,
+      alias: spec.alias,
+      fieldSql: spec.fieldSql,
+      scope: spec.scope,
+      sink: spec.sink,
+      appended: false,
+      lock: true,
+      keys: slot.keys,
+      encodeKey: slot.encodeKey
+    });
+  };
+  target.noteParent = (table, set, sink, scope, fieldSql) => {
+    const hop = slot.plan.hops(table)?.[0];
+    if (hop === undefined)
+      return;
+    if (scope === undefined || "unscoped" in scope)
+      return;
+    const assigned = {};
+    const next = set[hop.localField];
+    if (typeof next === "string")
+      assigned[hop.localField] = hop.encode(next);
+    slot.plan.writeExists({
+      table,
+      alias: "t",
+      fieldSql,
+      scope,
+      sink,
+      appended: true,
+      lock: true,
+      keys: slot.keys,
+      encodeKey: slot.encodeKey,
+      ...Object.keys(assigned).length > 0 ? { assigned } : {}
+    });
+  };
+  target.stamp = (table, rows, scope) => {
+    if (slot.plan.isPath(table)) {
+      requireScope2(slot.keys, table, scope);
+      return;
+    }
+    previousStamp(table, rows, scope);
+  };
+  target.client = (spec) => {
+    const view = previousClient(spec);
+    if (spec.scoped)
+      return view;
+    return { ...view, names: view.names.filter((name) => !slot.plan.isPath(name)) };
+  };
+  target.rules = (table, source, scope) => pathRules(previousRules(table, source, scope), slot, table, source, scope);
+}
+function pathRules(rules, slot, table, source, scope) {
+  const hops = slot.plan.hops(table);
+  if (hops === undefined)
+    return rules;
+  const next = [...rules];
+  next.push({
+    rule: "tenancy",
+    contribution: `path ${hops.map((hop) => hop.parent).join(".")}`,
+    provenance: "catalog",
+    ...source !== undefined ? { source } : {}
+  });
+  if (scope !== undefined && "value" in scope && !next.some((rule) => rule.contribution === "scoped")) {
+    next.push({ rule: "tenancy", contribution: "scoped", provenance: "planner" });
+  }
+  return next;
+}
+function requireScope2(keys, table, scope) {
+  if (scope === undefined || "unscoped" in scope) {
+    throw new OkmError2("OKM1701", `insert on ${table} has no tenant. Call for({ ${keys.join(", ")} }) so the scope can set it.`);
+  }
+}
+function isGlobal2(value) {
+  return isRecord3(value) && value.kind === "global" && typeof value.reason === "string";
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// src/runtime/tenancy/rls.ts
+var ROLE_MESSAGE = {
+  owner: "The connected role owns the tenant tables, so row-level security would not apply.",
+  superuser: "The connected role is a superuser, so row-level security would not apply.",
+  bypassrls: "The connected role has BYPASSRLS, so row-level security would not apply."
+};
+
+class RlsRoleError extends OkmError2 {
+  reason;
+  constructor(reason, endpoint) {
+    const named = endpoint === undefined ? ROLE_MESSAGE[reason] : `${ROLE_MESSAGE[reason]} Endpoint ${endpoint}.`;
+    super("OKM1707", named, {
+      fix: {
+        summary: "Connect as a role that is not the table owner, a superuser, or BYPASSRLS. okm seed under rlsTenancy runs as the application role. The owner gets this error."
+      }
+    });
+    this.name = "OkmError";
+    this.reason = reason;
+  }
+}
+var TRAIT = "okm.rls";
+var WRAPPED = Symbol("okmodel.rls.wrapped");
+var INNER = Symbol("okmodel.rls.inner");
+var guardChecks = new WeakMap;
+var scopeStates = new WeakMap;
+function openColumn(key) {
+  return columnTenancy({
+    key,
+    type: "uuid"
+  });
+}
+function statementOf(text, params) {
+  return params === undefined ? { text } : { text, params };
+}
+function rlsTenancy(input) {
+  if (input === undefined || typeof input !== "object") {
+    throw new OkmError2("OKM1060", "rlsTenancy() needs { key, type }.", {
+      fix: { summary: 'Pass rlsTenancy({ key: "tenantId", type: "uuid" }).' }
+    });
+  }
+  if (Array.isArray(input.key)) {
+    throw new OkmError2("OKM1060", "rlsTenancy() takes one key. Combining it with compositeTenancy or via() is not supported yet.", {
+      fix: {
+        summary: "Use rlsTenancy() on its own, with one key. compositeTenancy() and via() are separate strategies."
