permdock 0.1.0 → 0.3.0

package/dist/rls-fields-74oZPXWL.js

@@ -0,0 +1,3582 @@
+import { n as isReadonlyArray, r as sole } from "./compact-y6vfu2_f.js";
+import { T as isForbiddenKey, _ as listPermissions, a as formerKeys } from "./permissions-DVoF6dMt.js";
+import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField } from "./refs-KYb4ntaz.js";
+import { p as policyLevels } from "./policy-xyWg7QdR.js";
+import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { E as listRoles, l as inheritCondition, m as relationCondition } from "./grantee-Cv5Sogfv.js";
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { d as partitionsOf, h as scopeField } from "./validity-uOp8UpYn.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { _ as leveled, p as andWhere } from "./permdock-CbgvLnuo.js";
+import { i as requiresStandIn } from "./delegation-D8pUEuce.js";
+import { t as CliError } from "./errors-CWfoNg9N.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
+import { i as scopeMembershipTable, o as relatedSql, r as scopeColumn } from "./compile-Ba4blROR.js";
+import { t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
+import { l as roleColumn, u as roleManifest } from "./sources-4p0-4xQm.js";
+import { n as requirePeer } from "./peer-BOr_kJE1.js";
+import { A as keptRowSql, B as memberVia, C as grantPermissionSql, D as hasMemberFor, E as graphSqlText, F as memberForHelper, G as quoteIdent, H as permittedForHelper, I as memberForSources, J as restrictedHelper, K as quoteLiteral, M as kindFilterSql, N as linkHelper, O as inheritedRowsHelper, P as liveSessionSql, Q as scopeTypeOf, R as memberIdsHelper, S as globalKindFilterSql, U as permittedIdsHelper, W as qualifiedTable, X as scopeSources, Y as roleKindSql, Z as scopeTable, _ as activeUserSql, a as helperSchema, at as tenantTypeOf, b as columnTypesOf, c as signedIn, d as CLOSURE, et as sqlType, h as activeMembershipSql, i as allowEntry, it as tenantClaimSql, j as keyTenantSql, k as isRecord, l as textArray, m as activeInstancesSql, n as GLOBAL_ROLES, nt as subjectClaimSql, o as qualified$1, ot as userIdHelperSql, q as quoteTable, r as HELPERS, rt as subjectIdSql, s as rootName, t as CUSTOM_ROLES, tt as subjectClaimJsonSql, u as CLAIM, v as arrayColumnsOf, w as graphHelper, x as disabledKeep, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
+import { createHash } from "node:crypto";
+//#region src/cli/rls-api-keys.ts
+const API_KEY_ALLOWS = "permdock_api_key_allows";
+const DEFAULTS = {
+	claim: "api_key",
+	scopes: "scopes",
+	tenant: "tenant",
+	roles: "roles"
+};
+function field(settings, name) {
+	const value = settings[name] ?? DEFAULTS[name];
+	if (typeof value !== "string" || !SQL_IDENT.test(value)) throw new Error(`PermDock CLI: rls.apiKeys.${name} must be a claim field name matching ${SQL_IDENT.source}`);
+	return value;
+}
+function apiKeyFields(setting) {
+	const settings = setting === true ? {} : setting;
+	return {
+		claim: field(settings, "claim"),
+		scopes: field(settings, "scopes"),
+		tenant: field(settings, "tenant"),
+		roles: field(settings, "roles"),
+		serviceRoles: [...new Set(settings.serviceRoles ?? [])]
+	};
+}
+function apiKeysPlan(setting, declared, renamed) {
+	if (setting === void 0) return;
+	const fields = apiKeyFields(setting);
+	const unknown = fields.serviceRoles.filter((role) => !declared.has(role));
+	if (unknown.length > 0) throw new Error(`PermDock CLI: rls.apiKeys.serviceRoles names roles the policy does not declare: ${unknown.join(", ")}`);
+	return {
+		...fields,
+		...Object.keys(renamed).length === 0 ? {} : { renamed }
+	};
+}
+function qualified(ctx, name) {
+	return `${quoteIdent(ctx.schema ?? "permdock")}.${name}`;
+}
+function keyOf(ctx, plan) {
+	return `(select ${subjectClaimJsonSql(ctx, plan.claim)} as k) api_key`;
+}
+function permissionOf(plan, expr) {
+	return plan.renamed === void 0 ? expr : `coalesce(${quoteLiteral(JSON.stringify(plan.renamed))}::jsonb ->> ${expr}, ${expr})`;
+}
+function apiKeyAllowsCall(ctx, grant) {
+	return `${qualified(ctx, API_KEY_ALLOWS)}(${grant})`;
+}
+function apiKeyAllowsSql(ctx, plan, anonExecute) {
+	const fn = qualified(ctx, API_KEY_ALLOWS);
+	const scopes = `k -> ${quoteLiteral(plan.scopes)}`;
+	const grants = anonExecute ? `revoke execute on function ${fn}(text) from public;
+grant execute on function ${fn}(text) to anon, authenticated;` : `revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+	return `-- API keys: the ${plan.claim} claim's ${plan.scopes} list is a ceiling on every allow; denies always apply, and a request without the claim is not limited
+create or replace function ${fn}(p_grant text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select case
+    when k is null or k = 'null'::jsonb then true
+    when exists (
+      select 1 from ${qualified(ctx, "role_permissions")} rp
+      where rp.grant_key = p_grant and rp.effect = 'deny'
+    ) then true
+    when jsonb_typeof(k) is distinct from 'object' or jsonb_typeof(${scopes}) is distinct from 'array' then false
+    else exists (
+      select 1
+      from jsonb_array_elements_text(${scopes}) s(permission)
+      where ${permissionOf(plan, "s.permission")} = split_part(split_part(p_grant, '#', 1), '@', 1)
+    )
+  end
+  from ${keyOf(ctx, plan)}
+$$;
+${grants}`;
+}
+function serviceRolesJson(plan) {
+	return `${quoteLiteral(JSON.stringify(plan.serviceRoles))}::jsonb`;
+}
+function serviceKeyRows(ctx, plan) {
+	const roles = `k -> ${quoteLiteral(plan.roles)}`;
+	return `  from ${keyOf(ctx, plan)}
+  cross join lateral jsonb_array_elements_text(
+    case jsonb_typeof(${roles}) when 'array' then ${roles} else ${serviceRolesJson(plan)} end
+  ) r(role)`;
+}
+function serviceKeyFilters(ctx, plan, root, permission) {
+	const tenant = `k ->> ${quoteLiteral(plan.tenant)}`;
+	return [
+		`jsonb_typeof(k) = 'object'`,
+		`coalesce(${subjectIdSql(ctx)}::text, '') = ''`,
+		`coalesce(${tenant}, '') <> ''`,
+		...activeInstancesSql(ctx, root, (name) => name === root ? tenant : void 0, permission)
+	];
+}
+function serviceKeyIdsSql(ctx, plan, root, type) {
+	const kind = kindFilterSql(ctx, "r.role", { value: "credential" });
+	const set = ctx.grantSet === true;
+	const filters = [
+		...serviceKeyFilters(ctx, plan, root, grantPermissionSql(set ? "rp.grant_key" : "p_grant")),
+		...set ? [] : ["rp.grant_key = p_grant"],
+		`rp.scope = ${quoteLiteral(root)}`,
+		...kind === void 0 ? [] : [kind]
+	];
+	return `  select (k ->> ${quoteLiteral(plan.tenant)})::${type}${set ? ", rp.grant_key" : ""}
+${serviceKeyRows(ctx, plan)}
+  join ${qualified(ctx, "role_permissions")} rp on rp.role = r.role
+  where ${filters.join("\n    and ")}`;
+}
+function serviceKeyMemberSql(ctx, plan, root, type) {
+	return `  select distinct (k ->> ${quoteLiteral(plan.tenant)})::${type}
+${serviceKeyRows(ctx, plan)}
+  where ${serviceKeyFilters(ctx, plan, root).join("\n    and ")}`;
+}
+function ceilingIdsSql(body, allows) {
+	return `  select ids.id
+  from (
+${body}
+  ) ids(id)
+  where ${allows}`;
+}
+function ceilingHasSql(body, allows) {
+	return `  select ${allows} and coalesce((
+${body}
+  ), false)`;
+}
+//#endregion
+//#region src/cli/rls-conditions.ts
+const MAX_CLAIM_DEPTH = 8;
+/**
+* The claim path of a `principal.claim.*` / `principal.claims.*` ref, one
+* segment per JSON key; `undefined` for any other ref.
+*/
+function claimPath(ref) {
+	const prefix = ["principal.claim.", "principal.claims."].find((item) => ref.startsWith(item));
+	if (prefix === void 0) return;
+	const segments = ref.slice(prefix.length).split(".");
+	if (segments.length > MAX_CLAIM_DEPTH) throw new Error(`PermDock CLI: claim path '${ref}' is deeper than ${MAX_CLAIM_DEPTH}`);
+	for (const segment of segments) if (!CLAIM.test(segment) || isForbiddenKey(segment)) throw new Error(`PermDock CLI: unsafe claim name '${segment}'`);
+	return segments;
+}
+function jsonPath(base, keys, last) {
+	let sql = base;
+	for (const [index, key] of keys.entries()) sql += ` ${index === keys.length - 1 ? last : "->"} ${quoteLiteral(key)}`;
+	return sql;
+}
+/**
+* The JSON document a claim path starts from and the keys to walk in it. The
+* `guc` dialect keeps each top-level claim in its own setting as JSON text.
+*/
+function claimRoot(ctx, path) {
+	const [head, ...rest] = path;
+	if (head === void 0) throw new Error("PermDock CLI: empty claim path");
+	switch (ctx.dialect) {
+		case "supabase": return {
+			root: "(select auth.jwt())",
+			keys: path
+		};
+		case "neon": return {
+			root: "(select auth.session())",
+			keys: path
+		};
+		case "guc": return {
+			root: subjectClaimJsonSql(ctx, head),
+			keys: rest
+		};
+		default: return ctx.dialect;
+	}
+}
+/** The claim at `path` as `jsonb`. */
+function claimJsonSql(ctx, path) {
+	const { root, keys } = claimRoot(ctx, path);
+	return keys.length === 0 ? root : `(${jsonPath(root, keys, "->")})`;
+}
+/** The claim at `path` as text: `->>` on the last key, or the plain setting for a one-segment `guc` claim. */
+function claimTextSql(ctx, path) {
+	const [head] = path;
+	if (path.length === 1 && head !== void 0) return subjectClaimSql(ctx, head);
+	const { root, keys } = claimRoot(ctx, path);
+	return `(${jsonPath(root, keys, "->>")})`;
+}
+/** The JSON kind a claim must have to compare with a column of `type`. */
+function jsonKindOf(type) {
+	if (type === "numeric") return "number";
+	return type === "boolean" ? "boolean" : "string";
+}
+/**
+* A claim compared with a column of `type`. Numbers and booleans must be JSON
+* of that kind (anything else is `null`, so the comparison is false, as in
+* memory); other types cast the text form. A one-segment `guc` claim is text
+* and is cast as is.
+*/
+function typedClaimSql(ctx, path, type) {
+	const text = claimTextSql(ctx, path);
+	if (type === void 0 || type === "text") return text;
+	const cast = `${text}::${sqlType(type)}`;
+	const kind = jsonKindOf(type);
+	if (kind === "string" || ctx.dialect === "guc" && path.length === 1) return `(${cast})`;
+	return `(case when jsonb_typeof(${claimJsonSql(ctx, path)}) = '${kind}' then ${cast} end)`;
+}
+/**
+* The elements of an array claim as a Postgres array of the column's type,
+* built once per statement (an uncorrelated `array(select ...)` is an InitPlan).
+* A missing or non-array claim is the empty array; elements of another JSON
+* kind are left out.
+*/
+function claimArraySql(ctx, path, type) {
+	const json = claimJsonSql(ctx, path);
+	return `array(select ${type === void 0 || type === "text" ? `(e #>> '{}')` : `(e #>> '{}')::${sqlType(type)}`} from jsonb_array_elements(case when jsonb_typeof(${json}) = 'array' then ${json} else '[]'::jsonb end) e where jsonb_typeof(e) = '${jsonKindOf(type)}')`;
+}
+function sqlValue(value, ctx, field) {
+	if (value !== null && typeof value === "object" && "ref" in value) return compileRef(value.ref, ctx, field);
+	if (value !== null && typeof value === "object" && "date" in value) return quoteLiteral(value.date);
+	if (isReadonlyArray(value)) return `array[${value.map((item) => sqlValue(item, ctx)).join(", ")}]`;
+	if (value === null) return "null";
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
+	if (typeof value === "string") return quoteLiteral(value);
+	throw new Error("PermDock CLI: non-portable condition value");
+}
+function compileRef(ref, ctx, field) {
+	if (ref === "principal.id") return subjectIdSql(ctx);
+	if (ref === "now") return "now()";
+	const path = claimPath(ref);
+	if (ref === "principal.tenant" || path?.length === 1 && path[0] === ctx.tenantClaim) return tenantClaimSql(ctx);
+	if (path !== void 0) return typedClaimSql(ctx, path, field === void 0 ? void 0 : ctx.columnTypes?.[field]);
+	if (ref === "context" || ref.startsWith("context.")) throw new Error(`PermDock CLI: '${ref}' is request context, which is not in the token; RLS cannot read it (permdock doctor PD027)`);
+	throw new Error(`PermDock CLI: non-portable subject ref '${ref}'`);
+}
+/** `value` with `\`, `%` and `_` escaped for `like ... escape '\'`, as `escapeLike` does in process. */
+function likeLiteralSql(value) {
+	return `replace(replace(replace(${value}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`;
+}
+function compareSql(op, field, value) {
+	const left = quoteIdent(field);
+	switch (op) {
+		case "eq": return `${left} = ${value}`;
+		case "ne": return `${left} <> ${value}`;
+		case "gt": return `${left} > ${value}`;
+		case "gte": return `${left} >= ${value}`;
+		case "lt": return `${left} < ${value}`;
+		case "lte": return `${left} <= ${value}`;
+		case "contains": return `${left}::text like '%' || ${likeLiteralSql(`${value}::text`)} || '%' escape '\\'`;
+		default: return op;
+	}
+}
+function existsSql(table, rowColumn, rowField, roles, ctx, tenantColumn, scope) {
+	const parts = [`m.${quoteIdent(rowColumn)} = ${quoteIdent(rowField)}`, `m.${quoteIdent(table.user)} = ${subjectIdSql(ctx)}`];
+	const role = memberRoleOf(table);
+	if (roles.length > 0) {
+		const roleList = roles.map((name) => name.replaceAll("'", "''")).join(",");
+		const held = role.through === void 0 && !role.lateral ? `m.${quoteIdent(role.column)}` : role.lookup;
+		parts.push(`${held} = any('{${roleList}}')`);
+		const via = memberVia(table);
+		const single = sole(roles);
+		const kind = single === void 0 ? kindFilterSql(ctx, role.lookup, via) : roleKindSql(ctx, single, via);
+		if (kind !== void 0) parts.push(kind);
+	}
+	if (table.expiresAt !== void 0) parts.push(`(m.${quoteIdent(table.expiresAt)} is null or m.${quoteIdent(table.expiresAt)} > now())`);
+	parts.push(...activeMembershipSql(ctx, table.disabledAt === void 0 ? void 0 : `m.${quoteIdent(table.disabledAt)}`));
+	if (tenantColumn !== void 0 && ctx.tenants !== "all") parts.push(`m.${quoteIdent(tenantColumn)} = ${tenantClaimSql(ctx)}`);
+	parts.push(...activeUserSql(ctx));
+	if (scope !== void 0) {
+		const tenantOf = scope === rootScope(ctx.scopes) ? rowColumn : tenantColumn;
+		const keyed = keyTenantSql(ctx, tenantOf === void 0 ? void 0 : `m.${quoteIdent(tenantOf)}`);
+		if (keyed !== void 0) parts.push(keyed);
+		parts.push(...activeInstancesSql(ctx, scope, (name) => {
+			const held = scopeColumn(table, ctx.scopes, name);
+			return held === void 0 ? void 0 : `m.${quoteIdent(held)}`;
+		}));
+	}
+	const expand = roles.length > 0 && role.lateral ? role.join : "";
+	return `exists (select 1 from ${quoteTable(table.table)} m${expand} where ${parts.join(" and ")})`;
+}
+function compileMemberOf(condition, ctx) {
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(ctx.scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) throw new Error(`PermDock CLI: memberOf ${condition.scope} names a scope the policy does not declare`);
+	const mapping = scope === void 0 ? condition.resource === void 0 ? void 0 : ctx.memberships?.resource?.[condition.resource] : scopeMembershipTable(ctx.memberships, ctx.scopes, scope);
+	if (mapping !== void 0) {
+		const named = scope === void 0 ? void 0 : scopeTable(ctx, scope);
+		const rowColumn = scope === void 0 ? mapping.id : named?.column;
+		if (rowColumn === void 0) throw new Error(`PermDock CLI: memberships mapping for ${condition.scope} is missing the row column`);
+		const tenantColumn = scope === void 0 || scope === rootScope(ctx.scopes) ? void 0 : named?.tenantColumn;
+		const primary = existsSql(mapping, rowColumn, condition.field, condition.roles, ctx, tenantColumn, scope);
+		if (condition.scope !== "resource" || condition.parents === void 0) return primary;
+		return `(${[primary, ...condition.parents.flatMap((parent) => {
+			if (typeof parent === "string") return [existsSql(mapping, rowColumn, parent, condition.roles, ctx, tenantColumn)];
+			const hopTable = ctx.memberships?.resource?.[parent.resource];
+			return hopTable?.id === void 0 ? [] : [existsSql(hopTable, hopTable.id, parent.field, condition.roles, ctx)];
+		})].join(" or ")})`;
+	}
+	if (scope !== void 0 && condition.roles.length === 0 && scopeSources(ctx, scope).length > 0) return `${quoteIdent(condition.field)} in (select ${quoteIdent(ctx.schema ?? "permdock")}.${memberIdsHelper(scope)}())`;
+	if (scope !== void 0 && scope === rootScope(ctx.scopes)) {
+		const parts = [
+			ctx.tenants === "all" ? `${quoteIdent(condition.field)} in (select ${quoteIdent(ctx.schema ?? "permdock")}.${memberIdsHelper(scope)}())` : `${quoteIdent(condition.field)} = ${tenantClaimSql(ctx)}`,
+			...ctx.tenants === "all" ? [] : [keyTenantSql(ctx, quoteIdent(condition.field))].filter((part) => part !== void 0),
+			...activeUserSql(ctx),
+			...activeInstancesSql(ctx, scope, () => quoteIdent(condition.field))
+		];
+		return parts.length === 1 ? parts.join("") : `(${parts.join(" and ")})`;
+	}
+	throw new Error(`PermDock CLI: memberOf ${condition.scope} needs a memberships table mapping`);
+}
+function compileConditionSql(condition, ctx) {
+	switch (condition.op) {
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
+		case "contains": {
+			const element = ctx.arrayColumns?.[condition.field];
+			if (element !== void 0) return `${sqlValue(condition.value, {
+				...ctx,
+				columnTypes: {
+					...ctx.columnTypes,
+					[condition.field]: element
+				}
+			}, condition.field)} = any(${quoteIdent(condition.field)})`;
+			return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
+		}
+		case "in":
+		case "notIn": {
+			const keyword = condition.op === "in" ? "in" : "not in";
+			if (!Array.isArray(condition.value) && typeof condition.value === "object" && "ref" in condition.value) {
+				const path = claimPath(condition.value.ref);
+				if (path === void 0) {
+					compileRef(condition.value.ref, ctx);
+					throw new Error(`PermDock CLI: non-portable ${condition.op} against '${condition.value.ref}'`);
+				}
+				const column = quoteIdent(condition.field);
+				const list = claimArraySql(ctx, path, ctx.columnTypes?.[condition.field]);
+				return condition.op === "in" ? `${column} = any (${list})` : `(${column} is not null and not (${column} = any (${list})))`;
+			}
+			const values = condition.value.map((item) => sqlValue(item, ctx));
+			return `${quoteIdent(condition.field)} ${keyword} (${values.join(", ")})`;
+		}
+		case "isNull": return `${quoteIdent(condition.field)} is ${condition.value ? "" : "not "}null`;
+		case "and": return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" and ")})`;
+		case "or":
+			if (condition.conditions.length === 0) return "false";
+			return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" or ")})`;
+		case "not": return `(${compileConditionSql(condition.condition, ctx)}) is not true`;
+		case "memberOf": return compileMemberOf(condition, ctx);
+		case "related": return compileRelatedSql(condition, ctx);
+		case "sqlFunction":
+			if (ctx.inlineFunctions === true) return compileConditionSql(condition.twin, ctx);
+			return `${quoteTable(condition.name)}(${condition.args.map((arg) => isSqlFunctionField(arg) ? quoteIdent(arg.field) : sqlValue(arg, ctx)).join(", ")})`;
+		case "opaque": return condition.sql;
+		case "liveSession": return liveSessionSql(ctx);
+		default: return condition;
+	}
+}
+function andConditions(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	return {
+		op: "and",
+		conditions: [left, right]
+	};
+}
+function valueContextRefs(value) {
+	if (Array.isArray(value)) return value.flatMap(valueContextRefs);
+	if (isRecord(value) && typeof value["ref"] === "string" && (value["ref"] === "context" || value["ref"].startsWith("context."))) return [value["ref"]];
+	return [];
+}
+/**
+* The `context.*` refs a condition reads. The request context is not in the
+* token, so RLS cannot evaluate them.
