permdock 0.3.0 → 0.4.0

package/dist/{rls-fields-74oZPXWL.js → permission-keys-B26jeyUv.js}

@@ -1,150 +1,293 @@
-import { n as isReadonlyArray, r as sole } from "./compact-y6vfu2_f.js";
-import { T as isForbiddenKey, _ as listPermissions, a as formerKeys } from "./permissions-DVoF6dMt.js";
-import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField } from "./refs-KYb4ntaz.js";
-import { p as policyLevels } from "./policy-xyWg7QdR.js";
-import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { E as listRoles, l as inheritCondition, m as relationCondition } from "./grantee-Cv5Sogfv.js";
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
-import { d as partitionsOf, h as scopeField } from "./validity-uOp8UpYn.js";
-import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { _ as leveled, p as andWhere } from "./permdock-CbgvLnuo.js";
-import { i as requiresStandIn } from "./delegation-D8pUEuce.js";
+import { a as sole, n as isReadonlyArray, r as isRecord } from "./compact-CAf557ZB.js";
+import { o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
+import { l as isSqlFunctionField } from "./refs-f3imMjNW.js";
+import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { v as listRoles } from "./grantee-CXY-0C87.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-MQs5NIuX.js";
+import { l as partitionsOf, p as scopeField } from "./tenancy-DshjqY0n.js";
 import { t as CliError } from "./errors-CWfoNg9N.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
-import { i as scopeMembershipTable, o as relatedSql, r as scopeColumn } from "./compile-Ba4blROR.js";
-import { t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
-import { l as roleColumn, u as roleManifest } from "./sources-4p0-4xQm.js";
+import { i as scopeMembershipTable, o as relatedSql, r as scopeColumn } from "./compile-CcEu2ZQ1.js";
+import { l as sqlTextArray, r as qualifySqlTable, t as SQL_IDENT } from "./sql-t8teWOfo.js";
+import { d as keptKeys, l as roleColumn, u as roleManifest } from "./sources-B1-b-R0t.js";
 import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { A as keptRowSql, B as memberVia, C as grantPermissionSql, D as hasMemberFor, E as graphSqlText, F as memberForHelper, G as quoteIdent, H as permittedForHelper, I as memberForSources, J as restrictedHelper, K as quoteLiteral, M as kindFilterSql, N as linkHelper, O as inheritedRowsHelper, P as liveSessionSql, Q as scopeTypeOf, R as memberIdsHelper, S as globalKindFilterSql, U as permittedIdsHelper, W as qualifiedTable, X as scopeSources, Y as roleKindSql, Z as scopeTable, _ as activeUserSql, a as helperSchema, at as tenantTypeOf, b as columnTypesOf, c as signedIn, d as CLOSURE, et as sqlType, h as activeMembershipSql, i as allowEntry, it as tenantClaimSql, j as keyTenantSql, k as isRecord, l as textArray, m as activeInstancesSql, n as GLOBAL_ROLES, nt as subjectClaimSql, o as qualified$1, ot as userIdHelperSql, q as quoteTable, r as HELPERS, rt as subjectIdSql, s as rootName, t as CUSTOM_ROLES, tt as subjectClaimJsonSql, u as CLAIM, v as arrayColumnsOf, w as graphHelper, x as disabledKeep, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
-import { createHash } from "node:crypto";
-//#region src/cli/rls-api-keys.ts
-const API_KEY_ALLOWS = "permdock_api_key_allows";
-const DEFAULTS = {
-	claim: "api_key",
-	scopes: "scopes",
-	tenant: "tenant",
-	roles: "roles"
-};
-function field(settings, name) {
-	const value = settings[name] ?? DEFAULTS[name];
-	if (typeof value !== "string" || !SQL_IDENT.test(value)) throw new Error(`PermDock CLI: rls.apiKeys.${name} must be a claim field name matching ${SQL_IDENT.source}`);
-	return value;
+import { D as sqlType, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, S as CLAIM, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as helperSchema, k as CLI, m as memberVia, n as GLOBAL_ROLES, o as rootName, p as liveSessionSql, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, x as userIdHelperSql, y as subjectIdSql } from "./shared-1uhI-e-b.js";
+//#region src/cli/pg.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const STATEMENT_TIMEOUT_MS = 6e4;
+function loadPg(command) {
+	return requirePeer(() => import("pg"), "pg", command);
 }
-function apiKeyFields(setting) {
-	const settings = setting === true ? {} : setting;
+function options(db) {
 	return {
-		claim: field(settings, "claim"),
-		scopes: field(settings, "scopes"),
-		tenant: field(settings, "tenant"),
-		roles: field(settings, "roles"),
-		serviceRoles: [...new Set(settings.serviceRoles ?? [])]
+		connectionString: db,
+		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+		statement_timeout: STATEMENT_TIMEOUT_MS
 	};
 }
-function apiKeysPlan(setting, declared, renamed) {
-	if (setting === void 0) return;
-	const fields = apiKeyFields(setting);
-	const unknown = fields.serviceRoles.filter((role) => !declared.has(role));
-	if (unknown.length > 0) throw new Error(`PermDock CLI: rls.apiKeys.serviceRoles names roles the policy does not declare: ${unknown.join(", ")}`);
+/** Ctrl-C ends the connection, so a query that hangs cannot keep the process alive. */
+function endOnInterrupt(end) {
+	const interrupt = () => {
+		end().catch(() => void 0);
+		process.exitCode = 130;
+	};
+	process.once("SIGINT", interrupt);
+	return async () => {
+		process.off("SIGINT", interrupt);
+		await end();
+	};
+}
+function unreachable(command, cause) {
+	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, { cause });
+}
+/** The default `connect` of a command: one connection, failing with a message that names `command`. */
+function pgConnector(command) {
+	return (db) => connectPg(db, command);
+}
+/** One connection, for commands that run a transaction. */
+async function connectPg(db, command) {
+	const client = new (await (loadPg(command))).Client(options(db));
+	try {
+		await client.connect();
+	} catch (cause) {
+		throw unreachable(command, cause);
+	}
 	return {
-		...fields,
-		...Object.keys(renamed).length === 0 ? {} : { renamed }
+		query: (sql, values) => client.query(sql, values),
+		end: endOnInterrupt(() => client.end())
 	};
 }
-function qualified(ctx, name) {
-	return `${quoteIdent(ctx.schema ?? "permdock")}.${name}`;
+/** A small pool, for independent catalog reads that can run in parallel. */
+async function connectPgPool(db, command) {
+	const pool = new (await (loadPg(command))).Pool({
+		...options(db),
+		max: 4
+	});
+	try {
+		(await pool.connect()).release();
+	} catch (cause) {
+		await pool.end();
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => pool.query(sql, values),
+		end: endOnInterrupt(() => pool.end())
+	};
 }
-function keyOf(ctx, plan) {
-	return `(select ${subjectClaimJsonSql(ctx, plan.claim)} as k) api_key`;
+//#endregion
+//#region src/cli/sql/active.ts
+function checkActiveRow(label, row) {
+	quoteTable(row.table);
+	quoteIdent(row.id);
+	if (row.disabledAt !== void 0) quoteIdent(row.disabledAt);
+	if (row.status !== void 0) {
+		quoteIdent(row.status);
+		if (row.active === void 0 || row.active.length === 0) throw new Error(`PermDock CLI: ${label}.status needs the active values in ${label}.active`);
+	}
+	if (row.disabledAt === void 0 && row.status === void 0) throw new Error(`PermDock CLI: ${label} needs disabledAt or status to tell an active row`);
+}
+/** Validates `rls.suspension` and keys its scopes by declared name. */
+function checkSuspension(suspension, scopes) {
+	if (suspension === void 0) return;
+	if (suspension.users !== void 0) checkActiveRow("rls.suspension.users", suspension.users);
+	const byName = {};
+	for (const [key, row] of Object.entries(suspension.scopes ?? {})) {
+		const name = resolveScope(scopes, key);
+		if (name === void 0) throw new Error(`PermDock CLI: rls.suspension.scopes.${key} names a scope the policy does not declare`);
+		checkActiveRow(`rls.suspension.scopes.${key}`, row);
+		if (row.keep !== void 0 && !Array.isArray(row.keep)) throw new Error(`PermDock CLI: rls.suspension.scopes.${key}.keep is a list of permissions or permission keys`);
+		const keep = keptKeys(row);
+		const { keep: _given, ...active } = row;
+		byName[name] = keep.length === 0 ? active : {
+			...active,
+			keep
+		};
+	}
+	const memberships = suspension.memberships;
+	if (memberships?.keep !== void 0 && !Array.isArray(memberships.keep)) throw new Error("PermDock CLI: rls.suspension.memberships.keep is a list of permissions or permission keys");
+	const keep = keptKeys(memberships);
+	return {
+		...suspension.users === void 0 ? {} : { users: suspension.users },
+		...Object.keys(byName).length === 0 ? {} : { scopes: byName },
+		...keep.length === 0 ? {} : { memberships: { keep } }
+	};
 }
-function permissionOf(plan, expr) {
-	return plan.renamed === void 0 ? expr : `coalesce(${quoteLiteral(JSON.stringify(plan.renamed))}::jsonb ->> ${expr}, ${expr})`;
+function disabledKeep(ctx) {
+	return keptKeys(ctx.suspension?.memberships);
 }
-function apiKeyAllowsCall(ctx, grant) {
-	return `${qualified(ctx, API_KEY_ALLOWS)}(${grant})`;
+function activeMembershipSql(ctx, disabledAt, permission = ctx.permission === void 0 ? void 0 : { key: ctx.permission }) {
+	if (disabledAt === void 0) return [];
+	const keep = disabledKeep(ctx);
+	if (permission !== void 0 && "key" in permission && keep.includes(permission.key)) return [];
+	return permission !== void 0 && "sql" in permission && keep.length > 0 ? [`(${disabledAt} is null or ${permission.sql} = any(array[${keep.map(quoteLiteral).join(", ")}]::text[]))`] : [`${disabledAt} is null`];
 }
-function apiKeyAllowsSql(ctx, plan, anonExecute) {
-	const fn = qualified(ctx, API_KEY_ALLOWS);
-	const scopes = `k -> ${quoteLiteral(plan.scopes)}`;
-	const grants = anonExecute ? `revoke execute on function ${fn}(text) from public;
-grant execute on function ${fn}(text) to anon, authenticated;` : `revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;`;
-	return `-- API keys: the ${plan.claim} claim's ${plan.scopes} list is a ceiling on every allow; denies always apply, and a request without the claim is not limited
-create or replace function ${fn}(p_grant text)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select case
-    when k is null or k = 'null'::jsonb then true
-    when exists (
-      select 1 from ${qualified(ctx, "role_permissions")} rp
-      where rp.grant_key = p_grant and rp.effect = 'deny'
-    ) then true
-    when jsonb_typeof(k) is distinct from 'object' or jsonb_typeof(${scopes}) is distinct from 'array' then false
-    else exists (
-      select 1
-      from jsonb_array_elements_text(${scopes}) s(permission)
-      where ${permissionOf(plan, "s.permission")} = split_part(split_part(p_grant, '#', 1), '@', 1)
-    )
-  end
-  from ${keyOf(ctx, plan)}
-$$;
-${grants}`;
+function keptRowSql(keep, permission) {
+	const kind = `coalesce(jsonb_typeof(${keep}), 'null')`;
+	if (permission === void 0) return `${kind} = 'null'`;
+	return `case ${kind} when 'null' then true when 'array' then ${keep} @> jsonb_build_array(${"key" in permission ? quoteLiteral(permission.key) : permission.sql}) else false end`;
 }
-function serviceRolesJson(plan) {
-	return `${quoteLiteral(JSON.stringify(plan.serviceRoles))}::jsonb`;
+/**
+* `exists` over an active row whose id column equals `id`: a missing row is
+* suspended, so the check fails closed.
+*/
+function activeRowSql(row, id) {
+	const table = quoteTable(qualifySqlTable(row.table));
+	const parts = [`s.${quoteIdent(row.id)} = ${id}`];
+	if (row.disabledAt !== void 0) parts.push(`s.${quoteIdent(row.disabledAt)} is null`);
+	if (row.status !== void 0) {
+		const values = (row.active ?? []).map(quoteLiteral).join(", ");
+		parts.push(`s.${quoteIdent(row.status)}::text = any(array[${values}]::text[])`);
+	}
+	return `exists (select 1 from ${table} s where ${parts.join(" and ")})`;
 }
-function serviceKeyRows(ctx, plan) {
-	const roles = `k -> ${quoteLiteral(plan.roles)}`;
-	return `  from ${keyOf(ctx, plan)}
-  cross join lateral jsonb_array_elements_text(
-    case jsonb_typeof(${roles}) when 'array' then ${roles} else ${serviceRolesJson(plan)} end
-  ) r(role)`;
+/** The active-user check for `user`; empty without `rls.suspension.users`. */
+function activeUserSql(ctx, user = subjectIdSql(ctx)) {
+	const row = ctx.suspension?.users;
+	return row === void 0 ? [] : [activeRowSql(row, user)];
 }
-function serviceKeyFilters(ctx, plan, root, permission) {
-	const tenant = `k ->> ${quoteLiteral(plan.tenant)}`;
-	return [
-		`jsonb_typeof(k) = 'object'`,
-		`coalesce(${subjectIdSql(ctx)}::text, '') = ''`,
-		`coalesce(${tenant}, '') <> ''`,
-		...activeInstancesSql(ctx, root, (name) => name === root ? tenant : void 0, permission)
-	];
+/** The permission of a grant key held in `grant`: `key#group` and `key@level` name `key`. */
+function grantPermissionSql(grant) {
+	return { sql: `split_part(split_part(${grant}, '#', 1), '@', 1)` };
 }
-function serviceKeyIdsSql(ctx, plan, root, type) {
-	const kind = kindFilterSql(ctx, "r.role", { value: "credential" });
-	const set = ctx.grantSet === true;
-	const filters = [
-		...serviceKeyFilters(ctx, plan, root, grantPermissionSql(set ? "rp.grant_key" : "p_grant")),
-		...set ? [] : ["rp.grant_key = p_grant"],
-		`rp.scope = ${quoteLiteral(root)}`,
-		...kind === void 0 ? [] : [kind]
-	];
-	return `  select (k ->> ${quoteLiteral(plan.tenant)})::${type}${set ? ", rp.grant_key" : ""}
-${serviceKeyRows(ctx, plan)}
-  join ${qualified(ctx, "role_permissions")} rp on rp.role = r.role
-  where ${filters.join("\n    and ")}`;
+/**
+* The active-instance check for every suspendable scope on `scope`'s chain:
+* its own and each ancestor's. `idOf` gives the SQL for the id the membership
+* holds for a scope on that chain. A scope's `keep` lets `permission` through
+* a suspended instance: a kept key known now drops its check, and one read
+* at run time is compared with the kept keys.
+*/
+function activeInstancesSql(ctx, scope, idOf, permission = ctx.permission === void 0 ? void 0 : { key: ctx.permission }) {
+	const parts = [];
+	for (const name of scopeChain(ctx.scopes, scope)) {
+		const row = ctx.suspension?.scopes?.[name];
+		if (row === void 0) continue;
+		const id = idOf(name);
+		if (id === void 0) throw new Error(`PermDock CLI: rls.suspension.scopes.${name} needs the ${name} id on ${scope} memberships: add columns.${name} to the ${scope} memberships table`);
+		const keep = keptKeys(row);
+		if (permission !== void 0 && "key" in permission && keep.includes(permission.key)) continue;
+		const active = activeRowSql(row, `(${id})::${scopeTypeOf(ctx, name)}`);
+		parts.push(permission !== void 0 && "sql" in permission && keep.length > 0 ? `(${active} or ${permission.sql} = any(array[${keep.map(quoteLiteral).join(", ")}]::text[]))` : active);
+	}
+	return parts;
 }
-function serviceKeyMemberSql(ctx, plan, root, type) {
-	return `  select distinct (k ->> ${quoteLiteral(plan.tenant)})::${type}
-${serviceKeyRows(ctx, plan)}
-  where ${serviceKeyFilters(ctx, plan, root).join("\n    and ")}`;
+//#endregion
+//#region src/cli/sql/names.ts
+/** The closure table graph grants read. Part of the SQL contract. */
+const CLOSURE = { table: "permdock_closure" };
+/**
+* The snake_case SQL name of a resource or link (`chatThread` becomes
+* `chat_thread`), or `undefined` when it is not made of ASCII letters,
+* digits and underscores starting with a letter.