+      }
+    });
+  }
+  const base = openColumn(input.key);
+  const key = base.key;
+  let checker;
+  let armedFor;
+  const api = {
+    ...base,
+    strategy: "rls",
+    rewrite(tables) {
+      refuseVia(tables);
+      const next = base.rewrite(tables);
+      for (const item of tables) {
+        if (isTenantTable(item))
+          attachTrait(item, key);
+      }
+      return next;
+    },
+    hook(target, ctx) {
+      if (ctx.table !== undefined) {
+        arm(ctx, key, (check, session) => {
+          checker = check;
+          armedFor = session;
+        }, armedFor);
+        return;
+      }
+      base.hook(target, ctx);
+      if (checker !== undefined) {
+        target["~rls"] = checker;
+        checker = undefined;
+        armedFor = undefined;
+      }
+    }
+  };
+  return api;
+}
+async function runReadOnly(conn, text, params, prelude, options) {
+  await conn.execute("begin read only");
+  try {
+    await conn.execute(prelude.text, prelude.params);
+    const result = await conn.execute(text, params, options);
+    await conn.execute("commit");
+    return result;
+  } catch (error) {
+    await conn.execute("rollback").catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+async function* streamHeld(conn, text, params, prelude) {
+  await conn.execute("begin read only");
+  try {
+    await conn.execute(prelude.text, prelude.params);
+    await conn.execute(`declare okm_rls no scroll cursor for ${text}`, params);
+    for (;; ) {
+      const chunk = await conn.execute("fetch 64 from okm_rls");
+      if (chunk.rows.length === 0)
+        break;
+      yield chunk.rows;
+    }
+    await conn.execute("close okm_rls");
+    await conn.execute("commit");
+  } catch (error) {
+    await conn.execute("rollback").catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+function refuseVia(tables) {
+  for (const item of tables) {
+    const mark = item.options?.tenancy;
+    if (isRecord4(mark) && typeof mark.rewrite === "function") {
+      throw new OkmError2("OKM1060", `Table ${item.name} uses via() with rlsTenancy(). Combining them is not supported yet.`, {
+        fix: {
+          summary: "Use rlsTenancy() on its own, with one key. via() and compositeTenancy() are separate strategies."
+        }
+      });
+    }
+  }
+}
+function isTenantTable(item) {
+  const mark = item.options?.tenancy;
+  return mark === undefined;
+}
+function attachTrait(item, key) {
+  const trait = policyTrait(item.name, key);
+  const record = item;
+  if (record.options === undefined) {
+    Object.assign(item, { options: { traits: [trait] } });
+    return;
+  }
+  const traits = record.options.traits;
+  if (!Array.isArray(traits)) {
+    record.options.traits = [trait];
+    return;
+  }
+  if (traits.some((entry) => isRecord4(entry) && entry.name === TRAIT))
+    return;
+  traits.push(trait);
+}
+function policyTrait(tsName, key) {
+  return {
+    name: TRAIT,
+    fields: {},
+    apply() {
+      return;
+    },
+    contribute(_peers, built) {
+      if (!Array.isArray(built))
+        return [];
+      const objects = built;
+      const parent = objects.find((object) => object.kind === "table" && object.provenance.name === tsName);
+      if (parent === undefined || parent.kind !== "table")
+        return [];
+      const ref = { namespace: parent.identity.namespace, name: parent.identity.name };
+      if (objects.some((object) => object.kind === "policy" && object.identity.parent.name === ref.name)) {
+        return [];
+      }
+      const column = objects.find((object) => object.kind === "column" && object.identity.parent.name === ref.name && (object.identity.name === key || object.identity.name === snakeCase(key)));
+      if (column === undefined || column.kind !== "column") {
+        throw new OkmError2("OKM1020", `Table ${tsName} is missing the ${key} column row-level security needs.`);
+      }
+      const provenance = { origin: "trait", name: "rls" };
+      const expression = tenantPolicyExpression(column.identity.name, column.definition.dataType);