+*/
+function contextRefs(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn": return valueContextRefs(condition.value);
+		case "and":
+		case "or": return condition.conditions.flatMap((child) => contextRefs(child));
+		case "not": return contextRefs(condition.condition);
+		case "sqlFunction": return [...condition.args.flatMap(valueContextRefs), ...contextRefs(condition.twin)];
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+function sqlFunctionNames(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "sqlFunction": return [condition.name, ...sqlFunctionNames(condition.twin)];
+		case "and":
+		case "or": return condition.conditions.flatMap((child) => sqlFunctionNames(child));
+		case "not": return sqlFunctionNames(condition.condition);
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn":
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+/**
+* A `related` condition as uncorrelated subqueries, so Postgres runs the
+* helper once per statement: the row's field in the closure's descendants of
+* the ids the subject holds the relation on (or those ids alone at depth 0).
+* The helper sits in `array(...)` so it stays an InitPlan; a plain `in` gets
+* pulled into a join that can rescan it per closure row.
+*/
+function compileRelatedSql(condition, ctx) {
+	if (condition.hops !== void 0 && condition.hops.length > 0) return compileHoppedSql(condition, ctx);
+	const type = ctx.columnTypes?.[condition.field];
+	const cast = type === void 0 || type === "text" ? "" : `::${type}`;
+	const column = type === void 0 ? `${quoteIdent(condition.field)}::text` : quoteIdent(condition.field);
+	const helper = condition.permission === void 0 ? `${`${quoteIdent(ctx.schema ?? "permdock")}.${graphHelper(condition.resource)}`}(${quoteLiteral(condition.relation)})` : `${quoteIdent(ctx.schema ?? "permdock")}.${inheritedRowsHelper(condition.resource)}(${quoteLiteral(condition.permission)})`;
+	const cap = ctx.graph?.closures[condition.resource];
+	let inner;
+	if (condition.depth > 0 && cap !== void 0) {
+		const depth = condition.depth < cap ? ` and depth <= ${String(condition.depth)}` : "";
+		inner = `select descendant${cast} from ${`${quoteIdent(ctx.schema ?? "permdock")}.${CLOSURE.table}`} where resource = ${quoteLiteral(condition.resource)}${depth} and ancestor = any (array(select ${helper}))`;
+	} else inner = cast === "" ? `select ${helper}` : `select p.id${cast} from ${helper} as p(id)`;
+	const reach = `${column} in (${inner})`;
+	if (condition.parent === true && condition.restricted !== void 0) return `(${reach} and ${quoteIdent(condition.restricted)} is not true)`;
+	return reach;
+}
+/**
+* A `related` condition that crosses link hops: the reached instances of the
+* last resource, carried back over each link by its security definer helper,
+* so the hop reads a table the subject may not see.
+*/
+function compileHoppedSql(condition, ctx) {
+	const resources = ctx.graph?.resources;
+	if (resources === void 0) throw new Error("PermDock CLI: a related condition with link hops needs the policy resources in the RLS context");
+	const schema = quoteIdent(ctx.schema ?? "permdock");
+	return graphSqlText(relatedSql(condition, {
+		resources,
+		...ctx.graph?.tables === void 0 ? {} : { tables: ctx.graph.tables },
+		closure: `${ctx.schema ?? "permdock"}.${CLOSURE.table}`,
+		closureDepths: ctx.graph?.closures ?? {},
+		qualify: qualifiedTable,
+		holders: (resource, relation) => [{ text: `select ${schema}.${graphHelper(resource)}(${quoteLiteral(relation)})` }],
+		permitted: (resource, permission) => [{ text: `select ${schema}.${inheritedRowsHelper(resource)}(${quoteLiteral(permission)})` }],
+		restrictedRows: (resource) => [{ text: `select ${schema}.${restrictedHelper(resource)}()` }],
+		linked: (resource, link, targets) => [
+			{ text: `select ${schema}.${linkHelper(resource, link)}(array(` },
+			...targets,
+			{ text: "))" }
+		]
+	}), ctx);
+}
+//#endregion
+//#region src/cli/rls-grants.ts
+/**
+* The `role_permissions` grant key of a break-glass grant. It differs from
+* the permission key, so `authorize()` and the table policies never count it;
+* only the break-glass read asks for it.
+*/
+function breakGlassKey(permission) {
+	return `${permission}#break-glass`;
+}
+/**
+* The role and scope holding a break-glass grant. `breakGlass()` sets
+* `to: authenticated`, so inside `role()` the role is on the grant itself.
+*/
+function breakGlassHolder(item) {
+	if (item.access.kind === "role") return {
+		role: item.access.role,
+		scope: item.access.scope
+	};
+	const { role, scope } = item.grant;
+	return role === null || typeof scope !== "string" ? void 0 : {
+		role,
+		scope
+	};
+}
+function granteeItems(to) {
+	return Array.isArray(to) ? to : [to];
+}
+function relationWhere(policy, grant, grantee) {
+	const node = policy.resources.get(grant.permission.resource);
+	const where = relationCondition(grantee, node, scopeList(policy.scopes), {
+		resources: policy.resources,
+		now: { ref: "now" }
+	});
+	if (where === void 0) throw new Error(`PermDock CLI: grant ${grant.permission.key} names relation '${grantee.relation}', which ${grant.permission.resource} does not declare`);
+	return where;
+}
+function inheritWhere(policy, grant, grantee) {
+	const where = inheritCondition(grantee, policy.resources.get(grant.permission.resource), policy.resources);
+	if (where === void 0) throw new Error(`PermDock CLI: grant ${grant.permission.key} inherits ${grantee.permission}, which ${grant.permission.resource} cannot reach`);
+	return where;
+}
+/** Only a deny for `oauth-client` actors compiles: Postgres sees `client_id` and `act`, not other actor kinds. */
+function actorAccess(grant, grantee, others) {
+	if (grant.effect !== "deny" || grantee.actor !== "oauth-client" || others > 0) throw new Error(`PermDock CLI: grant ${grant.permission.key} is limited to an actor grantee; RLS compiles only deny(…, { to: actor('oauth-client') }) on its own, so enforce it in the application`);
+	return {
+		kind: "actor",
+		actor: "oauth-client"
+	};
+}
+function accessOf(grant, roles, anyone) {
+	const [held, ...more] = roles;
+	if (more.length > 0) throw new Error(`PermDock CLI: grant ${grant.permission.key} requires several roles at once (${roles.map((item) => item.role).join(", ")}); RLS compiles one role per grant`);
+	if (held === void 0) return anyone ? { kind: "anyone" } : { kind: "authenticated" };
+	if (typeof held.scope === "object") return {
+		kind: "resource",
+		role: held.role,
+		resource: held.scope.resource
+	};
+	return {
+		kind: "role",
+		role: held.role,
+		scope: held.scope
+	};
+}
+/**
+* Every grant RLS must enforce: role grants and top-level
+* `definePolicy({ grants })` alike (`policy.grants` holds both). A grantee
+* Postgres cannot see (plan, actor, assurance) fails with the permission named.
+*/
+function collectGrants(policy) {
+	return policy.grants.map((grant) => {
+		const items = granteeItems(grant.to);
+		const roles = [];
+		let anyone = true;
+		let where = grant.where;
+		let delegated;
+		for (const item of items) switch (item.kind) {
+			case "role":
+				roles.push(item);
+				break;
+			case "anyone": break;
+			case "authenticated":
+				anyone = false;
+				break;
+			case "relation":
+				anyone = false;
+				where = andConditions(where, relationWhere(policy, grant, item));
+				break;
+			case "inherit":
+				anyone = false;
+				where = andConditions(where, inheritWhere(policy, grant, item));
+				break;
+			case "actor":
+				delegated = actorAccess(grant, item, items.length - 1);
+				break;
+			case "plan":
+			case "assurance": throw new Error(`PermDock CLI: grant ${grant.permission.key} is limited to a ${item.kind} grantee, which RLS cannot compile; enforce it in the application`);
+			default: return item;
+		}
+		const access = delegated ?? accessOf(grant, roles, anyone);
+		const label = access.kind === "role" || access.kind === "resource" ? access.role : access.kind;
+		return where === void 0 ? {
+			grant,
+			label,
+			access
+		} : {
+			grant,
+			label,
+			access,
+			where
+		};
+	});
+}
+/** Declared role names (bindings and `defineRoles` leaves) plus any role a top-level grant names. */
+function roleNames(policy) {
+	const names = new Set(policy.roles.map((item) => item.name));
+	for (const leaf of listRoles(policy.vocabulary.roles)) names.add(leaf.key);
+	for (const item of collectGrants(policy)) if (item.access.kind === "role" || item.access.kind === "resource") names.add(item.access.role);
+	return [...names];
+}
+//#endregion
+//#region src/cli/global-roles.ts
+function qualify(name, schema) {
+	return name.includes(".") ? name : `${schema}.${name}`;
+}
+/** Resolves `source` against `schema`, aliasing the table `alias` and the roles table `<alias>k`. */
+function globalRoleSource(source, schema, alias) {
+	const table = qualify(source.table, schema);
+	const user = source.user ?? "user_id";
+	const role = roleColumn(source.role ?? "role", table, alias, {
+		label: "roles.role",
+		prefix: "PermDock CLI",
+		indent: "    "
+	});
+	return {
+		table,
+		user,
+		from: `${quoteTable(table)} ${alias}${role.join}`,
+		userSql: `${alias}.${quoteIdent(user)}`,
+		roleSql: role.sql,
+		role: roleManifest(role),
+		...role.through === void 0 ? {} : { through: role.through }
+	};
+}
+//#endregion
+//#region src/cli/rls-custom-roles.ts
+/** The readers every helpers file ends with. Names are part of the SQL contract. */
+const READERS = {
+	keys: "permdock_permission_keys",
+	roles: "permdock_role_permissions",
+	trusted: "permdock_trusted_role_permissions"
+};
+/**
+* The custom-role objects: the tables (`database` mode), the ceiling view
+* over the `assignable` declared roles, and `permdock_custom_keys`, which
+* resolves one custom role to the grant keys it holds in a scope. A row in
+* the tables can never reach a key outside the view.
+*/
+function customRolesSql(ctx) {
+	const custom = ctx.customRoles;
+	if (custom === void 0) return "";
+	const rp = qualified$1(ctx, "role_permissions");
+	const ceiling = qualified$1(ctx, CUSTOM_ROLES.ceiling);
+	const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
+	const chunks = [];
+	if (ctx.authorize === "database") {
+		const tenantType = tenantTypeOf(ctx);
+		for (const [name, column, check] of [[
+			CUSTOM_ROLES.permissions,
+			"permission",
+			`,
+  effect text not null default 'allow' check (effect in ('allow', 'deny'))`
+		], [
+			CUSTOM_ROLES.includes,
+			"include_role",
+			""
+		]]) {
+			const table = qualified$1(ctx, name);
+			const leveled = custom.levels === true && name === CUSTOM_ROLES.permissions;
+			const unique = `${column}${name === CUSTOM_ROLES.permissions ? ", effect" : ""}${leveled ? ", coalesce(level, '')" : ""}`;
+			const index = leveled ? `drop index if exists ${qualified$1(ctx, quoteIdent(`${name}_key`))};
+alter table ${table} add column if not exists level text check (level ~ '^[a-z][a-z0-9_]*$');
+create unique index if not exists ${quoteIdent(`${name}_level_key`)}` : `create unique index if not exists ${quoteIdent(`${name}_key`)}`;
+			chunks.push(`create table if not exists ${table} (
+  tenant_id ${tenantType},
+  scope text not null default ${quoteLiteral(rootName(ctx))},
+  scope_id text,
+  role text not null,
+  ${column} text not null${check},
+  check ((scope = 'global') = (tenant_id is null)),
+  check (scope <> 'global' or scope_id is null)
+);
+${index}
+  on ${table} (coalesce(tenant_id::text, ''), scope, coalesce(scope_id, ''), role, ${unique});
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;`);
+		}
+	}
+	chunks.push(`-- the ceiling: keys of assignable declared roles, and the denies of those roles on the same permissions
+create or replace view ${ceiling} with (security_invoker = true) as
+select rp.scope, rp.role, rp.permission, rp.grant_key, rp.effect
+from ${rp} rp
+where rp.role = any(${textArray(custom.assignable)})
+  and exists (
+    select 1 from ${rp} a
+    where a.role = rp.role
+      and a.permission = rp.permission
+      and a.scope = rp.scope
+      and a.effect = 'allow'
+  );
+revoke all on table ${ceiling} from anon, authenticated, public;`);
+	const renames = Object.entries(custom.renamed ?? {}).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	if (custom.levels === true) {
+		chunks.push(leveledKeysSql(ctx, renames));
+		return chunks.join("\n\n");
+	}
+	const rename = renamesSql(renames);
+	chunks.push(`-- one custom role: included ceiling keys and same-scope denies, plus every ceiling key of an allowed permission, minus denied permissions
+create or replace function ${keys}(p_allow text[], p_deny text[], p_include text[], p_scope text)
+returns setof text
+language sql
+stable
+set search_path = ''
+as $$
+  with ${rename.prelude}ceiling as (
+    select c.role, ${rename.permission("c")}, c.grant_key, c.effect
+    from ${ceiling} c${rename.join("c")}
+    where c.scope = p_scope
+  ),
+  included as (
+    select rp.role, ${rename.permission("rp")}, rp.grant_key, rp.scope, rp.effect
+    from ${rp} rp${rename.join("rp")}
+    where rp.role = any(coalesce(p_include, '{}'::text[]))
+  ),
+  kept as (
+    select i.permission, i.grant_key
+    from included i
+    where i.effect = 'allow'
+      and i.scope = p_scope
+      and exists (
+        select 1 from ceiling c
+        where c.role = i.role and c.grant_key = i.grant_key and c.effect = 'allow'
+      )
+  ),
+  wanted as (
+    ${rename.allow}
+    union
+    select i.permission
+    from included i
+    where i.effect = 'allow'
+      and not (i.scope = p_scope and exists (
+        select 1 from ceiling c
+        where c.role = i.role and c.grant_key = i.grant_key and c.effect = 'allow'
+      ))
+  ),
+  allowed as (
+    select w.permission
+    from wanted w
+    where not (${rename.denied("w")})
+      and not exists (select 1 from kept k where k.permission = w.permission)
+  )
+  select k.grant_key from kept k
+  where not (${rename.denied("k")})
+  union
+  select i.grant_key from included i
+  where i.effect = 'deny' and i.scope = p_scope
+  union
+  select c.grant_key from ceiling c
+  where c.permission in (select a.permission from allowed a)
+$$;
+revoke execute on function ${keys}(text[], text[], text[], text) from public, anon, authenticated;`);
+	return chunks.join("\n\n");
+}
+/**
+* `permdock_custom_keys` when resources declare levels. An allow entry is
+* `key` or `key@level`. A level reaches only the ceiling's `<grant key>@<level>`
+* keys, plus the ceiling denies of that permission; a level no ceiling key
+* carries removes the permission, as `resolveCustomRole` drops it with
+* `unknown-level`.
+*/
+function leveledKeysSql(ctx, renames) {
+	const rp = qualified$1(ctx, "role_permissions");
+	const ceiling = qualified$1(ctx, CUSTOM_ROLES.ceiling);
+	const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
+	const renamed = renames.length > 0;
+	const prelude = renamed ? `renamed (former, key) as (values ${renames.map(([former, current]) => `(${quoteLiteral(former)}, ${quoteLiteral(current)})`).join(", ")}),
+  ` : "";
+	const current = (raw, alias) => renamed ? `coalesce(r_${alias}.key, ${raw})` : raw;
+	const join = (raw, alias) => renamed ? ` left join renamed r_${alias} on r_${alias}.former = ${raw}` : "";
+	return `-- one custom role: as above, where an allow entry key@level reaches only the ceiling keys of that level
+create or replace function ${keys}(p_allow text[], p_deny text[], p_include text[], p_scope text)
+returns setof text
+language sql
+stable
+set search_path = ''
+as $$
+  with ${prelude}entries as (
+    select ${current("split_part(e.entry, '@', 1)", "e")} as permission, nullif(split_part(e.entry, '@', 2), '') as level
+    from unnest(coalesce(p_allow, '{}'::text[])) as e(entry)${join("split_part(e.entry, '@', 1)", "e")}
+  ),
+  ceiling as (
+    select c.role, ${current("c.permission", "c")} as permission, c.grant_key, c.effect
+    from ${ceiling} c${join("c.permission", "c")}
+    where c.scope = p_scope
+  ),
+  levels as (
+    select distinct c.permission, split_part(c.grant_key, '@', 2) as level
+    from ceiling c
+    where c.effect = 'allow' and strpos(c.grant_key, '@') > 0
+  ),
+  denied as (
+    select ${current("d.permission", "d")} as permission
+    from unnest(coalesce(p_deny, '{}'::text[])) as d(permission)${join("d.permission", "d")}
+    union
+    select e.permission from entries e
+    where e.level is not null
+      and not exists (select 1 from levels l where l.permission = e.permission and l.level = e.level)
+  ),
+  included as (
+    select rp.role, ${current("rp.permission", "rp")} as permission, rp.grant_key, rp.scope, rp.effect
+    from ${rp} rp${join("rp.permission", "rp")}
+    where rp.role = any(coalesce(p_include, '{}'::text[]))
+  ),
+  kept as (
+    select i.permission, i.grant_key
+    from included i
+    where i.effect = 'allow'
+      and i.scope = p_scope
+      and exists (
+        select 1 from ceiling c
+        where c.role = i.role and c.grant_key = i.grant_key and c.effect = 'allow'
+      )
+  ),
+  wanted as (
+    select e.permission from entries e where e.level is null
+    union
+    select i.permission
+    from included i
+    where i.effect = 'allow'
+      and not (i.scope = p_scope and exists (
+        select 1 from ceiling c
+        where c.role = i.role and c.grant_key = i.grant_key and c.effect = 'allow'
+      ))
+  ),
+  allowed as (
+    select w.permission
+    from wanted w
+    where w.permission not in (select d.permission from denied d)
+      and not exists (select 1 from kept k where k.permission = w.permission)
+  ),
+  allowed_levels as (
+    select e.permission, e.level
+    from entries e
+    where e.level is not null
+      and e.permission not in (select d.permission from denied d)
+      and e.permission not in (select a.permission from allowed a)
+      and not exists (select 1 from kept k where k.permission = e.permission)
+  )
+  select k.grant_key from kept k
+  where k.permission not in (select d.permission from denied d)
+  union
+  select i.grant_key from included i
+  where i.effect = 'deny' and i.scope = p_scope
+  union
+  select c.grant_key from ceiling c
+  where c.permission in (select a.permission from allowed a)
+  union
+  select c.grant_key from ceiling c
+  join allowed_levels a on a.permission = c.permission
+  where c.effect = 'deny' or split_part(c.grant_key, '@', 2) = a.level
+$$;
+revoke execute on function ${keys}(text[], text[], text[], text) from public, anon, authenticated;`;
+}
+function currentKeysSql(array) {
+	return `select coalesce(r.key, e.permission) as permission
+    from unnest(coalesce(${array}, '{}'::text[])) as e(permission)
+    left join renamed r on r.former = e.permission`;
+}
+/**
+* SQL fragments that read a stored former key as its current key inside
+* `permdock_custom_keys`. Without renames they are the plain column and
+* array reads.
