permdock 0.1.0 → 0.3.0

package/dist/rls-DQtdgTHB.js

@@ -0,0 +1,2521 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { _ as listPermissions, y as renamedKeys } from "./permissions-DVoF6dMt.js";
+import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { E as listRoles, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
+import { h as scopeField } from "./validity-uOp8UpYn.js";
+import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import "./budget-NbEtbJC_.js";
+import { n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
+import "./sources-4p0-4xQm.js";
+import { i as SEEDS_MARKER, r as INDEXES_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
+import { n as requirePeer } from "./peer-BOr_kJE1.js";
+import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-BpPXt3x1.js";
+import { $ as sessionLiveHelperSql, G as quoteIdent$1, K as quoteLiteral, Q as scopeTypeOf, R as memberIdsHelper, T as graphSqlName, U as permittedIdsHelper, V as parseMembershipsFlag, W as qualifiedTable$1, X as scopeSources, Z as scopeTable, f as SESSION_LIVE_HELPER, o as qualified$1, q as quoteTable, r as HELPERS, rt as subjectIdSql, tt as subjectClaimJsonSql, w as graphHelper, y as checkSuspension } from "./rls-shared-Cewd_-zI.js";
+import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-74oZPXWL.js";
+import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-CHwx0V8q.js";
+import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-RuFqaqGz.js";
+import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-CSLQ4zJ3.js";
+import { n as runRlsVerify } from "./rls-verify-CVQTHTh5.js";
+import { t as supautilsRejections } from "./supautils-Cn4R4cJ4.js";
+import { basename, delimiter, join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+//#region src/cli/rls-advisors.ts
+/** The PermDock doctor check that reports the same problem in migrations. */
+const ADVISOR_CODES = {
+	function_search_path_mutable: "PD048",
+	auth_rls_initplan: "PD051",
+	rls_disabled_in_public: "PD050",
+	security_definer_view: "PD022",
+	anon_security_definer_function_executable: "PD049",
+	authenticated_security_definer_function_executable: "PD046"
+};
+const defaultExec = (command, args, options) => {
+	const result = spawnSync(command, [...args], {
+		cwd: options.cwd,
+		env: options.env,
+		encoding: "utf8"
+	});
+	return {
+		status: result.status,
+		stdout: result.stdout ?? "",
+		stderr: result.stderr ?? "",
+		...result.error === void 0 ? {} : { error: result.error }
+	};
+};
+function text(value, key) {
+	const field = typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
+	return typeof field === "string" ? field : "";
+}
+function findingsOf(value) {
+	const results = typeof value === "object" && value !== null ? Reflect.get(value, "results") : void 0;
+	if (!Array.isArray(results)) return;
+	return results.map((row) => {
+		const name = text(row, "name");
+		const finding = {
+			name,
+			level: text(row, "level"),
+			detail: text(row, "detail"),
+			remediation: text(row, "remediation"),
+			cacheKey: text(row, "cacheKey")
+		};
+		const code = ADVISOR_CODES[name];
+		return code === void 0 ? finding : Object.assign(finding, { code });
+	});
+}
+const INSTALL = "rls verify --advisors runs the Supabase CLI: install it with npm install --save-dev supabase (or brew install supabase/tap/supabase)";
+/**
+* `supabase db advisors --type security` against `--db` or the local stack.
+* Exit 1 on a WARN or ERROR row, 2 when the CLI is missing or fails.
+*/
+function runRlsAdvisors(input) {
+	const exec = input.exec ?? defaultExec;
+	const bin = join(input.cwd, "node_modules", ".bin");
+	const path = input.env["PATH"];
+	const result = exec("supabase", [
+		"db",
+		"advisors",
+		...input.db === void 0 ? ["--local"] : ["--db-url", input.db],
+		"--type",
+		"security",
+		"--output-format",
+		"json"
+	], {
+		cwd: input.cwd,
+		env: {
+			...input.env,
+			PATH: path === void 0 ? bin : `${bin}${delimiter}${path}`
+		}
+	});
+	if (result.error !== void 0) return {
+		code: 2,
+		output: INSTALL
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(result.stdout);
+	} catch {
+		parsed = void 0;
+	}
+	const findings = findingsOf(parsed);
+	if (findings === void 0) {
+		const error = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "error") : void 0;
+		const message = [text(error, "message"), text(error, "suggestion")].filter((part) => part !== "").join(" ");
+		return {
+			code: 2,
+			output: `supabase db advisors failed: ${message === "" ? result.stderr.trim() || `exit ${String(result.status)}` : message}`
+		};
+	}
+	const failing = findings.filter((finding) => finding.level === "WARN" || finding.level === "ERROR");
+	const code = failing.length > 0 ? 1 : 0;
+	if (input.json) return {
+		code,
+		output: JSON.stringify({
+			findings,
+			errors: findings.filter((finding) => finding.level === "ERROR").length,
+			warnings: findings.filter((finding) => finding.level === "WARN").length
+		}, null, 2)
+	};
+	if (findings.length === 0) return {
+		code,
+		output: "supabase db advisors: no security findings"
+	};
+	return {
+		code,
+		output: `${findings.map((finding) => `${finding.level} ${finding.name}${finding.code === void 0 ? "" : ` (${finding.code})`}: ${finding.detail}\n  ${finding.remediation}`).join("\n")}\n\n${String(failing.length)} finding(s) at WARN or above`
+	};
+}
+//#endregion
+//#region src/cli/approval-schema.ts
+/** An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no `format`. */
+const INSTANT = String.raw`^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$`;
+const STRINGS = {
+	type: "array",
+	items: { type: "string" }
+};
+/**
+* `schemas/approval-request-v1.json`: the `ApprovalRequest` an approval store
+* holds. Self-contained (`$defs`, no remote `$ref`) so `rls.jsonSchema` can
+* inline it into a pg_jsonschema check constraint.
+*/
+const APPROVAL_REQUEST_SCHEMA = {
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$id: "https://permdock.com/schemas/approval-request-v1.json",
+	title: "PermDock approval request",
+	description: "An ApprovalRequest as an ApprovalStore holds it, wire format v1. Unknown properties are allowed so a v1 minor release can add one.",
+	type: "object",
+	required: [
+		"v",
+		"token",
+		"permission",
+		"scope",
+		"resource",
+		"subject",
+		"detail",
+		"createdAt",
+		"expiresAt",
+		"status"
+	],
+	properties: {
+		v: { const: 1 },
+		token: {
+			type: "string",
+			minLength: 1
+		},
+		permission: {
+			type: "string",
+			minLength: 1
+		},
+		scope: { type: "string" },
+		resource: {
+			type: "object",
+			required: ["type"],
+			properties: {
+				type: { type: "string" },
+				id: { type: "string" }
+			}
+		},
+		subject: { $ref: "#/$defs/subject" },
+		membership: {
+			type: "object",
+			required: ["roles"],
+			properties: { roles: STRINGS }
+		},
+		approvers: { type: "object" },
+		detail: { type: "string" },
+		adapter: { type: "string" },
+		createdAt: { $ref: "#/$defs/instant" },
+		expiresAt: { $ref: "#/$defs/instant" },
+		status: { enum: [
+			"pending",
+			"approved",
+			"rejected",
+			"expired"
+		] },
+		approvals: {
+			type: "array",
+			items: { $ref: "#/$defs/signature" }
+		},
+		resolvedAt: { $ref: "#/$defs/instant" },
+		resolvedBy: { type: "string" },
+		vouched: { type: "string" },
+		note: { type: "string" },
+		consumedAt: { $ref: "#/$defs/instant" }
+	},
+	$defs: {
+		instant: {
+			type: "string",
+			pattern: INSTANT
+		},
+		subject: {
+			type: "object",
+			required: ["principal"],
+			properties: {
+				principal: { anyOf: [{ type: "null" }, {
+					type: "object",
+					required: ["id", "roles"],
+					properties: {
+						id: { type: "string" },
+						roles: STRINGS,
+						tenant: { type: "string" }
+					}
+				}] },
+				actor: {
+					type: "object",
+					required: ["id", "kind"],
+					properties: {
+						id: { type: "string" },
+						kind: { type: "string" }
+					}
+				},
+				session: { type: "string" },
+				delegation: { type: "object" }
+			}
+		},
+		signature: {
+			type: "object",
+			required: ["by", "at"],
+			properties: {
+				by: { type: "string" },
+				at: { $ref: "#/$defs/instant" },
+				stage: {
+					type: "integer",
+					minimum: 0
+				},
+				vouched: { type: "string" }
+			}
+		}
+	}
+};
+//#endregion
+//#region src/cli/rls-approvals.ts
+/** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
+const APPROVAL_STORE = {
+	table: "approval_requests",
+	open: "permdock_approval_open",
+	get: "permdock_approval_get",
+	resolve: "permdock_approval_resolve",
+	consume: "permdock_approval_consume",
+	list: "permdock_approval_list",
+	expire: "permdock_approval_expire",
+	cancel: "permdock_approval_cancel"
+};
+/** `body` as the row's filter columns hold it. */
+const COLUMNS = `p_request ->> 'token',
+    p_request,
+    p_request ->> 'status',
+    p_request #>> '{subject,principal,tenant}',
+    p_request #>> '{subject,principal,id}',
+    p_request #>> '{subject,actor,id}',
+    p_request #>> '{subject,session}',
+    coalesce(jsonb_array_length(p_request -> 'approvals'), 0),
+    p_request ->> 'createdAt',
+    (p_request ->> 'expiresAt')::timestamptz,
+    (p_request ->> 'consumedAt')::timestamptz`;
+/** The `ApprovalListFilter` in `p_filter`, over the row aliased `a`. */
+const FILTER = `(p_filter ->> 'status' is null or a.status = p_filter ->> 'status')
+    and (p_filter ->> 'tenant' is null or a.tenant = p_filter ->> 'tenant')
+    and (p_filter ->> 'principalId' is null or a.principal_id = p_filter ->> 'principalId')
+    and (p_filter ->> 'actorId' is null or a.actor_id = p_filter ->> 'actorId')
+    and (p_filter ->> 'session' is null or a.session = p_filter ->> 'session')`;
+function serverOnly(fn, args) {
+	return `revoke execute on function ${fn}(${args}) from public, anon, authenticated;`;
+}
+const BODY_CHECK = `${APPROVAL_STORE.table}_body_schema`;
+/**
+* `rls.jsonSchema`: a pg_jsonschema check that `body` matches
+* `approval-request-v1.json`, added `not valid` and then validated. `auto`
+* adds it only where the extension is available.
+*/
+function bodySchemaSql(table, mode, body = "body", check = BODY_CHECK) {
+	const statements = [
+		"create schema if not exists extensions;",
+		"create extension if not exists pg_jsonschema with schema extensions;",
+		`alter table ${table} drop constraint if exists "${check}";`,
+		`alter table ${table} add constraint "${check}" check (extensions.jsonb_matches_schema(${quoteLiteral(JSON.stringify(APPROVAL_REQUEST_SCHEMA))}::json, ${body})) not valid;`,
+		`alter table ${table} validate constraint "${check}";`
+	];
+	const comment = "-- approval store: body matches schemas/approval-request-v1.json through pg_jsonschema";
+	if (mode === true) return `\n${comment}\n${statements.join("\n")}\n`;
+	return `\n${comment}, where the extension is available
+do $permdock$
+begin
+  if exists (select 1 from pg_available_extensions where name = 'pg_jsonschema') then
+${statements.map((statement) => `    ${statement}`).join("\n")}
+  end if;
+end
+$permdock$;\n`;
+}
+/**
+* The approval store (`rls.approvals`): one table of `ApprovalRequest`
+* bodies with the columns a list filters on, and one `security definer`
+* function per `ApprovalStore` method, each one atomic statement. No client
+* role may read the table or execute the functions: approvals are opened and
+* resolved by the server, which grants its own role.
