permdock 0.0.0 → 0.1.0

package/dist/pg-4GJWDUxG.js

@@ -0,0 +1,953 @@
+import { r as sole } from "./compact-y6vfu2_f.js";
+import { a as formerKeys, g as listPermissions } from "./permissions-DC7GROPA.js";
+import { a as hasConditionOp } from "./refs-ChLSxbST.js";
+import { u as scopeList } from "./scopes-cKVp_WTw.js";
+import { f as relationCondition, w as listRoles } from "./grantee-Bv04_Vzf.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { o as jsonSchemaOf } from "./catalog-doc-BSo_Q_-6.js";
+import { t as CliError } from "./errors-DSMnAVNa.js";
+import { n as requirePeer } from "./peer-BOr_kJE1.js";
+import { F as qualifiedTable, G as subjectClaimSql, I as quoteIdent, L as quoteLiteral, R as quoteTable, S as contextRefs, U as sqlFunctionNames, V as scopeTable, W as subjectClaimJsonSql, _ as andConditions, b as columnTypesOf, f as signedIn, n as accessSql, r as capabilityAccessSql, v as arrayColumnsOf, x as compileConditionSql } from "./rls-helpers-BxRuif0l.js";
+import { createHash } from "node:crypto";
+//#region src/cli/rls-grants.ts
+/**
+* The `role_permissions` grant key of a break-glass grant. It differs from
+* the permission key, so `authorize()` and the table policies never count it;
+* only the break-glass read asks for it.
+*/
+function breakGlassKey(permission) {
+	return `${permission}#break-glass`;
+}
+/**
+* The role and scope holding a break-glass grant. `breakGlass()` sets
+* `to: authenticated`, so inside `role()` the role is on the grant itself.
+*/
+function breakGlassHolder(item) {
+	if (item.access.kind === "role") return {
+		role: item.access.role,
+		scope: item.access.scope
+	};
+	const { role, scope } = item.grant;
+	return role === null || typeof scope !== "string" ? void 0 : {
+		role,
+		scope
+	};
+}
+function granteeItems(to) {
+	return Array.isArray(to) ? to : [to];
+}
+function relationWhere(policy, grant, grantee) {
+	const node = policy.resources.get(grant.permission.resource);
+	const where = relationCondition(grantee, node, scopeList(policy.scopes), {
+		resources: policy.resources,
+		now: { ref: "now" }
+	});
+	if (where === void 0) throw new Error(`PermDock CLI: grant ${grant.permission.key} names relation '${grantee.relation}', which ${grant.permission.resource} does not declare`);
+	return where;
+}
+/** Only a deny for `oauth-client` actors compiles: Postgres sees `client_id` and `act`, not other actor kinds. */
+function actorAccess(grant, grantee, others) {
+	if (grant.effect !== "deny" || grantee.actor !== "oauth-client" || others > 0) throw new Error(`PermDock CLI: grant ${grant.permission.key} is limited to an actor grantee; RLS compiles only deny(…, { to: actor('oauth-client') }) on its own, so enforce it in the application`);
+	return {
+		kind: "actor",
+		actor: "oauth-client"
+	};
+}
+function accessOf(grant, roles, anyone) {
+	const [held, ...more] = roles;
+	if (more.length > 0) throw new Error(`PermDock CLI: grant ${grant.permission.key} requires several roles at once (${roles.map((item) => item.role).join(", ")}); RLS compiles one role per grant`);
+	if (held === void 0) return anyone ? { kind: "anyone" } : { kind: "authenticated" };
+	if (typeof held.scope === "object") return {
+		kind: "resource",
+		role: held.role,
+		resource: held.scope.resource
+	};
+	return {
+		kind: "role",
+		role: held.role,
+		scope: held.scope
+	};
+}
+/**
+* Every grant RLS must enforce: role grants and top-level
+* `definePolicy({ grants })` alike (`policy.grants` holds both). A grantee
+* Postgres cannot see (plan, actor, assurance) fails with the permission named.
