permdock 0.1.0 → 0.3.0

package/dist/rls-helpers-BxRuif0l.js

@@ -1,1346 +0,0 @@
-import { n as isReadonlyArray, r as sole } from "./compact-y6vfu2_f.js";
-import { S as isForbiddenKey } from "./permissions-DC7GROPA.js";
-import { l as isSqlFunctionField } from "./refs-ChLSxbST.js";
-import { a as resolveScope, c as scopeChain, s as rootScope } from "./scopes-cKVp_WTw.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as scopeMembershipTable, o as relatedSql, r as scopeColumn } from "./compile-D22iwvuV.js";
-import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent, t as SQL_IDENT } from "./sql-Bll1d7y0.js";
-import "./sources-DVHM3Mwq.js";
-//#region src/cli/rls-sql.ts
-const CLI = "PermDock CLI";
-const CLAIM = SQL_IDENT;
-function checkActiveRow(label, row) {
-	quoteTable(row.table);
-	quoteIdent(row.id);
-	if (row.disabledAt !== void 0) quoteIdent(row.disabledAt);
-	if (row.status !== void 0) {
-		quoteIdent(row.status);
-		if (row.active === void 0 || row.active.length === 0) throw new Error(`PermDock CLI: ${label}.status needs the active values in ${label}.active`);
-	}
-	if (row.disabledAt === void 0 && row.status === void 0) throw new Error(`PermDock CLI: ${label} needs disabledAt or status to tell an active row`);
-}
-/** Validates `rls.suspension` and keys its scopes by declared name. */
-function checkSuspension(suspension, scopes) {
-	if (suspension === void 0) return;
-	if (suspension.users !== void 0) checkActiveRow("rls.suspension.users", suspension.users);
-	const byName = {};
-	for (const [key, row] of Object.entries(suspension.scopes ?? {})) {
-		const name = resolveScope(scopes, key);
-		if (name === void 0) throw new Error(`PermDock CLI: rls.suspension.scopes.${key} names a scope the policy does not declare`);
-		checkActiveRow(`rls.suspension.scopes.${key}`, row);
-		byName[name] = row;
-	}
-	return {
-		...suspension.users === void 0 ? {} : { users: suspension.users },
-		...Object.keys(byName).length === 0 ? {} : { scopes: byName }
-	};
-}
-/**
-* `exists` over an active row whose id column equals `id`: a missing row is
-* suspended, so the check fails closed.
-*/
-function activeRowSql(row, id) {
-	const table = quoteTable(row.table.includes(".") ? row.table : `public.${row.table}`);
-	const parts = [`s.${quoteIdent(row.id)} = ${id}`];
-	if (row.disabledAt !== void 0) parts.push(`s.${quoteIdent(row.disabledAt)} is null`);
-	if (row.status !== void 0) {
-		const values = (row.active ?? []).map(quoteLiteral).join(", ");
-		parts.push(`s.${quoteIdent(row.status)}::text = any(array[${values}]::text[])`);
-	}
-	return `exists (select 1 from ${table} s where ${parts.join(" and ")})`;
-}
-/** The active-user check for `user`; empty without `rls.suspension.users`. */
-function activeUserSql(ctx, user = subjectIdSql(ctx)) {
-	const row = ctx.suspension?.users;
-	return row === void 0 ? [] : [activeRowSql(row, user)];
-}
-/**
-* The active-instance check for every suspendable scope on `scope`'s chain:
-* its own and each ancestor's. `idOf` gives the SQL for the id the membership
-* holds for a scope on that chain.
-*/
-function activeInstancesSql(ctx, scope, idOf) {
-	const parts = [];
-	for (const name of scopeChain(ctx.scopes, scope)) {
-		const row = ctx.suspension?.scopes?.[name];
-		if (row === void 0) continue;
-		const id = idOf(name);
-		if (id === void 0) throw new Error(`PermDock CLI: rls.suspension.scopes.${name} needs the ${name} id on ${scope} memberships: add columns.${name} to the ${scope} memberships table`);
-		parts.push(activeRowSql(row, `(${id})::${scopeTypeOf(ctx, name)}`));
-	}
-	return parts;
-}
-const SQL_TYPE = /^[A-Za-z_][A-Za-z0-9_]*( [A-Za-z_][A-Za-z0-9_]*)*(\[\])?$/u;
-function sqlType(name) {
-	if (!SQL_TYPE.test(name)) throw new Error(`PermDock CLI: unsafe SQL type '${name}'`);
-	return name;
-}
-function tenantTypeOf(ctx) {
-	return sqlType(ctx.tenantType ?? "uuid");
-}
-function teamTypeOf(ctx) {
-	return sqlType(ctx.teamType ?? ctx.tenantType ?? "uuid");
-}
-/** Postgres type of scope `name`'s id: `scopeTypes`, then the tenant / team type by position. */
-function scopeTypeOf(ctx, name) {
-	const declared = ctx.scopeTypes?.[name];
-	if (declared !== void 0) return sqlType(declared);
-	return name === ctx.scopes[1]?.name ? teamTypeOf(ctx) : tenantTypeOf(ctx);
-}
-/**
-* A role with `for` counts only on a membership of one of those kinds:
-* `case role when 'admin' then via = any(...) ... else true end`. A missing
-* kind (`viaExpr` null) holds none of them. `undefined` when no role has `for`.
-*/
-function kindFilterSql(ctx, roleExpr, viaExpr) {
-	const kinds = Object.entries(ctx.ownership?.kinds ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
-	if (kinds.length === 0) return;
-	return `case ${roleExpr} ${kinds.map(([role, allowed]) => `when ${quoteLiteral(role)} then coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`).join(" ")} else true end`;
-}
-/** The kind check for one known role; `undefined` when it has no `for`. */
-function roleKindSql(ctx, role, viaExpr) {
-	const allowed = ctx.ownership?.kinds[role];
-	return allowed === void 0 ? void 0 : `coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`;
-}
-/** Roles with `for` held globally (no membership, so no kind) grant nothing. */
-function globalKindFilterSql(ctx, roleExpr) {
-	const roles = Object.keys(ctx.ownership?.kinds ?? {}).toSorted();
-	return roles.length === 0 ? void 0 : `not (${roleExpr} = any(array[${roles.map(quoteLiteral).join(", ")}]::text[]))`;
-}
-/** The closure table graph grants read. Part of the SQL contract. */
-const CLOSURE = { table: "permdock_closure" };
-/** The helper returning the ids of `resource` the subject holds a relation on. */
-function graphHelper(resource) {
-	return permittedIdsHelper(resource);
-}
-/** The helper returning the ids of `resource` whose `link` points into the ids it is given. */
-function linkHelper(resource, link) {
-	if (!/^[a-z][a-z0-9_]*$/u.test(link)) throw new Error(`PermDock CLI: link '${link}' on ${resource} is not a lowercase SQL name, so rls generate cannot name its helper`);
-	permittedIdsHelper(resource);
-	return `permdock_link_${resource}_${link}`;
-}
-/** Graph SQL parts as RLS text: values inline as literals, the subject from the dialect's claim. */
-function graphSqlText(parts, ctx) {
-	return parts.map((part) => {
-		if ("text" in part) return part.text;
-		if ("column" in part) return quoteIdent(part.column);
-		if ("subject" in part) return subjectIdSql(ctx);
-		return typeof part.value === "string" ? quoteLiteral(part.value) : String(part.value);
-	}).join("");
-}
-/** The schema-qualified name of a table under `search_path = ''`. */
-function qualifiedTable(name) {
-	return name.includes(".") ? name : `public.${name}`;
-}
-/** The helper returning the ids of scope `name` a grant key reaches. */
-function permittedIdsHelper(name) {
-	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw new Error(`PermDock CLI: unsafe scope name '${name}'`);
-	return `permitted_${name}_ids`;
-}
-/** The helper returning the ids of scope `name` the subject holds any live membership of. */
-function memberIdsHelper(name) {
-	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw new Error(`PermDock CLI: unsafe scope name '${name}'`);
-	return `member_${name}_ids`;
-}
-/** `member_<scope>_ids_for(p_user uuid)`: the same rows for a user the caller names; the token hook's helper. */
-function memberForHelper(name) {
-	return `${memberIdsHelper(name)}_for`;
-}
-/**
-* Whether `member_<scope>_ids_for` is generated for `name`: Supabase only
-* (its one caller is `supabase_auth_admin`), and only where `memberships` maps
-* a table for the scope or a membership source can hold it.