+*/
+function graphSqlName(name) {
+	if (!/^[A-Za-z][A-Za-z0-9_]*$/u.test(name)) return;
+	return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1_$2").replaceAll(/([A-Z]+)([A-Z][a-z])/gu, "$1_$2").toLowerCase();
 }
-function ceilingIdsSql(body, allows) {
-	return `  select ids.id
-  from (
-${body}
-  ) ids(id)
-  where ${allows}`;
+function sqlNameOf(name, label) {
+	const sql = graphSqlName(name);
+	if (sql === void 0) throw new Error(`PermDock CLI: ${label} is not a SQL name (letters, digits and underscores, starting with a letter), so rls generate cannot name its helper`);
+	return sql;
 }
-function ceilingHasSql(body, allows) {
-	return `  select ${allows} and coalesce((
-${body}
-  ), false)`;
+/** The helper returning the ids of `resource` the subject holds a relation on: `permitted_<snake_case resource>_ids`. */
+function graphHelper(resource) {
+	return permittedIdsHelper(sqlNameOf(resource, `resource '${resource}'`));
+}
+function inheritedRowsHelper(resource) {
+	return `permitted_${sqlNameOf(resource, `resource '${resource}'`)}_rows`;
+}
+/** The helper returning the ids of `resource` whose `link` points into the ids it is given. */
+function linkHelper(resource, link) {
+	return `permdock_link_${sqlNameOf(resource, `resource '${resource}'`)}_${sqlNameOf(link, `link '${link}' on ${resource}`)}`;
+}
+function restrictedHelper(resource) {
+	return `permdock_restricted_${sqlNameOf(resource, `resource '${resource}'`)}`;
+}
+/** Graph SQL parts as RLS text: values inline as literals, the subject from the dialect's claim. */
+function graphSqlText(parts, ctx) {
+	return parts.map((part) => {
+		if ("text" in part) return part.text;
+		if ("column" in part) return quoteIdent(part.column);
+		if ("subject" in part) return subjectIdSql(ctx);
+		return typeof part.value === "string" ? quoteLiteral(part.value) : String(part.value);
+	}).join("");
+}
+/**
+* The role column of an `rls.memberships` table aliased `alias`; a `through`
+* column joins its roles table as `<alias>k`, after a newline and `indent`
+* (inline without one).
+*/
+function memberRoleOf(table, alias = "m", indent) {
+	return roleColumn(table.role, qualifySqlTable(table.table), alias, {
+		label: `rls.memberships ${table.table} role`,
+		prefix: CLI,
+		...indent === void 0 ? {} : { indent }
+	});
+}
+/** The schema-qualified name of a table under `search_path = ''`. */
+/** The helper returning the ids of scope `name` a grant key reaches. */
+function permittedIdsHelper(name) {
+	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw new Error(`PermDock CLI: unsafe scope name '${name}'`);
+	return `permitted_${name}_ids`;
+}
+/** `permitted_<scope>_ids_for(p_user, p_grant)`: the same ids for a user the caller names. */
+function permittedForHelper(name) {
+	return `${permittedIdsHelper(name)}_for`;
+}
+/** The helper returning the ids of scope `name` the subject holds any live membership of. */
+function memberIdsHelper(name) {
+	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw new Error(`PermDock CLI: unsafe scope name '${name}'`);
+	return `member_${name}_ids`;
+}
+/** `member_<scope>_ids_for(p_user uuid)`: the same rows for a user the caller names; the token hook's helper. */
+function memberForHelper(name) {
+	return `${memberIdsHelper(name)}_for`;
+}
+/**
+* Whether `member_<scope>_ids_for` is generated for `name`: Supabase only
+* (its one caller is `supabase_auth_admin`), and only where `memberships` maps
+* a table for the scope or a membership source can hold it.
+*/
+function hasMemberFor(input, name) {
+	if (input.dialect !== "supabase") return false;
+	return memberForTable(input, name) !== void 0 || memberForSources(input, name).length > 0;
+}
+/** The table `member_<scope>_ids_for` reads for scope `name`, when `memberships` maps one with its id column. */
+function memberForTable(input, name) {
+	const table = scopeMembershipTable(input.memberships, input.scopes, name);
+	return table !== void 0 && scopeColumn(table, input.scopes, name) !== void 0 ? table : void 0;
+}
+/** The sources `member_<scope>_ids_for` reads: none when a table is mapped, as in `database` mode. */
+function memberForSources(input, name) {
+	if (memberForTable(input, name) !== void 0) return [];
+	return (input.memberSources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
+}
+/**
+* The membership sources that can hold scope `name` when `memberships` maps
+* no table for it: every `fromTable` source and the `fromJunction` sources of
+* that scope. Empty outside `database` mode.
+*/
+function scopeSources(ctx, name) {
+	if (ctx.authorize !== "database" || scopeTable(ctx, name) !== void 0) return [];
+	return (ctx.sources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
+}
+/** The membership table mapped for scope `name`, with the column of its id and of the first scope's id. */
+function scopeTable(ctx, name) {
+	const table = scopeMembershipTable(ctx.memberships, ctx.scopes, name);
+	if (table === void 0) return;
+	const column = scopeColumn(table, ctx.scopes, name);
+	if (column === void 0) return;
+	const root = rootScope(ctx.scopes);
+	const tenantColumn = root !== void 0 && scopeChain(ctx.scopes, name).includes(root) ? scopeColumn(table, ctx.scopes, root) : void 0;
+	return tenantColumn === void 0 ? {
+		table,
+		column
+	} : {
+		table,
+		column,
+		tenantColumn
+	};
 }
 //#endregion
-//#region src/cli/rls-conditions.ts
+//#region src/cli/sql/conditions.ts
 const MAX_CLAIM_DEPTH = 8;
 /**
 * The claim path of a `principal.claim.*` / `principal.claims.*` ref, one
@@ -308,10 +451,10 @@ function compileMemberOf(condition, ctx) {
 			return hopTable?.id === void 0 ? [] : [existsSql(hopTable, hopTable.id, parent.field, condition.roles, ctx)];
 		})].join(" or ")})`;
 	}
-	if (scope !== void 0 && condition.roles.length === 0 && scopeSources(ctx, scope).length > 0) return `${quoteIdent(condition.field)} in (select ${quoteIdent(ctx.schema ?? "permdock")}.${memberIdsHelper(scope)}())`;
+	if (scope !== void 0 && condition.roles.length === 0 && scopeSources(ctx, scope).length > 0) return `${quoteIdent(condition.field)} in (select ${qualified(ctx, memberIdsHelper(scope))}())`;
 	if (scope !== void 0 && scope === rootScope(ctx.scopes)) {
 		const parts = [
-			ctx.tenants === "all" ? `${quoteIdent(condition.field)} in (select ${quoteIdent(ctx.schema ?? "permdock")}.${memberIdsHelper(scope)}())` : `${quoteIdent(condition.field)} = ${tenantClaimSql(ctx)}`,
+			ctx.tenants === "all" ? `${quoteIdent(condition.field)} in (select ${qualified(ctx, memberIdsHelper(scope))}())` : `${quoteIdent(condition.field)} = ${tenantClaimSql(ctx)}`,
 			...ctx.tenants === "all" ? [] : [keyTenantSql(ctx, quoteIdent(condition.field))].filter((part) => part !== void 0),
 			...activeUserSql(ctx),
 			...activeInstancesSql(ctx, scope, () => quoteIdent(condition.field))
@@ -448,12 +591,12 @@ function compileRelatedSql(condition, ctx) {
 	const type = ctx.columnTypes?.[condition.field];
 	const cast = type === void 0 || type === "text" ? "" : `::${type}`;
 	const column = type === void 0 ? `${quoteIdent(condition.field)}::text` : quoteIdent(condition.field);
-	const helper = condition.permission === void 0 ? `${`${quoteIdent(ctx.schema ?? "permdock")}.${graphHelper(condition.resource)}`}(${quoteLiteral(condition.relation)})` : `${quoteIdent(ctx.schema ?? "permdock")}.${inheritedRowsHelper(condition.resource)}(${quoteLiteral(condition.permission)})`;
+	const helper = condition.permission === void 0 ? `${qualified(ctx, graphHelper(condition.resource))}(${quoteLiteral(condition.relation)})` : `${qualified(ctx, inheritedRowsHelper(condition.resource))}(${quoteLiteral(condition.permission)})`;
 	const cap = ctx.graph?.closures[condition.resource];
 	let inner;
 	if (condition.depth > 0 && cap !== void 0) {
 		const depth = condition.depth < cap ? ` and depth <= ${String(condition.depth)}` : "";
-		inner = `select descendant${cast} from ${`${quoteIdent(ctx.schema ?? "permdock")}.${CLOSURE.table}`} where resource = ${quoteLiteral(condition.resource)}${depth} and ancestor = any (array(select ${helper}))`;
+		inner = `select descendant${cast} from ${qualified(ctx, CLOSURE.table)} where resource = ${quoteLiteral(condition.resource)}${depth} and ancestor = any (array(select ${helper}))`;
 	} else inner = cast === "" ? `select ${helper}` : `select p.id${cast} from ${helper} as p(id)`;
 	const reach = `${column} in (${inner})`;
 	if (condition.parent === true && condition.restricted !== void 0) return `(${reach} and ${quoteIdent(condition.restricted)} is not true)`;
@@ -467,13 +610,13 @@ function compileRelatedSql(condition, ctx) {
 function compileHoppedSql(condition, ctx) {
 	const resources = ctx.graph?.resources;
 	if (resources === void 0) throw new Error("PermDock CLI: a related condition with link hops needs the policy resources in the RLS context");
-	const schema = quoteIdent(ctx.schema ?? "permdock");
+	const schema = quoteIdent(helperSchema(ctx));
 	return graphSqlText(relatedSql(condition, {
 		resources,
 		...ctx.graph?.tables === void 0 ? {} : { tables: ctx.graph.tables },
-		closure: `${ctx.schema ?? "permdock"}.${CLOSURE.table}`,
+		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
 		closureDepths: ctx.graph?.closures ?? {},
-		qualify: qualifiedTable,
+		qualify: qualifySqlTable,
 		holders: (resource, relation) => [{ text: `select ${schema}.${graphHelper(resource)}(${quoteLiteral(relation)})` }],
 		permitted: (resource, permission) => [{ text: `select ${schema}.${inheritedRowsHelper(resource)}(${quoteLiteral(permission)})` }],
 		restrictedRows: (resource) => [{ text: `select ${schema}.${restrictedHelper(resource)}()` }],
@@ -485,7 +628,7 @@ function compileHoppedSql(condition, ctx) {
 	}), ctx);
 }
 //#endregion
-//#region src/cli/rls-grants.ts
+//#region src/cli/sql/grants.ts
 /**
 * The `role_permissions` grant key of a break-glass grant. It differs from
 * the permission key, so `authorize()` and the table policies never count it;
@@ -606,66 +749,166 @@ function roleNames(policy) {
 	return [...names];
 }
 //#endregion
-//#region src/cli/global-roles.ts
-function qualify(name, schema) {
-	return name.includes(".") ? name : `${schema}.${name}`;
+//#region src/cli/rls/api-keys.ts
+const API_KEY_ALLOWS = "permdock_api_key_allows";
+const DEFAULTS = {
+	claim: "api_key",
+	scopes: "scopes",
+	tenant: "tenant",
+	roles: "roles"
+};
+function field(settings, name) {
+	const value = settings[name] ?? DEFAULTS[name];
+	if (typeof value !== "string" || !SQL_IDENT.test(value)) throw new Error(`PermDock CLI: rls.apiKeys.${name} must be a claim field name matching ${SQL_IDENT.source}`);
+	return value;
 }
-/** Resolves `source` against `schema`, aliasing the table `alias` and the roles table `<alias>k`. */
-function globalRoleSource(source, schema, alias) {
-	const table = qualify(source.table, schema);
-	const user = source.user ?? "user_id";
-	const role = roleColumn(source.role ?? "role", table, alias, {
-		label: "roles.role",
-		prefix: "PermDock CLI",
-		indent: "    "
-	});
+function apiKeyFields(setting) {
+	const settings = setting === true ? {} : setting;
 	return {
-		table,
-		user,
-		from: `${quoteTable(table)} ${alias}${role.join}`,
-		userSql: `${alias}.${quoteIdent(user)}`,
-		roleSql: role.sql,
-		role: roleManifest(role),
-		...role.through === void 0 ? {} : { through: role.through }
+		claim: field(settings, "claim"),
+		scopes: field(settings, "scopes"),
+		tenant: field(settings, "tenant"),
+		roles: field(settings, "roles"),
+		serviceRoles: [...new Set(settings.serviceRoles ?? [])]
 	};
 }
-//#endregion
-//#region src/cli/rls-custom-roles.ts
-/** The readers every helpers file ends with. Names are part of the SQL contract. */
-const READERS = {
-	keys: "permdock_permission_keys",
-	roles: "permdock_role_permissions",
-	trusted: "permdock_trusted_role_permissions"
-};
-/**
-* The custom-role objects: the tables (`database` mode), the ceiling view
-* over the `assignable` declared roles, and `permdock_custom_keys`, which
-* resolves one custom role to the grant keys it holds in a scope. A row in
-* the tables can never reach a key outside the view.
