permdock 0.1.0 → 0.3.0

package/dist/rls-shared-Cewd_-zI.js

@@ -0,0 +1,495 @@
+import { T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+import { c as rootScope, l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.js";
+import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
+import { d as keptKeys, l as roleColumn } from "./sources-4p0-4xQm.js";
+//#region src/cli/rls-sql.ts
+const CLI = "PermDock CLI";
+const CLAIM = SQL_IDENT;
+function checkActiveRow(label, row) {
+	quoteTable(row.table);
+	quoteIdent(row.id);
+	if (row.disabledAt !== void 0) quoteIdent(row.disabledAt);
+	if (row.status !== void 0) {
+		quoteIdent(row.status);
+		if (row.active === void 0 || row.active.length === 0) throw new Error(`PermDock CLI: ${label}.status needs the active values in ${label}.active`);
+	}
+	if (row.disabledAt === void 0 && row.status === void 0) throw new Error(`PermDock CLI: ${label} needs disabledAt or status to tell an active row`);
+}
+/** Validates `rls.suspension` and keys its scopes by declared name. */
+function checkSuspension(suspension, scopes) {
+	if (suspension === void 0) return;
+	if (suspension.users !== void 0) checkActiveRow("rls.suspension.users", suspension.users);
+	const byName = {};
+	for (const [key, row] of Object.entries(suspension.scopes ?? {})) {
+		const name = resolveScope(scopes, key);
+		if (name === void 0) throw new Error(`PermDock CLI: rls.suspension.scopes.${key} names a scope the policy does not declare`);
+		checkActiveRow(`rls.suspension.scopes.${key}`, row);
+		if (row.keep !== void 0 && !Array.isArray(row.keep)) throw new Error(`PermDock CLI: rls.suspension.scopes.${key}.keep is a list of permissions or permission keys`);
+		const keep = keptKeys(row);
+		const { keep: _given, ...active } = row;
+		byName[name] = keep.length === 0 ? active : {
+			...active,
+			keep
+		};
+	}
+	const memberships = suspension.memberships;
+	if (memberships?.keep !== void 0 && !Array.isArray(memberships.keep)) throw new Error("PermDock CLI: rls.suspension.memberships.keep is a list of permissions or permission keys");
+	const keep = keptKeys(memberships);
+	return {
+		...suspension.users === void 0 ? {} : { users: suspension.users },
+		...Object.keys(byName).length === 0 ? {} : { scopes: byName },
+		...keep.length === 0 ? {} : { memberships: { keep } }
+	};
+}
+function disabledKeep(ctx) {
+	return keptKeys(ctx.suspension?.memberships);
+}
+function activeMembershipSql(ctx, disabledAt, permission = ctx.permission === void 0 ? void 0 : { key: ctx.permission }) {
+	if (disabledAt === void 0) return [];
+	const keep = disabledKeep(ctx);
+	if (permission !== void 0 && "key" in permission && keep.includes(permission.key)) return [];
+	return permission !== void 0 && "sql" in permission && keep.length > 0 ? [`(${disabledAt} is null or ${permission.sql} = any(array[${keep.map(quoteLiteral).join(", ")}]::text[]))`] : [`${disabledAt} is null`];
+}
+function keptRowSql(keep, permission) {
+	const kind = `coalesce(jsonb_typeof(${keep}), 'null')`;
+	if (permission === void 0) return `${kind} = 'null'`;
+	return `case ${kind} when 'null' then true when 'array' then ${keep} @> jsonb_build_array(${"key" in permission ? quoteLiteral(permission.key) : permission.sql}) else false end`;
+}
+/**
+* `exists` over an active row whose id column equals `id`: a missing row is
+* suspended, so the check fails closed.