-*/
-function hasMemberFor(input, name) {
-	if (input.dialect !== "supabase") return false;
-	return memberForTable(input, name) !== void 0 || memberForSources(input, name).length > 0;
-}
-/** The table `member_<scope>_ids_for` reads for scope `name`, when `memberships` maps one with its id column. */
-function memberForTable(input, name) {
-	const table = scopeMembershipTable(input.memberships, input.scopes, name);
-	return table !== void 0 && scopeColumn(table, input.scopes, name) !== void 0 ? table : void 0;
-}
-/** The sources `member_<scope>_ids_for` reads: none when a table is mapped, as in `database` mode. */
-function memberForSources(input, name) {
-	if (memberForTable(input, name) !== void 0) return [];
-	return (input.memberSources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
-}
-/**
-* The membership sources that can hold scope `name` when `memberships` maps
-* no table for it: every `fromTable` source and the `fromJunction` sources of
-* that scope. Empty outside `database` mode.
-*/
-function scopeSources(ctx, name) {
-	if (ctx.authorize !== "database" || scopeTable(ctx, name) !== void 0) return [];
-	return (ctx.sources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
-}
-/** The membership table mapped for scope `name`, with the column of its id and of the first scope's id. */
-function scopeTable(ctx, name) {
-	const table = scopeMembershipTable(ctx.memberships, ctx.scopes, name);
-	if (table === void 0) return;
-	const column = scopeColumn(table, ctx.scopes, name);
-	if (column === void 0) return;
-	const root = rootScope(ctx.scopes);
-	const tenantColumn = root !== void 0 && scopeChain(ctx.scopes, name).includes(root) ? scopeColumn(table, ctx.scopes, root) : void 0;
-	return tenantColumn === void 0 ? {
-		table,
-		column
-	} : {
-		table,
-		column,
-		tenantColumn
-	};
-}
-/** The active-tenant claim cast to the tenant column's type, so the comparison uses the column's index. */
-function tenantClaimSql(ctx) {
-	return `${subjectClaimSql(ctx, ctx.tenantClaim)}::${tenantTypeOf(ctx)}`;
-}
-function quoteIdent(name) {
-	return quoteSqlIdent(name, CLI);
-}
-function quoteTable(name) {
-	return quoteSqlTable(name, CLI);
-}
-function quoteLiteral(value) {
-	return quoteSqlLiteral(value);
-}
-function subjectIdSql(ctx) {
-	switch (ctx.dialect) {
-		case "supabase": return "(select auth.uid())";
-		case "neon": return "(select auth.user_id())";
-		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.user_id`)}, true))`;
-		default: return ctx.dialect;
-	}
-}
-function subjectClaimSql(ctx, claim) {
-	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
-	switch (ctx.dialect) {
-		case "supabase": return `((select auth.jwt()) ->> ${quoteLiteral(claim)})`;
-		case "neon": return `((select auth.session()) ->> ${quoteLiteral(claim)})`;
-		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true))`;
-		default: return ctx.dialect;
-	}
-}
-/** A claim as `jsonb`; the `guc` dialect stores JSON text in `<prefix>.<claim>`. */
-function subjectClaimJsonSql(ctx, claim) {
-	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
-	switch (ctx.dialect) {
-		case "supabase": return `((select auth.jwt()) -> ${quoteLiteral(claim)})`;
-		case "neon": return `((select auth.session()) -> ${quoteLiteral(claim)})`;
-		case "guc": return `nullif((select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true)), '')::jsonb`;
-		default: return ctx.dialect;
-	}
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
-function columnTypeOf(property) {
-	if (!isRecord(property)) return;
-	const variants = [property["anyOf"], property["oneOf"]].find(Array.isArray);
-	if (variants !== void 0) {
-		const present = variants.filter((item) => !(isRecord(item) && item["type"] === "null"));
-		return present.length === 1 ? columnTypeOf(present[0]) : void 0;
-	}
-	const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
-	if (types.length !== 1) return;
-	switch (types[0]) {
-		case "integer":
-		case "number": return "numeric";
-		case "boolean": return "boolean";
-		case "string": switch (property["format"]) {
-			case "date-time": return "timestamptz";
-			case "date": return "date";
-			case "uuid": return "uuid";
-			default: return;
-		}
-		default: return;
-	}
-}
-/**
-* Column types from a resource's JSON Schema (`~standard.jsonSchema`): numbers
-* compare as `numeric`, booleans as `boolean`, and `date-time`, `date` and
-* `uuid` strings as `timestamptz`, `date` and `uuid`. Other columns are left
-* out and compare as text.
-*/
-function columnTypesOf(schema) {
-	const properties = isRecord(schema) ? schema["properties"] : void 0;
-	if (!isRecord(properties)) return {};
-	const types = {};
-	for (const [name, property] of Object.entries(properties)) {
-		const type = isForbiddenKey(name) ? void 0 : columnTypeOf(property);
-		if (type !== void 0) types[name] = type;
-	}
-	return types;
-}
-/**
-* Array columns from a resource's JSON Schema, each with the type its items
-* compare as (`text` when `columnTypesOf` would leave the item out).
-*/
-function arrayColumnsOf(schema) {
-	const properties = isRecord(schema) ? schema["properties"] : void 0;
-	if (!isRecord(properties)) return {};
-	const arrays = {};
-	for (const [name, property] of Object.entries(properties)) {
-		if (isForbiddenKey(name) || !isRecord(property)) continue;
-		const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
-		if (types.length === 1 && types[0] === "array") arrays[name] = columnTypeOf(property["items"]) ?? "text";
-	}
-	return arrays;
-}
-const MAX_CLAIM_DEPTH = 8;
-/**
-* The claim path of a `principal.claim.*` / `principal.claims.*` ref, one
-* segment per JSON key; `undefined` for any other ref.
-*/
-function claimPath(ref) {
-	const prefix = ["principal.claim.", "principal.claims."].find((item) => ref.startsWith(item));
-	if (prefix === void 0) return;
-	const segments = ref.slice(prefix.length).split(".");
-	if (segments.length > MAX_CLAIM_DEPTH) throw new Error(`PermDock CLI: claim path '${ref}' is deeper than ${MAX_CLAIM_DEPTH}`);
-	for (const segment of segments) if (!CLAIM.test(segment) || isForbiddenKey(segment)) throw new Error(`PermDock CLI: unsafe claim name '${segment}'`);
-	return segments;
-}
-function jsonPath(base, keys, last) {
-	let sql = base;
-	for (const [index, key] of keys.entries()) sql += ` ${index === keys.length - 1 ? last : "->"} ${quoteLiteral(key)}`;
-	return sql;
-}
-/**
-* The JSON document a claim path starts from and the keys to walk in it. The
-* `guc` dialect keeps each top-level claim in its own setting as JSON text.
-*/
-function claimRoot(ctx, path) {
-	const [head, ...rest] = path;
-	if (head === void 0) throw new Error("PermDock CLI: empty claim path");
-	switch (ctx.dialect) {
-		case "supabase": return {
-			root: "(select auth.jwt())",
-			keys: path
-		};
-		case "neon": return {
-			root: "(select auth.session())",
-			keys: path
-		};
-		case "guc": return {
-			root: subjectClaimJsonSql(ctx, head),
-			keys: rest
-		};
-		default: return ctx.dialect;
-	}
-}
-/** The claim at `path` as `jsonb`. */
-function claimJsonSql(ctx, path) {
-	const { root, keys } = claimRoot(ctx, path);
-	return keys.length === 0 ? root : `(${jsonPath(root, keys, "->")})`;
-}
-/** The claim at `path` as text: `->>` on the last key, or the plain setting for a one-segment `guc` claim. */
-function claimTextSql(ctx, path) {
-	const [head] = path;
-	if (path.length === 1 && head !== void 0) return subjectClaimSql(ctx, head);
-	const { root, keys } = claimRoot(ctx, path);
-	return `(${jsonPath(root, keys, "->>")})`;
-}
-/** The JSON kind a claim must have to compare with a column of `type`. */
-function jsonKindOf(type) {
-	if (type === "numeric") return "number";
-	return type === "boolean" ? "boolean" : "string";
-}
-/**
-* A claim compared with a column of `type`. Numbers and booleans must be JSON
-* of that kind (anything else is `null`, so the comparison is false, as in
-* memory); other types cast the text form. A one-segment `guc` claim is text
-* and is cast as is.