-*/
-function customRolesSql(ctx) {
-	const custom = ctx.customRoles;
-	if (custom === void 0) return "";
-	const rp = qualified$1(ctx, "role_permissions");
-	const ceiling = qualified$1(ctx, CUSTOM_ROLES.ceiling);
-	const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
-	const chunks = [];
-	if (ctx.authorize === "database") {
-		const tenantType = tenantTypeOf(ctx);
-		for (const [name, column, check] of [[
-			CUSTOM_ROLES.permissions,
-			"permission",
-			`,
-  effect text not null default 'allow' check (effect in ('allow', 'deny'))`
-		], [
-			CUSTOM_ROLES.includes,
-			"include_role",
-			""
-		]]) {
-			const table = qualified$1(ctx, name);
+function apiKeysPlan(setting, declared, renamed) {
+	if (setting === void 0) return;
+	const fields = apiKeyFields(setting);
+	const unknown = fields.serviceRoles.filter((role) => !declared.has(role));
+	if (unknown.length > 0) throw new Error(`PermDock CLI: rls.apiKeys.serviceRoles names roles the policy does not declare: ${unknown.join(", ")}`);
+	return {
+		...fields,
+		...Object.keys(renamed).length === 0 ? {} : { renamed }
+	};
+}
+function keyOf(ctx, plan) {
+	return `(select ${subjectClaimJsonSql(ctx, plan.claim)} as k) api_key`;
+}
+function permissionOf(plan, expr) {
+	return plan.renamed === void 0 ? expr : `coalesce(${quoteLiteral(JSON.stringify(plan.renamed))}::jsonb ->> ${expr}, ${expr})`;
+}
+function apiKeyAllowsCall(ctx, grant) {
+	return `${qualified(ctx, API_KEY_ALLOWS)}(${grant})`;
+}
+function apiKeyAllowsSql(ctx, plan, anonExecute) {
+	const fn = qualified(ctx, API_KEY_ALLOWS);
+	const scopes = `k -> ${quoteLiteral(plan.scopes)}`;
+	const grants = anonExecute ? `revoke execute on function ${fn}(text) from public;
+grant execute on function ${fn}(text) to anon, authenticated;` : `revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+	return `-- API keys: the ${plan.claim} claim's ${plan.scopes} list is a ceiling on every allow; denies always apply, and a request without the claim is not limited
+create or replace function ${fn}(p_grant text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select case
+    when k is null or k = 'null'::jsonb then true
+    when exists (
+      select 1 from ${qualified(ctx, "role_permissions")} rp
+      where rp.grant_key = p_grant and rp.effect = 'deny'
+    ) then true
+    when jsonb_typeof(k) is distinct from 'object' or jsonb_typeof(${scopes}) is distinct from 'array' then false
+    else exists (
+      select 1
+      from jsonb_array_elements_text(${scopes}) s(permission)
+      where ${permissionOf(plan, "s.permission")} = split_part(split_part(p_grant, '#', 1), '@', 1)
+    )
+  end
+  from ${keyOf(ctx, plan)}
+$$;
+${grants}`;
+}
+function serviceRolesJson(plan) {
+	return `${quoteLiteral(JSON.stringify(plan.serviceRoles))}::jsonb`;
+}
+function serviceKeyRows(ctx, plan) {
+	const roles = `k -> ${quoteLiteral(plan.roles)}`;
+	return `  from ${keyOf(ctx, plan)}
+  cross join lateral jsonb_array_elements_text(
+    case jsonb_typeof(${roles}) when 'array' then ${roles} else ${serviceRolesJson(plan)} end
+  ) r(role)`;
+}
+function serviceKeyFilters(ctx, plan, root, permission) {
+	const tenant = `k ->> ${quoteLiteral(plan.tenant)}`;
+	return [
+		`jsonb_typeof(k) = 'object'`,
+		`coalesce(${subjectIdSql(ctx)}::text, '') = ''`,
+		`coalesce(${tenant}, '') <> ''`,
+		...activeInstancesSql(ctx, root, (name) => name === root ? tenant : void 0, permission)
+	];
+}
+function serviceKeyIdsSql(ctx, plan, root, type) {
+	const kind = kindFilterSql(ctx, "r.role", { value: "credential" });
+	const set = ctx.grantSet === true;
+	const filters = [
+		...serviceKeyFilters(ctx, plan, root, grantPermissionSql(set ? "rp.grant_key" : "p_grant")),
+		...set ? [] : ["rp.grant_key = p_grant"],
+		`rp.scope = ${quoteLiteral(root)}`,
+		...kind === void 0 ? [] : [kind]
+	];
+	return `  select (k ->> ${quoteLiteral(plan.tenant)})::${type}${set ? ", rp.grant_key" : ""}
+${serviceKeyRows(ctx, plan)}
+  join ${qualified(ctx, "role_permissions")} rp on rp.role = r.role
+  where ${filters.join("\n    and ")}`;
+}
+function serviceKeyMemberSql(ctx, plan, root, type) {
+	return `  select distinct (k ->> ${quoteLiteral(plan.tenant)})::${type}
+${serviceKeyRows(ctx, plan)}
+  where ${serviceKeyFilters(ctx, plan, root).join("\n    and ")}`;
+}
+function ceilingIdsSql(body, allows) {
+	return `  select ids.id
+  from (
+${body}
+  ) ids(id)
+  where ${allows}`;
+}
+function ceilingHasSql(body, allows) {
+	return `  select ${allows} and coalesce((
+${body}
+  ), false)`;
+}
+//#endregion
+//#region src/cli/rls/custom-roles.ts
+/** The readers every helpers file ends with. Names are part of the SQL contract. */
+const READERS = {
+	keys: "permdock_permission_keys",
+	roles: "permdock_role_permissions",
+	trusted: "permdock_trusted_role_permissions"
+};
+/**
+* The custom-role objects: the tables (`database` mode), the ceiling view
+* over the `assignable` declared roles, and `permdock_custom_keys`, which
+* resolves one custom role to the grant keys it holds in a scope. A row in
+* the tables can never reach a key outside the view.
+*/
+function customRolesSql(ctx) {
+	const custom = ctx.customRoles;
+	if (custom === void 0) return "";
+	const rp = qualified(ctx, "role_permissions");
+	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
+	const keys = qualified(ctx, CUSTOM_ROLES.keys);
+	const chunks = [];
+	if (ctx.authorize === "database") {
+		const tenantType = tenantTypeOf(ctx);
+		for (const [name, column, check] of [[
+			CUSTOM_ROLES.permissions,
+			"permission",
+			`,
+  effect text not null default 'allow' check (effect in ('allow', 'deny'))`
+		], [
+			CUSTOM_ROLES.includes,
+			"include_role",
+			""
+		]]) {
+			const table = qualified(ctx, name);
 			const leveled = custom.levels === true && name === CUSTOM_ROLES.permissions;
 			const unique = `${column}${name === CUSTOM_ROLES.permissions ? ", effect" : ""}${leveled ? ", coalesce(level, '')" : ""}`;
-			const index = leveled ? `drop index if exists ${qualified$1(ctx, quoteIdent(`${name}_key`))};
+			const index = leveled ? `drop index if exists ${qualified(ctx, quoteIdent(`${name}_key`))};
 alter table ${table} add column if not exists level text check (level ~ '^[a-z][a-z0-9_]*$');
 create unique index if not exists ${quoteIdent(`${name}_level_key`)}` : `create unique index if not exists ${quoteIdent(`${name}_key`)}`;
 			chunks.push(`create table if not exists ${table} (
@@ -679,6 +922,8 @@ create unique index if not exists ${quoteIdent(`${name}_level_key`)}` : `create
 );
 ${index}
   on ${table} (coalesce(tenant_id::text, ''), scope, coalesce(scope_id, ''), role, ${unique});
+-- a row identity for triggers the application adds, such as an audit trigger that reads the primary key
+alter table ${table} add column if not exists id bigint generated always as identity primary key;
 alter table ${table} enable row level security;
 revoke all on table ${table} from anon, authenticated, public;`);
 		}
@@ -687,7 +932,7 @@ revoke all on table ${table} from anon, authenticated, public;`);
 create or replace view ${ceiling} with (security_invoker = true) as
 select rp.scope, rp.role, rp.permission, rp.grant_key, rp.effect
 from ${rp} rp
-where rp.role = any(${textArray(custom.assignable)})
+where rp.role = any(${sqlTextArray(custom.assignable)})
   and exists (
     select 1 from ${rp} a
     where a.role = rp.role
@@ -766,9 +1011,9 @@ revoke execute on function ${keys}(text[], text[], text[], text) from public, an
 * `unknown-level`.
 */
 function leveledKeysSql(ctx, renames) {
-	const rp = qualified$1(ctx, "role_permissions");
-	const ceiling = qualified$1(ctx, CUSTOM_ROLES.ceiling);
-	const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
+	const rp = qualified(ctx, "role_permissions");
+	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
+	const keys = qualified(ctx, CUSTOM_ROLES.keys);
 	const renamed = renames.length > 0;
 	const prelude = renamed ? `renamed (former, key) as (values ${renames.map(([former, current]) => `(${quoteLiteral(former)}, ${quoteLiteral(current)})`).join(", ")}),
   ` : "";
@@ -899,15 +1144,15 @@ function renamesSql(renames) {
 * `resolveCustomRole` returns it, never for a deny that merely removes an allow.
 */
 function roleReadersSql(ctx, permissions, trustedReaders) {
-	const rp = qualified$1(ctx, "role_permissions");
-	const reader = qualified$1(ctx, READERS.roles);
+	const rp = qualified(ctx, "role_permissions");
+	const reader = qualified(ctx, READERS.roles);
 	const tenantType = tenantTypeOf(ctx);
 	const custom = ctx.customRoles;
 	const root = ctx.scopes[0]?.name;
 	const database = ctx.authorize === "database";
 	const chunks = [];
 	if (permissions !== void 0) {
-		const catalog = qualified$1(ctx, READERS.keys);
+		const catalog = qualified(ctx, READERS.keys);
 		chunks.push(`-- every declared permission key
 create or replace function ${catalog}()
 returns setof text
@@ -915,7 +1160,7 @@ language sql
 stable
 set search_path = ''
 as $$
-  select k.permission from unnest(${textArray(permissions.toSorted())}) k(permission) order by 1
+  select k.permission from unnest(${sqlTextArray(permissions.toSorted())}) k(permission) order by 1
 $$;
 revoke execute on function ${catalog}() from public, anon;
 grant execute on function ${catalog}() to authenticated;
@@ -931,7 +1176,7 @@ as $$
   from ${rp} rp
   where rp.scope = p_scope
     and rp.effect = 'allow'
-    and rp.permission = any(${textArray(permissions.toSorted())})
+    and rp.permission = any(${sqlTextArray(permissions.toSorted())})
   order by 1
 $$;
 revoke execute on function ${catalog}(text) from public, anon;
@@ -948,24 +1193,24 @@ ${declared};
 end;`;
 	let trustedBody = body;
 	if (custom !== void 0 && database && root !== void 0) {
-		const tenant = qualified$1(ctx, CUSTOM_ROLES.permissions);
-		const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
-		const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
-		const shape = qualified$1(ctx, CUSTOM_ROLES.shape);
-		const ids = (helper) => `(select x::text from ${qualified$1(ctx, helper)}() x)`;
+		const tenant = qualified(ctx, CUSTOM_ROLES.permissions);
+		const includes = qualified(ctx, CUSTOM_ROLES.includes);
+		const keys = qualified(ctx, CUSTOM_ROLES.keys);
+		const shape = qualified(ctx, CUSTOM_ROLES.shape);
+		const ids = (helper) => `(select x::text from ${qualified(ctx, helper)}() x)`;
 		const memberOf = `p_tenant::text in ${ids(memberIdsHelper(root))}
       or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${ids(memberIdsHelper(scope))}`)}`;
 		const manage = custom.manage ?? [];
 		const platform = manage.length === 0 ? "false" : `exists (
         select 1 from ${rp} m
         where m.effect = 'allow'
-          and m.permission = any(${textArray(manage)})
-          and ${qualified$1(ctx, HELPERS.has)}(m.grant_key)
+          and m.permission = any(${sqlTextArray(manage)})
+          and ${qualified(ctx, HELPERS.has)}(m.grant_key)
       )`;
 		const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id and c.role = p_role`;
 		const allowEntryOf = custom.levels === true ? "c.permission || coalesce('@' || c.level, '')" : "c.permission";
 		const checked = (gate) => `begin
-  if p_role = any(${textArray(custom.declared)}) then
+  if p_role = any(${sqlTextArray(custom.declared)}) then
     return query
 ${declared};
     return;
@@ -1003,7 +1248,7 @@ ${body}
 $$;
 revoke execute on function ${reader}(text, text, ${tenantType}, text) from public, anon;
 grant execute on function ${reader}(text, text, ${tenantType}, text) to authenticated;`);
-	const trusted = qualified$1(ctx, READERS.trusted);
+	const trusted = qualified(ctx, READERS.trusted);
 	const signature = `text, text, ${tenantType}, text`;
 	const grants = trustedReaders === void 0 || trustedReaders.length === 0 ? "" : `\ngrant execute on function ${trusted}(${signature}) to ${trustedReaders.map(quoteIdent).join(", ")};`;
 	chunks.push(`create or replace function ${trusted}(p_role text, p_scope text, p_tenant ${tenantType} default null, p_scope_id text default null)
@@ -1037,593 +1282,39 @@ ${indent}  hint = ${quoteLiteral(hint)};`;
 function hasCustomRoleChecksFor(ctx) {
 	return ctx.authorize === "database" && ctx.customRoles !== void 0 && ctx.scopes.length > 0 && ctx.scopes.every((scope) => hasMemberFor(ctx, scope.name));
 }
-function callerFunctionsSql(ctx, custom, root, levelReach, forUser) {
-	const leveled = custom.levels === true;
-	const tenantType = tenantTypeOf(ctx);
-	const rp = qualified$1(ctx, "role_permissions");
-	const keys = qualified$1(ctx, CUSTOM_ROLES.keys);
-	const perms = qualified$1(ctx, CUSTOM_ROLES.permissions);
-	const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
-	const shape = qualified$1(ctx, CUSTOM_ROLES.shape);
-	const beyond = qualified$1(ctx, forUser ? CUSTOM_ROLES.beyondFor : CUSTOM_ROLES.beyond);
-	const guard = qualified$1(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
-	const user = forUser ? "p_user" : subjectIdSql(ctx);
-	const userParam = forUser ? "p_user uuid, " : "";
-	const userArg = forUser ? "uuid, " : "";
-	const userCall = forUser ? "p_user, " : "";
-	const has = (key) => forUser ? `${qualified$1(ctx, HELPERS.hasFor)}(p_user, ${key})` : `${qualified$1(ctx, HELPERS.has)}(${key})`;
-	const ids = (helper, arg) => `(select x::text from ${qualified$1(ctx, helper)}(${arg}) x)`;
-	const permitted = (scope, key) => forUser ? ids(permittedForHelper(scope), `p_user, ${key}`) : ids(permittedIdsHelper(scope), key);
-	const members = (scope) => forUser ? ids(memberForHelper(scope), "p_user") : ids(memberIdsHelper(scope), "");
-	const heldKey = (key) => `(${has(key)}
-        or (p_scope <> 'global'
-          and (p_tenant::text in ${permitted(root, key)}
-            or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${permitted(scope, key)}`)})))`;
-	const holdsAny = (permissions, held) => permissions.length === 0 ? "false" : `exists (
-    select 1 from ${rp} rp
-    where rp.effect = 'allow'
-      and rp.permission = any(${textArray(permissions)})
-      and ${held("rp.grant_key")}
-  )`;
-	const manageKeys = custom.manage ?? [];
-	const manage = holdsAny(manageKeys, heldKey);
-	const platform = holdsAny(manageKeys, has);
-	const requires = custom.requires === void 0 ? "" : `
-  if not ${holdsAny(custom.requires, heldKey)} then
-${raiseSql("    ", "42501", `'permdock: the caller may not manage roles in ' || coalesce(p_tenant::text, 'the platform')`, "manage-roles")}
-  end if;`;
-	const reachRows = levelReach.map(([grantKey, level]) => `(${quoteLiteral(grantKey)}, ${quoteLiteral(level)})`).join(", ");
-	const levelCheck = leveled && reachRows !== "" ? `
-      or exists (
-        select 1
-        from reach x
-        where x.grant_key = r.grant_key
-          and not exists (
-            select 1 from held h
-            join reach o on o.grant_key = h.grant_key
-            where h.permission = r.permission and o.level = x.level
-          )
-      )` : "";
-	const reachCte = leveled && reachRows !== "" ? `,
-    reach (grant_key, level) as (values ${reachRows})` : "";
-	const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id`;
-	const memberOf = `p_tenant::text in ${members(root)}
-      or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${members(scope)}`)}`;
-	return {
-		beyond: `-- custom-role writes: the permission keys of a definition the caller may not hand out in the tenant, as assignablePermissions computes them
-create or replace function ${beyond}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_allow text[], p_deny text[], p_include text[])
-returns setof text
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-begin
-  if ${manage} then
-    return;
-  end if;
-  return query
-  with resolved as (
-    select distinct rp.permission, k.key as grant_key
-    from ${keys}(p_allow, p_deny, p_include, p_scope) k(key)
-    join ${rp} rp on rp.grant_key = k.key and rp.effect = 'allow'
-  ),
-  held as (
-    select distinct rp.permission, rp.grant_key
-    from ${rp} rp
-    where rp.effect = 'allow'
-      and rp.permission in (select r.permission from resolved r)
-      and ${heldKey("rp.grant_key")}
-  )${reachCte}
-  select distinct r.permission
-  from resolved r
-  where not exists (select 1 from held h where h.permission = r.permission)${levelCheck};
-end;
-$$;
-revoke execute on function ${beyond}(${userArg}${tenantType}, text, text, text[], text[], text[]) from public, anon, authenticated;`,
-		guard: `-- a custom role the caller may change: membership of the tenant or the instance (a platform role, or a caller holding a manageRoles permission through a global role, needs none), and authority over the stored definition
-create or replace function ${guard}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
-returns void
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  v_allow text[];
-  v_deny text[];
-  v_include text[];
-  v_beyond text;
-begin
-  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
-  if not (${signedIn(ctx, user)} and (
-    ${platform}
-    or (p_scope <> 'global' and (${memberOf}))
-  )) then
-${raiseSql("    ", "42501", `'permdock: the caller is not a member of ' || coalesce(p_tenant::text, 'the platform')`, "not-member")}
-  end if;${requires}
-  select array_agg(${allowEntry(ctx)}) filter (where c.effect = 'allow'),
-    array_agg(c.permission) filter (where c.effect = 'deny')
-  into v_allow, v_deny
-  from ${perms} c
-  where ${match} and c.role = p_role;
-  select array_agg(c.include_role) into v_include
-  from ${includes} c
-  where ${match} and c.role = p_role;
-  select string_agg(b, ', ' order by b) into v_beyond
-  from ${beyond}(${userCall}p_tenant, p_scope, p_scope_id, v_allow, v_deny, v_include) b;
-  if v_beyond is not null then
-${raiseSql("    ", "42501", `'permdock: ' || p_role || ' allows ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
-  end if;
-end;
-$$;
-revoke execute on function ${guard}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;`
-	};
+//#endregion
+//#region src/cli/sql/global-roles.ts
+function qualify(name, schema) {
+	return name.includes(".") ? name : `${schema}.${name}`;
 }
-/**
-* The functions an application calls to save, rename and delete a custom
-* role in \`database\` mode, with the rules of \`validateCustomRole\` and
-* \`assignablePermissions\`: entries inside the ceiling of the role's scope,
-* includes naming declared roles, and only permissions and levels the caller
-* may hand out, for the new definition and the stored one alike. A platform
-* custom role (\`p_scope = 'global'\`, no tenant) is written by a caller who
-* holds a \`meta.manageRoles\` permission through a global role. The
-* \`permdock_trusted_*\` variants skip the caller checks and keep the
-* definition checks; no client role may execute them.