+*/
+function approvalStoreSql(ctx, jsonSchema = false) {
+	const table = qualified$1(ctx, APPROVAL_STORE.table);
+	const fn = (name) => qualified$1(ctx, name);
+	const index = (name) => `"${APPROVAL_STORE.table}_${name}"`;
+	return `-- approval store: ApprovalRequest bodies, opened, resolved and consumed through the functions below; supabaseApprovalStore calls them
+create table if not exists ${table} (
+  token text primary key,
+  body jsonb not null,
+  status text not null check (status in ('pending', 'approved', 'rejected', 'expired')),
+  tenant text,
+  principal_id text,
+  actor_id text,
+  session text,
+  approvals integer not null default 0,
+  created_at text not null,
+  expires_at timestamptz not null,
+  consumed_at timestamptz
+);
+create index if not exists ${index("page")} on ${table} (created_at collate "C", token collate "C");
+create index if not exists ${index("pending")} on ${table} (status, expires_at);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;
+${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema)}
+-- open a request; a repeated ask keeps the open record and replaces only an expired one
+create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  insert into ${table} as a (token, body, status, tenant, principal_id, actor_id, session, approvals, created_at, expires_at, consumed_at)
+  values (
+    ${COLUMNS}
+  )
+  on conflict (token) do update
+    set body = excluded.body, status = excluded.status, tenant = excluded.tenant,
+      principal_id = excluded.principal_id, actor_id = excluded.actor_id, session = excluded.session,
+      approvals = excluded.approvals, created_at = excluded.created_at,
+      expires_at = excluded.expires_at, consumed_at = excluded.consumed_at
+    where a.status = 'expired' or a.expires_at <= now()
+$$;
+${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
+
+create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.body from ${table} a where a.token = p_token
+$$;
+${serverOnly(fn(APPROVAL_STORE.get), "text")}
+
+-- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
+create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set body = p_next,
+    status = p_next ->> 'status',
+    approvals = coalesce(jsonb_array_length(p_next -> 'approvals'), 0)
+  where a.token = p_token
+    and a.status = 'pending'
+    and a.expires_at > now()
+    and a.approvals = p_seen
+  returning a.body
+$$;
+${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
+
+-- consume an approved, unexpired, unconsumed request once
+create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set consumed_at = p_now::timestamptz,
+    body = a.body || jsonb_build_object('consumedAt', p_now)
+  where a.token = p_token
+    and a.status = 'approved'
+    and a.consumed_at is null
+    and a.expires_at > p_now::timestamptz
+  returning a.body
+$$;
+${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
+
+-- one page in (createdAt, token) order after the cursor position
+create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
+returns setof jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.body
+  from ${table} a
+  where ${FILTER}
+    and (p_after_created is null
+      or (a.created_at collate "C", a.token collate "C") > (p_after_created collate "C", p_after_token collate "C"))
+  order by a.created_at collate "C", a.token collate "C"
+  limit p_limit
+$$;
+${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
+
+create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with expired as (
+    update ${table} a
+    set status = 'expired', body = a.body || '{"status":"expired"}'::jsonb
+    where a.status = 'pending' and a.expires_at <= p_now::timestamptz
+    returning 1
+  )
+  select count(*)::integer from expired
+$$;
+${serverOnly(fn(APPROVAL_STORE.expire), "text")}
+
+-- reject every pending request the filter matches, as system:<by>
+create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with cancelled as (
+    update ${table} a
+    set status = 'rejected',
+      body = (a.body - 'note') || jsonb_strip_nulls(jsonb_build_object(
+        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
+      ))
+    where a.status = 'pending'
+      and ${FILTER.replaceAll("\n    ", "\n      ")}
+    returning 1
+  )
+  select count(*)::integer from cancelled
+$$;
+${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
+`;
+}
+/** The request fields an adopted table may mirror into its own columns, as SQL over a body. */
+const MIRRORS = {
+	status: (body) => `${body} ->> 'status'`,
+	permission: (body) => `${body} ->> 'permission'`,
+	tenant: (body) => `${body} #>> '{subject,principal,tenant}'`,
+	principalId: (body) => `${body} #>> '{subject,principal,id}'`,
+	actorId: (body) => `${body} #>> '{subject,actor,id}'`,
+	session: (body) => `${body} #>> '{subject,session}'`,
+	approvals: (body) => `coalesce(jsonb_array_length(${body} -> 'approvals'), 0)`,
+	createdAt: (body) => `${body} ->> 'createdAt'`,
+	expiresAt: (body) => `${body} ->> 'expiresAt'`,
+	resolvedAt: (body) => `${body} ->> 'resolvedAt'`,
+	resolvedBy: (body) => `${body} ->> 'resolvedBy'`,
+	consumedAt: (body) => `${body} ->> 'consumedAt'`
+};
+function mirrorsOf(adopt) {
+	const out = [];
+	for (const [field, column] of Object.entries(adopt.mirror ?? {})) {
+		if (!Object.hasOwn(MIRRORS, field)) throw new Error(`PermDock CLI: rls.approvals.mirror.${field} is not a request field; use ${Object.keys(MIRRORS).join(", ")}`);
+		if (typeof column !== "string") throw new TypeError(`PermDock CLI: rls.approvals.mirror.${field} must be a column name`);
+		out.push([column, field]);
+	}
+	return out;
+}
+/** One row of `table` from `values` (column, SQL), each converted to the column's own type. */
+function populate(table, values) {
+	return `pg_catalog.jsonb_populate_record(null::${table}, pg_catalog.jsonb_build_object(${values.map(([column, sql]) => `${quoteLiteral(column)}, ${sql}`).join(", ")}))`;
+}
+/** The mirrored columns' values for the request `body`. */
+function mirrorRow(table, mirror, body) {
+	return populate(table, mirror.map(([column, field]) => [column, MIRRORS[field](body)]));
+}
+/** `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty without mirrors. */
+function mirrorSet(table, mirror, body) {
+	if (mirror.length === 0) return "";
+	const columns = mirror.map(([column]) => quoteIdent$1(column));
+	const picked = columns.map((column) => `r.${column}`).join(", ");
+	return `,\n    ${columns.length === 1 ? columns[0] ?? "" : `(${columns.join(", ")})`} = (select ${picked} from ${mirrorRow(table, mirror, body)} r)`;
+}
+/**
+* The approval store over a table the app already has (`rls.approvals:
+* { table, token?, body?, mirror? }`): the same `permdock_approval_*`
+* functions, reading every field from the request body in `body`, keyed by
+* the text column `token`, and copying the fields `mirror` names into the
+* app's own columns, converted to their types, on every write. The table's
+* grants and policies stay the app's.
+*/
+function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
+	const table = quoteTable(qualifiedTable$1(adopt.table));
+	const base = adopt.table.split(".").at(-1) ?? adopt.table;
+	const token = quoteIdent$1(adopt.token ?? "token");
+	const body = quoteIdent$1(adopt.body ?? "body");
+	const mirror = mirrorsOf(adopt);
+	for (const [column] of mirror) if (column === (adopt.token ?? "token") || column === (adopt.body ?? "body")) throw new Error(`PermDock CLI: rls.approvals.mirror names the ${column} column, which already holds the token or the body`);
+	const open = adopt.open ?? "insert";
+	if (open !== "insert" && open !== "attach") throw new Error(`PermDock CLI: rls.approvals.open must be 'insert' or 'attach', got '${String(open)}'`);
+	const schema = adopt.schema;
+	if (schema !== void 0 && (typeof schema !== "string" || schema === "")) throw new Error("PermDock CLI: rls.approvals.schema must be a schema name");
+	const fn = (name) => schema === void 0 ? qualified$1(ctx, name) : `${quoteIdent$1(schema)}.${name}`;
+	const index = (name) => quoteIdent$1(`${base}_permdock_${name}`);
+	const status = `a.${body} ->> 'status'`;
+	const expires = `(a.${body} ->> 'expiresAt')::timestamptz`;
+	const created = `(a.${body} ->> 'createdAt')`;
+	const filter = `(p_filter ->> 'status' is null or ${status} = p_filter ->> 'status')
+    and (p_filter ->> 'tenant' is null or a.${body} #>> '{subject,principal,tenant}' = p_filter ->> 'tenant')
+    and (p_filter ->> 'principalId' is null or a.${body} #>> '{subject,principal,id}' = p_filter ->> 'principalId')
+    and (p_filter ->> 'actorId' is null or a.${body} #>> '{subject,actor,id}' = p_filter ->> 'actorId')
+    and (p_filter ->> 'session' is null or a.${body} #>> '{subject,session}' = p_filter ->> 'session')`;
+	const columns = [
+		token,
+		body,
+		...mirror.map(([column]) => quoteIdent$1(column))
+	];
+	const inserted = populate(table, [
+		[adopt.token ?? "token", "p_request ->> 'token'"],
+		[adopt.body ?? "body", "p_request"],
+		...mirror.map(([column, field]) => [column, MIRRORS[field]("p_request")])
+	]);
+	const insertSql = `-- open a request; a repeated ask keeps the open record and replaces only an expired one
+create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  insert into ${table} as a (${columns.join(", ")})
+  select ${columns.map((column) => `r.${column}`).join(", ")}
+  from ${inserted} r
+  on conflict (${token}) do update
+    set ${columns.filter((column) => column !== token).map((column) => `${column} = excluded.${column}`).join(", ")}
+    where ${status} = 'expired' or ${expires} <= now()
+$$;`;
+	const attachSql = `create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+begin
+  update ${table} a
+  set ${body} = p_request${mirrorSet(table, mirror, "p_request")}
+  where a.${token} = p_request ->> 'token'
+    and (a.${body} is null or ${status} = 'expired' or ${expires} <= now());
+  if not found and not exists (select 1 from ${table} a where a.${token} = p_request ->> 'token') then
+    raise exception using
+      errcode = 'P0002',
+      message = 'permdock: no row of ${adopt.table.replaceAll("'", "''")} holds approval token ' || (p_request ->> 'token'),
+      hint = 'insert the application row with this token before opening the request';
+  end if;
+end;
+$$;`;
+	return `-- approval store adopted onto ${adopt.table}: ApprovalRequest bodies in ${adopt.body ?? "body"}, keyed by ${adopt.token ?? "token"}; supabaseApprovalStore calls the functions below
+alter table ${table} add column if not exists ${token} text;
+alter table ${table} add column if not exists ${body} jsonb;
+create unique index if not exists ${index("token")} on ${table} (${token});
+create index if not exists ${index("page")} on ${table} ((${body} ->> 'createdAt') collate "C", ${token} collate "C");
+create index if not exists ${index("status")} on ${table} ((${body} ->> 'status'));
+${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema, body, `${base}_permdock_body_schema`)}
+${open === "attach" ? attachSql : insertSql}
+${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
+
+create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.${body} from ${table} a where a.${token} = p_token
+$$;
+${serverOnly(fn(APPROVAL_STORE.get), "text")}
+
+-- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
+create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set ${body} = p_next${mirrorSet(table, mirror, "p_next")}
+  where a.${token} = p_token
+    and ${status} = 'pending'
+    and ${expires} > now()
+    and coalesce(jsonb_array_length(a.${body} -> 'approvals'), 0) = p_seen
+  returning a.${body}
+$$;
+${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
+
+-- consume an approved, unexpired, unconsumed request once
+create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set ${body} = a.${body} || jsonb_build_object('consumedAt', p_now)${mirrorSet(table, mirror, `(a.${body} || jsonb_build_object('consumedAt', p_now))`)}
+  where a.${token} = p_token
+    and ${status} = 'approved'
+    and a.${body} ->> 'consumedAt' is null
+    and ${expires} > p_now::timestamptz
+  returning a.${body}
+$$;
+${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
+
+-- one page in (createdAt, token) order after the cursor position
+create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
+returns setof jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.${body}
+  from ${table} a
+  where a.${body} is not null
+    and ${filter}
+    and (p_after_created is null
+      or (${created} collate "C", a.${token} collate "C") > (p_after_created collate "C", p_after_token collate "C"))
+  order by ${created} collate "C", a.${token} collate "C"
+  limit p_limit
+$$;
+${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
+
+create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with expired as (
+    update ${table} a
+    set ${body} = a.${body} || '{"status":"expired"}'::jsonb${mirrorSet(table, mirror, `(a.${body} || '{"status":"expired"}'::jsonb)`)}
+    where ${status} = 'pending' and ${expires} <= p_now::timestamptz
+    returning 1
+  )
+  select count(*)::integer from expired
+$$;
+${serverOnly(fn(APPROVAL_STORE.expire), "text")}
+
+-- reject every pending request the filter matches, as system:<by>
+create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with cancelled as (
+    update ${table} a
+    set ${body} = (a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object(
+        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
+      ))${mirrorSet(table, mirror, `((a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object('status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note)))`)}
+    where ${status} = 'pending'
+      and ${filter.replaceAll("\n    ", "\n      ")}
+    returning 1
+  )
+  select count(*)::integer from cancelled
+$$;
+${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
+`;
+}
+//#endregion
+//#region src/cli/rls-break-glass.ts
+/** The audit table every generated break-glass read writes to. Part of the SQL contract. */
+const BREAK_GLASS_AUDIT = "permdock_break_glass_audit";
+const IDENT = /^[a-z][a-z0-9_]*$/u;
+/**
+* The resources a `breakGlass` grant targets, with the table each reads. A
+* break-glass grant is non-portable, so `compileGrants` never turns it into a
+* policy; the server reads restricted rows through the generated function
+* instead, which is why plain RLS keeps denying them.
+*/
+function breakGlassEntries(policy, tables) {
+	const byResource = /* @__PURE__ */ new Map();
+	for (const item of collectGrants(policy)) {
+		const { grant } = item;
+		if (grant.breakGlass === void 0) continue;
+		const holder = breakGlassHolder(item);
+		const resource = grant.permission.resource;
+		const grants = byResource.get(resource) ?? [];
+		byResource.set(resource, grants);
+		if (holder === void 0) {
+			const root = policy.scopes[0];
+			grants.push({
+				permission: grant.permission.key,
+				scope: "anyone",
+				column: root === void 0 ? void 0 : scopeField(policy.resources.get(resource), root.name, policy.scopes),
+				...root === void 0 ? {} : { root: root.name }
+			});
+			continue;
+		}
+		grants.push({
+			permission: grant.permission.key,
+			scope: holder.scope,
+			column: holder.scope === "global" ? void 0 : scopeField(policy.resources.get(resource), holder.scope, policy.scopes)
+		});
+	}
+	return [...byResource].map(([resource, grants]) => ({
+		resource,
+		table: tableFor(resource, tables),
+		grants
+	}));
+}
+/**
+* Rows the subject's roles reach for `p_permission`: a break-glass grant
+* lifts denies, never the tenant boundary. A grant to no role reads the rows
+* of the root scopes the subject is a member of, or every row when the
+* policy declares no scopes.
