permdock 0.1.0 → 0.2.0

package/dist/rls-CJVja9Ww.js

@@ -1,2119 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { d as isFieldRelation, g as listPermissions, i as findPermission, p as isPrincipalRelation, u as isEdgeRelation, v as renamedKeys } from "./permissions-DC7GROPA.js";
-import { a as hasConditionOp } from "./refs-ChLSxbST.js";
-import { m as memoryRoleSource } from "./src-CTNT-PBW.js";
-import { a as resolveScope, c as scopeChain, u as scopeList } from "./scopes-cKVp_WTw.js";
-import { b as findRole, w as listRoles } from "./grantee-Bv04_Vzf.js";
-import { d as membershipsClaim, t as createPermDock, u as customRoleScope } from "./permdock-yoZ7EjxX.js";
-import { t as memoryRelations } from "./relations-r4soIFZB.js";
-import { o as jsonSchemaOf, s as policyRowConditionKeys } from "./catalog-doc-BSo_Q_-6.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-BZ24CpZP.js";
-import "./budget-NbEtbJC_.js";
-import { n as escapeSqlIdent } from "./sql-Bll1d7y0.js";
-import "./sources-DVHM3Mwq.js";
-import { i as SEEDS_MARKER, r as INDEXES_MARKER } from "./markers-B0hYLvMD.js";
-import { a as usageResult } from "./errors-DSMnAVNa.js";
-import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Cvaw0gDG.js";
-import { _ as resolveAuthorize, c as supabaseHookSql, d as parseSplit, f as partPath, g as rbacScaffold, h as parseRbacAuthorize, m as writeSqlFiles, p as pgDeltaPath, r as grantsLabel, u as driftOf, y as supabaseConfig } from "./supabase-hook-D_OqGb_V.js";
-import { B as scopeSources, C as globalKindFilterSql, D as kindFilterSql, F as qualifiedTable$1, H as scopeTypeOf, I as quoteIdent$1, K as subjectIdSql, L as quoteLiteral, M as memberIdsHelper, N as parseMembershipsFlag, P as permittedIdsHelper, R as quoteTable, V as scopeTable, W as subjectClaimJsonSql, a as helpersSql, b as columnTypesOf, c as membershipTable, d as seedSql, f as signedIn, i as globalRoleRows, l as qualified$1, n as accessSql, o as memberColumn, s as membershipRows, t as HELPERS, u as roleRows, w as graphHelper, y as checkSuspension, z as roleKindSql } from "./rls-helpers-BxRuif0l.js";
-import { _ as breakGlassKey, a as columnRevokeSql, c as rowBranches, d as commandFor, f as compileGrants, g as breakGlassHolder, h as indexesSql, i as columnGrantSql, l as viewName, m as indexTargets, n as connectPgPool, o as fieldViews, p as tableFor, r as FIELD_VIEWS, s as fieldViewsSql, t as connectPg, u as assemblePolicies, v as collectGrants, y as roleNames } from "./pg-4GJWDUxG.js";
-import { a as HELPER_TABLE_POLICIES_SQL, c as helperCallKeys, d as rowConditionMessage, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths, u as helperTablePoliciesFromRows } from "./rls-graph-DxQ39PJj.js";
-import { basename, resolve } from "node:path";
-import { randomUUID } from "node:crypto";
-//#region src/cli/rls-break-glass.ts
-/** The audit table every generated break-glass read writes to. Part of the SQL contract. */
-const BREAK_GLASS_AUDIT = "permdock_break_glass_audit";
-const IDENT = /^[a-z][a-z0-9_]*$/u;
-/**
-* The resources a `breakGlass` grant targets, with the table each reads. A
-* break-glass grant is non-portable, so `compileGrants` never turns it into a
-* policy; the server reads restricted rows through the generated function
-* instead, which is why plain RLS keeps denying them.
-*/
-function breakGlassEntries(policy, tables) {
-	const byResource = /* @__PURE__ */ new Map();
-	for (const item of collectGrants(policy)) {
-		const { grant } = item;
-		if (grant.breakGlass === void 0) continue;
-		const holder = breakGlassHolder(item);
-		const resource = grant.permission.resource;
-		const grants = byResource.get(resource) ?? [];
-		byResource.set(resource, grants);
-		if (holder === void 0) {
-			const root = policy.scopes[0];
-			grants.push({
-				permission: grant.permission.key,
-				scope: "anyone",
-				column: root?.key,
-				...root === void 0 ? {} : { root: root.name }
-			});
-			continue;
-		}
-		grants.push({
-			permission: grant.permission.key,
-			scope: holder.scope,
-			column: holder.scope === "global" ? void 0 : policy.scopes.find((scope) => scope.name === holder.scope)?.key
-		});
-	}
-	return [...byResource].map(([resource, grants]) => ({
-		resource,
-		table: tableFor(resource, tables),
-		grants
-	}));
-}
-/**
-* Rows the subject's roles reach for `p_permission`: a break-glass grant
-* lifts denies, never the tenant boundary. A grant to no role reads the rows
-* of the root scopes the subject is a member of, or every row when the
-* policy declares no scopes.
-*/
-function rowsFilter(ctx, entry) {
-	const arms = entry.grants.flatMap((grant) => {
-		const asked = `p_permission = ${quoteLiteral(grant.permission)}`;
-		if (grant.scope === "anyone") {
-			if (grant.root === void 0) return [`(${asked})`];
-			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified$1(ctx, memberIdsHelper(grant.root))}()))`];
-		}
-		if (grant.scope !== "global" && grant.column === void 0) return [];
-		return [`(${asked} and ${accessSql(ctx, grant.scope, breakGlassKey(grant.permission), grant.column)})`];
-	});
-	return arms.length === 0 ? "false" : [...new Set(arms)].join("\n    or ");
-}
-function functionName(resource) {
-	if (!IDENT.test(resource)) throw new Error(`PermDock CLI: unsafe break-glass resource '${resource}'`);
-	return `permdock_break_glass_${resource}`;
-}
-function qualifiedTable(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
-}
-function auditSql(ctx) {
-	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
-	return `-- break-glass audit: one row per session that read restricted data
--- RLS never compiles a break-glass override, so restricted rows stay denied to a direct read
-create table if not exists ${audit} (
-  id bigint generated always as identity primary key,
-  at timestamptz not null default now(),
-  subject text,
-  permission text not null,
-  purpose text,
-  reason text not null
-);
-alter table ${audit} enable row level security;
-revoke all on table ${audit} from anon, authenticated, public;`;
-}
-function readFunctionSql(ctx, entry) {
-	const fn = qualified$1(ctx, functionName(entry.resource));
-	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
-	const table = qualifiedTable(entry.table);
-	const session = subjectClaimJsonSql(ctx, "break_glass");
-	const subject = subjectIdSql(ctx);
-	return `-- ${entry.resource}: reads restricted rows through a checked, audited break-glass session
-create or replace function ${fn}(p_permission text)
-returns setof ${table}
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  session jsonb := ${session};
-begin
-  if session is null
-    or jsonb_typeof(session) <> 'object'
-    or session ->> 'v' <> '1'
-    or session ->> 'permission' <> p_permission
-    or coalesce(session ->> 'reason', '') = ''
-    or jsonb_typeof(session -> 'expiresAt') <> 'number'
-    or (session ->> 'expiresAt')::numeric <= extract(epoch from now())
-  then
-    raise exception 'PermDock: no valid break-glass session for %', p_permission
-      using errcode = '42501';
-  end if;
-  insert into ${audit} (subject, permission, purpose, reason)
-  values (
-    nullif((${subject})::text, ''),
-    p_permission,
-    session ->> 'purpose',
-    session ->> 'reason'
-  );
-  return query select * from ${table}
-  where ${rowsFilter(ctx, entry)};
-end;
-$$;
-revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;`;
-}
-/**
-* The `security definer` read path for every `breakGlass` grant: an audit
-* table and one `permdock_break_glass_<resource>(permission)` per resource
-* that checks a signed break-glass session, writes an audit row and returns
-* the rows in the scope instances where the subject holds a role with the
-* break-glass grant (bypassing the table's policies as the definer). Empty
-* when the policy has no break-glass grant.
-*/
-function breakGlassSql(ctx, entries) {
-	if (entries.length === 0) return "";
-	return [auditSql(ctx), ...entries.map((entry) => readFunctionSql(ctx, entry))].join("\n\n");
-}
-//#endregion
-//#region src/cli/rls-emit.ts
-const HEADER = "-- generated by permdock rls generate\n-- fail-closed: never target a bypass role\n";
-function assertNoServiceRole(text) {
-	if (/\bservice_role\b/iu.test(text)) throw new Error("PermDock CLI: generated RLS must never emit service_role");
-}
-/**
-* Neon's Data API and `pg_session_jwt` name the anonymous role `anonymous`;
-* Supabase, PostgREST and the GUC pattern use `anon`. Role lists end a line
-* or a statement after `to` or `from`, so only those are renamed.
-*/
-function dialectRoles(text, dialect) {
-	if (dialect !== "neon") return text;
-	return text.replaceAll(/\b(to|from) ((?:[a-z_]+, )*[a-z_]+)(?=;|\n)/gu, (_match, keyword, list) => `${keyword} ${list.split(", ").map((role) => role === "anon" ? "anonymous" : role).join(", ")}`);
-}
-function tablesOf(policies) {
-	return [...new Set(policies.map((item) => item.table))];
-}
-/** Enable (and force) row level security, then the table grants for the commands a policy allows. */
-function tableSql$1(table, policies, force, views) {
-	const closed = views.find((view) => view.table === table && view.companion !== void 0);
-	const target = quoteTable(qualifiedTable$1(table));
-	const lines = [`alter table ${target} enable row level security;`];
-	if (force) lines.push(`alter table ${target} force row level security;`);
-	lines.push(`revoke all on table ${target} from anon, authenticated;`);
-	for (const role of ["anon", "authenticated"]) {
-		const cmds = new Set(policies.filter((item) => item.table === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
-		const grants = [
-			"select",
-			"insert",
-			"update",
-			"delete"
-		].filter((cmd) => cmds.has(cmd) && (closed === void 0 || cmd !== "select"));
-		if (grants.length > 0) lines.push(`grant ${grants.join(", ")} on table ${target} to ${role};`);
-		if (closed !== void 0 && cmds.has("select")) lines.push(columnGrantSql(closed, role));
-	}
-	if (closed !== void 0) lines.push(columnRevokeSql(closed));
-	return lines.join("\n");
-}
-function emitSql(policies, preamble, force = false, views = []) {
-	const chunks = [HEADER];
-	if (preamble !== "") chunks.push(preamble);
-	for (const table of tablesOf(policies)) chunks.push(tableSql$1(table, policies, force, views), "");
-	for (const item of policies) {
-		const as = item.effect === "deny" ? "restrictive" : "permissive";
-		const to = item.roles.join(", ");
-		const lines = [
-			`drop policy if exists ${quoteIdent$1(item.name)} on ${quoteTable(qualifiedTable$1(item.table))};`,
-			`create policy ${quoteIdent$1(item.name)}`,
-			`  on ${quoteTable(qualifiedTable$1(item.table))}`,
-			`  as ${as}`,
-			`  for ${item.command}`,
-			`  to ${to}`
-		];
-		if (item.using !== void 0) lines.push(`  using (${item.using})`);
-		if (item.check !== void 0) lines.push(`  with check (${item.check})`);
-		chunks.push(`${lines.join("\n")};\n`);
-	}
-	if (views.length > 0) chunks.push(fieldViewsSql(views));
-	const text = `${chunks.join("\n").trim()}\n`;
-	assertNoServiceRole(text);
-	return text;
-}
-/**
-* The SQL a Drizzle or Prisma schema cannot declare: helpers, grants, `force` and field views.