+      return [
+        policyObject({
+          parent: ref,
+          name: `${ref.name}_tenant`,
+          command: "all",
+          expression,
+          force: true,
+          provenance
+        }),
+        policyObject({
+          parent: ref,
+          name: `${ref.name}_unscoped_select`,
+          command: "select",
+          expression: unscopedPolicyExpression(),
+          force: true,
+          provenance
+        })
+      ];
+    }
+  };
+}
+function arm(ctx, key, remember, armedFor) {
+  const session = ctx.session;
+  if (!isSession(session) || session === armedFor)
+    return;
+  const raw = innerPool(session.pool);
+  const tables = tenantTables(session.schema.model, key);
+  remember(() => checkEndpoint(raw, "primary", 0, tables), session);
+  if (session.scope === undefined || isWrapped(session.pool))
+    return;
+  session.pool = wrapPool(session.pool, session.scope, session.tx !== undefined, tables);
+}
+function isSession(value) {
+  if (value === undefined)
+    return false;
+  const pool = value.pool;
+  return typeof pool === "object" && pool !== null && "execute" in pool;
+}
+function tenantTables(model, key) {
+  const snake = snakeCase(key);
+  const tables = [];
+  for (const table of Object.values(model)) {
+    if (table.primary.length === 0)
+      continue;
+    const column = table.columns.find((item) => item.field === key || item.sql === snake);
+    if (column?.dataType === undefined)
+      continue;
+    tables.push({ name: table.sql, column: column.sql, dataType: column.dataType });
+  }
+  return tables;
+}
+function isWrapped(pool) {
+  return WRAPPED in pool;
+}
+function innerPool(pool) {
+  const inner = pool[INNER];
+  return inner ?? pool;
+}
+function rootPool(pool) {
+  let current = pool;
+  for (;; ) {
+    const inner = current[INNER];
+    if (inner === undefined)
+      return current;
+    current = inner;
+  }
+}
+function wrapPool(inner, scope, inside, tables) {
+  const setting = settingOf(scope);
+  const unscoped = "unscoped" in scope;
+  installGuard(inner, tables);
+  const ensure = () => inner.okmGuardInstalled === true ? Promise.resolve() : checkEndpoint(inner, "primary", 0, tables);
+  const state = inside ? scopeState(rootPool(inner)) : undefined;
+  if (state !== undefined)
+    queueScope(inner, scope, state);
+  const arm = () => state === undefined ? Promise.resolve() : ensureScope(inner, scope, state);
+  const wrapped = {
+    capabilities: inner.capabilities,
+    execute: async (text, params, options) => {
+      await ensure();
+      if (unscoped && isWriteSql(text))
+        unscopedWrite();
+      if (inside) {
+        if (state === undefined) {
+          await arm();
+          return inner.execute(text, params, options);
+        }
+        const release = await acquire(state);
+        try {
+          await ensureScope(inner, scope, state);
+          return await inner.execute(text, params, options);
+        } finally {
+          release();
+        }
+      }
+      if (isReadSql(text))
+        return runScopedRead(inner, text, params, setting, options);
+      const results = await inner.batch([setting, statementOf(text, params)], options);
+      const result = results[1];
+      if (result === undefined) {
+        throw new OkmError2("OKM1111", "The driver returned no result for the statement.", {
+          fix: { summary: "Use a Postgres driver that returns one result per batched statement." }
+        });
+      }
+      return result;
+    },
+    batch: async (statements, options) => {
+      await ensure();
+      if (unscoped && statements.some((statement) => isWriteSql(statement.text)))
+        unscopedWrite();
+      if (inside) {
+        if (state === undefined) {
+          await arm();
+          return inner.batch(statements, options);
+        }
+        const release = await acquire(state);
+        try {
+          await ensureScope(inner, scope, state);
+          return await inner.batch(statements, options);
