permdock 0.0.0 → 0.2.0

package/dist/rls-import-D8F7j35Q.js

@@ -0,0 +1,943 @@
+import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
+import { B as parseMembershipsFlag, n as HELPERS } from "./rls-shared-aOQ4hGTO.js";
+import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-BMasREhR.js";
+import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { deparse, parse } from "pgsql-parser";
+//#region src/cli/rls-import-ast.ts
+function asNode$1(value) {
+	if (value !== null && typeof value === "object" && !Array.isArray(value)) return value;
+}
+function stringVal(value) {
+	const node = asNode$1(value);
+	if (node === void 0) return;
+	const inner = asNode$1(node["String"]);
+	if (inner !== void 0) {
+		if (typeof inner["sval"] === "string") return inner["sval"];
+		if (typeof inner["str"] === "string") return inner["str"];
+	}
+	if (typeof node["str"] === "string") return node["str"];
+	if (typeof node["sval"] === "string") return node["sval"];
+}
+function unwrap(value) {
+	const node = asNode$1(value);
+	if (node === void 0) return value;
+	const cast = asNode$1(node["TypeCast"]);
+	if (cast !== void 0) return unwrap(cast["arg"]);
+	return value;
+}
+function columnName(value) {
+	const fields = asNode$1(asNode$1(unwrap(value))?.["ColumnRef"])?.["fields"];
+	if (!Array.isArray(fields) || fields.length === 0) return;
+	return stringVal(fields.at(-1));
+}
+function funcName(value) {
+	const names = asNode$1(asNode$1(unwrap(value))?.["FuncCall"])?.["funcname"];
+	if (!Array.isArray(names) || names.length === 0) return;
+	return names.map((item) => stringVal(item) ?? "").join(".");
+}
+/** The expression of a scalar `(select <expr>)`, the InitPlan form generate writes. */
+function scalarSubselect(value) {
+	const targets = asNode$1(asNode$1(asNode$1(asNode$1(unwrap(value))?.["SubLink"])?.["subselect"])?.["SelectStmt"])?.["targetList"];
+	if (!Array.isArray(targets) || targets[0] === void 0) return;
+	return asNode$1(asNode$1(targets[0])?.["ResTarget"])?.["val"];
+}
+function isAuthUid(value) {
+	const inner = scalarSubselect(value);
+	if (inner !== void 0) return isAuthUid(inner);
+	const name = funcName(value);
+	return name === "auth.uid" || name === "auth.user_id" || name === "uid" || name === "user_id" || name?.split(".").at(-1) === "permdock_user_id";
+}
+function isCurrentSettingUserId(value) {
+	const inner = scalarSubselect(value);
+	if (inner !== void 0) return isCurrentSettingUserId(inner);
+	if (funcName(value) !== "current_setting") return false;
+	const args = asNode$1(asNode$1(unwrap(value))?.["FuncCall"])?.["args"];
+	if (!Array.isArray(args) || args[0] === void 0) return false;
+	const literal = constValue(args[0]);
+	return typeof literal === "string" && literal.endsWith(".user_id");
+}
+function constValue(value) {
+	const constant = asNode$1(asNode$1(unwrap(value))?.["A_Const"]);
+	if (constant === void 0) return;
+	if (constant["isnull"] === true) return null;
+	const sval = asNode$1(constant["sval"]);
+	if (sval !== void 0 && typeof sval["sval"] === "string") return sval["sval"];
+	if (typeof constant["sval"] === "string") return constant["sval"];
+	const ival = asNode$1(constant["ival"]);
+	if (ival !== void 0) {
+		const number = ival["ival"] ?? 0;
+		return typeof number === "number" ? number : void 0;
+	}
+	if (typeof constant["ival"] === "number") return constant["ival"];
+	const boolval = asNode$1(constant["boolval"]);
+	if (boolval !== void 0) {
+		const flag = boolval["boolval"] ?? false;
+		return typeof flag === "boolean" ? flag : void 0;
+	}
+	if (typeof constant["boolval"] === "boolean") return constant["boolval"];
+}
+function selectFromTable(selectNode) {
+	const from = asNode$1(asNode$1(selectNode)?.["SelectStmt"])?.["fromClause"];
+	if (!Array.isArray(from) || from[0] === void 0) return;
+	const relname = asNode$1(asNode$1(from[0])?.["RangeVar"])?.["relname"];
+	return typeof relname === "string" ? relname : void 0;
+}
+function sublinkTable(value, kinds) {
+	const sub = asNode$1(asNode$1(unwrap(value))?.["SubLink"]);
+	if (sub === void 0) return;
+	const kind = sub["subLinkType"];
+	if (kind === void 0 || !kinds.has(kind)) return;
+	return selectFromTable(sub["subselect"]);
+}
+function membershipTable(value) {
+	const exists = sublinkTable(value, /* @__PURE__ */ new Set(["EXISTS_SUBLINK", 0]));