+*/
+function collectGrants(policy) {
+	return policy.grants.map((grant) => {
+		const items = granteeItems(grant.to);
+		const roles = [];
+		let anyone = true;
+		let where = grant.where;
+		let delegated;
+		for (const item of items) switch (item.kind) {
+			case "role":
+				roles.push(item);
+				break;
+			case "anyone": break;
+			case "authenticated":
+				anyone = false;
+				break;
+			case "relation":
+				anyone = false;
+				where = andConditions(where, relationWhere(policy, grant, item));
+				break;
+			case "actor":
+				delegated = actorAccess(grant, item, items.length - 1);
+				break;
+			case "plan":
+			case "assurance": throw new Error(`PermDock CLI: grant ${grant.permission.key} is limited to a ${item.kind} grantee, which RLS cannot compile; enforce it in the application`);
+			default: return item;
+		}
+		const access = delegated ?? accessOf(grant, roles, anyone);
+		const label = access.kind === "role" || access.kind === "resource" ? access.role : access.kind;
+		return where === void 0 ? {
+			grant,
+			label,
+			access
+		} : {
+			grant,
+			label,
+			access,
+			where
+		};
+	});
+}
+/** Declared role names (bindings and `defineRoles` leaves) plus any role a top-level grant names. */
+function roleNames(policy) {
+	const names = new Set(policy.roles.map((item) => item.name));
+	for (const leaf of listRoles(policy.vocabulary.roles)) names.add(leaf.key);
+	for (const item of collectGrants(policy)) if (item.access.kind === "role" || item.access.kind === "resource") names.add(item.access.role);
+	return [...names];
+}
+//#endregion
+//#region src/cli/rls-indexes.ts
+/** Postgres truncates identifiers longer than this, in bytes. */
+const MAX_IDENT = 63;
+/**
+* The row fields `condition` compares, through `and`, `or` and `not`. A
+* dotted field is a JSON path, which a plain index does not serve.
+*/
+function conditionFields(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "and":
+		case "or": return condition.conditions.flatMap(conditionFields);
+		case "not": return conditionFields(condition.condition);
+		case "sqlFunction": return conditionFields(condition.twin);
+		case "opaque":
+		case "related": return [];
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn":
+		case "isNull":
+		case "memberOf": return condition.field.includes(".") ? [] : [condition.field];
+		default: return condition;
+	}
+}
+/**
+* Every index the generated SQL reads through: the row columns policies
+* filter on (scope keys and condition fields), and the membership tables'
+* user column, followed by the scope column the helpers select.
+*/
+function indexTargets(ctx, rowColumns) {
+	const targets = /* @__PURE__ */ new Map();
+	const add = (table, columns) => {
+		const target = {
+			table: qualifiedTable(table),
+			columns
+		};
+		targets.set(`${target.table}\u0000${columns[0] ?? ""}`, target);
+	};
+	for (const { table, column } of rowColumns) add(table, [column]);
+	for (const scope of ctx.scopes) {
+		const mapped = scopeTable(ctx, scope.name);
+		if (mapped !== void 0) add(mapped.table.table, [mapped.table.user, mapped.column]);
+	}
+	for (const source of [...ctx.sources ?? [], ...ctx.memberSources ?? []]) add(source.sql.table, [source.sql.user]);
+	return [...targets.values()].toSorted((a, b) => `${a.table}.${a.columns.join(",")}` < `${b.table}.${b.columns.join(",")}` ? -1 : 1);
+}
+/** A stable index name under Postgres' identifier limit. */
+function indexName(target) {
+	const name = `permdock_${target.table.slice(target.table.lastIndexOf(".") + 1)}_${target.columns.join("_")}_idx`;
+	if (Buffer.byteLength(name) <= MAX_IDENT) return name;
+	return `permdock_${createHash("sha256").update(name).digest("hex").slice(0, 8)}_idx`;
+}
+/** `create index if not exists` for every target, one per line. */
+function indexesSql(targets) {
+	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
+}
+//#endregion
+//#region src/cli/rls-compile.ts
+/** The SQL command `action` compiles to: `rls.actions` first, then the six default verbs. */
+function commandFor(action, actions) {
+	if (actions !== void 0 && Object.hasOwn(actions, action)) {
+		const configured = actions[action];
+		return configured === "none" ? void 0 : configured;
+	}
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return "select";
+		case "create": return "insert";
+		case "update": return "update";
+		case "delete": return "delete";
+		default: return;
+	}
+}
+function tableFor(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+function ancestorsOf(policy, name) {
+	const names = [];
+	let current = policy.resources.get(name);
+	while (current?.parent !== void 0 && !names.includes(current.parent.resource)) {
+		names.push(current.parent.resource);
+		current = policy.resources.get(current.parent.resource);
+	}
+	return names;
+}
+function membershipField(policy, resource, holder) {
+	if (resource === void 0) return;
+	if (resource.name === holder) return resource.id ?? "id";
+	let current = resource;
+	const seen = /* @__PURE__ */ new Set();
+	while (current?.parent !== void 0 && !seen.has(current.name)) {
+		seen.add(current.name);
+		if (current.parent.resource === holder) return current.parent.field;
+		current = policy.resources.get(current.parent.resource);
+	}
+}
+function resourceCondition(item, policy, ctx) {
+	if (item.access.kind !== "resource") throw new Error("PermDock CLI: resourceCondition needs a resource role");
+	const { role, resource: roleResource } = item.access;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const holders = [roleResource, ...ancestorsOf(policy, roleResource)];
+	const hops = [];
+	for (const [index, holder] of holders.entries()) {
+		const field = membershipField(policy, target, holder);
+		if (field === void 0) continue;
+		if (index > 0 && ctx.memberships?.resource?.[holder] === void 0) continue;
+		hops.push({
+			op: "memberOf",
+			scope: "resource",
+			field,
+			roles: [role],
+			resource: holder
+		});
+	}
+	return sole(hops) ?? {
+		op: "or",
+		conditions: hops
+	};
+}
+/**
+* The access a link capability has to a resource-scoped grant, over the same
+* holders as `resourceCondition`. It reads the claim, so ancestor hops need
+* no memberships table. `undefined` when no holder is on the row's chain.