-*/
-function typedClaimSql(ctx, path, type) {
-	const text = claimTextSql(ctx, path);
-	if (type === void 0 || type === "text") return text;
-	const cast = `${text}::${sqlType(type)}`;
-	const kind = jsonKindOf(type);
-	if (kind === "string" || ctx.dialect === "guc" && path.length === 1) return `(${cast})`;
-	return `(case when jsonb_typeof(${claimJsonSql(ctx, path)}) = '${kind}' then ${cast} end)`;
-}
-/**
-* The elements of an array claim as a Postgres array of the column's type,
-* built once per statement (an uncorrelated `array(select ...)` is an InitPlan).
-* A missing or non-array claim is the empty array; elements of another JSON
-* kind are left out.
-*/
-function claimArraySql(ctx, path, type) {
-	const json = claimJsonSql(ctx, path);
-	return `array(select ${type === void 0 || type === "text" ? `(e #>> '{}')` : `(e #>> '{}')::${sqlType(type)}`} from jsonb_array_elements(case when jsonb_typeof(${json}) = 'array' then ${json} else '[]'::jsonb end) e where jsonb_typeof(e) = '${jsonKindOf(type)}')`;
-}
-function sqlValue(value, ctx, field) {
-	if (value !== null && typeof value === "object" && "ref" in value) return compileRef(value.ref, ctx, field);
-	if (value !== null && typeof value === "object" && "date" in value) return quoteLiteral(value.date);
-	if (isReadonlyArray(value)) return `array[${value.map((item) => sqlValue(item, ctx)).join(", ")}]`;
-	if (value === null) return "null";
-	if (typeof value === "boolean") return value ? "true" : "false";
-	if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
-	if (typeof value === "string") return quoteLiteral(value);
-	throw new Error("PermDock CLI: non-portable condition value");
-}
-function compileRef(ref, ctx, field) {
-	if (ref === "principal.id") return subjectIdSql(ctx);
-	if (ref === "now") return "now()";
-	const path = claimPath(ref);
-	if (ref === "principal.tenant" || path?.length === 1 && path[0] === ctx.tenantClaim) return tenantClaimSql(ctx);
-	if (path !== void 0) return typedClaimSql(ctx, path, field === void 0 ? void 0 : ctx.columnTypes?.[field]);
-	if (ref === "context" || ref.startsWith("context.")) throw new Error(`PermDock CLI: '${ref}' is request context, which is not in the token; RLS cannot read it (permdock doctor PD027)`);
-	throw new Error(`PermDock CLI: non-portable subject ref '${ref}'`);
-}
-/** `value` with `\`, `%` and `_` escaped for `like ... escape '\'`, as `escapeLike` does in process. */
-function likeLiteralSql(value) {
-	return `replace(replace(replace(${value}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`;
-}
-function compareSql(op, field, value) {
-	const left = quoteIdent(field);
-	switch (op) {
-		case "eq": return `${left} = ${value}`;
-		case "ne": return `${left} <> ${value}`;
-		case "gt": return `${left} > ${value}`;
-		case "gte": return `${left} >= ${value}`;
-		case "lt": return `${left} < ${value}`;
-		case "lte": return `${left} <= ${value}`;
-		case "contains": return `${left}::text like '%' || ${likeLiteralSql(`${value}::text`)} || '%' escape '\\'`;
-		default: return op;
-	}
-}
-function existsSql(table, rowColumn, rowField, roles, ctx, tenantColumn, scope) {
-	const parts = [`m.${quoteIdent(rowColumn)} = ${quoteIdent(rowField)}`, `m.${quoteIdent(table.user)} = ${subjectIdSql(ctx)}`];
-	if (roles.length > 0) {
-		const roleList = roles.map((role) => role.replaceAll("'", "''")).join(",");
-		parts.push(`m.${quoteIdent(table.role)} = any('{${roleList}}')`);
-		const via = table.via === void 0 ? "null::text" : `m.${quoteIdent(table.via)}::text`;
-		const single = sole(roles);
-		const kind = single === void 0 ? kindFilterSql(ctx, `m.${quoteIdent(table.role)}::text`, via) : roleKindSql(ctx, single, via);
-		if (kind !== void 0) parts.push(kind);
-	}
-	if (table.expiresAt !== void 0) parts.push(`(m.${quoteIdent(table.expiresAt)} is null or m.${quoteIdent(table.expiresAt)} > now())`);
-	if (tenantColumn !== void 0) parts.push(`m.${quoteIdent(tenantColumn)} = ${tenantClaimSql(ctx)}`);
-	parts.push(...activeUserSql(ctx));
-	if (scope !== void 0) parts.push(...activeInstancesSql(ctx, scope, (name) => {
-		const held = scopeColumn(table, ctx.scopes, name);
-		return held === void 0 ? void 0 : `m.${quoteIdent(held)}`;
-	}));
-	return `exists (select 1 from ${quoteTable(table.table)} m where ${parts.join(" and ")})`;
-}
-function compileMemberOf(condition, ctx) {
-	const scope = condition.scope === "resource" ? void 0 : resolveScope(ctx.scopes, condition.scope);
-	if (condition.scope !== "resource" && scope === void 0) throw new Error(`PermDock CLI: memberOf ${condition.scope} names a scope the policy does not declare`);
-	const mapping = scope === void 0 ? condition.resource === void 0 ? void 0 : ctx.memberships?.resource?.[condition.resource] : scopeMembershipTable(ctx.memberships, ctx.scopes, scope);
-	if (mapping !== void 0) {
-		const named = scope === void 0 ? void 0 : scopeTable(ctx, scope);
-		const rowColumn = scope === void 0 ? mapping.id : named?.column;
-		if (rowColumn === void 0) throw new Error(`PermDock CLI: memberships mapping for ${condition.scope} is missing the row column`);
-		const tenantColumn = scope === void 0 || scope === rootScope(ctx.scopes) ? void 0 : named?.tenantColumn;
-		const primary = existsSql(mapping, rowColumn, condition.field, condition.roles, ctx, tenantColumn, scope);
-		if (condition.scope !== "resource" || condition.parents === void 0) return primary;
-		return `(${[primary, ...condition.parents.flatMap((parent) => {
-			if (typeof parent === "string") return [existsSql(mapping, rowColumn, parent, condition.roles, ctx, tenantColumn)];
-			const hopTable = ctx.memberships?.resource?.[parent.resource];
-			return hopTable?.id === void 0 ? [] : [existsSql(hopTable, hopTable.id, parent.field, condition.roles, ctx)];
-		})].join(" or ")})`;
-	}
-	if (scope !== void 0 && condition.roles.length === 0 && scopeSources(ctx, scope).length > 0) return `${quoteIdent(condition.field)} in (select ${quoteIdent(ctx.schema ?? "permdock")}.${memberIdsHelper(scope)}())`;
-	if (scope !== void 0 && scope === rootScope(ctx.scopes)) {
-		const parts = [
-			`${quoteIdent(condition.field)} = ${tenantClaimSql(ctx)}`,
-			...activeUserSql(ctx),
-			...activeInstancesSql(ctx, scope, () => quoteIdent(condition.field))
-		];
-		return parts.length === 1 ? parts.join("") : `(${parts.join(" and ")})`;
-	}
-	throw new Error(`PermDock CLI: memberOf ${condition.scope} needs a memberships table mapping`);
-}
-function compileConditionSql(condition, ctx) {
-	switch (condition.op) {
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte": return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
-		case "contains": {
-			const element = ctx.arrayColumns?.[condition.field];
-			if (element !== void 0) return `${sqlValue(condition.value, {
-				...ctx,
-				columnTypes: {
-					...ctx.columnTypes,
-					[condition.field]: element
-				}
-			}, condition.field)} = any(${quoteIdent(condition.field)})`;
-			return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
-		}
-		case "in":
-		case "notIn": {
-			const keyword = condition.op === "in" ? "in" : "not in";
-			if (!Array.isArray(condition.value) && typeof condition.value === "object" && "ref" in condition.value) {
-				const path = claimPath(condition.value.ref);
-				if (path === void 0) {
-					compileRef(condition.value.ref, ctx);
-					throw new Error(`PermDock CLI: non-portable ${condition.op} against '${condition.value.ref}'`);
-				}
-				const column = quoteIdent(condition.field);
-				const list = claimArraySql(ctx, path, ctx.columnTypes?.[condition.field]);