+	if (exists !== void 0) return exists;
+	const anyDirect = sublinkTable(value, /* @__PURE__ */ new Set([
+		"ANY_SUBLINK",
+		"IN_SUBLINK",
+		2
+	]));
+	if (anyDirect !== void 0) return anyDirect;
+	const expr = asNode$1(asNode$1(unwrap(value))?.["A_Expr"]);
+	if (expr === void 0) return;
+	const fromRight = sublinkTable(unwrap(expr["rexpr"]), /* @__PURE__ */ new Set([
+		"ANY_SUBLINK",
+		"IN_SUBLINK",
+		"EXISTS_SUBLINK",
+		0,
+		2
+	]));
+	if (fromRight !== void 0) return fromRight;
+	if (Array.isArray(expr["rexpr"]) && expr["rexpr"][0] !== void 0) return selectFromTable(expr["rexpr"][0]);
+}
+function operatorName(value) {
+	const names = asNode$1(asNode$1(unwrap(value))?.["A_Expr"])?.["name"];
+	if (!Array.isArray(names) || names[0] === void 0) return;
+	return stringVal(names[0]);
+}
+function boolOp(value) {
+	const op = asNode$1(asNode$1(unwrap(value))?.["BoolExpr"])?.["boolop"];
+	if (op === "AND_EXPR" || op === 0) return "and";
+	if (op === "OR_EXPR" || op === 1) return "or";
+	if (op === "NOT_EXPR" || op === 2) return "not";
+}
+function functionLookupName(name, functions) {
+	if (functions === void 0) return;
+	if (functions[name] !== void 0) return functions[name];
+	return functions[name.includes(".") ? name.slice(name.lastIndexOf(".") + 1) : name];
+}
+function argFromNode(value) {
+	const field = columnName(value);
+	if (field !== void 0) return { field };
+	if (isAuthUid(value) || isCurrentSettingUserId(value)) return { ref: "principal.id" };
+	return constValue(value);
+}
+async function canonicalDump(sql) {
+	try {
+		return await deparse(await parse(sql));
+	} catch {
+		return;
+	}
+}
+function asStmts(parsed) {
+	if (Array.isArray(parsed)) return parsed;
+	const node = asNode$1(parsed);
+	if (Array.isArray(node?.["stmts"])) return node["stmts"];
+	return [];
+}
+async function fingerprintSql(sql) {
+	try {
+		const parsed = await parse(`SELECT 1 WHERE (${sql})`);
+		const deparsed = await deparse(parsed);
+		return createHash("sha256").update(deparsed).digest("hex").slice(0, 16);
+	} catch {
+		return createHash("sha256").update(sql.replaceAll(/\s+/g, " ").trim().toLowerCase()).digest("hex").slice(0, 16);
+	}
+}
+async function conditionFromAst(sql, memberships, functions, unmapped, joins = [], seeds = []) {
+	if (sql === void 0 || sql.trim() === "" || sql.trim() === "true") return {
+		op: "eq",
+		field: "_",
+		value: true
+	};
+	const where = await whereOf(sql);
+	if (where === void 0) return {
+		op: "opaque",
+		sql,
+		fingerprint: await fingerprintSql(sql)
+	};
+	const mapped = mapNode(where, {
+		memberships,
+		functions,
+		unmapped,
+		joins,
+		seeds
+	});
+	if (mapped === void 0) return {
+		op: "opaque",
+		sql,
+		fingerprint: await fingerprintSql(sql)
+	};
+	return mapped;
+}
+async function whereOf(sql) {
+	try {
+		return asNode$1(asNode$1(nodeStmt(asNode$1(asStmts(await parse(`SELECT 1 WHERE (${sql})`))[0])))?.["SelectStmt"])?.["whereClause"];
+	} catch {
+		return;
+	}
+}
+const PERMITTED = /^permitted_([a-z][a-z0-9_]*)_ids$/u;
+function helperScope(name) {
+	if (name === void 0) return;
+	const bare = name.slice(name.lastIndexOf(".") + 1);
+	if (bare === HELPERS.has) return "global";
+	return PERMITTED.exec(bare)?.[1];
+}
+function helperKey(call) {
+	const args = asNode$1(asNode$1(unwrap(call))?.["FuncCall"])?.["args"];
+	if (!Array.isArray(args) || args.length !== 1) return;
+	const key = constValue(args[0]);
+	return typeof key === "string" ? key : void 0;
+}
+function helperCall(value) {
+	const node = asNode$1(unwrap(value));
+	const sub = asNode$1(node?.["SubLink"]);
+	if (sub === void 0) {
+		const scope = helperScope(funcName(node));
+		const key = helperKey(node);
+		return scope === "global" && key !== void 0 ? {
+			scope,
+			key
+		} : void 0;
+	}
+	const targets = asNode$1(asNode$1(sub["subselect"])?.["SelectStmt"])?.["targetList"];
+	if (!Array.isArray(targets) || targets.length !== 1) return;
+	const call = asNode$1(asNode$1(targets[0])?.["ResTarget"])?.["val"];
+	const scope = helperScope(funcName(call));
+	const key = helperKey(call);
+	if (scope === void 0 || key === void 0) return;
+	const kind = sub["subLinkType"];
+	if (scope === "global") return kind === "EXPR_SUBLINK" || kind === 4 ? {
+		scope,
+		key
+	} : void 0;
+	const column = columnName(sub["testexpr"]);
+	return (kind === "ANY_SUBLINK" || kind === 2) && column !== void 0 ? {