+*/
+function capabilityAccess(item, policy, ctx) {
+	if (item.access.kind !== "resource") return;
+	const { role, resource: roleResource } = item.access;
+	const kinds = ctx.ownership?.kinds[role];
+	if (kinds !== void 0 && !kinds.includes("link")) return;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const hops = [];
+	for (const holder of [roleResource, ...ancestorsOf(policy, roleResource)]) {
+		const field = membershipField(policy, target, holder);
+		if (field !== void 0) hops.push(capabilityAccessSql(ctx, field, holder, role, item.grant.permission.key));
+	}
+	if (hops.length === 0) return;
+	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
+}
+function prepare(item, tables, warnings, skipClosures, actions) {
+	const { grant, label } = item;
+	if (grant.breakGlass !== void 0) {
+		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
+		return;
+	}
+	if (grant.closure !== void 0 || grant.portable === false) {
+		if (skipClosures) {
+			warnings.push(`skipped non-portable grant ${label}/${grant.permission.key}`);
+			return;
+		}
+		throw new Error(`PermDock CLI: closure grant ${label}/${grant.permission.key} is not portable; rewrite it or pass --skip-closures`);
+	}
+	const context = [.../* @__PURE__ */ new Set([...contextRefs(item.where), ...contextRefs(grant.check)])];
+	if (context.length > 0) {
+		if (skipClosures) {
+			warnings.push(`skipped grant ${label}/${grant.permission.key}: it reads ${context.join(", ")}, which is not in the token`);
+			return;
+		}
+		throw new Error(`PermDock CLI: grant ${label}/${grant.permission.key} reads ${context.join(", ")}; request context is not in the token, so RLS cannot compile it. Move the value to a server-set claim (principal.claims.*) or pass --skip-closures (permdock doctor PD027)`);
+	}
+	if (requiresApproval(grant.approval)) {
+		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
+		return;
+	}
+	const command = commandFor(grant.permission.action, actions);
+	const table = tableFor(grant.permission.resource, tables);
+	if (command === void 0) {
+		if (item.access.kind !== "role") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions) and only role grants are seeded`);
+			return;
+		}
+		if (grant.validity !== void 0 && grant.effect === "allow") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: a role_permissions row cannot carry validFrom / validUntil, so a time-bounded grant on an action with no SQL command is not seeded`);
+			return;
+		}
+		warnings.push(`no policy for ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions); seeded for permdock_has and permitted_<scope>_ids`);
+		return {
+			item,
+			command: "none",
+			table,
+			...item.where === void 0 ? {} : { using: item.where },
+			...grant.check === void 0 ? {} : { check: grant.check }
+		};
+	}
+	const using = command === "insert" ? void 0 : item.where;
+	const check = command === "insert" ? grant.check ?? item.where : command === "update" ? grant.check ?? item.where : void 0;
+	return {
+		item,
+		command,
+		table,
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+function signature(entry, byFields) {
+	const base = [
+		entry.item.grant.effect,
+		entry.using ?? null,
+		entry.check ?? null
+	];
+	return JSON.stringify(byFields ? [...base, entry.item.grant.fields ?? null] : base);
+}
+/**
+* Grant keys per permission: the key is the permission, split into
+* `permission#n` when role grants carry different portable conditions (or
+* effects), one key per condition group. With field views, grants that differ
+* only in `fields` get their own keys too, so a view can tell them apart.
+*/
+function assignKeys(entries, byFields) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (entry.item.access.kind !== "role") continue;
+		const key = entry.item.grant.permission.key;
+		const byCondition = groups.get(key) ?? /* @__PURE__ */ new Map();
+		const sig = signature(entry, byFields);
+		byCondition.set(sig, [...byCondition.get(sig) ?? [], entry]);
+		groups.set(key, byCondition);
+	}
+	const keys = /* @__PURE__ */ new Map();
+	for (const [permission, byCondition] of groups) {
+		const lists = [...byCondition.values()];
+		for (const [index, list] of lists.entries()) {
+			const grantKey = lists.length === 1 ? permission : `${permission}#${index + 1}`;
+			for (const entry of list) keys.set(entry, grantKey);
+		}
+	}
+	return keys;
+}
+function compileOptional(condition, ctx) {
+	return condition === void 0 ? void 0 : compileConditionSql(condition, ctx);
+}
+function noteConditions(entry, warnings) {
+	const { label, grant } = entry.item;
+	const names = [...sqlFunctionNames(entry.using), ...sqlFunctionNames(entry.check)];
+	if (names.length > 0) warnings.push(`sqlFunction ${[...new Set(names)].join(", ")} on ${label}/${grant.permission.key} is portable via twin`);
+	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
+}
+/**
+* Compiles every grant (role and top-level) to branches whose role check is
+* a helper call keyed by grant key. Nothing in a branch is per-row except the
+* portable row condition and resource-membership joins.