-				return condition.op === "in" ? `${column} = any (${list})` : `(${column} is not null and not (${column} = any (${list})))`;
-			}
-			const values = condition.value.map((item) => sqlValue(item, ctx));
-			return `${quoteIdent(condition.field)} ${keyword} (${values.join(", ")})`;
-		}
-		case "isNull": return `${quoteIdent(condition.field)} is ${condition.value ? "" : "not "}null`;
-		case "and": return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" and ")})`;
-		case "or":
-			if (condition.conditions.length === 0) return "false";
-			return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" or ")})`;
-		case "not": return `not (${compileConditionSql(condition.condition, ctx)})`;
-		case "memberOf": return compileMemberOf(condition, ctx);
-		case "related": return compileRelatedSql(condition, ctx);
-		case "sqlFunction":
-			if (ctx.inlineFunctions === true) return compileConditionSql(condition.twin, ctx);
-			return `${quoteTable(condition.name)}(${condition.args.map((arg) => isSqlFunctionField(arg) ? quoteIdent(arg.field) : sqlValue(arg, ctx)).join(", ")})`;
-		case "opaque": return condition.sql;
-		default: return condition;
-	}
-}
-function parseMembershipsFlag(raw) {
-	if (raw === void 0 || raw === "") return;
-	const colon = raw.indexOf(":");
-	const table = colon === -1 ? raw : raw.slice(0, colon);
-	const cols = (colon === -1 ? "" : raw.slice(colon + 1)).split(",").map((item) => item.trim()).filter((item) => item !== "");
-	return { tenant: {
-		table,
-		tenant: cols[0] ?? "tenant_id",
-		user: cols[1] ?? "user_id",
-		role: cols[2] ?? "role",
-		...cols[3] === void 0 ? {} : { expiresAt: cols[3] }
-	} };
-}
-function andConditions(left, right) {
-	if (left === void 0) return right;
-	if (right === void 0) return left;
-	return {
-		op: "and",
-		conditions: [left, right]
-	};
-}
-function valueContextRefs(value) {
-	if (Array.isArray(value)) return value.flatMap(valueContextRefs);
-	if (isRecord(value) && typeof value["ref"] === "string" && (value["ref"] === "context" || value["ref"].startsWith("context."))) return [value["ref"]];
-	return [];
-}
-/**
-* The `context.*` refs a condition reads. The request context is not in the
-* token, so RLS cannot evaluate them.
-*/
-function contextRefs(condition) {
-	if (condition === void 0) return [];
-	switch (condition.op) {
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte":
-		case "contains":
-		case "in":
-		case "notIn": return valueContextRefs(condition.value);
-		case "and":
-		case "or": return condition.conditions.flatMap((child) => contextRefs(child));
-		case "not": return contextRefs(condition.condition);
-		case "sqlFunction": return [...condition.args.flatMap(valueContextRefs), ...contextRefs(condition.twin)];
-		case "isNull":
-		case "memberOf":
-		case "related":
-		case "opaque": return [];
-		default: return condition;
-	}
-}
-function sqlFunctionNames(condition) {
-	if (condition === void 0) return [];
-	switch (condition.op) {
-		case "sqlFunction": return [condition.name, ...sqlFunctionNames(condition.twin)];
-		case "and":
-		case "or": return condition.conditions.flatMap((child) => sqlFunctionNames(child));
-		case "not": return sqlFunctionNames(condition.condition);
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte":
-		case "contains":
-		case "in":
-		case "notIn":
-		case "isNull":
-		case "memberOf":
-		case "related":
-		case "opaque": return [];
-		default: return condition;
-	}
-}
-/**
-* A `related` condition as uncorrelated subqueries, so Postgres runs the
-* helper once per statement: the row's field in the closure's descendants of
-* the ids the subject holds the relation on (or those ids alone at depth 0).
-* The helper sits in `array(...)` so it stays an InitPlan; a plain `in` gets
-* pulled into a join that can rescan it per closure row.
-*/
-function compileRelatedSql(condition, ctx) {
-	if (condition.hops !== void 0 && condition.hops.length > 0) return compileHoppedSql(condition, ctx);
-	const type = ctx.columnTypes?.[condition.field];
-	const cast = type === void 0 || type === "text" ? "" : `::${type}`;
-	const column = type === void 0 ? `${quoteIdent(condition.field)}::text` : quoteIdent(condition.field);
-	const helper = `${`${quoteIdent(ctx.schema ?? "permdock")}.${graphHelper(condition.resource)}`}(${quoteLiteral(condition.relation)})`;
-	const cap = ctx.graph?.closures[condition.resource];
-	let inner;
-	if (condition.depth > 0 && cap !== void 0) {
-		const depth = condition.depth < cap ? ` and depth <= ${String(condition.depth)}` : "";
-		inner = `select descendant${cast} from ${`${quoteIdent(ctx.schema ?? "permdock")}.${CLOSURE.table}`} where resource = ${quoteLiteral(condition.resource)}${depth} and ancestor = any (array(select ${helper}))`;
-	} else inner = cast === "" ? `select ${helper}` : `select p.id${cast} from ${helper} as p(id)`;
-	const reach = `${column} in (${inner})`;
-	if (condition.parent === true && condition.restricted !== void 0) return `(${reach} and ${quoteIdent(condition.restricted)} is not true)`;
-	return reach;
-}
-/**
-* A `related` condition that crosses link hops: the reached instances of the
-* last resource, carried back over each link by its security definer helper,
-* so the hop reads a table the subject may not see.
-*/
-function compileHoppedSql(condition, ctx) {
-	const resources = ctx.graph?.resources;
-	if (resources === void 0) throw new Error("PermDock CLI: a related condition with link hops needs the policy resources in the RLS context");
-	const schema = quoteIdent(ctx.schema ?? "permdock");
-	return graphSqlText(relatedSql(condition, {
-		resources,
-		...ctx.graph?.tables === void 0 ? {} : { tables: ctx.graph.tables },
-		closure: `${ctx.schema ?? "permdock"}.${CLOSURE.table}`,
-		closureDepths: ctx.graph?.closures ?? {},
-		qualify: qualifiedTable,
-		holders: (resource, relation) => [{ text: `select ${schema}.${graphHelper(resource)}(${quoteLiteral(relation)})` }],
-		linked: (resource, link, targets) => [
-			{ text: `select ${schema}.${linkHelper(resource, link)}(array(` },
-			...targets,
-			{ text: "))" }
-		]
-	}), ctx);
-}
-//#endregion
-//#region src/cli/global-roles.ts
-function qualify(name, schema) {
-	return name.includes(".") ? name : `${schema}.${name}`;
-}
-/** Resolves `source` against `schema`, aliasing the table `alias` and the roles table `<alias>k`. */
-function globalRoleSource(source, schema, alias) {
-	const table = qualify(source.table, schema);
-	const user = source.user ?? "user_id";
-	const userSql = `${alias}.${quoteIdent(user)}`;
-	const role = source.role ?? "role";
-	if (typeof role === "string") return {
-		table,
-		user,
-		from: `${quoteTable(table)} ${alias}`,
-		userSql,
-		roleSql: `${alias}.${quoteIdent(role)}::text`
-	};
-	const pairs = Object.entries(role.on);
-	const [pair] = pairs;
-	if (pair === void 0 || pairs.length !== 1) throw new Error(`PermDock CLI: roles.role.on must map exactly one column of ${table} to ${role.through}, for example { role_id: 'id' }`);
-	const [ref, id] = pair;
-	const through = qualify(role.through, table.split(".")[0] ?? schema);
-	const keys = `${alias}k`;
-	return {
-		table,
-		user,
-		from: `${quoteTable(table)} ${alias}
-    join ${quoteTable(through)} ${keys} on ${keys}.${quoteIdent(id)} = ${alias}.${quoteIdent(ref)}`,
-		userSql,
-		roleSql: `${keys}.${quoteIdent(role.column)}::text`,
-		through: {
-			table: through,
-			id,
-			key: role.column,
-			ref
-		}
-	};
-}
-//#endregion
-//#region src/cli/rls-helpers.ts
-/**
-* The per-statement helpers every generated policy calls: `permdock_has` for
-* global roles and one `permitted_<scope>_ids` per scope
-* (`permittedIdsHelper`). Names are part of the SQL contract.