+*/
+function renamesSql(renames) {
+	if (renames.length === 0) return {
+		prelude: "",
+		permission: (alias) => `${alias}.permission`,
+		join: () => "",
+		allow: "select unnest(coalesce(p_allow, '{}'::text[])) as permission",
+		denied: (alias) => `${alias}.permission = any(coalesce(p_deny, '{}'::text[]))`
+	};
+	return {
+		prelude: `renamed (former, key) as (values ${renames.map(([former, current]) => `(${quoteLiteral(former)}, ${quoteLiteral(current)})`).join(", ")}),
+  denied as (
+    ${currentKeysSql("p_deny")}
+  ),
+  `,
+		permission: (alias) => `coalesce(r_${alias}.key, ${alias}.permission) as permission`,
+		join: (alias) => ` left join renamed r_${alias} on r_${alias}.former = ${alias}.permission`,
+		allow: currentKeysSql("p_allow"),
+		denied: (alias) => `${alias}.permission in (select d.permission from denied d)`
+	};
+}
+/**
+* The catalog reader `permdock_permission_keys()` and the role reader
+* `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)`, both
+* for `authenticated`. A declared role answers from `role_permissions`, which
+* is the catalog. A custom role (`database` mode) answers from the tenant's
+* own rows through `permdock_custom_keys`, only to a member of the tenant or
+* a holder of a `meta.manageRoles` permission for a platform role. The
+* effect is `deny` for a deny the role carries after the ceiling, as
+* `resolveCustomRole` returns it, never for a deny that merely removes an allow.
+*/
+function roleReadersSql(ctx, permissions, trustedReaders) {
+	const rp = qualified$1(ctx, "role_permissions");
+	const reader = qualified$1(ctx, READERS.roles);
+	const tenantType = tenantTypeOf(ctx);
+	const custom = ctx.customRoles;
+	const root = ctx.scopes[0]?.name;
+	const database = ctx.authorize === "database";
+	const chunks = [];
+	if (permissions !== void 0) {
+		const catalog = qualified$1(ctx, READERS.keys);
+		chunks.push(`-- every declared permission key
+create or replace function ${catalog}()
+returns setof text
+language sql
+stable
+set search_path = ''
+as $$
+  select k.permission from unnest(${textArray(permissions.toSorted())}) k(permission) order by 1
+$$;
+revoke execute on function ${catalog}() from public, anon;
+grant execute on function ${catalog}() to authenticated;
+
+create or replace function ${catalog}(p_scope text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select distinct rp.permission
+  from ${rp} rp
+  where rp.scope = p_scope
+    and rp.effect = 'allow'
+    and rp.permission = any(${textArray(permissions.toSorted())})
+  order by 1
+$$;
+revoke execute on function ${catalog}(text) from public, anon;
+grant execute on function ${catalog}(text) to authenticated;`);
+	}
+	const declared = `  select distinct rp.permission, rp.effect
+  from ${rp} rp
+  where rp.role = p_role and rp.scope = p_scope
+  order by 1, 2`;
+	let body = `begin
+  perform p_tenant, p_scope_id; -- only a custom role reads them
+  return query
+${declared};
+end;`;
+	let trustedBody = body;
+	if (custom !== void 0 && database && root !== void 0) {
+		const tenant = qualified$1(ctx, CUSTOM_ROLES.permissions);
+		const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
+		const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
+		const shape = qualified$1(ctx, CUSTOM_ROLES.shape);
+		const ids = (helper) => `(select x::text from ${qualified$1(ctx, helper)}() x)`;
+		const memberOf = `p_tenant::text in ${ids(memberIdsHelper(root))}
+      or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${ids(memberIdsHelper(scope))}`)}`;
+		const manage = custom.manage ?? [];
+		const platform = manage.length === 0 ? "false" : `exists (
+        select 1 from ${rp} m
+        where m.effect = 'allow'
+          and m.permission = any(${textArray(manage)})
+          and ${qualified$1(ctx, HELPERS.has)}(m.grant_key)
+      )`;
+		const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id and c.role = p_role`;
+		const allowEntryOf = custom.levels === true ? "c.permission || coalesce('@' || c.level, '')" : "c.permission";
+		const checked = (gate) => `begin
+  if p_role = any(${textArray(custom.declared)}) then
+    return query
+${declared};
+    return;
+  end if;
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);${gate}
+  return query
+  select distinct rp.permission, rp.effect
+  from ${keys}(
+    array(select ${allowEntryOf} from ${tenant} c where ${match} and c.effect = 'allow'),
+    array(select c.permission from ${tenant} c where ${match} and c.effect = 'deny'),
+    array(select c.include_role from ${includes} c where ${match}),
+    p_scope
+  ) k(grant_key)
+  join ${rp} rp on rp.grant_key = k.grant_key and rp.scope = p_scope
+  order by 1, 2;
+end;`;
+		body = checked(`
+  if not (${signedIn(ctx)} and (
+    ${platform}
+    or (p_scope <> 'global' and (${memberOf}))
+  )) then
+${raiseSql("    ", "42501", `'permdock: the caller is not a member of ' || coalesce(p_tenant::text, 'the platform')`, "not-member")}
+  end if;`);
+		trustedBody = checked("");
+	}
+	chunks.push(`-- the permission keys a role holds on a scope, with effect allow or deny; a custom role is read for its tenant and, below the first scope, its instance
+create or replace function ${reader}(p_role text, p_scope text, p_tenant ${tenantType} default null, p_scope_id text default null)
+returns table (permission text, effect text)
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+${body}
+$$;
+revoke execute on function ${reader}(text, text, ${tenantType}, text) from public, anon;
+grant execute on function ${reader}(text, text, ${tenantType}, text) to authenticated;`);
+	const trusted = qualified$1(ctx, READERS.trusted);
+	const signature = `text, text, ${tenantType}, text`;
+	const grants = trustedReaders === void 0 || trustedReaders.length === 0 ? "" : `\ngrant execute on function ${trusted}(${signature}) to ${trustedReaders.map(quoteIdent).join(", ")};`;
+	chunks.push(`create or replace function ${trusted}(p_role text, p_scope text, p_tenant ${tenantType} default null, p_scope_id text default null)
+returns table (permission text, effect text)
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+${trustedBody}
+$$;
+revoke execute on function ${trusted}(${signature}) from public, anon, authenticated;${grants}`);
+	return chunks.join("\n\n");
+}
+/** `expr` read as its current key: a former key maps to the key it was renamed to. */
+function currentKeyExpr(renames, expr) {
+	if (renames.length === 0) return expr;
+	return `(case ${expr} ${renames.map(([former, current]) => `when ${quoteLiteral(former)} then ${quoteLiteral(current)}`).join(" ")} else ${expr} end)`;
+}
+/** `case p_scope when '<scope>' then <sql for scope> ... else false end` over the declared scopes. */
+function perScope(ctx, sql) {
+	const arms = ctx.scopes.map((scope) => `when ${quoteLiteral(scope.name)} then ${sql(scope.name)}`).join(" ");
+	return arms === "" ? "false" : `(case p_scope ${arms} else false end)`;
+}
+function raiseSql(indent, errcode, message, hint) {
+	return `${indent}raise exception using
+${indent}  errcode = '${errcode}',
+${indent}  message = ${message},
+${indent}  hint = ${quoteLiteral(hint)};`;
+}
+function hasCustomRoleChecksFor(ctx) {
+	return ctx.authorize === "database" && ctx.customRoles !== void 0 && ctx.scopes.length > 0 && ctx.scopes.every((scope) => hasMemberFor(ctx, scope.name));
+}
+function callerFunctionsSql(ctx, custom, root, levelReach, forUser) {
+	const leveled = custom.levels === true;
+	const tenantType = tenantTypeOf(ctx);
+	const rp = qualified$1(ctx, "role_permissions");
+	const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
+	const perms = qualified$1(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
+	const shape = qualified$1(ctx, CUSTOM_ROLES.shape);
+	const beyond = qualified$1(ctx, forUser ? CUSTOM_ROLES.beyondFor : CUSTOM_ROLES.beyond);
+	const guard = qualified$1(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
+	const user = forUser ? "p_user" : subjectIdSql(ctx);
+	const userParam = forUser ? "p_user uuid, " : "";
+	const userArg = forUser ? "uuid, " : "";
+	const userCall = forUser ? "p_user, " : "";
+	const has = (key) => forUser ? `${qualified$1(ctx, HELPERS.hasFor)}(p_user, ${key})` : `${qualified$1(ctx, HELPERS.has)}(${key})`;
+	const ids = (helper, arg) => `(select x::text from ${qualified$1(ctx, helper)}(${arg}) x)`;
+	const permitted = (scope, key) => forUser ? ids(permittedForHelper(scope), `p_user, ${key}`) : ids(permittedIdsHelper(scope), key);
+	const members = (scope) => forUser ? ids(memberForHelper(scope), "p_user") : ids(memberIdsHelper(scope), "");
+	const heldKey = (key) => `(${has(key)}
+        or (p_scope <> 'global'
+          and (p_tenant::text in ${permitted(root, key)}
+            or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${permitted(scope, key)}`)})))`;
+	const holdsAny = (permissions, held) => permissions.length === 0 ? "false" : `exists (
+    select 1 from ${rp} rp
+    where rp.effect = 'allow'
+      and rp.permission = any(${textArray(permissions)})
+      and ${held("rp.grant_key")}
+  )`;
+	const manageKeys = custom.manage ?? [];
+	const manage = holdsAny(manageKeys, heldKey);
+	const platform = holdsAny(manageKeys, has);
+	const requires = custom.requires === void 0 ? "" : `
+  if not ${holdsAny(custom.requires, heldKey)} then
+${raiseSql("    ", "42501", `'permdock: the caller may not manage roles in ' || coalesce(p_tenant::text, 'the platform')`, "manage-roles")}
+  end if;`;
+	const reachRows = levelReach.map(([grantKey, level]) => `(${quoteLiteral(grantKey)}, ${quoteLiteral(level)})`).join(", ");
+	const levelCheck = leveled && reachRows !== "" ? `
+      or exists (
+        select 1
+        from reach x
+        where x.grant_key = r.grant_key
+          and not exists (
+            select 1 from held h
+            join reach o on o.grant_key = h.grant_key
+            where h.permission = r.permission and o.level = x.level
+          )
+      )` : "";
+	const reachCte = leveled && reachRows !== "" ? `,
+    reach (grant_key, level) as (values ${reachRows})` : "";
+	const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id`;
+	const memberOf = `p_tenant::text in ${members(root)}
+      or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${members(scope)}`)}`;
+	return {
+		beyond: `-- custom-role writes: the permission keys of a definition the caller may not hand out in the tenant, as assignablePermissions computes them
+create or replace function ${beyond}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_allow text[], p_deny text[], p_include text[])
+returns setof text
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+begin
+  if ${manage} then
+    return;
+  end if;
+  return query
+  with resolved as (
+    select distinct rp.permission, k.key as grant_key
+    from ${keys}(p_allow, p_deny, p_include, p_scope) k(key)
+    join ${rp} rp on rp.grant_key = k.key and rp.effect = 'allow'
+  ),
+  held as (
+    select distinct rp.permission, rp.grant_key
+    from ${rp} rp
+    where rp.effect = 'allow'
+      and rp.permission in (select r.permission from resolved r)
+      and ${heldKey("rp.grant_key")}
+  )${reachCte}
+  select distinct r.permission
+  from resolved r
+  where not exists (select 1 from held h where h.permission = r.permission)${levelCheck};
+end;
+$$;
+revoke execute on function ${beyond}(${userArg}${tenantType}, text, text, text[], text[], text[]) from public, anon, authenticated;`,
+		guard: `-- a custom role the caller may change: membership of the tenant or the instance (a platform role, or a caller holding a manageRoles permission through a global role, needs none), and authority over the stored definition
+create or replace function ${guard}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+returns void
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_beyond text;
+begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
+  if not (${signedIn(ctx, user)} and (
+    ${platform}
+    or (p_scope <> 'global' and (${memberOf}))
+  )) then
+${raiseSql("    ", "42501", `'permdock: the caller is not a member of ' || coalesce(p_tenant::text, 'the platform')`, "not-member")}
+  end if;${requires}
+  select array_agg(${allowEntry(ctx)}) filter (where c.effect = 'allow'),
+    array_agg(c.permission) filter (where c.effect = 'deny')
+  into v_allow, v_deny
+  from ${perms} c
+  where ${match} and c.role = p_role;
+  select array_agg(c.include_role) into v_include
+  from ${includes} c
+  where ${match} and c.role = p_role;
+  select string_agg(b, ', ' order by b) into v_beyond
+  from ${beyond}(${userCall}p_tenant, p_scope, p_scope_id, v_allow, v_deny, v_include) b;
+  if v_beyond is not null then
+${raiseSql("    ", "42501", `'permdock: ' || p_role || ' allows ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
+  end if;
+end;
+$$;
+revoke execute on function ${guard}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;`
+	};
+}
+/**
+* The functions an application calls to save, rename and delete a custom
+* role in \`database\` mode, with the rules of \`validateCustomRole\` and
+* \`assignablePermissions\`: entries inside the ceiling of the role's scope,
+* includes naming declared roles, and only permissions and levels the caller
+* may hand out, for the new definition and the stored one alike. A platform
+* custom role (\`p_scope = 'global'\`, no tenant) is written by a caller who
+* holds a \`meta.manageRoles\` permission through a global role. The
+* \`permdock_trusted_*\` variants skip the caller checks and keep the
+* definition checks; no client role may execute them.
+*/
+function customRoleWritesSql(ctx, levelReach) {
+	const custom = ctx.customRoles;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || ctx.authorize !== "database" || root === void 0) return "";
+	const leveled = custom.levels === true;
+	const tenantType = tenantTypeOf(ctx);
+	const rp = qualified$1(ctx, "role_permissions");
+	const ceiling = qualified$1(ctx, CUSTOM_ROLES.ceiling);
+	const perms = qualified$1(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
+	const beyond = qualified$1(ctx, CUSTOM_ROLES.beyond);
+	const guard = qualified$1(ctx, CUSTOM_ROLES.guard);
+	const shape = qualified$1(ctx, CUSTOM_ROLES.shape);
+	const entries = qualified$1(ctx, CUSTOM_ROLES.entries);
+	const renames = Object.entries(custom.renamed ?? {}).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const current = (expr) => currentKeyExpr(renames, expr);
+	const known = textArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
+	const caller = callerFunctionsSql(ctx, custom, root, levelReach, false);
+	const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id`;
+	const scopes = textArray(ctx.scopes.map((scope) => scope.name));
+	const roleName = (param) => `coalesce(${param}, '') = '' or ${param} = any(${textArray(custom.declared)})`;
+	const levelOf = leveled ? ", nullif(split_part(e, '@', 2), '')" : "";
+	const write = `  delete from ${perms} c where ${match} and c.role = p_role;
+  delete from ${includes} c where ${match} and c.role = p_role;
+  insert into ${perms} (tenant_id, scope, scope_id, role, permission, effect${leveled ? ", level" : ""})
+  select distinct p_tenant, p_scope, p_scope_id, p_role, ${current(leveled ? "split_part(e, '@', 1)" : "e")}, 'allow'${levelOf}
+  from unnest(coalesce(p_allow, '{}'::text[])) e
+  union
+  select distinct p_tenant, p_scope, p_scope_id, p_role, ${current("e")}, 'deny'${leveled ? ", null" : ""}
+  from unnest(coalesce(p_deny, '{}'::text[])) e;
+  insert into ${includes} (tenant_id, scope, scope_id, role, include_role)
+  select distinct p_tenant, p_scope, p_scope_id, p_role, e
+  from unnest(coalesce(p_include, '{}'::text[])) e;`;
+	const move = `  if ${roleName("p_to")} then
+${raiseSql("    ", "22023", `'permdock: ' || coalesce(p_to, 'null') || ' is not a custom role name'`, "declared-role")}
+  end if;
+  if exists (select 1 from ${perms} c where ${match} and c.role = p_to)
+    or exists (select 1 from ${includes} c where ${match} and c.role = p_to) then
+${raiseSql("    ", "22023", `'permdock: ' || p_to || ' already has grants'`, "role-exists")}
+  end if;
+  update ${perms} c set role = p_to where ${match} and c.role = p_from;
+  update ${includes} c set role = p_to where ${match} and c.role = p_from;`;
+	const remove = `  delete from ${perms} c where ${match} and c.role = p_role;
+  delete from ${includes} c where ${match} and c.role = p_role;`;
+	const writeArgs = `${tenantType}, text, text, text, text[], text[], text[]`;
+	const renameArgs = `${tenantType}, text, text, text, text`;
+	const removeArgs = `${tenantType}, text, text, text`;
+	const fn = (comment, name, params, args, body, member) => `-- ${comment}
+create or replace function ${qualified$1(ctx, name)}(${params})
+returns void
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+${body}
+$$;
+${member ? `revoke execute on function ${qualified$1(ctx, name)}(${args}) from public, anon;
+grant execute on function ${qualified$1(ctx, name)}(${args}) to authenticated;` : `revoke execute on function ${qualified$1(ctx, name)}(${args}) from public, anon, authenticated;`}`;
+	const writeParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text, p_allow text[], p_deny text[], p_include text[]`;
+	const renameParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_from text, p_to text`;
+	const removeParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text`;
+	return `${caller.beyond}
+
+-- where a custom role may live: a scope of a tenant, or the platform (scope global, no tenant or instance), under an undeclared name
+create or replace function ${shape}(p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+returns void
+language plpgsql
+stable
+set search_path = ''
+as $$
+begin
+  if p_scope = 'global' then
+    if p_tenant is not null or p_scope_id is not null then
+${raiseSql("      ", "22023", `'permdock: a platform custom role has no tenant or instance'`, "unknown-scope")}
+    end if;
+  elsif p_tenant is null or not (p_scope = any(${scopes})) then
+${raiseSql("    ", "22023", `'permdock: custom roles are held at a scope of a tenant or at global, not ' || coalesce(p_scope, 'null')`, "unknown-scope")}
+  end if;
+  if ${roleName("p_role")} then
+${raiseSql("    ", "22023", `'permdock: ' || coalesce(p_role, 'null') || ' is not a custom role name'`, "declared-role")}
+  end if;
+end;
+$$;
+revoke execute on function ${shape}(${tenantType}, text, text, text) from public, anon, authenticated;
+
+${caller.guard}
+${hasCustomRoleChecksFor(ctx) ? `
+-- the same checks for a user the caller names: trusted SQL acting later for a stored user; no client role may execute them
+${callerFunctionsSql(ctx, custom, root, levelReach, true).beyond}
+
+${callerFunctionsSql(ctx, custom, root, levelReach, true).guard}
+` : ""}
+-- the entries of a definition: declared keys and levels inside the ceiling of the scope, and declared includes
+create or replace function ${entries}(p_scope text, p_allow text[], p_deny text[], p_include text[])
+returns void
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_entry text;
+  v_key text;
+begin
+  foreach v_entry in array coalesce(p_allow, '{}'::text[]) loop
+    v_key := ${current(leveled ? "split_part(v_entry, '@', 1)" : "v_entry")};
+    if not (v_key = any(${known})) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared permission'`, "unknown-permission")}
+    end if;
+    if not exists (
+      select 1 from ${ceiling} c
+      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
+    ) then
+${raiseSql("      ", "22023", `'permdock: ' || v_key || ' is outside the ceiling of ' || p_scope`, "outside-ceiling")}
+    end if;${leveled ? `
+    if strpos(v_entry, '@') > 0 and not exists (
+      select 1 from ${ceiling} c
+      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
+        and split_part(c.grant_key, '@', 2) = split_part(v_entry, '@', 2)
+    ) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' names a level the resource does not declare'`, "unknown-level")}
+    end if;` : ""}
+  end loop;
+  foreach v_entry in array coalesce(p_deny, '{}'::text[]) loop
+    if not (v_entry = any(${known})) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared permission'`, "unknown-permission")}
+    end if;
+  end loop;
+  foreach v_entry in array coalesce(p_include, '{}'::text[]) loop
+    if not (v_entry = any(${textArray(custom.declared)})) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared role'`, "unknown-role")}
+    end if;
+  end loop;
+  select string_agg(distinct ${current("rp.permission")}, ', ') into v_key
+  from ${rp} rp
+  where rp.role = any(coalesce(p_include, '{}'::text[]))
+    and rp.effect = 'allow'
+    and not exists (
+      select 1 from ${ceiling} c
+      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = ${current("rp.permission")}
+    );
+  if v_key is not null then
+${raiseSql("    ", "22023", `'permdock: an included role allows ' || v_key || ', outside the ceiling of ' || p_scope`, "outside-ceiling")}
+  end if;
+end;
+$$;
+revoke execute on function ${entries}(text, text[], text[], text[]) from public, anon, authenticated;
+
+${fn("save a custom role: replace its grants and includes after checking each entry against the ceiling and the caller's own permissions", CUSTOM_ROLES.replace, writeParams, writeArgs, `declare
+  v_beyond text;
+begin
+  perform ${guard}(p_tenant, p_scope, p_scope_id, p_role);
+  perform ${entries}(p_scope, p_allow, p_deny, p_include);
+  select string_agg(b, ', ' order by b) into v_beyond
+  from ${beyond}(p_tenant, p_scope, p_scope_id, p_allow, p_deny, p_include) b;
+  if v_beyond is not null then
+${raiseSql("    ", "42501", `'permdock: ' || p_role || ' would allow ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
+  end if;
+${write}
+end;`, true)}
+
+${fn("rename a custom role: move its grants and includes to the new name", CUSTOM_ROLES.rename, renameParams, renameArgs, `begin
+  perform ${guard}(p_tenant, p_scope, p_scope_id, p_from);
+${move}
+end;`, true)}
+
+${fn("delete a custom role: remove its grants and includes", CUSTOM_ROLES.remove, removeParams, removeArgs, `begin
+  perform ${guard}(p_tenant, p_scope, p_scope_id, p_role);
+${remove}
+end;`, true)}
+
+${fn("save a custom role for a trusted caller (a migration, a job, a backend role granted execute): the definition checks without the caller checks", CUSTOM_ROLES.trustedReplace, writeParams, writeArgs, `begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
+  perform ${entries}(p_scope, p_allow, p_deny, p_include);
+${write}
+end;`, false)}
+
+${fn("rename a custom role for a trusted caller", CUSTOM_ROLES.trustedRename, renameParams, renameArgs, `begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_from);
+${move}
+end;`, false)}
+
+${fn("delete a custom role for a trusted caller", CUSTOM_ROLES.trustedRemove, removeParams, removeArgs, `begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
+${remove}
+end;`, false)}`;
+}
+/** `row.column`, for a trigger's `old` or `new`. */
+function rowColumn(row, name) {
+	return `${row}.${quoteIdent(name)}`;
+}
+/** The custom-role rows of the role a trigger's `v_<prefix>_*` variables name. */
+function cascadeMatch(prefix) {
+	return `c.tenant_id is not distinct from v_${prefix}_tenant and c.scope = v_${prefix}_scope and c.scope_id is not distinct from v_${prefix}_id and c.role = v_${prefix}_key`;
+}
+/**
+* The trigger on the application's roles table (`rls.customRoleWrites.roles`):
+* a rename, a move to another tenant, scope or instance, or a delete of a
+* custom role's row carries its grants and includes along. A signed-in
+* caller at trigger depth 1 passes the write functions' checks: authority
+* over the stored definition where it was, and, after a move, membership
+* and authority where it lands and entries inside that scope's ceiling.