+*/
+/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
+const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
+function compileGrants(policy, ctx, tables, warnings, skipClosures) {
+	const items = collectGrants(policy);
+	const entries = items.flatMap((item) => {
+		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions);
+		return entry === void 0 ? [] : [entry];
+	});
+	const keys = assignKeys(entries, ctx.fields === "views");
+	const rows = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const holder = item.grant.breakGlass === void 0 ? void 0 : breakGlassHolder(item);
+		if (holder !== void 0) {
+			const row = {
+				role: holder.role,
+				permission: item.grant.permission.key,
+				grantKey: breakGlassKey(item.grant.permission.key),
+				scope: holder.scope,
+				effect: item.grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+	}
+	const branches = [];
+	const rowColumns = /* @__PURE__ */ new Map();
+	const filters = (table, column) => {
+		rowColumns.set(`${table}\u0000${column}`, {
+			table,
+			column
+		});
+	};
+	const typed = /* @__PURE__ */ new Map();
+	const contextFor = (name) => {
+		const known = typed.get(name);
+		if (known !== void 0) return known;
+		const node = policy.resources.get(name);
+		const schema = node === void 0 ? void 0 : jsonSchemaOf(node);
+		const next = {
+			...ctx,
+			columnTypes: columnTypesOf(schema),
+			arrayColumns: arrayColumnsOf(schema)
+		};
+		typed.set(name, next);
+		return next;
+	};
+	for (const entry of entries) {
+		const { item, command, table } = entry;
+		const { grant, access, label } = item;
+		if (command === "none") {
+			const grantKey = keys.get(entry);
+			if (access.kind === "role" && grantKey !== void 0) {
+				const row = {
+					role: access.role,
+					permission: grant.permission.key,
+					grantKey,
+					scope: access.scope,
+					effect: grant.effect
+				};
+				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+			}
+			continue;
+		}
+		const rowCtx = contextFor(item.grant.permission.resource);
+		noteConditions(entry, warnings);
+		for (const field of [...conditionFields(entry.using), ...conditionFields(entry.check)]) filters(table, field);
+		const grantKey = keys.get(entry);
+		let accessExpr;
+		if (access.kind === "role" && grantKey !== void 0) {
+			const column = access.scope === "global" ? void 0 : policy.scopes.find((scope) => scope.name === access.scope)?.key;
+			accessExpr = accessSql(ctx, access.scope, grantKey, column);
+			if (column !== void 0) filters(table, column);
+			const row = {
+				role: access.role,
+				permission: grant.permission.key,
+				grantKey,
+				scope: access.scope,
+				effect: grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+		const linkOnly = access.kind === "resource" && ctx.capabilities === true && ctx.memberships?.resource?.[access.resource] === void 0;
+		if (access.kind === "actor") accessExpr = `${subjectClaimSql(ctx, "client_id")} is not null or ${subjectClaimJsonSql(ctx, "act")} is not null`;
+		if (access.kind === "resource" && !linkOnly) accessExpr = compileConditionSql(resourceCondition(item, policy, ctx), ctx);
+		if (linkOnly) warnings.push(`no ${access.resource} memberships table: only link capabilities reach ${label}/${grant.permission.key}`);
+		const validity = validitySql(grant.validity);
+		accessExpr = andSql(accessExpr, validity);
+		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
+		const using = compileOptional(entry.using, rowCtx);
+		const check = compileOptional(entry.check, rowCtx);
+		const fields = grant.fields === void 0 ? {} : { fields: grant.fields };
+		if (!linkOnly) branches.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: access.kind === "anyone" ? ["anon", "authenticated"] : ["authenticated"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			...grantKey === void 0 ? {} : { grantKey },
+			...accessExpr === void 0 ? {} : { access: accessExpr },
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+		const linked = ctx.capabilities === true ? capabilityAccess(item, policy, ctx) : void 0;
+		if (linked !== void 0) branches.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: ["anon"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			access: andSql(linked, validity) ?? linked,
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+	}
+	return {
+		branches: ensureSelectCoverage(branches, warnings),
+		rolePermissions: withAliasRows(policy, [...rows.values()]),
+		rowColumns: [...rowColumns.values()]
+	};
+}
+/**
+* Each row again under every key its permission was renamed from, so SQL that
+* still calls `permdock_has('<old key>')` keeps the access the current key
+* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
+* copied.