+        } finally {
+          release();
+        }
+      }
+      if (statements.length > 0 && statements.every((statement) => isReadSql(statement.text))) {
+        const results = [];
+        for (const statement of statements) {
+          results.push(await runScopedRead(inner, statement.text, statement.params, setting, options));
+        }
+        return results;
+      }
+      const results = await inner.batch([setting, ...statements.map((statement) => statementOf(statement.text, statement.params))], options);
+      return results.slice(1);
+    },
+    stats: () => inner.stats(),
+    close: () => inner.close()
+  };
+  if (state !== undefined)
+    bindScopeHooks(inner, wrapped, state);
+  if (inner.reserve !== undefined)
+    wrapped.reserve = () => inner.reserve();
+  if (inner.describe !== undefined) {
+    wrapped.describe = (text, params) => inner.describe(text, params);
+  }
+  if (inner.listen !== undefined)
+    wrapped.listen = (channel, onNotify) => inner.listen(channel, onNotify);
+  if (inner.cancel !== undefined)
+    wrapped.cancel = () => inner.cancel();
+  if (inner.stream !== undefined || inner.okmReadOnlyStream !== undefined) {
+    wrapped.stream = (text, params) => streamScoped(inner, text, params, setting, scope, inside, unscoped, ensure, arm, state);
+  }
+  Object.defineProperty(wrapped, WRAPPED, { value: true });
+  Object.defineProperty(wrapped, INNER, { value: inner });
+  return wrapped;
+}
+function settingOf(scope) {
+  if ("unscoped" in scope)
+    return { text: "select set_config('app.unscoped', 'on', true)" };
+  return { text: "select set_config('app.tenant', $1, true)", params: [scope.value] };
+}
+async function runScopedRead(inner, text, params, setting, options) {
+  const unit = inner.okmReadOnlyUnit;
+  if (unit !== undefined)
+    return unit(text, params, setting, options);
+  if (inner.reserve === undefined) {
+    throw new OkmError2("OKM1111", "Row-level security needs a driver that can reserve a connection.", {
+      fix: { summary: "Use a Postgres driver that supports interactive transactions." }
+    });
+  }
+  const conn = await inner.reserve();
+  try {
+    return await runReadOnly(conn, text, params, setting, options);
+  } finally {
+    await conn.release();
+  }
+}
+function streamScoped(inner, text, params, setting, scope, inside, unscoped, ensure, arm, state) {
+  return async function* () {
+    await ensure();
+    if (unscoped && isWriteSql(text))
+      unscopedWrite();
+    const routed = inner.okmReadOnlyStream;
+    if (!inside && isReadSql(text) && routed !== undefined) {
+      yield* routed(text, params, setting, undefined);
+      return;
+    }
+    if (inside) {
+      if (inner.stream === undefined) {
+        throw new OkmError2("OKM1111", "stream() inside tx() needs a driver stream.", {
+          fix: { summary: "Stream outside the transaction, or read with find()." }
+        });
+      }
+      if (state === undefined) {
+        await arm();
+        yield* inner.stream(text, params);
+        return;
+      }
+      const release = await acquire(state);
+      try {
+        await ensureScope(inner, scope, state);
+        yield* inner.stream(text, params);
+      } finally {
+        release();
+      }
+      return;
+    }
+    if (inner.reserve === undefined) {
+      throw new OkmError2("OKM1111", "Row-level security needs a driver that can reserve a connection.", {
+        fix: { summary: "Use a Postgres driver that supports interactive transactions." }
+      });
+    }
+    const conn = await inner.reserve();
+    try {
+      yield* streamHeld(conn, text, params, setting);
+    } finally {
+      await conn.release();
+    }
+  }();
+}
+function scopeState(pool) {
+  let state = scopeStates.get(pool);
+  if (state === undefined) {
+    state = { last: undefined, pending: undefined, epoch: 0, chain: Promise.resolve() };
+    scopeStates.set(pool, state);
+  }
+  return state;
+}
+function acquire(state) {
+  const previous = state.chain;