-* `rls generate` writes it next to `out` for a custom migration.
-*/
-function migrationSql(policies, preamble, force, views) {
-	const parts = [
-		preamble.trim(),
-		...tablesOf(policies).map((table) => tableSql$1(table, policies, force, views)),
-		fieldViewsSql(views)
-	].filter((part) => part !== "");
-	if (parts.length === 0) return "";
-	const text = `${HEADER}\n${parts.join("\n\n")}\n`;
-	assertNoServiceRole(text);
-	return text;
-}
-function helpersNote(helpers, how) {
-	return helpers === void 0 ? [] : [`// run ${helpers} ${how}`];
-}
-function camelCase(name) {
-	return name.replace(/[_-]+([a-z0-9])/gi, (_, char) => char.toUpperCase());
-}
-function pascalCase(name) {
-	const camel = camelCase(name);
-	return camel.charAt(0).toUpperCase() + camel.slice(1);
-}
-const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
-function identifier(name, what) {
-	if (!IDENTIFIER.test(name)) throw new Error(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
-	return name;
-}
-function quoted(text) {
-	return `'${text.replace(/[\\']/g, (match) => `\\${match}`)}'`;
-}
-function templateText(text) {
-	return text.replace(/[\\`]|\$\{/g, (match) => `\\${match}`);
-}
-const AUTH_UID = "(select auth.uid())";
-function drizzleRoles(list) {
-	return list.includes("anon") ? "[anonRole, authenticatedRole]" : "authenticatedRole";
-}
-function emitDrizzle(policies, options) {
-	const supabase = options.dialect === "supabase";
-	const anon = policies.some((item) => item.roles.includes("anon"));
-	const sqlOf = (text) => {
-		const parts = text.split(AUTH_UID).map(templateText);
-		return `sql\`${supabase ? parts.join("${authUid}") : parts.join(AUTH_UID)}\``;
-	};
-	const usesUid = supabase && policies.some((item) => item.using?.includes(AUTH_UID) === true || item.check?.includes(AUTH_UID) === true);
-	const lines = [
-		"// generated by permdock rls generate",
-		"// fail-closed: never target a bypass role",
-		...helpersNote(options.helpers, "in a custom migration (drizzle-kit generate --custom)"),
-		"import { sql } from 'drizzle-orm'"
-	];
-	if (supabase) {
-		const named = [
-			anon ? "anonRole" : "",
-			"authenticatedRole",
-			usesUid ? "authUid" : ""
-		].filter((name) => name !== "").join(", ");
-		lines.push("import { pgPolicy } from 'drizzle-orm/pg-core'", `import { ${named} } from 'drizzle-orm/supabase'`);
-	} else lines.push("import { pgPolicy, pgRole } from 'drizzle-orm/pg-core'");
-	lines.push(`import * as schema from ${quoted(options.schema ?? "./schema")}`, "");
-	if (!supabase) {
-		if (anon) lines.push(`export const anonRole = pgRole('${options.dialect === "neon" ? "anonymous" : "anon"}').existing()`);
-		lines.push("export const authenticatedRole = pgRole('authenticated').existing()", "");
-	}
-	for (const item of policies) {
-		const as = item.effect === "deny" ? "restrictive" : "permissive";
-		const table = identifier(options.exports?.[item.table] ?? camelCase(item.table), "table export");
-		const name = identifier(camelCase(item.name), "policy export");
-		const using = item.using === void 0 ? "" : `\n  using: ${sqlOf(item.using)},`;
-		const check = item.check === void 0 ? "" : `\n  withCheck: ${sqlOf(item.check)},`;
-		lines.push(`export const ${name} = pgPolicy(${quoted(item.name)}, {`, `  as: '${as}',`, `  for: '${item.command}',`, `  to: ${drizzleRoles(item.roles)},${using}${check}`, `}).link(schema.${table})`, "");
-	}
-	const text = `${lines.join("\n").trimEnd()}\n`;
-	assertNoServiceRole(text);
-	return text;
-}
-/** Prisma 8 `policy_<command>` blocks; each target model declares `@@rls` itself. */
-function emitPrisma(policies, options = {}) {
-	const modelOf = (table) => identifier(options.models?.[table] ?? pascalCase(table), "model");
-	const models = [...new Set(policies.map((item) => modelOf(item.table)))];
-	const lines = [
-		"// generated by permdock rls generate (Prisma 8 policy blocks)",
-		"// fail-closed: never target a bypass role",
-		`// add @@rls to ${models.length === 1 ? "model" : "models"} ${models.join(", ")}; keep these blocks in their namespace`,
-		...helpersNote(options.helpers, "in a migration before these policies"),
-		""
-	];
-	for (const item of policies) {
-		if (item.effect === "deny") throw new Error(`PermDock CLI: Prisma policy blocks are permissive only, so ${item.name} (a deny) needs --target sql`);
-		lines.push(`policy_${item.command} ${identifier(item.name, "policy name")} {`, `  target = ${modelOf(item.table)}`, `  roles  = [${item.roles.join(", ")}]`);
-		if (item.using !== void 0) lines.push(`  using  = ${JSON.stringify(item.using)}`);
-		if (item.check !== void 0) lines.push(`  withCheck = ${JSON.stringify(item.check)}`);
-		lines.push("}", "");
-	}
-	const text = `${lines.join("\n").trimEnd()}\n`;
-	assertNoServiceRole(text);
-	return text;
-}
-/** The migration file written next to `out`. */
-function migrationOut(out) {
-	const dot = out.lastIndexOf(".");
-	return `${dot > Math.max(out.lastIndexOf("/"), out.lastIndexOf("\\")) ? out.slice(0, dot) : out}.migration.sql`;
-}
-function defaultOut(target) {
-	switch (target) {
-		case "sql": return "rls.sql";
-		case "drizzle": return "src/db/policies.ts";
-		case "prisma": return "prisma/policies.prisma";
-		default: return target;
-	}
-}
-//#endregion
-//#region src/cli/rls-ownership.ts
-/** Objects the ownership rules add next to the helpers. Names are part of the SQL contract. */
-const OWNERSHIP = {
-	canAssign: "permdock_can_assign",
-	holders: "permdock_holders",
-	transferOnly: "permdock_transfer_only"
-};
-function roleScope(policy, scopes, name) {
-	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
-	return typeof on === "string" ? resolveScope(scopes, on) : void 0;
-}
-/** The rules `rls generate` enforces; `undefined` when no role declares one. */
-function ownershipRules(policy, scopes) {
-	const kinds = {};
-	const assigns = [];
-	const counted = [];
-	for (const binding of policy.roles) {
-		const scope = roleScope(policy, scopes, binding.name);
-		if (binding.for !== void 0) kinds[binding.name] = binding.for;
-		const assigner = scope ?? (binding.on === void 0 ? "global" : void 0);
-		for (const target of binding.assigns ?? []) {
-			const at = roleScope(policy, scopes, target);
-			if (assigner !== void 0 && at !== void 0 && (assigner === "global" || scopeChain(scopes, at).includes(assigner))) assigns.push({
-				assigner: binding.name,
-				scope: assigner,
-				role: target
-			});
-		}
-		const min = binding.min ?? 0;
-		const transferOnly = binding.transferOnly === true;
-		if (scope !== void 0 && (min > 0 || binding.max !== void 0 || transferOnly)) counted.push(binding.max === void 0 ? {
-			role: binding.name,
-			scope,
-			min,
-			transferOnly
-		} : {
-			role: binding.name,
-			scope,
-			min,
-			max: binding.max,
-			transferOnly
-		});
-	}
-	if (Object.keys(kinds).length === 0 && assigns.length === 0 && counted.length === 0) return;
-	return {
-		kinds,
-		assigns,
-		counted
-	};
-}
-function objectName(prefix, scope) {
-	return quoteIdent$1(`${prefix}_${scope}`);
-}
-/** Live holders of `roleExpr` in instance `idExpr`, with the same kind and expiry rules as the helpers. */
-function holdersSql(ctx, table, column, idExpr, role, into) {
-	const roleExpr = typeof role === "string" ? quoteLiteral(role) : role.expr;
-	const filters = [`m.${quoteIdent$1(column)} = ${idExpr}`, `m.${quoteIdent$1(table.role)}::text = ${roleExpr}`];
-	if (table.expiresAt !== void 0) {
-		const expires = memberColumn(table.expiresAt);
-		filters.push(`(${expires} is null or ${expires} > now())`);
-	}
-	const via = table.via === void 0 ? "null::text" : `${memberColumn(table.via)}::text`;
-	const kind = typeof role === "string" ? roleKindSql(ctx, role, via) : kindFilterSql(ctx, roleExpr, via);
-	if (kind !== void 0) filters.push(kind);
-	return `select count(distinct m.${quoteIdent$1(table.user)}) into ${into}
-      from ${membershipTable(table.table)} m
-      where ${filters.join("\n        and ")}`;
-}
-/**
-* `min` and `max` as a deferred constraint trigger: checked at commit, so a
-* transfer (demote one holder, promote another) passes in one transaction. An
-* instance with no memberships left is being torn down and skips `min`.
-*/
-function holdersTriggerSql(ctx, scope, table, column, counted) {
-	const fn = qualified$1(ctx, `${OWNERSHIP.holders}_${scope}`);
-	const col = quoteIdent$1(column);
-	const checks = counted.map((rule) => {
-		const lines = [`    select count(*) into v_total from ${membershipTable(table.table)} m where m.${col} = v_key;`, `    ${holdersSql(ctx, table, column, "v_key", rule.role, "v_count")};`];
-		if (rule.min > 0) lines.push(`    if v_total > 0 and v_count < ${String(rule.min)} then
-      raise exception using
-        errcode = '23514',
-        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` keeps at least ${String(rule.min)} ${rule.role}`)},
-        hint = 'last-holder';
-    end if;`);
-		if (rule.max !== void 0) lines.push(`    if v_count > ${String(rule.max)} then
-      raise exception using
-        errcode = '23514',
-        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` has at most ${String(rule.max)} ${rule.role}`)},
-        hint = 'max-holders';
-    end if;`);
-		return lines.join("\n");
-	});
-	return `-- ${scope}: holder counts (min / max), checked at commit
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_ids text[] := '{}';
-  v_id text;
-  v_key ${membershipTable(table.table)}.${col}%type;
-  v_total bigint;
-  v_count bigint;
-begin
-  if tg_op in ('UPDATE', 'DELETE') then
-    v_ids := v_ids || old.${col}::text;
-  end if;
-  if tg_op in ('INSERT', 'UPDATE') then
-    v_ids := v_ids || new.${col}::text;
-  end if;
-  foreach v_id in array v_ids loop
-    continue when v_id is null;
-    v_key := v_id;
-${checks.join("\n")}
-  end loop;
-  return null;
-end;
-$$;
-drop trigger if exists ${objectName(OWNERSHIP.holders, scope)} on ${membershipTable(table.table)};
-create constraint trigger ${objectName(OWNERSHIP.holders, scope)}
-  after insert or update or delete on ${membershipTable(table.table)}
-  deferrable initially deferred
-  for each row execute function ${fn}();`;
-}
-/**
-* `transferOnly` as statement triggers over transition tables: a statement
-* that changes a role's holder count in an instance that had holders before
-* and still has some after is refused. Creating the first holder and removing
-* the last (which `min` guards) are not transfers.