+*/
+function rowsFilter(ctx, entry) {
+	const arms = entry.grants.flatMap((grant) => {
+		const asked = `p_permission = ${quoteLiteral(grant.permission)}`;
+		if (grant.scope === "anyone") {
+			if (grant.root === void 0) return [`(${asked})`];
+			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified$1(ctx, memberIdsHelper(grant.root))}()))`];
+		}
+		if (grant.scope !== "global" && grant.column === void 0) return [];
+		return [`(${asked} and ${accessSql(ctx, grant.scope, breakGlassKey(grant.permission), grant.column)})`];
+	});
+	return arms.length === 0 ? "false" : [...new Set(arms)].join("\n    or ");
+}
+function functionName(resource) {
+	if (!IDENT.test(resource)) throw new Error(`PermDock CLI: unsafe break-glass resource '${resource}'`);
+	return `permdock_break_glass_${resource}`;
+}
+function qualifiedTable(name) {
+	return quoteTable(name.includes(".") ? name : `public.${name}`);
+}
+function auditSql(ctx) {
+	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+	return `-- break-glass audit: one row per session that read restricted data
+-- RLS never compiles a break-glass override, so restricted rows stay denied to a direct read
+create table if not exists ${audit} (
+  id bigint generated always as identity primary key,
+  at timestamptz not null default now(),
+  subject text,
+  permission text not null,
+  purpose text,
+  reason text not null
+);
+alter table ${audit} enable row level security;
+revoke all on table ${audit} from anon, authenticated, public;`;
+}
+function readFunctionSql(ctx, entry) {
+	const fn = qualified$1(ctx, functionName(entry.resource));
+	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+	const table = qualifiedTable(entry.table);
+	const session = subjectClaimJsonSql(ctx, "break_glass");
+	const subject = subjectIdSql(ctx);
+	return `-- ${entry.resource}: reads restricted rows through a checked, audited break-glass session
+create or replace function ${fn}(p_permission text)
+returns setof ${table}
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  session jsonb := ${session};
+begin
+  if session is null
+    or jsonb_typeof(session) <> 'object'
+    or session ->> 'v' <> '1'
+    or session ->> 'permission' <> p_permission
+    or coalesce(session ->> 'reason', '') = ''
+    or jsonb_typeof(session -> 'expiresAt') <> 'number'
+    or (session ->> 'expiresAt')::numeric <= extract(epoch from now())
+  then
+    raise exception 'PermDock: no valid break-glass session for %', p_permission
+      using errcode = '42501';
+  end if;
+  insert into ${audit} (subject, permission, purpose, reason)
+  values (
+    nullif((${subject})::text, ''),
+    p_permission,
+    session ->> 'purpose',
+    session ->> 'reason'
+  );
+  return query select * from ${table}
+  where ${rowsFilter(ctx, entry)};
+end;
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+}
+/**
+* The `security definer` read path for every `breakGlass` grant: an audit
+* table and one `permdock_break_glass_<resource>(permission)` per resource
+* that checks a signed break-glass session, writes an audit row and returns
+* the rows in the scope instances where the subject holds a role with the
+* break-glass grant (bypassing the table's policies as the definer). Empty
+* when the policy has no break-glass grant.
+*/
+function breakGlassSql(ctx, entries) {
+	if (entries.length === 0) return "";
+	return [auditSql(ctx), ...entries.map((entry) => readFunctionSql(ctx, entry))].join("\n\n");
+}
+//#endregion
+//#region src/cli/rls-emit.ts
+const HEADER = "-- generated by permdock rls generate\n-- fail-closed: never target a bypass role\n";
+const TRUSTED_READER_GRANT = /^grant execute on function [^\n]+\.permdock_trusted_role_permissions\([^)\n]*\) to [^\n;]+;$/gmu;
+function assertNoServiceRole(text) {
+	if (/\bservice_role\b/iu.test(text.replace(TRUSTED_READER_GRANT, ""))) throw new Error("PermDock CLI: generated RLS must never emit service_role");
+}
+function assertSupautilsSafe(text) {
+	const [first] = supautilsRejections(text);
+	if (first !== void 0) throw new Error(`PermDock CLI: generated SQL line ${String(first.line)} ${first.reason}, which supautils rejects on Supabase`);
+}
+/**
+* Neon's Data API and `pg_session_jwt` name the anonymous role `anonymous`;
+* Supabase, PostgREST and the GUC pattern use `anon`. Role lists end a line
+* or a statement after `to` or `from`, so only those are renamed.
+*/
+function dialectRoles(text, dialect) {
+	if (dialect !== "neon") return text;
+	return text.replaceAll(/\b(to|from) ((?:[a-z_]+, )*[a-z_]+)(?=;|\n)/gu, (_match, keyword, list) => `${keyword} ${list.split(", ").map((role) => role === "anon" ? "anonymous" : role).join(", ")}`);
+}
+function tablesOf(policies) {
+	return [...new Set(policies.map((item) => item.table))];
+}
+/** Enable (and force) row level security, then the table grants for the commands a policy allows. */
+function tableSql(table, policies, force, views) {
+	const closed = views.find((view) => view.table === table && view.companion !== void 0);
+	const target = quoteTable(qualifiedTable$1(table));
+	const lines = [`alter table ${target} enable row level security;`];
+	if (force) lines.push(`alter table ${target} force row level security;`);
+	lines.push(`revoke all on table ${target} from anon, authenticated;`);
+	for (const role of ["anon", "authenticated"]) {
+		const cmds = new Set(policies.filter((item) => item.table === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
+		const grants = [
+			"select",
+			"insert",
+			"update",
+			"delete"
+		].filter((cmd) => cmds.has(cmd) && (closed === void 0 || cmd !== "select"));
+		if (grants.length > 0) lines.push(`grant ${grants.join(", ")} on table ${target} to ${role};`);
+		if (closed !== void 0 && cmds.has("select")) lines.push(columnGrantSql(closed, role));
+	}
+	if (closed !== void 0) lines.push(columnRevokeSql(closed));
+	return lines.join("\n");
+}
+/** `drop policy if exists` and `create policy` for one policy, without the table's grants. */
+function policySql(item) {
+	const target = quoteTable(qualifiedTable$1(item.table));
+	const lines = [
+		`drop policy if exists ${quoteIdent$1(item.name)} on ${target};`,
+		`create policy ${quoteIdent$1(item.name)}`,
+		`  on ${target}`,
+		`  as ${item.effect === "deny" ? "restrictive" : "permissive"}`,
+		`  for ${item.command}`,
+		`  to ${item.roles.join(", ")}`
+	];
+	if (item.using !== void 0) lines.push(`  using (${item.using})`);
+	if (item.check !== void 0) lines.push(`  with check (${item.check})`);
+	return `${lines.join("\n")};\n`;
+}
+function emitSql(policies, preamble, force = false, views = []) {
+	const chunks = [HEADER];
+	if (preamble !== "") chunks.push(preamble);
+	for (const table of tablesOf(policies)) chunks.push(tableSql(table, policies, force, views), "");
+	for (const item of policies) chunks.push(policySql(item));
+	if (views.length > 0) chunks.push(fieldViewsSql(views));
+	const text = `${chunks.join("\n").trim()}\n`;
+	assertNoServiceRole(text);
+	assertSupautilsSafe(text);
+	return text;
+}
+/**
+* The SQL a Drizzle or Prisma schema cannot declare: helpers, grants, `force` and field views.
+* `rls generate` writes it next to `out` for a custom migration.
+*/
+function migrationSql(policies, preamble, force, views) {
+	const parts = [
+		preamble.trim(),
+		...tablesOf(policies).map((table) => tableSql(table, policies, force, views)),
+		fieldViewsSql(views)
+	].filter((part) => part !== "");
+	if (parts.length === 0) return "";
+	const text = `${HEADER}\n${parts.join("\n\n")}\n`;
+	assertNoServiceRole(text);
+	assertSupautilsSafe(text);
+	return text;
+}
+function helpersNote(helpers, how) {
+	return helpers === void 0 ? [] : [`// run ${helpers} ${how}`];
+}
+function camelCase(name) {
+	return name.replace(/[_-]+([a-z0-9])/gi, (_, char) => char.toUpperCase());
+}
+function tableName(table) {
+	return table.slice(table.lastIndexOf(".") + 1);
+}
+function pascalCase(name) {
+	const camel = camelCase(name);
+	return camel.charAt(0).toUpperCase() + camel.slice(1);
+}
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+function identifier(name, what) {
+	if (!IDENTIFIER.test(name)) throw new Error(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
+	return name;
+}
+function quoted(text) {
+	return `'${text.replace(/[\\']/g, (match) => `\\${match}`)}'`;
+}
+function templateText(text) {
+	return text.replace(/[\\`]|\$\{/g, (match) => `\\${match}`);
+}
+const AUTH_UID = "(select auth.uid())";
+function drizzleRoles(list) {
+	return list.includes("anon") ? "[anonRole, authenticatedRole]" : "authenticatedRole";
+}
+function emitDrizzle(policies, options) {
+	const supabase = options.dialect === "supabase";
+	const anon = policies.some((item) => item.roles.includes("anon"));
+	const sqlOf = (text) => {
+		const parts = text.split(AUTH_UID).map(templateText);
+		return `sql\`${supabase ? parts.join("${authUid}") : parts.join(AUTH_UID)}\``;
+	};
+	const usesUid = supabase && policies.some((item) => item.using?.includes(AUTH_UID) === true || item.check?.includes(AUTH_UID) === true);
+	const lines = [
+		"// generated by permdock rls generate",
+		"// fail-closed: never target a bypass role",
+		...helpersNote(options.helpers, "in a custom migration (drizzle-kit generate --custom)"),
+		"import { sql } from 'drizzle-orm'"
+	];
+	if (supabase) {
+		const named = [
+			anon ? "anonRole" : "",
+			"authenticatedRole",
+			usesUid ? "authUid" : ""
+		].filter((name) => name !== "").join(", ");
+		lines.push("import { pgPolicy } from 'drizzle-orm/pg-core'", `import { ${named} } from 'drizzle-orm/supabase'`);
+	} else lines.push("import { pgPolicy, pgRole } from 'drizzle-orm/pg-core'");
+	lines.push(`import * as schema from ${quoted(options.schema ?? "./schema")}`, "");
+	if (!supabase) {
+		if (anon) lines.push(`export const anonRole = pgRole('${options.dialect === "neon" ? "anonymous" : "anon"}').existing()`);
+		lines.push("export const authenticatedRole = pgRole('authenticated').existing()", "");
+	}
+	for (const item of policies) {
+		const as = item.effect === "deny" ? "restrictive" : "permissive";
+		const table = identifier(options.exports?.[item.table] ?? camelCase(tableName(item.table)), "table export");
+		const name = identifier(camelCase(item.name), "policy export");
+		const using = item.using === void 0 ? "" : `\n  using: ${sqlOf(item.using)},`;
+		const check = item.check === void 0 ? "" : `\n  withCheck: ${sqlOf(item.check)},`;
+		lines.push(`export const ${name} = pgPolicy(${quoted(item.name)}, {`, `  as: '${as}',`, `  for: '${item.command}',`, `  to: ${drizzleRoles(item.roles)},${using}${check}`, `}).link(schema.${table})`, "");
+	}
+	const text = `${lines.join("\n").trimEnd()}\n`;
+	assertNoServiceRole(text);
+	return text;
+}
+/** Prisma 8 `policy_<command>` blocks; each target model declares `@@rls` itself. */
+function emitPrisma(policies, options = {}) {
+	const modelOf = (table) => identifier(options.models?.[table] ?? pascalCase(tableName(table)), "model");
+	const models = [...new Set(policies.map((item) => modelOf(item.table)))];
+	const lines = [
+		"// generated by permdock rls generate (Prisma 8 policy blocks)",
+		"// fail-closed: never target a bypass role",
+		`// add @@rls to ${models.length === 1 ? "model" : "models"} ${models.join(", ")}; keep these blocks in their namespace`,
+		...helpersNote(options.helpers, "in a migration before these policies"),
+		""
+	];
+	for (const item of policies) {
+		if (item.effect === "deny") throw new Error(`PermDock CLI: Prisma policy blocks are permissive only, so ${item.name} (a deny) needs --target sql`);
+		lines.push(`policy_${item.command} ${identifier(item.name, "policy name")} {`, `  target = ${modelOf(item.table)}`, `  roles  = [${item.roles.join(", ")}]`);
+		if (item.using !== void 0) lines.push(`  using  = ${JSON.stringify(item.using)}`);
+		if (item.check !== void 0) lines.push(`  withCheck = ${JSON.stringify(item.check)}`);
+		lines.push("}", "");
+	}
+	const text = `${lines.join("\n").trimEnd()}\n`;
+	assertNoServiceRole(text);
+	return text;
+}
+/** The migration file written next to `out`. */
+function migrationOut(out) {
+	const dot = out.lastIndexOf(".");
+	return `${dot > Math.max(out.lastIndexOf("/"), out.lastIndexOf("\\")) ? out.slice(0, dot) : out}.migration.sql`;
+}
+function defaultOut(target) {
+	switch (target) {
+		case "sql": return "rls.sql";
+		case "drizzle": return "src/db/policies.ts";
+		case "prisma": return "prisma/policies.prisma";
+		default: return target;
+	}
+}
+//#endregion
+//#region src/cli/rls-realtime-storage.ts
+const SCOPE_SEGMENT = /^\{([a-z][a-z0-9_]*)\}$/u;
+const LITERAL_SEGMENT = /^[^{}:\s]+$/u;
+const TOPIC = "(select realtime.topic())";
+function policyName(prefix, name, command) {
+	const full = `permdock_${prefix}_${name.replaceAll(/[^A-Za-z0-9]+/gu, "_").replaceAll(/^_|_$/gu, "")}_${command}`;
+	if (new TextEncoder().encode(full).length > 63) throw new Error(`PermDock CLI: the ${prefix} policy name ${full} is longer than Postgres's 63 bytes; shorten '${name}'`);
+	return full;
+}
+function grantKey(facts, ref, where, warnings) {
+	if (ref === void 0) return;
+	const key = typeof ref === "object" && ref !== null ? Reflect.get(ref, "key") : ref;
+	if (typeof key !== "string" || !facts.keys.has(key)) throw new Error(`PermDock CLI: ${where} must be a permission reference from the definitions (got ${JSON.stringify(key)})`);
+	if (facts.rowConditions.has(key)) warnings.push(`${where} is ${key}, whose grants carry row conditions (a relation, a where or another condition): the policy admits only the instances its role allows without a condition reach, through permitted_<scope>_ids_by_permission`);
+	return key;
+}
+function declaredScope(facts, scope, where) {
+	if (!facts.scopes.has(scope)) throw new Error(`PermDock CLI: ${where} names the scope '${scope}', which definePolicy({ scopes }) does not declare`);
+	return scope;
+}
+/**
+* The ids of `scope` where the subject holds `key` through an allow without
+* a row condition, minus a deny of it, as text: `<value> in (…)`. A
+* relationship or a `where` on the same permission never widens it.