+*/
+function withAliasRows(policy, rows) {
+	const former = new Map(listPermissions(policy.permissions).map((leaf) => [leaf.key, formerKeys(leaf)]));
+	const out = [...rows];
+	for (const row of rows) {
+		const suffix = row.grantKey.slice(row.permission.length);
+		if (!row.grantKey.startsWith(row.permission) || suffix !== "" && !/^#\d+$/u.test(suffix)) continue;
+		for (const old of former.get(row.permission) ?? []) out.push({
+			...row,
+			permission: old,
+			grantKey: `${old}${suffix}`
+		});
+	}
+	return out;
+}
+/**
+* Postgres needs SELECT access to find rows for UPDATE / DELETE and for
+* RETURNING, so a table with only update or delete grants gets matching
+* SELECT branches.
+*/
+function ensureSelectCoverage(branches, warnings) {
+	const extra = [];
+	const readable = new Set(branches.filter((item) => item.command === "select" && item.effect === "allow").map((item) => item.table));
+	const covered = /* @__PURE__ */ new Set();
+	for (const item of branches) {
+		if (item.effect !== "allow" || item.command !== "update" && item.command !== "delete" || readable.has(item.table)) continue;
+		const { check: _check, ...rest } = item;
+		extra.push({
+			...rest,
+			command: "select",
+			coverage: true
+		});
+		if (!covered.has(item.table)) {
+			covered.add(item.table);
+			warnings.push(`added SELECT coverage for ${item.table} (${item.permissionKey})`);
+		}
+	}
+	return [...branches, ...extra];
+}
+/** True when `sql` is one parenthesised expression, so AND / OR need not wrap it again. */
+function isWrapped(sql) {
+	if (!sql.startsWith("(") || !sql.endsWith(")")) return false;
+	let depth = 0;
+	let quoted = false;
+	for (let index = 0; index < sql.length; index += 1) {
+		const ch = sql[index];
+		if (ch === "'") quoted = !quoted;
+		else if (!quoted && ch === "(") depth += 1;
+		else if (!quoted && ch === ")") {
+			depth -= 1;
+			if (depth === 0 && index < sql.length - 1) return false;
+		}
+	}
+	return depth === 0;
+}
+function wrapSql(sql) {
+	return isWrapped(sql) ? sql : `(${sql})`;
+}
+/**
+* The grant's `validFrom` / `validUntil` as a clock check: `from` inclusive,
+* `until` exclusive, matching the in-process evaluator.
+*/
+function validitySql(validity) {
+	if (validity === void 0) return;
+	return andSql(validity.from === void 0 ? void 0 : `now() >= to_timestamp(${validity.from})`, validity.until === void 0 ? void 0 : `now() < to_timestamp(${validity.until})`);
+}
+function andSql(...parts) {
+	const present = parts.filter((part) => part !== void 0 && part !== "true");
+	if (present.length === 0) return;
+	return present.length === 1 ? present[0] : present.map(wrapSql).join(" and ");
+}
+/** `USING` and `WITH CHECK` for a branch: its access check ANDed with its row conditions. */
+function branchClauses(branch) {
+	const using = branch.command === "insert" ? void 0 : andSql(branch.access, branch.using) ?? "true";
+	const check = branch.command === "insert" || branch.command === "update" ? andSql(branch.access, branch.check) ?? "true" : void 0;
+	return {
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+//#endregion
+//#region src/cli/rls-policies.ts
+/** Each database role gets its own policy, so no role sees two permissive policies for one command. */
+const AUDIENCES = ["authenticated", "anon"];
+const DEFAULT_POLICY_NAME = "{table}_{op}";
+const DEFAULT_PER_ROLE_NAME = "{role}_{permission}";
+const PLACEHOLDER = /\{(table|op|role|permission)\}/gu;
+function sanitize(name) {
+	return name.replaceAll(/[^A-Za-z0-9_]/g, "_");
+}
+function render(template, values) {
+	return sanitize(template.replaceAll(PLACEHOLDER, (_match, key) => values[key]));
+}
+/** Rejects a template that cannot name every policy of the chosen shape uniquely. */
+function assertPolicyName(template, perRole) {
+	if (!perRole && /\{(role|permission)\}/u.test(template)) throw new Error("PermDock CLI: --policy-name {role} and {permission} need --policy-per-role; a collapsed policy covers several roles");
+	if (!perRole && !(template.includes("{table}") && template.includes("{op}"))) throw new Error("PermDock CLI: --policy-name needs {table} and {op} so each table and command gets its own policy");
+}
+function orSql(parts) {
+	const distinct = [...new Set(parts)];
+	if (distinct.includes("true")) return "true";
+	return sole(distinct) ?? distinct.map(wrapSql).join(" or ");
+}
+function negate(sql) {
+	return sql === void 0 ? void 0 : `not (${sql})`;
+}
+function policyOf(name, branch, using, check) {
+	const deny = branch.effect === "deny";
+	const policy = {
+		name,
+		table: branch.table,
+		command: branch.command,
+		effect: branch.effect,