-*/
-function customRoleWritesSql(ctx, levelReach) {
-	const custom = ctx.customRoles;
-	const root = ctx.scopes[0]?.name;
-	if (custom === void 0 || ctx.authorize !== "database" || root === void 0) return "";
-	const leveled = custom.levels === true;
-	const tenantType = tenantTypeOf(ctx);
-	const rp = qualified$1(ctx, "role_permissions");
-	const ceiling = qualified$1(ctx, CUSTOM_ROLES.ceiling);
-	const perms = qualified$1(ctx, CUSTOM_ROLES.permissions);
-	const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
-	const beyond = qualified$1(ctx, CUSTOM_ROLES.beyond);
-	const guard = qualified$1(ctx, CUSTOM_ROLES.guard);
-	const shape = qualified$1(ctx, CUSTOM_ROLES.shape);
-	const entries = qualified$1(ctx, CUSTOM_ROLES.entries);
-	const renames = Object.entries(custom.renamed ?? {}).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	const current = (expr) => currentKeyExpr(renames, expr);
-	const known = textArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
-	const caller = callerFunctionsSql(ctx, custom, root, levelReach, false);
-	const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id`;
-	const scopes = textArray(ctx.scopes.map((scope) => scope.name));
-	const roleName = (param) => `coalesce(${param}, '') = '' or ${param} = any(${textArray(custom.declared)})`;
-	const levelOf = leveled ? ", nullif(split_part(e, '@', 2), '')" : "";
-	const write = `  delete from ${perms} c where ${match} and c.role = p_role;
-  delete from ${includes} c where ${match} and c.role = p_role;
-  insert into ${perms} (tenant_id, scope, scope_id, role, permission, effect${leveled ? ", level" : ""})
-  select distinct p_tenant, p_scope, p_scope_id, p_role, ${current(leveled ? "split_part(e, '@', 1)" : "e")}, 'allow'${levelOf}
-  from unnest(coalesce(p_allow, '{}'::text[])) e
-  union
-  select distinct p_tenant, p_scope, p_scope_id, p_role, ${current("e")}, 'deny'${leveled ? ", null" : ""}
-  from unnest(coalesce(p_deny, '{}'::text[])) e;
-  insert into ${includes} (tenant_id, scope, scope_id, role, include_role)
-  select distinct p_tenant, p_scope, p_scope_id, p_role, e
-  from unnest(coalesce(p_include, '{}'::text[])) e;`;
-	const move = `  if ${roleName("p_to")} then
-${raiseSql("    ", "22023", `'permdock: ' || coalesce(p_to, 'null') || ' is not a custom role name'`, "declared-role")}
-  end if;
-  if exists (select 1 from ${perms} c where ${match} and c.role = p_to)
-    or exists (select 1 from ${includes} c where ${match} and c.role = p_to) then
-${raiseSql("    ", "22023", `'permdock: ' || p_to || ' already has grants'`, "role-exists")}
-  end if;
-  update ${perms} c set role = p_to where ${match} and c.role = p_from;
-  update ${includes} c set role = p_to where ${match} and c.role = p_from;`;
-	const remove = `  delete from ${perms} c where ${match} and c.role = p_role;
-  delete from ${includes} c where ${match} and c.role = p_role;`;
-	const writeArgs = `${tenantType}, text, text, text, text[], text[], text[]`;
-	const renameArgs = `${tenantType}, text, text, text, text`;
-	const removeArgs = `${tenantType}, text, text, text`;
-	const fn = (comment, name, params, args, body, member) => `-- ${comment}
-create or replace function ${qualified$1(ctx, name)}(${params})
-returns void
-language plpgsql
-volatile
-security definer
-set search_path = ''
-as $$
-${body}
-$$;
-${member ? `revoke execute on function ${qualified$1(ctx, name)}(${args}) from public, anon;
-grant execute on function ${qualified$1(ctx, name)}(${args}) to authenticated;` : `revoke execute on function ${qualified$1(ctx, name)}(${args}) from public, anon, authenticated;`}`;
-	const writeParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text, p_allow text[], p_deny text[], p_include text[]`;
-	const renameParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_from text, p_to text`;
-	const removeParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text`;
-	return `${caller.beyond}
-
--- where a custom role may live: a scope of a tenant, or the platform (scope global, no tenant or instance), under an undeclared name
-create or replace function ${shape}(p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
-returns void
-language plpgsql
-stable
-set search_path = ''
-as $$
-begin
-  if p_scope = 'global' then
-    if p_tenant is not null or p_scope_id is not null then
-${raiseSql("      ", "22023", `'permdock: a platform custom role has no tenant or instance'`, "unknown-scope")}
-    end if;
-  elsif p_tenant is null or not (p_scope = any(${scopes})) then
-${raiseSql("    ", "22023", `'permdock: custom roles are held at a scope of a tenant or at global, not ' || coalesce(p_scope, 'null')`, "unknown-scope")}
-  end if;
-  if ${roleName("p_role")} then
-${raiseSql("    ", "22023", `'permdock: ' || coalesce(p_role, 'null') || ' is not a custom role name'`, "declared-role")}
-  end if;
-end;
-$$;
-revoke execute on function ${shape}(${tenantType}, text, text, text) from public, anon, authenticated;
-
-${caller.guard}
-${hasCustomRoleChecksFor(ctx) ? `
--- the same checks for a user the caller names: trusted SQL acting later for a stored user; no client role may execute them
-${callerFunctionsSql(ctx, custom, root, levelReach, true).beyond}
-
-${callerFunctionsSql(ctx, custom, root, levelReach, true).guard}
-` : ""}
--- the entries of a definition: declared keys and levels inside the ceiling of the scope, and declared includes
-create or replace function ${entries}(p_scope text, p_allow text[], p_deny text[], p_include text[])
-returns void
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  v_entry text;
-  v_key text;
-begin
-  foreach v_entry in array coalesce(p_allow, '{}'::text[]) loop
-    v_key := ${current(leveled ? "split_part(v_entry, '@', 1)" : "v_entry")};
-    if not (v_key = any(${known})) then
-${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared permission'`, "unknown-permission")}
-    end if;
-    if not exists (
-      select 1 from ${ceiling} c
-      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
-    ) then
-${raiseSql("      ", "22023", `'permdock: ' || v_key || ' is outside the ceiling of ' || p_scope`, "outside-ceiling")}
-    end if;${leveled ? `
-    if strpos(v_entry, '@') > 0 and not exists (
-      select 1 from ${ceiling} c
-      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
-        and split_part(c.grant_key, '@', 2) = split_part(v_entry, '@', 2)
-    ) then
-${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' names a level the resource does not declare'`, "unknown-level")}
-    end if;` : ""}
-  end loop;
-  foreach v_entry in array coalesce(p_deny, '{}'::text[]) loop
-    if not (v_entry = any(${known})) then
-${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared permission'`, "unknown-permission")}
-    end if;
-  end loop;
-  foreach v_entry in array coalesce(p_include, '{}'::text[]) loop
-    if not (v_entry = any(${textArray(custom.declared)})) then
-${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared role'`, "unknown-role")}
-    end if;
-  end loop;
-  select string_agg(distinct ${current("rp.permission")}, ', ') into v_key
-  from ${rp} rp
-  where rp.role = any(coalesce(p_include, '{}'::text[]))
-    and rp.effect = 'allow'
-    and not exists (
-      select 1 from ${ceiling} c
-      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = ${current("rp.permission")}
-    );
-  if v_key is not null then
-${raiseSql("    ", "22023", `'permdock: an included role allows ' || v_key || ', outside the ceiling of ' || p_scope`, "outside-ceiling")}
-  end if;
-end;
-$$;
-revoke execute on function ${entries}(text, text[], text[], text[]) from public, anon, authenticated;
-
-${fn("save a custom role: replace its grants and includes after checking each entry against the ceiling and the caller's own permissions", CUSTOM_ROLES.replace, writeParams, writeArgs, `declare
-  v_beyond text;
-begin
-  perform ${guard}(p_tenant, p_scope, p_scope_id, p_role);
-  perform ${entries}(p_scope, p_allow, p_deny, p_include);
-  select string_agg(b, ', ' order by b) into v_beyond
-  from ${beyond}(p_tenant, p_scope, p_scope_id, p_allow, p_deny, p_include) b;
-  if v_beyond is not null then
-${raiseSql("    ", "42501", `'permdock: ' || p_role || ' would allow ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
-  end if;
-${write}
-end;`, true)}
-
-${fn("rename a custom role: move its grants and includes to the new name", CUSTOM_ROLES.rename, renameParams, renameArgs, `begin
-  perform ${guard}(p_tenant, p_scope, p_scope_id, p_from);
-${move}
-end;`, true)}
-
-${fn("delete a custom role: remove its grants and includes", CUSTOM_ROLES.remove, removeParams, removeArgs, `begin
-  perform ${guard}(p_tenant, p_scope, p_scope_id, p_role);
-${remove}
-end;`, true)}
-
-${fn("save a custom role for a trusted caller (a migration, a job, a backend role granted execute): the definition checks without the caller checks", CUSTOM_ROLES.trustedReplace, writeParams, writeArgs, `begin
-  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
-  perform ${entries}(p_scope, p_allow, p_deny, p_include);
-${write}
-end;`, false)}
-
-${fn("rename a custom role for a trusted caller", CUSTOM_ROLES.trustedRename, renameParams, renameArgs, `begin
-  perform ${shape}(p_tenant, p_scope, p_scope_id, p_from);
-${move}
-end;`, false)}
-
-${fn("delete a custom role for a trusted caller", CUSTOM_ROLES.trustedRemove, removeParams, removeArgs, `begin
-  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
-${remove}
-end;`, false)}`;
-}
-/** `row.column`, for a trigger's `old` or `new`. */
-function rowColumn(row, name) {
-	return `${row}.${quoteIdent(name)}`;
-}
-/** The custom-role rows of the role a trigger's `v_<prefix>_*` variables name. */
-function cascadeMatch(prefix) {
-	return `c.tenant_id is not distinct from v_${prefix}_tenant and c.scope = v_${prefix}_scope and c.scope_id is not distinct from v_${prefix}_id and c.role = v_${prefix}_key`;
-}
-/**
-* The trigger on the application's roles table (`rls.customRoleWrites.roles`):
-* a rename, a move to another tenant, scope or instance, or a delete of a
-* custom role's row carries its grants and includes along. A signed-in
-* caller at trigger depth 1 passes the write functions' checks: authority
-* over the stored definition where it was, and, after a move, membership
-* and authority where it lands and entries inside that scope's ceiling.
-* Other paths (a migration, a job, a nested trigger) move the rows as the
-* function owner.
-*/
-function customRoleCascadeSql(ctx) {
-	const custom = ctx.customRoles;
-	const table = custom?.table;
-	const root = ctx.scopes[0]?.name;
-	if (custom === void 0 || table === void 0 || root === void 0) return "";
-	const tenantType = tenantTypeOf(ctx);
-	const perms = qualified$1(ctx, CUSTOM_ROLES.permissions);
-	const includes = qualified$1(ctx, CUSTOM_ROLES.includes);
-	const fn = qualified$1(ctx, CUSTOM_ROLES.cascade);
-	const target = quoteTable(table.table.includes(".") ? table.table : `public.${table.table}`);
-	const tenant = (row) => table.tenant === void 0 ? `null::${tenantType}` : `${rowColumn(row, table.tenant)}::${tenantType}`;
-	const scope = (row) => table.scope === void 0 ? `case when ${tenant(row)} is null then 'global' else ${quoteLiteral(root)} end` : `case when ${tenant(row)} is null then 'global' else ${rowColumn(row, table.scope)}::text end`;
-	const id = (row) => table.id === void 0 ? "null::text" : `${rowColumn(row, table.id)}::text`;
-	const skipped = (row) => table.skip === void 0 ? "false" : `coalesce(${rowColumn(row, table.skip)}, false)`;
-	const guard = qualified$1(ctx, CUSTOM_ROLES.guard);
-	const entries = qualified$1(ctx, CUSTOM_ROLES.entries);
-	const allowEntryOf = custom.levels === true ? "c.permission || coalesce('@' || c.level, '')" : "c.permission";
-	return `-- the application's roles table: renames, moves and deletes of a custom role carry its grants and includes
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-volatile
-security definer
-set search_path = ''
-as $$
-declare
-  v_old_tenant ${tenantType} := ${tenant("old")};
-  v_old_scope text := ${scope("old")};
-  v_old_id text := ${id("old")};
-  v_old_key text := ${rowColumn("old", table.key)}::text;
-  v_new_tenant ${tenantType};
-  v_new_scope text;
-  v_new_id text;
-  v_new_key text;
-  v_checked boolean := ${signedIn(ctx)} and pg_trigger_depth() = 1;
-  v_allow text[];
-  v_deny text[];
-  v_include text[];
-begin
-  if ${skipped("old")} then
-    return null;
-  end if;
-  if tg_op = 'UPDATE' and not ${skipped("new")} then
-    v_new_tenant := ${tenant("new")};
-    v_new_scope := ${scope("new")};
-    v_new_id := ${id("new")};
-    v_new_key := ${rowColumn("new", table.key)}::text;
-    if v_new_key = v_old_key
-      and v_new_tenant is not distinct from v_old_tenant
-      and v_new_scope = v_old_scope
-      and v_new_id is not distinct from v_old_id then
-      return null;
-    end if;
-  end if;
-  if not exists (select 1 from ${perms} c where ${cascadeMatch("old")})
-    and not exists (select 1 from ${includes} c where ${cascadeMatch("old")}) then
-    return null;
-  end if;
-  if v_checked then
-    perform ${guard}(v_old_tenant, v_old_scope, v_old_id, v_old_key);
-  end if;
-  if v_new_key is null then
-    delete from ${perms} c where ${cascadeMatch("old")};
-    delete from ${includes} c where ${cascadeMatch("old")};
-    return null;
-  end if;
-  if exists (select 1 from ${perms} c where ${cascadeMatch("new")})
-    or exists (select 1 from ${includes} c where ${cascadeMatch("new")}) then
-${raiseSql("    ", "22023", `'permdock: ' || v_new_key || ' already has grants'`, "role-exists")}
-  end if;
-  update ${perms} c set tenant_id = v_new_tenant, scope = v_new_scope, scope_id = v_new_id, role = v_new_key where ${cascadeMatch("old")};
-  update ${includes} c set tenant_id = v_new_tenant, scope = v_new_scope, scope_id = v_new_id, role = v_new_key where ${cascadeMatch("old")};
-  if v_checked then
-    perform ${guard}(v_new_tenant, v_new_scope, v_new_id, v_new_key);
-    select array_agg(${allowEntryOf}) filter (where c.effect = 'allow'),
-      array_agg(c.permission) filter (where c.effect = 'deny')
-    into v_allow, v_deny
-    from ${perms} c
-    where ${cascadeMatch("new")};
-    select array_agg(c.include_role) into v_include
-    from ${includes} c
-    where ${cascadeMatch("new")};
-    perform ${entries}(v_new_scope, v_allow, v_deny, v_include);
-  end if;
-  return null;
-end;
-$$;
-revoke execute on function ${fn}() from public, anon, authenticated;
-drop trigger if exists "permdock_custom_role_cascade" on ${target};
-create trigger "permdock_custom_role_cascade"
-  after update or delete on ${target}
-  for each row execute function ${fn}();
-`;
-}
-//#endregion
-//#region src/cli/rls-global-roles.ts
-function qualifiedName(name) {
-	return name.includes(".") ? name : `public.${name}`;
-}
-/**
-* `permdock_replace_global_roles(p_user, p_roles)`: sets the global roles of
-* one user in `rls.roles` in one statement pair. It runs as the invoker, so
-* the table's policies and the `rls.assignments` trigger judge every row it
-* deletes or inserts.