+*/
+function activeRowSql(row, id) {
+	const table = quoteTable(row.table.includes(".") ? row.table : `public.${row.table}`);
+	const parts = [`s.${quoteIdent(row.id)} = ${id}`];
+	if (row.disabledAt !== void 0) parts.push(`s.${quoteIdent(row.disabledAt)} is null`);
+	if (row.status !== void 0) {
+		const values = (row.active ?? []).map(quoteLiteral).join(", ");
+		parts.push(`s.${quoteIdent(row.status)}::text = any(array[${values}]::text[])`);
+	}
+	return `exists (select 1 from ${table} s where ${parts.join(" and ")})`;
+}
+/** The active-user check for `user`; empty without `rls.suspension.users`. */
+function activeUserSql(ctx, user = subjectIdSql(ctx)) {
+	const row = ctx.suspension?.users;
+	return row === void 0 ? [] : [activeRowSql(row, user)];
+}
+/** The permission of a grant key held in `grant`: `key#group` and `key@level` name `key`. */
+function grantPermissionSql(grant) {
+	return { sql: `split_part(split_part(${grant}, '#', 1), '@', 1)` };
+}
+/**
+* The active-instance check for every suspendable scope on `scope`'s chain:
+* its own and each ancestor's. `idOf` gives the SQL for the id the membership
+* holds for a scope on that chain. A scope's `keep` lets `permission` through
+* a suspended instance: a kept key known now drops its check, and one read
+* at run time is compared with the kept keys.
+*/
+function activeInstancesSql(ctx, scope, idOf, permission = ctx.permission === void 0 ? void 0 : { key: ctx.permission }) {
+	const parts = [];
+	for (const name of scopeChain(ctx.scopes, scope)) {
+		const row = ctx.suspension?.scopes?.[name];
+		if (row === void 0) continue;
+		const id = idOf(name);
+		if (id === void 0) throw new Error(`PermDock CLI: rls.suspension.scopes.${name} needs the ${name} id on ${scope} memberships: add columns.${name} to the ${scope} memberships table`);
+		const keep = keptKeys(row);
+		if (permission !== void 0 && "key" in permission && keep.includes(permission.key)) continue;
+		const active = activeRowSql(row, `(${id})::${scopeTypeOf(ctx, name)}`);
+		parts.push(permission !== void 0 && "sql" in permission && keep.length > 0 ? `(${active} or ${permission.sql} = any(array[${keep.map(quoteLiteral).join(", ")}]::text[]))` : active);
+	}
+	return parts;
+}
+const SQL_TYPE = /^[A-Za-z_][A-Za-z0-9_]*( [A-Za-z_][A-Za-z0-9_]*)*(\[\])?$/u;
+function sqlType(name) {
+	if (!SQL_TYPE.test(name)) throw new Error(`PermDock CLI: unsafe SQL type '${name}'`);
+	return name;
+}
+function tenantTypeOf(ctx) {
+	return sqlType(ctx.tenantType ?? "uuid");
+}
+function teamTypeOf(ctx) {
+	return sqlType(ctx.teamType ?? ctx.tenantType ?? "uuid");
+}
+/** Postgres type of scope `name`'s id: `scopeTypes`, then the tenant / team type by position. */
+function scopeTypeOf(ctx, name) {
+	const declared = ctx.scopeTypes?.[name];
+	if (declared !== void 0) return sqlType(declared);
+	return name === ctx.scopes[1]?.name ? teamTypeOf(ctx) : tenantTypeOf(ctx);
+}
+function viaAllowed(value, allowed) {
+	return allowed.includes(value ?? "");
+}
+/**
+* A role with `for` counts only on a membership of one of those kinds:
+* `case role when 'admin' then via = any(...) ... else true end`. A missing
+* kind (`viaExpr` null) holds none of them. A constant kind folds into the
+* roles it excludes, or no filter. `undefined` when nothing is filtered.
+*/
+function kindFilterSql(ctx, roleExpr, viaExpr) {
+	const kinds = Object.entries(ctx.ownership?.kinds ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
+	if (kinds.length === 0) return;
+	if (typeof viaExpr !== "string") {
+		const excluded = kinds.filter(([, allowed]) => !viaAllowed(viaExpr.value, allowed)).map(([role]) => role);
+		return excluded.length === 0 ? void 0 : `not (${roleExpr} = any(array[${excluded.map(quoteLiteral).join(", ")}]::text[]))`;
+	}
+	return `case ${roleExpr} ${kinds.map(([role, allowed]) => `when ${quoteLiteral(role)} then coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`).join(" ")} else true end`;
+}
+/** The kind check for one known role; `undefined` when it has no `for` or a constant kind it allows. */
+function roleKindSql(ctx, role, viaExpr) {
+	const allowed = ctx.ownership?.kinds[role];
+	if (allowed === void 0) return;
+	if (typeof viaExpr !== "string") return viaAllowed(viaExpr.value, allowed) ? void 0 : "false";
+	return `coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`;
+}
+/** Roles with `for` held globally (no membership, so no kind) grant nothing. */
+function globalKindFilterSql(ctx, roleExpr) {
+	const roles = Object.keys(ctx.ownership?.kinds ?? {}).toSorted();
+	return roles.length === 0 ? void 0 : `not (${roleExpr} = any(array[${roles.map(quoteLiteral).join(", ")}]::text[]))`;
+}
+/** The closure table graph grants read. Part of the SQL contract. */
+const CLOSURE = { table: "permdock_closure" };
+/**
+* The snake_case SQL name of a resource or link (`chatThread` becomes
+* `chat_thread`), or `undefined` when it is not made of ASCII letters,
+* digits and underscores starting with a letter.