-*/
-function transferTriggerSql(ctx, scope, table, column, roles) {
-	const fn = qualified$1(ctx, `${OWNERSHIP.transferOnly}_${scope}`);
-	const col = quoteIdent$1(column);
-	const role = quoteIdent$1(table.role);
-	const list = `array[${roles.map(quoteLiteral).join(", ")}]::text[]`;
-	const rows = (alias, source, delta) => `select ${alias}.${col} as id, ${alias}.${role}::text as role, ${delta} as delta from ${source} ${alias} where ${alias}.${role}::text = any(${list})`;
-	const loop = (source) => `    for v_change in
-      select c.id, c.role, sum(c.delta) as delta
-      from (${source}) c
-      group by c.id, c.role
-    loop
-      continue when v_change.delta = 0 or v_change.id is null;
-      ${holdersSql(ctx, table, column, "v_change.id", { expr: "v_change.role" }, "v_after")};
-      if v_after > 0 and v_after - v_change.delta > 0 then
-        raise exception using
-          errcode = '23514',
-          message = 'permdock: ' || v_change.role || ${quoteLiteral(` in ${scope} `)} || v_change.id || ' moves only by transfer',
-          hint = 'transfer-only';
-      end if;
-    end loop;`;
-	const inserted = rows("n", "permdock_new", "1");
-	const deleted = rows("o", "permdock_old", "-1");
-	const target = membershipTable(table.table);
-	const trigger = (op) => {
-		const name = quoteIdent$1(`${OWNERSHIP.transferOnly}_${scope}_${op}`);
-		return `drop trigger if exists ${name} on ${target};
-create trigger ${name}
-  after ${op} on ${target}
-  referencing ${op === "insert" ? "new table as permdock_new" : op === "delete" ? "old table as permdock_old" : "old table as permdock_old new table as permdock_new"}
-  for each statement execute function ${fn}();`;
-	};
-	return `-- ${scope}: transfer-only roles (${roles.join(", ")}) keep their holder count per statement
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_change record;
-  v_after bigint;
-begin
-  if tg_op = 'INSERT' then
-${loop(inserted)}
-  elsif tg_op = 'DELETE' then
-${loop(deleted)}
-  else
-${loop(`${inserted} union all ${deleted}`)}
-  end if;
-  return null;
-end;
-$$;
-${trigger("insert")}
-${trigger("update")}
-${trigger("delete")}`;
-}
-function pairsSql(pairs) {
-	return `values ${pairs.map((pair) => `(${quoteLiteral(pair.assigner)}, ${quoteLiteral(pair.role)})`).join(", ")}`;
-}
-/** Whether the signed-in user holds, in instance `p_scope_id`, a role whose `assigns` lists `p_role`. */
-function canAssignSql(ctx, own) {
-	const fn = qualified$1(ctx, OWNERSHIP.canAssign);
-	const parts = [];
-	const global = own.assigns.filter((pair) => pair.scope === "global");
-	if (global.length > 0) {
-		if (ctx.authorize === "database") {
-			const ur = globalRoleRows(ctx);
-			const kind = globalKindFilterSql(ctx, ur.roleSql);
-			parts.push(`exists (
-      select 1 from ${ur.from}
-      where ${ur.userSql} = ${subjectIdSql(ctx)}
-        and (${ur.roleSql}, p_role) in (${pairsSql(global)})${kind === void 0 ? "" : `\n        and ${kind}`}
-    )`);
-		} else {
-			const kind = globalKindFilterSql(ctx, "r.role");
-			parts.push(`exists (
-      select 1 from ${roleRows(ctx)}
-      where (r.role, p_role) in (${pairsSql(global)})${kind === void 0 ? "" : `\n        and ${kind}`}
-    )`);
-		}
-	}
-	for (const { name } of ctx.scopes) {
-		const pairs = own.assigns.filter((pair) => pair.scope === name);
-		if (pairs.length === 0) continue;
-		if (ctx.authorize === "database") {
-			const mapped = scopeTable(ctx, name);
-			if (mapped === void 0) continue;
-			const { table, column } = mapped;
-			const filters = [
-				`${memberColumn(table.user)} = ${subjectIdSql(ctx)}`,
-				`${memberColumn(column)}::text = p_scope_id`,
-				`(${memberColumn(table.role)}::text, p_role) in (${pairsSql(pairs)})`
-			];
-			if (table.expiresAt !== void 0) {
-				const expires = memberColumn(table.expiresAt);
-				filters.push(`(${expires} is null or ${expires} > now())`);
-			}
-			const kind = kindFilterSql(ctx, `${memberColumn(table.role)}::text`, table.via === void 0 ? "null::text" : `${memberColumn(table.via)}::text`);
-			if (kind !== void 0) filters.push(kind);
-			parts.push(`exists (
-      select 1 from ${membershipTable(table.table)} m
-      where ${filters.join("\n        and ")}
-    )`);
-		} else {
-			const kind = kindFilterSql(ctx, "r.role", "m ->> 'via'");
-			parts.push(`exists (
-      select 1 from ${membershipRows(ctx)}
-      where m ->> 'scope' = ${quoteLiteral(name)}
-        and m ->> 'id' = p_scope_id
-        and (r.role, p_role) in (${pairsSql(pairs)})
-        and case jsonb_typeof(m -> 'expiresAt')
-          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
-          else true
-        end${kind === void 0 ? "" : `\n        and ${kind}`}
-    )`);
-		}
-	}
-	const body = parts.length === 0 ? "false" : parts.join("\n    or ");
-	return `-- who may assign: a held role whose assigns lists p_role, in instance p_scope_id (its scope or an ancestor's)
-create or replace function ${fn}(p_role text, p_scope_id text)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select ${signedIn(ctx)} and (
-    ${body}
-  )
-$$;
-revoke execute on function ${fn}(text, text) from public, anon;
-grant execute on function ${fn}(text, text) to authenticated;`;
-}
-/**
-* The ownership objects: holder-count and transfer-only triggers on each
-* scope's membership table, and `permdock_can_assign` for the application's
-* own policies on those tables. Empty when no role declares a rule.
-*/
-function ownershipSql(ctx) {
-	const own = ctx.ownership;
-	if (own === void 0) return "";
-	const chunks = [];
-	for (const { name } of ctx.scopes) {
-		const counted = own.counted.filter((rule) => rule.scope === name);
-		if (counted.length === 0) continue;
-		const mapped = scopeTable(ctx, name);
-		if (mapped === void 0) {
-			chunks.push(`-- ${name}: no memberships table configured, so min, max and transferOnly are checked only by decideRoleChange`);
-			continue;
-		}
-		chunks.push(holdersTriggerSql(ctx, name, mapped.table, mapped.column, counted));
-		const transfer = counted.filter((rule) => rule.transferOnly).map((rule) => rule.role);
-		if (transfer.length > 0) chunks.push(transferTriggerSql(ctx, name, mapped.table, mapped.column, transfer));
-	}
-	if (own.assigns.length > 0) chunks.push(canAssignSql(ctx, own));
-	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
-}
-//#endregion
-//#region src/cli/rls-shims.ts
-const NAME = /^[a-z_][a-z0-9_]*$/u;
-/**
-* The key a legacy caller passes, mapped the way `rls migrate` maps it:
-* `keys` and `renamed` exactly, then the longest `prefixes` entry.
-*/
-function mappedKey(config, renamed) {
-	const exact = {
-		...renamed,
-		...config.keys
-	};
-	const prefixes = Object.entries(config.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length);
-	const fallback = prefixes.length === 0 ? "p_key" : `case ${prefixes.map(([from, to]) => `when pg_catalog.starts_with(p_key, ${quoteLiteral(from)}) then ${quoteLiteral(to)} || pg_catalog.substr(p_key, ${String(from.length + 1)})`).join(" ")} else p_key end`;
-	if (Object.keys(exact).length === 0) return fallback;
-	return `coalesce(${quoteLiteral(JSON.stringify(exact))}::jsonb ->> p_key, ${fallback})`;
-}
-function scopeOf(ctx, scope) {
-	if (!ctx.scopes.some((item) => item.name === scope)) throw new Error(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
-	return scope;
-}
-function shimFunction(name, args, argTypes, returns, sql) {
-	return `create or replace function ${name}(${args})
-returns ${returns}
-language sql
-stable
-security invoker
-set search_path = ''
-as $$
-${sql}
-$$;
-revoke execute on function ${name}(${argTypes}) from public, anon;
-grant execute on function ${name}(${argTypes}) to authenticated;`;
-}
-function shim(ctx, config, key, fn, helper) {
-	switch (helper.form) {
-		case "ids": {
-			const scope = scopeOf(ctx, helper.scope);
-			return shimFunction(fn, "p_key text", "text", `setof ${scopeTypeOf(ctx, scope)}`, `  select * from ${qualified$1(ctx, permittedIdsHelper(scope))}(${key})`);
-		}
-		case "row": {
-			const scope = scopeOf(ctx, helper.scope);
-			const type = scopeTypeOf(ctx, scope);
-			return shimFunction(fn, `p_id ${type}, p_key text`, `${type}, text`, "boolean", `  select coalesce(p_id in (select ${qualified$1(ctx, permittedIdsHelper(scope))}(${key})), false)`);
-		}
-		case "membership": {
-			const scope = scopeOf(ctx, helper.scope);
-			const type = scopeTypeOf(ctx, scope);
-			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified$1(ctx, memberIdsHelper(scope))}()), false)`);
-		}
-		case "global": return shimFunction(fn, "p_key text", "text", "boolean", `  select ${qualified$1(ctx, HELPERS.has)}(${key})`);
-		case "scoped": {
-			const literals = /* @__PURE__ */ new Map();
-			for (const scope of ctx.scopes) literals.set(scope.name, scope.name);
-			for (const [literal, scope] of Object.entries(config.scopes ?? {})) literals.set(literal, scopeOf(ctx, scope));
-			const global = config.globalScopes ?? [];
-			return shimFunction(fn, "p_scope text, p_id text, p_key text", "text, text, text", "boolean", `  select case\n${[...global.length === 0 ? [] : [`    when p_scope in (${global.map(quoteLiteral).join(", ")}) then ${qualified$1(ctx, HELPERS.has)}(${key})`], ...[...literals].filter(([literal]) => !global.includes(literal)).map(([literal, scope]) => `    when p_scope = ${quoteLiteral(literal)} then coalesce(p_id in (select ids::text from ${qualified$1(ctx, permittedIdsHelper(scope))}(${key}) as ids), false)`)].join("\n")}\n    else false\n  end`);
-		}
-		default: return helper;
-	}
-}
-/**
-* One wrapper per `rls.migrate.helpers` entry under its legacy name, so SQL
-* that `rls migrate` has not rewritten yet (function bodies, views, triggers)
-* answers from the PermDock helpers. Each is `security invoker`: it reads no
-* table, and the helpers it calls are the `security definer` ones.