-*/
-function globalRolesSql(ctx) {
-	if (ctx.roles === void 0) return "";
-	const source = globalRoleSource(ctx.roles, "public", "t");
-	const table = quoteTable(qualifiedName(ctx.roles.table));
-	const user = quoteIdent(source.user);
-	const fn = qualified$1(ctx, GLOBAL_ROLES.replace);
-	const type = ctx.dialect === "supabase" ? "uuid" : "text";
-	const wanted = `select distinct r from unnest(coalesce(p_roles, '{}'::text[])) r where r is not null`;
-	const through = source.through;
-	let body;
-	if (through === void 0) {
-		const role = typeof ctx.roles.role === "string" ? ctx.roles.role : "role";
-		const column = quoteIdent(role);
-		body = `  delete from ${table} t
-  where t.${user} = p_user
-    and t.${column}::text <> all(coalesce(p_roles, '{}'::text[]));
-  insert into ${table} (${user}, ${column})
-  select p_user, w.r
-  from (${wanted}) w(r)
-  where not exists (
-    select 1 from ${table} t where t.${user} = p_user and t.${column}::text = w.r
-  );`;
-	} else {
-		const keys = quoteTable(through.table);
-		const id = quoteIdent(through.id);
-		const key = quoteIdent(through.key);
-		const ref = quoteIdent(through.ref);
-		body = `  select string_agg(w.r, ', ' order by w.r) into v_unknown
-  from (${wanted}) w(r)
-  where not exists (select 1 from ${keys} k where k.${key}::text = w.r);
-  if v_unknown is not null then
-    raise exception using
-      errcode = '22023',
-      message = 'permdock: ' || v_unknown || ' is not a role',
-      hint = 'unknown-role';
-  end if;
-  delete from ${table} t
-  where t.${user} = p_user
-    and not exists (
-      select 1 from ${keys} k
-      where k.${id} = t.${ref}
-        and k.${key}::text = any(coalesce(p_roles, '{}'::text[]))
-    );
-  insert into ${table} (${user}, ${ref})
-  select p_user, k.${id}
-  from ${keys} k
-  where k.${key}::text in (${wanted})
-    and not exists (
-      select 1 from ${table} t where t.${user} = p_user and t.${ref} = k.${id}
-    );`;
-	}
-	const declare = through === void 0 ? "" : "declare\n  v_unknown text;\n";
-	const args = `${type}, text[]`;
-	return `-- set the global roles of a user: delete the others and insert the missing ones, as the caller, so the table's policies and the assignment trigger still apply
-create or replace function ${fn}(p_user ${type}, p_roles text[])
-returns void
-language plpgsql
-volatile
-set search_path = ''
-as $$
-${declare}begin
-${body}
-end;
-$$;
-revoke execute on function ${fn}(${args}) from public, anon;
-grant execute on function ${fn}(${args}) to authenticated;`;
-}
-//#endregion
-//#region src/cli/rls-helpers.ts
-/** The helper `--capabilities` adds: ids of one resource a link capability claim reaches. Part of the SQL contract. */
-const CAPABILITIES = { ids: "permdock_capability_ids" };
-/**
-* The policy-side call for a grant key. Every form is uncorrelated, so
-* Postgres runs the helper once per statement (an InitPlan, or a hashed
-* SubPlan for `in`), never once per row.
-*/
-function accessSql(ctx, scope, grantKey, column) {
-	const key = quoteLiteral(grantKey);
-	if (scope === "global") return `(select ${qualified$1(ctx, HELPERS.has)}(${key}))`;
-	if (column === void 0) throw new Error(`PermDock CLI: ${scope}-scoped grant needs definePolicy({ scopes.${scope} })`);
-	return `${quoteIdent(column)} in (select ${qualified$1(ctx, permittedIdsHelper(scope))}(${key}))`;
-}
-/**
-* The `anon` branch access for a resource-scoped grant reached through a link
-* capability: the row's `field` holds an id the capability claim names for
-* `resource`, `role` and `permission`. Uncorrelated, so it runs once per
-* statement; the column is compared as text because the claim holds text.
-*/
-function capabilityAccessSql(ctx, field, resource, role, permission) {
-	const args = [
-		resource,
-		role,
-		permission
-	].map(quoteLiteral).join(", ");
-	return `${quoteIdent(field)}::text in (select ${qualified$1(ctx, CAPABILITIES.ids)}(${args}))`;
-}
-function capabilitiesSql(ctx) {
-	if (ctx.capabilities !== true) return "";
-	const fn = qualified$1(ctx, CAPABILITIES.ids);
-	return `-- link capabilities: the capability claim exchangeCapability mints (role anon, short-lived)
-create or replace function ${fn}(p_resource text, p_role text, p_permission text)
-returns setof text
-language sql
-stable
-set search_path = ''
-as $$
-  select c -> 'on' ->> 'id'
-  from (select ${subjectClaimJsonSql(ctx, "capability")} as c) capability
-  where jsonb_typeof(c) = 'object'
-    and c ->> 'v' = '1'
-    and c ->> 'holder' = 'link'
-    and c -> 'on' ->> 'resource' = p_resource
-    and jsonb_typeof(c -> 'roles') = 'array'
-    and c -> 'roles' @> jsonb_build_array(p_role)
-    and (c -> 'permissions' is null or c -> 'permissions' @> jsonb_build_array(p_permission))
-    and jsonb_typeof(c -> 'expiresAt') = 'number'
-    and (c ->> 'expiresAt')::numeric > extract(epoch from now())
-$$;
-revoke execute on function ${fn}(text, text, text) from public;
-grant execute on function ${fn}(text, text, text) to anon, authenticated;`;
-}
-function userIdSql(ctx, anonExecute) {
-	const fn = userIdHelperSql(ctx);
-	return `-- the caller's user id: the sub of request.jwt.claims, or null when it is empty or absent
-create or replace function ${fn}()
-returns uuid
-language sql
-stable
-set search_path = ''
-as $$
-  select nullif(
-    nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub',
-    ''
-  )::uuid
-$$;
-${anonExecute ? `revoke execute on function ${fn}() from public;
-grant execute on function ${fn}() to anon, authenticated;` : `revoke execute on function ${fn}() from public, anon;
-grant execute on function ${fn}() to authenticated;`}`;
+function throughTenant(through, roles) {
+	if (through === void 0 || roles?.tenant === void 0) return;
+	return qualify(roles.table, "public") === through.table ? roles.tenant : void 0;
 }
-function membershipTable(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
+/** Resolves `source` against `schema`, aliasing the table `alias` and the roles table `<alias>k`. */
+function globalRoleSource(source, schema, alias, roles) {
+	const table = qualify(source.table, schema);
+	const user = source.user ?? "user_id";
+	const role = roleColumn(source.role ?? "role", table, alias, {
+		label: "roles.role",
+		prefix: "PermDock CLI",
+		indent: "    "
+	});
+	const tenant = role.lateral ? void 0 : throughTenant(role.through, roles);
+	const global = tenant === void 0 ? "" : ` and ${alias}k.${quoteIdent(tenant)} is null`;
+	return {
+		table,
+		user,
+		from: `${quoteTable(table)} ${alias}${role.join}${global}`,
+		userSql: `${alias}.${quoteIdent(user)}`,
+		roleSql: role.sql,
+		role: roleManifest(role),
+		...role.through === void 0 ? {} : { through: role.through },
+		...tenant === void 0 ? {} : { tenant }
+	};
 }
+//#endregion
+//#region src/cli/rls/helper-rows.ts
 function activeTenant(ctx) {
 	return `nullif(${subjectClaimSql(ctx, ctx.tenantClaim)}, '')`;
 }
@@ -1691,21 +1382,23 @@ function andLine(indent, condition) {
 /** `rls.roles`, or the generated `user_roles (user_id, role)`, aliased `ur`. */
 function globalRoleRows(ctx) {
 	return ctx.roles === void 0 ? {
-		from: `${qualified$1(ctx, "user_roles")} ur`,
+		from: `${qualified(ctx, "user_roles")} ur`,
 		userSql: "ur.user_id",
 		roleSql: "ur.role::text"
-	} : globalRoleSource(ctx.roles, "public", "ur");
+	} : globalRoleSource(ctx.roles, "public", "ur", ctx.customRoles?.table);
 }
 function customKeysJoin(ctx, scope, allows, denies, includes) {
-	return `  cross join lateral ${qualified$1(ctx, CUSTOM_ROLES.keys)}(
+	return `  cross join lateral ${qualified(ctx, CUSTOM_ROLES.keys)}(
     ${allows},
     ${denies},
     ${includes},
     ${quoteLiteral(scope)}
   ) ck(grant_key)`;
 }
+//#endregion
+//#region src/cli/rls/helper-bodies.ts
 function hasSetBody(ctx) {
-	const rp = qualified$1(ctx, "role_permissions");
+	const rp = qualified(ctx, "role_permissions");
 	const active = userActive(ctx, "    ").map((line) => `\n${line}`).join("");
 	const custom = ctx.customRoles;
 	if (ctx.authorize === "database") {
@@ -1717,14 +1410,14 @@ function hasSetBody(ctx) {
     and rp.scope = 'global'${andLine("    ", globalKindFilterSql(ctx, ur.roleSql))}${active}`;
 		if (custom === void 0) return declared;
 		const match = `c.tenant_id is null and c.scope = 'global' and c.scope_id is null and c.role = ${ur.roleSql}`;
-		const rows = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
+		const rows = (source, value, extra) => `array(select c.${value} from ${qualified(ctx, source)} c where ${match}${extra})`;
 		return `${declared}
   union
   select ck.grant_key
   from ${ur.from}
 ${customKeysJoin(ctx, "global", rows(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"), rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), rows(CUSTOM_ROLES.includes, "include_role", ""))}
   where ${ur.userSql} = ${subjectIdSql(ctx)}
-    and not (${ur.roleSql} = any(${textArray(custom.declared)}))${active}`;
+    and not (${ur.roleSql} = any(${sqlTextArray(custom.declared)}))${active}`;
 	}
 	const declared = `  select rp.grant_key
   from ${roleRows(ctx)}
@@ -1741,11 +1434,11 @@ ${customKeysJoin(ctx, "global", rows(CUSTOM_ROLES.permissions, allowEntry(ctx),
 ${customKeysJoin(ctx, "global", claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
   where ${signedIn(ctx)}
     and jsonb_typeof(cg.g) = 'array'
-    and not (r.role = any(${textArray(custom.declared)}))${active}`;
+    and not (r.role = any(${sqlTextArray(custom.declared)}))${active}`;
 }
 function hasBody(ctx) {
 	if (ctx.grantSet === true) return hasSetBody(ctx);
-	const rp = qualified$1(ctx, "role_permissions");
+	const rp = qualified(ctx, "role_permissions");
 	const active = userActive(ctx, "      ").map((line) => `\n${line}`).join("");
 	const custom = ctx.customRoles;
 	if (ctx.authorize === "database") {
@@ -1760,13 +1453,13 @@ function hasBody(ctx) {
   )`;
 		if (custom === void 0) return declared;
 		const match = `c.tenant_id is null and c.scope = 'global' and c.scope_id is null and c.role = ${ur.roleSql}`;
-		const rows = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
+		const rows = (source, value, extra) => `array(select c.${value} from ${qualified(ctx, source)} c where ${match}${extra})`;
 		return `${declared}
   or exists (
     select 1
     from ${ur.from}
     where ${ur.userSql} = ${subjectIdSql(ctx)}
-      and not (${ur.roleSql} = any(${textArray(custom.declared)}))${active}
+      and not (${ur.roleSql} = any(${sqlTextArray(custom.declared)}))${active}
       ${customKeysSql(ctx, "global", rows(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"), rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), rows(CUSTOM_ROLES.includes, "include_role", "")).trimStart()}
   )`;
 	}
@@ -1785,7 +1478,7 @@ function hasBody(ctx) {
     from ${roleRows(ctx)}
     cross join lateral (select ${claim} -> r.role as g) cg
     where jsonb_typeof(cg.g) = 'array'
-      and not (r.role = any(${textArray(custom.declared)}))${active}
+      and not (r.role = any(${sqlTextArray(custom.declared)}))${active}
       ${customKeysSql(ctx, "global", claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)")).trimStart()}
   ))`;
 }
@@ -1806,7 +1499,7 @@ function claimEntries(where, value) {
 }
 /** `p_grant in (select permdock_custom_keys(allows, denies, includes, scope))`. */
 function customKeysSql(ctx, scope, allows, denies, includes) {
-	return `    and p_grant in (select ${qualified$1(ctx, CUSTOM_ROLES.keys)}(
+	return `    and p_grant in (select ${qualified(ctx, CUSTOM_ROLES.keys)}(
       ${allows},
       ${denies},
       ${includes},
@@ -1840,8 +1533,8 @@ function tableBody(ctx, scope, type) {
 	const kind = kindFilterSql(ctx, role.sql, memberVia(table));
 	const lines = [
 		`  select${role.lateral ? " distinct" : ""} ${memberColumn(column)}::${type}${set ? ", rp.grant_key" : ""}`,
-		`  from ${membershipTable(table.table)} m${role.join}`,
-		`  join ${qualified$1(ctx, "role_permissions")} rp on rp.role = ${role.sql}`,
+		`  from ${quoteQualified(table.table)} m${role.join}`,
+		`  join ${qualified(ctx, "role_permissions")} rp on rp.role = ${role.sql}`,
 		owner ?? "",
 		...set ? [] : ["    and rp.grant_key = p_grant"],
 		`    and rp.scope = ${quoteLiteral(scope)}`,
@@ -1856,7 +1549,7 @@ function tableBody(ctx, scope, type) {
 		`(c.scope_id is null or c.scope_id = ${memberColumn(column)}::text)`,
 		`c.role = ${role.sql}`
 	].join(" and ");
-	const rows = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
+	const rows = (source, value, extra) => `array(select c.${value} from ${qualified(ctx, source)} c where ${match}${extra})`;
 	const entries = [
 		rows(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"),
 		rows(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"),
@@ -1866,18 +1559,18 @@ function tableBody(ctx, scope, type) {
 		...lines,
 		"  union",
 		`  select ${memberColumn(column)}::${type}, ck.grant_key`,
-		`  from ${membershipTable(table.table)} m${role.join}`,
+		`  from ${quoteQualified(table.table)} m${role.join}`,
 		customKeysJoin(ctx, scope, ...entries),
 		...filtersFor("ck.grant_key"),
-		`    and not (${role.sql} = any(${textArray(custom.declared)}))`
+		`    and not (${role.sql} = any(${sqlTextArray(custom.declared)}))`
 	].join("\n");
 	return [
 		...lines,
 		"  union",
 		`  select ${memberColumn(column)}::${type}`,
-		`  from ${membershipTable(table.table)} m${role.join}`,
+		`  from ${quoteQualified(table.table)} m${role.join}`,
 		...filters,
-		`    and not (${role.sql} = any(${textArray(custom.declared)}))`,
+		`    and not (${role.sql} = any(${sqlTextArray(custom.declared)}))`,
 		customKeysSql(ctx, scope, ...entries)
 	].join("\n");
 }
@@ -1903,7 +1596,7 @@ function claimBody(ctx, scope, type) {
 	const filters = filtersFor(set ? "rp.grant_key" : "p_grant");
 	const declared = `  select (m ->> 'id')::${type}${set ? ", rp.grant_key" : ""}
   from ${membershipRows(ctx)}
-  join ${qualified$1(ctx, "role_permissions")} rp on rp.role = r.role
+  join ${qualified(ctx, "role_permissions")} rp on rp.role = r.role
   where ${signedIn(ctx)}${set ? "" : "\n    and rp.grant_key = p_grant"}
     and rp.scope = ${quoteLiteral(scope)}${andLine("    ", kindFilterSql(ctx, "r.role", "m ->> 'via'"))}
 ${filters}`;
@@ -1917,7 +1610,7 @@ ${filters}`;
 ${customKeysJoin(ctx, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
   where ${signedIn(ctx)}
     and jsonb_typeof(cg.g) = 'array'
-    and not (r.role = any(${textArray(custom.declared)}))
+    and not (r.role = any(${sqlTextArray(custom.declared)}))
 ${filtersFor("ck.grant_key")}`;
 	return `${declared}
   union
@@ -1926,7 +1619,7 @@ ${filtersFor("ck.grant_key")}`;
   cross join lateral (select m -> 'grants' -> r.role as g) cg
   where ${signedIn(ctx)}
     and jsonb_typeof(cg.g) = 'array'
-    and not (r.role = any(${textArray(custom.declared)}))
+    and not (r.role = any(${sqlTextArray(custom.declared)}))
 ${filters}
 ${customKeysSql(ctx, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}`;
 }
@@ -1938,109 +1631,668 @@ ${customKeysSql(ctx, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), c
 function sourcesKeep(sources) {
 	return sources.some((source) => source.sql.keeps);
 }
-function sourceRows(sources) {
-	const keep = sourcesKeep(sources);
-	return sources.map((source, index) => source.sql.select(sourceUser(index), keep).replaceAll(/^/gmu, "    ")).join("\n    union all\n");
+function sourceRows(sources) {
+	const keep = sourcesKeep(sources);
+	return sources.map((source, index) => source.sql.select(sourceUser(index), keep).replaceAll(/^/gmu, "    ")).join("\n    union all\n");
+}
+function sourceUser(index) {
+	return `v_user_${String(index)}`;
+}
+function sqlBody(sql) {
+	return {
+		sql,
+		vars: []
+	};
+}
+function sourcesBodyOf(sql, sources, user) {
+	return {
+		sql,
+		vars: sources.map((source, index) => `${sourceUser(index)} ${source.sql.userType} := ${user};`)
+	};
+}
+/** `language sql`, or `plpgsql` returning the query when the body declares variables. */
+function functionBody(body) {
+	if (body.vars.length === 0) return `language sql
+stable
+security definer
+set search_path = ''
+as $$
+${body.sql}
+$$;`;
+	return `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${body.vars.map((line) => `  ${line}`).join("\n")}
+begin
+  return query
+${body.sql};
+end;
+$$;`;
+}
+/**
+* `ms.id` for the scope itself and `ms.within ->> name` for an ancestor. The
+* alias is not `s`, which `activeRowSql` binds inside its `exists`.