+*/
+function permitted(ctx, value, scope, key) {
+	return `${value} in (select x::text from ${qualified$1(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
+}
+function escapeRegex(text) {
+	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+}
+function realtimePolicies(ctx, facts, realtime, warnings) {
+	return Object.entries(realtime.topics).flatMap(([pattern, topic]) => {
+		const where = `rls.realtime.topics['${pattern}']`;
+		const segments = pattern.split(":");
+		const placeholders = segments.flatMap((segment, index) => {
+			const match = SCOPE_SEGMENT.exec(segment);
+			return match === null ? [] : [{
+				index,
+				scope: match[1] ?? ""
+			}];
+		});
+		const [placeholder] = placeholders;
+		if (placeholder === void 0 || placeholders.length > 1 || segments.some((segment, index) => index !== placeholder.index && !LITERAL_SEGMENT.test(segment))) throw new Error(`PermDock CLI: ${where} must be ':'-separated segments with exactly one '{<scope>}' segment, such as 'org:{organization}:chat'`);
+		const scope = declaredScope(facts, placeholder.scope, where);
+		const regex = `^${segments.map((segment, index) => index === placeholder.index ? "[^:]+" : escapeRegex(segment)).join(":")}$`;
+		const id = `split_part(${TOPIC}, ':', ${String(placeholder.index + 1)})`;
+		const condition = (key) => `extension in ('broadcast', 'presence')
+    and ${TOPIC} ~ ${quoteLiteral(regex)}
+    and ${permitted(ctx, id, scope, key)}`;
+		const read = grantKey(facts, topic.read, `${where}.read`, warnings);
+		const write = grantKey(facts, topic.write, `${where}.write`, warnings);
+		if (read === void 0) throw new Error(`PermDock CLI: ${where}.read is required`);
+		const policies = [{
+			name: policyName("realtime", pattern, "select"),
+			table: "realtime.messages",
+			command: "select",
+			effect: "allow",
+			roles: ["authenticated"],
+			using: condition(read)
+		}];
+		if (write !== void 0) policies.push({
+			name: policyName("realtime", pattern, "insert"),
+			table: "realtime.messages",
+			command: "insert",
+			effect: "allow",
+			roles: ["authenticated"],
+			check: condition(write)
+		});
+		return policies;
+	});
+}
+function folderOf(bucket, where) {
+	const folder = bucket.folder ?? 1;
+	if (!Number.isInteger(folder) || folder < 1) throw new Error(`PermDock CLI: ${where}.folder must be a positive integer (got ${String(folder)})`);
+	return folder;
+}
+function storagePolicies(ctx, facts, storage, warnings) {
+	return Object.entries(storage.buckets).flatMap(([id, bucket]) => {
+		const where = `rls.storage.buckets['${id}']`;
+		const scope = declaredScope(facts, bucket.scope, `${where}.scope`);
+		const folder = folderOf(bucket, where);
+		const condition = (key) => `bucket_id = ${quoteLiteral(id)}
+    and ${permitted(ctx, `(storage.foldername(name))[${String(folder)}]`, scope, key)}`;
+		const policies = [
+			[
+				"select",
+				bucket.read,
+				"read"
+			],
+			[
+				"insert",
+				bucket.write,
+				"write"
+			],
+			[
+				"update",
+				bucket.write,
+				"write"
+			],
+			[
+				"delete",
+				bucket.delete,
+				"delete"
+			]
+		].flatMap(([command, ref, field]) => {
+			const key = grantKey(facts, ref, `${where}.${field}`, warnings);
+			if (key === void 0) return [];
+			const expression = condition(key);
+			return [{
+				name: policyName("storage", id, command),
+				table: "storage.objects",
+				command,
+				effect: "allow",
+				roles: ["authenticated"],
+				...command === "insert" ? {} : { using: expression },
+				...command === "select" || command === "delete" ? {} : { check: expression }
+			}];
+		});
+		if (policies.length === 0) throw new Error(`PermDock CLI: ${where} needs read, write or delete`);
+		return policies;
+	});
+}
+/**
+* The `realtime.messages` and `storage.objects` policies `rls.realtime` and
+* `rls.storage` describe. Each one admits a row only where the subject holds
+* the permission in the scope instance its topic segment or folder names,
+* through an allow without a row condition, so the helpers' API-key ceiling
+* and suspension rules apply and a relationship grant on the same permission
+* never reaches a topic or a folder.
+*/
+function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
+	if (config.realtime === void 0 && config.storage === void 0) return [];
+	if (ctx.dialect !== "supabase") throw new Error(`PermDock CLI: rls.realtime and rls.storage need --dialect supabase (got ${ctx.dialect})`);
+	const policies = [...config.realtime === void 0 ? [] : realtimePolicies(ctx, facts, config.realtime, warnings), ...config.storage === void 0 ? [] : storagePolicies(ctx, facts, config.storage, warnings)];
+	const seen = /* @__PURE__ */ new Set();
+	for (const { name } of policies) {
+		if (seen.has(name)) throw new Error(`PermDock CLI: two rls.realtime or rls.storage entries both name the policy ${name}; rename one`);
+		seen.add(name);
+	}
+	return policies;
+}
+//#endregion
+//#region src/cli/rls-rows.ts
+/** `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject may act on with one permission. */
+function rowsHelper(resource) {
+	const name = graphSqlName(resource);
+	const helper = `permitted_${name ?? resource}_rows`;
+	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw new Error(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
+	return helper;
+}
+/** The branches a row check of a permission reads: its allows and denies on rows that exist, for signed-in callers. */
+function rowBranchesOf(branches, resource) {
+	const out = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.resource !== resource || branch.command === "insert" || branch.coverage === true || !branch.roles.includes("authenticated")) continue;
+		out.set(branch.permissionKey, [...out.get(branch.permissionKey) ?? [], branch]);
+	}
+	return out;
+}
+function usingOf(branches) {
+	const parts = branches.map((branch) => branchClauses(branch).using ?? "true");
+	return parts.length === 0 ? void 0 : orSql(parts);
+}
+function permissionCase(key, branches) {
+	const allow = usingOf(branches.filter((branch) => branch.effect === "allow"));
+	if (allow === void 0) return;
+	const deny = usingOf(branches.filter((branch) => branch.effect === "deny"));
+	const granted = `coalesce((${allow}), false)`;
+	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
+}
+function forUserSql(ctx, fn, helper) {
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const signature = `${user}, text, jsonb`;
+	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
+returns setof text
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$`;
+	const tail = `revoke execute on function ${fn}(${signature}) from public, anon, authenticated;`;
+	if (ctx.dialect === "supabase") return `${head}
+declare
+  v_claims text := pg_catalog.current_setting('request.jwt.claims', true);
+begin
+  perform pg_catalog.set_config(
+    'request.jwt.claims',
+    (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
+    true
+  );
+  return query select r.id from ${helper}(p_permission) r(id);
+  perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
+end
+$$;
+${tail}`;
+	const prefix = ctx.gucPrefix;
+	return `${head}
+declare
+  v_saved jsonb := '{}'::jsonb;
+  v_key text;
+  v_value text;
+begin
+  for v_key, v_value in
+    select 'user_id', p_user
+    union all
+    select c.key, c.value from pg_catalog.jsonb_each_text(coalesce(p_claims, '{}'::jsonb)) c where c.key <> 'user_id'
+  loop
+    v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+  return query select r.id from ${helper}(p_permission) r(id);
+  for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
+    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
+  end loop;
+end
+$$;
+${tail}`;
+}
+function inheritTargets(policy) {
+	const out = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) for (const item of flattenGrantee(grant.to)) if (item.kind === "inherit") out.add(item.resource);
+	return [...out].toSorted();
+}
+function stubSql(ctx, resource) {
+	return `create or replace function ${qualified$1(ctx, rowsHelper(resource))}(p_permission text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select null::text where false
+$$;`;
+}
+function rowSql(ctx, rows, table, where) {
+	const fn = qualified$1(ctx, rows.replace(/_rows$/u, "_row"));
+	return `create or replace function ${fn}(p_row ${table}, p_permission text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (select 1 from (select (p_row).*) r where ${where})
+$$;
+revoke execute on function ${fn}(${table}, text) from public, anon;
+grant execute on function ${fn}(${table}, text) to authenticated;`;
+}
+function resourceSql(ctx, node, branches, tables) {
+	const name = rowsHelper(node.name);
+	const fn = qualified$1(ctx, name);
+	const table = quoteTable(qualifiedTable$1(tableFor(node.name, tables)));
+	const cases = [...branches.keys()].toSorted().flatMap((key) => {
+		const sql = permissionCase(key, branches.get(key) ?? []);
+		return sql === void 0 ? [] : [sql];
+	});
+	const where = cases.length === 0 ? "false" : `case p_permission\n${cases.join("\n")}\n    else false\n  end`;
+	const rows = `-- ${node.name}: ids of the rows the caller may act on with p_permission, as the table's policies decide it
+create or replace function ${fn}(p_permission text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${quoteIdent$1(node.id)}::text from ${table}
+  where ${where}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;
+${rowSql(ctx, name, table, where)}`;
+	if (ctx.dialect === "neon") return rows;
+	return `${rows}
+-- the same rows for a user the caller names, with claims it supplies; no client role may execute it
+${forUserSql(ctx, qualified$1(ctx, `${name}_for`), fn)}`;
+}
+/**
+* `permitted_<resource>_rows(p_permission)` for each resource `select`
+* names (or every resource a grant reaches with `true`): the ids of its rows
+* the caller may read, update or delete with that permission, from the same
+* compiled allows and denies the table policies use, so closure walks, link
+* hops, the restricted stop, `includes`, groups and `requires` all apply. A
+* `security definer` helper, so hand-written policies and functions call it
+* without restating the graph. Outside the `neon` dialect a
+* `permitted_<resource>_rows_for(p_user, p_permission, p_claims)` form runs it
+* as the named user, with the claims the caller supplies, for trusted SQL.
+*/
+function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
+	const names = select === true ? [...new Set(branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(select)];
+	const called = inheritTargets(policy);
+	for (const name of called) if (!names.includes(name)) names.push(name);
+	const chunks = called.map((name) => stubSql(ctx, name));
+	for (const name of names) {
+		const node = policy.resources.get(name);
+		if (node === void 0) throw new Error(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
+		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), tables));
+	}
+	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
+	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls-shims.ts
+const NAME = /^[a-z_][a-z0-9_]*$/u;
+/**
+* The key a legacy caller passes, mapped the way `rls migrate` maps it:
+* `keys` and `renamed` exactly, then the longest `prefixes` entry.