-*/
-function shimsSql(ctx, config, shims, renamed) {
-	const schema = shims.schema ?? "public";
-	const key = mappedKey(config, renamed);
-	const chunks = [`-- permdock shims: legacy helper names over the permdock helpers; drop each once doctor reports no caller (PD056)`];
-	for (const [name, helper] of Object.entries(config.helpers).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
-		if (!NAME.test(name)) throw new Error(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
-		chunks.push(shim(ctx, config, key, `${quoteIdent$1(schema)}.${name}`, helper));
-	}
-	return `${chunks.join("\n\n")}\n`;
-}
-//#endregion
-//#region src/cli/rls-generate.ts
-async function loadPolicy(cwd, config, from) {
-	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
-	if (policyPath === void 0) throw new Error("PermDock CLI: rls generate needs policy in permdock.config.ts or --from");
-	return asPolicy(pickNamed(await loadModule(resolve(cwd, policyPath)), ["policy"]));
-}
-/** Declared role names, and those a tenant admin may compose into custom roles. */
-function customRoleNames(policy) {
-	const declared = [...roleNames(policy)].toSorted();
-	const assignable = declared.filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
-	const renamed = renamedKeys(policy.vocabulary.permissions);
-	return renamed.size === 0 ? {
-		declared,
-		assignable
-	} : {
-		declared,
-		assignable,
-		renamed: Object.fromEntries(renamed)
-	};
-}
-async function runRlsGenerate(input) {
-	const rls = input.config.rls;
-	const fieldsMode = input.fields ?? rls?.fields;
-	if (fieldsMode !== void 0 && fieldsMode !== "views") return {
-		code: 2,
-		output: `rls generate --fields must be views (got ${fieldsMode})`,
-		text: ""
-	};
-	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
-	if (revokeColumns && fieldsMode === void 0) return {
-		code: 2,
-		output: "rls generate --revoke-columns needs --fields views",
-		text: ""
-	};
-	const policy = await loadPolicy(input.cwd, input.config, input.from);
-	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
-	if (input.rbac && input.dialect !== "supabase") return {
-		code: 2,
-		output: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})`,
-		text: ""
-	};
-	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
-	const authorize = resolveAuthorize(input.config, {
-		authorize: input.authorize,
-		rbac: input.rbac,
-		memberships
-	});
-	const memberSources = rls?.membershipSources ?? input.config.supabase?.hook?.memberships;
-	const sources = authorize === "database" ? memberSources : void 0;
-	const scopes = scopeList(policy.scopes);
-	const suspension = checkSuspension(rls?.suspension, scopes);
-	const hookRoles = input.config.supabase?.hook?.roles;
-	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
-	if (roles !== void 0 && input.rbac) return {
-		code: 2,
-		output: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag",
-		text: ""
-	};
-	const ownership = ownershipRules(policy, scopes);
-	const graph = graphPlan(policy);
-	const ctx = {
-		dialect: input.dialect,
-		scopes,
-		tenantClaim: rls?.tenantClaim ?? "tenant_id",
-		gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
-		...rls?.actions === void 0 ? {} : { actions: rls.actions },
-		inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
-		schema,
-		authorize,
-		roleClaim: rls?.roleClaim ?? "user_role",
-		tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
-		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
-		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
-		...memberships === void 0 ? {} : { memberships },
-		...sources === void 0 || sources.length === 0 ? {} : { sources },
-		...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
-		...suspension === void 0 ? {} : { suspension },
-		...roles === void 0 ? {} : { roles },
-		...input.customRoles === true || rls?.customRoles === true ? { customRoles: customRoleNames(policy) } : {},
-		...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
-		...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
-		...ownership === void 0 ? {} : { ownership },
-		...fieldsMode === void 0 ? {} : { fields: fieldsMode },
-		...graph.size === 0 ? {} : { graph: {
-			closures: closureDepths(graph),
-			resources: policy.resources,
-			...rls?.tables === void 0 ? {} : { tables: rls.tables }
-		} }
-	};
-	if (ctx.anonymousSignIns === "deny" && ctx.dialect !== "supabase") return {
-		code: 2,
-		output: `rls.anonymousSignIns needs --dialect supabase (got ${ctx.dialect})`,
-		text: ""
-	};
-	const warnings = [];
-	if (authorize === "database") {
-		for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
-	}
-	const compiled = compileGrants(policy, ctx, rls?.tables, warnings, input.skipClosures);
-	const views = fieldsMode === void 0 ? [] : fieldViews(policy, ctx, compiled.branches, { revokeColumns }, warnings);
-	const force = input.force === true || rls?.force === true;
-	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
-	const policyName = input.policyName ?? rls?.policyName;
-	const helpersOnly = input.helpersOnly === true || rls?.helpersOnly === true;
-	if (helpersOnly && (input.target !== "sql" || fieldsMode !== void 0)) return {
-		code: 2,
-		output: "rls generate --helpers-only needs --target sql and no --fields",
-		text: ""
-	};
-	const policies = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
-		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
-		...policyName === void 0 ? {} : { name: policyName }
-	});
-	const rootMapped = ctx.scopes[0] === void 0 ? void 0 : scopeTable(ctx, ctx.scopes[0].name);
-	const rootTable = rootMapped === void 0 ? void 0 : {
-		...rootMapped.table,
-		tenant: rootMapped.column
-	};
-	const rbac = input.rbac ? rbacScaffold(policy, {
-		schema,
-		authorize,
-		...rootTable === void 0 ? {} : { memberships: rootTable },
-		...ctx.scopes[0] === void 0 ? {} : { scope: ctx.scopes[0].name },
-		...ctx.customRoles === void 0 ? {} : { customRoles: { declared: ctx.customRoles.declared } },
-		context: ctx
-	}) : void 0;
-	if (rbac !== void 0) warnings.push(...rbac.warnings);
-	if (input.rbac) warnings.push("the token hook that writes user_role and memberships comes from permdock supabase hook generate");
-	const owned = ownershipSql(ctx);
-	const graphed = graphSql(ctx, graph, rls?.tables);
-	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, rls?.tables));
-	const configured = rls?.shims;
-	const shimsConfig = typeof configured === "object" ? configured : configured === true || input.shims === true ? {} : void 0;
-	if (shimsConfig !== void 0 && rls?.migrate === void 0) return {
-		code: 2,
-		output: "PermDock CLI: rls generate --shims needs rls.migrate.helpers in permdock.config.ts",
-		text: ""
-	};
-	const shims = shimsConfig === void 0 || rls?.migrate === void 0 ? void 0 : shimsSql(ctx, rls.migrate, shimsConfig, Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
-	const preamble = [
-		rbac?.head,
-		helpersSql(ctx, compiled.rolePermissions, {
-			userRoles: !input.rbac,
-			anonExecute: views.some((view) => view.roles.includes("anon")),
-			withoutSeeds: splitsPart(input.split, "seeds")
-		}),
-		owned === "" ? void 0 : owned,
-		graphed === "" ? void 0 : graphed,
-		breakGlass === "" ? void 0 : breakGlass,
-		shims,
-		rbac?.tail
-	].filter((part) => part !== void 0).join("\n");
-	if (force) for (const entry of graph.values()) {
-		const own = [...entry.relations].filter((name) => !("edge" in (entry.node.relations[name] ?? {})));
-		if (own.length > 0) warnings.push(`--force: ${entry.node.name} relations ${own.join(", ")} are read from the ${entry.node.name} table itself, so ${graphHelper(entry.node.name)} would recurse through its own policy; keep ${entry.node.name} unforced or move them to edge tables`);
-	}
-	const outRel = input.out ?? rls?.out ?? defaultOut(input.target);
-	const migration = input.target === "sql" ? "" : dialectRoles(migrationSql(policies, preamble, force, views), ctx.dialect);
-	const migrationRel = migration === "" ? void 0 : migrationOut(outRel);
-	const helpers = migrationRel === void 0 ? void 0 : basename(migrationRel);
-	let text;
-	switch (input.target) {
-		case "sql":
-			text = dialectRoles(emitSql(policies, preamble, force, views), ctx.dialect);
-			break;
-		case "drizzle":
-			text = emitDrizzle(policies, compact({
-				dialect: ctx.dialect,
-				schema: rls?.drizzle?.schema,
-				exports: rls?.drizzle?.exports,
-				helpers
-			}));
-			break;
-		case "prisma":
-			text = emitPrisma(policies, compact({
-				models: rls?.prisma?.models,
-				helpers
-			}));
-			break;
-		default: return input.target;
-	}
-	const indexes = indexTargets(ctx, compiled.rowColumns);
-	if (!splitsPart(input.split, "indexes")) for (const target of indexes) warnings.push(`index suggestion: create index on ${target.table} (${target.columns.join(", ")}), or add indexes to --split`);
-	const extras = migration === "" ? {} : { migration };
-	if (input.write === false) return {
-		code: 0,
-		output: warnings.join("\n"),
-		text,
-		policies,
-		seeds: compiled.rolePermissions,
-		indexes,
-		keys: {
-			permissions: listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key),
-			rowConditions: [...policyRowConditionKeys(policy)],
-			renamed: Object.fromEntries(renamedKeys(policy.vocabulary.permissions))
-		},
-		schema,
-		helpersOnly,
-		...extras
-	};
-	const planned = outputFiles({
-		input,
-		outRel,
-		text,
-		helpersOnly,
-		sql: () => ({
-			policies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
-			helpers: dialectRoles(emitSql([], preamble), ctx.dialect),
-			seeds: `${SEEDS_MARKER} schema=${schema}\n${seedSql(ctx, compiled.rolePermissions)}\n`,
-			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
-		}),
-		scopes,
-		schema
-	});
-	if (typeof planned === "string") return {
-		code: 2,
-		output: planned,
-		text,
-		...extras
-	};
-	const files = [...planned];
-	if (migrationRel !== void 0) files.push({
-		part: "migration",
-		rel: migrationRel,
-		text: migration
-	});
-	if (input.check) {
-		const drift = driftOf(input.cwd, files);
-		return drift.length === 0 ? {
-			code: 0,
-			output: "rls generate up to date",
-			text,
-			...extras
-		} : {
-			code: 1,
-			output: drift.map((line) => `rls generate drift: ${line}`).join("\n"),
-			text,
-			...extras
-		};
-	}
-	const written = writeSqlFiles(input.cwd, files);
-	const extra = warnings.length === 0 ? "" : `\n${warnings.join("\n")}`;
-	return {
-		code: 0,
-		output: `wrote ${written.wrote.join(", ")}${written.printed === "" ? "" : `\n${written.printed}`}${extra}`,
-		text,
-		...extras
-	};
-}
-/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
-function splitsPart(raw, part) {
-	const split = parseSplit(raw);
-	return typeof split !== "string" && split?.includes(part) === true;
-}
-/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants. */
-function outputFiles(plan) {
-	const { input } = plan;
-	const split = parseSplit(input.split);
-	if (typeof split === "string") return split;
-	if (split?.includes("policies") === true && plan.helpersOnly) return "rls generate --helpers-only writes no policies part; drop it from --split";
-	if (split === void 0) {
-		if (input.grantsOut !== void 0) return "rls generate --grants-out needs --split with the hook part: the grants are the token hook's";
-		if (input.seedsOut !== void 0) return "rls generate --seeds-out needs --split with the seeds part";
-		return [{
-			part: "rls",
-			rel: plan.outRel,
-			text: plan.text
-		}];
-	}
-	if (input.target !== "sql") return "rls generate --split needs --target sql";
-	const pgDelta = input.out === void 0 && input.config.rls?.out === void 0 ? supabaseConfig(input.cwd).pgDelta : void 0;
-	if (pgDelta === void 0 && !plan.outRel.includes("{part}")) return `rls generate --split needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
-	if (pgDelta !== void 0 && split.includes("helpers") && !split.includes("seeds")) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
-	if (pgDelta !== void 0 && split.includes("seeds") && input.seedsOut === void 0) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
-	const at = (part, schema = plan.schema) => pgDelta === void 0 ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
-	if (input.grantsOut !== void 0 && !split.includes("hook")) return "rls generate --grants-out needs the hook part in --split";
-	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
-	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
-	const sql = plan.sql();
-	const files = [];
-	for (const part of split) switch (part) {
-		case "helpers":
-			files.push({
-				part,
-				rel: at(part),
-				text: sql.helpers
-			});
-			break;
-		case "seeds":
-			files.push({
-				part,
-				rel: input.seedsOut ?? at(part),
-				text: sql.seeds
-			});
-			break;
-		case "indexes":
-			files.push({
-				part,
-				rel: at(part),
-				text: sql.indexes
-			});
-			break;
-		case "policies":
-			files.push({
-				part,
-				rel: at(part),
-				text: sql.policies
-			});
-			break;
-		case "hook": {
-			const hook = supabaseHookSql(plan.scopes, input.config, {}, grantsLabel(input.grantsOut));
-			files.push({
-				part,
-				rel: at(part, hook.manifest.hook.schema),
-				text: hook.sql
-			});
-			if (input.grantsOut !== void 0) files.push({
-				part: "grants",
-				rel: input.grantsOut,
-				text: hook.grants
-			});
-			break;
-		}
-		default: return part;
-	}
-	return files;
-}
-//#endregion
-//#region src/cli/rls-introspect.ts
-const ROLES = ["anon", "authenticated"];
-/** Neon's `anonymous` is the role `rls generate` writes as `anon` for the other dialects. */
-function liveRole(role) {
-	return role === "anonymous" ? "anon" : role;
-}
-const PRIVILEGES = [
-	"select",
-	"insert",
-	"update",
-	"delete"
-];
-/** `posts` and `"app"."posts"` as `public.posts` and `app.posts`. */
-function qualified(table) {
-	const parts = table.split(".").map((part) => part.replaceAll("\"", ""));
-	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
-}
-const FUNCTION_HEADER = /create or replace function ("?)([A-Za-z_][\w$]*)\1\.("?)([A-Za-z_][\w$]*)\3\s*\(([\s\S]*?)\nas \$/gu;
-function helpersOf(sql) {
-	const found = /* @__PURE__ */ new Set();
-	for (const match of sql.matchAll(FUNCTION_HEADER)) {
-		const [header = "", , schema = "", , name = ""] = match;
-		if (/\bsecurity definer\b/u.test(header)) found.add(`${schema}.${name}`);
-	}
-	return [...found];
-}
-function expectedRls(policies, sql, indexes = []) {
-	const tables = [...new Set(policies.map((item) => qualified(item.table)))];
-	const grants = {};
-	for (const table of tables) {
-		const byRole = {};
-		for (const role of ROLES) {
-			const commands = new Set(policies.filter((item) => qualified(item.table) === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
-			byRole[role] = PRIVILEGES.filter((privilege) => commands.has(privilege));
-		}
-		grants[table] = byRole;
-	}
-	return {
-		policies: policies.map((item) => ({
-			table: qualified(item.table),
-			name: item.name,
-			command: item.command,
-			permissive: item.effect === "allow",
-			roles: item.roles.toSorted()
-		})),
-		tables,
-		grants,
-		helpers: helpersOf(sql),
-		indexes: indexes.map((target) => ({
-			...target,
-			table: qualified(target.table)
-		}))
-	};
-}
-/**
-* One warning per index target no index starts with. A missing index slows
-* the policy down but grants nothing, so these do not fail `verify`.