-*/
-const HELPERS = { has: "permdock_has" };
-/** The helper `--capabilities` adds: ids of one resource a link capability claim reaches. Part of the SQL contract. */
-const CAPABILITIES = { ids: "permdock_capability_ids" };
-/** Objects `--custom-roles` adds next to the helpers. Names are part of the SQL contract. */
-const CUSTOM_ROLES = {
-	permissions: "custom_role_permissions",
-	includes: "custom_role_includes",
-	ceiling: "permdock_ceiling",
-	keys: "permdock_custom_keys"
-};
-function helperSchema(ctx) {
-	return ctx.schema ?? "permdock";
-}
-function qualified(ctx, name) {
-	return `${quoteIdent(helperSchema(ctx))}.${name}`;
-}
-/**
-* The policy-side call for a grant key. Every form is uncorrelated, so
-* Postgres runs the helper once per statement (an InitPlan, or a hashed
-* SubPlan for `in`), never once per row.
-*/
-function accessSql(ctx, scope, grantKey, column) {
-	const key = quoteLiteral(grantKey);
-	if (scope === "global") return `(select ${qualified(ctx, HELPERS.has)}(${key}))`;
-	if (column === void 0) throw new Error(`PermDock CLI: ${scope}-scoped grant needs definePolicy({ scopes.${scope} })`);
-	return `${quoteIdent(column)} in (select ${qualified(ctx, permittedIdsHelper(scope))}(${key}))`;
-}
-/**
-* The `anon` branch access for a resource-scoped grant reached through a link
-* capability: the row's `field` holds an id the capability claim names for
-* `resource`, `role` and `permission`. Uncorrelated, so it runs once per
-* statement; the column is compared as text because the claim holds text.
-*/
-function capabilityAccessSql(ctx, field, resource, role, permission) {
-	const args = [
-		resource,
-		role,
-		permission
-	].map(quoteLiteral).join(", ");
-	return `${quoteIdent(field)}::text in (select ${qualified(ctx, CAPABILITIES.ids)}(${args}))`;
-}
-function capabilitiesSql(ctx) {
-	if (ctx.capabilities !== true) return "";
-	const fn = qualified(ctx, CAPABILITIES.ids);
-	return `-- link capabilities: the capability claim exchangeCapability mints (role anon, short-lived)
-create or replace function ${fn}(p_resource text, p_role text, p_permission text)
-returns setof text
-language sql
-stable
-set search_path = ''
-as $$
-  select c -> 'on' ->> 'id'
-  from (select ${subjectClaimJsonSql(ctx, "capability")} as c) capability
-  where jsonb_typeof(c) = 'object'
-    and c ->> 'v' = '1'
-    and c ->> 'holder' = 'link'
-    and c -> 'on' ->> 'resource' = p_resource
-    and jsonb_typeof(c -> 'roles') = 'array'
-    and c -> 'roles' @> jsonb_build_array(p_role)
-    and (c -> 'permissions' is null or c -> 'permissions' @> jsonb_build_array(p_permission))
-    and jsonb_typeof(c -> 'expiresAt') = 'number'
-    and (c ->> 'expiresAt')::numeric > extract(epoch from now())
-$$;
-revoke execute on function ${fn}(text, text, text) from public;
-grant execute on function ${fn}(text, text, text) to anon, authenticated;`;
-}
-function membershipTable(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
-}
-/** `user` is the SQL for the user id: `auth.uid()` (the default) or the `p_user` parameter of a `_for` helper. */
-function signedIn(ctx, user = subjectIdSql(ctx)) {
-	return `coalesce(${user}::text, '') <> ''`;
-}
-function activeTenant(ctx) {
-	return `nullif(${subjectClaimSql(ctx, ctx.tenantClaim)}, '')`;
-}
-function rootName(ctx) {
-	return ctx.scopes[0]?.name ?? "tenant";
-}
-/** Whether the active tenant narrows memberships of `scope`: the first scope is on its chain. */
-function underRoot(ctx, scope) {
-	const root = ctx.scopes[0]?.name;
-	let current = ctx.scopes.find((item) => item.name === scope);
-	const seen = /* @__PURE__ */ new Set();
-	while (current !== void 0 && !seen.has(current.name)) {
-		if (current.name === root) return true;
-		seen.add(current.name);
-		const parent = current.within;
-		current = parent === void 0 ? void 0 : ctx.scopes.find((item) => item.name === parent);
-	}
-	return false;
-}
-/** `and exists (...)` lines for an active user; empty without `rls.suspension.users`. */
-function userActive(ctx, indent, user) {
-	return activeUserSql(ctx, user).map((part) => `${indent}and ${part}`);
-}
-/** `and exists (...)` lines for every suspendable instance on the chain of `scope`'s membership. */
-function instancesActive(ctx, scope, idOf, indent) {
-	return activeInstancesSql(ctx, scope, idOf).map((part) => `${indent}and ${part}`);
-}
-function roleRows(ctx) {
-	const claim = ctx.roleClaim ?? "user_role";
-	switch (ctx.dialect) {
-		case "guc": return `unnest(string_to_array(nullif(current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true), ''), ',')) r(role)`;
-		case "supabase":
-		case "neon": {
-			const raw = subjectClaimJsonSql(ctx, claim);
-			const value = ctx.dialect === "supabase" ? `coalesce(nullif(${raw}, 'null'::jsonb), (select auth.jwt()) -> 'app_metadata' -> ${quoteLiteral(claim)})` : raw;
-			return `jsonb_array_elements_text(
-      case jsonb_typeof(${value})
-        when 'array' then ${value}
-        when 'string' then jsonb_build_array(${value})
-        else '[]'::jsonb
-      end
-    ) r(role)`;
-		}
-		default: return ctx.dialect;
-	}
-}
-function membershipRows(ctx) {
-	const raw = subjectClaimJsonSql(ctx, "memberships");
-	const value = ctx.dialect === "supabase" ? `coalesce(${raw}, (select auth.jwt()) -> 'app_metadata' -> 'memberships')` : raw;
-	return `jsonb_array_elements(
-      case jsonb_typeof(${value}) when 'array' then ${value} else '[]'::jsonb end
-    ) m
-    cross join lateral jsonb_array_elements_text(
-      case jsonb_typeof(m -> 'roles') when 'array' then m -> 'roles' else '[]'::jsonb end
-    ) r(role)`;
-}
-function andLine(indent, condition) {
-	return condition === void 0 ? "" : `\n${indent}and ${condition}`;
-}
-/** `rls.roles`, or the generated `user_roles (user_id, role)`, aliased `ur`. */
-function globalRoleRows(ctx) {
-	return ctx.roles === void 0 ? {
-		from: `${qualified(ctx, "user_roles")} ur`,
-		userSql: "ur.user_id",
-		roleSql: "ur.role::text"
-	} : globalRoleSource(ctx.roles, "public", "ur");
-}
-function hasBody(ctx) {
-	const rp = qualified(ctx, "role_permissions");
-	const active = userActive(ctx, "      ").map((line) => `\n${line}`).join("");
-	const custom = ctx.customRoles;
-	if (ctx.authorize === "database") {
-		const ur = globalRoleRows(ctx);
-		const declared = `  select exists (
-    select 1
-    from ${ur.from}
-    join ${rp} rp on rp.role = ${ur.roleSql}
-    where ${ur.userSql} = ${subjectIdSql(ctx)}
-      and rp.grant_key = p_grant