+* Other paths (a migration, a job, a nested trigger) move the rows as the
+* function owner.
+*/
+function customRoleCascadeSql(ctx) {
+	const custom = ctx.customRoles;
+	const table = custom?.table;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || table === void 0 || root === void 0) return "";
+	const tenantType = tenantTypeOf(ctx);
+	const perms = qualified$1(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
+	const fn = qualified$1(ctx, CUSTOM_ROLES.cascade);
+	const target = quoteTable(table.table.includes(".") ? table.table : `public.${table.table}`);
+	const tenant = (row) => table.tenant === void 0 ? `null::${tenantType}` : `${rowColumn(row, table.tenant)}::${tenantType}`;
+	const scope = (row) => table.scope === void 0 ? `case when ${tenant(row)} is null then 'global' else ${quoteLiteral(root)} end` : `case when ${tenant(row)} is null then 'global' else ${rowColumn(row, table.scope)}::text end`;
+	const id = (row) => table.id === void 0 ? "null::text" : `${rowColumn(row, table.id)}::text`;
+	const skipped = (row) => table.skip === void 0 ? "false" : `coalesce(${rowColumn(row, table.skip)}, false)`;
+	const guard = qualified$1(ctx, CUSTOM_ROLES.guard);
+	const entries = qualified$1(ctx, CUSTOM_ROLES.entries);
+	const allowEntryOf = custom.levels === true ? "c.permission || coalesce('@' || c.level, '')" : "c.permission";
+	return `-- the application's roles table: renames, moves and deletes of a custom role carry its grants and includes
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+declare
+  v_old_tenant ${tenantType} := ${tenant("old")};
+  v_old_scope text := ${scope("old")};
+  v_old_id text := ${id("old")};
+  v_old_key text := ${rowColumn("old", table.key)}::text;
+  v_new_tenant ${tenantType};
+  v_new_scope text;
+  v_new_id text;
+  v_new_key text;
+  v_checked boolean := ${signedIn(ctx)} and pg_trigger_depth() = 1;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+begin
+  if ${skipped("old")} then
+    return null;
+  end if;
+  if tg_op = 'UPDATE' and not ${skipped("new")} then
+    v_new_tenant := ${tenant("new")};
+    v_new_scope := ${scope("new")};
+    v_new_id := ${id("new")};
+    v_new_key := ${rowColumn("new", table.key)}::text;
+    if v_new_key = v_old_key
+      and v_new_tenant is not distinct from v_old_tenant
+      and v_new_scope = v_old_scope
+      and v_new_id is not distinct from v_old_id then
+      return null;
+    end if;
+  end if;
+  if not exists (select 1 from ${perms} c where ${cascadeMatch("old")})
+    and not exists (select 1 from ${includes} c where ${cascadeMatch("old")}) then
+    return null;
+  end if;
+  if v_checked then
+    perform ${guard}(v_old_tenant, v_old_scope, v_old_id, v_old_key);
+  end if;
+  if v_new_key is null then
+    delete from ${perms} c where ${cascadeMatch("old")};
+    delete from ${includes} c where ${cascadeMatch("old")};
+    return null;
+  end if;
+  if exists (select 1 from ${perms} c where ${cascadeMatch("new")})
+    or exists (select 1 from ${includes} c where ${cascadeMatch("new")}) then
+${raiseSql("    ", "22023", `'permdock: ' || v_new_key || ' already has grants'`, "role-exists")}
+  end if;
+  update ${perms} c set tenant_id = v_new_tenant, scope = v_new_scope, scope_id = v_new_id, role = v_new_key where ${cascadeMatch("old")};
+  update ${includes} c set tenant_id = v_new_tenant, scope = v_new_scope, scope_id = v_new_id, role = v_new_key where ${cascadeMatch("old")};
+  if v_checked then
+    perform ${guard}(v_new_tenant, v_new_scope, v_new_id, v_new_key);
+    select array_agg(${allowEntryOf}) filter (where c.effect = 'allow'),
+      array_agg(c.permission) filter (where c.effect = 'deny')
+    into v_allow, v_deny
+    from ${perms} c
+    where ${cascadeMatch("new")};
+    select array_agg(c.include_role) into v_include
+    from ${includes} c
+    where ${cascadeMatch("new")};
+    perform ${entries}(v_new_scope, v_allow, v_deny, v_include);
+  end if;
+  return null;
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists "permdock_custom_role_cascade" on ${target};
+create trigger "permdock_custom_role_cascade"
+  after update or delete on ${target}
+  for each row execute function ${fn}();
+`;
+}
+//#endregion
+//#region src/cli/rls-global-roles.ts
+function qualifiedName(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+/**
+* `permdock_replace_global_roles(p_user, p_roles)`: sets the global roles of
+* one user in `rls.roles` in one statement pair. It runs as the invoker, so
+* the table's policies and the `rls.assignments` trigger judge every row it
+* deletes or inserts.
+*/
+function globalRolesSql(ctx) {
+	if (ctx.roles === void 0) return "";
+	const source = globalRoleSource(ctx.roles, "public", "t");
+	const table = quoteTable(qualifiedName(ctx.roles.table));
+	const user = quoteIdent(source.user);
+	const fn = qualified$1(ctx, GLOBAL_ROLES.replace);
+	const type = ctx.dialect === "supabase" ? "uuid" : "text";
+	const wanted = `select distinct r from unnest(coalesce(p_roles, '{}'::text[])) r where r is not null`;
+	const through = source.through;
+	let body;
+	if (through === void 0) {
+		const role = typeof ctx.roles.role === "string" ? ctx.roles.role : "role";
+		const column = quoteIdent(role);
+		body = `  delete from ${table} t
+  where t.${user} = p_user
+    and t.${column}::text <> all(coalesce(p_roles, '{}'::text[]));
+  insert into ${table} (${user}, ${column})
+  select p_user, w.r
+  from (${wanted}) w(r)
+  where not exists (
+    select 1 from ${table} t where t.${user} = p_user and t.${column}::text = w.r
+  );`;
+	} else {
+		const keys = quoteTable(through.table);
+		const id = quoteIdent(through.id);
+		const key = quoteIdent(through.key);
+		const ref = quoteIdent(through.ref);
+		body = `  select string_agg(w.r, ', ' order by w.r) into v_unknown
+  from (${wanted}) w(r)
+  where not exists (select 1 from ${keys} k where k.${key}::text = w.r);
+  if v_unknown is not null then
+    raise exception using
+      errcode = '22023',
+      message = 'permdock: ' || v_unknown || ' is not a role',
+      hint = 'unknown-role';
+  end if;
+  delete from ${table} t
+  where t.${user} = p_user
+    and not exists (
+      select 1 from ${keys} k
+      where k.${id} = t.${ref}
+        and k.${key}::text = any(coalesce(p_roles, '{}'::text[]))
+    );
+  insert into ${table} (${user}, ${ref})
+  select p_user, k.${id}
+  from ${keys} k
+  where k.${key}::text in (${wanted})
+    and not exists (
+      select 1 from ${table} t where t.${user} = p_user and t.${ref} = k.${id}
+    );`;
+	}
+	const declare = through === void 0 ? "" : "declare\n  v_unknown text;\n";
+	const args = `${type}, text[]`;
+	return `-- set the global roles of a user: delete the others and insert the missing ones, as the caller, so the table's policies and the assignment trigger still apply
+create or replace function ${fn}(p_user ${type}, p_roles text[])
+returns void
+language plpgsql
+volatile
+set search_path = ''
+as $$
+${declare}begin
+${body}
+end;
+$$;
+revoke execute on function ${fn}(${args}) from public, anon;
+grant execute on function ${fn}(${args}) to authenticated;`;
+}
+//#endregion
+//#region src/cli/rls-helpers.ts
+/** The helper `--capabilities` adds: ids of one resource a link capability claim reaches. Part of the SQL contract. */
+const CAPABILITIES = { ids: "permdock_capability_ids" };
+/**
+* The policy-side call for a grant key. Every form is uncorrelated, so
+* Postgres runs the helper once per statement (an InitPlan, or a hashed
+* SubPlan for `in`), never once per row.
+*/
+function accessSql(ctx, scope, grantKey, column) {
+	const key = quoteLiteral(grantKey);
+	if (scope === "global") return `(select ${qualified$1(ctx, HELPERS.has)}(${key}))`;
+	if (column === void 0) throw new Error(`PermDock CLI: ${scope}-scoped grant needs definePolicy({ scopes.${scope} })`);
+	return `${quoteIdent(column)} in (select ${qualified$1(ctx, permittedIdsHelper(scope))}(${key}))`;
+}
+/**
+* The `anon` branch access for a resource-scoped grant reached through a link
+* capability: the row's `field` holds an id the capability claim names for
+* `resource`, `role` and `permission`. Uncorrelated, so it runs once per
+* statement; the column is compared as text because the claim holds text.
+*/
+function capabilityAccessSql(ctx, field, resource, role, permission) {
+	const args = [
+		resource,
+		role,
+		permission
+	].map(quoteLiteral).join(", ");
+	return `${quoteIdent(field)}::text in (select ${qualified$1(ctx, CAPABILITIES.ids)}(${args}))`;
+}
+function capabilitiesSql(ctx) {
+	if (ctx.capabilities !== true) return "";
+	const fn = qualified$1(ctx, CAPABILITIES.ids);
+	return `-- link capabilities: the capability claim exchangeCapability mints (role anon, short-lived)
+create or replace function ${fn}(p_resource text, p_role text, p_permission text)
+returns setof text
+language sql
+stable
+set search_path = ''
+as $$
+  select c -> 'on' ->> 'id'
+  from (select ${subjectClaimJsonSql(ctx, "capability")} as c) capability
+  where jsonb_typeof(c) = 'object'
+    and c ->> 'v' = '1'
+    and c ->> 'holder' = 'link'
+    and c -> 'on' ->> 'resource' = p_resource
+    and jsonb_typeof(c -> 'roles') = 'array'
+    and c -> 'roles' @> jsonb_build_array(p_role)
+    and (c -> 'permissions' is null or c -> 'permissions' @> jsonb_build_array(p_permission))
+    and jsonb_typeof(c -> 'expiresAt') = 'number'
+    and (c ->> 'expiresAt')::numeric > extract(epoch from now())
+$$;
+revoke execute on function ${fn}(text, text, text) from public;
+grant execute on function ${fn}(text, text, text) to anon, authenticated;`;
+}
+function userIdSql(ctx, anonExecute) {
+	const fn = userIdHelperSql(ctx);
+	return `-- the caller's user id: the sub of request.jwt.claims, or null when it is empty or absent
+create or replace function ${fn}()
+returns uuid
+language sql
+stable
+set search_path = ''
+as $$
+  select nullif(
+    nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub',
+    ''
+  )::uuid
+$$;
+${anonExecute ? `revoke execute on function ${fn}() from public;
+grant execute on function ${fn}() to anon, authenticated;` : `revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;`}`;
+}
+function membershipTable(name) {
+	return quoteTable(name.includes(".") ? name : `public.${name}`);
+}
+function activeTenant(ctx) {
+	return `nullif(${subjectClaimSql(ctx, ctx.tenantClaim)}, '')`;
+}
+function keyTenantLine(ctx, scope, tenant) {
+	const keyed = keyTenantSql(ctx, underRoot(ctx, scope) ? tenant : void 0);
+	return keyed === void 0 ? "" : `\n    and ${keyed}`;
+}
+/** Whether the helper for `scope` narrows to the tenant claim: unless `rls.tenants` is `'all'`, when the first scope is on its chain. */
+function narrowsTo(ctx, scope) {
+	return ctx.tenants !== "all" && underRoot(ctx, scope);
+}
+/** Whether the active tenant narrows memberships of `scope`: the first scope is on its chain. */
+function underRoot(ctx, scope) {
+	const root = ctx.scopes[0]?.name;
+	let current = ctx.scopes.find((item) => item.name === scope);
+	const seen = /* @__PURE__ */ new Set();
+	while (current !== void 0 && !seen.has(current.name)) {
+		if (current.name === root) return true;
+		seen.add(current.name);
+		const parent = current.within;
+		current = parent === void 0 ? void 0 : ctx.scopes.find((item) => item.name === parent);
+	}
+	return false;
+}
+/** `and exists (...)` lines for an active user; empty without `rls.suspension.users`. */
+function userActive(ctx, indent, user) {
+	return activeUserSql(ctx, user).map((part) => `${indent}and ${part}`);
+}
+/** `and exists (...)` lines for every suspendable instance on the chain of `scope`'s membership. */
+function instancesActive(ctx, scope, idOf, indent, permission) {
+	return activeInstancesSql(ctx, scope, idOf, permission).map((part) => `${indent}and ${part}`);
+}
+function roleRows(ctx) {
+	const claim = ctx.roleClaim ?? "user_role";
+	switch (ctx.dialect) {
+		case "guc": return `unnest(string_to_array(nullif(current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true), ''), ',')) r(role)`;
+		case "supabase":
+		case "neon": {
+			const raw = subjectClaimJsonSql(ctx, claim);
+			const value = ctx.dialect === "supabase" ? `coalesce(nullif(${raw}, 'null'::jsonb), (select auth.jwt()) -> 'app_metadata' -> ${quoteLiteral(claim)})` : raw;
+			return `jsonb_array_elements_text(
+      case jsonb_typeof(${value})
+        when 'array' then ${value}
+        when 'string' then jsonb_build_array(${value})
+        else '[]'::jsonb
+      end
+    ) r(role)`;
+		}
+		default: return ctx.dialect;
+	}
+}
+function membershipRows(ctx) {
+	const raw = subjectClaimJsonSql(ctx, "memberships");
+	const value = ctx.dialect === "supabase" ? `coalesce(${raw}, (select auth.jwt()) -> 'app_metadata' -> 'memberships')` : raw;
+	return `jsonb_array_elements(
+      case jsonb_typeof(${value}) when 'array' then ${value} else '[]'::jsonb end
+    ) m
+    cross join lateral jsonb_array_elements_text(
+      case jsonb_typeof(m -> 'roles') when 'array' then m -> 'roles' else '[]'::jsonb end
+    ) r(role)`;
+}
+function andLine(indent, condition) {
+	return condition === void 0 ? "" : `\n${indent}and ${condition}`;
+}
+/** `rls.roles`, or the generated `user_roles (user_id, role)`, aliased `ur`. */
+function globalRoleRows(ctx) {
+	return ctx.roles === void 0 ? {
+		from: `${qualified$1(ctx, "user_roles")} ur`,
+		userSql: "ur.user_id",
+		roleSql: "ur.role::text"
+	} : globalRoleSource(ctx.roles, "public", "ur");
+}
+function customKeysJoin(ctx, scope, allows, denies, includes) {
+	return `  cross join lateral ${qualified$1(ctx, CUSTOM_ROLES.keys)}(
+    ${allows},
+    ${denies},
+    ${includes},
+    ${quoteLiteral(scope)}
+  ) ck(grant_key)`;
+}
+function hasSetBody(ctx) {
+	const rp = qualified$1(ctx, "role_permissions");
+	const active = userActive(ctx, "    ").map((line) => `\n${line}`).join("");
+	const custom = ctx.customRoles;
+	if (ctx.authorize === "database") {
+		const ur = globalRoleRows(ctx);
+		const declared = `  select rp.grant_key
+  from ${ur.from}
+  join ${rp} rp on rp.role = ${ur.roleSql}
+  where ${ur.userSql} = ${subjectIdSql(ctx)}
+    and rp.scope = 'global'${andLine("    ", globalKindFilterSql(ctx, ur.roleSql))}${active}`;
+		if (custom === void 0) return declared;
+		const match = `c.tenant_id is null and c.scope = 'global' and c.scope_id is null and c.role = ${ur.roleSql}`;
+		const rows = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
+		return `${declared}
+  union
+  select ck.grant_key
+  from ${ur.from}
+${customKeysJoin(ctx, "global", rows(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"), rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), rows(CUSTOM_ROLES.includes, "include_role", ""))}
+  where ${ur.userSql} = ${subjectIdSql(ctx)}
+    and not (${ur.roleSql} = any(${textArray(custom.declared)}))${active}`;
+	}
+	const declared = `  select rp.grant_key
+  from ${roleRows(ctx)}
+  join ${rp} rp on rp.role = r.role
+  where ${signedIn(ctx)}
+    and rp.scope = 'global'${andLine("    ", globalKindFilterSql(ctx, "r.role"))}${active}`;
+	if (custom === void 0) return declared;
+	const claim = subjectClaimJsonSql(ctx, GLOBAL_GRANTS_CLAIM);
+	return `${declared}
+  union
+  select ck.grant_key
+  from ${roleRows(ctx)}
+  cross join lateral (select ${claim} -> r.role as g) cg
+${customKeysJoin(ctx, "global", claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
+  where ${signedIn(ctx)}
+    and jsonb_typeof(cg.g) = 'array'
+    and not (r.role = any(${textArray(custom.declared)}))${active}`;
+}
+function hasBody(ctx) {
+	if (ctx.grantSet === true) return hasSetBody(ctx);
+	const rp = qualified$1(ctx, "role_permissions");
+	const active = userActive(ctx, "      ").map((line) => `\n${line}`).join("");
+	const custom = ctx.customRoles;
+	if (ctx.authorize === "database") {
+		const ur = globalRoleRows(ctx);
+		const declared = `  select exists (
+    select 1
+    from ${ur.from}
+    join ${rp} rp on rp.role = ${ur.roleSql}
+    where ${ur.userSql} = ${subjectIdSql(ctx)}
+      and rp.grant_key = p_grant
+      and rp.scope = 'global'${andLine("      ", globalKindFilterSql(ctx, ur.roleSql))}${active}
+  )`;
+		if (custom === void 0) return declared;
+		const match = `c.tenant_id is null and c.scope = 'global' and c.scope_id is null and c.role = ${ur.roleSql}`;
+		const rows = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
+		return `${declared}
+  or exists (
+    select 1
+    from ${ur.from}
+    where ${ur.userSql} = ${subjectIdSql(ctx)}
+      and not (${ur.roleSql} = any(${textArray(custom.declared)}))${active}
+      ${customKeysSql(ctx, "global", rows(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"), rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), rows(CUSTOM_ROLES.includes, "include_role", "")).trimStart()}
+  )`;
+	}
+	const declared = `  select ${signedIn(ctx)} and exists (
+    select 1
+    from ${roleRows(ctx)}
+    join ${rp} rp on rp.role = r.role
+    where rp.grant_key = p_grant
+      and rp.scope = 'global'${andLine("      ", globalKindFilterSql(ctx, "r.role"))}${active}
+  )`;
+	if (custom === void 0) return declared;
+	const claim = subjectClaimJsonSql(ctx, GLOBAL_GRANTS_CLAIM);
+	return `${declared}
+  or (${signedIn(ctx)} and exists (
+    select 1
+    from ${roleRows(ctx)}
+    cross join lateral (select ${claim} -> r.role as g) cg
+    where jsonb_typeof(cg.g) = 'array'
+      and not (r.role = any(${textArray(custom.declared)}))${active}
+      ${customKeysSql(ctx, "global", claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)")).trimStart()}
+  ))`;
+}
+/** The claim `jwt` mode reads platform custom roles from: `customRoleClaim(globalRoles)`. */
+const GLOBAL_GRANTS_CLAIM = "role_grants";