+  let release = () => {
+    return;
+  };
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  state.chain = previous.then(() => gate, () => gate);
+  return previous.then(() => release, () => release);
+}
+function scopeKey(scope) {
+  return "unscoped" in scope ? `unscoped:${scope.unscoped}` : scope.value;
+}
+function queueScope(inner, scope, state) {
+  const key = scopeKey(scope);
+  if (state.last === key || state.pending !== undefined)
+    return;
+  const setting = settingOf(scope);
+  const run = inner.execute(setting.text, setting.params).then(() => {
+    if (state.pending === run)
+      state.pending = undefined;
+  });
+  state.pending = run;
+  run.catch(() => {
+    if (state.pending === run)
+      state.pending = undefined;
+  });
+}
+async function ensureScope(inner, scope, state) {
+  const key = scopeKey(scope);
+  const pending = state.pending;
+  if (pending !== undefined)
+    await pending;
+  if (state.last === key)
+    return;
+  const epoch = state.epoch;
+  const setting = settingOf(scope);
+  await inner.execute(setting.text, setting.params);
+  if (state.epoch !== epoch)
+    return;
+  state.last = key;
+}
+function bindScopeHooks(inner, wrapped, state) {
+  const hooks = {
+    okmForgetScope() {
+      state.epoch += 1;
+      state.last = undefined;
+      state.pending = undefined;
+      state.chain = Promise.resolve();
+    },
+    okmScopePending() {
+      return state.pending;
+    }
+  };
+  Object.assign(inner, hooks);
+  Object.assign(wrapped, hooks);
+}
+function installGuard(inner, tables) {
+  const routed = inner;
+  if (routed.okmEndpoints === undefined || routed.okmGuardInstalled === true)
+    return;
+  const guard = (endpoint) => checkEndpoint(endpoint.pool, endpoint.name, endpoint.generation, tables);
+  for (const endpoint of routed.okmEndpoints()) {
+    endpoint.pool.okmGuard = guard;
+  }
+  routed.okmGuardInstalled = true;
+}
+function checkEndpoint(pool, endpoint, generation, tables) {
+  let generations = guardChecks.get(pool);
+  if (generations === undefined) {
+    generations = new Map;
+    guardChecks.set(pool, generations);
+  }
+  const existing = generations.get(generation);
+  if (existing !== undefined)
+    return existing;
+  const pending = verifyEndpoint(pool, endpoint, tables);
+  generations.set(generation, pending);
+  pending.catch(() => {
+    if (generations.get(generation) === pending)
+      generations.delete(generation);
+  });
+  return pending;
+}
+async function verifyEndpoint(pool, endpoint, tables) {
+  const idents = tables.length === 0 ? "" : tables.map((table) => quoteLiteral(quotedIdent(table.name))).join(", ");
+  const names = idents.length === 0 ? "" : `array[${idents}]::text[]`;
+  const owns = names.length === 0 ? "false" : `exists (
+          select 1
+          from unnest(${names}) as owned_name(relname)
+          join pg_class owned on owned.oid = to_regclass(owned_name.relname)
+          where owned.relkind = 'r'
+            and owned.relowner = r.oid
+        )`;
+  const policies = names.length === 0 ? "" : `, c.relname, c.relrowsecurity::text, c.relforcerowsecurity::text, p.polname, coalesce(pg_get_expr(p.polqual, p.polrelid), ''), coalesce(pg_get_expr(p.polwithcheck, p.polrelid), '')`;
+  const join = names.length === 0 ? "" : ` left join unnest(${names}) as listed(relname) on true left join pg_class c on c.oid = to_regclass(listed.relname) and c.relkind = 'r' left join pg_policy p on p.polrelid = c.oid`;
+  const result = await pool.execute(`select r.rolsuper::text, r.rolbypassrls::text, (${owns})::text${policies} from pg_roles r${join} where r.rolname = current_user`);
+  const row = result.rows[0];
+  if (row === undefined) {
+    throw new OkmError2("OKM1707", `The connected role is not visible in pg_roles. Endpoint ${endpoint}.`, {
+      fix: {
+        summary: "Connect as a role that is not the table owner, a superuser, or BYPASSRLS. okm seed under rlsTenancy runs as the application role. The owner gets this error."