-      and rp.scope = 'global'${andLine("      ", globalKindFilterSql(ctx, ur.roleSql))}${active}
-  )`;
-		if (custom === void 0) return declared;
-		const match = `c.tenant_id is null and c.scope = 'global' and c.scope_id is null and c.role = ${ur.roleSql}`;
-		const rows = (source, value, extra) => `array(select c.${value} from ${qualified(ctx, source)} c where ${match}${extra})`;
-		return `${declared}
-  or exists (
-    select 1
-    from ${ur.from}
-    where ${ur.userSql} = ${subjectIdSql(ctx)}
-      and not (${ur.roleSql} = any(${textArray(custom.declared)}))${active}
-      ${customKeysSql(ctx, "global", rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), rows(CUSTOM_ROLES.includes, "include_role", "")).trimStart()}
-  )`;
-	}
-	const declared = `  select ${signedIn(ctx)} and exists (
-    select 1
-    from ${roleRows(ctx)}
-    join ${rp} rp on rp.role = r.role
-    where rp.grant_key = p_grant
-      and rp.scope = 'global'${andLine("      ", globalKindFilterSql(ctx, "r.role"))}${active}
-  )`;
-	if (custom === void 0) return declared;
-	const claim = subjectClaimJsonSql(ctx, GLOBAL_GRANTS_CLAIM);
-	return `${declared}
-  or (${signedIn(ctx)} and exists (
-    select 1
-    from ${roleRows(ctx)}
-    cross join lateral (select ${claim} -> r.role as g) cg
-    where jsonb_typeof(cg.g) = 'array'
-      and not (r.role = any(${textArray(custom.declared)}))${active}
-      ${customKeysSql(ctx, "global", claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)")).trimStart()}
-  ))`;
-}
-/** The claim `jwt` mode reads platform custom roles from: `customRoleClaim(globalRoles)`. */
-const GLOBAL_GRANTS_CLAIM = "role_grants";
-function memberColumn(name) {
-	return `m.${quoteIdent(name)}`;
-}
-/** Entries of a compact custom-role claim (`cg.g`) that match `where`. */
-function claimEntries(where, value) {
-	return `array(select ${value} from jsonb_array_elements_text(cg.g) e where ${where})`;
-}
-function textArray(values) {
-	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
-}
-/** `p_grant in (select permdock_custom_keys(allows, denies, includes, scope))`. */
-function customKeysSql(ctx, scope, allows, denies, includes) {
-	return `    and p_grant in (select ${qualified(ctx, CUSTOM_ROLES.keys)}(
-      ${allows},
-      ${denies},
-      ${includes},
-      ${quoteLiteral(scope)}
-    ))`;
-}
-function tableBody(ctx, scope, type) {
-	const mapped = scopeTable(ctx, scope);
-	if (mapped === void 0) return `  select null::${type} where false -- no ${scope} memberships table configured`;
-	const { table, column, tenantColumn } = mapped;
-	const filters = [`  where ${memberColumn(table.user)} = ${subjectIdSql(ctx)}`];
-	if (table.expiresAt !== void 0) {
-		const expires = memberColumn(table.expiresAt);
-		filters.push(`    and (${expires} is null or ${expires} > now())`);
-	}
-	if (tenantColumn !== void 0) filters.push(`    and (${activeTenant(ctx)} is null or ${memberColumn(tenantColumn)}::text = ${activeTenant(ctx)})`);
-	filters.push(...userActive(ctx, "    "), ...instancesActive(ctx, scope, (name) => {
-		const held = scopeColumn(table, ctx.scopes, name);
-		return held === void 0 ? void 0 : memberColumn(held);
-	}, "    "));
-	const [owner, ...rest] = filters;
-	const kind = kindFilterSql(ctx, `${memberColumn(table.role)}::text`, table.via === void 0 ? "null::text" : `${memberColumn(table.via)}::text`);
-	const lines = [
-		`  select ${memberColumn(column)}::${type}`,
-		`  from ${membershipTable(table.table)} m`,
-		`  join ${qualified(ctx, "role_permissions")} rp on rp.role = ${memberColumn(table.role)}::text`,
-		owner ?? "",
-		"    and rp.grant_key = p_grant",
-		`    and rp.scope = ${quoteLiteral(scope)}`,
-		...kind === void 0 ? [] : [`    and ${kind}`],
-		...rest
-	];
-	const custom = ctx.customRoles;
-	if (custom === void 0) return lines.join("\n");
-	const match = [
-		`c.tenant_id::text = ${memberColumn(tenantColumn ?? column)}::text`,
-		`c.scope = ${quoteLiteral(scope)}`,
-		`(c.scope_id is null or c.scope_id = ${memberColumn(column)}::text)`,
-		`c.role = ${memberColumn(table.role)}::text`
-	].join(" and ");
-	const rows = (source, value, extra) => `array(select c.${value} from ${qualified(ctx, source)} c where ${match}${extra})`;
-	return [
-		...lines,
-		"  union",
-		`  select ${memberColumn(column)}::${type}`,
-		`  from ${membershipTable(table.table)} m`,
-		...filters,
-		`    and not (${memberColumn(table.role)}::text = any(${textArray(custom.declared)}))`,
-		customKeysSql(ctx, scope, rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), rows(CUSTOM_ROLES.includes, "include_role", ""))
-	].join("\n");
-}
-/** The membership's instance of the first scope, from the canonical claim. */
-function claimTenant(ctx, scope) {
-	const root = rootName(ctx);
-	return scope === root ? `m ->> 'id'` : `m -> 'within' ->> ${quoteLiteral(root)}`;
-}
-function claimBody(ctx, scope, type) {
-	const narrow = underRoot(ctx, scope) ? `
-    and (${activeTenant(ctx)} is null or ${claimTenant(ctx, scope)} = ${activeTenant(ctx)})` : "";
-	const filters = `    and m ->> 'scope' = ${quoteLiteral(scope)}
-    and m ->> 'id' is not null${narrow}
-    and case jsonb_typeof(m -> 'expiresAt')
-      when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
-      else true
-    end${[...userActive(ctx, "    "), ...instancesActive(ctx, scope, (name) => name === scope ? `m ->> 'id'` : `m -> 'within' ->> ${quoteLiteral(name)}`, "    ")].map((line) => `\n${line}`).join("")}`;
-	const declared = `  select (m ->> 'id')::${type}
-  from ${membershipRows(ctx)}
-  join ${qualified(ctx, "role_permissions")} rp on rp.role = r.role
-  where ${signedIn(ctx)}
-    and rp.grant_key = p_grant
-    and rp.scope = ${quoteLiteral(scope)}${andLine("    ", kindFilterSql(ctx, "r.role", "m ->> 'via'"))}
-${filters}`;
-	const custom = ctx.customRoles;
-	if (custom === void 0) return declared;
-	return `${declared}
-  union
-  select (m ->> 'id')::${type}
-  from ${membershipRows(ctx)}
-  cross join lateral (select m -> 'grants' -> r.role as g) cg
-  where ${signedIn(ctx)}
-    and jsonb_typeof(cg.g) = 'array'
-    and not (r.role = any(${textArray(custom.declared)}))
-${filters}
-${customKeysSql(ctx, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}`;
-}
-/**
-* The custom-role objects: the tables (`database` mode), the ceiling view
-* over the `assignable` declared roles, and `permdock_custom_keys`, which
-* resolves one custom role to the grant keys it holds in a scope. A row in
-* the tables can never reach a key outside the view.