-*/
-function missingIndexes(expected, actual) {
-	return expected.indexes.flatMap((target) => {
-		const column = target.columns[0];
-		return column === void 0 || actual.leadingColumns[target.table]?.includes(column) === true ? [] : [`warning: ${target.table}: no index starts with ${column}, which the policies or helpers filter on; add it, or write it with rls generate --split ...,indexes`];
-	});
-}
-function sameList(left, right) {
-	const a = left.toSorted();
-	const b = right.toSorted();
-	return a.length === b.length && a.every((item, index) => item === b[index]);
-}
-/** One line per difference; policy expressions are not compared, since Postgres rewrites their text. */
-function diffRls(expected, actual, options = {}) {
-	const out = [];
-	const found = new Map(actual.policies.map((item) => [`${item.table}\u0000${item.name}`, item]));
-	for (const want of expected.policies) {
-		const have = found.get(`${want.table}\u0000${want.name}`);
-		if (have === void 0) {
-			out.push(`${want.table}: policy ${want.name} is missing`);
-			continue;
-		}
-		if (have.command !== want.command) out.push(`${want.table}: policy ${want.name} is for ${have.command}, expected ${want.command}`);
-		if (have.permissive !== want.permissive) out.push(`${want.table}: policy ${want.name} is ${have.permissive ? "permissive" : "restrictive"}, expected ${want.permissive ? "permissive" : "restrictive"}`);
-		if (!sameList(have.roles, want.roles)) out.push(`${want.table}: policy ${want.name} applies to ${have.roles.join(", ")}, expected ${want.roles.join(", ")}`);
-	}
-	const wanted = new Set(expected.policies.map((item) => `${item.table}\u0000${item.name}`));
-	for (const have of actual.policies) if (expected.tables.includes(have.table) && !wanted.has(`${have.table}\u0000${have.name}`)) out.push(`${have.table}: policy ${have.name} is not generated (${have.permissive ? "permissive" : "restrictive"} ${have.command}); a permissive one widens access`);
-	for (const table of expected.tables) {
-		if (actual.rlsEnabled[table] !== true) {
-			out.push(actual.rlsEnabled[table] === void 0 ? `${table}: table is missing` : `${table}: row level security is disabled`);
-			continue;
-		}
-		for (const role of ROLES) {
-			const want = expected.grants[table]?.[role] ?? [];
-			const have = actual.grants[table]?.[role] ?? [];
-			for (const privilege of want) if (!have.includes(privilege) && !(privilege === "select" && options.columnGrants === true)) out.push(`${table}: ${role} lacks ${privilege}, so the policy answers 42501 instead of filtering`);
-			for (const privilege of have) if (!want.includes(privilege)) out.push(`${table}: ${role} holds ${privilege}, which no generated policy allows`);
-		}
-	}
-	for (const helper of expected.helpers) {
-		const have = actual.helpers[helper];
-		if (have === void 0) {
-			out.push(`${helper}: helper is missing`);
-			continue;
-		}
-		if (!have.securityDefiner) out.push(`${helper}: helper is not security definer`);
-		if (!have.emptySearchPath) out.push(`${helper}: helper does not set search_path = ''`);
-	}
-	return out;
-}
-const POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, cmd, permissive, roles::text[] as roles
-from pg_policies
-where schemaname || '.' || tablename = any($1::text[])`;
-const TABLES_SQL = `select n.nspname || '.' || c.relname as target, c.relrowsecurity as enabled
-from pg_class c
-join pg_namespace n on n.oid = c.relnamespace
-where c.relkind in ('r', 'p') and n.nspname || '.' || c.relname = any($1::text[])`;
-const GRANTS_SQL = `select table_schema || '.' || table_name as target, grantee, lower(privilege_type) as privilege
-from information_schema.role_table_grants
-where grantee in ('anon', 'anonymous', 'authenticated')
-  and lower(privilege_type) in ('select', 'insert', 'update', 'delete')
-  and table_schema || '.' || table_name = any($1::text[])`;
-const HELPERS_SQL = `select n.nspname || '.' || p.proname as target, p.prosecdef as definer,
-  coalesce(array_to_string(p.proconfig, ','), '') as config
-from pg_proc p
-join pg_namespace n on n.oid = p.pronamespace
-where n.nspname || '.' || p.proname = any($1::text[])`;
-const INDEXES_SQL = `select n.nspname || '.' || c.relname as target, a.attname as leading
-from pg_index i
-join pg_class c on c.oid = i.indrelid
-join pg_namespace n on n.oid = c.relnamespace
-join pg_attribute a on a.attrelid = i.indrelid and a.attnum = i.indkey[0]
-where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
-function commandOf(cmd) {
-	const text = String(cmd ?? "").toLowerCase();
-	return text === "*" ? "all" : text;
-}
-function connectIntrospect(db) {
-	return connectPgPool(db, "permdock rls verify --introspect");
-}
-/** Reads the catalogs for the tables and helpers `expected` names (postgres-meta's queries, trimmed). */
-async function introspectRls(db, expected, connect = connectIntrospect) {
-	const client = await connect(db);
-	try {
-		const tables = [...expected.tables];
-		const [policies, enabled, grants, helpers, indexes] = await Promise.all([
-			client.query(POLICIES_SQL, [tables]),
-			client.query(TABLES_SQL, [tables]),
-			client.query(GRANTS_SQL, [tables]),
-			client.query(HELPERS_SQL, [[...expected.helpers]]),
-			client.query(INDEXES_SQL, [[...new Set(expected.indexes.map((target) => target.table))]])
-		]);
-		const leadingColumns = {};
-		for (const row of indexes.rows) (leadingColumns[String(row["target"])] ??= []).push(String(row["leading"]));
-		const byTable = {};
-		for (const row of grants.rows) {
-			const table = String(row["target"]);
-			const role = liveRole(String(row["grantee"]));
-			const entry = byTable[table] ??= {};
-			(entry[role] ??= []).push(String(row["privilege"]));
-		}
-		return {
-			policies: policies.rows.map((row) => ({
-				table: String(row["target"]),
-				name: String(row["policyname"]),
-				command: commandOf(row["cmd"]),
-				permissive: String(row["permissive"]).toUpperCase() === "PERMISSIVE",
-				roles: Array.isArray(row["roles"]) ? row["roles"].map((role) => liveRole(String(role))) : []
-			})),
-			rlsEnabled: Object.fromEntries(enabled.rows.map((row) => [String(row["target"]), row["enabled"] === true])),
-			grants: byTable,
-			helpers: Object.fromEntries(helpers.rows.map((row) => [String(row["target"]), {
-				securityDefiner: row["definer"] === true,
-				emptySearchPath: String(row["config"]).split(",").some((item) => item === "search_path=\"\"" || item === "search_path=''")
-			}])),
-			leadingColumns
-		};
-	} finally {
-		await client.end();
-	}
-}
-const SYSTEM_SCHEMAS = [
-	"pg_catalog",
-	"information_schema",
-	"pg_toast",
-	"auth",
-	"storage",
-	"realtime",
-	"extensions",
-	"graphql",
-	"graphql_public",
-	"vault",
-	"pgsodium",
-	"pgsodium_masks",
-	"net",
-	"cron",
-	"supabase_functions",
-	"supabase_migrations"
-];
-function inScope(table) {
-	const schema = table.split(".")[0] ?? "";
-	return HELPER_TABLES.some((item) => item === table) || !(SYSTEM_SCHEMAS.some((item) => item === schema) || schema.startsWith("pg_"));
-}
-function seedLine(row) {
-	return `${row.role} ${row.effect} ${row.grantKey} on ${row.scope}`;
-}
-/** Drift is an error; `info` names RLS tables whose policies call no PermDock helper. */
-function diffMixed(expected, actual) {
-	const drift = [];
-	const want = new Set(expected.seeds.map(seedLine));
-	const have = new Set(actual.seeds.map(seedLine));
-	for (const line of want) if (!have.has(line)) drift.push(`${expected.schema}.role_permissions: missing ${line}`);
-	for (const line of have) if (!want.has(line)) drift.push(`${expected.schema}.role_permissions: unexpected ${line}`);
-	const permissions = new Set(expected.permissions);
-	const conditioned = new Set(expected.rowConditions);
-	const covered = /* @__PURE__ */ new Set();
-	for (const policy of actual.policies) {
-		if (callsHelper(policy.expression)) covered.add(policy.table);
-		for (const key of helperCallKeys(policy.expression)) if (!permissions.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, which the policy does not declare, so it always denies`);
-		else if (conditioned.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`);
-	}
-	return {
-		drift,
-		info: actual.rlsTables.filter((table) => !covered.has(table)).map((table) => `${table}: no policy calls a PermDock helper`)
-	};
-}
-const ALL_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname,
-  coalesce(qual, '') || ' ' || coalesce(with_check, '') as expression
-from pg_policies`;
-const RLS_TABLES_SQL = `select n.nspname || '.' || c.relname as target
-from pg_class c
-join pg_namespace n on n.oid = c.relnamespace
-where c.relkind in ('r', 'p') and c.relrowsecurity`;
-const quoteIdent = escapeSqlIdent;
-/** Reads `role_permissions`, `pg_policies` and the RLS-enabled tables for {@link diffMixed}. */
-async function introspectMixed(db, schema, connect = connectIntrospect) {
-	const client = await connect(db);
-	try {
-		const [seeds, policies, tables] = await Promise.all([
-			client.query(`select role, permission, grant_key, scope, effect from ${quoteIdent(schema)}.role_permissions`, []),
-			client.query(ALL_POLICIES_SQL, []),
-			client.query(RLS_TABLES_SQL, [])
-		]);
-		return {
-			seeds: seeds.rows.map((row) => ({
-				role: String(row["role"]),
-				permission: String(row["permission"]),
-				grantKey: String(row["grant_key"]),
-				scope: String(row["scope"]),
-				effect: String(row["effect"]) === "deny" ? "deny" : "allow"
-			})),
-			policies: policies.rows.map((row) => ({
-				table: String(row["target"]),
-				name: String(row["policyname"]),
-				expression: String(row["expression"])
-			})).filter((row) => inScope(row.table)),
-			rlsTables: tables.rows.map((row) => String(row["target"])).filter(inScope).toSorted()
-		};
-	} finally {
-		await client.end();
-	}
-}
-//#endregion
-//#region src/cli/rls-verify-tree.ts
-const SUBJECTS = 3;
-function tableSql(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
-}
-function idFactory(node) {
-	const type = columnTypesOf(jsonSchemaOf(node))[node.id];
-	let next = 9e5;
-	return type === "numeric" ? () => {
-		next += 1;
-		return next;
-	} : () => randomUUID();
-}
-/**
-* Two spines one level deeper than the walk depth, so the depth cap is
-* crossed; side branches under the first levels alternate restricted, and
-* the second spine is restricted two levels down.