+      }
+    });
+  }
+  if (row[0] === "true")
+    throw new RlsRoleError("superuser", endpoint);
+  if (row[1] === "true")
+    throw new RlsRoleError("bypassrls", endpoint);
+  if (row[2] === "true")
+    throw new RlsRoleError("owner", endpoint);
+  if (tables.length === 0)
+    return;
+  assertPolicyRows(result.rows, tables, endpoint);
+}
+function assertPolicyRows(rows, tables, endpoint) {
+  const live = new Map;
+  for (const row of rows) {
+    const name = row[3];
+    if (name === undefined || name === null || name.length === 0)
+      continue;
+    let table = live.get(name);
+    if (table === undefined) {
+      table = {
+        rowsecurity: row[4] ?? "",
+        force: row[5] ?? "",
+        policies: new Map
+      };
+      live.set(name, table);
+    }
+    const policy = row[6];
+    if (policy === undefined || policy === null || policy.length === 0)
+      continue;
+    table.policies.set(policy, { using: row[7] ?? "", check: row[8] ?? "" });
+  }
+  for (const table of tables) {
+    const found = live.get(table.name);
+    if (found === undefined || found.rowsecurity !== "true") {
+      policyError(table.name, "is missing forced row-level security.", endpoint);
+    }
+    if (found.force !== "true") {
+      policyError(table.name, "does not force row-level security.", endpoint);
+    }
+    const tenant = tenantPolicyExpression(table.column, table.dataType);
+    const unscoped = unscopedPolicyExpression();
+    const tenantPolicy = found.policies.get(`${table.name}_tenant`);
+    const unscopedPolicy = found.policies.get(`${table.name}_unscoped_select`);
+    if (tenantPolicy === undefined || tenantPolicy.using !== tenant || tenantPolicy.check !== tenant) {
+      policyError(table.name, `policy ${table.name}_tenant does not match the tenant predicate.`, endpoint);
+    }
+    if (unscopedPolicy === undefined || unscopedPolicy.using !== unscoped || unscopedPolicy.check !== "") {
+      policyError(table.name, `policy ${table.name}_unscoped_select does not match the unscoped predicate.`, endpoint);
+    }
+    if (found.policies.size !== 2) {
+      policyError(table.name, "has a row-level security policy okm did not emit.", endpoint);
+    }
+  }
+}
+function policyError(table, detail, endpoint) {
+  throw new OkmError2("OKM1708", `Table ${table} ${detail} Endpoint ${endpoint}.`, {
+    table,
+    fix: { summary: "Restore the policies okm generate emits for this rls schema." }
+  });
+}
+function quotedIdent(name) {
+  return `"${name.replaceAll('"', '""')}"`;
+}
+function unscopedWrite() {
+  throw new OkmError2("OKM1701", "unscoped() cannot write under row-level security.", {
+    fix: {
+      summary: "Cross-tenant writes belong to the migration role. Use for() to write as one tenant."
+    }
+  });
+}
+function isWriteSql(text) {
+  const sql = text.trimStart().toLowerCase().replace(/\s+/g, " ");
+  if (/^(insert|update|delete|refresh|truncate|create|alter|drop|grant|revoke|copy)\b/.test(sql)) {
+    return true;
+  }
+  return sql.startsWith("with ") && /\b(insert|update|delete)\b/.test(sql);
+}
+function isReadSql(text) {
+  const sql = text.trimStart().toLowerCase().replace(/\s+/g, " ");
+  if (/^(select|values|table|show|explain)\b/.test(sql)) {
+    return !/\sfor (no key update|key share|update|share)\b/.test(sql);
+  }
+  return sql.startsWith("with ") && !/\b(insert|update|delete)\b/.test(sql);
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/runtime/tenancy/index.ts
 function global(reason) {
   if (typeof reason !== "string" || reason.trim().length === 0) {
@@ -51,30 +1500,30 @@ function columnTenancy(input) {
       tenants.clear();
       globals.clear();
       exemptions.clear();
-      return rewriteTables(key, column, tables, tenants, globals, exemptions);
+      return rewriteTables2(key, column, encode, api, tables, tenants, globals, exemptions);
     },
     column: () => column,
     predicate(spec) {
-      return writePredicate(key, tenants, spec);
+      return writePredicate2(key, tenants, spec);
     },
     guard(table, field, kind) {
       if (!tenants.has(table) || field !== key)
         return;
-      refuseKey(kind, table, field);
+      refuseKey2(kind, table, field);
     },
     stamp(table, rows, scope) {