+*/
+function mappedKey(config, renamed) {
+	const exact = {
+		...renamed,
+		...config.keys
+	};
+	const prefixes = Object.entries(config.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length);
+	const fallback = prefixes.length === 0 ? "p_key" : `case ${prefixes.map(([from, to]) => `when pg_catalog.starts_with(p_key, ${quoteLiteral(from)}) then ${quoteLiteral(to)} || pg_catalog.substr(p_key, ${String(from.length + 1)})`).join(" ")} else p_key end`;
+	if (Object.keys(exact).length === 0) return fallback;
+	return `coalesce(${quoteLiteral(JSON.stringify(exact))}::jsonb ->> p_key, ${fallback})`;
+}
+function scopeOf(ctx, scope) {
+	if (!ctx.scopes.some((item) => item.name === scope)) throw new Error(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
+	return scope;
+}
+function addKey(list, key) {
+	if (!list.includes(key)) list.push(key);
+}
+/**
+* The grant keys behind each permission, per scope: the keys of its
+* unconditional allows, and every deny key. A shim cannot apply a row
+* condition or a validity window, so a conditional allow answers nothing and
+* a conditional deny always subtracts; the conditioned keys are listed apart.
+* A break-glass key answers only the break-glass read, so it is left out too.
+* Rows seeded under a former key are left out; the shim maps a former key to
+* the current one first.
+*/
+function shimGrants(rows, conditioned, renamed) {
+	const byScope = /* @__PURE__ */ new Map();
+	for (const row of rows.toSorted((a, b) => a.grantKey < b.grantKey ? -1 : a.grantKey > b.grantKey ? 1 : 0)) {
+		if (Object.hasOwn(renamed, row.permission) || row.effect === "allow" && row.grantKey === breakGlassKey(row.permission)) continue;
+		const scope = byScope.get(row.scope) ?? {};
+		byScope.set(row.scope, scope);
+		const keys = (Object.hasOwn(scope, row.permission) ? scope[row.permission] : void 0) ?? {
+			allow: [],
+			deny: []
+		};
+		scope[row.permission] = keys;
+		const isConditioned = conditioned.has(row.grantKey);
+		if (row.effect === "allow") {
+			if (isConditioned) {
+				keys["conditioned-allow"] ??= [];
+				addKey(keys["conditioned-allow"], row.grantKey);
+			} else addKey(keys.allow, row.grantKey);
+			continue;
+		}
+		addKey(keys.deny, row.grantKey);
+		if (isConditioned) {
+			keys["conditioned-deny"] ??= [];
+			addKey(keys["conditioned-deny"], row.grantKey);
+		}
+	}
+	return byScope;
+}
+function shimMap(grants, scope) {
+	const entries = Object.entries(grants.get(scope) ?? {}).flatMap(([permission, keys]) => keys.allow.length === 0 && keys.deny.length === 0 ? [] : [[permission, {
+		allow: keys.allow,
+		deny: keys.deny
+	}]]);
+	return JSON.stringify(Object.fromEntries(entries));
+}
+function shimFunction(name, args, argTypes, returns, sql) {
+	return `create or replace function ${name}(${args})
+returns ${returns}
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+${sql}
+$$;
+revoke execute on function ${name}(${argTypes}) from public, anon;
+grant execute on function ${name}(${argTypes}) to authenticated;`;
+}
+function grantKeys(keys, scope, effect) {
+	return `pg_catalog.jsonb_array_elements_text(coalesce(${keys.map(scope)} -> (${keys.key}) -> ${quoteLiteral(effect)}, '[]'::jsonb)) g(grant_key)`;
+}
+/** The instances of `scope` the caller holds an unconditional allow of the key in, minus those it holds a deny in. */
+function idsSql(ctx, keys, scope) {
+	const helper = qualified$1(ctx, permittedIdsHelper(scope));
+	return `  select a.id
+  from ${grantKeys(keys, scope, "allow")}
+  cross join lateral ${helper}(g.grant_key) a(id)
+  except
+  select d.id
+  from ${grantKeys(keys, scope, "deny")}
+  cross join lateral ${helper}(g.grant_key) d(id)`;
+}
+function hasSql(ctx, keys) {
+	const has = qualified$1(ctx, HELPERS.has);
+	return `exists (select 1 from ${grantKeys(keys, "global", "allow")} where ${has}(g.grant_key))
+    and not exists (select 1 from ${grantKeys(keys, "global", "deny")} where ${has}(g.grant_key))`;
+}
+function shim(ctx, config, keys, fn, helper) {
+	switch (helper.form) {
+		case "ids": {
+			const scope = scopeOf(ctx, helper.scope);
+			return shimFunction(fn, "p_key text", "text", `setof ${scopeTypeOf(ctx, scope)}`, idsSql(ctx, keys, scope));
+		}
+		case "row": {
+			const scope = scopeOf(ctx, helper.scope);
+			const type = scopeTypeOf(ctx, scope);
+			return shimFunction(fn, `p_id ${type}, p_key text`, `${type}, text`, "boolean", `  select coalesce(p_id in (\n${idsSql(ctx, keys, scope)}\n  ), false)`);
+		}
+		case "membership": {
+			const scope = scopeOf(ctx, helper.scope);
+			const type = scopeTypeOf(ctx, scope);
+			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified$1(ctx, memberIdsHelper(scope))}()), false)`);
+		}
+		case "global": return shimFunction(fn, "p_key text", "text", "boolean", `  select ${hasSql(ctx, keys)}`);
+		case "scoped": {
+			const literals = /* @__PURE__ */ new Map();
+			for (const scope of ctx.scopes) literals.set(scope.name, scope.name);
+			for (const [literal, scope] of Object.entries(config.scopes ?? {})) literals.set(literal, scopeOf(ctx, scope));
+			const global = config.globalScopes ?? [];
+			return shimFunction(fn, "p_scope text, p_id text, p_key text", "text, text, text", "boolean", `  select case\n${[...global.length === 0 ? [] : [`    when p_scope in (${global.map(quoteLiteral).join(", ")}) then ${hasSql(ctx, keys)}`], ...[...literals].filter(([literal]) => !global.includes(literal)).map(([literal, scope]) => `    when p_scope = ${quoteLiteral(literal)} then coalesce(p_id in (select s.id::text from (\n${idsSql(ctx, keys, scope)}\n    ) s(id)), false)`)].join("\n")}\n    else false\n  end`);
+		}
+		default: return helper;
+	}
+}
+/**
+* One wrapper per `rls.migrate.helpers` entry under its legacy name, so SQL
+* that `rls migrate` has not rewritten yet (function bodies, views, triggers)
+* answers from the PermDock helpers. A wrapper maps the legacy key to the
+* permission key, then to the grant keys `grants` lists for the helper's
+* scope, so a permission whose grants are split by condition still answers.
+* Each is `security definer` with an empty `search_path`, so a caller needs
+* `execute` on the wrapper only, not usage on the helper schema.
+*/
+function shimsSql(ctx, config, shims, renamed, grants) {
+	const schema = shims.schema ?? "public";
+	const keys = {
+		key: mappedKey(config, renamed),
+		map: (scope) => `${quoteLiteral(shimMap(grants, scope))}::jsonb`
+	};
+	const chunks = [`-- permdock shims: legacy helper names over the permdock helpers; drop each once doctor reports no caller (PD056)`];
+	for (const [name, helper] of Object.entries(config.helpers).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+		if (!NAME.test(name)) throw new Error(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
+		chunks.push(shim(ctx, config, keys, `${quoteIdent$1(schema)}.${name}`, helper));
+	}
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls-generate.ts
+async function loadPolicy(cwd, config, from) {
+	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
+	if (policyPath === void 0) throw new Error("PermDock CLI: rls generate needs policy in permdock.config.ts or --from");
+	return asPolicy(pickNamed(await loadModule(resolve(cwd, policyPath)), ["policy"]));
+}
+/** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
+function writeRequirement(policy, requires) {
+	if (requires === void 0) return {};
+	const leaves = listPermissions(policy.permissions);
+	const keys = requires === "manageRoles" ? leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key) : [...requires];
+	if (keys.length === 0) return { error: requires === "manageRoles" ? "rls.customRoleWrites.requires is 'manageRoles', but no permission declares meta.manageRoles" : "rls.customRoleWrites.requires names no permission" };
+	const known = new Set(leaves.map((leaf) => leaf.key));
+	const unknown = keys.filter((key) => !known.has(key));
+	if (unknown.length > 0) return { error: `rls.customRoleWrites.requires names undeclared permissions: ${unknown.join(", ")}` };
+	return { keys: [...new Set(keys)].toSorted() };
+}
+/** Declared role names, and those a tenant admin may compose into custom roles. */
+function customRoleNames(policy, requires) {
+	const declared = [...roleNames(policy)].toSorted();
+	const assignable = declared.filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
+	const renamed = renamedKeys(policy.vocabulary.permissions);
+	const leaves = listPermissions(policy.permissions);
+	const manage = leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key);
+	return {
+		declared,
+		assignable,
+		...renamed.size === 0 ? {} : { renamed: Object.fromEntries(renamed) },
+		permissions: leaves.map((leaf) => leaf.key).toSorted(),
+		...manage.length === 0 ? {} : { manage: manage.toSorted() },
+		...requires === void 0 ? {} : { requires },
+		...policy.levels === void 0 ? {} : { levels: true }
+	};
+}
+function moveUndiffed(sql, label, part) {
+	const { kept, moved } = splitUndiffed(sql);
+	const [first = "", ...rest] = kept.split("\n");
+	return {
+		sql: [
+			first,
+			`-- what supabase db diff drops from this part is in ${label}`,
+			...rest
+		].join("\n"),
+		grants: `-- the privileges and view options supabase db diff drops from the ${part} part\n${moved.join("\n")}`
+	};
+}
+/**
+* The row columns that belong to a table. With `rls.tables` set, a resource
+* it does not name is a table only when generated policies are written for
+* it; with `--helpers-only` it has none, so it gets no index.