+		scope,
+		key,
+		column
+	} : void 0;
+}
+const MEMBER = /^member_([a-z][a-z0-9_]*)_ids$/u;
+/** `col in (select member_<scope>_ids())`: any live membership of the row's instance. */
+function memberCall(value) {
+	const sub = asNode$1(asNode$1(unwrap(value))?.["SubLink"]);
+	const kind = sub?.["subLinkType"];
+	if (sub === void 0 || kind !== "ANY_SUBLINK" && kind !== 2) return;
+	const targets = asNode$1(asNode$1(sub["subselect"])?.["SelectStmt"])?.["targetList"];
+	if (!Array.isArray(targets) || targets.length !== 1) return;
+	const call = asNode$1(asNode$1(targets[0])?.["ResTarget"])?.["val"];
+	const name = funcName(asNode$1(unwrap(call)));
+	const args = asNode$1(asNode$1(unwrap(call))?.["FuncCall"])?.["args"];
+	const scope = name === void 0 ? void 0 : MEMBER.exec(name.slice(name.lastIndexOf(".") + 1))?.[1];
+	const column = columnName(sub["testexpr"]);
+	return scope === void 0 || column === void 0 || Array.isArray(args) && args.length > 0 ? void 0 : {
+		scope,
+		column
+	};
+}
+function rolesFor(seeds, key, scope) {
+	return [...new Set(seeds.filter((seed) => seed.grantKey === key && seed.scope === scope).map((seed) => seed.role))];
+}
+function helperCondition(call, seeds) {
+	const roles = rolesFor(seeds, call.key, call.scope);
+	if (call.scope === "global" || call.column === void 0) {
+		const sql = `(select ${HELPERS.has}(${quoteSqlLiteral(call.key)}))`;
+		return {
+			op: "opaque",
+			sql,
+			fingerprint: createHash("sha256").update(sql).digest("hex").slice(0, 16)
+		};
+	}
+	return {
+		op: "memberOf",
+		scope: call.scope,
+		field: call.column,
+		roles: [...roles]
+	};
+}
+function flatten(value, op) {
+	if (boolOp(value) !== op) return [value];
+	const args = asNode$1(asNode$1(unwrap(value))?.["BoolExpr"])?.["args"];
+	return Array.isArray(args) ? args.flatMap((arg) => flatten(arg, op)) : [];
+}
+function helperCalls(conjunct) {
+	const calls = flatten(conjunct, "or").map(helperCall);
+	return calls.every((call) => call !== void 0) ? calls : void 0;
+}
+/**
+* The role structure of a policy that calls the helpers: each OR branch's
+* helper calls become grants (roles from the `role_permissions` seeds), the
+* branch's other conjuncts become their `where`. Restrictive policies are
+* read through their outer `not`.
+*/
+async function helperGrants(sql, memberships, functions, seeds) {
+	if (sql === void 0) return [];
+	let where = await whereOf(sql);
+	if (boolOp(where) === "not") {
+		where = asNode$1(asNode$1(unwrap(where))?.["BoolExpr"])?.["args"];
+		where = Array.isArray(where) ? where[0] : void 0;
+	}
+	const unportable = {
+		op: "opaque",
+		sql,
+		fingerprint: await fingerprintSql(sql)
+	};
+	const grants = [];
+	for (const branch of flatten(where, "or")) {
+		const conjuncts = flatten(branch, "and");
+		const calls = [];
+		const rest = [];
+		let portable = true;
+		for (const conjunct of conjuncts) {
+			const found = helperCalls(conjunct);
+			if (found !== void 0) {
+				calls.push(...found);
+				continue;
+			}
+			const mapped = mapNode(conjunct, {
+				memberships,
+				functions,
+				unmapped: [],
+				joins: [],
+				seeds
+			});
+			if (mapped === void 0) portable = false;
+			else rest.push(mapped);
+		}
+		if (calls.length === 0) continue;
+		const condition = !portable ? unportable : rest.length === 0 ? void 0 : rest.length === 1 ? rest[0] : {
+			op: "and",
+			conditions: rest
+		};
+		for (const call of calls) {
+			const permission = seeds.find((seed) => seed.grantKey === call.key)?.permission ?? call.key.replace(/#[a-z0-9][a-z0-9_-]*$/u, "");
+			grants.push({
+				key: call.key,
+				permission,
+				scope: call.scope,
+				roles: rolesFor(seeds, call.key, call.scope),
+				...condition === void 0 ? {} : { where: condition }
+			});
+		}
+	}
+	return grants;
+}
+const SEED_COLUMNS = [
+	"role",
+	"permission",
+	"grant_key",
+	"scope",
+	"effect"
+];
+function asScope(value) {
+	return typeof value === "string" && /^[a-z][a-z0-9_]*$/u.test(value) ? value : void 0;
+}
+function seedFromRow(row) {
+	const scope = asScope(row["scope"]);
+	if (typeof row["role"] !== "string" || typeof row["permission"] !== "string" || typeof row["grant_key"] !== "string" || scope === void 0) return;
+	return {
+		role: row["role"],
+		permission: row["permission"],
+		grantKey: row["grant_key"],