+*/
+function sourceIdOf(scope) {
+	return (name) => name === scope ? "ms.id" : `ms.within ->> ${quoteLiteral(name)}`;
+}
+function sourceFilters(ctx, scope, user = subjectIdSql(ctx), permission, keeps = false) {
+	return [
+		...keeps ? [`    and ${keptRowSql("ms.keep", permission)}`] : [],
+		...userActive(ctx, "    ", user),
+		...instancesActive(ctx, scope, sourceIdOf(scope), "    ", permission)
+	].map((line) => `\n${line}`).join("");
+}
+function sourcesBody(ctx, scope, type) {
+	const root = rootName(ctx);
+	const tenant = sourceIdOf(scope)(root);
+	const narrow = narrowsTo(ctx, scope) ? `\n    and (${activeTenant(ctx)} is null or ${tenant} = ${activeTenant(ctx)})${keyTenantLine(ctx, scope, tenant)}` : keyTenantLine(ctx, scope, tenant);
+	const sources = scopeSources(ctx, scope);
+	const set = ctx.grantSet === true;
+	const rows = `  from (
+${sourceRows(sources)}
+  ) ms
+  cross join lateral jsonb_array_elements_text(
+    case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
+  ) r(role)`;
+	const declared = `  select (ms.id)::${type}${set ? ", rp.grant_key" : ""}
+${rows}
+  join ${qualified(ctx, "role_permissions")} rp on rp.role = r.role
+  where ${signedIn(ctx)}
+    and ms.scope = ${quoteLiteral(scope)}${set ? "" : "\n    and rp.grant_key = p_grant"}
+    and rp.scope = ${quoteLiteral(scope)}${andLine("    ", kindFilterSql(ctx, "r.role", "ms.via"))}${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql(set ? "rp.grant_key" : "p_grant"), sourcesKeep(sources))}`;
+	const custom = ctx.customRoles;
+	if (custom === void 0) return sourcesBodyOf(declared, sources, subjectIdSql(ctx));
+	const match = [
+		`c.tenant_id::text = (${tenant})::text`,
+		`c.scope = ${quoteLiteral(scope)}`,
+		"(c.scope_id is null or c.scope_id = (ms.id)::text)",
+		"c.role = r.role"
+	].join(" and ");
+	const entries = (source, value, extra) => `array(select c.${value} from ${qualified(ctx, source)} c where ${match}${extra})`;
+	if (set) return sourcesBodyOf(`${declared}
+  union
+  select (ms.id)::${type}, ck.grant_key
+${rows}
+${customKeysJoin(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}
+  where ${signedIn(ctx)}
+    and ms.scope = ${quoteLiteral(scope)}
+    and not (r.role = any(${sqlTextArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("ck.grant_key"), sourcesKeep(sources))}`, sources, subjectIdSql(ctx));
+	return sourcesBodyOf(`${declared}
+  union
+  select (ms.id)::${type}
+${rows}
+  where ${signedIn(ctx)}
+    and ms.scope = ${quoteLiteral(scope)}
+    and not (r.role = any(${sqlTextArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("p_grant"), sourcesKeep(sources))}
+${customKeysSql(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}`, sources, subjectIdSql(ctx));
+}
+function scopedBody(ctx, scope, type) {
+	if (ctx.authorize !== "database") return sqlBody(claimBody(ctx, scope, type));
+	return scopeSources(ctx, scope).length > 0 ? sourcesBody(ctx, scope, type) : sqlBody(tableBody(ctx, scope, type));
+}
+//#endregion
+//#region src/cli/rls/capabilities.ts
+/** The helper `--capabilities` adds: ids of one resource a link capability claim reaches. Part of the SQL contract. */
+const CAPABILITIES = { ids: "permdock_capability_ids" };
+/**
+* The `anon` branch access for a resource-scoped grant reached through a link
+* capability: the row's `field` holds an id the capability claim names for
+* `resource`, `role` and `permission`. Uncorrelated, so it runs once per
+* statement; the column is compared as text because the claim holds text.
+*/
+function capabilityAccessSql(ctx, field, resource, role, permission) {
+	const args = [
+		resource,
+		role,
+		permission
+	].map(quoteLiteral).join(", ");
+	return `${quoteIdent(field)}::text in (select ${qualified(ctx, CAPABILITIES.ids)}(${args}))`;
+}
+function capabilitiesSql(ctx) {
+	if (ctx.capabilities !== true) return "";
+	const fn = qualified(ctx, CAPABILITIES.ids);
+	return `-- link capabilities: the capability claim exchangeCapability mints (role anon, short-lived)
+create or replace function ${fn}(p_resource text, p_role text, p_permission text)
+returns setof text
+language sql
+stable
+set search_path = ''
+as $$
+  select c -> 'on' ->> 'id'
+  from (select ${subjectClaimJsonSql(ctx, "capability")} as c) capability
+  where jsonb_typeof(c) = 'object'
+    and c ->> 'v' = '1'
+    and c ->> 'holder' = 'link'
+    and c -> 'on' ->> 'resource' = p_resource
+    and jsonb_typeof(c -> 'roles') = 'array'
+    and c -> 'roles' @> jsonb_build_array(p_role)
+    and (c -> 'permissions' is null or c -> 'permissions' @> jsonb_build_array(p_permission))
+    and jsonb_typeof(c -> 'expiresAt') = 'number'
+    and (c ->> 'expiresAt')::numeric > extract(epoch from now())
+$$;
+revoke execute on function ${fn}(text, text, text) from public;
+grant execute on function ${fn}(text, text, text) to anon, authenticated;`;
 }
-function sourceUser(index) {
-	return `v_user_${String(index)}`;
+//#endregion
+//#region src/cli/rls/custom-role-cascade.ts
+/** `row.column`, for a trigger's `old` or `new`. */
+function rowColumn(row, name) {
+	return `${row}.${quoteIdent(name)}`;
 }
-function sqlBody(sql) {
-	return {
-		sql,
-		vars: []
-	};
+/** The custom-role rows of the role a trigger's `v_<prefix>_*` variables name. */
+function cascadeMatch(prefix) {
+	return `c.tenant_id is not distinct from v_${prefix}_tenant and c.scope = v_${prefix}_scope and c.scope_id is not distinct from v_${prefix}_id and c.role = v_${prefix}_key`;
 }
-function sourcesBodyOf(sql, sources, user) {
+/**
+* The trigger on the application's roles table (`rls.customRoleWrites.roles`):
+* a rename, a move to another tenant, scope or instance, or a delete of a
+* custom role's row carries its grants and includes along. A signed-in
+* caller at trigger depth 1 passes the write functions' checks: authority
+* over the stored definition where it was, and, after a move, membership
+* and authority where it lands and entries inside that scope's ceiling.
+* Other paths (a migration, a job, a nested trigger) move the rows as the
+* function owner.
+*/
+function customRoleCascadeSql(ctx) {
+	const custom = ctx.customRoles;
+	const table = custom?.table;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || table === void 0 || root === void 0) return "";
+	const tenantType = tenantTypeOf(ctx);
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const fn = qualified(ctx, CUSTOM_ROLES.cascade);
+	const target = quoteTable(qualifySqlTable(table.table));
+	const tenant = (row) => table.tenant === void 0 ? `null::${tenantType}` : `${rowColumn(row, table.tenant)}::${tenantType}`;
+	const scope = (row) => table.scope === void 0 ? `case when ${tenant(row)} is null then 'global' else ${quoteLiteral(root)} end` : `case when ${tenant(row)} is null then 'global' else ${rowColumn(row, table.scope)}::text end`;
+	const id = (row) => table.id === void 0 ? "null::text" : `${rowColumn(row, table.id)}::text`;
+	const skipped = (row) => table.skip === void 0 ? "false" : `coalesce(${rowColumn(row, table.skip)}, false)`;
+	const guard = qualified(ctx, CUSTOM_ROLES.guard);
+	const entries = qualified(ctx, CUSTOM_ROLES.entries);
+	const allowEntryOf = custom.levels === true ? "c.permission || coalesce('@' || c.level, '')" : "c.permission";
+	return `-- the application's roles table: renames, moves and deletes of a custom role carry its grants and includes
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+declare
+  v_old_tenant ${tenantType} := ${tenant("old")};
+  v_old_scope text := ${scope("old")};
+  v_old_id text := ${id("old")};
+  v_old_key text := ${rowColumn("old", table.key)}::text;
+  v_new_tenant ${tenantType};
+  v_new_scope text;
+  v_new_id text;
+  v_new_key text;
+  v_checked boolean := ${signedIn(ctx)} and pg_trigger_depth() = 1;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+begin
+  if ${skipped("old")} then
+    return null;
+  end if;
+  if tg_op = 'UPDATE' and not ${skipped("new")} then
+    v_new_tenant := ${tenant("new")};
+    v_new_scope := ${scope("new")};
+    v_new_id := ${id("new")};
+    v_new_key := ${rowColumn("new", table.key)}::text;
+    if v_new_key = v_old_key
+      and v_new_tenant is not distinct from v_old_tenant
+      and v_new_scope = v_old_scope
+      and v_new_id is not distinct from v_old_id then
+      return null;
+    end if;
+  end if;
+  if not exists (select 1 from ${perms} c where ${cascadeMatch("old")})
+    and not exists (select 1 from ${includes} c where ${cascadeMatch("old")}) then
+    return null;
+  end if;
+  if v_checked then
+    perform ${guard}(v_old_tenant, v_old_scope, v_old_id, v_old_key);
+  end if;
+  if v_new_key is null then
+    delete from ${perms} c where ${cascadeMatch("old")};
+    delete from ${includes} c where ${cascadeMatch("old")};
+    return null;
+  end if;
+  if exists (select 1 from ${perms} c where ${cascadeMatch("new")})
+    or exists (select 1 from ${includes} c where ${cascadeMatch("new")}) then
+${raiseSql("    ", "22023", `'permdock: ' || v_new_key || ' already has grants'`, "role-exists")}
+  end if;
+  update ${perms} c set tenant_id = v_new_tenant, scope = v_new_scope, scope_id = v_new_id, role = v_new_key where ${cascadeMatch("old")};
+  update ${includes} c set tenant_id = v_new_tenant, scope = v_new_scope, scope_id = v_new_id, role = v_new_key where ${cascadeMatch("old")};
+  if v_checked then
+    perform ${guard}(v_new_tenant, v_new_scope, v_new_id, v_new_key);
+    select array_agg(${allowEntryOf}) filter (where c.effect = 'allow'),
+      array_agg(c.permission) filter (where c.effect = 'deny')
+    into v_allow, v_deny
+    from ${perms} c
+    where ${cascadeMatch("new")};
+    select array_agg(c.include_role) into v_include
+    from ${includes} c
+    where ${cascadeMatch("new")};
+    perform ${entries}(v_new_scope, v_allow, v_deny, v_include);
+  end if;
+  return null;
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists "permdock_custom_role_cascade" on ${target};
+create trigger "permdock_custom_role_cascade"
+  after update or delete on ${target}
+  for each row execute function ${fn}();
+`;
+}
+//#endregion
+//#region src/cli/rls/custom-role-writes.ts
+function callerFunctionsSql(ctx, custom, root, levelReach, forUser) {
+	const leveled = custom.levels === true;
+	const tenantType = tenantTypeOf(ctx);
+	const rp = qualified(ctx, "role_permissions");
+	const keys = qualified(ctx, CUSTOM_ROLES.keys);
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const shape = qualified(ctx, CUSTOM_ROLES.shape);
+	const beyond = qualified(ctx, forUser ? CUSTOM_ROLES.beyondFor : CUSTOM_ROLES.beyond);
+	const guard = qualified(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
+	const user = forUser ? "p_user" : subjectIdSql(ctx);
+	const userParam = forUser ? "p_user uuid, " : "";
+	const userArg = forUser ? "uuid, " : "";
+	const userCall = forUser ? "p_user, " : "";
+	const has = (key) => forUser ? `${qualified(ctx, HELPERS.hasFor)}(p_user, ${key})` : `${qualified(ctx, HELPERS.has)}(${key})`;
+	const ids = (helper, arg) => `(select x::text from ${qualified(ctx, helper)}(${arg}) x)`;
+	const permitted = (scope, key) => forUser ? ids(permittedForHelper(scope), `p_user, ${key}`) : ids(permittedIdsHelper(scope), key);
+	const members = (scope) => forUser ? ids(memberForHelper(scope), "p_user") : ids(memberIdsHelper(scope), "");
+	const heldKey = (key) => `(${has(key)}
+        or (p_scope <> 'global'
+          and (p_tenant::text in ${permitted(root, key)}
+            or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${permitted(scope, key)}`)})))`;
+	const holdsAny = (permissions, held) => permissions.length === 0 ? "false" : `exists (
+    select 1 from ${rp} rp
+    where rp.effect = 'allow'
+      and rp.permission = any(${sqlTextArray(permissions)})
+      and ${held("rp.grant_key")}
+  )`;
+	const manageKeys = custom.manage ?? [];
+	const manage = holdsAny(manageKeys, heldKey);
+	const platform = holdsAny(manageKeys, has);
+	const requires = custom.requires === void 0 ? "" : `
+  if not ${holdsAny(custom.requires, heldKey)} then
+${raiseSql("    ", "42501", `'permdock: the caller may not manage roles in ' || coalesce(p_tenant::text, 'the platform')`, "manage-roles")}
+  end if;`;
+	const reachRows = levelReach.map(([grantKey, level]) => `(${quoteLiteral(grantKey)}, ${quoteLiteral(level)})`).join(", ");
+	const levelCheck = leveled && reachRows !== "" ? `
+      or exists (
+        select 1
+        from reach x
+        where x.grant_key = r.grant_key
+          and not exists (
+            select 1 from held h
+            join reach o on o.grant_key = h.grant_key
+            where h.permission = r.permission and o.level = x.level
+          )
+      )` : "";
+	const reachCte = leveled && reachRows !== "" ? `,
+    reach (grant_key, level) as (values ${reachRows})` : "";
+	const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id`;
+	const memberOf = `p_tenant::text in ${members(root)}
+      or ${perScope(ctx, (scope) => scope === root ? "false" : `p_scope_id in ${members(scope)}`)}`;
 	return {
-		sql,
-		vars: sources.map((source, index) => `${sourceUser(index)} ${source.sql.userType} := ${user};`)
+		beyond: `-- custom-role writes: the permission keys of a definition the caller may not hand out in the tenant, as assignablePermissions computes them
+create or replace function ${beyond}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_allow text[], p_deny text[], p_include text[])
+returns setof text
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+begin
+  if ${manage} then
+    return;
+  end if;
+  return query
+  with resolved as (
+    select distinct rp.permission, k.key as grant_key
+    from ${keys}(p_allow, p_deny, p_include, p_scope) k(key)
+    join ${rp} rp on rp.grant_key = k.key and rp.effect = 'allow'
+  ),
+  held as (
+    select distinct rp.permission, rp.grant_key
+    from ${rp} rp
+    where rp.effect = 'allow'
+      and rp.permission in (select r.permission from resolved r)
+      and ${heldKey("rp.grant_key")}
+  )${reachCte}
+  select distinct r.permission
+  from resolved r
+  where not exists (select 1 from held h where h.permission = r.permission)${levelCheck};
+end;
+$$;
+revoke execute on function ${beyond}(${userArg}${tenantType}, text, text, text[], text[], text[]) from public, anon, authenticated;`,
+		guard: `-- a custom role the caller may change: membership of the tenant or the instance (a platform role, or a caller holding a manageRoles permission through a global role, needs none), and authority over the stored definition
+create or replace function ${guard}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+returns void
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_beyond text;
+begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
+  if not (${signedIn(ctx, user)} and (
+    ${platform}
+    or (p_scope <> 'global' and (${memberOf}))
+  )) then
+${raiseSql("    ", "42501", `'permdock: the caller is not a member of ' || coalesce(p_tenant::text, 'the platform')`, "not-member")}
+  end if;${requires}
+  select array_agg(${allowEntry(ctx)}) filter (where c.effect = 'allow'),
+    array_agg(c.permission) filter (where c.effect = 'deny')
+  into v_allow, v_deny
+  from ${perms} c
+  where ${match} and c.role = p_role;
+  select array_agg(c.include_role) into v_include
+  from ${includes} c
+  where ${match} and c.role = p_role;
+  select string_agg(b, ', ' order by b) into v_beyond
+  from ${beyond}(${userCall}p_tenant, p_scope, p_scope_id, v_allow, v_deny, v_include) b;
+  if v_beyond is not null then
+${raiseSql("    ", "42501", `'permdock: ' || p_role || ' allows ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
+  end if;
+end;
+$$;
+revoke execute on function ${guard}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;`
 	};
 }
-/** `language sql`, or `plpgsql` returning the query when the body declares variables. */
-function functionBody(body) {
-	if (body.vars.length === 0) return `language sql
-stable
+/**
+* The functions an application calls to save, rename and delete a custom
+* role in \`database\` mode, with the rules of \`validateCustomRole\` and
+* \`assignablePermissions\`: entries inside the ceiling of the role's scope,
+* includes naming declared roles, and only permissions and levels the caller
+* may hand out, for the new definition and the stored one alike. A platform
+* custom role (\`p_scope = 'global'\`, no tenant) is written by a caller who
+* holds a \`meta.manageRoles\` permission through a global role. The
+* \`permdock_trusted_*\` variants skip the caller checks and keep the
+* definition checks; no client role may execute them.