+*/
+function graphSqlName(name) {
+	if (!/^[A-Za-z][A-Za-z0-9_]*$/u.test(name)) return;
+	return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1_$2").replaceAll(/([A-Z]+)([A-Z][a-z])/gu, "$1_$2").toLowerCase();
+}
+function sqlNameOf(name, label) {
+	const sql = graphSqlName(name);
+	if (sql === void 0) throw new Error(`PermDock CLI: ${label} is not a SQL name (letters, digits and underscores, starting with a letter), so rls generate cannot name its helper`);
+	return sql;
+}
+/** The helper returning the ids of `resource` the subject holds a relation on: `permitted_<snake_case resource>_ids`. */
+function graphHelper(resource) {
+	return permittedIdsHelper(sqlNameOf(resource, `resource '${resource}'`));
+}
+function inheritedRowsHelper(resource) {
+	return `permitted_${sqlNameOf(resource, `resource '${resource}'`)}_rows`;
+}
+/** The helper returning the ids of `resource` whose `link` points into the ids it is given. */
+function linkHelper(resource, link) {
+	return `permdock_link_${sqlNameOf(resource, `resource '${resource}'`)}_${sqlNameOf(link, `link '${link}' on ${resource}`)}`;
+}
+function restrictedHelper(resource) {
+	return `permdock_restricted_${sqlNameOf(resource, `resource '${resource}'`)}`;
+}
+/** Graph SQL parts as RLS text: values inline as literals, the subject from the dialect's claim. */
+function graphSqlText(parts, ctx) {
+	return parts.map((part) => {
+		if ("text" in part) return part.text;
+		if ("column" in part) return quoteIdent(part.column);
+		if ("subject" in part) return subjectIdSql(ctx);
+		return typeof part.value === "string" ? quoteLiteral(part.value) : String(part.value);
+	}).join("");
+}
+/**
+* The role column of an `rls.memberships` table aliased `alias`; a `through`
+* column joins its roles table as `<alias>k`, after a newline and `indent`
+* (inline without one).
+*/
+function memberRoleOf(table, alias = "m", indent) {
+	return roleColumn(table.role, qualifiedTable(table.table), alias, {
+		label: `rls.memberships ${table.table} role`,
+		prefix: CLI,
+		...indent === void 0 ? {} : { indent }
+	});
+}
+/** The schema-qualified name of a table under `search_path = ''`. */
+function qualifiedTable(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+/** The helper returning the ids of scope `name` a grant key reaches. */
+function permittedIdsHelper(name) {
+	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw new Error(`PermDock CLI: unsafe scope name '${name}'`);
+	return `permitted_${name}_ids`;
+}
+/** `permitted_<scope>_ids_for(p_user, p_grant)`: the same ids for a user the caller names. */
+function permittedForHelper(name) {
+	return `${permittedIdsHelper(name)}_for`;
+}
+/** The helper returning the ids of scope `name` the subject holds any live membership of. */
+function memberIdsHelper(name) {
+	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw new Error(`PermDock CLI: unsafe scope name '${name}'`);
+	return `member_${name}_ids`;
+}
+/** `member_<scope>_ids_for(p_user uuid)`: the same rows for a user the caller names; the token hook's helper. */
+function memberForHelper(name) {
+	return `${memberIdsHelper(name)}_for`;
+}
+/**
+* Whether `member_<scope>_ids_for` is generated for `name`: Supabase only
+* (its one caller is `supabase_auth_admin`), and only where `memberships` maps
+* a table for the scope or a membership source can hold it.