+*/
+function tableColumns(rowColumns, tables, helpersOnly, warnings) {
+	if (tables === void 0) return rowColumns;
+	const unmapped = [...new Set(rowColumns.map((item) => item.resource).filter((resource) => !Object.hasOwn(tables, resource)))].toSorted();
+	if (unmapped.length === 0) return rowColumns;
+	if (helpersOnly) {
+		warnings.push(`no index is suggested for resources without an rls.tables entry: ${unmapped.join(", ")}; map each one that is a table`);
+		return rowColumns.filter((item) => Object.hasOwn(tables, item.resource));
+	}
+	warnings.push(`policies for resources without an rls.tables entry target a table named after the resource: ${unmapped.map((resource) => qualifiedTable$1(resource)).join(", ")}; map each one to its table`);
+	return rowColumns;
+}
+async function runRlsGenerate(input) {
+	const rls = input.config.rls;
+	const fieldsMode = input.fields ?? rls?.fields;
+	if (fieldsMode !== void 0 && fieldsMode !== "views") return {
+		code: 2,
+		output: `rls generate --fields must be views (got ${fieldsMode})`,
+		text: ""
+	};
+	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
+	if (revokeColumns && fieldsMode === void 0) return {
+		code: 2,
+		output: "rls generate --revoke-columns needs --fields views",
+		text: ""
+	};
+	const policy = await loadPolicy(input.cwd, input.config, input.from);
+	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
+	if (input.rbac && input.dialect !== "supabase") return {
+		code: 2,
+		output: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})`,
+		text: ""
+	};
+	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
+	const authorize = resolveAuthorize(input.config, {
+		authorize: input.authorize,
+		rbac: input.rbac,
+		memberships
+	});
+	const memberSources = rls?.membershipSources ?? input.config.supabase?.hook?.memberships;
+	const sources = authorize === "database" ? memberSources : void 0;
+	const scopes = scopeList(policy.scopes);
+	const suspension = checkSuspension(rls?.suspension, scopes);
+	const hookRoles = input.config.supabase?.hook?.roles;
+	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
+	if (roles !== void 0 && input.rbac) return {
+		code: 2,
+		output: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag",
+		text: ""
+	};
+	const requires = writeRequirement(policy, rls?.customRoleWrites?.requires);
+	if (requires.error !== void 0) return {
+		code: 2,
+		output: requires.error,
+		text: ""
+	};
+	const readers = rls?.trustedReaders;
+	if (readers !== void 0 && (!Array.isArray(readers) || !readers.every((name) => typeof name === "string" && name !== ""))) return {
+		code: 2,
+		output: "rls.trustedReaders must list Postgres role names, such as ['service_role']",
+		text: ""
+	};
+	const ownership = ownershipRules(policy, scopes);
+	const graph = graphPlan(policy);
+	const apiKeys = apiKeysPlan(rls?.apiKeys, new Set(roleNames(policy)), Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
+	const ctx = {
+		dialect: input.dialect,
+		scopes,
+		tenantClaim: rls?.tenantClaim ?? "tenant_id",
+		...rls?.tenants === "all" ? { tenants: "all" } : {},
+		gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
+		...rls?.actions === void 0 ? {} : { actions: rls.actions },
+		inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
+		schema,
+		authorize,
+		roleClaim: rls?.roleClaim ?? "user_role",
+		tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
+		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
+		...memberships === void 0 ? {} : { memberships },
+		...sources === void 0 || sources.length === 0 ? {} : { sources },
+		...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
+		...suspension === void 0 ? {} : { suspension },
+		...roles === void 0 ? {} : { roles },
+		...input.customRoles === true || rls?.customRoles === true ? { customRoles: {
+			...customRoleNames(policy, requires.keys),
+			...rls?.customRoleWrites?.roles === void 0 ? {} : { table: rls.customRoleWrites.roles }
+		} } : {},
+		...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
+		...apiKeys === void 0 ? {} : { apiKeys },
+		...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
+		...ownership === void 0 ? {} : { ownership },
+		...rls?.ownershipTriggers === void 0 ? {} : { skipOwnershipTriggers: rls.ownershipTriggers === false ? "all" : Object.keys(rls.ownershipTriggers).map((key) => {
+			const name = resolveScope(scopes, key);
+			if (name === void 0) throw new Error(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
+			return name;
+		}) },
+		...rls?.assignments === void 0 ? {} : { assignments: rls.assignments === true ? { tables: [] } : {
+			tables: rls.assignments.tables ?? [],
+			...rls.assignments.ownRole === void 0 ? {} : { ownRole: rls.assignments.ownRole }
+		} },
+		...fieldsMode === void 0 ? {} : { fields: fieldsMode },
+		...graph.size === 0 ? {} : { graph: {
+			closures: closureDepths(graph),
+			resources: policy.resources,
+			...rls?.tables === void 0 ? {} : { tables: rls.tables }
+		} }
+	};
+	if (ctx.anonymousSignIns === "deny" && ctx.dialect !== "supabase") return {
+		code: 2,
+		output: `rls.anonymousSignIns needs --dialect supabase (got ${ctx.dialect})`,
+		text: ""
+	};
+	const jsonSchema = rls?.jsonSchema;
+	if (jsonSchema !== void 0 && jsonSchema !== "auto" && typeof jsonSchema !== "boolean") return {
+		code: 2,
+		output: `rls.jsonSchema must be 'auto', true or false (got ${JSON.stringify(jsonSchema)})`,
+		text: ""
+	};
+	const warnings = [];
+	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
+	if (authorize === "database") {
+		for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
+	}
+	const compiled = compileGrants(policy, ctx, rls?.tables, warnings, input.skipClosures, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0);
+	const helpersOnly = input.helpersOnly === true || rls?.helpersOnly === true;
+	if (helpersOnly && (input.target !== "sql" || revokeColumns)) return {
+		code: 2,
+		output: "rls generate --helpers-only needs --target sql and no --revoke-columns: the table grants are hand-written, so revoke the restricted columns there",
+		text: ""
+	};
+	const views = fieldsMode === void 0 ? [] : fieldViews(policy, ctx, compiled.branches, {
+		revokeColumns,
+		helpersOnly
+	}, warnings);
+	const force = input.force === true || rls?.force === true;
+	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
+	const policyName = input.policyName ?? rls?.policyName;
+	const assembled = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
+		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
+		...policyName === void 0 ? {} : { name: policyName }
+	});
+	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
+	if (actorKinds !== void 0 && helpersOnly) warnings.push("rls.readOnlyActors adds policies, and --helpers-only writes none: add the restrictive read-only policies to the hand-written ones");
+	const policies = actorKinds === void 0 ? assembled : [...assembled, ...readOnlyActorPolicies(assembled, subjectClaimJsonSql(ctx, "act"), actorKinds)];
+	let tablePolicies;
+	try {
+		tablePolicies = realtimeStoragePolicies(ctx, {
+			scopes: new Set(ctx.scopes.map((scope) => scope.name)),
+			keys: new Set(listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key)),
+			rowConditions: new Set(policyRowConditionKeys(policy))
+		}, compact({
+			realtime: rls?.realtime,
+			storage: rls?.storage
+		}), warnings);
+	} catch (cause) {
+		return {
+			code: 2,
+			output: describeError(cause),
+			text: ""
+		};
+	}
+	if (tablePolicies.length > 0 && helpersOnly) warnings.push("rls.realtime and rls.storage add policies, and --helpers-only writes none: no realtime.messages or storage.objects policy is written");
+	const servicePolicies = tablePolicies.length === 0 || helpersOnly ? [] : [...tablePolicies, ...actorKinds === void 0 ? [] : readOnlyActorPolicies(tablePolicies, subjectClaimJsonSql(ctx, "act"), actorKinds)];
+	const helperTables = servicePolicies.length === 0 ? void 0 : [SERVICE_TABLES_HEADER, ...servicePolicies.map(policySql)].join("\n");
+	const guardedTables = servicePolicies.length === 0 ? void 0 : [`${SERVICE_TABLES_HEADER} A stack without the service has no table, so each policy is skipped there.`, ...servicePolicies.map(guardedPolicySql)].join("\n");
+	const rootMapped = ctx.scopes[0] === void 0 ? void 0 : scopeTable(ctx, ctx.scopes[0].name);
+	const rootTable = rootMapped === void 0 ? void 0 : {
+		...rootMapped.table,
+		tenant: rootMapped.column
+	};
+	const rbac = input.rbac ? rbacScaffold(policy, {
+		schema,
+		authorize,
+		...rootTable === void 0 ? {} : { memberships: rootTable },
+		...ctx.scopes[0] === void 0 ? {} : { scope: ctx.scopes[0].name },
+		...ctx.customRoles === void 0 ? {} : { customRoles: {
+			declared: ctx.customRoles.declared,
+			...ctx.customRoles.levels === true ? { levels: true } : {}
+		} },
+		context: ctx
+	}) : void 0;
+	if (rbac !== void 0) warnings.push(...rbac.warnings);
+	if (input.rbac) warnings.push("the token hook that writes user_role and memberships comes from permdock supabase hook generate");
+	const owned = [ownershipSql(ctx), assignmentSql(ctx)].filter((part) => part !== "").join("\n");
+	if (ctx.assignments !== void 0 && (ownership === void 0 || ownership.assigns.length === 0)) warnings.push("rls.assignments needs a role that declares assigns: no assignment trigger is written");
+	let approvals;
+	try {
+		approvals = rls?.approvals === true ? approvalStoreSql(ctx, jsonSchema ?? false) : typeof rls?.approvals === "object" ? adoptedApprovalStoreSql(ctx, rls.approvals, jsonSchema ?? false) : void 0;
+	} catch (cause) {
+		return {
+			code: 2,
+			output: describeError(cause),
+			text: ""
+		};
+	}
+	const graphed = graphSql(ctx, graph, rls?.tables);
+	let rowHelpers = "";
+	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) try {
+		rowHelpers = rowHelpersSql(ctx, policy, [...fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], rls?.tables, warnings);
+	} catch (cause) {
+		return {
+			code: 2,
+			output: describeError(cause),
+			text: ""
+		};
+	}
+	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, rls?.tables));
+	const configured = rls?.shims;
+	const shimsConfig = typeof configured === "object" ? configured : configured === true || input.shims === true ? {} : void 0;
+	if (shimsConfig !== void 0 && rls?.migrate === void 0) return {
+		code: 2,
+		output: "PermDock CLI: rls generate --shims needs rls.migrate.helpers in permdock.config.ts",
+		text: ""
+	};
+	const renamed = Object.fromEntries(renamedKeys(policy.vocabulary.permissions));
+	const grants = shimGrants(compiled.rolePermissions, compiled.conditionedKeys, renamed);
+	const anonExecute = rls?.anonExecute === true || views.some((view) => view.roles.includes("anon")) || compiled.branches.some((branch) => branch.roles.includes("anon") && [
+		branch.access,
+		branch.using,
+		branch.check
+	].some((sql) => sql?.includes("permdock_user_id") === true));
+	const usesLiveSession = compiled.branches.some((branch) => [
+		branch.access,
+		branch.using,
+		branch.check
+	].some((sql) => sql?.includes(SESSION_LIVE_HELPER) === true));
+	const shims = shimsConfig === void 0 || rls?.migrate === void 0 ? void 0 : shimsSql(ctx, rls.migrate, shimsConfig, renamed, grants);
+	const preamble = [
+		rbac?.head,
+		helpersSql(ctx, compiled.rolePermissions, {
+			levelReach: compiled.levelReach,
+			permissions: listPermissions(policy.permissions).map((leaf) => leaf.key).toSorted(),
+			userRoles: !input.rbac,
+			anonExecute,
+			withoutSeeds: splitsPart(input.split, "seeds"),
+			...rls?.trustedReaders === void 0 ? {} : { trustedReaders: rls.trustedReaders }
+		}),
+		permissionHelpersSql(ctx, grants, renamed, anonExecute),
+		usesLiveSession ? sessionLiveHelperSql(ctx) : void 0,
+		approvals,
+		owned === "" ? void 0 : owned,
+		graphed === "" ? void 0 : graphed,
+		breakGlass === "" ? void 0 : breakGlass,
+		rowHelpers === "" ? void 0 : rowHelpers,
+		shims,
+		rbac?.tail
+	].filter((part) => part !== void 0).join("\n");
+	if (force) for (const entry of graph.values()) {
+		const own = [...entry.relations].filter((name) => !("edge" in (entry.node.relations[name] ?? {})));
+		if (own.length > 0) warnings.push(`--force: ${entry.node.name} relations ${own.join(", ")} are read from the ${entry.node.name} table itself, so ${graphHelper(entry.node.name)} would recurse through its own policy; keep ${entry.node.name} unforced or move them to edge tables`);
+	}
+	const outRel = input.out ?? rls?.out ?? defaultOut(input.target);
+	const migration = input.target === "sql" ? "" : dialectRoles(migrationSql(policies, withHelperTables(preamble, helperTables), force, views), ctx.dialect);
+	const migrationRel = migration === "" ? void 0 : migrationOut(outRel);
+	const helpers = migrationRel === void 0 ? void 0 : basename(migrationRel);
+	let text;
+	switch (input.target) {
+		case "sql":
+			text = dialectRoles(withHelperTables(emitSql(policies, preamble, force, views), helperTables), ctx.dialect);
+			break;
+		case "drizzle":
+			text = emitDrizzle(policies, compact({
+				dialect: ctx.dialect,
+				schema: rls?.drizzle?.schema,
+				exports: rls?.drizzle?.exports,
+				helpers
+			}));
+			break;
+		case "prisma":
+			text = emitPrisma(policies, compact({
+				models: rls?.prisma?.models,
+				helpers
+			}));
+			break;
+		default: return input.target;
+	}
+	let indexes = indexTargets(ctx, tableColumns(compiled.rowColumns, rls?.tables, helpersOnly, warnings));
+	if (input.db !== void 0) try {
+		const pruned = pruneIndexTargets(indexes, await readTableIndexFacts(input.db, [...new Set(indexes.map((target) => target.table))], input.connect));
+		indexes = pruned.targets;
+		warnings.push(...pruned.warnings);
+	} catch (cause) {
+		return {
+			code: 2,
+			output: describeError(cause),
+			text: ""
+		};
+	}
+	if (!splitsPart(input.split, "indexes")) for (const target of indexes) warnings.push(`index suggestion: create index on ${target.table} (${target.columns.join(", ")}), or add indexes to --split`);
+	const extras = migration === "" ? {} : { migration };
+	if (input.write === false) return {
+		code: 0,
+		output: warnings.join("\n"),
+		text,
+		policies,
+		seeds: compiled.rolePermissions,
+		indexes,
+		keys: {
+			permissions: listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key),
+			rowConditions: [...policyRowConditionKeys(policy)],
+			renamed: Object.fromEntries(renamedKeys(policy.vocabulary.permissions))
+		},
+		schema,
+		helpersOnly,
+		...extras
+	};
+	const planned = outputFiles({
+		input,
+		outRel,
+		text,
+		helpersOnly,
+		sql: () => ({
+			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
+			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
+			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
+			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
+			seeds: `${SEEDS_MARKER} schema=${schema}\n${seedSql(ctx, compiled.rolePermissions)}\n`,
+			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
+		}),
+		scopes,
+		schema
+	});
+	if (typeof planned === "string") return {
+		code: 2,
+		output: planned,
+		text,
+		...extras
+	};
+	const files = [...planned];
+	if (migrationRel !== void 0) files.push({
+		part: "migration",
+		rel: migrationRel,
+		text: migration
+	});
+	if (input.check) {
+		const drift = driftOf(input.cwd, files);
+		return drift.length === 0 ? {
+			code: 0,
+			output: "rls generate up to date",
+			text,
+			...extras
+		} : {
+			code: 1,
+			output: drift.map((line) => `rls generate drift: ${line}`).join("\n"),
+			text,
+			...extras
+		};
+	}
+	const written = writeSqlFiles(input.cwd, files);
+	const extra = warnings.length === 0 ? "" : `\n${warnings.join("\n")}`;
+	return {
+		code: 0,
+		output: `wrote ${written.wrote.join(", ")}${written.printed === "" ? "" : `\n${written.printed}`}${extra}`,
+		text,
+		...extras
+	};
+}
+/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
+const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
+/**
+* A `realtime.messages` or `storage.objects` policy that applies only where
+* the table exists. The Realtime and Storage services create those tables, so
+* a local stack with the service off, and pg-delta's shadow database, have
+* none.