+*/
+function customRoleWritesSql(ctx, levelReach) {
+	const custom = ctx.customRoles;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || ctx.authorize !== "database" || root === void 0) return "";
+	const leveled = custom.levels === true;
+	const tenantType = tenantTypeOf(ctx);
+	const rp = qualified(ctx, "role_permissions");
+	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const beyond = qualified(ctx, CUSTOM_ROLES.beyond);
+	const guard = qualified(ctx, CUSTOM_ROLES.guard);
+	const shape = qualified(ctx, CUSTOM_ROLES.shape);
+	const entries = qualified(ctx, CUSTOM_ROLES.entries);
+	const renames = Object.entries(custom.renamed ?? {}).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const current = (expr) => currentKeyExpr(renames, expr);
+	const known = sqlTextArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
+	const caller = callerFunctionsSql(ctx, custom, root, levelReach, false);
+	const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id`;
+	const scopes = sqlTextArray(ctx.scopes.map((scope) => scope.name));
+	const roleName = (param) => `coalesce(${param}, '') = '' or ${param} = any(${sqlTextArray(custom.declared)})`;
+	const levelOf = leveled ? ", nullif(split_part(e, '@', 2), '')" : "";
+	const write = `  delete from ${perms} c where ${match} and c.role = p_role;
+  delete from ${includes} c where ${match} and c.role = p_role;
+  insert into ${perms} (tenant_id, scope, scope_id, role, permission, effect${leveled ? ", level" : ""})
+  select distinct p_tenant, p_scope, p_scope_id, p_role, ${current(leveled ? "split_part(e, '@', 1)" : "e")}, 'allow'${levelOf}
+  from unnest(coalesce(p_allow, '{}'::text[])) e
+  union
+  select distinct p_tenant, p_scope, p_scope_id, p_role, ${current("e")}, 'deny'${leveled ? ", null" : ""}
+  from unnest(coalesce(p_deny, '{}'::text[])) e;
+  insert into ${includes} (tenant_id, scope, scope_id, role, include_role)
+  select distinct p_tenant, p_scope, p_scope_id, p_role, e
+  from unnest(coalesce(p_include, '{}'::text[])) e;`;
+	const move = `  if ${roleName("p_to")} then
+${raiseSql("    ", "22023", `'permdock: ' || coalesce(p_to, 'null') || ' is not a custom role name'`, "declared-role")}
+  end if;
+  if exists (select 1 from ${perms} c where ${match} and c.role = p_to)
+    or exists (select 1 from ${includes} c where ${match} and c.role = p_to) then
+${raiseSql("    ", "22023", `'permdock: ' || p_to || ' already has grants'`, "role-exists")}
+  end if;
+  update ${perms} c set role = p_to where ${match} and c.role = p_from;
+  update ${includes} c set role = p_to where ${match} and c.role = p_from;`;
+	const remove = `  delete from ${perms} c where ${match} and c.role = p_role;
+  delete from ${includes} c where ${match} and c.role = p_role;`;
+	const writeArgs = `${tenantType}, text, text, text, text[], text[], text[]`;
+	const renameArgs = `${tenantType}, text, text, text, text`;
+	const removeArgs = `${tenantType}, text, text, text`;
+	const fn = (comment, name, params, args, body, member) => `-- ${comment}
+create or replace function ${qualified(ctx, name)}(${params})
+returns void
+language plpgsql
+volatile
 security definer
 set search_path = ''
 as $$
-${body.sql}
-$$;`;
-	return `language plpgsql
+${body}
+$$;
+${member ? `revoke execute on function ${qualified(ctx, name)}(${args}) from public, anon;
+grant execute on function ${qualified(ctx, name)}(${args}) to authenticated;` : `revoke execute on function ${qualified(ctx, name)}(${args}) from public, anon, authenticated;`}`;
+	const writeParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text, p_allow text[], p_deny text[], p_include text[]`;
+	const renameParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_from text, p_to text`;
+	const removeParams = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text`;
+	return `${caller.beyond}
+
+-- where a custom role may live: a scope of a tenant, or the platform (scope global, no tenant or instance), under an undeclared name
+create or replace function ${shape}(p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+returns void
+language plpgsql
+stable
+set search_path = ''
+as $$
+begin
+  if p_scope = 'global' then
+    if p_tenant is not null or p_scope_id is not null then
+${raiseSql("      ", "22023", `'permdock: a platform custom role has no tenant or instance'`, "unknown-scope")}
+    end if;
+  elsif p_tenant is null or not (p_scope = any(${scopes})) then
+${raiseSql("    ", "22023", `'permdock: custom roles are held at a scope of a tenant or at global, not ' || coalesce(p_scope, 'null')`, "unknown-scope")}
+  end if;
+  if ${roleName("p_role")} then
+${raiseSql("    ", "22023", `'permdock: ' || coalesce(p_role, 'null') || ' is not a custom role name'`, "declared-role")}
+  end if;
+end;
+$$;
+revoke execute on function ${shape}(${tenantType}, text, text, text) from public, anon, authenticated;
+
+${caller.guard}
+${hasCustomRoleChecksFor(ctx) ? `
+-- the same checks for a user the caller names: trusted SQL acting later for a stored user; no client role may execute them
+${callerFunctionsSql(ctx, custom, root, levelReach, true).beyond}
+
+${callerFunctionsSql(ctx, custom, root, levelReach, true).guard}
+` : ""}
+-- the entries of a definition: declared keys and levels inside the ceiling of the scope, and declared includes
+create or replace function ${entries}(p_scope text, p_allow text[], p_deny text[], p_include text[])
+returns void
+language plpgsql
 stable
 security definer
 set search_path = ''
 as $$
 declare
-${body.vars.map((line) => `  ${line}`).join("\n")}
+  v_entry text;
+  v_key text;
 begin
-  return query
-${body.sql};
+  foreach v_entry in array coalesce(p_allow, '{}'::text[]) loop
+    v_key := ${current(leveled ? "split_part(v_entry, '@', 1)" : "v_entry")};
+    if not (v_key = any(${known})) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared permission'`, "unknown-permission")}
+    end if;
+    if not exists (
+      select 1 from ${ceiling} c
+      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
+    ) then
+${raiseSql("      ", "22023", `'permdock: ' || v_key || ' is outside the ceiling of ' || p_scope`, "outside-ceiling")}
+    end if;${leveled ? `
+    if strpos(v_entry, '@') > 0 and not exists (
+      select 1 from ${ceiling} c
+      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
+        and split_part(c.grant_key, '@', 2) = split_part(v_entry, '@', 2)
+    ) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' names a level the resource does not declare'`, "unknown-level")}
+    end if;` : ""}
+  end loop;
+  foreach v_entry in array coalesce(p_deny, '{}'::text[]) loop
+    if not (v_entry = any(${known})) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared permission'`, "unknown-permission")}
+    end if;
+  end loop;
+  foreach v_entry in array coalesce(p_include, '{}'::text[]) loop
+    if not (v_entry = any(${sqlTextArray(custom.declared)})) then
+${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared role'`, "unknown-role")}
+    end if;
+  end loop;
+  select string_agg(distinct ${current("rp.permission")}, ', ') into v_key
+  from ${rp} rp
+  where rp.role = any(coalesce(p_include, '{}'::text[]))
+    and rp.effect = 'allow'
+    and not exists (
+      select 1 from ${ceiling} c
+      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = ${current("rp.permission")}
+    );
+  if v_key is not null then
+${raiseSql("    ", "22023", `'permdock: an included role allows ' || v_key || ', outside the ceiling of ' || p_scope`, "outside-ceiling")}
+  end if;
 end;
-$$;`;
+$$;
+revoke execute on function ${entries}(text, text[], text[], text[]) from public, anon, authenticated;
+
+${fn("save a custom role: replace its grants and includes after checking each entry against the ceiling and the caller's own permissions", CUSTOM_ROLES.replace, writeParams, writeArgs, `declare
+  v_beyond text;
+begin
+  perform ${guard}(p_tenant, p_scope, p_scope_id, p_role);
+  perform ${entries}(p_scope, p_allow, p_deny, p_include);
+  select string_agg(b, ', ' order by b) into v_beyond
+  from ${beyond}(p_tenant, p_scope, p_scope_id, p_allow, p_deny, p_include) b;
+  if v_beyond is not null then
+${raiseSql("    ", "42501", `'permdock: ' || p_role || ' would allow ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
+  end if;
+${write}
+end;`, true)}
+
+${fn("rename a custom role: move its grants and includes to the new name", CUSTOM_ROLES.rename, renameParams, renameArgs, `begin
+  perform ${guard}(p_tenant, p_scope, p_scope_id, p_from);
+${move}
+end;`, true)}
+
+${fn("delete a custom role: remove its grants and includes", CUSTOM_ROLES.remove, removeParams, removeArgs, `begin
+  perform ${guard}(p_tenant, p_scope, p_scope_id, p_role);
+${remove}
+end;`, true)}
+
+${fn("save a custom role for a trusted caller (a migration, a job, a backend role granted execute): the definition checks without the caller checks", CUSTOM_ROLES.trustedReplace, writeParams, writeArgs, `begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
+  perform ${entries}(p_scope, p_allow, p_deny, p_include);
+${write}
+end;`, false)}
+
+${fn("rename a custom role for a trusted caller", CUSTOM_ROLES.trustedRename, renameParams, renameArgs, `begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_from);
+${move}
+end;`, false)}
+
+${fn("delete a custom role for a trusted caller", CUSTOM_ROLES.trustedRemove, removeParams, removeArgs, `begin
+  perform ${shape}(p_tenant, p_scope, p_scope_id, p_role);
+${remove}
+end;`, false)}`;
 }
+//#endregion
+//#region src/cli/rls/global-roles.ts
 /**
-* `ms.id` for the scope itself and `ms.within ->> name` for an ancestor. The
-* alias is not `s`, which `activeRowSql` binds inside its `exists`.
+* `permdock_replace_global_roles(p_user, p_roles)`: sets the global roles of
+* one user in `rls.roles` in one statement pair. It runs as the invoker, so
+* the table's policies and the `rls.assignments` trigger judge every row it
+* deletes or inserts.