-*/
-function generateTree(node, depth) {
-	const id = idFactory(node);
-	const nodes = [];
-	for (const spine of [0, 1]) {
-		let parent = null;
-		for (let level = 0; level <= depth + 1; level += 1) {
-			const current = id();
-			nodes.push({
-				id: current,
-				parent,
-				restricted: node.restricted !== void 0 && spine === 1 && level === 2
-			});
-			if (spine === 0 && level >= 1 && level <= 3) {
-				const side = id();
-				nodes.push({
-					id: side,
-					parent: current,
-					restricted: node.restricted !== void 0 && level % 2 === 1
-				});
-				nodes.push({
-					id: id(),
-					parent: side,
-					restricted: false
-				});
-			}
-			parent = current;
-		}
-	}
-	return nodes;
-}
-function insertSql(table, rows) {
-	const columns = Object.keys(rows[0] ?? {});
-	const values = [];
-	const tuples = rows.map((row) => `(${columns.map((column) => {
-		values.push(row[column]);
-		return `$${String(values.length)}`;
-	}).join(", ")})`);
-	return {
-		sql: `insert into ${tableSql(table)} (${columns.map(quoteIdent$1).join(", ")}) values ${tuples.join(", ")} returning *`,
-		values
-	};
-}
-const REQUIRED_COLUMNS_SQL = `select a.attname as name,
-  format_type(a.atttypid, a.atttypmod) as type,
-  k.confrelid::regclass::text as "refTable",
-  r.attname as "refColumn"
-from pg_attribute a
-left join pg_constraint k
-  on k.conrelid = a.attrelid and k.contype = 'f' and k.conkey = array[a.attnum]
-left join pg_attribute r
-  on r.attrelid = k.confrelid and r.attnum = k.confkey[1]
-where a.attrelid = $1::regclass and a.attnum > 0 and not a.attisdropped
-  and a.attnotnull and not a.atthasdef
-  and a.attidentity = '' and a.attgenerated = ''`;
-function placeholder(type) {
-	if (type === "uuid") return randomUUID();
-	if (type === "boolean") return false;
-	if (/^(smallint|integer|bigint|numeric|real|double precision)/u.test(type)) return 0;
-	if (type.startsWith("timestamp") || type === "date") return (/* @__PURE__ */ new Date()).toISOString();
-	if (type === "json" || type === "jsonb") return {};
-	return "permdock-tree";
-}
-function asRequiredColumn(row) {
-	const { name, type, refTable, refColumn } = row;
-	if (typeof name !== "string" || typeof type !== "string") return;
-	return {
-		name,
-		type,
-		refTable: typeof refTable === "string" ? refTable : null,
-		refColumn: typeof refColumn === "string" ? refColumn : null
-	};
-}
-/**
-* Values for the required columns a generated row leaves out, such as a
-* tenant column or a name: an existing value of the referenced table for a
-* foreign key, a placeholder of the column's type otherwise.
-*/
-async function requiredValues(query, table, set) {
-	const columns = (await query(REQUIRED_COLUMNS_SQL, [table])).rows.map(asRequiredColumn).filter((column) => column !== void 0 && !set.has(column.name));
-	const values = {};
-	for (const column of columns) if (column.refTable !== null && column.refColumn !== null) {
-		const existing = await query(`select ${quoteIdent$1(column.refColumn)} as value from ${column.refTable} limit 1`);
-		values[column.name] = existing.rows[0]?.["value"] ?? null;
-	} else values[column.name] = placeholder(column.type);
-	return values;
-}
-/** Inserts `rows` after filling the required columns they leave out. */
-async function seedRows(query, table, rows) {
-	const fill = await requiredValues(query, tableSql(table), new Set(Object.keys(rows[0] ?? {})));
-	const inserted = insertSql(table, rows.map((row) => ({
-		...fill,
-		...row
-	})));
-	return (await query(inserted.sql, inserted.values)).rows;
-}
-/**
-* Parity between `decide` and RLS on a generated object graph: for every
-* self-parented resource a graph grant walks, a tree with restricted
-* branches and a chain past the walk depth, child rows under it, and edges
-* for a few generated principals. Everything runs in one transaction that
-* is rolled back.
-*/
-async function verifyTree(input) {
-	const { policy, query } = input;
-	const tables = input.config.rls?.tables;
-	const walked = [...graphPlan(policy).values()].filter((entry) => entry.closure !== void 0);
-	if (walked.length === 0) return {
-		checked: 0,
-		granted: 0,
-		mismatches: [],
-		notes: ["no graph grant walks a self-parented resource"]
-	};
-	const subjects = Array.from({ length: SUBJECTS }, () => randomUUID());
-	const rows = {};
-	const edges = {};
-	const now = Date.now();
-	for (const entry of walked) {
-		const node = entry.node;
-		const parent = node.parent;
-		if (parent === void 0) continue;
-		const tree = generateTree(node, entry.closure ?? 0);
-		const seeded = tree.map((item, index) => {
-			const row = {
-				[node.id]: item.id,
-				[parent.field]: item.parent
-			};
-			if (node.restricted !== void 0) row[node.restricted] = item.restricted;
-			for (const name of entry.relations) {
-				const spec = node.relations[name];
-				const column = isFieldRelation(spec) ? spec.memberOf === void 0 ? spec.field : void 0 : isPrincipalRelation(spec) ? spec.principal : void 0;
-				if (column !== void 0 && column !== parent.field) row[column] = index % 4 === 0 ? subjects[index % SUBJECTS] : randomUUID();
-			}
-			return row;
-		});
-		if ([...entry.relations].some((name) => {
-			const spec = node.relations[name];
-			return isPrincipalRelation(spec) && spec.principal === parent.field || isFieldRelation(spec) && spec.field === parent.field;
-		})) subjects.push(...tree.filter((_, index) => index % 3 === 0).map((item) => String(item.id)));
-		rows[node.name] = [...await seedRows(query, tables?.[node.name] ?? node.name, seeded)];
-		for (const name of entry.relations) {
-			const spec = node.relations[name];
-			if (!isEdgeRelation(spec)) continue;
-			const object = spec.object ?? `${node.name}_id`;
-			const subject = spec.subject ?? "user_id";
-			const list = [];
-			const edgeRows = [];
-			for (const [index, item] of tree.entries()) {
-				const holder = subjects[index % SUBJECTS];
-				if (holder === void 0 || index % 5 !== 1) continue;
-				const expiresAt = spec.expiresAt !== void 0 && index % 10 === 6 ? /* @__PURE__ */ new Date(now - 864e5) : void 0;
-				edgeRows.push({
-					[object]: item.id,
-					[subject]: holder,
-					...spec.expiresAt === void 0 ? {} : { [spec.expiresAt]: expiresAt ?? null }
-				});
-				list.push({
-					id: String(item.id),
-					principal: holder,
-					...expiresAt === void 0 ? {} : { expiresAt: expiresAt.getTime() / 1e3 }
-				});
-			}
-			if (edgeRows.length > 0) await seedRows(query, spec.edge, edgeRows);
-			edges[node.name] = {
-				...edges[node.name],
-				[name]: list
-			};
-		}
-		for (const child of policy.resources.values()) {
-			if (child.name === node.name || child.parent?.resource !== node.name) continue;
-			const make = idFactory(child);
-			const childRows = tree.map((item, index) => {
-				const row = {
-					[child.id]: make(),
-					[child.parent?.field ?? ""]: item.id
-				};
-				if (child.restricted !== void 0) row[child.restricted] = index % 7 === 3;
-				return row;
-			});
-			rows[child.name] = [...await seedRows(query, tables?.[child.name] ?? child.name, childRows)];
-		}
-	}
-	const relations = memoryRelations(policy.permissions, {
-		rows,
-		edges
-	});
-	const mismatches = [];
-	let checked = 0;
-	let granted = 0;
-	const reads = listPermissions(policy.permissions).filter((leaf) => leaf.kind === "instance" && commandFor(leaf.action, input.config.rls?.actions) === "select" && rows[leaf.resource] !== void 0);
-	for (const subject of subjects) {
-		const permdock = await createPermDock(policy, {
-			principal: {
-				id: subject,
-				roles: []
-			},
-			context: {}
-		}, { relations });
-		await input.bind(subject);
-		for (const permission of reads) {
-			const node = policy.resources.get(permission.resource);
-			const list = rows[permission.resource] ?? [];
-			if (node === void 0 || list.length === 0) continue;
-			const ids = list.map((row) => String(row[node.id]));
-			const visible = await query(`select ${quoteIdent$1(node.id)}::text as id from ${tableSql(tables?.[node.name] ?? node.name)} where ${quoteIdent$1(node.id)} = any($1)`, [ids]);
-			const seen = new Set(visible.rows.map((row) => String(row["id"])));
-			for (const row of list) {
-				checked += 1;
-				const id = String(row[node.id]);
-				const allowed = permdock.can(permission, row);
-				if (allowed !== seen.has(id)) mismatches.push(`${permission.key} ${id}: in-process ${allowed ? "granted" : "denied"}, database ${seen.has(id) ? "allowed" : "filtered"}`);
-				else if (allowed) granted += 1;
-			}
-		}
-	}
-	return {
-		checked,
-		granted,
-		mismatches,
-		notes: []
-	};
-}
-//#endregion
-//#region src/cli/rls-verify.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/** A custom role's scope and pinned instance, as the `custom_role_*` tables store them. */
-function customRoleAt(role, scopes) {
-	return {
-		scope: customRoleScope(role, scopes),
-		id: role.scope === void 0 ? role.team : role.id
-	};
-}
-function canFixture(permdock, permission, row) {
-	if (permission.kind === "collection") return permdock.can(permission, row);
-	return permdock.can(permission, row);
-}
-function grantKind(policy, key) {
-	const grants = policy.grants.filter((grant) => grant.permission.key === key);
-	if (grants.some((grant) => hasConditionOp(grant.where, "opaque") || hasConditionOp(grant.check, "opaque"))) return "opaque";
-	if (grants.some((grant) => hasConditionOp(grant.where, "sqlFunction") || hasConditionOp(grant.check, "sqlFunction"))) return "sqlFunction";
-	return "portable";
-}
-function columnsOf(row) {
-	return isRecord(row) ? Object.entries(row).filter(([, value]) => value !== void 0 && typeof value !== "object") : [];
-}
-/**
-* The statement a fixture runs: `create` inserts the whole row, `update` writes
-* `newRow` when given. Each reads back only the key, so `--revoke-columns`
-* (which keeps only unrestricted columns readable) does not reject it.
