permdock 0.0.0 → 0.2.0

package/dist/compact-y6vfu2_f.js

@@ -0,0 +1,19 @@
+//#region src/core/compact.ts
+function compact(value) {
+	const result = {};
+	for (const key of Object.keys(value)) {
+		const next = value[key];
+		if (next !== void 0) result[key] = next;
+	}
+	return result;
+}
+/** `Array.isArray` that keeps `readonly T[]` instead of widening to `any[]`. */
+function isReadonlyArray(value) {
+	return Array.isArray(value);
+}
+/** The element of a one-element list, else `undefined`. */
+function sole(items) {
+	return items.length === 1 ? items[0] : void 0;
+}
+//#endregion
+export { isReadonlyArray as n, sole as r, compact as t };

package/dist/compare-pfyVnBjE.js

@@ -0,0 +1,12 @@
+//#region src/core/compare.ts
+/**
+* Orders strings by UTF-16 code unit, the same in every locale and runtime,
+* so sorted output is byte-stable where `localeCompare` would follow the ICU
+* build.
+*/
+function byCodePoint(a, b) {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+}
+//#endregion
+export { byCodePoint as t };

package/dist/compile/index.d.ts

@@ -0,0 +1,3 @@
+import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-B-dsAT6j.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-CNnl6uIt.js";
+export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/compile/index.js

@@ -0,0 +1,2 @@
+import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
+export { compileWhere, escapeLike };

package/dist/compile-Ba4blROR.js

@@ -0,0 +1,613 @@
+import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { S as restrictedFor, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, l as groupEntries, m as isPrincipalRelation, r as expandRelation, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-KYb4ntaz.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { c as rootScope, d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CVdPrWN-.js";
+//#region src/conditions/graph-sql.ts
+/** A Postgres identifier, schema-qualified names split on `.`. */
+function quoteSqlName(name) {
+	return name.split(".").map((part) => {
+		assertSafeKey(part, "sql identifier");
+		if (part === "" || part.includes("\0")) throw new Error(`PermDock: unsafe SQL identifier '${name}'`);
+		return `"${part.replaceAll("\"", "\"\"")}"`;
+	}).join(".");
+}
+function text(value) {
+	return { text: value };
+}
+function nextAlias(build, prefix) {
+	build.alias += 1;
+	return `${prefix}${String(build.alias)}`;
+}
+function nodeOf(build, resource) {
+	const node = build.options.resources.get(resource);
+	if (node === void 0) throw new Error(`PermDock: graph resource '${resource}' is not declared`);
+	return node;
+}
+function tableName(build, name) {
+	return quoteSqlName(build.options.qualify?.(name) ?? name);
+}
+function tableOf(build, resource) {
+	return tableName(build, build.options.tables?.[resource] ?? resource);
+}
+function col(alias, name) {
+	return `${alias}.${quoteSqlName(name)}`;
+}
+function notExpired(column) {
+	return `(${column} is null or ${column} > now())`;
+}
+function edgeRowFilter(spec, alias) {
+	const parts = [];
+	for (const [column, value] of Object.entries(spec.match ?? {})) parts.push(text(` and ${col(alias, column)} = `), { value });
+	if (spec.expiresAt !== void 0) parts.push(text(` and ${notExpired(col(alias, spec.expiresAt))}`));
+	return parts;
+}
+function groupHolders(build, resource, relation) {
+	return build.options.holders?.(resource, relation) ?? holderIds(build, resource, relation);
+}
+/** Who a row of the edge names, when it is not a group of the edge's own resource. */
+function edgeHolderFilter(build, node, spec, alias) {
+	const holder = col(alias, spec.subject ?? "user_id");
+	const groups = spec.groups;
+	if (groups === void 0) return [text(`${holder} = `), { subject: true }];
+	const kind = groups.column === void 0 ? void 0 : col(alias, groups.column);
+	const direct = kind === void 0 ? [
+		text(`(${holder} = `),
+		{ subject: true },
+		text(")")
+	] : [
+		text("(("),
+		...groups.direct === void 0 ? [text(`${kind} is null`)] : [text(`${kind} is null or ${kind} = `), { value: groups.direct }],
+		text(`) and ${holder} = `),
+		{ subject: true },
+		text(")")
+	];
+	const parts = [text("("), ...direct];
+	for (const group of groupEntries(spec)) {
+		if (group.resource === node.name) continue;
+		const id = `${col(alias, group.subject)}::text in (`;
+		parts.push(...kind === void 0 ? [text(` or (${id}`)] : [
+			text(` or (${kind} = `),
+			{ value: group.resource },
+			text(` and ${id}`)
+		], ...groupHolders(build, group.resource, group.relation), text("))"));
+	}
+	parts.push(text(")"));
+	return parts;
+}
+/** The nested-group step of an edge whose groups include its own resource: the row names a group of `node`. */
+function selfGroupWhere(spec, node, subject, alias) {
+	const column = spec.groups?.column;
+	return column === void 0 ? [text(`${subject} is not null`)] : [text(`${col(alias, column)} = `), { value: node.name }];
+}
+/**
+* One concrete relation's arm: `select <id>::text as id ...` for every
+* instance of `node` the subject holds `relation` on, through groups too.