+function memberColumn(name) {
+	return `m.${quoteIdent(name)}`;
+}
+function disabledColumn(table) {
+	return table.disabledAt === void 0 ? void 0 : memberColumn(table.disabledAt);
+}
+function claimKeptLines(ctx, indent, permission) {
+	return disabledKeep(ctx).length === 0 ? [] : [`${indent}and ${keptRowSql("m -> 'keep'", permission)}`];
+}
+/** Entries of a compact custom-role claim (`cg.g`) that match `where`. */
+function claimEntries(where, value) {
+	return `array(select ${value} from jsonb_array_elements_text(cg.g) e where ${where})`;
+}
+/** `p_grant in (select permdock_custom_keys(allows, denies, includes, scope))`. */
+function customKeysSql(ctx, scope, allows, denies, includes) {
+	return `    and p_grant in (select ${qualified$1(ctx, CUSTOM_ROLES.keys)}(
+      ${allows},
+      ${denies},
+      ${includes},
+      ${quoteLiteral(scope)}
+    ))`;
+}
+function tableBody(ctx, scope, type) {
+	const mapped = scopeTable(ctx, scope);
+	if (mapped === void 0) return `  select null::${type} where false -- no ${scope} memberships table configured`;
+	const { table, column, tenantColumn } = mapped;
+	const set = ctx.grantSet === true;
+	const filtersFor = (grant) => {
+		const filters = [`  where ${memberColumn(table.user)} = ${subjectIdSql(ctx)}`];
+		if (table.expiresAt !== void 0) {
+			const expires = memberColumn(table.expiresAt);
+			filters.push(`    and (${expires} is null or ${expires} > now())`);
+		}
+		filters.push(...activeMembershipSql(ctx, disabledColumn(table), grantPermissionSql(grant)).map((part) => `    and ${part}`));
+		if (tenantColumn !== void 0 && ctx.tenants !== "all") filters.push(`    and (${activeTenant(ctx)} is null or ${memberColumn(tenantColumn)}::text = ${activeTenant(ctx)})`);
+		const keyed = keyTenantSql(ctx, tenantColumn === void 0 ? void 0 : memberColumn(tenantColumn));
+		if (keyed !== void 0) filters.push(`    and ${keyed}`);
+		filters.push(...userActive(ctx, "    "), ...instancesActive(ctx, scope, (name) => {
+			const held = scopeColumn(table, ctx.scopes, name);
+			return held === void 0 ? void 0 : memberColumn(held);
+		}, "    ", grantPermissionSql(grant)));
+		return filters;
+	};
+	const filters = filtersFor(set ? "rp.grant_key" : "p_grant");
+	const [owner, ...rest] = filters;
+	const role = memberRoleOf(table, "m", "  ");
+	const kind = kindFilterSql(ctx, role.sql, memberVia(table));
+	const lines = [
+		`  select${role.lateral ? " distinct" : ""} ${memberColumn(column)}::${type}${set ? ", rp.grant_key" : ""}`,
+		`  from ${membershipTable(table.table)} m${role.join}`,
+		`  join ${qualified$1(ctx, "role_permissions")} rp on rp.role = ${role.sql}`,
+		owner ?? "",
+		...set ? [] : ["    and rp.grant_key = p_grant"],
+		`    and rp.scope = ${quoteLiteral(scope)}`,
+		...kind === void 0 ? [] : [`    and ${kind}`],
+		...rest
+	];
+	const custom = ctx.customRoles;
+	if (custom === void 0) return lines.join("\n");
+	const match = [
+		`c.tenant_id::text = ${memberColumn(tenantColumn ?? column)}::text`,
+		`c.scope = ${quoteLiteral(scope)}`,
+		`(c.scope_id is null or c.scope_id = ${memberColumn(column)}::text)`,
+		`c.role = ${role.sql}`
+	].join(" and ");
+	const rows = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
+	const entries = [
+		rows(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"),
+		rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"),
+		rows(CUSTOM_ROLES.includes, "include_role", "")
+	];
+	if (set) return [
+		...lines,
+		"  union",
+		`  select ${memberColumn(column)}::${type}, ck.grant_key`,
+		`  from ${membershipTable(table.table)} m${role.join}`,
+		customKeysJoin(ctx, scope, ...entries),
+		...filtersFor("ck.grant_key"),
+		`    and not (${role.sql} = any(${textArray(custom.declared)}))`
+	].join("\n");
+	return [
+		...lines,
+		"  union",
+		`  select ${memberColumn(column)}::${type}`,
+		`  from ${membershipTable(table.table)} m${role.join}`,
+		...filters,
+		`    and not (${role.sql} = any(${textArray(custom.declared)}))`,
+		customKeysSql(ctx, scope, ...entries)
+	].join("\n");
+}
+/** The membership's instance of the first scope, from the canonical claim. */
+function claimTenant(ctx, scope) {
+	const root = rootName(ctx);
+	return scope === root ? `m ->> 'id'` : `m -> 'within' ->> ${quoteLiteral(root)}`;
+}
+function claimBody(ctx, scope, type) {
+	const set = ctx.grantSet === true;
+	const narrow = narrowsTo(ctx, scope) ? `
+    and (${activeTenant(ctx)} is null or ${claimTenant(ctx, scope)} = ${activeTenant(ctx)})` : "";
+	const filtersFor = (grant) => `    and m ->> 'scope' = ${quoteLiteral(scope)}
+    and m ->> 'id' is not null${narrow}${keyTenantLine(ctx, scope, claimTenant(ctx, scope))}
+    and case jsonb_typeof(m -> 'expiresAt')
+      when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+      else true
+    end${[
+		...claimKeptLines(ctx, "    ", grantPermissionSql(grant)),
+		...userActive(ctx, "    "),
+		...instancesActive(ctx, scope, (name) => name === scope ? `m ->> 'id'` : `m -> 'within' ->> ${quoteLiteral(name)}`, "    ", grantPermissionSql(grant))
+	].map((line) => `\n${line}`).join("")}`;
+	const filters = filtersFor(set ? "rp.grant_key" : "p_grant");
+	const declared = `  select (m ->> 'id')::${type}${set ? ", rp.grant_key" : ""}
+  from ${membershipRows(ctx)}
+  join ${qualified$1(ctx, "role_permissions")} rp on rp.role = r.role
+  where ${signedIn(ctx)}${set ? "" : "\n    and rp.grant_key = p_grant"}
+    and rp.scope = ${quoteLiteral(scope)}${andLine("    ", kindFilterSql(ctx, "r.role", "m ->> 'via'"))}
+${filters}`;
+	const custom = ctx.customRoles;
+	if (custom === void 0) return declared;
+	if (set) return `${declared}
+  union
+  select (m ->> 'id')::${type}, ck.grant_key
+  from ${membershipRows(ctx)}
+  cross join lateral (select m -> 'grants' -> r.role as g) cg
+${customKeysJoin(ctx, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
+  where ${signedIn(ctx)}
+    and jsonb_typeof(cg.g) = 'array'
+    and not (r.role = any(${textArray(custom.declared)}))
+${filtersFor("ck.grant_key")}`;
+	return `${declared}
+  union
+  select (m ->> 'id')::${type}
+  from ${membershipRows(ctx)}
+  cross join lateral (select m -> 'grants' -> r.role as g) cg
+  where ${signedIn(ctx)}
+    and jsonb_typeof(cg.g) = 'array'
+    and not (r.role = any(${textArray(custom.declared)}))
+${filters}
+${customKeysSql(ctx, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}`;
+}
+/**
+* The rows the membership sources select for the subject, one per instance
+* (`scope`, `id`, `within`, `roles`, `via`), with each source's own expiry
+* and suspension filters: the statements the token hook runs.
+*/
+function sourcesKeep(sources) {
+	return sources.some((source) => source.sql.keeps);
+}
+function sourceRows(sources) {
+	const keep = sourcesKeep(sources);
+	return sources.map((source, index) => source.sql.select(sourceUser(index), keep).replaceAll(/^/gmu, "    ")).join("\n    union all\n");
+}
+function sourceUser(index) {
+	return `v_user_${String(index)}`;
+}
+function sqlBody(sql) {
+	return {
+		sql,
+		vars: []
+	};
+}
+function sourcesBodyOf(sql, sources, user) {
+	return {
+		sql,
+		vars: sources.map((source, index) => `${sourceUser(index)} ${source.sql.userType} := ${user};`)
+	};
+}
+/** `language sql`, or `plpgsql` returning the query when the body declares variables. */
+function functionBody(body) {
+	if (body.vars.length === 0) return `language sql
+stable
+security definer
+set search_path = ''
+as $$
+${body.sql}
+$$;`;
+	return `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${body.vars.map((line) => `  ${line}`).join("\n")}
+begin
+  return query
+${body.sql};
+end;
+$$;`;
+}
+/**
+* `ms.id` for the scope itself and `ms.within ->> name` for an ancestor. The
+* alias is not `s`, which `activeRowSql` binds inside its `exists`.
+*/
+function sourceIdOf(scope) {
+	return (name) => name === scope ? "ms.id" : `ms.within ->> ${quoteLiteral(name)}`;
+}
+function sourceFilters(ctx, scope, user = subjectIdSql(ctx), permission, keeps = false) {
+	return [
+		...keeps ? [`    and ${keptRowSql("ms.keep", permission)}`] : [],
+		...userActive(ctx, "    ", user),
+		...instancesActive(ctx, scope, sourceIdOf(scope), "    ", permission)
+	].map((line) => `\n${line}`).join("");
+}
+function sourcesBody(ctx, scope, type) {
+	const root = rootName(ctx);
+	const tenant = sourceIdOf(scope)(root);
+	const narrow = narrowsTo(ctx, scope) ? `\n    and (${activeTenant(ctx)} is null or ${tenant} = ${activeTenant(ctx)})${keyTenantLine(ctx, scope, tenant)}` : keyTenantLine(ctx, scope, tenant);
+	const sources = scopeSources(ctx, scope);
+	const set = ctx.grantSet === true;
+	const rows = `  from (
+${sourceRows(sources)}
+  ) ms
+  cross join lateral jsonb_array_elements_text(
+    case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
+  ) r(role)`;
+	const declared = `  select (ms.id)::${type}${set ? ", rp.grant_key" : ""}
+${rows}
+  join ${qualified$1(ctx, "role_permissions")} rp on rp.role = r.role
+  where ${signedIn(ctx)}
+    and ms.scope = ${quoteLiteral(scope)}${set ? "" : "\n    and rp.grant_key = p_grant"}
+    and rp.scope = ${quoteLiteral(scope)}${andLine("    ", kindFilterSql(ctx, "r.role", "ms.via"))}${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql(set ? "rp.grant_key" : "p_grant"), sourcesKeep(sources))}`;
+	const custom = ctx.customRoles;
+	if (custom === void 0) return sourcesBodyOf(declared, sources, subjectIdSql(ctx));
+	const match = [
+		`c.tenant_id::text = (${tenant})::text`,
+		`c.scope = ${quoteLiteral(scope)}`,
+		"(c.scope_id is null or c.scope_id = (ms.id)::text)",
+		"c.role = r.role"
+	].join(" and ");
+	const entries = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
+	if (set) return sourcesBodyOf(`${declared}
+  union
+  select (ms.id)::${type}, ck.grant_key
+${rows}
+${customKeysJoin(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}
+  where ${signedIn(ctx)}
+    and ms.scope = ${quoteLiteral(scope)}
+    and not (r.role = any(${textArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("ck.grant_key"), sourcesKeep(sources))}`, sources, subjectIdSql(ctx));
+	return sourcesBodyOf(`${declared}
+  union
+  select (ms.id)::${type}
+${rows}
+  where ${signedIn(ctx)}
+    and ms.scope = ${quoteLiteral(scope)}
+    and not (r.role = any(${textArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("p_grant"), sourcesKeep(sources))}
+${customKeysSql(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}`, sources, subjectIdSql(ctx));
+}
+function scopedBody(ctx, scope, type) {
+	if (ctx.authorize !== "database") return sqlBody(claimBody(ctx, scope, type));
+	return scopeSources(ctx, scope).length > 0 ? sourcesBody(ctx, scope, type) : sqlBody(tableBody(ctx, scope, type));
+}
+/**
+* The body of `member_<scope>_ids()`: instances of `scope` the subject holds
+* a live membership of, with any role. Not narrowed to the active tenant, and
+* no cascade: a membership of a child scope is not one of its parent.
+*/
+function memberBody(ctx, scope, type) {
+	if (ctx.authorize !== "database") return sqlBody(`  select distinct (m ->> 'id')::${type}
+  from jsonb_array_elements(
+    case jsonb_typeof(${membershipClaim(ctx)}) when 'array' then ${membershipClaim(ctx)} else '[]'::jsonb end
+  ) m
+  where ${signedIn(ctx)}
+    and m ->> 'scope' = ${quoteLiteral(scope)}
+    and m ->> 'id' is not null${keyTenantLine(ctx, scope, claimTenant(ctx, scope))}
+    and jsonb_typeof(m -> 'roles') = 'array'
+    and jsonb_array_length(m -> 'roles') > 0
+    and case jsonb_typeof(m -> 'expiresAt')
+      when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+      else true
+    end${[
+		...claimKeptLines(ctx, "    "),
+		...userActive(ctx, "    "),
+		...instancesActive(ctx, scope, (name) => name === scope ? `m ->> 'id'` : `m -> 'within' ->> ${quoteLiteral(name)}`, "    ")
+	].map((line) => `\n${line}`).join("")}`);
+	return memberRowsBody(ctx, scope, type, subjectIdSql(ctx), scopeSources(ctx, scope), true);
+}
+/**
+* The membership rows of `user` for `scope`, from the sources or else the
+* mapped table, with the same expiry and suspension filters either way.
+*/
+function memberRowsBody(ctx, scope, type, user, sources, keyed = false) {
+	if (sources.length > 0) {
+		const narrow = keyed ? keyTenantLine(ctx, scope, sourceIdOf(scope)(rootName(ctx))) : "";
+		return sourcesBodyOf(`  select distinct (ms.id)::${type}
+  from (
+${sourceRows(sources)}
+  ) ms
+  where ${signedIn(ctx, user)}
+    and ms.scope = ${quoteLiteral(scope)}
+    and jsonb_typeof(ms.roles) = 'array'
+    and jsonb_array_length(ms.roles) > 0${narrow}${sourceFilters(ctx, scope, user, void 0, sourcesKeep(sources))}`, sources, user);
+	}
+	const mapped = scopeTable(ctx, scope);
+	if (mapped === void 0) return sqlBody(`  select null::${type} where false -- no ${scope} memberships table configured`);
+	const { table, column, tenantColumn } = mapped;
+	const role = memberRoleOf(table, "m", "  ");
+	const lines = [
+		`  select distinct ${memberColumn(column)}::${type}`,
+		`  from ${membershipTable(table.table)} m${role.join}`,
+		`  where ${memberColumn(table.user)} = ${user}`,
+		`    and ${role.through === void 0 && !role.lateral ? memberColumn(role.column) : role.sql} is not null`
+	];
+	const narrow = keyed ? keyTenantSql(ctx, tenantColumn === void 0 ? void 0 : memberColumn(tenantColumn)) : void 0;
+	if (narrow !== void 0) lines.push(`    and ${narrow}`);
+	if (table.expiresAt !== void 0) {
+		const expires = memberColumn(table.expiresAt);
+		lines.push(`    and (${expires} is null or ${expires} > now())`);
+	}
+	lines.push(...activeMembershipSql(ctx, disabledColumn(table), void 0).map((part) => `    and ${part}`), ...userActive(ctx, "    ", user), ...instancesActive(ctx, scope, (name) => {
+		const held = scopeColumn(table, ctx.scopes, name);
+		return held === void 0 ? void 0 : memberColumn(held);
+	}, "    "));
+	return sqlBody(lines.join("\n"));
+}
+function membershipClaim(ctx) {
+	const raw = subjectClaimJsonSql(ctx, "memberships");
+	return ctx.dialect === "supabase" ? `coalesce(${raw}, (select auth.jwt()) -> 'app_metadata' -> 'memberships')` : raw;
+}
+function memberFunction(ctx, scope, type, anonExecute) {
+	const fn = qualified$1(ctx, memberIdsHelper(scope));
+	const body = memberBody(ctx, scope, type);
+	const keys = ctx.apiKeys;
+	const keyed = keys === void 0 || scope !== rootName(ctx) ? body : {
+		sql: `${body.sql}\n  union\n${serviceKeyMemberSql(ctx, keys, scope, type)}`,
+		vars: body.vars
+	};
+	const grants = anonExecute ? `revoke execute on function ${fn}() from public;
+grant execute on function ${fn}() to anon, authenticated;` : `revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;`;
+	return `create or replace function ${fn}()
+returns setof ${type}
+${functionBody(keyed)}
+${grants}`;
+}
+/**
+* `member_<scope>_ids_for(p_user uuid)`: `member_<scope>_ids()` for a user the
+* caller names, read from the membership sources (or the mapped table) in
+* either mode, so a token hook can call it before any claim exists. Naming
+* the user is why no client role may execute it; the hook's grants give
+* `supabase_auth_admin` execute.
+*/
+function memberForFunction(ctx, scope, type) {
+	const fn = qualified$1(ctx, memberForHelper(scope));
+	return `create or replace function ${fn}(p_user uuid)
+returns setof ${type}
+${functionBody(memberRowsBody(ctx, scope, type, "p_user", memberForSources(ctx, scope)))}
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+function helperFunction(ctx, name, returns, body, anonExecute) {
+	const fn = qualified$1(ctx, name);
+	const grants = anonExecute ? `revoke execute on function ${fn}(text) from public;
+grant execute on function ${fn}(text) to anon, authenticated;` : `revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+	return `create or replace function ${fn}(p_grant text)
+returns ${returns}
+${functionBody(body)}
+${grants}`;
+}
+/**
+* `permdock_has_for(p_user, p_grant)` and one
+* `permitted_<scope>_ids_for(p_user, p_grant)` per scope in `database` mode:
+* the bodies of `permdock_has` and `permitted_<scope>_ids` with `p_user` for
+* the signed-in user and no tenant-claim narrowing, since a named user has
+* no token. For trusted SQL that acts for a stored user (jobs, triggers,
+* approvals resolved later). Naming the user is why no client role may
+* execute them: `security definer` callers run them as their owner, and a
+* backend role needs its own grant.
+*/
+function forUserSql(ctx) {
+	if (ctx.authorize !== "database") return "";
+	const forUser = forUserContext(ctx);
+	const type = ctx.dialect === "supabase" ? "uuid" : "text";
+	const fn = (name, returns, body) => {
+		const qualifiedName = qualified$1(ctx, name);
+		return `create or replace function ${qualifiedName}(p_user ${type}, p_grant text)
+returns ${returns}
+${functionBody(body)}
+revoke execute on function ${qualifiedName}(${type}, text) from public, anon, authenticated;`;
+	};
+	return [`-- the helpers for a user the caller names: trusted SQL acting for a stored user; no client role may execute them
+${fn(HELPERS.hasFor, "boolean", sqlBody(hasBody(forUser)))}`, ...ctx.scopes.map((scope) => {
+		const scopeType = scopeTypeOf(ctx, scope.name);
+		return fn(permittedForHelper(scope.name), `setof ${scopeType}`, scopedBody(forUser, scope.name, scopeType));
+	})].join("\n\n");
+}
+function userIdType(ctx) {
+	return ctx.dialect === "supabase" ? "uuid not null references auth.users on delete cascade" : "text not null";
+}
+/**
+* The `role_permissions` rows the policy compiles to: an upsert and a delete
+* of every other row. Data, not schema, so `supabase db diff` drops it from a
+* declarative schema; `--split ...,seeds` writes it as its own migration.