-*/
-function statementFor(fixture, action, table) {
-	const quoted = quoteIdent$1(table);
-	const id = quoteIdent$1("id");
-	const key = rowId(fixture.row);
-	switch (action) {
-		case "read":
-		case "list":
-		case "get": return {
-			sql: `select ${id} from ${quoted} where ${id} = $1`,
-			values: [key]
-		};
-		case "update": {
-			const next = columnsOf(fixture.newRow).filter(([name]) => name !== "id");
-			return {
-				sql: `update ${quoted} set ${next.length === 0 ? `${id} = ${id}` : next.map(([name], index) => `${quoteIdent$1(name)} = $${index + 2}`).join(", ")} where ${id} = $1 returning ${id}`,
-				values: [key, ...next.map(([, value]) => value)]
-			};
-		}
-		case "create": {
-			const cols = columnsOf(fixture.row);
-			if (cols.length === 0) return {
-				sql: `insert into ${quoted} (${id}) values ($1) returning ${id}`,
-				values: [key]
-			};
-			return {
-				sql: `insert into ${quoted} (${cols.map(([name]) => quoteIdent$1(name)).join(", ")}) values (${cols.map((_, index) => `$${index + 1}`).join(", ")}) returning ${id}`,
-				values: cols.map(([, value]) => value)
-			};
-		}
-		case "delete": return {
-			sql: `delete from ${quoted} where ${id} = $1 returning ${id}`,
-			values: [key]
-		};
-		default: return {
-			sql: `select ${id} from ${quoted} where ${id} = $1`,
-			values: [key]
-		};
-	}
-}
-function rowId(row) {
-	if (isRecord(row) && "id" in row) return row["id"];
-}
-function emitPgtap(fixtures, customRoles, scopes) {
-	const lines = [
-		"begin;",
-		`select plan(${fixtures.length});`,
-		"-- fixtures carry memberships and tenant for the exists join"
-	];
-	for (const [index, fixture] of fixtures.entries()) {
-		const claims = JSON.stringify({
-			sub: fixture.subject.id,
-			role: "authenticated",
-			tenant_id: fixture.subject.tenant ?? null,
-			memberships: membershipsClaim(fixture.subject.memberships ?? [], customRoles, scopes)
-		});
-		lines.push(`-- ${fixture.action}`, `select set_config('request.jwt.claims', ${JSON.stringify(claims)}, true);`, `select set_config('request.jwt.claim.sub', ${JSON.stringify(fixture.subject.id)}, true);`, `select ok(true, 'fixture ${index} ${fixture.action}');`);
-	}
-	lines.push("select * from finish();", "rollback;");
-	return `${lines.join("\n")}\n`;
-}
-/** Columns of `row` that hold a value; a masked column reads as null. */
-function valuedColumns(row) {
-	return isRecord(row) ? Object.keys(row).filter((name) => row[name] !== null && row[name] !== void 0).toSorted() : [];
-}
-/**
-* What a field view returns for a row: nothing for a denied row, otherwise
-* `pick`'s columns with a value plus the key, which always passes through.
-*/
-function expectedFields(granted, picked, key, row) {
-	if (!granted) return [];
-	const kept = new Set(valuedColumns(picked));
-	if (isRecord(row) && row[key] !== null && row[key] !== void 0) kept.add(key);
-	return [...kept].toSorted();
-}
-function fieldsMismatch(fixture, want, seen) {
-	const kept = want.join(", ");
-	if (typeof seen === "string") return [`${fixture.action}: field view read failed (${seen}), pick keeps [${kept}]`];
-	return seen.join(", ") === kept ? [] : [`${fixture.action} ${String(rowId(fixture.row))}: field view returns [${seen.join(", ")}], pick keeps [${kept}]`];
-}
-/** The field view's columns for the fixture's row: the view, or the table itself when no grant limits its fields. */
-async function viewFields(query, table, key) {
-	const view = quoteIdent$1(viewName(table, FIELD_VIEWS.view));
-	const id = quoteIdent$1("id");
-	await query("savepoint permdock_fields");
-	const result = await query(`select * from ${view} where ${id} = $1`, [key]);
-	if (result.code === void 0) return valuedColumns(result.rows[0]);
-	await query("rollback to savepoint permdock_fields");
-	if (result.code !== "42P01") return result.code;
-	const base = await query(`select * from ${quoteIdent$1(table)} where ${id} = $1`, [key]);
-	return base.code ?? valuedColumns(base.rows[0]);
-}
-/** Writes the custom roles into the `database`-mode tables; the fixture transaction rolls them back. */
-async function seedCustomRoles(query, schema, customRoles, scopes) {
-	const table = (name) => `${quoteIdent$1(schema)}.${quoteIdent$1(name)}`;
-	const write = async (sql, values) => {
-		const result = await query(sql, values);
-		if (result.code !== void 0) throw new Error(`PermDock CLI: rls verify --db could not seed custom roles (${result.code}); connect as a role that owns the custom_role_* tables`);
-	};
-	for (const role of customRoles) {
-		const at = customRoleAt(role, scopes);
-		if (at.scope === void 0) continue;
-		for (const grant of role.grants ?? []) await write(`insert into ${table("custom_role_permissions")} (tenant_id, scope, scope_id, role, permission, effect) values ($1, $2, $3, $4, $5, $6)`, [
-			role.tenant ?? null,
-			at.scope,
-			at.id ?? null,
-			role.name,
-			grant.permission,
-			grant.effect ?? "allow"
-		]);
-		for (const name of role.includes ?? []) await write(`insert into ${table("custom_role_includes")} (tenant_id, scope, scope_id, role, include_role) values ($1, $2, $3, $4, $5)`, [
-			role.tenant ?? null,
-			at.scope,
-			at.id ?? null,
-			role.name,
-			name
-		]);
-	}
-}
-async function bindSubject(query, fixture, dialect, gucPrefix, tenantClaim, roleClaim, customRoles, scopes) {
-	await query("set local role \"authenticated\"");
-	const roles = fixture.subject.roles ?? [];
-	const memberships = membershipsClaim(fixture.subject.memberships ?? [], customRoles, scopes);
-	if (dialect === "guc") {
-		const settings = [
-			[`${gucPrefix}.user_id`, fixture.subject.id],
-			[`${gucPrefix}.${roleClaim}`, roles.join(",")],
-			[`${gucPrefix}.memberships`, JSON.stringify(memberships)]
-		];
-		if (fixture.subject.tenant !== void 0) settings.push([`${gucPrefix}.${tenantClaim}`, fixture.subject.tenant]);
-		for (const [name, value] of settings) await query("select set_config($1, $2, true)", [name, value]);
-		return;
-	}
-	const claims = {
-		sub: fixture.subject.id,
-		role: "authenticated",
-		[roleClaim]: roles.length === 1 ? roles[0] : roles,
-		[tenantClaim]: fixture.subject.tenant,
-		memberships
-	};
-	await query("select set_config($1, $2, true)", ["request.jwt.claims", JSON.stringify(claims)]);
-	await query("select set_config($1, $2, true)", ["request.jwt.claim.sub", fixture.subject.id]);
-}
-async function verifyAgainstDatabase(input) {
-	const client = await input.connect(input.db);
-	const dialect = input.config.rls?.dialect ?? "supabase";
-	const gucPrefix = input.config.rls?.gucPrefix ?? "app";
-	const tenantClaim = input.config.rls?.tenantClaim ?? "tenant_id";
-	const roleClaim = input.config.rls?.roleClaim ?? "user_role";
-	const rls = input.config.rls;
-	const seedsTables = rls?.customRoles === true && (rls.authorize ?? rls.rbac?.authorize ?? "jwt") === "database";
-	const schema = rls?.schema ?? rls?.rbac?.schema ?? "permdock";
-	const scopes = scopeList(input.policy.scopes);
-	const query = async (sql, values) => {
-		try {
-			const result = await client.query(sql, values === void 0 ? [] : [...values]);
-			return {
-				rows: result.rows,
-				rowCount: result.rowCount ?? result.rows.length
-			};
-		} catch (cause) {
-			const code = cause !== null && typeof cause === "object" && "code" in cause && typeof cause.code === "string" ? cause.code : void 0;
-			return {
-				rows: [],
-				rowCount: 0,
-				...code === void 0 ? {} : { code }
-			};
-		}
-	};
-	const mismatches = [];
-	const notes = [];
-	try {
-		const conditioned = policyRowConditionKeys(input.policy);
-		for (const found of helperTablePoliciesFromRows((await query(HELPER_TABLE_POLICIES_SQL)).rows)) {
-			const keys = found.keys.filter((key) => conditioned.has(key));
-			if (keys.length > 0) mismatches.push(`PD037 ${rowConditionMessage(found, keys)}`);
-		}
-		for (const [index, fixture] of input.fixtures.entries()) {
-			const permission = findPermission(input.policy.permissions, fixture.action);
-			const status = input.inProcess[index];
-			if (permission === void 0 || status === void 0) continue;
-			if (status.kind === "opaque") {
-				notes.push(`${fixture.action}: opaque grant untestable app-side`);
-				continue;
-			}
-			const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
-			await query("begin");
-			try {
-				if (seedsTables) await seedCustomRoles(query, schema, input.customRoles, scopes);
-				await bindSubject(query, fixture, dialect, gucPrefix, tenantClaim, roleClaim, input.customRoles, scopes);
-				const statement = statementFor(fixture, permission.action, table);
-				const result = await query(statement.sql, statement.values);
-				const count = result.rowCount ?? result.rows.length;
-				const database = result.code === "42501" ? "rejected" : count > 0 ? "allowed" : "filtered";
-				if (!(status.granted ? database === "allowed" : database === "filtered" || database === "rejected")) mismatches.push(`${fixture.action}: in-process ${status.granted ? "granted" : "denied"}, database ${database}`);
-				else if (status.kind === "sqlFunction") notes.push(`${fixture.action}: verified through twin`);
-				mismatches.push(...status.fields === void 0 ? [] : fieldsMismatch(fixture, status.fields, await viewFields(query, table, rowId(fixture.row))));
-			} finally {
-				await query("rollback");
-			}
-		}
-	} finally {
-		await client.end();
-	}
-	return {
-		mismatches,
-		notes
-	};
-}
-/** `--tree`: seeds a generated object graph in a rolled-back transaction and compares `can()` with RLS. */
-async function verifyTreeAgainstDatabase(db, policy, config, connect) {
-	const client = await connect(db);
-	const scopes = scopeList(policy.scopes);
-	const query = async (sql, values) => {
-		return { rows: (await client.query(sql, values === void 0 ? [] : [...values])).rows };
-	};
-	const loose = async (sql, values) => {
-		await query(sql, values);
-		return { rows: [] };
-	};
-	try {
-		await query("begin");
-		const result = await verifyTree({
-			policy,
-			config,
-			query,
-			bind: (subject) => bindSubject(loose, {
-				subject: { id: subject },
-				row: {},
-				action: "read"
-			}, config.rls?.dialect ?? "supabase", config.rls?.gucPrefix ?? "app", config.rls?.tenantClaim ?? "tenant_id", config.rls?.roleClaim ?? "user_role", [], scopes)
-		});
-		if (result.mismatches.length > 0) return {
-			code: 1,
-			output: [...result.mismatches, ...result.notes].join("\n")
-		};
-		const verified = `verified ${String(result.checked)} tree check(s) against the database (${String(result.granted)} granted)`;
-		return {
-			code: 0,
-			output: result.notes.length === 0 ? verified : `${verified}\n${result.notes.join("\n")}`
-		};
-	} catch (cause) {
-		return {
-			code: 2,
-			output: `PermDock CLI: rls verify --tree could not seed the tree (${cause instanceof Error ? cause.message : String(cause)}); connect as a role that owns the tables and is a member of authenticated`
-		};
-	} finally {
-		await client.query("rollback", []).catch(() => void 0);
-		await client.end();
-	}
-}
-async function runRlsVerify(input) {
-	const connect = input.connect ?? ((db) => connectPg(db, "permdock rls verify --db"));
-	const policyPath = input.from ?? input.config.policy;
-	if (policyPath === void 0) return {
-		code: 2,
-		output: "PermDock CLI: rls verify needs policy in the config or --from"