+		scope,
+		effect: row["effect"] === "deny" ? "deny" : "allow"
+	};
+}
+/** `role_permissions` rows from the `insert ... values` statements of a SQL dump. */
+async function seedsFromSql(sql) {
+	let parsed;
+	try {
+		parsed = await parse(sql);
+	} catch {
+		return [];
+	}
+	const seeds = [];
+	for (const item of asStmts(parsed)) {
+		const insert = asNode$1(asNode$1(nodeStmt(asNode$1(item)))?.["InsertStmt"]);
+		if (asNode$1(insert?.["relation"])?.["relname"] !== "role_permissions") continue;
+		const cols = Array.isArray(insert?.["cols"]) ? insert["cols"].map((col) => asNode$1(asNode$1(col)?.["ResTarget"])?.["name"]) : [];
+		const values = asNode$1(asNode$1(insert?.["selectStmt"])?.["SelectStmt"])?.["valuesLists"];
+		if (!Array.isArray(values)) continue;
+		for (const list of values) {
+			const items = asNode$1(asNode$1(list)?.["List"])?.["items"];
+			if (!Array.isArray(items)) continue;
+			const row = {};
+			for (const [index, col] of cols.entries()) if (typeof col === "string" && SEED_COLUMNS.includes(col)) row[col] = constValue(items[index]);
+			const seed = seedFromRow(row);
+			if (seed !== void 0) seeds.push(seed);
+		}
+	}
+	return seeds;
+}
+function nodeStmt(first) {
+	const raw = asNode$1(first?.["RawStmt"]);
+	if (raw !== void 0) return raw["stmt"];
+	return first?.["stmt"];
+}
+function mapNode(value, ctx) {
+	if (value === void 0) return;
+	const node = asNode$1(unwrap(value));
+	if (node === void 0) return;
+	const { memberships, functions, unmapped, joins } = ctx;
+	const member = memberCall(node);
+	if (member !== void 0) return {
+		op: "memberOf",
+		scope: member.scope,
+		field: member.column,
+		roles: []
+	};
+	const helper = helperCall(node);
+	if (helper !== void 0) return helperCondition(helper, ctx.seeds);
+	if (funcName(scalarSubselect(node) ?? node)?.split(".").at(-1) === "permdock_session_live") return { op: "liveSession" };
+	const nullTest = asNode$1(node["NullTest"]);
+	if (nullTest !== void 0) {
+		const field = columnName(nullTest["arg"]);
+		if (field === void 0) return;
+		return {
+			op: "isNull",
+			field,
+			value: nullTest["nulltesttype"] === "IS_NULL" || nullTest["nulltesttype"] === 0 || nullTest["nulltesttype"] === void 0
+		};
+	}
+	const compound = boolOp(node);
+	if (compound !== void 0) {
+		const args = asNode$1(node["BoolExpr"])?.["args"];
+		if (!Array.isArray(args)) return;
+		if (compound === "not") {
+			const inner = mapNode(args[0], ctx);
+			return inner === void 0 ? void 0 : {
+				op: "not",
+				condition: inner
+			};
+		}
+		const children = args.map((arg) => mapNode(arg, ctx)).filter((item) => item !== void 0);
+		if (children.length !== args.length) return;
+		return {
+			op: compound,
+			conditions: children
+		};
+	}
+	const table = membershipTable(node);
+	if (table !== void 0) {
+		for (const [scope, mapped] of Object.entries(memberships?.scopes ?? {})) {
+			const column = mapped.columns?.[scope];
+			if (mapped.table === table && column !== void 0) return {
+				op: "memberOf",
+				scope,
+				field: column,
+				roles: []
+			};
+		}
+		if (memberships?.tenant?.table === table) return {
+			op: "memberOf",
+			scope: "tenant",
+			field: memberships.tenant.tenant ?? "tenant_id",
+			roles: []
+		};
+		if (memberships?.team?.table === table) return {
+			op: "memberOf",
+			scope: "team",
+			field: memberships.team.team ?? "team_id",
+			roles: []
+		};
+		joins.push(table);
+		return;
+	}
+	const name = funcName(node);
+	if (name !== void 0 && !isAuthUid(node) && name !== "current_setting") {
+		const mapping = functionLookupName(name, functions);
+		if (mapping === void 0) {
+			unmapped.push(name);
+			return;
+		}
+		const call = asNode$1(node["FuncCall"]);
+		const rawArgs = Array.isArray(call?.["args"]) ? call["args"] : [];
+		return {
+			op: "sqlFunction",
+			name,
+			args: mapping.args?.map((field) => ({ field })) ?? rawArgs.map((arg) => argFromNode(arg)).filter((item) => item !== void 0),
+			twin: mapping.twin
+		};
+	}
+	const op = operatorName(node);
+	const expr = asNode$1(node["A_Expr"]);
+	if (op === "=" || op === "<>" || op === ">" || op === ">=" || op === "<" || op === "<=") {
+		const left = columnName(expr?.["lexpr"]) ?? columnName(expr?.["rexpr"]);
+		const right = expr?.["lexpr"];
+		const other = columnName(expr?.["lexpr"]) !== void 0 ? expr?.["rexpr"] : right;