+*/
+function relationArm(build, node, relation) {
+	const spec = node.relations[relation];
+	if (isEdgeRelation(spec)) {
+		const edge = tableName(build, spec.edge);
+		const object = spec.object ?? `${node.name}_id`;
+		const e = nextAlias(build, "e");
+		const base = [
+			text(`select ${col(e, object)}::text as id from ${edge} ${e} where `),
+			...edgeHolderFilter(build, node, spec, e),
+			...edgeRowFilter(spec, e)
+		];
+		const self = groupEntries(spec).find((group) => group.resource === node.name);
+		if (self === void 0) return base;
+		const g = nextAlias(build, "g");
+		const n = nextAlias(build, "e");
+		const subject = col(n, self.subject);
+		return [
+			text(`select ${g}.id from (with recursive ${g}(id, level) as (select b.id, 0 from (`),
+			...base,
+			text(`) b union select ${col(n, object)}::text, ${g}.level + 1 from ${edge} ${n} join ${g} on ${subject}::text = ${g}.id where `),
+			...selfGroupWhere(spec, node, subject, n),
+			text(` and ${g}.level < ${String(16)}`),
+			...edgeRowFilter(spec, n),
+			text(`) select ${g}.id from ${g}) ${g}`)
+		];
+	}
+	const table = tableOf(build, node.name);
+	const t = nextAlias(build, "t");
+	const id = `${col(t, node.id)}::text`;
+	if (isPrincipalRelation(spec)) {
+		const parts = [text(`select ${id} as id from ${table} ${t} where ${col(t, spec.principal)} = `), { subject: true }];
+		const startsAt = spec.period?.startsAt;
+		if (startsAt !== void 0) {
+			const column = col(t, startsAt);
+			parts.push(text(` and (${column} is null or ${column} <= now())`));
+		}
+		const expiresAt = spec.period?.expiresAt;
+		if (expiresAt !== void 0) parts.push(text(` and ${notExpired(col(t, expiresAt))}`));
+		return parts;
+	}
+	if (isFieldRelation(spec) && spec.memberOf === void 0) return [text(`select ${id} as id from ${table} ${t} where ${col(t, spec.field)} = `), { subject: true }];
+	throw new Error(`PermDock: relation '${relation}' on ${node.name} has no graph SQL form`);
+}
+function holderIds(build, resource, relation) {
+	const node = nodeOf(build, resource);
+	const arms = expandRelation(node, relation).map((name) => relationArm(build, node, name));
+	if (arms.length === 0) return [text("select null::text as id where false")];
+	const out = [];
+	for (const [index, arm] of arms.entries()) {
+		if (index > 0) out.push(text(" union "));
+		out.push(...arm);
+	}
+	return out;
+}
+/** One concrete relation's arm, for helpers that guard each arm by the relation asked for. */
+function relationArmSql(resource, relation, options) {
+	const build = {
+		options,
+		alias: 0
+	};
+	return relationArm(build, nodeOf(build, resource), relation);
+}
+function heldIds(build, condition) {
+	if (condition.permission !== void 0) {
+		const permitted = build.options.permitted;
+		if (permitted === void 0) throw new Error(`PermDock: inherit(${condition.permission}) has no query form outside generated RLS`);
+		return permitted(condition.resource, condition.permission);
+	}
+	if (condition.ids === void 0) return groupHolders(build, condition.resource, condition.relation);
+	if (condition.ids.length === 0) return [text("select null::text as id where false")];
+	const parts = [text("select v.id from (values ")];
+	for (const [index, id] of condition.ids.entries()) parts.push(text(index === 0 ? "(" : ", ("), { value: id }, text("::text)"));