-*/
-function customRolesSql(ctx) {
-	const custom = ctx.customRoles;
-	if (custom === void 0) return "";
-	const rp = qualified(ctx, "role_permissions");
-	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
-	const keys = qualified(ctx, CUSTOM_ROLES.keys);
-	const chunks = [];
-	if (ctx.authorize === "database") {
-		const tenantType = tenantTypeOf(ctx);
-		for (const [name, column, check] of [[
-			CUSTOM_ROLES.permissions,
-			"permission",
-			`,
-  effect text not null default 'allow' check (effect in ('allow', 'deny'))`
-		], [
-			CUSTOM_ROLES.includes,
-			"include_role",
-			""
-		]]) {
-			const table = qualified(ctx, name);
-			const unique = `${column}${name === CUSTOM_ROLES.permissions ? ", effect" : ""}`;
-			chunks.push(`create table if not exists ${table} (
-  tenant_id ${tenantType},
-  scope text not null default ${quoteLiteral(rootName(ctx))},
-  scope_id text,
-  role text not null,
-  ${column} text not null${check},
-  check ((scope = 'global') = (tenant_id is null)),
-  check (scope <> 'global' or scope_id is null)
-);
-create unique index if not exists ${quoteIdent(`${name}_key`)}
-  on ${table} (coalesce(tenant_id::text, ''), scope, coalesce(scope_id, ''), role, ${unique});
-alter table ${table} enable row level security;
-revoke all on table ${table} from anon, authenticated, public;`);
-		}
-	}
-	chunks.push(`-- the ceiling: keys of assignable declared roles, and the denies of those roles on the same permissions
-create or replace view ${ceiling} with (security_invoker = true) as
-select rp.scope, rp.role, rp.permission, rp.grant_key, rp.effect
-from ${rp} rp
-where rp.role = any(${textArray(custom.assignable)})
-  and exists (
-    select 1 from ${rp} a
-    where a.role = rp.role
-      and a.permission = rp.permission
-      and a.scope = rp.scope
-      and a.effect = 'allow'
-  );
-revoke all on table ${ceiling} from anon, authenticated, public;`);
-	const rename = renamesSql(Object.entries(custom.renamed ?? {}).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
-	chunks.push(`-- one custom role: included ceiling keys and same-scope denies, plus every ceiling key of an allowed permission, minus denied permissions
-create or replace function ${keys}(p_allow text[], p_deny text[], p_include text[], p_scope text)
-returns setof text
-language sql
-stable
-set search_path = ''
-as $$
-  with ${rename.prelude}ceiling as (
-    select c.role, ${rename.permission("c")}, c.grant_key, c.effect
-    from ${ceiling} c${rename.join("c")}
-    where c.scope = p_scope
-  ),
-  included as (
-    select rp.role, ${rename.permission("rp")}, rp.grant_key, rp.scope, rp.effect
-    from ${rp} rp${rename.join("rp")}
-    where rp.role = any(coalesce(p_include, '{}'::text[]))
-  ),
-  kept as (
-    select i.permission, i.grant_key
-    from included i
-    where i.effect = 'allow'
-      and i.scope = p_scope
-      and exists (
-        select 1 from ceiling c
-        where c.role = i.role and c.grant_key = i.grant_key and c.effect = 'allow'
-      )
-  ),
-  wanted as (
-    ${rename.allow}
-    union
-    select i.permission
-    from included i
-    where i.effect = 'allow'
-      and not (i.scope = p_scope and exists (
-        select 1 from ceiling c
-        where c.role = i.role and c.grant_key = i.grant_key and c.effect = 'allow'
-      ))
-  ),
-  allowed as (
-    select w.permission
-    from wanted w
-    where not (${rename.denied("w")})
-      and not exists (select 1 from kept k where k.permission = w.permission)
-  )
-  select k.grant_key from kept k
-  where not (${rename.denied("k")})
-  union
-  select i.grant_key from included i
-  where i.effect = 'deny' and i.scope = p_scope
-  union
-  select c.grant_key from ceiling c
-  where c.permission in (select a.permission from allowed a)
-$$;
-revoke execute on function ${keys}(text[], text[], text[], text) from public, anon, authenticated;`);
-	return chunks.join("\n\n");
-}
-function currentKeysSql(array) {
-	return `select coalesce(r.key, e.permission) as permission
-    from unnest(coalesce(${array}, '{}'::text[])) as e(permission)
-    left join renamed r on r.former = e.permission`;
-}
-/**
-* SQL fragments that read a stored former key as its current key inside
-* `permdock_custom_keys`. Without renames they are the plain column and
-* array reads.
-*/
-function renamesSql(renames) {
-	if (renames.length === 0) return {
-		prelude: "",
-		permission: (alias) => `${alias}.permission`,
-		join: () => "",
-		allow: "select unnest(coalesce(p_allow, '{}'::text[])) as permission",
-		denied: (alias) => `${alias}.permission = any(coalesce(p_deny, '{}'::text[]))`
-	};
-	return {
-		prelude: `renamed (former, key) as (values ${renames.map(([former, current]) => `(${quoteLiteral(former)}, ${quoteLiteral(current)})`).join(", ")}),
-  denied as (
-    ${currentKeysSql("p_deny")}
-  ),
-  `,
-		permission: (alias) => `coalesce(r_${alias}.key, ${alias}.permission) as permission`,
-		join: (alias) => ` left join renamed r_${alias} on r_${alias}.former = ${alias}.permission`,
-		allow: currentKeysSql("p_allow"),
-		denied: (alias) => `${alias}.permission in (select d.permission from denied d)`
-	};
-}
-/**
-* The rows the membership sources select for the subject, one per instance
-* (`scope`, `id`, `within`, `roles`, `via`), with each source's own expiry
-* and suspension filters: the statements the token hook runs.
-*/
-function sourceRows(sources) {
-	return sources.map((source, index) => source.sql.select(sourceUser(index)).replaceAll(/^/gmu, "    ")).join("\n    union all\n");
-}
-function sourceUser(index) {
-	return `v_user_${String(index)}`;
-}
-function sqlBody(sql) {
-	return {
-		sql,
-		vars: []
-	};
-}
-function sourcesBodyOf(sql, sources, user) {
-	return {
-		sql,
-		vars: sources.map((source, index) => `${sourceUser(index)} ${source.sql.userType} := ${user};`)
-	};
-}
-/** `language sql`, or `plpgsql` returning the query when the body declares variables. */
-function functionBody(body) {
-	if (body.vars.length === 0) return `language sql
-stable
-security definer
-set search_path = ''
-as $$
-${body.sql}
-$$;`;
-	return `language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-${body.vars.map((line) => `  ${line}`).join("\n")}
-begin
-  return query
-${body.sql};
-end;
-$$;`;
-}
-/**
-* `ms.id` for the scope itself and `ms.within ->> name` for an ancestor. The
-* alias is not `s`, which `activeRowSql` binds inside its `exists`.
-*/
-function sourceIdOf(scope) {
-	return (name) => name === scope ? "ms.id" : `ms.within ->> ${quoteLiteral(name)}`;
-}
-function sourceFilters(ctx, scope, user = subjectIdSql(ctx)) {
-	return [...userActive(ctx, "    ", user), ...instancesActive(ctx, scope, sourceIdOf(scope), "    ")].map((line) => `\n${line}`).join("");
-}
-function sourcesBody(ctx, scope, type) {
-	if (ctx.customRoles !== void 0) throw new Error(`PermDock CLI: --custom-roles in database mode needs rls.memberships.scopes.${scope}: the membership sources carry no custom roles`);
-	const root = rootName(ctx);
-	const narrow = underRoot(ctx, scope) ? `\n    and (${activeTenant(ctx)} is null or ${sourceIdOf(scope)(root)} = ${activeTenant(ctx)})` : "";
-	const sources = scopeSources(ctx, scope);
-	return sourcesBodyOf(`  select (ms.id)::${type}
-  from (
-${sourceRows(sources)}
-  ) ms
-  cross join lateral jsonb_array_elements_text(
-    case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
-  ) r(role)
-  join ${qualified(ctx, "role_permissions")} rp on rp.role = r.role
-  where ${signedIn(ctx)}
-    and ms.scope = ${quoteLiteral(scope)}
-    and rp.grant_key = p_grant
-    and rp.scope = ${quoteLiteral(scope)}${andLine("    ", kindFilterSql(ctx, "r.role", "ms.via"))}${narrow}${sourceFilters(ctx, scope)}`, sources, subjectIdSql(ctx));
-}
-function scopedBody(ctx, scope, type) {
-	if (ctx.authorize !== "database") return sqlBody(claimBody(ctx, scope, type));
-	return scopeSources(ctx, scope).length > 0 ? sourcesBody(ctx, scope, type) : sqlBody(tableBody(ctx, scope, type));
-}
-/**
-* The body of `member_<scope>_ids()`: instances of `scope` the subject holds
-* a live membership of, with any role. Not narrowed to the active tenant, and
-* no cascade: a membership of a child scope is not one of its parent.
-*/
-function memberBody(ctx, scope, type) {
-	if (ctx.authorize !== "database") return sqlBody(`  select distinct (m ->> 'id')::${type}
-  from jsonb_array_elements(
-    case jsonb_typeof(${membershipClaim(ctx)}) when 'array' then ${membershipClaim(ctx)} else '[]'::jsonb end
-  ) m
-  where ${signedIn(ctx)}
-    and m ->> 'scope' = ${quoteLiteral(scope)}
-    and m ->> 'id' is not null
-    and jsonb_typeof(m -> 'roles') = 'array'
-    and jsonb_array_length(m -> 'roles') > 0
-    and case jsonb_typeof(m -> 'expiresAt')
-      when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
-      else true
-    end${[...userActive(ctx, "    "), ...instancesActive(ctx, scope, (name) => name === scope ? `m ->> 'id'` : `m -> 'within' ->> ${quoteLiteral(name)}`, "    ")].map((line) => `\n${line}`).join("")}`);
-	return memberRowsBody(ctx, scope, type, subjectIdSql(ctx), scopeSources(ctx, scope));
-}
-/**
-* The membership rows of `user` for `scope`, from the sources or else the
-* mapped table, with the same expiry and suspension filters either way.