+		if (left === void 0) return;
+		const comparison = op === "=" ? "eq" : op === "<>" ? "ne" : op === ">" ? "gt" : op === ">=" ? "gte" : op === "<" ? "lt" : "lte";
+		if (isAuthUid(other) || isCurrentSettingUserId(other)) return {
+			op: comparison,
+			field: left,
+			value: { ref: "principal.id" }
+		};
+		const literal = constValue(other);
+		if (literal === void 0) {
+			const claim = jwtClaim(other);
+			if (claim !== void 0) return {
+				op: comparison,
+				field: left,
+				value: { ref: `principal.claim.${claim}` }
+			};
+			return;
+		}
+		return {
+			op: comparison,
+			field: left,
+			value: literal
+		};
+	}
+}
+function jwtClaim(value) {
+	const node = asNode$1(unwrap(value));
+	const expr = asNode$1(node?.["A_Expr"]);
+	if (expr === void 0) return;
+	const name = operatorName(node);
+	if (name !== "->>" && name !== "->" || !isJwtCall(expr["lexpr"])) return;
+	const claim = constValue(expr["rexpr"]);
+	return typeof claim === "string" ? claim : void 0;
+}
+/** `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's `->>` is row data, not a claim. */
+function isJwtCall(value) {
+	const inner = scalarSubselect(value);
+	if (inner !== void 0) return isJwtCall(inner);
+	const name = funcName(value);
+	return name === "auth.jwt" || name === "auth.session";
+}
+//#endregion
+//#region src/cli/rls-import-views.ts
+function asNode(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function list(value) {
+	return Array.isArray(value) ? value : [];
+}
+function sval(value) {
+	const inner = asNode(asNode(value)?.["String"]);
+	return typeof inner?.["sval"] === "string" ? inner["sval"] : void 0;
+}
+function optionOn(value) {
+	const def = asNode(asNode(value)?.["DefElem"]);
+	if (typeof def?.["defname"] !== "string") return;
+	const arg = sval(def["arg"]) ?? "true";
+	return [
+		"true",
+		"on",
+		"1"
+	].includes(arg.toLowerCase()) ? def["defname"].toLowerCase() : void 0;
+}
+function viewsOf(stmts) {
+	const out = [];
+	for (const item of stmts) {
+		const view = asNode(asNode(asNode(item)?.["stmt"])?.["ViewStmt"]);
+		const relation = asNode(view?.["view"]);
+		const select = asNode(asNode(view?.["query"])?.["SelectStmt"]);
+		if (typeof relation?.["relname"] !== "string" || select === void 0) continue;
+		const options = new Set(list(view?.["options"]).flatMap((option) => {
+			const on = optionOn(option);
+			return on === void 0 ? [] : [on];
+		}));
+		out.push({
+			name: relation["relname"],
+			options,
+			select
+		});
+	}
+	return out;
+}
+function columnRef(value) {
+	const fields = list(asNode(asNode(value)?.["ColumnRef"])?.["fields"]).map(sval);
+	const column = fields.at(-1);
+	if (column === void 0 || fields.some((field) => field === void 0)) return;
+	const from = fields.at(-2);
+	return fields.length > 1 && from !== void 0 ? {
+		from,
+		column
+	} : { column };
+}
+function targetOf(value) {
+	const target = asNode(asNode(value)?.["ResTarget"]);
+	if (target === void 0) return;
+	const plain = columnRef(target["val"]);
+	const alias = typeof target["name"] === "string" ? target["name"] : void 0;
+	if (plain !== void 0) return {
+		name: alias ?? plain.column,
+		column: plain.column,
+		...plain.from === void 0 ? {} : { from: plain.from }
+	};
+	const when = asNode(asNode(list(asNode(asNode(target["val"])?.["CaseExpr"])?.["args"])[0])?.["CaseWhen"]);
+	const result = when === void 0 ? void 0 : columnRef(when["result"]);
+	if (when === void 0 || result === void 0) return;
+	return {
+		name: alias ?? result.column,
+		column: result.column,
+		mask: when["expr"]
+	};
+}
+function rangeVar(value) {
+	const range = asNode(asNode(value)?.["RangeVar"]);
+	if (typeof range?.["relname"] !== "string") return;
+	const alias = asNode(range["alias"])?.["aliasname"];
+	return typeof alias === "string" ? {
+		name: range["relname"],
+		alias
+	} : { name: range["relname"] };
+}
+function sourceOf(select) {
+	const from = list(select["fromClause"]);
+	if (from.length !== 1) return;
+	const direct = rangeVar(from[0]);
+	if (direct !== void 0) return direct.alias === void 0 ? { table: direct.name } : {
+		table: direct.name,
+		alias: direct.alias
+	};
+	const join = asNode(asNode(from[0])?.["JoinExpr"]);
+	const left = rangeVar(join?.["larg"]);
+	const right = rangeVar(join?.["rarg"]);