+	parts.push(text(") as v(id)"));
+	return parts;
+}
+/** Instances of the condition's resource at or below the held ones, within its depth and never through a restricted child. */
+function reached(build, condition) {
+	const held = heldIds(build, condition);
+	if (condition.depth === 0) return held;
+	const node = nodeOf(build, condition.resource);
+	if (!isSelfParented(node) || node.parent === void 0) throw new Error(`PermDock: '${condition.resource}' is not self-parented, so a related walk of depth ${String(condition.depth)} has no SQL form`);
+	const { closure, closureDepths } = build.options;
+	if (closure !== void 0 && (closureDepths === void 0 || closureDepths[condition.resource] !== void 0)) {
+		const c = nextAlias(build, "c");
+		const cap = closureDepths?.[condition.resource];
+		const depth = cap !== void 0 && condition.depth >= cap ? "" : ` and ${c}.depth <= ${String(condition.depth)}`;
+		return [
+			text(`select ${c}.descendant as id from ${quoteSqlName(closure)} ${c} where ${c}.resource = `),
+			{ value: condition.resource },
+			text(`${depth} and ${c}.ancestor in (`),
+			...held,
+			text(")")
+		];
+	}
+	const d = nextAlias(build, "d");
+	const t = nextAlias(build, "t");
+	const stop = restrictedFor(node, "parent");
+	const restricted = stop === void 0 ? "" : ` and ${col(t, stop)} is not true`;
+	return [
+		text(`select ${d}.id from (with recursive ${d}(id, level) as (select h.id, 0 from (`),
+		...held,
+		text(`) h union select ${col(t, node.id)}::text, ${d}.level + 1 from ${tableOf(build, node.name)} ${t} join ${d} on ${col(t, node.parent.field)}::text = ${d}.id where ${d}.level < ${String(condition.depth)}${restricted}) select ${d}.id from ${d}) ${d}`)
+	];
+}
+/** Ids the row's `field` may hold: the reached instances, carried back over each link hop. */
+function targets(build, condition) {
+	let set = reached(build, condition);
+	const hops = condition.hops ?? [];
+	for (let index = hops.length - 1; index >= 1; index -= 1) {
+		const from = hops[index - 1];
+		const hop = hops[index];
+		if (from === void 0 || hop === void 0)
+ /* v8 ignore next */
+		break;
+		const custom = build.options.linked?.(from.resource, hop.link, set);
+		if (custom !== void 0) {
+			set = custom;
+			continue;
+		}
+		const node = nodeOf(build, from.resource);
+		const link = Object.hasOwn(node.links, hop.link) ? node.links[hop.link] : void 0;
+		if (link === void 0) throw new Error(`PermDock: '${from.resource}' has no link '${hop.link}'`);
+		const t = nextAlias(build, "t");
+		set = [
+			text(`select ${col(t, node.id)}::text as id from ${tableOf(build, node.name)} ${t} where ${col(t, link.field)}::text in (`),
+			...set,
+			text(")")
+		];
+	}
+	return set;
+}
+/** The ids the row's field may hold for `condition` to match, as one text column `id`. */
+function relatedTargetsSql(condition, options) {
+	return targets({
+		options,
+		alias: 0
+	}, condition);
+}
+function closedRows(build, above) {
+	const custom = build.options.restrictedRows?.(above.resource);
+	if (custom !== void 0) return custom;
+	const table = tableOf(build, nodeOf(build, above.resource).name);
+	const span = above.depth - 1;
+	const { closure, closureDepths } = build.options;
+	const cap = closureDepths?.[above.resource];