+		roles: branch.roles
+	};
+	const finalUsing = deny ? negate(using) : using;
+	const finalCheck = deny ? negate(check) : check;
+	if (finalUsing !== void 0) policy.using = finalUsing;
+	if (finalCheck !== void 0) policy.check = finalCheck;
+	return policy;
+}
+function uniqueName(names, name) {
+	const seen = names.get(name) ?? 0;
+	names.set(name, seen + 1);
+	return seen === 0 ? name : `${name}_${seen + 1}`;
+}
+function perRolePolicies(branches, template) {
+	const names = /* @__PURE__ */ new Map();
+	return branches.map((branch) => {
+		const clauses = branchClauses(branch);
+		const deny = branch.effect === "deny";
+		const base = render(template, {
+			table: branch.table,
+			op: branch.command,
+			role: branch.label,
+			permission: branch.permissionKey
+		});
+		const name = `${deny ? "deny_" : ""}${base}${branch.coverage === true ? "_select_coverage" : ""}`;
+		return policyOf(uniqueName(names, name), branch, clauses.using, clauses.check);
+	});
+}
+/**
+* Branches of one grant-key group share their row condition, so the group
+* becomes one OR branch whose access ORs the helper calls of each scope.
+*/
+function mergeGroups(branches) {
+	const merged = [];
+	const byKey = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		const id = branch.grantKey === void 0 ? void 0 : `${branch.table}\u0000${branch.command}\u0000${branch.grantKey}\u0000${branch.coverage === true}`;
+		const entry = id === void 0 ? void 0 : byKey.get(id);
+		if (entry === void 0) {
+			const created = {
+				branch,
+				accesses: branch.access === void 0 ? [] : [branch.access]
+			};
+			if (id !== void 0) byKey.set(id, created);
+			merged.push(created);
+			continue;
+		}
+		if (branch.access !== void 0 && !entry.accesses.includes(branch.access)) entry.accesses.push(branch.access);
+	}
+	return merged.map(({ branch, accesses }) => accesses.length <= 1 ? branch : withAccess(branch, orSql(accesses)));
+}
+function withAccess(branch, access) {
+	return {
+		...branch,
+		access
+	};
+}
+function collapsedPolicies(branches, template) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const branch of mergeGroups(branches)) {
+		const id = `${branch.table}\u0000${branch.command}\u0000${branch.effect}`;
+		groups.set(id, [...groups.get(id) ?? [], branch]);
+	}
+	const names = /* @__PURE__ */ new Map();
+	return [...groups.values()].flatMap((group) => AUDIENCES.flatMap((audience) => {
+		const members = group.filter((branch) => branch.roles.includes(audience));
+		const [first] = members;
+		if (first === void 0) return [];
+		const deny = first.effect === "deny";
+		const clauses = members.map(branchClauses);
+		const usings = clauses.flatMap((item) => item.using === void 0 ? [] : [item.using]);
+		const checks = clauses.flatMap((item) => item.check === void 0 ? [] : [item.check]);
+		const base = render(template, {
+			table: first.table,
+			op: first.command,
+			role: first.label,
+			permission: first.permissionKey
+		});
+		return [policyOf(uniqueName(names, `${deny ? "deny_" : ""}${base}${audience === "anon" ? "_anon" : ""}`), {
+			...first,
+			roles: [audience]
+		}, usings.length === 0 ? void 0 : orSql(usings), checks.length === 0 ? void 0 : orSql(checks))];
+	}));
+}
+/**
+* Assembles policies. The default is one PERMISSIVE policy per table,
+* command and database role (Splinter `multiple_permissive_policies` stays
+* quiet), with denies in one RESTRICTIVE policy per table, command and role.
+*/
+function assemblePolicies(branches, shape) {
+	const template = shape.name ?? (shape.perRole ? DEFAULT_PER_ROLE_NAME : DEFAULT_POLICY_NAME);
+	assertPolicyName(template, shape.perRole);
+	return shape.perRole ? perRolePolicies(branches, template) : collapsedPolicies(branches, template);
+}
+//#endregion
+//#region src/cli/rls-fields.ts
+/** Names of the field-view objects. Part of the SQL contract. */
+const FIELD_VIEWS = {
+	/** `<table>_visible`: the `security_invoker` view clients read. */
+	view: "_visible",
+	/** `<table>_visible_fields`: the owner-rights companion `--revoke-columns` adds. */
+	companion: "_visible_fields",
+	/** The companion's row-key column, joined to the base table's key. */
+	key: "permdock_key",
+	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
+	comment: "permdock:field-companion"
+};
+function covers(branch, column) {
+	return branch.fields === void 0 || branch.fields.includes(column);
+}
+/**
+* A read grant that only shapes columns: a field-limited deny (it never
+* denies the row) or an allow with an empty list (it grants nothing). With
+* field views it leaves the row policy and lives in the view's masks.