-*/
-function memberRowsBody(ctx, scope, type, user, sources) {
-	if (sources.length > 0) return sourcesBodyOf(`  select distinct (ms.id)::${type}
-  from (
-${sourceRows(sources)}
-  ) ms
-  where ${signedIn(ctx, user)}
-    and ms.scope = ${quoteLiteral(scope)}
-    and jsonb_typeof(ms.roles) = 'array'
-    and jsonb_array_length(ms.roles) > 0${sourceFilters(ctx, scope, user)}`, sources, user);
-	const mapped = scopeTable(ctx, scope);
-	if (mapped === void 0) return sqlBody(`  select null::${type} where false -- no ${scope} memberships table configured`);
-	const { table, column } = mapped;
-	const lines = [
-		`  select distinct ${memberColumn(column)}::${type}`,
-		`  from ${membershipTable(table.table)} m`,
-		`  where ${memberColumn(table.user)} = ${user}`,
-		`    and ${memberColumn(table.role)} is not null`
-	];
-	if (table.expiresAt !== void 0) {
-		const expires = memberColumn(table.expiresAt);
-		lines.push(`    and (${expires} is null or ${expires} > now())`);
-	}
-	lines.push(...userActive(ctx, "    ", user), ...instancesActive(ctx, scope, (name) => {
-		const held = scopeColumn(table, ctx.scopes, name);
-		return held === void 0 ? void 0 : memberColumn(held);
-	}, "    "));
-	return sqlBody(lines.join("\n"));
-}
-function membershipClaim(ctx) {
-	const raw = subjectClaimJsonSql(ctx, "memberships");
-	return ctx.dialect === "supabase" ? `coalesce(${raw}, (select auth.jwt()) -> 'app_metadata' -> 'memberships')` : raw;
-}
-function memberFunction(ctx, scope, type, anonExecute) {
-	const fn = qualified(ctx, memberIdsHelper(scope));
-	const grants = anonExecute ? `revoke execute on function ${fn}() from public;
-grant execute on function ${fn}() to anon, authenticated;` : `revoke execute on function ${fn}() from public, anon;
-grant execute on function ${fn}() to authenticated;`;
-	return `create or replace function ${fn}()
-returns setof ${type}
-${functionBody(memberBody(ctx, scope, type))}
-${grants}`;
-}
-/**
-* `member_<scope>_ids_for(p_user uuid)`: `member_<scope>_ids()` for a user the
-* caller names, read from the membership sources (or the mapped table) in
-* either mode, so a token hook can call it before any claim exists. Naming
-* the user is why no client role may execute it; the hook's grants give
-* `supabase_auth_admin` execute.
-*/
-function memberForFunction(ctx, scope, type) {
-	const fn = qualified(ctx, memberForHelper(scope));
-	return `create or replace function ${fn}(p_user uuid)
-returns setof ${type}
-${functionBody(memberRowsBody(ctx, scope, type, "p_user", memberForSources(ctx, scope)))}
-revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
-}
-function helperFunction(ctx, name, returns, body, anonExecute) {
-	const fn = qualified(ctx, name);
-	const grants = anonExecute ? `revoke execute on function ${fn}(text) from public;
-grant execute on function ${fn}(text) to anon, authenticated;` : `revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;`;
-	return `create or replace function ${fn}(p_grant text)
-returns ${returns}
-${functionBody(body)}
-${grants}`;
-}
-function userIdType(ctx) {
-	return ctx.dialect === "supabase" ? "uuid not null references auth.users on delete cascade" : "text not null";
-}
-/**
-* The `role_permissions` rows the policy compiles to: an upsert and a delete
-* of every other row. Data, not schema, so `supabase db diff` drops it from a
-* declarative schema; `--split ...,seeds` writes it as its own migration.
-*/
-function seedSql(ctx, rows) {
-	const table = qualified(ctx, "role_permissions");
-	if (rows.length === 0) return `delete from ${table};`;
-	return `insert into ${table} (role, permission, grant_key, scope, effect) values
-${rows.map((row) => `  (${[
-		row.role,
-		row.permission,
-		row.grantKey,
-		row.scope,
-		row.effect
-	].map(quoteLiteral).join(", ")})`).join(",\n")}
-on conflict (role, grant_key, scope) do update
-  set permission = excluded.permission, effect = excluded.effect;
-delete from ${table}
-where (role, grant_key, scope) not in (values
-${rows.map((row) => `  (${[
-		row.role,
-		row.grantKey,
-		row.scope
-	].map(quoteLiteral).join(", ")})`).join(",\n")}
-);`;
-}
-/**
-* `role_permissions`, its seeds, and the three `security definer` helpers
-* with `search_path = ''`. `execute` goes to `authenticated` only.
-*/
-function helpersSql(ctx, rows, options) {
-	const schema = helperSchema(ctx);
-	const s = quoteIdent(schema);
-	const rp = qualified(ctx, "role_permissions");
-	const chunks = [`-- permdock helpers (${ctx.authorize === "database" ? "database: reads the membership and user_roles tables" : "jwt: reads the role and memberships claims"})
--- policies call them uncorrelated, so Postgres evaluates each once per statement`];
-	if (schema !== "public") chunks.push(`create schema if not exists ${s};\nrevoke all on schema ${s} from public;\ngrant usage on schema ${s} to ${options.anonExecute === true ? "anon, authenticated" : "authenticated"};`);
-	chunks.push(`create table if not exists ${rp} (
-  role text not null,
-  permission text not null,
-  grant_key text not null,
-  scope text not null check (scope ~ '^[a-z][a-z0-9_]*$'),
-  effect text not null default 'allow' check (effect in ('allow', 'deny')),
-  primary key (role, grant_key, scope)
-);
-alter table ${rp} enable row level security;
-revoke all on table ${rp} from anon, authenticated, public;`);
-	if (options.withoutSeeds !== true) chunks.push(seedSql(ctx, rows));
-	if (ctx.authorize === "database" && options.userRoles && ctx.roles === void 0) {
-		const ur = qualified(ctx, "user_roles");
-		chunks.push(`create table if not exists ${ur} (
-  user_id ${userIdType(ctx)},
-  role text not null,
-  primary key (user_id, role)
-);
-alter table ${ur} enable row level security;
-revoke all on table ${ur} from anon, authenticated, public;`);
-	}
-	const custom = customRolesSql(ctx);
-	if (custom !== "") chunks.push(custom);
-	const anon = options.anonExecute === true;
-	chunks.push(helperFunction(ctx, HELPERS.has, "boolean", sqlBody(hasBody(ctx)), anon));
-	const capabilities = capabilitiesSql(ctx);
-	if (capabilities !== "") chunks.push(capabilities);
-	for (const scope of ctx.scopes) {
-		const type = scopeTypeOf(ctx, scope.name);
-		chunks.push(helperFunction(ctx, permittedIdsHelper(scope.name), `setof ${type}`, scopedBody(ctx, scope.name, type), anon));
-		chunks.push(memberFunction(ctx, scope.name, type, anon));
-		if (hasMemberFor(ctx, scope.name)) chunks.push(memberForFunction(ctx, scope.name, type));
-	}
-	return `${chunks.join("\n\n")}\n`;
-}
-//#endregion
-export { memberForSources as A, scopeSources as B, globalKindFilterSql as C, kindFilterSql as D, hasMemberFor as E, qualifiedTable as F, subjectClaimSql as G, scopeTypeOf as H, quoteIdent as I, subjectIdSql as K, quoteLiteral as L, memberIdsHelper as M, parseMembershipsFlag as N, linkHelper as O, permittedIdsHelper as P, quoteTable as R, contextRefs as S, graphSqlText as T, sqlFunctionNames as U, scopeTable as V, subjectClaimJsonSql as W, andConditions as _, helpersSql as a, columnTypesOf as b, membershipTable as c, seedSql as d, signedIn as f, activeUserSql as g, activeRowSql as h, globalRoleRows as i, memberForTable as j, memberForHelper as k, qualified as l, CLOSURE as m, accessSql as n, memberColumn as o, globalRoleSource as p, capabilityAccessSql as r, membershipRows as s, HELPERS as t, roleRows as u, arrayColumnsOf as v, graphHelper as w, compileConditionSql as x, checkSuspension as y, roleKindSql as z };