+*/
+function hasMemberFor(input, name) {
+	if (input.dialect !== "supabase") return false;
+	return memberForTable(input, name) !== void 0 || memberForSources(input, name).length > 0;
+}
+/** The table `member_<scope>_ids_for` reads for scope `name`, when `memberships` maps one with its id column. */
+function memberForTable(input, name) {
+	const table = scopeMembershipTable(input.memberships, input.scopes, name);
+	return table !== void 0 && scopeColumn(table, input.scopes, name) !== void 0 ? table : void 0;
+}
+/** The sources `member_<scope>_ids_for` reads: none when a table is mapped, as in `database` mode. */
+function memberForSources(input, name) {
+	if (memberForTable(input, name) !== void 0) return [];
+	return (input.memberSources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
+}
+/**
+* The membership sources that can hold scope `name` when `memberships` maps
+* no table for it: every `fromTable` source and the `fromJunction` sources of
+* that scope. Empty outside `database` mode.
+*/
+function scopeSources(ctx, name) {
+	if (ctx.authorize !== "database" || scopeTable(ctx, name) !== void 0) return [];
+	return (ctx.sources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
+}
+/** The membership table mapped for scope `name`, with the column of its id and of the first scope's id. */
+function scopeTable(ctx, name) {
+	const table = scopeMembershipTable(ctx.memberships, ctx.scopes, name);
+	if (table === void 0) return;
+	const column = scopeColumn(table, ctx.scopes, name);
+	if (column === void 0) return;
+	const root = rootScope(ctx.scopes);
+	const tenantColumn = root !== void 0 && scopeChain(ctx.scopes, name).includes(root) ? scopeColumn(table, ctx.scopes, root) : void 0;
+	return tenantColumn === void 0 ? {
+		table,
+		column
+	} : {
+		table,
+		column,
+		tenantColumn
+	};
+}
+function keyTenantSql(ctx, tenant) {
+	const keys = ctx.apiKeys;
+	if (keys === void 0) return;
+	const named = `nullif(${subjectClaimJsonSql(ctx, keys.claim)} ->> ${quoteLiteral(keys.tenant)}, '')`;
+	return tenant === void 0 ? `${named} is null` : `(${named} is null or (${tenant})::text = ${named})`;
+}
+/** The active-tenant claim cast to the tenant column's type, so the comparison uses the column's index. */
+function tenantClaimSql(ctx) {
+	return `${subjectClaimSql(ctx, ctx.tenantClaim)}::${tenantTypeOf(ctx)}`;
+}
+function quoteIdent(name) {
+	return quoteSqlIdent(name, CLI);
+}
+function quoteTable(name) {
+	return quoteSqlTable(name, CLI);
+}
+/** The membership kind of a row `m` of `table`: its column as text, or its constant (`null` without one). */
+function memberVia(table) {
+	const via = table.via;
+	if (via === void 0) return { value: null };
+	return typeof via === "string" ? `m.${quoteIdent(via)}::text` : { value: via.value };
+}
+function quoteLiteral(value) {
+	return quoteSqlLiteral(value);
+}
+const USER_ID_HELPER = "permdock_user_id";
+function userIdHelperSql(ctx) {
+	return `${quoteIdent(ctx.schema ?? "permdock")}.${USER_ID_HELPER}`;
+}
+const SESSION_LIVE_HELPER = "permdock_session_live";
+/** `{ subject: { session: { live: true } } }` in a policy; only Supabase has `auth.sessions`. */
+function liveSessionSql(ctx) {
+	if (ctx.dialect !== "supabase") throw new Error(`PermDock CLI: { subject: { session: { live: true } } } reads auth.sessions, which only the supabase dialect has (got ${ctx.dialect})`);
+	return `(select ${quoteIdent(ctx.schema ?? "permdock")}.${SESSION_LIVE_HELPER}())`;
+}
+/**
+* `permdock_session_live()`: the token's `session_id` names a session of its
+* user that is still in `auth.sessions`, so a signed-out or revoked session
+* stops passing before the token's `exp`. A token without one, such as a
+* service key's, is never live.