+*/
+function fieldOnly(branch) {
+	if (branch.command !== "select" || branch.fields === void 0) return false;
+	return branch.effect === "deny" || branch.fields.length === 0;
+}
+/** Branches the row policies keep when field views compile. */
+function rowBranches(branches) {
+	return branches.filter((branch) => !fieldOnly(branch));
+}
+/**
+* Whether the reader is signed in, for branches with no helper call: a grant
+* to any signed-in user relies on `to authenticated` in its policy, which a
+* view does not have.
+*/
+function audience(ctx, branch) {
+	if (branch.access !== void 0 || branch.roles.length !== 1) return;
+	if (branch.roles[0] === "authenticated") return signedIn(ctx);
+	return branch.roles[0] === "anon" ? `not (${signedIn(ctx)})` : void 0;
+}
+function clause(ctx, branch) {
+	return andSql(audience(ctx, branch), branchClauses(branch).using) ?? "true";
+}
+/**
+* `can(permission, row, { field })` in SQL: an allow that covers the column
+* holds for the row and no covering deny does. Every access term is the
+* uncorrelated helper call the row policy uses, so it runs once per statement.
+*/
+function maskSql(ctx, allows, denies, column) {
+	const allowed = allows.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	if (allowed.length === 0) return "false";
+	const denied = denies.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	const allow = orSql(allowed);
+	if (denied.length === 0) return allow;
+	const deny = orSql(denied);
+	return allow === "true" ? `not ${wrapSql(deny)}` : `${wrapSql(allow)} and not ${wrapSql(deny)}`;
+}
+function schemaColumns(policy, resource) {
+	const node = policy.resources.get(resource);
+	const schema = node === void 0 ? null : jsonSchemaOf(node);
+	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
+	return properties !== null && typeof properties === "object" ? Object.keys(properties) : void 0;
+}
+function viewName(table, suffix) {
+	return `${table}${suffix}`;
+}
+/**
+* One view per table whose read grants limit fields. A column is restricted
+* when some read allow lists fields without it or some read deny lists it;
+* every other column, and the row key, passes through unchanged.
+*/
+function fieldViews(policy, ctx, branches, options, warnings) {
+	const byTable = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.command !== "select" || branch.coverage === true) continue;
+		byTable.set(branch.table, [...byTable.get(branch.table) ?? [], branch]);
+	}
+	const views = [];
+	for (const [table, reads] of byTable) {
+		const allows = reads.filter((branch) => branch.effect === "allow" && branch.fields?.length !== 0);
+		const denies = reads.filter((branch) => branch.effect === "deny");
+		const limited = reads.some((branch) => branch.fields !== void 0);
+		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
+		if (!limited || allows.length === 0 || resource === void 0) continue;
+		const names = schemaColumns(policy, resource);
+		if (names === void 0) throw new Error(`PermDock CLI: --fields views needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
+		const key = policy.resources.get(resource)?.id ?? "id";
+		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
+		const columns = names.map((name) => {
+			quoteIdent(name);
+			return restricted(name) ? {
+				name,
+				mask: maskSql(ctx, allows, denies, name)
+			} : { name };
+		});
+		if (columns.every((column) => column.mask === void 0)) continue;
+		const view = viewName(table, FIELD_VIEWS.view);
+		if (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(key))) warnings.push(`field view ${view}: the key ${key} passes through, although a read grant on ${resource} omits it`);
+		const hidden = columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+		if (!options.revokeColumns) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; add --revoke-columns so clients read through the view`);
+		views.push({
+			resource,
+			table,
+			view,
+			key,
+			columns,
+			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
+			...options.revokeColumns ? { companion: viewName(table, FIELD_VIEWS.companion) } : {}
+		});
+	}
+	return views;
+}
+/** Columns of `view`'s table that `anon` and `authenticated` keep on the base table with `--revoke-columns`. */
+function readableColumns(view) {
+	return view.columns.filter((column) => column.mask === void 0).map((column) => column.name);
+}
+function restrictedColumns(view) {
+	return view.columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+}
+function columnList(names) {
+	return names.map(quoteIdent).join(", ");
+}
+function selectList(lines) {
+	return lines.map((line) => `  ${line}`).join(",\n");
+}
+function grantView(name, roles) {
+	return [`revoke all on table ${quoteTable(qualifiedTable(name))} from anon, authenticated, public;`, `grant select on table ${quoteTable(qualifiedTable(name))} to ${roles.join(", ")};`].join("\n");