-	};
-	const policy = asPolicy(pickNamed(await loadModule(resolve(input.cwd, policyPath)), ["policy"]));
-	if (input.tree === true) {
-		if (input.db === void 0) return {
-			code: 2,
-			output: "PermDock CLI: rls verify --tree needs --db"
-		};
-		try {
-			return await verifyTreeAgainstDatabase(input.db, policy, input.config, connect);
-		} catch (cause) {
-			return usageResult(cause);
-		}
-	}
-	const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
-	const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
-	if (input.format === "pgtap") return {
-		code: 0,
-		output: emitPgtap(fixtures, customRoles, scopeList(policy.scopes))
-	};
-	const mismatches = [];
-	const notes = [];
-	const inProcess = [];
-	const fieldsMode = input.config.rls?.fields === "views";
-	for (const fixture of fixtures) {
-		const permission = findPermission(policy.permissions, fixture.action);
-		if (permission === void 0) {
-			mismatches.push(`${fixture.action}: unknown permission`);
-			inProcess.push({
-				action: fixture.action,
-				granted: false,
-				kind: "portable"
-			});
-			continue;
-		}
-		const kind = grantKind(policy, fixture.action);
-		const permdock = await createPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryRoleSource(customRoles) });
-		const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
-		const outcome = granted ? "granted" : "denied";
-		if (fixture.expected !== void 0 && fixture.expected !== outcome) mismatches.push(`${fixture.action}: in-process ${outcome}, expected ${fixture.expected}`);
-		if (kind === "opaque") notes.push(`${fixture.action}: opaque grant untestable app-side`);
-		const fields = fieldsMode && permission.kind === "instance" && commandFor(permission.action, input.config.rls?.actions) === "select" ? expectedFields(granted, permdock.pick(permission, fixture.row), policy.resources.get(permission.resource)?.id ?? "id", fixture.row) : void 0;
-		inProcess.push({
-			action: fixture.action,
-			granted,
-			kind,
-			...fields === void 0 ? {} : { fields }
-		});
-	}
-	if (input.db !== void 0) try {
-		const database = await verifyAgainstDatabase({
-			db: input.db,
-			policy,
-			fixtures,
-			customRoles,
-			config: input.config,
-			inProcess,
-			connect
-		});
-		mismatches.push(...database.mismatches);
-		notes.push(...database.notes);
-	} catch (cause) {
-		return usageResult(cause);
-	}
-	if (mismatches.length > 0) return {
-		code: 1,
-		output: [...mismatches, ...notes].join("\n")
-	};
-	const verified = `verified ${fixtures.length} fixture(s) in-process`;
-	return {
-		code: 0,
-		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
-	};
-}
-//#endregion
-//#region src/cli/rls.ts
-const RLS_HELP = `permdock rls generate | import | verify | migrate
-
-  generate --target drizzle|sql|prisma --dialect supabase|neon|guc
-           [--rbac supabase] [--rbac-schema public] [--authorize database|jwt]
-           [--memberships <table>:tenant,user,role]
-           [--policy-per-role] [--policy-name '{table}_{op}'] [--tenant-type uuid] [--custom-roles]
-           [--capabilities] [--fields views [--revoke-columns]]
-           [--out <path>] [--check] [--skip-closures] [--inline-functions] [--force] [--guc-prefix app]
-           [--split helpers,seeds,policies,hook --out <dir>/056_permdock_{part}.sql]
-           [--grants-out <file>|-] [--seeds-out <file>|-]
-           [--helpers-only] [--shims]
-  import   --sql schema.sql | --db $DATABASE_URL --out src/permissions.generated.ts
-           [--schema zod|valibot|arktype] [--memberships <table>:tenant,user,role]
-  verify   [--db $DATABASE_URL] [--fixtures rls.fixtures.ts] [--format pgtap|node] [--tree]
-           [--introspect --db $DATABASE_URL, with the generate flags]
-  migrate  --sql <dir> [--write] [--json], with the generate flags
-           rewrites the rls.migrate helpers' calls in policies onto the generated helpers
-
-Never emits service_role. memberOf compiles through the dialect memberships mapping.
-`;
-function asTarget(value) {
-	if (value === void 0 || value === "sql" || value === "drizzle" || value === "prisma") return value ?? "sql";
-}
-function asDialect(value) {
-	if (value === void 0 || value === "supabase" || value === "neon" || value === "guc") return value ?? "supabase";
-}
-function generateInput(input, target, dialect) {
-	return {
-		cwd: input.cwd,
-		config: input.config,
-		target,
-		dialect,
-		rbac: input.rbac,
-		...input.rbacSchema === void 0 ? {} : { rbacSchema: input.rbacSchema },
-		...input.authorize === void 0 ? {} : { authorize: parseRbacAuthorize(input.authorize) ?? "database" },
-		check: input.check,
-		skipClosures: input.skipClosures,
-		inlineFunctions: input.inlineFunctions,
-		force: input.force,
-		io: input.io,
-		...input.out === void 0 ? {} : { out: input.out },
-		...input.from === void 0 ? {} : { from: input.from },
-		...input.memberships === void 0 ? {} : { memberships: input.memberships },
-		...input.gucPrefix === void 0 ? {} : { gucPrefix: input.gucPrefix },
-		policyPerRole: input.policyPerRole,
-		...input.policyName === void 0 ? {} : { policyName: input.policyName },
-		...input.tenantType === void 0 ? {} : { tenantType: input.tenantType },
-		customRoles: input.customRoles,
-		capabilities: input.capabilities,
-		...input.fields === void 0 ? {} : { fields: input.fields },
-		revokeColumns: input.revokeColumns,
-		...input.split === void 0 ? {} : { split: input.split },
-		...input.grantsOut === void 0 ? {} : { grantsOut: input.grantsOut },
-		...input.seedsOut === void 0 ? {} : { seedsOut: input.seedsOut },
-		helpersOnly: input.helpersOnly,
-		shims: input.shims === true
-	};
-}
-async function migrate(input) {
-	const config = input.config.rls?.migrate;
-	if (config === void 0) return {
-		code: 2,
-		output: "rls migrate needs rls.migrate.helpers in permdock.config.ts"
-	};
-	if (input.sql === void 0) return {
-		code: 2,
-		output: "rls migrate needs --sql <dir>"
-	};
-	const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
-	if (dialect === void 0) return {
-		code: 2,
-		output: "rls migrate --dialect (or rls.dialect) must be supabase, neon or guc"
-	};
-	const generated = await runRlsGenerate({
-		...generateInput(input, "sql", dialect),
-		check: false,
-		write: false
-	});
-	if (generated.code !== 0) return {
-		code: 2,
-		output: generated.output
-	};
-	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-DrFPbf8p.js");
-	return runRlsMigrate({
-		cwd: input.cwd,
-		sql: input.sql,
-		config,
-		target: migrateTarget(generated),
-		write: input.write,
-		json: input.json
-	});
-}
-/** `verify --introspect` with `--helpers-only`: helpers and seeds exactly, hand-written policies by their keys. */
-async function introspectHelpersOnly(db, expected, generated, connect) {
-	const schema = generated.schema ?? "permdock";
-	try {
-		const actual = await introspectRls(db, expected, connect);
-		const helpers = diffRls(expected, actual);
-		const warnings = missingIndexes(expected, actual);
-		const mixed = diffMixed({
-			schema,
-			seeds: generated.seeds ?? [],
-			permissions: generated.keys?.permissions ?? [],
-			rowConditions: generated.keys?.rowConditions ?? []
-		}, await introspectMixed(db, schema, connect));
-		const drift = [...helpers, ...mixed.drift];
-		const info = mixed.info.map((line) => `info: ${line}`);
-		return drift.length > 0 ? {
-			code: 1,
-			output: [
-				...drift,
-				...warnings,
-				...info
-			].join("\n")
-		} : {
-			code: 0,
-			output: [
-				...warnings,
-				...info,
-				`introspected ${String(expected.helpers.length)} helper(s) and ${String(generated.seeds?.length ?? 0)} seeded row(s), helpers only: no drift`
-			].join("\n")
-		};
-	} catch (cause) {
-		return usageResult(cause);
-	}
-}
-/** `verify --introspect`: the catalogs against what `generate` would write with the same flags. */
-async function introspect(input) {
-	if (input.db === void 0) return {
-		code: 2,
-		output: "PermDock CLI: rls verify --introspect needs --db"
-	};
-	const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
-	if (dialect === void 0) return {
-		code: 2,
-		output: "rls verify --dialect (or rls.dialect) must be supabase, neon or guc"
-	};
-	const generated = await runRlsGenerate({
-		...generateInput(input, "sql", dialect),
-		check: false,
-		write: false
-	});
-	if (generated.code !== 0 || generated.policies === void 0) return {
-		code: 2,
-		output: generated.output
-	};
-	const expected = expectedRls(generated.policies, generated.text, generated.indexes);
-	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect);
-	try {
-		const actual = await introspectRls(input.db, expected, input.connect);
-		const drift = diffRls(expected, actual, { columnGrants: (input.fields ?? input.config.rls?.fields) === "views" });
-		const warnings = missingIndexes(expected, actual);
-		if (drift.length > 0) return {
-			code: 1,
-			output: [...drift, ...warnings].join("\n")
-		};
-		return {
-			code: 0,
-			output: `${warnings.map((line) => `${line}\n`).join("")}introspected ${String(expected.policies.length)} policies on ${String(expected.tables.length)} table(s) and ${String(expected.helpers.length)} helper(s): no drift`
-		};
-	} catch (cause) {
-		return usageResult(cause);
-	}
-}
-async function runRls(input) {
-	const action = input.rest[0];
-	if (action === void 0 || action === "help") return {
-		code: 2,
-		output: RLS_HELP
-	};
-	switch (action) {
-		case "generate": {
-			const target = asTarget(input.target);
-			const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
-			if (target === void 0) return {
-				code: 2,
-				output: "rls generate --target must be drizzle, sql or prisma"
-			};
-			if (dialect === void 0) return {
-				code: 2,
-				output: "rls generate --dialect (or rls.dialect) must be supabase, neon or guc"
-			};
-			return runRlsGenerate(generateInput(input, target, dialect));
-		}
-		case "import": {
-			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./rls-import-CXV6LBlS.js");
-			return runRlsImport({
-				cwd: input.cwd,
-				config: input.config,
-				schema: input.schema ?? "zod",
-				io: input.io,
-				...input.sql === void 0 ? {} : { sql: input.sql },
-				...input.db === void 0 ? {} : { db: input.db },
-				...input.out === void 0 ? {} : { out: input.out },
-				...input.memberships === void 0 ? {} : { memberships: input.memberships },
-				...input.connect === void 0 ? {} : { connect: input.connect }
-			});
-		}
-		case "verify": {
-			if (input.introspect) return introspect(input);
-			const format = input.format ?? "node";
-			if (format !== "node" && format !== "pgtap") return {
-				code: 2,
-				output: "rls verify --format must be pgtap or node"
-			};
-			return await runRlsVerify({
-				cwd: input.cwd,
-				config: input.config,
-				format,
-				tree: input.tree,
-				io: input.io,
-				...input.fixtures === void 0 ? {} : { fixtures: input.fixtures },
-				...input.db === void 0 ? {} : { db: input.db },
-				...input.from === void 0 ? {} : { from: input.from },
-				...input.connect === void 0 ? {} : { connect: input.connect }
-			});
-		}
-		case "migrate": return migrate(input);
-		default: return {
-			code: 2,
-			output: RLS_HELP
-		};
-	}
-}
-//#endregion
-export { runRls };