+	if (join?.["jointype"] !== "JOIN_LEFT" || left === void 0 || right === void 0) return;
+	return {
+		table: left.name,
+		...left.alias === void 0 ? {} : { alias: left.alias },
+		companion: right
+	};
+}
+/** A mask is `allow`, `not deny` or `allow and not deny`; the generator puts the deny last. */
+function splitMask(mask) {
+	const bool = asNode(asNode(mask)?.["BoolExpr"]);
+	if (bool?.["boolop"] === "NOT_EXPR") return { deny: list(bool["args"])[0] };
+	if (bool?.["boolop"] !== "AND_EXPR") return { allow: mask };
+	const args = list(bool["args"]);
+	const last = asNode(asNode(args.at(-1))?.["BoolExpr"]);
+	if (last?.["boolop"] !== "NOT_EXPR") return { allow: mask };
+	const rest = args.slice(0, -1);
+	return {
+		allow: rest.length === 1 ? rest[0] : { BoolExpr: {
+			boolop: "AND_EXPR",
+			args: rest
+		} },
+		deny: list(last["args"])[0]
+	};
+}
+async function grantsOf(node, memberships, functions, seeds) {
+	const expr = asNode(node);
+	if (expr === void 0) return [];
+	return helperGrants(await deparse(expr), memberships, functions, seeds);
+}
+/**
+* Reads back the field views `rls generate --fields views` writes: a
+* `security_invoker` `<table>_visible` whose restricted columns are
+* `case when <mask> then col end`, either inline or through the
+* `<table>_visible_fields` companion it joins. Other views are ignored.
+*/
+async function fieldViewsFromSql(sql, memberships, functions, seeds) {
+	let stmts;
+	try {
+		stmts = list(asNode(await parse(sql))?.["stmts"]);
+	} catch {
+		return [];
+	}
+	const views = viewsOf(stmts);
+	const byName = new Map(views.map((view) => [view.name, view]));
+	const out = [];
+	for (const view of views) {
+		if (!view.name.endsWith(FIELD_VIEWS.view) || !view.options.has("security_invoker")) continue;
+		const source = sourceOf(view.select);
+		const targets = list(view.select["targetList"]).map(targetOf);
+		if (source === void 0 || targets.some((target) => target === void 0)) continue;
+		const companion = source.companion === void 0 ? void 0 : byName.get(source.companion.name);
+		const masks = /* @__PURE__ */ new Map();
+		if (source.companion !== void 0) {
+			if (companion === void 0 || !companion.options.has("security_barrier")) continue;
+			for (const target of list(companion.select["targetList"]).map(targetOf)) if (target?.mask !== void 0) masks.set(target.name, target.mask);
+		}
+		const passthrough = [];
+		const restricted = [];
+		for (const target of targets) {
+			const fromCompanion = source.companion !== void 0 && target.from !== void 0 && target.from === (source.companion.alias ?? source.companion.name);
+			const mask = target.mask ?? (fromCompanion ? masks.get(target.name) : void 0);
+			if (mask === void 0) {
+				if (!fromCompanion) passthrough.push(target.name);
+				continue;
+			}
+			const { allow, deny } = splitMask(mask);
+			restricted.push({
+				column: target.name,
+				grants: await grantsOf(allow, memberships, functions, seeds),
+				denies: await grantsOf(deny, memberships, functions, seeds)
+			});
+		}
+		out.push({
+			view: view.name,
+			table: source.table,
+			...source.companion === void 0 ? {} : { companion: source.companion.name },
+			passthrough,
+			restricted
+		});
+	}
+	return out;
+}
+const quote = escapeSqlIdent;
+/** `create view` statements for every view in the database, from `pg_get_viewdef` and the view's options. */
+async function viewsSqlFromDb(query) {
+	return (await query(`select n.nspname as schema, c.relname as name, c.reloptions as options, pg_get_viewdef(c.oid) as definition
+     from pg_class c join pg_namespace n on n.oid = c.relnamespace
+     where c.relkind = 'v' and n.nspname not in ('pg_catalog', 'information_schema')
+     order by n.nspname, c.relname`)).rows.flatMap((row) => {
+		const { schema, name, definition } = row;
+		if (typeof schema !== "string" || typeof name !== "string" || typeof definition !== "string") return [];
+		const safe = (Array.isArray(row["options"]) ? row["options"].filter((item) => typeof item === "string") : []).filter((item) => /^[a-z_]+=[a-z0-9_]+$/u.test(item));
+		const withOptions = safe.length === 0 ? "" : ` with (${safe.join(", ")})`;
+		return [`create view ${quote(schema)}.${quote(name)}${withOptions} as ${definition.trim().replace(/;$/u, "")};`];
+	}).join("\n");
+}
+//#endregion
+//#region src/cli/rls-import.ts