+}
+function inlineViewSql(view) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? quoteIdent(column.name) : `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteTable(qualifiedTable(view.view))} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteTable(qualifiedTable(view.table))};`;
+}
+function companionSql(view, companion) {
+	const restricted = view.columns.filter((column) => column.mask !== void 0);
+	const targets = [`${quoteIdent(view.key)} as ${quoteIdent(FIELD_VIEWS.key)}`, ...restricted.map((column) => `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`)];
+	const any = orSql(restricted.map((column) => column.mask ?? "false"));
+	return `create or replace view ${quoteTable(qualifiedTable(companion))} with (security_barrier = true) as
+select
+${selectList(targets)}
+from ${quoteTable(qualifiedTable(view.table))}
+where ${any};
+comment on view ${quoteTable(qualifiedTable(companion))} is ${quoteLiteral(`${FIELD_VIEWS.comment} ${view.view}`)};`;
+}
+function joinedViewSql(view, companion) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? `t.${quoteIdent(column.name)}` : `f.${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteTable(qualifiedTable(view.view))} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteTable(qualifiedTable(view.table))} t
+left join ${quoteTable(qualifiedTable(companion))} f on f.${quoteIdent(FIELD_VIEWS.key)} = t.${quoteIdent(view.key)};`;
+}
+/** `select` on only the unrestricted columns (and the key) of the base table, for `--revoke-columns`. */
+function columnGrantSql(view, role) {
+	return `grant select (${columnList(readableColumns(view))}) on table ${quoteTable(qualifiedTable(view.table))} to ${role};`;
+}
+function columnRevokeSql(view) {
+	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteTable(qualifiedTable(view.table))} from anon, authenticated;`;
+}
+/**
+* The view SQL: the `security_invoker` view, and with `--revoke-columns` the
+* owner-rights companion it joins for the restricted columns. The companion
+* masks every column with the full field decision and keeps only rows where
+* one is readable, so reading it directly shows nothing `pick` would not.
+*/
+function fieldViewsSql(views) {
+	return views.map((view) => {
+		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
+		if (view.companion === void 0) return [
+			head,
+			inlineViewSql(view),
+			grantView(view.view, view.roles)
+		].join("\n");
+		return [
+			head,
+			`-- ${view.companion} reads ${view.table} as its owner; ${view.view} reads the rows as the caller and joins it`,
+			companionSql(view, view.companion),
+			grantView(view.companion, view.roles),
+			joinedViewSql(view, view.companion),
+			grantView(view.view, view.roles)
+		].join("\n");
+	}).join("\n\n");
+}
+//#endregion
+//#region src/cli/pg.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const STATEMENT_TIMEOUT_MS = 6e4;
+function loadPg(command) {
+	return requirePeer(() => import("pg"), "pg", command);
+}
+function options(db) {
+	return {
+		connectionString: db,
+		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+		statement_timeout: STATEMENT_TIMEOUT_MS
+	};
+}
+/** Ctrl-C ends the connection, so a query that hangs cannot keep the process alive. */
+function endOnInterrupt(end) {
+	const interrupt = () => {
+		end().catch(() => void 0);
+		process.exitCode = 130;
+	};
+	process.once("SIGINT", interrupt);
+	return async () => {
+		process.off("SIGINT", interrupt);
+		await end();
+	};
+}
+function unreachable(command, cause) {
+	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, { cause });
+}
+/** One connection, for commands that run a transaction. */
+async function connectPg(db, command) {
+	const client = new (await (loadPg(command))).Client(options(db));
+	try {
+		await client.connect();
+	} catch (cause) {
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => client.query(sql, values),
+		end: endOnInterrupt(() => client.end())
+	};
+}
+/** A small pool, for independent catalog reads that can run in parallel. */
+async function connectPgPool(db, command) {
+	const pool = new (await (loadPg(command))).Pool({
+		...options(db),
+		max: 4
+	});
+	try {
+		(await pool.connect()).release();
+	} catch (cause) {
+		await pool.end();
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => pool.query(sql, values),
+		end: endOnInterrupt(() => pool.end())
+	};
+}
+//#endregion
+export { breakGlassKey as _, columnRevokeSql as a, rowBranches as c, commandFor as d, compileGrants as f, breakGlassHolder as g, indexesSql as h, columnGrantSql as i, viewName as l, indexTargets as m, connectPgPool as n, fieldViews as o, tableFor as p, FIELD_VIEWS as r, fieldViewsSql as s, connectPg as t, assemblePolicies as u, collectGrants as v, roleNames as y };