+*/
+function sessionLiveHelperSql(ctx) {
+	const name = `${quoteIdent(ctx.schema ?? "permdock")}.${SESSION_LIVE_HELPER}`;
+	return `create or replace function ${name}()
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_session uuid;
+begin
+  begin
+    v_session := nullif((select auth.jwt()) ->> 'session_id', '')::uuid;
+  exception when invalid_text_representation then
+    return false;
+  end;
+  if v_session is null then
+    return false;
+  end if;
+  return exists (
+    select 1
+    from auth.sessions s
+    where s.id = v_session
+      and s.user_id::text = ${subjectIdSql(ctx)}::text
+      and (s.not_after is null or s.not_after > now())
+  );
+end;
+$$;
+revoke execute on function ${name}() from public, anon;
+grant execute on function ${name}() to authenticated;
+`;
+}
+function subjectIdSql(ctx) {
+	if (ctx.subjectId !== void 0) return ctx.subjectId;
+	switch (ctx.dialect) {
+		case "supabase": return `(select ${userIdHelperSql(ctx)}())`;
+		case "neon": return "(select auth.user_id())";
+		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.user_id`)}, true))`;
+		default: return ctx.dialect;
+	}
+}
+function subjectClaimSql(ctx, claim) {
+	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
+	switch (ctx.dialect) {
+		case "supabase": return `((select auth.jwt()) ->> ${quoteLiteral(claim)})`;
+		case "neon": return `((select auth.session()) ->> ${quoteLiteral(claim)})`;
+		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true))`;
+		default: return ctx.dialect;
+	}
+}
+/** A claim as `jsonb`; the `guc` dialect stores JSON text in `<prefix>.<claim>`. */
+function subjectClaimJsonSql(ctx, claim) {
+	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
+	switch (ctx.dialect) {
+		case "supabase": return `((select auth.jwt()) -> ${quoteLiteral(claim)})`;
+		case "neon": return `((select auth.session()) -> ${quoteLiteral(claim)})`;
+		case "guc": return `nullif((select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true)), '')::jsonb`;
+		default: return ctx.dialect;
+	}
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
+function columnTypeOf(property) {
+	if (!isRecord(property)) return;
+	const variants = [property["anyOf"], property["oneOf"]].find(Array.isArray);
+	if (variants !== void 0) {
+		const present = variants.filter((item) => !(isRecord(item) && item["type"] === "null"));
+		return present.length === 1 ? columnTypeOf(present[0]) : void 0;
+	}
+	const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
+	if (types.length !== 1) return;
+	switch (types[0]) {
+		case "integer":
+		case "number": return "numeric";
+		case "boolean": return "boolean";
+		case "string": switch (property["format"]) {
+			case "date-time": return "timestamptz";
+			case "date": return "date";
+			case "uuid": return "uuid";
+			default: return;
+		}
+		default: return;
+	}
+}
+/**
+* Column types from a resource's JSON Schema (`~standard.jsonSchema`): numbers
+* compare as `numeric`, booleans as `boolean`, and `date-time`, `date` and
+* `uuid` strings as `timestamptz`, `date` and `uuid`. Other columns are left
+* out and compare as text.
+*/
+function columnTypesOf(schema) {
+	const properties = isRecord(schema) ? schema["properties"] : void 0;
+	if (!isRecord(properties)) return {};
+	const types = {};
+	for (const [name, property] of Object.entries(properties)) {
+		const type = isForbiddenKey(name) ? void 0 : columnTypeOf(property);
+		if (type !== void 0) types[name] = type;
+	}
+	return types;
+}
+/**
+* Array columns from a resource's JSON Schema, each with the type its items
+* compare as (`text` when `columnTypesOf` would leave the item out).
+*/
+function arrayColumnsOf(schema) {
+	const properties = isRecord(schema) ? schema["properties"] : void 0;
+	if (!isRecord(properties)) return {};
+	const arrays = {};
+	for (const [name, property] of Object.entries(properties)) {
+		if (isForbiddenKey(name) || !isRecord(property)) continue;
+		const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
+		if (types.length === 1 && types[0] === "array") arrays[name] = columnTypeOf(property["items"]) ?? "text";
+	}
+	return arrays;
+}
+function parseMembershipsFlag(raw) {
+	if (raw === void 0 || raw === "") return;
+	const colon = raw.indexOf(":");
+	const table = colon === -1 ? raw : raw.slice(0, colon);
+	const cols = (colon === -1 ? "" : raw.slice(colon + 1)).split(",").map((item) => item.trim()).filter((item) => item !== "");
+	return { tenant: {
+		table,
+		tenant: cols[0] ?? "tenant_id",
+		user: cols[1] ?? "user_id",
+		role: cols[2] ?? "role",
+		...cols[3] === void 0 ? {} : { expiresAt: cols[3] }
+	} };
+}
+//#endregion
+//#region src/cli/rls-shared.ts
+/**
+* The per-statement helpers every generated policy calls: `permdock_has` for
+* global roles and one `permitted_<scope>_ids` per scope
+* (`permittedIdsHelper`). Names are part of the SQL contract.