+const POLICY_RE = /create\s+policy\s+"?([A-Za-z0-9_]+)"?\s+on\s+"?([A-Za-z0-9_]+)"?([\s\S]*?);/gi;
+function extractParenClause(sql, keyword) {
+	const match = new RegExp(`\\b${keyword}\\s*\\(`, "i").exec(sql);
+	if (match?.index === void 0) return;
+	const start = match.index + match[0].length;
+	let depth = 1;
+	for (let i = start; i < sql.length; i += 1) {
+		const ch = sql[i];
+		if (ch === "(") depth += 1;
+		else if (ch === ")") {
+			depth -= 1;
+			if (depth === 0) return sql.slice(start, i).trim();
+		}
+	}
+}
+function splitPolicies(sql) {
+	const out = [];
+	for (const match of sql.matchAll(POLICY_RE)) {
+		const name = match[1] ?? "policy";
+		const table = match[2] ?? "table";
+		const body = match[3] ?? "";
+		const clauses = body.search(/\b(?:using|with\s+check)\s*\(/i);
+		const header = clauses === -1 ? body : body.slice(0, clauses);
+		const asRestrictive = /\bas\s+restrictive\b/i.test(header);
+		const cmdMatch = /\bfor\s+(all|select|insert|update|delete)\b/i.exec(header);
+		const toMatch = /\bto\s+([^\n]+)/i.exec(header);
+		const using = extractParenClause(body, "using");
+		const check = extractParenClause(body, "with\\s+check");
+		const roles = (toMatch?.[1] ?? "authenticated").split(",").map((item) => item.trim()).filter((item) => item !== "");
+		const cmd = (cmdMatch?.[1] ?? "all").toUpperCase();
+		const commands = cmd === "ALL" ? [
+			"SELECT",
+			"INSERT",
+			"UPDATE",
+			"DELETE"
+		] : [cmd];
+		for (const command of commands) out.push({
+			name,
+			table,
+			cmd: command,
+			permissive: !asRestrictive,
+			roles,
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+	}
+	return out;
+}
+function actionsFor(cmds) {
+	const actions = [];
+	const collection = [];
+	if (cmds.includes("SELECT")) {
+		actions.push("read");
+		collection.push("list");
+	}
+	if (cmds.includes("INSERT")) collection.push("create");
+	if (cmds.includes("UPDATE")) actions.push("update");
+	if (cmds.includes("DELETE")) actions.push("delete");
+	if (actions.length === 0) actions.push("read");
+	return {
+		actions,
+		collection
+	};
+}
+function emitGenerated(catalog, fieldViews, schema) {
+	const kind = isSchemaKind(schema) ? schema : "zod";
+	const tables = [...new Set(catalog.map((item) => item.table))];
+	return emitPermissionsModule({
+		generator: "rls import",
+		schema: kind,
+		exports: fieldViews.length === 0 ? { catalog } : {
+			catalog,
+			fieldViews
+		},
+		resources: tables.map((table) => {
+			const { actions, collection } = actionsFor(catalog.filter((item) => item.table === table).map((item) => item.cmd));
+			return {
+				path: [table.replaceAll(/[^A-Za-z0-9_]/g, "_")],
+				schema: emptySchema(kind),
+				actions,
+				collection
+			};
+		})
+	});
+}
+function assertNoServiceRole(sql) {
+	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw new Error("PermDock CLI: imported SQL must never target service_role");
+}
+async function seedsFromDb(query) {
+	const schema = (await query(`select table_schema from information_schema.tables where table_name = 'role_permissions' order by table_schema = 'permdock' desc, table_schema = 'public' desc, table_schema limit 1`)).rows[0]?.["table_schema"];
+	if (typeof schema !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(schema)) return [];
+	try {
+		return (await query(`select role::text, permission::text, grant_key, scope, effect from "${schema}".role_permissions`)).rows.flatMap((row) => {
+			const seed = seedFromRow(row);
+			return seed === void 0 ? [] : [seed];
+		});
+	} catch {
+		return [];
+	}
+}
+/** `pg_policies.roles` is a `name[]`, which `pg` returns as an array or, untyped, as `{a,b}`. */
+function policyRoles(value) {
+	if (Array.isArray(value)) return value.map(String);
+	return typeof value === "string" ? value.replaceAll(/[{}]/g, "").split(",").map((item) => item.trim()).filter((item) => item !== "") : [];
+}
+async function policiesFromDb(db, connect) {
+	const client = await connect(db);
+	const query = (sql) => client.query(sql, []);
+	try {
+		const result = await query(`select tablename, policyname, permissive, roles, cmd, qual, with_check from pg_policies`);
+		const bodies = /* @__PURE__ */ new Map();
+		const procs = await query(`select proname, prosrc from pg_proc`);
+		for (const row of procs.rows) {
+			const { proname, prosrc } = row;