+	if (closure !== void 0 && (closureDepths === void 0 || cap !== void 0 && cap >= span)) {
+		const c = nextAlias(build, "c");
+		const a = nextAlias(build, "a");
+		const q = nextAlias(build, "q");
+		return [
+			text(`select ${c}.descendant as id from ${quoteSqlName(closure)} ${c} join ${table} ${a} on ${col(a, above.id)}::text = ${c}.ancestor where ${c}.resource = `),
+			{ value: above.resource },
+			text(` and ${c}.depth <= ${String(span)} and (${col(a, above.field)} is true or (${c}.depth = ${String(span)} and exists (select 1 from ${table} ${q} where ${col(q, above.id)} = ${col(a, above.parent)})))`)
+		];
+	}
+	const d = nextAlias(build, "d");
+	const r = nextAlias(build, "r");
+	const t = nextAlias(build, "t");
+	const u = nextAlias(build, "t");
+	const v = nextAlias(build, "t");
+	const w = nextAlias(build, "t");
+	const q = nextAlias(build, "q");
+	return [text(`select ${d}.id from (with recursive ${d}(id, level) as (select ${col(t, above.id)}::text, 0 from ${table} ${t} where ${col(t, above.field)} is true union select ${col(u, above.id)}::text, ${d}.level + 1 from ${table} ${u} join ${d} on ${col(u, above.parent)}::text = ${d}.id where ${d}.level < ${String(span)}) select ${d}.id from ${d}) ${d} union select ${col(w, above.id)}::text from ${table} ${w} where ${col(w, above.id)}::text not in (select ${r}.id from (with recursive ${r}(id, level) as (select ${col(v, above.id)}::text, 0 from ${table} ${v} where ${col(v, above.parent)} is null or not exists (select 1 from ${table} ${q} where ${col(q, above.id)} = ${col(v, above.parent)}) union select ${col(t, above.id)}::text, ${r}.level + 1 from ${table} ${t} join ${r} on ${col(t, above.parent)}::text = ${r}.id where ${r}.level < ${String(span)}) select ${r}.id from ${r}) ${r})`)];
+}
+function restrictedRowsSql(above, options) {
+	return closedRows({
+		options,
+		alias: 0
+	}, above);
+}
+/** Whether the row's restricted column keeps it out of `condition` whatever the graph says. */
+function relatedRowGuard(condition) {
+	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
+	return (condition.parent === true || hopped) && condition.restricted !== void 0 ? condition.restricted : void 0;
+}
+/**
+* `condition` as a boolean over the filtered row that is never NULL: the
+* row's field is among the reached ids, and with `parent` or `hops` the row
+* is not restricted.
+*/
+function relatedSql(condition, options) {
+	const build = {
+		options,
+		alias: 0
+	};
+	const parts = [
+		text("coalesce("),
+		{ column: condition.field },
+		text("::text in ("),
+		...targets(build, condition),
+		text("), false)")
+	];
+	const guard = relatedRowGuard(condition);
+	const above = condition.restrictedAncestors;
+	if (guard === void 0 && above === void 0) return parts;
+	const out = [text("("), ...parts];
+	if (guard !== void 0) out.push(text(" and "), { column: guard }, text(" is not true"));
+	if (above !== void 0) out.push(text(" and ("), { column: above.parent }, text(" is null or "), { column: above.parent }, text("::text not in ("), ...closedRows(build, above), text("))"));
+	out.push(text(")"));
+	return out;
+}
+/**
+* Renders parts to one SQL string: `placeholder(n)` names the n-th bound
+* value (from 1), `column` names a row column, and the subject id binds as
+* a value.