+*/
+function guardedPolicySql(item) {
+	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
+	return `do $permdock$
+begin
+  if to_regclass(${quoteLiteral(qualifiedTable$1(item.table))}) is not null then
+${body}
+  end if;
+end
+$permdock$;
+`;
+}
+/** Appends the `realtime.messages` and `storage.objects` policies, which never get `tableSql`. */
+function withHelperTables(sql, helperTables) {
+	if (helperTables === void 0) return sql;
+	const tables = `${helperTables.trimEnd()}\n`;
+	return sql.trim() === "" ? tables : `${sql.trimEnd()}\n\n${tables}`;
+}
+function splitsPart(raw, part) {
+	const split = parseSplit(raw);
+	return typeof split !== "string" && split?.includes(part) === true;
+}
+/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants. */
+function outputFiles(plan) {
+	const { input } = plan;
+	const split = parseSplit(input.split);
+	if (typeof split === "string") return split;
+	if (split?.includes("policies") === true && plan.helpersOnly) return "rls generate --helpers-only writes no policies part; drop it from --split";
+	if (split === void 0) {
+		if (input.grantsOut !== void 0) return "rls generate --grants-out needs --split with the helpers or hook part";
+		if (input.seedsOut !== void 0) return "rls generate --seeds-out needs --split with the seeds part";
+		return [{
+			part: "rls",
+			rel: plan.outRel,
+			text: plan.text
+		}];
+	}
+	if (input.target !== "sql") return "rls generate --split needs --target sql";
+	const pgDelta = input.out === void 0 && input.config.rls?.out === void 0 ? supabaseConfig(input.cwd).pgDelta : void 0;
+	if (pgDelta === void 0 && !plan.outRel.includes("{part}")) return `rls generate --split needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
+	if (pgDelta !== void 0 && split.includes("helpers") && !split.includes("seeds")) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
+	if (pgDelta !== void 0 && split.includes("seeds") && input.seedsOut === void 0) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
+	const at = (part, schema = plan.schema) => pgDelta === void 0 ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
+	if (input.grantsOut !== void 0 && !split.includes("hook") && !split.includes("helpers")) return "rls generate --grants-out needs the helpers or hook part in --split";
+	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
+	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
+	const sql = plan.sql();
+	const relocated = pgDelta === void 0 ? void 0 : sql.servicePolicies;
+	if (relocated !== void 0 && split.includes("policies") && !split.includes("seeds")) return "rls generate --split policies under pg-delta with rls.realtime or rls.storage needs the seeds part with --seeds-out: the shadow database has no realtime.messages or storage.objects, so their policies go in that migration";
+	const seeds = relocated === void 0 || !split.includes("policies") ? sql.seeds : `${sql.seeds}\n${relocated}`;
+	const files = [];
+	const label = grantsLabel(input.grantsOut);
+	let grantsMarker = `${GRANTS_MARKER} schema=${plan.schema}`;
+	const grants = [];
+	for (const part of split) switch (part) {
+		case "helpers": {
+			if (label === void 0) {
+				files.push({
+					part,
+					rel: at(part),
+					text: sql.helpers
+				});
+				break;
+			}
+			const moved = moveUndiffed(sql.helpers, label, part);
+			files.push({
+				part,
+				rel: at(part),
+				text: moved.sql
+			});
+			grants.push(moved.grants);
+			break;
+		}
+		case "seeds": {
+			const out = input.seedsOut;
+			if (out !== void 0 && isSeedsDirectory(input.cwd, out)) {
+				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? /* @__PURE__ */ new Date());
+				if (!planned.current || input.check) files.push({
+					part,
+					rel: planned.rel,
+					text: seeds
+				});
+				break;
+			}
+			files.push({
+				part,
+				rel: out ?? at(part),
+				text: seeds
+			});
+			break;
+		}
+		case "indexes":
+			files.push({
+				part,
+				rel: at(part),
+				text: sql.indexes
+			});
+			break;
+		case "policies":
+			files.push({
+				part,
+				rel: at(part),
+				text: pgDelta === void 0 ? sql.policies : sql.declarativePolicies
+			});
+			break;
+		case "hook": {
+			const hook = supabaseHookSql(plan.scopes, input.config, {}, label);
+			files.push({
+				part,
+				rel: at(part, hook.manifest.hook.schema),
+				text: hook.sql
+			});
+			const [marker = grantsMarker, ...rest] = hook.grants.split("\n");
+			grantsMarker = marker;
+			grants.push(rest.join("\n").trimEnd());
+			break;
+		}
+		default: return part;
+	}
+	if (input.grantsOut !== void 0) files.push({
+		part: "grants",
+		rel: input.grantsOut,
+		text: `${[grantsMarker, ...grants].join("\n")}\n`
+	});
+	return files;
+}
+//#endregion
+//#region src/cli/rls-introspect.ts
+const ROLES = ["anon", "authenticated"];
+/** Neon's `anonymous` is the role `rls generate` writes as `anon` for the other dialects. */
+function liveRole(role) {
+	return role === "anonymous" ? "anon" : role;
+}
+const PRIVILEGES = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+/** `posts` and `"app"."posts"` as `public.posts` and `app.posts`. */
+function qualified(table) {
+	const parts = table.split(".").map((part) => part.replaceAll("\"", ""));
+	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
+}
+const FUNCTION_HEADER = /create or replace function ("?)([A-Za-z_][\w$]*)\1\.("?)([A-Za-z_][\w$]*)\3\s*\(([\s\S]*?)\nas \$/gu;
+function helpersOf(sql) {
+	const found = /* @__PURE__ */ new Set();
+	for (const match of sql.matchAll(FUNCTION_HEADER)) {
+		const [header = "", , schema = "", , name = ""] = match;
+		if (/\bsecurity definer\b/u.test(header)) found.add(`${schema}.${name}`);
+	}
+	return [...found];
+}
+function expectedRls(policies, sql, indexes = []) {
+	const tables = [...new Set(policies.map((item) => qualified(item.table)))];
+	const grants = {};
+	for (const table of tables) {
+		const byRole = {};
+		for (const role of ROLES) {
+			const commands = new Set(policies.filter((item) => qualified(item.table) === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
+			byRole[role] = PRIVILEGES.filter((privilege) => commands.has(privilege));
+		}
+		grants[table] = byRole;
+	}
+	return {
+		policies: policies.map((item) => ({
+			table: qualified(item.table),
+			name: item.name,
+			command: item.command,
+			permissive: item.effect === "allow",
+			roles: item.roles.toSorted()
+		})),
+		tables,
+		grants,
+		helpers: helpersOf(sql),
+		indexes: indexes.map((target) => ({
+			...target,
+			table: qualified(target.table)
+		}))
+	};
+}
+/**
+* One warning per index target no index starts with. A missing index slows
+* the policy down but grants nothing, so these do not fail `verify`.
+*/
+function missingIndexes(expected, actual) {
+	return expected.indexes.flatMap((target) => {
+		const column = target.columns[0];
+		const columns = actual.columns?.[target.table];
+		return column === void 0 || columns !== void 0 && !columns.includes(column) || actual.leadingColumns[target.table]?.includes(column) === true ? [] : [`warning: ${target.table}: no index starts with ${column}, which the policies or helpers filter on; add it, or write it with rls generate --split ...,indexes`];
+	});
+}
+function sameList(left, right) {
+	const a = left.toSorted();
+	const b = right.toSorted();
+	return a.length === b.length && a.every((item, index) => item === b[index]);
+}
+/** One line per difference; policy expressions are not compared, since Postgres rewrites their text. */
+function diffRls(expected, actual, options = {}) {
+	const out = [];
+	const found = new Map(actual.policies.map((item) => [`${item.table}\u0000${item.name}`, item]));
+	for (const want of expected.policies) {
+		const have = found.get(`${want.table}\u0000${want.name}`);
+		if (have === void 0) {
+			out.push(`${want.table}: policy ${want.name} is missing`);
+			continue;
+		}
+		if (have.command !== want.command) out.push(`${want.table}: policy ${want.name} is for ${have.command}, expected ${want.command}`);
+		if (have.permissive !== want.permissive) out.push(`${want.table}: policy ${want.name} is ${have.permissive ? "permissive" : "restrictive"}, expected ${want.permissive ? "permissive" : "restrictive"}`);
+		if (!sameList(have.roles, want.roles)) out.push(`${want.table}: policy ${want.name} applies to ${have.roles.join(", ")}, expected ${want.roles.join(", ")}`);
+	}
+	const wanted = new Set(expected.policies.map((item) => `${item.table}\u0000${item.name}`));
+	for (const have of actual.policies) if (expected.tables.includes(have.table) && !wanted.has(`${have.table}\u0000${have.name}`)) out.push(`${have.table}: policy ${have.name} is not generated (${have.permissive ? "permissive" : "restrictive"} ${have.command}); a permissive one widens access`);
+	for (const table of expected.tables) {
+		if (actual.rlsEnabled[table] !== true) {
+			out.push(actual.rlsEnabled[table] === void 0 ? `${table}: table is missing` : `${table}: row level security is disabled`);
+			continue;
+		}
+		for (const role of ROLES) {
+			const want = expected.grants[table]?.[role] ?? [];
+			const have = actual.grants[table]?.[role] ?? [];
+			for (const privilege of want) if (!have.includes(privilege) && !(privilege === "select" && options.columnGrants === true)) out.push(`${table}: ${role} lacks ${privilege}, so the policy answers 42501 instead of filtering`);
+			for (const privilege of have) if (!want.includes(privilege)) out.push(`${table}: ${role} holds ${privilege}, which no generated policy allows`);
+		}
+	}
+	for (const helper of expected.helpers) {
+		const have = actual.helpers[helper];
+		if (have === void 0) {
+			out.push(`${helper}: helper is missing`);
+			continue;
+		}
+		if (!have.securityDefiner) out.push(`${helper}: helper is not security definer`);
+		if (!have.emptySearchPath) out.push(`${helper}: helper does not set search_path = ''`);
+	}
+	return out;
+}
+const POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, cmd, permissive, roles::text[] as roles
+from pg_policies
+where schemaname || '.' || tablename = any($1::text[])`;
+const TABLES_SQL = `select n.nspname || '.' || c.relname as target, c.relrowsecurity as enabled
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where c.relkind in ('r', 'p') and n.nspname || '.' || c.relname = any($1::text[])`;
+const GRANTS_SQL = `select table_schema || '.' || table_name as target, grantee, lower(privilege_type) as privilege
+from information_schema.role_table_grants
+where grantee in ('anon', 'anonymous', 'authenticated')
+  and lower(privilege_type) in ('select', 'insert', 'update', 'delete')
+  and table_schema || '.' || table_name = any($1::text[])`;
+const HELPERS_SQL = `select n.nspname || '.' || p.proname as target, p.prosecdef as definer,
+  coalesce(array_to_string(p.proconfig, ','), '') as config
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+where n.nspname || '.' || p.proname = any($1::text[])`;
+const INDEXES_SQL = `select n.nspname || '.' || c.relname as target, a.attname as leading
+from pg_index i
+join pg_class c on c.oid = i.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+join pg_attribute a on a.attrelid = i.indrelid and a.attnum = i.indkey[0]
+where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
+function commandOf(cmd) {
+	const text = String(cmd ?? "").toLowerCase();
+	return text === "*" ? "all" : text;
+}
+function connectIntrospect(db) {
+	return connectPgPool(db, "permdock rls verify --introspect");
+}
+/** Reads the catalogs for the tables and helpers `expected` names (postgres-meta's queries, trimmed). */
+async function introspectRls(db, expected, connect = connectIntrospect) {
+	const client = await connect(db);
+	try {
+		const tables = [...expected.tables];
+		const indexed = [...new Set(expected.indexes.map((target) => target.table))];
+		const [policies, enabled, grants, helpers, indexes, columns] = await Promise.all([
+			client.query(POLICIES_SQL, [tables]),
+			client.query(TABLES_SQL, [tables]),
+			client.query(GRANTS_SQL, [tables]),
+			client.query(HELPERS_SQL, [[...expected.helpers]]),
+			client.query(INDEXES_SQL, [indexed]),
+			client.query(COLUMNS_SQL, [indexed])
+		]);
+		const columnsOf = {};
+		for (const row of columns.rows) (columnsOf[String(row["target"])] ??= []).push(String(row["name"]));
+		const leadingColumns = {};
+		for (const row of indexes.rows) (leadingColumns[String(row["target"])] ??= []).push(String(row["leading"]));
+		const byTable = {};
+		for (const row of grants.rows) {
+			const table = String(row["target"]);
+			const role = liveRole(String(row["grantee"]));
+			const entry = byTable[table] ??= {};
+			(entry[role] ??= []).push(String(row["privilege"]));
+		}
+		return {
+			policies: policies.rows.map((row) => ({
+				table: String(row["target"]),
+				name: String(row["policyname"]),
+				command: commandOf(row["cmd"]),
+				permissive: String(row["permissive"]).toUpperCase() === "PERMISSIVE",
+				roles: Array.isArray(row["roles"]) ? row["roles"].map((role) => liveRole(String(role))) : []
+			})),