+*/
+function seedSql(ctx, rows) {
+	const table = qualified$1(ctx, "role_permissions");
+	if (rows.length === 0) return `delete from ${table};`;
+	return `insert into ${table} (role, permission, grant_key, scope, effect) values
+${rows.map((row) => `  (${[
+		row.role,
+		row.permission,
+		row.grantKey,
+		row.scope,
+		row.effect
+	].map(quoteLiteral).join(", ")})`).join(",\n")}
+on conflict (role, grant_key, scope) do update
+  set permission = excluded.permission, effect = excluded.effect;
+delete from ${table}
+where (role, grant_key, scope) not in (values
+${rows.map((row) => `  (${[
+		row.role,
+		row.grantKey,
+		row.scope
+	].map(quoteLiteral).join(", ")})`).join(",\n")}
+);`;
+}
+/**
+* `role_permissions`, its seeds, and the three `security definer` helpers
+* with `search_path = ''`. `execute` goes to `authenticated` only.
+*/
+function helpersSql(ctx, rows, options) {
+	const schema = helperSchema(ctx);
+	const s = quoteIdent(schema);
+	const rp = qualified$1(ctx, "role_permissions");
+	const chunks = [`-- permdock helpers (${ctx.authorize === "database" ? "database: reads the membership and user_roles tables" : "jwt: reads the role and memberships claims"})
+-- policies call them uncorrelated, so Postgres evaluates each once per statement`];
+	if (schema !== "public") chunks.push(`create schema if not exists ${s};\nrevoke all on schema ${s} from public;\ngrant usage on schema ${s} to ${options.anonExecute === true ? "anon, authenticated" : "authenticated"};`);
+	if (ctx.dialect === "supabase") chunks.push(userIdSql(ctx, options.anonExecute === true));
+	chunks.push(`create table if not exists ${rp} (
+  role text not null,
+  permission text not null,
+  grant_key text not null,
+  scope text not null check (scope ~ '^[a-z][a-z0-9_]*$'),
+  effect text not null default 'allow' check (effect in ('allow', 'deny')),
+  primary key (role, grant_key, scope)
+);
+alter table ${rp} enable row level security;
+revoke all on table ${rp} from anon, authenticated, public;`);
+	if (options.withoutSeeds !== true) chunks.push(seedSql(ctx, rows));
+	if (ctx.authorize === "database" && options.userRoles && ctx.roles === void 0) {
+		const ur = qualified$1(ctx, "user_roles");
+		chunks.push(`create table if not exists ${ur} (
+  user_id ${userIdType(ctx)},
+  role text not null,
+  primary key (user_id, role)
+);
+alter table ${ur} enable row level security;
+revoke all on table ${ur} from anon, authenticated, public;`);
+	}
+	const custom = customRolesSql(ctx);
+	if (custom !== "") chunks.push(custom);
+	const anon = options.anonExecute === true;
+	const keys = ctx.apiKeys;
+	if (keys !== void 0) chunks.push(apiKeyAllowsSql(ctx, keys, anon));
+	const bodies = grantBodies(ctx);
+	chunks.push(helperFunction(ctx, HELPERS.has, "boolean", bodies.has, anon));
+	const capabilities = capabilitiesSql(ctx);
+	if (capabilities !== "") chunks.push(capabilities);
+	for (const scope of ctx.scopes) {
+		const type = scopeTypeOf(ctx, scope.name);
+		chunks.push(helperFunction(ctx, permittedIdsHelper(scope.name), `setof ${type}`, bodies.ids(scope.name), anon));
+		chunks.push(memberFunction(ctx, scope.name, type, anon));
+		if (hasMemberFor(ctx, scope.name)) chunks.push(memberForFunction(ctx, scope.name, type));
+	}
+	const forUser = forUserSql(ctx);
+	if (forUser !== "") chunks.push(forUser);
+	const writes = customRoleWritesSql(ctx, options.levelReach ?? []);
+	if (writes !== "") {
+		chunks.push(writes);
+		const cascade = customRoleCascadeSql(ctx);
+		if (cascade !== "") chunks.push(cascade);
+	}
+	const globalRoles = globalRolesSql(ctx);
+	if (globalRoles !== "") chunks.push(globalRoles);
+	const readers = roleReadersSql(ctx, options.permissions, options.trustedReaders);
+	if (readers !== "") chunks.push(readers);
+	return `${chunks.join("\n\n")}\n`;
+}
+function grantBodies(ctx) {
+	const keys = ctx.apiKeys;
+	const set = ctx.grantSet === true;
+	const allows = apiKeyAllowsCall(ctx, set ? "ids.grant_key" : "p_grant");
+	const keyTenant = keyTenantSql(ctx, void 0) ?? "true";
+	return {
+		has: sqlBody(keys === void 0 ? hasBody(ctx) : set ? `  select g.grant_key
+  from (
+${hasBody(ctx)}
+  ) g(grant_key)
+  where ${apiKeyAllowsCall(ctx, "g.grant_key")} and ${keyTenant}` : ceilingHasSql(hasBody(ctx), `${allows} and ${keyTenant}`)),
+		ids: (scope) => {
+			const type = scopeTypeOf(ctx, scope);
+			const body = scopedBody(ctx, scope, type);
+			if (keys === void 0) return body;
+			const sql = scope === rootName(ctx) ? `${body.sql}\n  union\n${serviceKeyIdsSql(ctx, keys, scope, type)}` : body.sql;
+			return {
+				sql: set ? `  select ids.id, ids.grant_key
+  from (
+${sql}
+  ) ids(id, grant_key)
+  where ${allows}` : ceilingIdsSql(sql, allows),
+				vars: body.vars
+			};
+		}
+	};
+}
+function forUserContext(ctx) {
+	const { apiKeys: _apiKeys, ...unkeyed } = ctx;
+	return {
+		...unkeyed,
+		subjectId: "p_user",
+		tenants: "all"
+	};
+}
+//#endregion
+//#region src/cli/pg.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const STATEMENT_TIMEOUT_MS = 6e4;
+function loadPg(command) {
+	return requirePeer(() => import("pg"), "pg", command);
+}
+function options(db) {
+	return {
+		connectionString: db,
+		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+		statement_timeout: STATEMENT_TIMEOUT_MS
+	};
+}
+/** Ctrl-C ends the connection, so a query that hangs cannot keep the process alive. */
+function endOnInterrupt(end) {
+	const interrupt = () => {
+		end().catch(() => void 0);
+		process.exitCode = 130;
+	};
+	process.once("SIGINT", interrupt);
+	return async () => {
+		process.off("SIGINT", interrupt);
+		await end();
+	};
+}
+function unreachable(command, cause) {
+	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, { cause });
+}
+/** One connection, for commands that run a transaction. */
+async function connectPg(db, command) {
+	const client = new (await (loadPg(command))).Client(options(db));
+	try {
+		await client.connect();
+	} catch (cause) {
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => client.query(sql, values),
+		end: endOnInterrupt(() => client.end())
+	};
+}
+/** A small pool, for independent catalog reads that can run in parallel. */
+async function connectPgPool(db, command) {
+	const pool = new (await (loadPg(command))).Pool({
+		...options(db),
+		max: 4
+	});
+	try {
+		(await pool.connect()).release();
+	} catch (cause) {
+		await pool.end();
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => pool.query(sql, values),
+		end: endOnInterrupt(() => pool.end())
+	};
+}
+//#endregion
+//#region src/cli/rls-indexes.ts
+/** Postgres truncates identifiers longer than this, in bytes. */
+const MAX_IDENT = 63;
+/**
+* The row fields `condition` compares with the subject, a claim or a
+* membership (`ownerId: principal.id`, `memberOf`), through `and` and `or`:
+* the selective comparisons an index serves. A comparison with a constant
+* (`status: 'sent'`) narrows rows the scope key already found, a negation
+* scans anyway, and a dotted field is a JSON path a plain index does not serve.
+*/
+function indexedFields(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "and":
+		case "or": return condition.conditions.flatMap(indexedFields);
+		case "memberOf": return plainField(condition.field);
+		case "eq":
+		case "in": return isConditionRef(condition.value) ? plainField(condition.field) : [];
+		case "not":
+		case "sqlFunction":
+		case "opaque":
+		case "related":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "notIn":
+		case "isNull":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+function plainField(field) {
+	return field.includes(".") ? [] : [field];
+}
+/**
+* Every index the generated SQL reads through: the row columns policies
+* filter on (scope keys and selective condition fields), and the membership
+* tables' user column, followed by the scope column the helpers select.
+*/
+function indexTargets(ctx, rowColumns) {
+	const targets = /* @__PURE__ */ new Map();
+	const add = (table, columns) => {
+		const target = {
+			table: qualifiedTable(table),
+			columns
+		};
+		targets.set(`${target.table}\u0000${columns[0] ?? ""}`, target);
+	};
+	for (const { table, column } of rowColumns) add(table, [column]);
+	for (const scope of ctx.scopes) {
+		const mapped = scopeTable(ctx, scope.name);
+		if (mapped !== void 0) add(mapped.table.table, [mapped.table.user, mapped.column]);
+	}
+	for (const source of [...ctx.sources ?? [], ...ctx.memberSources ?? []]) {
+		add(source.sql.table, [source.sql.user]);
+		const users = source.sql.userThrough;
+		if (users !== void 0) add(users.table, [users.key]);
+	}
+	return [...targets.values()].toSorted((a, b) => `${a.table}.${a.columns.join(",")}` < `${b.table}.${b.columns.join(",")}` ? -1 : 1);
+}
+/** A stable index name under Postgres' identifier limit. */
+function indexName(target) {
+	const name = `permdock_${target.table.slice(target.table.lastIndexOf(".") + 1)}_${target.columns.join("_")}_idx`;
+	if (Buffer.byteLength(name) <= MAX_IDENT) return name;
+	return `permdock_${createHash("sha256").update(name).digest("hex").slice(0, 8)}_idx`;
+}
+/** `create index if not exists` for every target, one per line. */
+function indexesSql(targets) {
+	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
+}
+/** Every live column of the tables in `$1` (`schema.table`), as `target` and `name`. */
+const COLUMNS_SQL = `select n.nspname || '.' || c.relname as target, a.attname as name
+from pg_attribute a
+join pg_class c on c.oid = a.attrelid
+join pg_namespace n on n.oid = c.relnamespace
+where a.attnum > 0 and not a.attisdropped
+  and n.nspname || '.' || c.relname = any($1::text[])`;
+const INDEX_COLUMNS_SQL = `select n.nspname || '.' || c.relname as target,
+  array(
+    select a.attname::text
+    from unnest(i.indkey) with ordinality k(attnum, ord)
+    left join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum and k.attnum > 0
+    where k.ord <= i.indnkeyatts
+    order by k.ord
+  ) as columns
+from pg_index i
+join pg_class c on c.oid = i.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
+function strings(value) {
+	return Array.isArray(value) ? value.map((item) => typeof item === "string" ? item : null) : [];
+}
+/** Reads the columns and index key columns of `tables` (`schema.table`). */
+async function readTableIndexFacts(db, tables, connect = (url) => connectPgPool(url, "permdock rls generate --db")) {
+	const client = await connect(db);
+	try {
+		const [columns, indexes] = await Promise.all([client.query(COLUMNS_SQL, [[...tables]]), client.query(INDEX_COLUMNS_SQL, [[...tables]])]);
+		const byTable = {};
+		for (const row of columns.rows) (byTable[String(row["target"])] ??= []).push(String(row["name"]));
+		const keys = {};
+		for (const row of indexes.rows) {
+			const list = strings(row["columns"]);
+			const end = list.indexOf(null);
+			const lead = end === -1 ? list : list.slice(0, end);
+			if (lead.length > 0) (keys[String(row["target"])] ??= []).push(lead);
+		}
+		return {
+			columns: byTable,
+			indexes: keys
+		};
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Drops the targets a database already serves or cannot hold: a target on a
+* table or column the database lacks (with a warning), and one an existing
+* index leads with (its key columns start with the target's).
+*/
+function pruneIndexTargets(targets, facts) {
+	const warnings = [];
+	return {
+		targets: targets.filter((target) => {
+			const columns = facts.columns[target.table];
+			if (columns === void 0) {
+				warnings.push(`no index suggested on ${target.table}: the database has no such table`);
+				return false;
+			}
+			const absent = target.columns.filter((column) => !columns.includes(column));
+			if (absent.length > 0) {
+				warnings.push(`no index suggested on ${target.table} (${target.columns.join(", ")}): the table has no column ${absent.join(", ")}`);
+				return false;
+			}
+			return !(facts.indexes[target.table] ?? []).some((index) => target.columns.every((column, at) => index[at] === column));
+		}),
+		warnings
+	};
+}
+//#endregion
+//#region src/cli/rls-permission-keys.ts
+/** The helpers that take a permission key instead of a grant key. Names are part of the SQL contract. */
+const PERMISSION_HELPERS = {
+	grantKeys: "grant_keys",
+	has: "permdock_has_permission",
+	hasFor: "permdock_has_permission_for"
+};
+/** `permitted_<scope>_permission_keys(p_id)`: every permission key the subject holds on one instance. */
+function permissionKeysHelper(scope) {
+	permittedIdsHelper(scope);
+	return `permitted_${scope}_permission_keys`;
+}
+/** `permitted_<scope>_permission_keys_for(p_user, p_id)`, written in `database` mode. */
+function permissionKeysForHelper(scope) {
+	return `${permissionKeysHelper(scope)}_for`;
+}
+/** `permitted_<scope>_ids_by_permission(p_permission)`. */
+function permittedByPermissionHelper(scope) {
+	return `${permittedIdsHelper(scope)}_by_permission`;
+}
+/**
+* A grant's `requires` as SQL: the subject holds `key` globally, or on the
+* row's instance of a scope that partitions it, through the helpers by
+* permission key, as `requirementCondition` does in process.
+*/
+function requiresSql(ctx, key, resource) {
+	const literal = quoteLiteral(key);
+	return `(${[`(select ${qualified$1(ctx, PERMISSION_HELPERS.has)}(${literal}))`, ...(resource === void 0 ? [] : partitionsOf(resource, ctx.scopes)).map((scope) => {
+		const field = scopeField(resource, scope, ctx.scopes) ?? scope;
+		return `${quoteIdent(field)} in (select ${qualified$1(ctx, checkName(permittedByPermissionHelper(scope)))}(${literal}))`;
+	})].join(" or ")})`;
+}
+/** Postgres truncates an identifier past 63 bytes, which would merge two helpers. */
+function checkName(name) {
+	if (new TextEncoder().encode(name).length > 63) throw new Error(`PermDock CLI: the helper name ${name} is longer than 63 bytes; use a shorter scope name`);
+	return name;
+}
+function grantsFunction(ctx, grants, renamed, anonExecute) {
+	const fn = qualified$1(ctx, PERMISSION_HELPERS.grantKeys);
+	const map = Object.fromEntries([...grants].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+	const current = Object.keys(renamed).length === 0 ? "p_permission" : `coalesce(${quoteLiteral(JSON.stringify(renamed))}::jsonb ->> p_permission, p_permission)`;
+	return `-- the grant keys a permission key reaches on one scope: its unconditional allows, with p_effect 'deny' every deny, and with 'conditioned-allow' or 'conditioned-deny' the allows or denies that carry a row condition
+create or replace function ${fn}(p_permission text, p_scope text, p_effect text default 'allow')
+returns setof text
+language sql
+stable
+set search_path = ''
+as $$
+  select g.grant_key
+  from pg_catalog.jsonb_array_elements_text(coalesce(
+    ${quoteLiteral(JSON.stringify(map))}::jsonb -> p_scope -> ${current} -> p_effect,
+    '[]'::jsonb
+  )) g(grant_key)
+$$;
+${grantsSql(fn, "text, text, text", anonExecute)}`;
+}
+function grantsSql(fn, args, anonExecute) {
+	return anonExecute ? `revoke execute on function ${fn}(${args}) from public;
+grant execute on function ${fn}(${args}) to anon, authenticated;` : `revoke execute on function ${fn}(${args}) from public, anon;
+grant execute on function ${fn}(${args}) to authenticated;`;
+}
+function definer(fn, params, returns, sql) {
+	return `create or replace function ${fn}(${params})
+returns ${returns}
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+${sql}
+$$;`;
+}
+function heldSql(at, effect) {
+	return `select 1 from pdk_h where pdk_h.key = pdk_k.key and pdk_h.scope = ${quoteLiteral(at)} and pdk_h.effect = '${effect}'`;
+}
+function keysFunction(fn, params, body, access) {
+	return `create or replace function ${fn}(${params})
+returns setof text
+${functionBody(body).replace("set search_path = ''", "set search_path = ''\nset jit = off")}
+${access}`;
+}
+/**
+* The permission-key forms of the helpers: `grant_keys`, which maps a
+* permission key to the grant keys of its unconditional allows on a scope
+* (or every deny key, or the conditioned allow or deny keys),
+* `permdock_has_permission(p_permission)` and one
+* `permitted_<scope>_ids_by_permission(p_permission)` per scope, plus their
+* `_for(p_user, ...)` forms in `database` mode. They answer with the
+* unconditional allows minus any deny, so a permission whose allows all carry
+* a row condition answers nothing. The
+* `permitted_<scope>_ids_by_permission(p_permission, p_conditioned)` overload
+* with `true` also lists the instances a conditioned allow reaches and
+* subtracts only unconditional denies, leaving the row condition to the
+* caller, as `permittedIds(..., { conditioned: true })` does in process.