+*/
+function renderGraphSql(parts, render) {
+	let sql = "";
+	const values = [];
+	for (const part of parts) if ("text" in part) sql += part.text;
+	else if ("column" in part) sql += render.column(part.column);
+	else {
+		values.push("subject" in part ? render.subject : part.value);
+		sql += render.placeholder(values.length);
+	}
+	return {
+		sql,
+		values
+	};
+}
+//#endregion
+//#region src/conditions/compile.ts
+/** The membership table mapped for scope `name`, through the `tenant` / `team` shorthands. */
+function scopeMembershipTable(mapping, scopes, name) {
+	const table = mapping?.scopes?.[name];
+	if (table !== void 0) return table;
+	if (name === scopes[0]?.name) return mapping?.tenant;
+	if (name === scopes[1]?.name) return mapping?.team;
+}
+/** The column of `table` holding scope `name`'s id, through the `tenant` / `team` shorthands. */
+function scopeColumn(table, scopes, name) {
+	const column = table.columns?.[name];
+	if (column !== void 0) return column;
+	if (name === scopes[0]?.name) return table.tenant;
+	if (name === scopes[1]?.name) return table.team;
+}
+const NEVER = { kind: "never" };
+const ALWAYS = { kind: "always" };
+function isScalar(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value instanceof Date;
+}
+/**
+* The SQL-bound value of a condition operand. A ref the subject does not
+* resolve, or resolves to an object, becomes `null`: the in-memory evaluator
+* never matches it, so the compiled form must not either.
+*/
+function unwrap(value, subject) {
+	if (isConditionRef(value)) {
+		const resolved = resolveConditionRef(value.ref, subject);
+		if (Array.isArray(resolved)) return resolved.filter((item) => isScalar(item));
+		return isScalar(resolved) ? resolved : null;
+	}
+	if (isConditionDate(value)) {
+		const date = new Date(value.date);
+		return Number.isNaN(date.getTime()) ? null : date;
+	}
+	if (isReadonlyArray(value)) return value.map((item) => unwrap(item, subject));
+	return value;
+}
+function nonPortable(detail) {
+	return new PermDockValidationError({
+		code: "non-portable-condition",
+		permission: "",
+		resource: "",
+		boundary: "where",
+		message: `PermDock: non-portable-condition: ${detail}`
+	});
+}
+function asPortableCondition(input) {
+	if ("partial" in input && input.partial) throw nonPortable("closure grant");
+	if ("condition" in input && !("op" in input)) return input.condition;
+	return input;
+}
+/** A `contains` pattern for `LIKE`: `%`, `_` and the escape itself match literally. */
+function escapeLike(value) {
+	return value.replaceAll(/[\\%_]/gu, (char) => `\\${char}`);
+}
+function allOf(items) {
+	if (items.some((item) => item.kind === "never")) return NEVER;
+	const kept = items.filter((item) => item.kind !== "always");
+	if (kept.length === 0) return ALWAYS;
+	return sole(kept) ?? {
+		kind: "and",
+		items: kept
+	};
+}
+function anyOf(items) {
+	if (items.some((item) => item.kind === "always")) return ALWAYS;
+	const kept = items.filter((item) => item.kind !== "never");
+	if (kept.length === 0) return NEVER;
+	return sole(kept) ?? {
+		kind: "or",
+		items: kept
+	};
+}
+/**
+* Negation normal form. In memory a comparison against a NULL field is
+* false, so its negation is true; SQL's `NOT (NULL)` stays NULL. Every
+* negated comparison therefore also admits the NULL field explicitly, and
+* `not` only ever wraps a comparison or an `exists`.