       if (!tenants.has(table))
         return;
-      stampRows(key, table, rows, scope);
+      stampRows2(key, table, rows, scope);
     },
     client(spec) {
       const names = spec.scoped ? spec.names : spec.names.filter((name) => !tenants.has(name));
       if (spec.scoped)
         return { names };
-      return { names, ...bindClient(key, encode, spec.open) };
+      return { names, ...bindClient2(key, encode, spec.open) };
     },
     rules(table, source, scope) {
-      return tenancyRules(table, source, scope, tenants, globals, exemptions);
+      return tenancyRules2(table, source, scope, tenants, globals, exemptions);
     },
     scopeView(name) {
       tenants.add(name);
@@ -103,8 +1552,10 @@ function columnTenancy(input) {
   };
   return api;
 }
-function rewriteTables(key, column, tables, tenants, globals, exemptions) {
+function rewriteTables2(key, column, encode, api, tables, tenants, globals, exemptions) {
   const kind = new Map;
+  const swapped = new Map;
+  const extras = new Map;
   for (const item of tables) {
     const options = item.options;
     const mark = options?.tenancy;
@@ -112,26 +1563,37 @@ function rewriteTables(key, column, tables, tenants, globals, exemptions) {
       kind.set(item.name, "tenant");
       continue;
     }
-    if (isGlobal(mark)) {
+    if (isGlobal3(mark)) {
       kind.set(item.name, "global");
       globals.set(item.name, mark.reason);
       continue;
     }
-    if (isRecord(mark) && "via" in mark) {
-      unavailable(`Table ${item.name} tenancy via is not available yet. It arrives later.`);
+    if (isRecord5(mark) && typeof mark.rewrite === "function") {
+      swapped.set(item.name, mark.rewrite(item, {
+        tables,
+        keys: [key],
+        encodes: [encode],
+        api,
+        extras
+      }));
+      kind.set(item.name, "path");
+      continue;
     }
-    definition(`Table ${item.name} tenancy must be global("reason").`);
+    definition(`Table ${item.name} tenancy must be global("reason") or via().`);
   }
   return tables.map((item) => {
+    const next = swapped.get(item.name);
+    if (next !== undefined)
+      return next;
     if (kind.get(item.name) !== "tenant") {
       if (kind.get(item.name) === "global")
-        refuseGlobalReference(item, kind);
+        refuseGlobalReference2(item, kind);
       return item;
     }
-    return rewriteTenant(key, column, item, tables, kind, tenants, exemptions);
+    return rewriteTenant2(key, column, item, tables, kind, tenants, exemptions, extras);
   });
 }
-function refuseGlobalReference(item, kind) {
+function refuseGlobalReference2(item, kind) {
   for (const [field, builder] of Object.entries(item.columns)) {
     if (!(builder instanceof ColumnBuilder2))
       continue;
@@ -141,7 +1603,7 @@ function refuseGlobalReference(item, kind) {
     }
   }
 }
-function rewriteTenant(key, column, item, tables, kind, tenants, exemptions) {
+function rewriteTenant2(key, column, item, tables, kind, tenants, exemptions, extras) {
   if (Object.hasOwn(item.columns, key)) {
     throw new OkmError2("OKM1012", `Table ${item.name} already declares ${key}, which tenancy adds. Rename the field or drop it from the table.`);
   }
@@ -178,23 +1640,27 @@ function rewriteTenant(key, column, item, tables, kind, tenants, exemptions) {
     }
     const reference = builder.state.references;
     if (reference !== undefined) {
-      const widened = widenReference(key, item.name, field, reference, tables, kind);
+      const widened = widenReference2(key, item.name, field, reference, tables, kind);
       if (widened !== undefined)
         patch.references = widened;
     }
     const changed = patch.dropUnique === true || patch.dropPrimary === true || patch.references !== undefined;
     columns[field] = changed ? retarget(builder, patch) : builder;
   }
-  const primary = primaryFields(item);
+  const primary = primaryFields2(item);
   const primaryKey = primary.length > 0 && !primary.includes(key) ? [...primary, key] : undefined;
   if (primaryKey !== undefined)
     unique[`${primary.join("_")}_${key}`] = primaryKey;
+  const noted = extras.get(item.name);
+  if (noted !== undefined && noted.length > 0 && unique[noted.join("_")] === undefined) {