+			if (typeof proname === "string" && typeof prosrc === "string") bodies.set(proname, prosrc);
+		}
+		const seeds = await seedsFromDb(query);
+		const views = await viewsSqlFromDb(query);
+		const policies = [];
+		for (const row of result.rows) {
+			const { tablename, policyname, qual, with_check: check } = row;
+			if (typeof tablename !== "string" || typeof policyname !== "string") continue;
+			const cmd = typeof row["cmd"] === "string" ? row["cmd"].toUpperCase() : "ALL";
+			const commands = cmd === "ALL" ? [
+				"SELECT",
+				"INSERT",
+				"UPDATE",
+				"DELETE"
+			] : [cmd];
+			for (const command of commands) policies.push({
+				name: policyname,
+				table: tablename,
+				cmd: command,
+				permissive: row["permissive"] !== "RESTRICTIVE",
+				roles: policyRoles(row["roles"]),
+				...typeof qual === "string" ? { using: qual } : {},
+				...typeof check === "string" ? { check } : {}
+			});
+		}
+		return {
+			policies,
+			bodies,
+			seeds,
+			views
+		};
+	} finally {
+		await client.end();
+	}
+}
+async function runRlsImport(input) {
+	let policies = [];
+	let bodies = /* @__PURE__ */ new Map();
+	let seeds = [];
+	let viewsSql = "";
+	if (input.sql !== void 0) {
+		const sqlPath = resolve(input.cwd, input.sql);
+		if (!existsSync(sqlPath)) return {
+			code: 2,
+			output: `PermDock CLI: SQL dump not found: ${input.sql}`
+		};
+		const sql = readFileSync(sqlPath, "utf8");
+		assertNoServiceRole(sql);
+		viewsSql = sql;
+		seeds = await seedsFromSql(sql);
+		policies = splitPolicies(await canonicalDump(sql) ?? sql);
+		if (policies.length === 0) policies = splitPolicies(sql);
+	} else if (input.db !== void 0) try {
+		const fromDb = await policiesFromDb(input.db, input.connect ?? ((db) => connectPg(db, "permdock rls import --db")));
+		policies = fromDb.policies;
+		bodies = fromDb.bodies;
+		seeds = fromDb.seeds;
+		viewsSql = fromDb.views;
+	} catch (cause) {
+		return usageResult(cause);
+	}
+	else return {
+		code: 2,
+		output: "PermDock CLI: rls import needs --sql <file> or --db <url>"
+	};
+	const memberships = parseMembershipsFlag(input.memberships) ?? input.config.rls?.memberships;
+	const functions = input.config.rls?.functions;
+	const unmapped = [];
+	const joins = [];
+	const catalog = [];
+	for (const item of policies) {
+		const sourceSql = item.using ?? item.check ?? "true";
+		const condition = await conditionFromAst(item.using ?? item.check, memberships, functions, unmapped, joins, seeds);
+		const grants = await helperGrants(item.using ?? item.check, memberships, functions, seeds);
+		catalog.push({
+			table: item.table,
+			cmd: item.cmd,
+			permissive: item.permissive,
+			roles: item.roles,
+			condition,
+			fingerprint: await fingerprintSql(sourceSql),
+			sourceSql,
+			...grants.length === 0 ? {} : { grants }
+		});
+	}
+	const fieldViews = viewsSql === "" ? [] : await fieldViewsFromSql(viewsSql, memberships, functions, seeds);
+	const outRel = input.out ?? "src/permissions.generated.ts";
+	const outPath = resolve(input.cwd, outRel);
+	mkdirSync(dirname(outPath), { recursive: true });
+	writeFileSync(outPath, emitGenerated(catalog, fieldViews, input.schema));
+	const hints = [
+		...uniqueHints([...new Set(unmapped)], bodies),
+		...[...new Set(joins)].map(membershipHint),
+		...fieldViews.map(fieldViewHint)
+	];
+	return {
+		code: 0,
+		output: hints.length === 0 ? `wrote ${outRel}` : `wrote ${outRel}\n${hints.join("\n")}`
+	};
+}
+function fieldViewHint(view) {
+	return `field view ${view.view} over ${view.table}: ${view.restricted.map((item) => item.column).join(", ")} are field-limited; set fields on the read grants that list them (fieldViews export)`;
+}
+function membershipHint(table) {
+	return [`exists over ${table} stayed opaque; if it holds memberships, map it in permdock.config.ts:`, `// rls: { memberships: { tenant: { table: '${table}', user: 'user_id', tenant: 'tenant_id', role: 'role' } } }`].join("\n");
+}
+function uniqueHints(names, bodies) {
+	const lines = [];
+	for (const name of names) {
+		const short = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1) : name;
+		lines.push(`add rls.functions.${short} to make this grant portable`);
+		const body = bodies.get(short) ?? bodies.get(name);
+		if (body !== void 0) lines.push(`-- ${name}: ${body.trim().slice(0, 240)}`);
+	}
+	return lines;
+}
+//#endregion
+export { runRlsImport };