+*/
+function permissionHelpersSql(ctx, grants, renamed, anonExecute) {
+	const keys = qualified$1(ctx, PERMISSION_HELPERS.grantKeys);
+	const allowKeys = (scope) => `${keys}(p_permission, ${quoteLiteral(scope)}) g(grant_key)`;
+	const denyKeys = (scope) => `${keys}(p_permission, ${quoteLiteral(scope)}, 'deny') g(grant_key)`;
+	const has = (helper, user) => `  select exists (select 1 from ${allowKeys("global")} where ${helper}(${user}g.grant_key))
+    and not exists (select 1 from ${denyKeys("global")} where ${helper}(${user}g.grant_key))`;
+	const ids = (helper, scope, user) => `  select a.id
+  from ${allowKeys(scope)}
+  cross join lateral ${helper}(${user}g.grant_key) a(id)
+  except
+  select d.id
+  from ${denyKeys(scope)}
+  cross join lateral ${helper}(${user}g.grant_key) d(id)`;
+	const conditionedIds = (helper, scope, user) => `  select a.id
+  from (
+    select g.grant_key from ${allowKeys(scope)}
+    union all
+    select g.grant_key from ${keys}(p_permission, ${quoteLiteral(scope)}, 'conditioned-allow') g(grant_key)
+    where p_conditioned
+  ) g
+  cross join lateral ${helper}(${user}g.grant_key) a(id)
+  except
+  select d.id
+  from (
+    select g.grant_key from ${denyKeys(scope)}
+    except
+    select g.grant_key from ${keys}(p_permission, ${quoteLiteral(scope)}, 'conditioned-deny') g(grant_key)
+    where p_conditioned
+  ) g
+  cross join lateral ${helper}(${user}g.grant_key) d(id)`;
+	const keysBody = (scope, bodies, filtered) => {
+		const rows = ["global", scope].flatMap((at) => Object.entries(grants.get(at) ?? {}).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).flatMap(([key, effects]) => ["allow", "deny"].flatMap((effect) => effects[effect].map((grant) => `(${[
+			key,
+			at,
+			effect,
+			grant
+		].map(quoteLiteral).join(", ")})`))));
+		if (new Set(["global", scope].flatMap((at) => Object.entries(grants.get(at) ?? {}).flatMap(([key, effects]) => effects.allow.length > 0 ? [key] : []))).size === 0) return {
+			sql: "  select null::text where false",
+			vars: []
+		};
+		const hasBody = bodies.has;
+		const idsBody = bodies.ids(scope);
+		return {
+			sql: `  with pdk_m(key, scope, effect, grant_key) as (
+    values
+      ${rows.join(",\n      ")}
+  ),
+  pdk_w as (
+    select pdk_m.key, pdk_m.scope, pdk_m.effect, pdk_m.grant_key
+    from pdk_m${filtered ? `\n    where pdk_m.key in (select ${Object.keys(renamed).length === 0 ? "k.key" : `coalesce(${quoteLiteral(JSON.stringify(renamed))}::jsonb ->> k.key, k.key)`} from pg_catalog.unnest(p_keys) k(key))` : ""}
+  ),
+  pdk_g as (
+${hasBody.sql}
+  ),
+  pdk_s as (
+    select pdk_i.grant_key
+    from (
+${idsBody.sql}
+    ) pdk_i(id, grant_key)
+    where pdk_i.id = p_id
+  ),
+  pdk_h as (
+    select pdk_w.key, pdk_w.scope, pdk_w.effect
+    from pdk_w
+    where (pdk_w.scope = 'global' and pdk_w.grant_key in (select pdk_g.grant_key from pdk_g))
+      or (pdk_w.scope = ${quoteLiteral(scope)} and pdk_w.grant_key in (select pdk_s.grant_key from pdk_s))
+  )
+  select pdk_k.key
+  from (select distinct pdk_w.key from pdk_w where pdk_w.effect = 'allow') pdk_k
+  where (exists (${heldSql("global", "allow")}) and not exists (${heldSql("global", "deny")}))
+    or (exists (${heldSql(scope, "allow")}) and not exists (${heldSql(scope, "deny")}))
+  order by 1`,
+			vars: [.../* @__PURE__ */ new Set([...hasBody.vars, ...idsBody.vars])]
+		};
+	};
+	const chunks = [grantsFunction(ctx, grants, renamed, anonExecute), `-- the helpers by permission key: unconditional allows minus any deny
+${definer(qualified$1(ctx, PERMISSION_HELPERS.has), "p_permission text", "boolean", has(qualified$1(ctx, HELPERS.has), ""))}
+${grantsSql(qualified$1(ctx, PERMISSION_HELPERS.has), "text", anonExecute)}`];
+	for (const scope of ctx.scopes) {
+		const fn = qualified$1(ctx, checkName(permittedByPermissionHelper(scope.name)));
+		chunks.push(`${definer(fn, "p_permission text", `setof ${scopeTypeOf(ctx, scope.name)}`, ids(qualified$1(ctx, permittedIdsHelper(scope.name)), scope.name, ""))}
+${grantsSql(fn, "text", anonExecute)}`);
+		const keysFn = qualified$1(ctx, checkName(permissionKeysHelper(scope.name)));
+		const type = scopeTypeOf(ctx, scope.name);
+		const caller = grantBodies({
+			...ctx,
+			grantSet: true
+		});
+		chunks.push(`-- the permission keys the caller holds on one ${scope.name}: what permdock_has_permission or permitted_${scope.name}_ids_by_permission answers for each key, in one call
+${keysFunction(keysFn, `p_id ${type}`, keysBody(scope.name, caller, false), grantsSql(keysFn, type, anonExecute))}
+${keysFunction(keysFn, `p_id ${type}, p_keys text[]`, keysBody(scope.name, caller, true), grantsSql(keysFn, `${type}, text[]`, anonExecute))}`);
+		chunks.push(`-- with p_conditioned true, also the instances a conditioned allow reaches, minus only unconditional denies: the caller applies the row condition
+${definer(fn, "p_permission text, p_conditioned boolean", `setof ${scopeTypeOf(ctx, scope.name)}`, conditionedIds(qualified$1(ctx, permittedIdsHelper(scope.name)), scope.name, ""))}
+${grantsSql(fn, "text, boolean", anonExecute)}`);
+	}
+	if (ctx.authorize !== "database") return `${chunks.join("\n\n")}\n`;
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const revoke = (fn) => `revoke execute on function ${fn}(${user}, text) from public, anon, authenticated;`;
+	const hasFor = qualified$1(ctx, PERMISSION_HELPERS.hasFor);
+	chunks.push(`-- the same for a user the caller names; no client role may execute them
+${definer(hasFor, `p_user ${user}, p_permission text`, "boolean", has(qualified$1(ctx, HELPERS.hasFor), "p_user, "))}
+${revoke(hasFor)}`);
+	for (const scope of ctx.scopes) {
+		const fn = qualified$1(ctx, checkName(`${permittedByPermissionHelper(scope.name)}_for`));
+		chunks.push(`${definer(fn, `p_user ${user}, p_permission text`, `setof ${scopeTypeOf(ctx, scope.name)}`, ids(qualified$1(ctx, permittedForHelper(scope.name)), scope.name, "p_user, "))}
+${revoke(fn)}`);
+		chunks.push(`${definer(fn, `p_user ${user}, p_permission text, p_conditioned boolean`, `setof ${scopeTypeOf(ctx, scope.name)}`, conditionedIds(qualified$1(ctx, permittedForHelper(scope.name)), scope.name, "p_user, "))}
+revoke execute on function ${fn}(${user}, text, boolean) from public, anon, authenticated;`);
+		const keysFor = qualified$1(ctx, checkName(permissionKeysForHelper(scope.name)));
+		const type = scopeTypeOf(ctx, scope.name);
+		const named = grantBodies({
+			...forUserContext(ctx),
+			grantSet: true
+		});
+		chunks.push(`${keysFunction(keysFor, `p_user ${user}, p_id ${type}`, keysBody(scope.name, named, false), `revoke execute on function ${keysFor}(${user}, ${type}) from public, anon, authenticated;`)}
+${keysFunction(keysFor, `p_user ${user}, p_id ${type}, p_keys text[]`, keysBody(scope.name, named, true), `revoke execute on function ${keysFor}(${user}, ${type}, text[]) from public, anon, authenticated;`)}`);
+	}
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls-compile.ts
+/**
+* The levels an allow reaches: every level without a row condition, else the
+* levels whose condition equals its condition.
+*/
+function reachedLevels(where, levels) {
+	if (where === void 0) return levels.map(([name]) => name);
+	const held = canonicalJson(where);
+	return levels.filter(([, condition]) => canonicalJson(condition) === held).map(([name]) => name);
+}
+function levelReachOf(policy, keys) {
+	const reach = /* @__PURE__ */ new Map();
+	for (const [entry, grantKey] of keys) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || grant.level !== void 0) continue;
+		const levels = policyLevels(policy, grant.permission.resource);
+		if (levels.length > 0) {
+			const set = reach.get(grantKey) ?? /* @__PURE__ */ new Set();
+			for (const name of reachedLevels(grant.where, levels)) set.add(name);
+			reach.set(grantKey, set);
+		}
+	}
+	const out = [];
+	for (const grantKey of new Set(keys.values())) {
+		const at = grantKey.lastIndexOf("@");
+		const base = at === -1 ? grantKey : grantKey.slice(0, at);
+		const level = at === -1 ? void 0 : grantKey.slice(at + 1);
+		for (const name of reach.get(base) ?? []) if (level === void 0 || level === name) out.push([grantKey, name]);
+	}
+	return out.toSorted(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
+}
+/** The SQL command `action` compiles to: `rls.actions` first, then the six default verbs. */
+function commandFor(action, actions) {
+	if (actions !== void 0 && Object.hasOwn(actions, action)) {
+		const configured = actions[action];
+		return configured === "none" ? void 0 : configured;
+	}
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return "select";
+		case "create": return "insert";
+		case "update": return "update";
+		case "delete": return "delete";
+		default: return;
+	}
+}
+function tableFor(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+function ancestorsOf(policy, name) {
+	const names = [];
+	let current = policy.resources.get(name);
+	while (current?.parent !== void 0 && !names.includes(current.parent.resource)) {
+		names.push(current.parent.resource);
+		current = policy.resources.get(current.parent.resource);
+	}
+	return names;
+}
+function membershipField(policy, resource, holder) {
+	if (resource === void 0) return;
+	if (resource.name === holder) return resource.id ?? "id";
+	let current = resource;
+	const seen = /* @__PURE__ */ new Set();
+	while (current?.parent !== void 0 && !seen.has(current.name)) {
+		seen.add(current.name);
+		if (current.parent.resource === holder) return current.parent.field;
+		current = policy.resources.get(current.parent.resource);
+	}
+}
+function resourceCondition(item, policy, ctx) {
+	if (item.access.kind !== "resource") throw new Error("PermDock CLI: resourceCondition needs a resource role");
+	const { role, resource: roleResource } = item.access;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const holders = [roleResource, ...ancestorsOf(policy, roleResource)];
+	const hops = [];
+	for (const [index, holder] of holders.entries()) {
+		const field = membershipField(policy, target, holder);
+		if (field === void 0) continue;
+		if (index > 0 && ctx.memberships?.resource?.[holder] === void 0) continue;
+		hops.push({
+			op: "memberOf",
+			scope: "resource",
+			field,
+			roles: [role],
+			resource: holder
+		});
+	}
+	return sole(hops) ?? {
+		op: "or",
+		conditions: hops
+	};
+}
+/**
+* The access a link capability has to a resource-scoped grant, over the same
+* holders as `resourceCondition`. It reads the claim, so ancestor hops need
+* no memberships table. `undefined` when no holder is on the row's chain.
+*/
+function capabilityAccess(item, policy, ctx) {
+	if (item.access.kind !== "resource") return;
+	const { role, resource: roleResource } = item.access;
+	const kinds = ctx.ownership?.kinds[role];
+	if (kinds !== void 0 && !kinds.includes("link")) return;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const hops = [];
+	for (const holder of [roleResource, ...ancestorsOf(policy, roleResource)]) {
+		const field = membershipField(policy, target, holder);
+		if (field !== void 0) hops.push(capabilityAccessSql(ctx, field, holder, role, item.grant.permission.key));
+	}
+	if (hops.length === 0) return;
+	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
+}
+function prepare(item, tables, warnings, skipClosures, actions, rowActions = false) {
+	const { grant, label } = item;
+	if (grant.breakGlass !== void 0) {
+		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
+		return;
+	}
+	if (grant.closure !== void 0 || grant.portable === false) {
+		if (skipClosures) {
+			warnings.push(`skipped non-portable grant ${label}/${grant.permission.key}`);
+			return;
+		}
+		throw new Error(`PermDock CLI: closure grant ${label}/${grant.permission.key} is not portable; rewrite it or pass --skip-closures`);
+	}
+	const context = [.../* @__PURE__ */ new Set([...contextRefs(item.where), ...contextRefs(grant.check)])];
+	if (context.length > 0) {
+		if (skipClosures) {
+			warnings.push(`skipped grant ${label}/${grant.permission.key}: it reads ${context.join(", ")}, which is not in the token`);
+			return;
+		}
+		throw new Error(`PermDock CLI: grant ${label}/${grant.permission.key} reads ${context.join(", ")}; request context is not in the token, so RLS cannot compile it. Move the value to a server-set claim (principal.claims.*) or pass --skip-closures (permdock doctor PD027)`);
+	}
+	if (requiresApproval(grant.approval)) {
+		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
+		return;
+	}
+	const command = commandFor(grant.permission.action, actions);
+	const table = tableFor(grant.permission.resource, tables);
+	if (command === void 0) {
+		if (item.access.kind !== "role" && rowActions) {
+			warnings.push(`no policy for ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions); only permitted_<resource>_rows answers it`);
+			return {
+				item,
+				command: "none",
+				table,
+				...item.where === void 0 ? {} : { using: item.where }
+			};
+		}
+		if (item.access.kind !== "role") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions) and only role grants are seeded`);
+			return;
+		}
+		if (grant.validity !== void 0 && grant.effect === "allow") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: a role_permissions row cannot carry validFrom / validUntil, so a time-bounded grant on an action with no SQL command is not seeded`);
+			return;
+		}
+		warnings.push(`no policy for ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions); seeded for permdock_has and permitted_<scope>_ids`);
+		return {
+			item,
+			command: "none",
+			table,
+			...item.where === void 0 ? {} : { using: item.where },
+			...grant.check === void 0 ? {} : { check: grant.check }
+		};
+	}
+	const using = command === "insert" ? void 0 : item.where;
+	const check = command === "insert" ? grant.check ?? item.where : command === "update" ? grant.check ?? item.where : void 0;
+	return {
+		item,
+		command,
+		table,
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+function signature(entry, byFields) {
+	const base = [
+		entry.item.grant.effect,
+		entry.using ?? null,
+		entry.check ?? null
+	];
+	return JSON.stringify(byFields ? [...base, entry.item.grant.fields ?? null] : base);
+}
+/**
+* Grant keys per permission: the key is the permission, split into
+* `permission#n` when role grants carry different portable conditions (or
+* effects), one key per condition group; a group whose grants set `group`
+* is `permission#<group>` instead. With field views, grants that differ
+* only in `fields` get their own keys too, so a view can tell them apart.
+*/
+function assignKeys(entries, byFields) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (entry.item.access.kind !== "role") continue;
+		const key = entry.item.grant.permission.key;
+		const byCondition = groups.get(key) ?? /* @__PURE__ */ new Map();
+		const sig = signature(entry, byFields);
+		byCondition.set(sig, [...byCondition.get(sig) ?? [], entry]);
+		groups.set(key, byCondition);
+	}
+	const keys = /* @__PURE__ */ new Map();
+	for (const [permission, byCondition] of groups) {
+		const lists = [...byCondition.values()];
+		const named = /* @__PURE__ */ new Set();
+		for (const [index, list] of lists.entries()) {
+			const group = groupOf(permission, list);
+			if (group !== void 0 && named.has(group)) throw new Error(`PermDock CLI: grants of ${permission} with different conditions share group '${group}'; a group names one condition`);
+			if (group !== void 0) named.add(group);
+			const grantKey = group !== void 0 ? `${permission}#${group}` : lists.length === 1 ? permission : `${permission}#${index + 1}`;
+			for (const entry of list) keys.set(entry, grantKey);
+		}
+	}
+	return keys;
+}
+function groupOf(permission, list) {
+	const names = [...new Set(list.flatMap((entry) => entry.item.grant.group === void 0 ? [] : [entry.item.grant.group]))].toSorted();
+	if (names.length > 1) throw new Error(`PermDock CLI: grants of ${permission} with one condition name the groups ${names.join(", ")}; give them one group`);
+	return names[0];
+}
+/**
+* One entry per level for every allow of an assignable role on a resource
+* with levels, keyed `<grant key>@<level>`. Only `permdock_custom_keys`
+* hands these keys out, to a custom role whose stored allow names the level.
+*/
+function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
+	const custom = ctx.customRoles;
+	if (custom?.levels !== true) return [];
+	const assignable = new Set(custom.assignable);
+	const out = [];
+	for (const [entry, grantKey] of Array.from(keys)) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || !assignable.has(item.access.role)) continue;
+		if (grant.permission.key.includes("@")) throw new Error(`PermDock CLI: permission key '${grant.permission.key}' holds '@', which separates a level in custom-role grant keys`);
+		for (const [level, condition] of policyLevels(policy, grant.permission.resource)) {
+			const where = andWhere(item.where, condition);
+			const prepared = prepare({
+				...item,
+				grant: leveled(grant, level, condition),
+				...where === void 0 ? {} : { where }
+			}, tables, warnings, skipClosures, ctx.actions);
+			if (prepared !== void 0) {
+				keys.set(prepared, `${grantKey}@${level}`);
+				out.push(prepared);
+			}
+		}
+	}
+	return out;
+}
+function compileOptional(condition, ctx) {
+	return condition === void 0 ? void 0 : compileConditionSql(condition, ctx);
+}
+function noteConditions(entry, warnings) {
+	const { label, grant } = entry.item;
+	const names = [...sqlFunctionNames(entry.using), ...sqlFunctionNames(entry.check)];
+	if (names.length > 0) warnings.push(`sqlFunction ${[...new Set(names)].join(", ")} on ${label}/${grant.permission.key} is portable via twin`);
+	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
+}
+/**
+* Compiles every grant (role and top-level) to branches whose role check is
+* a helper call keyed by grant key. Nothing in a branch is per-row except the
+* portable row condition and resource-membership joins.
+*/
+/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
+const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
+function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
+	const items = collectGrants(policy);
+	const entries = items.flatMap((item) => {
+		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions, rowActions);
+		return entry === void 0 ? [] : [entry];
+	});
+	const keys = assignKeys(entries, ctx.fields === "views");
+	entries.push(...levelEntries(policy, ctx, keys, tables, warnings, skipClosures));
+	const conditionedKeys = /* @__PURE__ */ new Set();
+	for (const [entry, grantKey] of keys) if (entry.using !== void 0 || entry.check !== void 0 || entry.item.grant.validity !== void 0 || entry.item.grant.requires !== void 0) conditionedKeys.add(grantKey);
+	const rows = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const holder = item.grant.breakGlass === void 0 ? void 0 : breakGlassHolder(item);
+		if (holder !== void 0) {
+			const row = {
+				role: holder.role,
+				permission: item.grant.permission.key,
+				grantKey: breakGlassKey(item.grant.permission.key),
+				scope: holder.scope,
+				effect: item.grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+	}
+	const branches = [];
+	const actionBranches = [];
+	const rowColumns = /* @__PURE__ */ new Map();
+	const filters = (resource, table, column) => {
+		rowColumns.set(`${table}\u0000${column}`, {
+			resource,
+			table,
+			column
+		});
+	};
+	const typed = /* @__PURE__ */ new Map();
+	const contextFor = (name) => {
+		const known = typed.get(name);
+		if (known !== void 0) return known;
+		const node = policy.resources.get(name);
+		const schema = node === void 0 ? void 0 : jsonSchemaOf(node);
+		const next = {
+			...ctx,
+			columnTypes: columnTypesOf(schema),
+			arrayColumns: arrayColumnsOf(schema)
+		};
+		typed.set(name, next);
+		return next;
+	};
+	for (const entry of entries) {
+		const { item, table } = entry;
+		const { grant, access, label } = item;
+		if (entry.command === "none") {
+			const grantKey = keys.get(entry);
+			if (access.kind === "role" && grantKey !== void 0) {
+				const row = {
+					role: access.role,
+					permission: grant.permission.key,
+					grantKey,
+					scope: access.scope,
+					effect: grant.effect
+				};
+				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+			}
+			if (!rowActions) continue;
+		}
+		const actionOnly = entry.command === "none";
+		const command = actionOnly ? "select" : entry.command;
+		const target = actionOnly ? actionBranches : branches;
+		const rowCtx = {
+			...contextFor(item.grant.permission.resource),
+			permission: grant.permission.key
+		};
+		noteConditions(entry, warnings);
+		for (const field of [...indexedFields(entry.using), ...indexedFields(entry.check)]) filters(grant.permission.resource, table, field);
+		const grantKey = keys.get(entry);
+		let accessExpr;
+		if (access.kind === "role" && grantKey !== void 0) {
+			const column = access.scope === "global" ? void 0 : scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
+			accessExpr = accessSql(ctx, access.scope, grantKey, column);
+			if (column !== void 0) filters(grant.permission.resource, table, column);
+			const row = {
+				role: access.role,
+				permission: grant.permission.key,
+				grantKey,
+				scope: access.scope,
+				effect: grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+		const linkOnly = access.kind === "resource" && ctx.capabilities === true && ctx.memberships?.resource?.[access.resource] === void 0;
+		if (access.kind === "actor") accessExpr = `${subjectClaimSql(ctx, "client_id")} is not null or ${subjectClaimJsonSql(ctx, "act")} is not null`;
+		if (access.kind === "resource" && !linkOnly) accessExpr = compileConditionSql(resourceCondition(item, policy, ctx), {
+			...ctx,
+			permission: grant.permission.key
+		});
+		if (linkOnly) warnings.push(`no ${access.resource} memberships table: only link capabilities reach ${label}/${grant.permission.key}`);
+		const validity = validitySql(grant.validity);
+		accessExpr = andSql(accessExpr, validity);
+		for (const key of grant.requires ?? []) accessExpr = andSql(accessExpr, requiresSql(ctx, key, policy.resources.get(grant.permission.resource)));
+		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
+		if (ctx.apiKeys !== void 0 && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
+			const calls = (requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []]).map((key) => `(select ${apiKeyAllowsCall(ctx, quoteLiteral(key))})`);
+			accessExpr = andSql(accessExpr, calls.length === 1 ? calls[0] ?? "" : `(${calls.join(" and ")})`);
+		}
+		const using = compileOptional(entry.using, rowCtx);
+		const check = compileOptional(entry.check, rowCtx);
+		const fields = grant.fields === void 0 ? {} : { fields: grant.fields };
+		if (!linkOnly) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: access.kind === "anyone" ? ["anon", "authenticated"] : ["authenticated"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			...grantKey === void 0 ? {} : { grantKey },
+			...accessExpr === void 0 ? {} : { access: accessExpr },
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+		const linked = ctx.capabilities === true ? capabilityAccess(item, policy, ctx) : void 0;
+		if (linked !== void 0) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: ["anon"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			access: andSql(linked, validity) ?? linked,
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+	}
+	return {
+		branches: ensureSelectCoverage(branches, warnings),
+		actionBranches,
+		rolePermissions: withAliasRows(policy, [...rows.values()]),
+		conditionedKeys,
+		rowColumns: [...rowColumns.values()],
+		levelReach: ctx.customRoles?.levels === true ? levelReachOf(policy, keys) : []
+	};
+}
+/**
+* Each row again under every key its permission was renamed from, so SQL that
+* still calls `permdock_has('<old key>')` keeps the access the current key
+* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
+* copied.