+*/
+const HELPERS = {
+	has: "permdock_has",
+	hasFor: "permdock_has_for"
+};
+/** Objects `--custom-roles` adds next to the helpers. Names are part of the SQL contract. */
+const CUSTOM_ROLES = {
+	permissions: "custom_role_permissions",
+	includes: "custom_role_includes",
+	ceiling: "permdock_ceiling",
+	keys: "permdock_custom_keys",
+	beyond: "permdock_custom_role_beyond",
+	guard: "permdock_custom_role_guard",
+	beyondFor: "permdock_custom_role_beyond_for",
+	guardFor: "permdock_custom_role_guard_for",
+	shape: "permdock_custom_role_shape",
+	entries: "permdock_custom_role_entries",
+	replace: "permdock_replace_custom_role_grants",
+	rename: "permdock_rename_custom_role_grants",
+	remove: "permdock_delete_custom_role_grants",
+	trustedReplace: "permdock_trusted_replace_custom_role_grants",
+	trustedRename: "permdock_trusted_rename_custom_role_grants",
+	trustedRemove: "permdock_trusted_delete_custom_role_grants",
+	cascade: "permdock_cascade_custom_role"
+};
+/** The function `rls.roles` adds. The name is part of the SQL contract. */
+const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
+function helperSchema(ctx) {
+	return ctx.schema ?? "permdock";
+}
+function qualified(ctx, name) {
+	return `${quoteIdent(helperSchema(ctx))}.${name}`;
+}
+/** `user` is the SQL for the user id: the dialect's (the default) or the `p_user` parameter of a `_for` helper. */
+function signedIn(ctx, user = subjectIdSql(ctx)) {
+	return `coalesce(${user}::text, '') <> ''`;
+}
+function rootName(ctx) {
+	return ctx.scopes[0]?.name ?? "tenant";
+}
+/** The stored allow as `permissions` hands it to `permdock_custom_keys`: `key`, or `key@level` with levels. */
+function allowEntry(ctx) {
+	return ctx.customRoles?.levels === true ? "permission || coalesce('@' || c.level, '')" : "permission";
+}
+function textArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
+}
+//#endregion
+export { sessionLiveHelperSql as $, keptRowSql as A, memberVia as B, grantPermissionSql as C, hasMemberFor as D, graphSqlText as E, memberForHelper as F, quoteIdent as G, permittedForHelper as H, memberForSources as I, restrictedHelper as J, quoteLiteral as K, memberForTable as L, kindFilterSql as M, linkHelper as N, inheritedRowsHelper as O, liveSessionSql as P, scopeTypeOf as Q, memberIdsHelper as R, globalKindFilterSql as S, graphSqlName as T, permittedIdsHelper as U, parseMembershipsFlag as V, qualifiedTable as W, scopeSources as X, roleKindSql as Y, scopeTable as Z, activeUserSql as _, helperSchema as a, tenantTypeOf as at, columnTypesOf as b, signedIn as c, CLOSURE as d, sqlType as et, SESSION_LIVE_HELPER as f, activeRowSql as g, activeMembershipSql as h, allowEntry as i, tenantClaimSql as it, keyTenantSql as j, isRecord as k, textArray as l, activeInstancesSql as m, GLOBAL_ROLES as n, subjectClaimSql as nt, qualified as o, userIdHelperSql as ot, USER_ID_HELPER as p, quoteTable as q, HELPERS as r, subjectIdSql as rt, rootName as s, CUSTOM_ROLES as t, subjectClaimJsonSql as tt, CLAIM as u, arrayColumnsOf as v, graphHelper as w, disabledKeep as x, checkSuspension as y, memberRoleOf as z };