+*/
+function negate(node) {
+	switch (node.kind) {
+		case "never": return ALWAYS;
+		case "always": return NEVER;
+		case "and": return anyOf(node.items.map((item) => negate(item)));
+		case "or": return allOf(node.items.map((item) => negate(item)));
+		case "not": return node.item;
+		case "isNull": return {
+			...node,
+			negated: !node.negated
+		};
+		case "compare": return anyOf([{
+			kind: "not",
+			item: node
+		}, {
+			kind: "isNull",
+			field: node.field,
+			negated: false
+		}]);
+		case "exists":
+		case "sql": return {
+			kind: "not",
+			item: node
+		};
+		default: throw nonPortable(`unknown compiled node '${String(node)}'`);
+	}
+}
+function matchingMemberships(condition, subject, now, scopes) {
+	const memberships = subjectMemberships(subject?.principal?.memberships, scopes);
+	const wanted = new Set(condition.roles);
+	return memberships.filter((membership) => {
+		if (expiredAt(membership, now)) return false;
+		if (wanted.size === 0) return true;
+		return membership.roles.some((role) => wanted.has(role));
+	});
+}
+function inList(field, values) {
+	const unique = [...new Set(values.filter((value) => value !== null && value !== void 0))];
+	if (unique.length === 0) return NEVER;
+	if (unique.length === 1) return {
+		kind: "compare",
+		op: "eq",
+		field,
+		value: unique[0]
+	};
+	return {
+		kind: "compare",
+		op: "in",
+		field,
+		value: unique
+	};
+}
+function activeTenant(subject) {
+	const tenant = subject?.principal?.tenant;
+	return tenant === void 0 || tenant === "" ? void 0 : tenant;
+}
+function existsOn(table, subject, roles, rowColumn, rowField, scoped) {
+	assertSafeKey(table.table, "membership table");
+	assertSafeKey(rowColumn, "membership column");
+	assertSafeKey(rowField, "condition field");
+	const tenantValue = scoped.tenantColumn === void 0 ? void 0 : activeTenant(subject);
+	return compact({
+		kind: "exists",
+		table: table.table,
+		user: table.user,
+		userValue: subject.principal?.id ?? "",
+		role: table.role,
+		roles,
+		rowColumn,
+		rowField,
+		expiresAt: table.expiresAt,
+		now: scoped.now,
+		tenantColumn: tenantValue === void 0 ? void 0 : scoped.tenantColumn,
+		tenantValue,
+		resourceColumn: scoped.resource === void 0 ? void 0 : table.resource,
+		resourceValue: table.resource === void 0 ? void 0 : scoped.resource
+	});
+}
+function compileExists(condition, table, subject, now, mappings, scopes) {
+	const userValue = subject?.principal?.id;
+	if (subject === void 0 || typeof userValue !== "string" || userValue === "") return NEVER;
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
+	const rowColumn = scope === void 0 ? table.id : scopeColumn(table, scopes, scope);
+	if (rowColumn === void 0) return NEVER;
+	const root = rootScope(scopes);
+	const own = existsOn(table, subject, condition.roles, rowColumn, condition.field, {
+		now,
+		tenantColumn: scope !== void 0 && root !== void 0 && scopeChain(scopes, scope).includes(root) ? scopeColumn(table, scopes, root) : void 0,
+		resource: condition.scope === "resource" ? condition.resource : void 0
+	});
+	if (condition.scope !== "resource") return own;
+	return anyOf([own, ...(condition.parents ?? []).map((parent) => {
+		const hop = parentHop(parent);
+		if (hop.resource === void 0) return existsOn(table, subject, condition.roles, rowColumn, hop.field, {
+			now,
+			tenantColumn: void 0,
+			resource: void 0
+		});
+		const hopTable = mappings?.resource?.[hop.resource];
+		if (hopTable?.id === void 0) return NEVER;
+		return existsOn(hopTable, subject, condition.roles, hopTable.id, hop.field, {
+			now,
+			tenantColumn: void 0,
+			resource: hop.resource
+		});
+	})]);
+}
+function compileMemberOf(condition, options) {
+	assertSafeKey(condition.field, "condition field");
+	const now = options.now ?? Date.now() / 1e3;
+	const scopes = options.scopes ?? scopeList(void 0);
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) return NEVER;
+	const mapping = scope === void 0 ? condition.resource === void 0 ? void 0 : options.memberships?.resource?.[condition.resource] : scopeMembershipTable(options.memberships, scopes, scope);
+	if (mapping !== void 0) return compileExists(condition, mapping, options.subject, Math.ceil(now), options.memberships, scopes);
+	const matched = matchingMemberships(condition, options.subject, now, scopes);