+    unique[noted.join("_")] = noted;
+  }
   columns[key] = column;
   tenants.add(item.name);
   if (notes.length > 0)
     exemptions.set(item.name, notes);
-  const indexes = wrapIndexes(key, item.name, options?.indexes);
-  return {
+  const indexes = wrapIndexes2(key, item.name, options?.indexes);
+  const rewritten = {
     ...item,
     columns,
     options: {
@@ -204,8 +1670,9 @@ function rewriteTenant(key, column, item, tables, kind, tenants, exemptions) {
       ...indexes !== undefined ? { indexes } : {}
     }
   };
+  return noted !== undefined && noted.length > 0 ? markPathEndpoint(rewritten) : rewritten;
 }
-function widenReference(key, table, field, reference, tables, kind) {
+function widenReference2(key, table, field, reference, tables, kind) {
   const targetKind = kind.get(reference.table);
   if (targetKind !== "tenant")
     return;
@@ -214,7 +1681,7 @@ function widenReference(key, table, field, reference, tables, kind) {
     definition(`Foreign key ${table}.${field} includes ${key}, so ${action} cannot clear it. Accepted actions: cascade, restrict, no action.`);
   }
   const target = tables.find((item) => item.name === reference.table);
-  const remote = reference.columns ?? (target === undefined ? undefined : primaryFields(target));
+  const remote = reference.columns ?? (target === undefined ? undefined : primaryFields2(target));
   if (remote === undefined || remote.length === 0)
     return;
   if (remote.includes(key)) {
@@ -228,7 +1695,7 @@ function widenReference(key, table, field, reference, tables, kind) {
     along: [...reference.along ?? [], key]
   };
 }
-function primaryFields(item) {
+function primaryFields2(item) {
   const listed = item.options?.primaryKey;
   if (listed !== undefined && listed.length > 0)
     return [...listed];
@@ -239,7 +1706,7 @@ function primaryFields(item) {
   }
   return fields;
 }
-function wrapIndexes(key, table, build) {
+function wrapIndexes2(key, table, build) {
   if (build === undefined)
     return;
   return (columns) => {
@@ -255,7 +1722,7 @@ function wrapIndexes(key, table, build) {
     return calls;
   };
 }
-function writePredicate(key, tenants, input) {
+function writePredicate2(key, tenants, input) {
   if (!tenants.has(input.table))
     return false;
   const scope = input.scope;
@@ -279,7 +1746,7 @@ function writePredicate(key, tenants, input) {
   input.sink.mark("tenant|");
   return true;
 }
-function refuseKey(kind, table, field) {
+function refuseKey2(kind, table, field) {
   if (kind === "insert") {
     throw new OkmError2("OKM1190", `Field ${table}.${field} is the tenant key. The scope sets it. Input cannot.`);
   }
@@ -288,14 +1755,14 @@ function refuseKey(kind, table, field) {
   }
   throw new OkmError2("OKM1704", `Field ${table}.${field} is the tenant key. A filter cannot set it.`);
 }
-function stampRows(key, table, rows, scope) {
+function stampRows2(key, table, rows, scope) {
   if (scope === undefined || "unscoped" in scope) {
     throw new OkmError2("OKM1701", `insert on ${table} has no tenant. Call for({ ${key} }) so the scope can set it.`);
   }
   for (const row of rows)
     row[key] = scope.value;
 }
-function bindClient(key, encode, openScope) {
+function bindClient2(key, encode, openScope) {
   return {
     for: (input) => {
       if (typeof input !== "object" || input === null || Array.isArray(input)) {
@@ -322,7 +1789,7 @@ function bindClient(key, encode, openScope) {
     }
   };
 }
-function tenancyRules(table, source, scope, tenants, globals, exemptions) {
+function tenancyRules2(table, source, scope, tenants, globals, exemptions) {
   const rules = [];
   const reason = globals.get(table);
   if (reason !== undefined) {
@@ -356,13 +1823,17 @@ function tenancyRules(table, source, scope, tenants, globals, exemptions) {
   }
   return rules;
 }
-function isGlobal(value) {
-  return isRecord(value) && value.kind === "global" && typeof value.reason === "string";
+function isGlobal3(value) {
+  return isRecord5(value) && value.kind === "global" && typeof value.reason === "string";
 }
-function isRecord(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 export {
+  RlsRoleError,
   columnTenancy,
-  global
+  compositeTenancy,
+  global,
+  rlsTenancy,
+  via
 };