+*/
+function withAliasRows(policy, rows) {
+	const former = new Map(listPermissions(policy.permissions).map((leaf) => [leaf.key, formerKeys(leaf)]));
+	const out = [...rows];
+	for (const row of rows) {
+		const suffix = row.grantKey.slice(row.permission.length);
+		if (!row.grantKey.startsWith(row.permission) || suffix !== "" && (!/^#[a-z0-9][a-z0-9_-]*$/u.test(suffix) || suffix === "#break-glass")) continue;
+		for (const old of former.get(row.permission) ?? []) out.push({
+			...row,
+			permission: old,
+			grantKey: `${old}${suffix}`
+		});
+	}
+	return out;
+}
+/**
+* Postgres needs SELECT access to find rows for UPDATE / DELETE and for
+* RETURNING, so a table with only update or delete grants gets matching
+* SELECT branches.
+*/
+function ensureSelectCoverage(branches, warnings) {
+	const extra = [];
+	const readable = new Set(branches.filter((item) => item.command === "select" && item.effect === "allow").map((item) => item.table));
+	const covered = /* @__PURE__ */ new Set();
+	for (const item of branches) {
+		if (item.effect !== "allow" || item.command !== "update" && item.command !== "delete" || readable.has(item.table)) continue;
+		const { check: _check, ...rest } = item;
+		extra.push({
+			...rest,
+			command: "select",
+			coverage: true
+		});
+		if (!covered.has(item.table)) {
+			covered.add(item.table);
+			warnings.push(`added SELECT coverage for ${item.table} (${item.permissionKey})`);
+		}
+	}
+	return [...branches, ...extra];
+}
+/** True when `sql` is one parenthesised expression, so AND / OR need not wrap it again. */
+function isWrapped(sql) {
+	if (!sql.startsWith("(") || !sql.endsWith(")")) return false;
+	let depth = 0;
+	let quoted = false;
+	for (let index = 0; index < sql.length; index += 1) {
+		const ch = sql[index];
+		if (ch === "'") quoted = !quoted;
+		else if (!quoted && ch === "(") depth += 1;
+		else if (!quoted && ch === ")") {
+			depth -= 1;
+			if (depth === 0 && index < sql.length - 1) return false;
+		}
+	}
+	return depth === 0;
+}
+function wrapSql(sql) {
+	return isWrapped(sql) ? sql : `(${sql})`;
+}
+/**
+* The grant's `validFrom` / `validUntil` as a clock check: `from` inclusive,
+* `until` exclusive, matching the in-process evaluator.
+*/
+function validitySql(validity) {
+	if (validity === void 0) return;
+	return andSql(validity.from === void 0 ? void 0 : `now() >= to_timestamp(${validity.from})`, validity.until === void 0 ? void 0 : `now() < to_timestamp(${validity.until})`);
+}
+function andSql(...parts) {
+	const present = parts.filter((part) => part !== void 0 && part !== "true");
+	if (present.length === 0) return;
+	return present.length === 1 ? present[0] : present.map(wrapSql).join(" and ");
+}
+/** `USING` and `WITH CHECK` for a branch: its access check ANDed with its row conditions. */
+function branchClauses(branch) {
+	const using = branch.command === "insert" ? void 0 : andSql(branch.access, branch.using) ?? "true";
+	const check = branch.command === "insert" || branch.command === "update" ? andSql(branch.access, branch.check) ?? "true" : void 0;
+	return {
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+//#endregion
+//#region src/cli/rls-policies.ts
+/** Each database role gets its own policy, so no role sees two permissive policies for one command. */
+const AUDIENCES = ["authenticated", "anon"];
+const DEFAULT_POLICY_NAME = "{table}_{op}";
+const DEFAULT_PER_ROLE_NAME = "{role}_{permission}";
+const PLACEHOLDER = /\{(table|op|role|permission)\}/gu;
+function sanitize(name) {
+	return name.replaceAll(/[^A-Za-z0-9_]/g, "_");
+}
+function render(template, values) {
+	return sanitize(template.replaceAll(PLACEHOLDER, (_match, key) => values[key]));
+}
+/** Rejects a template that cannot name every policy of the chosen shape uniquely. */
+function assertPolicyName(template, perRole) {
+	if (!perRole && /\{(role|permission)\}/u.test(template)) throw new Error("PermDock CLI: --policy-name {role} and {permission} need --policy-per-role; a collapsed policy covers several roles");
+	if (!perRole && !(template.includes("{table}") && template.includes("{op}"))) throw new Error("PermDock CLI: --policy-name needs {table} and {op} so each table and command gets its own policy");
+}
+function orSql(parts) {
+	const distinct = [...new Set(parts)];
+	if (distinct.includes("true")) return "true";
+	return sole(distinct) ?? distinct.map(wrapSql).join(" or ");
+}
+function negate(sql) {
+	return sql === void 0 ? void 0 : `(${sql}) is not true`;
+}
+function policyOf(name, branch, using, check) {
+	const deny = branch.effect === "deny";
+	const policy = {
+		name,
+		table: branch.table,
+		command: branch.command,
+		effect: branch.effect,
+		roles: branch.roles
+	};
+	const finalUsing = deny ? negate(using) : using;
+	const finalCheck = deny ? negate(check) : check;
+	if (finalUsing !== void 0) policy.using = finalUsing;
+	if (finalCheck !== void 0) policy.check = finalCheck;
+	return policy;
+}
+function uniqueName(names, name) {
+	const seen = names.get(name) ?? 0;
+	names.set(name, seen + 1);
+	return seen === 0 ? name : `${name}_${seen + 1}`;
+}
+function perRolePolicies(branches, template) {
+	const names = /* @__PURE__ */ new Map();
+	return branches.map((branch) => {
+		const clauses = branchClauses(branch);
+		const deny = branch.effect === "deny";
+		const base = render(template, {
+			table: branch.table,
+			op: branch.command,
+			role: branch.label,
+			permission: branch.permissionKey
+		});
+		const name = `${deny ? "deny_" : ""}${base}${branch.coverage === true ? "_select_coverage" : ""}`;
+		return policyOf(uniqueName(names, name), branch, clauses.using, clauses.check);
+	});
+}
+/**
+* Branches of one grant-key group share their row condition, so the group
+* becomes one OR branch whose access ORs the helper calls of each scope.
+*/
+function mergeGroups(branches) {
+	const merged = [];
+	const byKey = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		const id = branch.grantKey === void 0 ? void 0 : `${branch.table}\u0000${branch.command}\u0000${branch.grantKey}\u0000${branch.coverage === true}`;
+		const entry = id === void 0 ? void 0 : byKey.get(id);
+		if (entry === void 0) {
+			const created = {
+				branch,
+				accesses: branch.access === void 0 ? [] : [branch.access]
+			};
+			if (id !== void 0) byKey.set(id, created);
+			merged.push(created);
+			continue;
+		}
+		if (branch.access !== void 0 && !entry.accesses.includes(branch.access)) entry.accesses.push(branch.access);
+	}
+	return merged.map(({ branch, accesses }) => accesses.length <= 1 ? branch : withAccess(branch, orSql(accesses)));
+}
+function withAccess(branch, access) {
+	return {
+		...branch,
+		access
+	};
+}
+function collapsedPolicies(branches, template) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const branch of mergeGroups(branches)) {
+		const id = `${branch.table}\u0000${branch.command}\u0000${branch.effect}`;
+		groups.set(id, [...groups.get(id) ?? [], branch]);
+	}
+	const names = /* @__PURE__ */ new Map();
+	return [...groups.values()].flatMap((group) => AUDIENCES.flatMap((audience) => {
+		const members = group.filter((branch) => branch.roles.includes(audience));
+		const [first] = members;
+		if (first === void 0) return [];
+		const deny = first.effect === "deny";
+		const clauses = members.map(branchClauses);
+		const usings = clauses.flatMap((item) => item.using === void 0 ? [] : [item.using]);
+		const checks = clauses.flatMap((item) => item.check === void 0 ? [] : [item.check]);
+		const base = render(template, {
+			table: first.table,
+			op: first.command,
+			role: first.label,
+			permission: first.permissionKey
+		});
+		return [policyOf(uniqueName(names, `${deny ? "deny_" : ""}${base}${audience === "anon" ? "_anon" : ""}`), {
+			...first,
+			roles: [audience]
+		}, usings.length === 0 ? void 0 : orSql(usings), checks.length === 0 ? void 0 : orSql(checks))];
+	}));
+}
+/**
+* Assembles policies. The default is one PERMISSIVE policy per table,
+* command and database role (Splinter `multiple_permissive_policies` stays
+* quiet), with denies in one RESTRICTIVE policy per table, command and role.
+*/
+function assemblePolicies(branches, shape) {
+	const template = shape.name ?? (shape.perRole ? DEFAULT_PER_ROLE_NAME : DEFAULT_POLICY_NAME);
+	assertPolicyName(template, shape.perRole);
+	return shape.perRole ? perRolePolicies(branches, template) : collapsedPolicies(branches, template);
+}
+const DEFAULT_READ_ONLY_ACTORS = ["support", "impersonation"];
+const ACTOR_KIND = /^[a-z][a-z0-9_-]*$/u;
+/** The actor kinds `rls.readOnlyActors` names, or `undefined` when it is off. */
+function readOnlyActorKinds(setting) {
+	if (setting === void 0 || setting === false) return;
+	const kinds = setting === true ? DEFAULT_READ_ONLY_ACTORS : setting;
+	if (kinds.length === 0 || kinds.some((kind) => !ACTOR_KIND.test(kind))) throw new Error("PermDock CLI: rls.readOnlyActors must be true or a non-empty list of actor kinds such as 'support'");
+	return [...new Set(kinds)];
+}
+/**
+* One restrictive policy per table and write command the allow policies
+* grant to `authenticated`: the write passes unless the token's `act` claim
+* (`act`, as SQL `jsonb`) is a session of one of `kinds` that is not
+* `read_only: false`. Reads are never touched.
+*/
+function readOnlyActorPolicies(policies, act, kinds) {
+	const list = `array[${kinds.map((kind) => `'${kind}'`).join(", ")}]::text[]`;
+	const passes = `not coalesce(${kinds.includes("support") ? `(${act} ->> 'kind') = any(${list}) or ((${act} ->> 'kind') is null and ${act} ? 'session_id')` : `(${act} ->> 'kind') = any(${list})`}, false) or coalesce((${act} ->> 'read_only') = 'false', false)`;
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const policy of policies) {
+		const key = `${policy.table}\u0000${policy.command}`;
+		if (policy.effect !== "allow" || policy.command === "select" || !policy.roles.includes("authenticated") || seen.has(key)) continue;
+		seen.add(key);
+		out.push({
+			name: sanitize(`${policy.table}_${policy.command}_read_only_actors`),
+			table: policy.table,
+			command: policy.command,
+			effect: "deny",
+			roles: ["authenticated"],
+			...policy.command === "insert" ? {} : { using: passes },
+			...policy.command === "delete" ? {} : { check: passes }
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/cli/rls-fields.ts
+/** Names of the field-view objects. Part of the SQL contract. */
+const FIELD_VIEWS = {
+	/** `<table>_visible`: the `security_invoker` view clients read. */
+	view: "_visible",
+	/** `<table>_visible_fields`: the owner-rights companion `--revoke-columns` adds. */
+	companion: "_visible_fields",
+	/** The companion's row-key column, joined to the base table's key. */
+	key: "permdock_key",
+	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
+	comment: "permdock:field-companion"
+};
+function covers(branch, column) {
+	return branch.fields === void 0 || branch.fields.includes(column);
+}
+/**
+* A read grant that only shapes columns: a field-limited deny (it never
+* denies the row) or an allow with an empty list (it grants nothing). With
+* field views it leaves the row policy and lives in the view's masks.
+*/
+function fieldOnly(branch) {
+	if (branch.command !== "select" || branch.fields === void 0) return false;
+	return branch.effect === "deny" || branch.fields.length === 0;
+}
+/** Branches the row policies keep when field views compile. */
+function rowBranches(branches) {
+	return branches.filter((branch) => !fieldOnly(branch));
+}
+/**
+* Whether the reader is signed in, for branches with no helper call: a grant
+* to any signed-in user relies on `to authenticated` in its policy, which a
+* view does not have.
+*/
+function audience(ctx, branch) {
+	if (branch.access !== void 0 || branch.roles.length !== 1) return;
+	if (branch.roles[0] === "authenticated") return signedIn(ctx);
+	return branch.roles[0] === "anon" ? `not (${signedIn(ctx)})` : void 0;
+}
+function clause(ctx, branch) {
+	return andSql(audience(ctx, branch), branchClauses(branch).using) ?? "true";
+}
+/**
+* `can(permission, row, { field })` in SQL: an allow that covers the column
+* holds for the row and no covering deny does. Every access term is the
+* uncorrelated helper call the row policy uses, so it runs once per statement.
+*/
+function maskSql(ctx, allows, denies, column) {
+	const allowed = allows.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	if (allowed.length === 0) return "false";
+	const denied = denies.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	const allow = orSql(allowed);
+	if (denied.length === 0) return allow;
+	const deny = orSql(denied);
+	return allow === "true" ? `not ${wrapSql(deny)}` : `${wrapSql(allow)} and not ${wrapSql(deny)}`;
+}
+function schemaColumns(policy, resource) {
+	const node = policy.resources.get(resource);
+	const schema = node === void 0 ? null : jsonSchemaOf(node);
+	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
+	return properties !== null && typeof properties === "object" ? Object.keys(properties) : void 0;
+}
+function viewName(table, suffix) {
+	return `${table}${suffix}`;
+}
+/**
+* `<helper schema>.<table>_visible_fields`: outside the Data API's schemas,
+* so its owner rights reach clients only through the `_visible` join.
+*/
+function companionName(ctx, table) {
+	const base = table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
+	return `${helperSchema(ctx)}.${viewName(base, FIELD_VIEWS.companion)}`;
+}
+/**
+* One view per table whose read grants limit fields. A column is restricted
+* when some read allow lists fields without it or some read deny lists it;
+* every other column, and the row key, passes through unchanged.
+*/
+function fieldViews(policy, ctx, branches, options, warnings) {
+	const byTable = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.command !== "select" || branch.coverage === true) continue;
+		byTable.set(branch.table, [...byTable.get(branch.table) ?? [], branch]);
+	}
+	const views = [];
+	for (const [table, reads] of byTable) {
+		const allows = reads.filter((branch) => branch.effect === "allow" && branch.fields?.length !== 0);
+		const denies = reads.filter((branch) => branch.effect === "deny");
+		const limited = reads.some((branch) => branch.fields !== void 0);
+		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
+		if (!limited || allows.length === 0 || resource === void 0) continue;
+		const names = schemaColumns(policy, resource);
+		if (names === void 0) throw new Error(`PermDock CLI: --fields views needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
+		const key = policy.resources.get(resource)?.id ?? "id";
+		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
+		const columns = names.map((name) => {
+			quoteIdent(name);
+			return restricted(name) ? {
+				name,
+				mask: maskSql(ctx, allows, denies, name)
+			} : { name };
+		});
+		if (columns.every((column) => column.mask === void 0)) continue;
+		const view = viewName(table, FIELD_VIEWS.view);
+		if (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(key))) warnings.push(`field view ${view}: the key ${key} passes through, although a read grant on ${resource} omits it`);
+		const hidden = columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+		if (options.helpersOnly === true) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; revoke select on those columns from client roles in your own grants, or read them through a function`);
+		else if (!options.revokeColumns) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; add --revoke-columns so clients read through the view`);
+		views.push({
+			resource,
+			table,
+			view,
+			key,
+			columns,
+			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
+			...options.revokeColumns ? { companion: companionName(ctx, table) } : {}
+		});
+	}
+	return views;
+}
+/** Columns of `view`'s table that `anon` and `authenticated` keep on the base table with `--revoke-columns`. */
+function readableColumns(view) {
+	return view.columns.filter((column) => column.mask === void 0).map((column) => column.name);
+}
+function restrictedColumns(view) {
+	return view.columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+}
+function columnList(names) {
+	return names.map(quoteIdent).join(", ");
+}
+function selectList(lines) {
+	return lines.map((line) => `  ${line}`).join(",\n");
+}
+function grantView(name, roles) {
+	return [`revoke all on table ${quoteTable(qualifiedTable(name))} from anon, authenticated, public;`, `grant select on table ${quoteTable(qualifiedTable(name))} to ${roles.join(", ")};`].join("\n");
+}
+function inlineViewSql(view) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? quoteIdent(column.name) : `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteTable(qualifiedTable(view.view))} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteTable(qualifiedTable(view.table))};`;
+}
+function companionSql(view, companion) {
+	const restricted = view.columns.filter((column) => column.mask !== void 0);
+	const targets = [`${quoteIdent(view.key)} as ${quoteIdent(FIELD_VIEWS.key)}`, ...restricted.map((column) => `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`)];
+	const any = orSql(restricted.map((column) => column.mask ?? "false"));
+	const name = companion.slice(0, companion.indexOf("."));
+	const schema = quoteIdent(name);
+	return `${name === "public" ? "" : `create schema if not exists ${schema};
+revoke all on schema ${schema} from public;
+grant usage on schema ${schema} to ${view.roles.join(", ")};
+`}create or replace view ${quoteTable(qualifiedTable(companion))} with (security_barrier = true) as
+select
+${selectList(targets)}
+from ${quoteTable(qualifiedTable(view.table))}
+where ${any};
+comment on view ${quoteTable(qualifiedTable(companion))} is ${quoteLiteral(`${FIELD_VIEWS.comment} ${view.view}`)};`;
+}
+function joinedViewSql(view, companion) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? `t.${quoteIdent(column.name)}` : `f.${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteTable(qualifiedTable(view.view))} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteTable(qualifiedTable(view.table))} t
+left join ${quoteTable(qualifiedTable(companion))} f on f.${quoteIdent(FIELD_VIEWS.key)} = t.${quoteIdent(view.key)};`;
+}
+/** `select` on only the unrestricted columns (and the key) of the base table, for `--revoke-columns`. */
+function columnGrantSql(view, role) {
+	return `grant select (${columnList(readableColumns(view))}) on table ${quoteTable(qualifiedTable(view.table))} to ${role};`;
+}
+function columnRevokeSql(view) {
+	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteTable(qualifiedTable(view.table))} from anon, authenticated;`;
+}
+/**
+* The view SQL: the `security_invoker` view, and with `--revoke-columns` the
+* owner-rights companion it joins for the restricted columns. The companion
+* masks every column with the full field decision and keeps only rows where
+* one is readable, so reading it directly shows nothing `pick` would not.
+*/
+function fieldViewsSql(views) {
+	return views.map((view) => {
+		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
+		if (view.companion === void 0) return [
+			head,
+			inlineViewSql(view),
+			grantView(view.view, view.roles)
+		].join("\n");
+		return [
+			head,
+			`-- ${view.companion} reads ${view.table} as its owner; ${view.view} reads the rows as the caller and joins it`,
+			companionSql(view, view.companion),
+			grantView(view.companion, view.roles),
+			joinedViewSql(view, view.companion),
+			grantView(view.view, view.roles)
+		].join("\n");
+	}).join("\n\n");
+}
+//#endregion
+export { helpersSql as A, breakGlassHolder as B, readTableIndexFacts as C, claimKeptLines as D, accessSql as E, seedSql as F, API_KEY_ALLOWS as G, collectGrants as H, sourceFilters as I, apiKeyFields as K, sourcesKeep as L, membershipRows as M, membershipTable as N, disabledColumn as O, roleRows as P, hasCustomRoleChecksFor as R, pruneIndexTargets as S, connectPgPool as T, roleNames as U, breakGlassKey as V, contextRefs as W, permissionKeysForHelper as _, fieldViewsSql as a, indexTargets as b, assemblePolicies as c, readOnlyActorPolicies as d, branchClauses as f, permissionHelpersSql as g, tableFor as h, fieldViews as i, memberColumn as j, globalRoleRows as k, orSql as l, compileGrants as m, columnGrantSql as n, rowBranches as o, commandFor as p, apiKeysPlan as q, columnRevokeSql as r, viewName as s, FIELD_VIEWS as t, readOnlyActorKinds as u, permittedByPermissionHelper as v, connectPg as w, indexesSql as x, COLUMNS_SQL as y, globalRoleSource as z };