+	const active = activeTenant(options.subject);
+	if (scope !== void 0) return inList(condition.field, matched.flatMap((membership) => {
+		if (membership.scope !== scope || membership.id === void 0) return [];
+		const tenant = tenantOf(membership, scopes);
+		return active !== void 0 && tenant !== void 0 && tenant !== active ? [] : [membership.id];
+	}));
+	const ids = matched.flatMap((membership) => {
+		if (membership.on === void 0) return [];
+		if (condition.resource !== void 0 && membership.on.resource !== condition.resource) return [];
+		return [membership.on.id];
+	});
+	return anyOf([inList(condition.field, ids), ...(condition.parents ?? []).map((parent) => {
+		const hop = parentHop(parent);
+		assertSafeKey(hop.field, "condition field");
+		return inList(hop.field, matched.flatMap((membership) => membership.on === void 0 || hop.resource !== void 0 && membership.on.resource !== hop.resource ? [] : [membership.on.id]));
+	})]);
+}
+function compileCompare(condition, options) {
+	if (condition.field === "_" && condition.op === "eq") return condition.value === true ? ALWAYS : NEVER;
+	assertSafeKey(condition.field, "condition field");
+	const value = unwrap(condition.value, options.subject);
+	if (condition.op === "in" || condition.op === "notIn") {
+		const list = Array.isArray(value) ? [...new Set(value.filter((item) => item !== null && item !== void 0))] : [];
+		if (list.length === 0) return condition.op === "in" ? NEVER : {
+			kind: "isNull",
+			field: condition.field,
+			negated: true
+		};
+		return {
+			kind: "compare",
+			op: condition.op,
+			field: condition.field,
+			value: list
+		};
+	}
+	if (value === null || value === void 0) return NEVER;
+	return {
+		kind: "compare",
+		op: condition.op,
+		field: condition.field,
+		value
+	};
+}
+function compileRelated(condition, options) {
+	if (options.relations === void 0 || options.resources === void 0) throw nonPortable("related (the relation graph): pass `relations` so it compiles to a subquery, or resolve it to ids first (permdock/prisma resolveRelated)");
+	assertSafeKey(condition.field, "condition field");
+	const principal = options.subject?.principal?.id;
+	if (condition.ids === void 0 && (principal === void 0 || principal === "")) return NEVER;
+	return {
+		kind: "sql",
+		parts: relatedSql(condition, {
+			...options.relations,
+			resources: options.resources
+		}),
+		subject: principal ?? ""
+	};
+}
+function compileNode(condition, options) {
+	switch (condition.op) {
+		case "and": return allOf(condition.conditions.map((child) => compileNode(child, options)));
+		case "or": return anyOf(condition.conditions.map((child) => compileNode(child, options)));
+		case "not": return negate(compileNode(condition.condition, options));
+		case "isNull":
+			assertSafeKey(condition.field, "condition field");
+			return {
+				kind: "isNull",
+				field: condition.field,
+				negated: !condition.value
+			};
+		case "opaque": throw nonPortable("opaque SQL");
+		case "sqlFunction": return compileNode(condition.twin, options);
+		case "memberOf": return compileMemberOf(condition, options);
+		case "related": return compileRelated(condition, options);
+		case "liveSession": return options.subject?.liveSession === true ? ALWAYS : NEVER;
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn": return compileCompare(condition, options);
+		default: throw nonPortable("unknown condition");
+	}
+}
+/** The subject `permdock.where()` was built for, when the input carries one. */
+function whereSubject(input) {
+	return "partial" in input ? input.subject : void 0;
+}
+function whereScopes(input) {
+	return "partial" in input ? input.scopes : void 0;
+}
+function whereResources(input) {
+	return "partial" in input ? input.resources : void 0;
+}
+function compileWhere(input, options = {}) {
+	const subject = options.subject ?? whereSubject(input);
+	const scopes = options.scopes ?? whereScopes(input);
+	const resources = options.resources ?? whereResources(input);
+	return compileNode(asPortableCondition(input), compact({
+		...options,
+		subject,
+		scopes,
+		resources
+	}));
+}
+//#endregion
+export { relatedRowGuard as a, relationArmSql as c, scopeMembershipTable as i, renderGraphSql as l, escapeLike as n, relatedSql as o, scopeColumn as r, relatedTargetsSql as s, compileWhere as t, restrictedRowsSql as u };