+			rlsEnabled: Object.fromEntries(enabled.rows.map((row) => [String(row["target"]), row["enabled"] === true])),
+			grants: byTable,
+			helpers: Object.fromEntries(helpers.rows.map((row) => [String(row["target"]), {
+				securityDefiner: row["definer"] === true,
+				emptySearchPath: String(row["config"]).split(",").some((item) => item === "search_path=\"\"" || item === "search_path=''")
+			}])),
+			leadingColumns,
+			columns: columnsOf
+		};
+	} finally {
+		await client.end();
+	}
+}
+const SYSTEM_SCHEMAS = [
+	"pg_catalog",
+	"information_schema",
+	"pg_toast",
+	"auth",
+	"storage",
+	"realtime",
+	"extensions",
+	"graphql",
+	"graphql_public",
+	"vault",
+	"pgsodium",
+	"pgsodium_masks",
+	"net",
+	"cron",
+	"supabase_functions",
+	"supabase_migrations"
+];
+function inScope(table) {
+	const schema = table.split(".")[0] ?? "";
+	return HELPER_TABLES.some((item) => item === table) || !(SYSTEM_SCHEMAS.some((item) => item === schema) || schema.startsWith("pg_"));
+}
+function seedLine(row) {
+	return `${row.role} ${row.effect} ${row.grantKey} on ${row.scope}`;
+}
+/** Drift is an error; `info` names RLS tables whose policies call no PermDock helper. */
+function diffMixed(expected, actual) {
+	const drift = [];
+	const want = new Set(expected.seeds.map(seedLine));
+	const have = new Set(actual.seeds.map(seedLine));
+	for (const line of want) if (!have.has(line)) drift.push(`${expected.schema}.role_permissions: missing ${line}`);
+	for (const line of have) if (!want.has(line)) drift.push(`${expected.schema}.role_permissions: unexpected ${line}`);
+	const permissions = new Set(expected.permissions);
+	const conditioned = new Set(expected.rowConditions);
+	const covered = /* @__PURE__ */ new Set();
+	for (const policy of actual.policies) {
+		if (callsHelper(policy.expression)) covered.add(policy.table);
+		const blind = new Set(helperCallKeys(policy.expression, true));
+		for (const key of helperCallKeys(policy.expression)) if (!permissions.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, which the policy does not declare, so it always denies`);
+		else if (conditioned.has(key) && blind.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`);
+	}
+	return {
+		drift,
+		info: actual.rlsTables.filter((table) => !covered.has(table)).map((table) => `${table}: no policy calls a PermDock helper`)
+	};
+}
+const ALL_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname,
+  coalesce(qual, '') || ' ' || coalesce(with_check, '') as expression
+from pg_policies`;
+const RLS_TABLES_SQL = `select n.nspname || '.' || c.relname as target
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where c.relkind in ('r', 'p') and c.relrowsecurity`;
+const quoteIdent = escapeSqlIdent;
+/** Reads `role_permissions`, `pg_policies` and the RLS-enabled tables for {@link diffMixed}. */
+async function introspectMixed(db, schema, connect = connectIntrospect) {
+	const client = await connect(db);
+	try {
+		const [seeds, policies, tables] = await Promise.all([
+			client.query(`select role, permission, grant_key, scope, effect from ${quoteIdent(schema)}.role_permissions`, []),
+			client.query(ALL_POLICIES_SQL, []),
+			client.query(RLS_TABLES_SQL, [])
+		]);
+		return {
+			seeds: seeds.rows.map((row) => ({
+				role: String(row["role"]),
+				permission: String(row["permission"]),
+				grantKey: String(row["grant_key"]),
+				scope: String(row["scope"]),
+				effect: String(row["effect"]) === "deny" ? "deny" : "allow"
+			})),
+			policies: policies.rows.map((row) => ({
+				table: String(row["target"]),
+				name: String(row["policyname"]),
+				expression: String(row["expression"])
+			})).filter((row) => inScope(row.table)),
+			rlsTables: tables.rows.map((row) => String(row["target"])).filter(inScope).toSorted()
+		};
+	} finally {
+		await client.end();
+	}
+}
+//#endregion
+//#region src/cli/rls.ts
+const RLS_HELP = `permdock rls generate | import | verify | migrate
+
+  generate --target drizzle|sql|prisma --dialect supabase|neon|guc
+           [--rbac supabase] [--rbac-schema public] [--authorize database|jwt]
+           [--memberships <table>:tenant,user,role]
+           [--policy-per-role] [--policy-name '{table}_{op}'] [--tenant-type uuid] [--custom-roles]
+           [--capabilities] [--fields views [--revoke-columns]]
+           [--out <path>] [--check] [--skip-closures] [--inline-functions] [--force] [--guc-prefix app]
+           [--split helpers,seeds,policies,hook --out <dir>/056_permdock_{part}.sql]
+           [--grants-out <file>|-] [--seeds-out <file>|-]
+           [--helpers-only] [--shims] [--db $DATABASE_URL]
+  import   --sql schema.sql | --db $DATABASE_URL --out src/permissions.generated.ts
+           [--schema zod|valibot|arktype] [--memberships <table>:tenant,user,role]
+  verify   [--db $DATABASE_URL] [--fixtures rls.fixtures.ts] [--format pgtap|node] [--tree]
+           [--introspect --db $DATABASE_URL, with the generate flags]
+           [--advisors [--db $DATABASE_URL] [--json]]: supabase db advisors, security lints
+  migrate  --sql <dir> [--write] [--json], with the generate flags
+           rewrites the rls.migrate helpers' calls in policies onto the generated helpers
+
+Never emits service_role, except in the execute grant rls.trustedReaders asks for. memberOf compiles through the dialect memberships mapping.
+`;
+function asTarget(value) {
+	if (value === void 0 || value === "sql" || value === "drizzle" || value === "prisma") return value ?? "sql";
+}
+function asDialect(value) {
+	if (value === void 0 || value === "supabase" || value === "neon" || value === "guc") return value ?? "supabase";
+}
+function generateInput(input, target, dialect) {
+	return {
+		cwd: input.cwd,
+		config: input.config,
+		target,
+		dialect,
+		rbac: input.rbac,
+		...input.rbacSchema === void 0 ? {} : { rbacSchema: input.rbacSchema },
+		...input.authorize === void 0 ? {} : { authorize: parseRbacAuthorize(input.authorize) ?? "database" },
+		check: input.check,
+		skipClosures: input.skipClosures,
+		inlineFunctions: input.inlineFunctions,
+		force: input.force,
+		io: input.io,
+		...input.out === void 0 ? {} : { out: input.out },
+		...input.from === void 0 ? {} : { from: input.from },
+		...input.memberships === void 0 ? {} : { memberships: input.memberships },
+		...input.gucPrefix === void 0 ? {} : { gucPrefix: input.gucPrefix },
+		policyPerRole: input.policyPerRole,
+		...input.policyName === void 0 ? {} : { policyName: input.policyName },
+		...input.tenantType === void 0 ? {} : { tenantType: input.tenantType },
+		customRoles: input.customRoles,
+		capabilities: input.capabilities,
+		...input.fields === void 0 ? {} : { fields: input.fields },
+		revokeColumns: input.revokeColumns,
+		...input.split === void 0 ? {} : { split: input.split },
+		...input.grantsOut === void 0 ? {} : { grantsOut: input.grantsOut },
+		...input.seedsOut === void 0 ? {} : { seedsOut: input.seedsOut },
+		helpersOnly: input.helpersOnly,
+		shims: input.shims === true
+	};
+}
+async function migrate(input) {
+	const config = input.config.rls?.migrate;
+	if (config === void 0) return {
+		code: 2,
+		output: "rls migrate needs rls.migrate.helpers in permdock.config.ts"
+	};
+	if (input.sql === void 0) return {
+		code: 2,
+		output: "rls migrate needs --sql <dir>"
+	};
+	const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
+	if (dialect === void 0) return {
+		code: 2,
+		output: "rls migrate --dialect (or rls.dialect) must be supabase, neon or guc"
+	};
+	const generated = await runRlsGenerate({
+		...generateInput(input, "sql", dialect),
+		check: false,
+		write: false
+	});
+	if (generated.code !== 0) return {
+		code: 2,
+		output: generated.output
+	};
+	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
+	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-CN4TlJTO.js");
+	return runRlsMigrate({
+		cwd: input.cwd,
+		sql: input.sql,
+		config,
+		target: migrateTarget(generated),
+		write: input.write,
+		json: input.json
+	});
+}
+/** `verify --introspect` with `--helpers-only`: helpers and seeds exactly, hand-written policies by their keys. */
+async function introspectHelpersOnly(db, expected, generated, connect) {
+	const schema = generated.schema ?? "permdock";
+	try {
+		const actual = await introspectRls(db, expected, connect);
+		const helpers = diffRls(expected, actual);
+		const warnings = missingIndexes(expected, actual);
+		const mixed = diffMixed({
+			schema,
+			seeds: generated.seeds ?? [],
+			permissions: generated.keys?.permissions ?? [],
+			rowConditions: generated.keys?.rowConditions ?? []
+		}, await introspectMixed(db, schema, connect));
+		const drift = [...helpers, ...mixed.drift];
+		const info = mixed.info.map((line) => `info: ${line}`);
+		return drift.length > 0 ? {
+			code: 1,
+			output: [
+				...drift,
+				...warnings,
+				...info
+			].join("\n")
+		} : {
+			code: 0,
+			output: [
+				...warnings,
+				...info,
+				`introspected ${String(expected.helpers.length)} helper(s) and ${String(generated.seeds?.length ?? 0)} seeded row(s), helpers only: no drift`
+			].join("\n")
+		};
+	} catch (cause) {
+		return usageResult(cause);
+	}
+}
+/** `verify --introspect`: the catalogs against what `generate` would write with the same flags. */
+async function introspect(input) {
+	if (input.db === void 0) return {
+		code: 2,
+		output: "PermDock CLI: rls verify --introspect needs --db"
+	};
+	const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
+	if (dialect === void 0) return {
+		code: 2,
+		output: "rls verify --dialect (or rls.dialect) must be supabase, neon or guc"
+	};
+	const generated = await runRlsGenerate({
+		...generateInput(input, "sql", dialect),
+		check: false,
+		write: false
+	});
+	if (generated.code !== 0 || generated.policies === void 0) return {
+		code: 2,
+		output: generated.output
+	};
+	const expected = expectedRls(generated.policies, generated.text, generated.indexes);
+	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect);
+	try {
+		const actual = await introspectRls(input.db, expected, input.connect);
+		const drift = diffRls(expected, actual, { columnGrants: (input.fields ?? input.config.rls?.fields) === "views" });
+		const warnings = missingIndexes(expected, actual);
+		if (drift.length > 0) return {
+			code: 1,
+			output: [...drift, ...warnings].join("\n")
+		};
+		return {
+			code: 0,
+			output: `${warnings.map((line) => `${line}\n`).join("")}introspected ${String(expected.policies.length)} policies on ${String(expected.tables.length)} table(s) and ${String(expected.helpers.length)} helper(s): no drift`
+		};
+	} catch (cause) {
+		return usageResult(cause);
+	}
+}
+async function runRls(input) {
+	const action = input.rest[0];
+	if (action === void 0 || action === "help") return {
+		code: 2,
+		output: RLS_HELP
+	};
+	switch (action) {
+		case "generate": {
+			const target = asTarget(input.target);
+			const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
+			if (target === void 0) return {
+				code: 2,
+				output: "rls generate --target must be drizzle, sql or prisma"
+			};
+			if (dialect === void 0) return {
+				code: 2,
+				output: "rls generate --dialect (or rls.dialect) must be supabase, neon or guc"
+			};
+			return runRlsGenerate({
+				...generateInput(input, target, dialect),
+				...input.db === void 0 ? {} : { db: input.db },
+				...input.connect === void 0 ? {} : { connect: input.connect }
+			});
+		}
+		case "import": {
+			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
+			const { runRlsImport } = await import("./rls-import-BTFVk3jH.js");
+			return runRlsImport({
+				cwd: input.cwd,
+				config: input.config,
+				schema: input.schema ?? "zod",
+				io: input.io,
+				...input.sql === void 0 ? {} : { sql: input.sql },
+				...input.db === void 0 ? {} : { db: input.db },
+				...input.out === void 0 ? {} : { out: input.out },
+				...input.memberships === void 0 ? {} : { memberships: input.memberships },
+				...input.connect === void 0 ? {} : { connect: input.connect }
+			});
+		}
+		case "verify": {
+			if (input.advisors === true) return runRlsAdvisors({
+				cwd: input.cwd,
+				json: input.json,
+				env: input.io.env ?? process.env,
+				...input.db === void 0 ? {} : { db: input.db },
+				...input.exec === void 0 ? {} : { exec: input.exec }
+			});
+			if (input.introspect) return introspect(input);
+			const format = input.format ?? "node";
+			if (format !== "node" && format !== "pgtap") return {
+				code: 2,
+				output: "rls verify --format must be pgtap or node"
+			};
+			return await runRlsVerify({
+				cwd: input.cwd,
+				config: input.config,
+				format,
+				tree: input.tree,
+				io: input.io,
+				...input.fixtures === void 0 ? {} : { fixtures: input.fixtures },
+				...input.db === void 0 ? {} : { db: input.db },
+				...input.from === void 0 ? {} : { from: input.from },
+				...input.connect === void 0 ? {} : { connect: input.connect }
+			});
+		}
+		case "migrate": return migrate(input);
+		default: return {
+			code: 2,
+			output: RLS_HELP
+		};
+	}
+}
+//#endregion
+export { runRls };