 */
-function sourceIdOf(scope) {
-	return (name) => name === scope ? "ms.id" : `ms.within ->> ${quoteLiteral(name)}`;
-}
-function sourceFilters(ctx, scope, user = subjectIdSql(ctx), permission, keeps = false) {
-	return [
-		...keeps ? [`    and ${keptRowSql("ms.keep", permission)}`] : [],
-		...userActive(ctx, "    ", user),
-		...instancesActive(ctx, scope, sourceIdOf(scope), "    ", permission)
-	].map((line) => `\n${line}`).join("");
-}
-function sourcesBody(ctx, scope, type) {
-	const root = rootName(ctx);
-	const tenant = sourceIdOf(scope)(root);
-	const narrow = narrowsTo(ctx, scope) ? `\n    and (${activeTenant(ctx)} is null or ${tenant} = ${activeTenant(ctx)})${keyTenantLine(ctx, scope, tenant)}` : keyTenantLine(ctx, scope, tenant);
-	const sources = scopeSources(ctx, scope);
-	const set = ctx.grantSet === true;
-	const rows = `  from (
-${sourceRows(sources)}
-  ) ms
-  cross join lateral jsonb_array_elements_text(
-    case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
-  ) r(role)`;
-	const declared = `  select (ms.id)::${type}${set ? ", rp.grant_key" : ""}
-${rows}
-  join ${qualified$1(ctx, "role_permissions")} rp on rp.role = r.role
-  where ${signedIn(ctx)}
-    and ms.scope = ${quoteLiteral(scope)}${set ? "" : "\n    and rp.grant_key = p_grant"}
-    and rp.scope = ${quoteLiteral(scope)}${andLine("    ", kindFilterSql(ctx, "r.role", "ms.via"))}${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql(set ? "rp.grant_key" : "p_grant"), sourcesKeep(sources))}`;
-	const custom = ctx.customRoles;
-	if (custom === void 0) return sourcesBodyOf(declared, sources, subjectIdSql(ctx));
-	const match = [
-		`c.tenant_id::text = (${tenant})::text`,
-		`c.scope = ${quoteLiteral(scope)}`,
-		"(c.scope_id is null or c.scope_id = (ms.id)::text)",
-		"c.role = r.role"
-	].join(" and ");
-	const entries = (source, value, extra) => `array(select c.${value} from ${qualified$1(ctx, source)} c where ${match}${extra})`;
-	if (set) return sourcesBodyOf(`${declared}
-  union
-  select (ms.id)::${type}, ck.grant_key
-${rows}
-${customKeysJoin(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}
-  where ${signedIn(ctx)}
-    and ms.scope = ${quoteLiteral(scope)}
-    and not (r.role = any(${textArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("ck.grant_key"), sourcesKeep(sources))}`, sources, subjectIdSql(ctx));
-	return sourcesBodyOf(`${declared}
-  union
-  select (ms.id)::${type}
-${rows}
-  where ${signedIn(ctx)}
-    and ms.scope = ${quoteLiteral(scope)}
-    and not (r.role = any(${textArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("p_grant"), sourcesKeep(sources))}
-${customKeysSql(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}`, sources, subjectIdSql(ctx));
-}
-function scopedBody(ctx, scope, type) {
-	if (ctx.authorize !== "database") return sqlBody(claimBody(ctx, scope, type));
-	return scopeSources(ctx, scope).length > 0 ? sourcesBody(ctx, scope, type) : sqlBody(tableBody(ctx, scope, type));
+function globalRolesSql(ctx) {
+	if (ctx.roles === void 0) return "";
+	const source = globalRoleSource(ctx.roles, "public", "t", ctx.customRoles?.table);
+	const table = quoteQualified(ctx.roles.table);
+	const user = quoteIdent(source.user);
+	const fn = qualified(ctx, GLOBAL_ROLES.replace);
+	const type = ctx.dialect === "supabase" ? "uuid" : "text";
+	const wanted = `select distinct r from unnest(coalesce(p_roles, '{}'::text[])) r where r is not null`;
+	const through = source.through;
+	let body;
+	if (through === void 0) {
+		const role = typeof ctx.roles.role === "string" ? ctx.roles.role : "role";
+		const column = quoteIdent(role);
+		body = `  delete from ${table} t
+  where t.${user} = p_user
+    and t.${column}::text <> all(coalesce(p_roles, '{}'::text[]));
+  insert into ${table} (${user}, ${column})
+  select p_user, w.r
+  from (${wanted}) w(r)
+  where not exists (
+    select 1 from ${table} t where t.${user} = p_user and t.${column}::text = w.r
+  );`;
+	} else {
+		const keys = quoteTable(through.table);
+		const id = quoteIdent(through.id);
+		const key = quoteIdent(through.key);
+		const ref = quoteIdent(through.ref);
+		const global = source.tenant === void 0 ? "" : ` and k.${quoteIdent(source.tenant)} is null`;
+		body = `  select string_agg(w.r, ', ' order by w.r) into v_unknown
+  from (${wanted}) w(r)
+  where not exists (select 1 from ${keys} k where k.${key}::text = w.r${global});
+  if v_unknown is not null then
+    raise exception using
+      errcode = '22023',
+      message = 'permdock: ' || v_unknown || ' is not a role',
+      hint = 'unknown-role';
+  end if;
+  delete from ${table} t
+  where t.${user} = p_user
+    and not exists (
+      select 1 from ${keys} k
+      where k.${id} = t.${ref}
+        and k.${key}::text = any(coalesce(p_roles, '{}'::text[]))${global}
+    );
+  insert into ${table} (${user}, ${ref})
+  select p_user, k.${id}
+  from ${keys} k
+  where k.${key}::text in (${wanted})${global}
+    and not exists (
+      select 1 from ${table} t where t.${user} = p_user and t.${ref} = k.${id}
+    );`;
+	}
+	const declare = through === void 0 ? "" : "declare\n  v_unknown text;\n";
+	const args = `${type}, text[]`;
+	return `-- set the global roles of a user: delete the others and insert the missing ones, as the caller, so the table's policies and the assignment trigger still apply
+create or replace function ${fn}(p_user ${type}, p_roles text[])
+returns void
+language plpgsql
+volatile
+set search_path = ''
+as $$
+${declare}begin
+${body}
+end;
+$$;
+revoke execute on function ${fn}(${args}) from public, anon;
+grant execute on function ${fn}(${args}) to authenticated;`;
 }
+//#endregion
+//#region src/cli/rls/helper-members.ts
 /**
 * The body of `member_<scope>_ids()`: instances of `scope` the subject holds
 * a live membership of, with any role. Not narrowed to the active tenant, and
@@ -2088,7 +2340,7 @@ ${sourceRows(sources)}
 	const role = memberRoleOf(table, "m", "  ");
 	const lines = [
 		`  select distinct ${memberColumn(column)}::${type}`,
-		`  from ${membershipTable(table.table)} m${role.join}`,
+		`  from ${quoteQualified(table.table)} m${role.join}`,
 		`  where ${memberColumn(table.user)} = ${user}`,
 		`    and ${role.through === void 0 && !role.lateral ? memberColumn(role.column) : role.sql} is not null`
 	];
@@ -2109,7 +2361,7 @@ function membershipClaim(ctx) {
 	return ctx.dialect === "supabase" ? `coalesce(${raw}, (select auth.jwt()) -> 'app_metadata' -> 'memberships')` : raw;
 }
 function memberFunction(ctx, scope, type, anonExecute) {
-	const fn = qualified$1(ctx, memberIdsHelper(scope));
+	const fn = qualified(ctx, memberIdsHelper(scope));
 	const body = memberBody(ctx, scope, type);
 	const keys = ctx.apiKeys;
 	const keyed = keys === void 0 || scope !== rootName(ctx) ? body : {
@@ -2132,14 +2384,45 @@ ${grants}`;
 * `supabase_auth_admin` execute.
 */
 function memberForFunction(ctx, scope, type) {
-	const fn = qualified$1(ctx, memberForHelper(scope));
+	const fn = qualified(ctx, memberForHelper(scope));
 	return `create or replace function ${fn}(p_user uuid)
 returns setof ${type}
 ${functionBody(memberRowsBody(ctx, scope, type, "p_user", memberForSources(ctx, scope)))}
 revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
 }
+//#endregion
+//#region src/cli/rls/helpers.ts
+/**
+* The policy-side call for a grant key. Every form is uncorrelated, so
+* Postgres runs the helper once per statement (an InitPlan, or a hashed
+* SubPlan for `in`), never once per row.
+*/
+function accessSql(ctx, scope, grantKey, column) {
+	const key = quoteLiteral(grantKey);
+	if (scope === "global") return `(select ${qualified(ctx, HELPERS.has)}(${key}))`;
+	if (column === void 0) throw new Error(`PermDock CLI: ${scope}-scoped grant needs definePolicy({ scopes.${scope} })`);
+	return `${quoteIdent(column)} in (select ${qualified(ctx, permittedIdsHelper(scope))}(${key}))`;
+}
+function userIdSql(ctx, anonExecute) {
+	const fn = userIdHelperSql(ctx);
+	return `-- the caller's user id: the sub of request.jwt.claims, or null when it is empty or absent
+create or replace function ${fn}()
+returns uuid
+language sql
+stable
+set search_path = ''
+as $$
+  select nullif(
+    nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub',
+    ''
+  )::uuid
+$$;
+${anonExecute ? `revoke execute on function ${fn}() from public;
+grant execute on function ${fn}() to anon, authenticated;` : `revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;`}`;
+}
 function helperFunction(ctx, name, returns, body, anonExecute) {
-	const fn = qualified$1(ctx, name);
+	const fn = qualified(ctx, name);
 	const grants = anonExecute ? `revoke execute on function ${fn}(text) from public;
 grant execute on function ${fn}(text) to anon, authenticated;` : `revoke execute on function ${fn}(text) from public, anon;
 grant execute on function ${fn}(text) to authenticated;`;
@@ -2163,7 +2446,7 @@ function forUserSql(ctx) {
 	const forUser = forUserContext(ctx);
 	const type = ctx.dialect === "supabase" ? "uuid" : "text";
 	const fn = (name, returns, body) => {
-		const qualifiedName = qualified$1(ctx, name);
+		const qualifiedName = qualified(ctx, name);
 		return `create or replace function ${qualifiedName}(p_user ${type}, p_grant text)
 returns ${returns}
 ${functionBody(body)}
@@ -2184,7 +2467,7 @@ function userIdType(ctx) {
 * declarative schema; `--split ...,seeds` writes it as its own migration.
 */
 function seedSql(ctx, rows) {
-	const table = qualified$1(ctx, "role_permissions");
+	const table = qualified(ctx, "role_permissions");
 	if (rows.length === 0) return `delete from ${table};`;
 	return `insert into ${table} (role, permission, grant_key, scope, effect) values
 ${rows.map((row) => `  (${[
@@ -2203,308 +2486,107 @@ ${rows.map((row) => `  (${[
 		row.grantKey,
 		row.scope
 	].map(quoteLiteral).join(", ")})`).join(",\n")}
-);`;
-}
-/**
-* `role_permissions`, its seeds, and the three `security definer` helpers
-* with `search_path = ''`. `execute` goes to `authenticated` only.
-*/
-function helpersSql(ctx, rows, options) {
-	const schema = helperSchema(ctx);
-	const s = quoteIdent(schema);
-	const rp = qualified$1(ctx, "role_permissions");
-	const chunks = [`-- permdock helpers (${ctx.authorize === "database" ? "database: reads the membership and user_roles tables" : "jwt: reads the role and memberships claims"})
--- policies call them uncorrelated, so Postgres evaluates each once per statement`];
-	if (schema !== "public") chunks.push(`create schema if not exists ${s};\nrevoke all on schema ${s} from public;\ngrant usage on schema ${s} to ${options.anonExecute === true ? "anon, authenticated" : "authenticated"};`);
-	if (ctx.dialect === "supabase") chunks.push(userIdSql(ctx, options.anonExecute === true));
-	chunks.push(`create table if not exists ${rp} (
-  role text not null,
-  permission text not null,
-  grant_key text not null,
-  scope text not null check (scope ~ '^[a-z][a-z0-9_]*$'),
-  effect text not null default 'allow' check (effect in ('allow', 'deny')),
-  primary key (role, grant_key, scope)
-);
-alter table ${rp} enable row level security;
-revoke all on table ${rp} from anon, authenticated, public;`);
-	if (options.withoutSeeds !== true) chunks.push(seedSql(ctx, rows));
-	if (ctx.authorize === "database" && options.userRoles && ctx.roles === void 0) {
-		const ur = qualified$1(ctx, "user_roles");
-		chunks.push(`create table if not exists ${ur} (
-  user_id ${userIdType(ctx)},
-  role text not null,
-  primary key (user_id, role)
-);
-alter table ${ur} enable row level security;
-revoke all on table ${ur} from anon, authenticated, public;`);
-	}
-	const custom = customRolesSql(ctx);
-	if (custom !== "") chunks.push(custom);
-	const anon = options.anonExecute === true;
-	const keys = ctx.apiKeys;
-	if (keys !== void 0) chunks.push(apiKeyAllowsSql(ctx, keys, anon));
-	const bodies = grantBodies(ctx);
-	chunks.push(helperFunction(ctx, HELPERS.has, "boolean", bodies.has, anon));
-	const capabilities = capabilitiesSql(ctx);
-	if (capabilities !== "") chunks.push(capabilities);
-	for (const scope of ctx.scopes) {
-		const type = scopeTypeOf(ctx, scope.name);
-		chunks.push(helperFunction(ctx, permittedIdsHelper(scope.name), `setof ${type}`, bodies.ids(scope.name), anon));
-		chunks.push(memberFunction(ctx, scope.name, type, anon));
-		if (hasMemberFor(ctx, scope.name)) chunks.push(memberForFunction(ctx, scope.name, type));
-	}
-	const forUser = forUserSql(ctx);
-	if (forUser !== "") chunks.push(forUser);
-	const writes = customRoleWritesSql(ctx, options.levelReach ?? []);
-	if (writes !== "") {
-		chunks.push(writes);
-		const cascade = customRoleCascadeSql(ctx);
-		if (cascade !== "") chunks.push(cascade);
-	}
-	const globalRoles = globalRolesSql(ctx);
-	if (globalRoles !== "") chunks.push(globalRoles);
-	const readers = roleReadersSql(ctx, options.permissions, options.trustedReaders);
-	if (readers !== "") chunks.push(readers);
-	return `${chunks.join("\n\n")}\n`;
-}
-function grantBodies(ctx) {
-	const keys = ctx.apiKeys;
-	const set = ctx.grantSet === true;
-	const allows = apiKeyAllowsCall(ctx, set ? "ids.grant_key" : "p_grant");
-	const keyTenant = keyTenantSql(ctx, void 0) ?? "true";
-	return {
-		has: sqlBody(keys === void 0 ? hasBody(ctx) : set ? `  select g.grant_key
-  from (
-${hasBody(ctx)}
-  ) g(grant_key)
-  where ${apiKeyAllowsCall(ctx, "g.grant_key")} and ${keyTenant}` : ceilingHasSql(hasBody(ctx), `${allows} and ${keyTenant}`)),
-		ids: (scope) => {
-			const type = scopeTypeOf(ctx, scope);
-			const body = scopedBody(ctx, scope, type);
-			if (keys === void 0) return body;
-			const sql = scope === rootName(ctx) ? `${body.sql}\n  union\n${serviceKeyIdsSql(ctx, keys, scope, type)}` : body.sql;
-			return {
-				sql: set ? `  select ids.id, ids.grant_key
-  from (
-${sql}
-  ) ids(id, grant_key)
-  where ${allows}` : ceilingIdsSql(sql, allows),
-				vars: body.vars
-			};
-		}
-	};
-}
-function forUserContext(ctx) {
-	const { apiKeys: _apiKeys, ...unkeyed } = ctx;
-	return {
-		...unkeyed,
-		subjectId: "p_user",
-		tenants: "all"
-	};
-}
-//#endregion
-//#region src/cli/pg.ts
-const CONNECT_TIMEOUT_MS = 1e4;
-const STATEMENT_TIMEOUT_MS = 6e4;
-function loadPg(command) {
-	return requirePeer(() => import("pg"), "pg", command);
-}
-function options(db) {
-	return {
-		connectionString: db,
-		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
-		statement_timeout: STATEMENT_TIMEOUT_MS
-	};
-}
-/** Ctrl-C ends the connection, so a query that hangs cannot keep the process alive. */
-function endOnInterrupt(end) {
-	const interrupt = () => {
-		end().catch(() => void 0);
-		process.exitCode = 130;
-	};
-	process.once("SIGINT", interrupt);
-	return async () => {
-		process.off("SIGINT", interrupt);
-		await end();
-	};
-}
-function unreachable(command, cause) {
-	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, { cause });
-}
-/** One connection, for commands that run a transaction. */
-async function connectPg(db, command) {
-	const client = new (await (loadPg(command))).Client(options(db));
-	try {
-		await client.connect();
-	} catch (cause) {
-		throw unreachable(command, cause);
-	}
-	return {
-		query: (sql, values) => client.query(sql, values),
-		end: endOnInterrupt(() => client.end())
-	};
-}
-/** A small pool, for independent catalog reads that can run in parallel. */
-async function connectPgPool(db, command) {
-	const pool = new (await (loadPg(command))).Pool({
-		...options(db),
-		max: 4
-	});
-	try {
-		(await pool.connect()).release();
-	} catch (cause) {
-		await pool.end();
-		throw unreachable(command, cause);
-	}
-	return {
-		query: (sql, values) => pool.query(sql, values),
-		end: endOnInterrupt(() => pool.end())
-	};
-}
-//#endregion
-//#region src/cli/rls-indexes.ts
-/** Postgres truncates identifiers longer than this, in bytes. */
-const MAX_IDENT = 63;
-/**
-* The row fields `condition` compares with the subject, a claim or a
-* membership (`ownerId: principal.id`, `memberOf`), through `and` and `or`:
-* the selective comparisons an index serves. A comparison with a constant
-* (`status: 'sent'`) narrows rows the scope key already found, a negation
-* scans anyway, and a dotted field is a JSON path a plain index does not serve.
-*/
-function indexedFields(condition) {
-	if (condition === void 0) return [];
-	switch (condition.op) {
-		case "and":
-		case "or": return condition.conditions.flatMap(indexedFields);
-		case "memberOf": return plainField(condition.field);
-		case "eq":
-		case "in": return isConditionRef(condition.value) ? plainField(condition.field) : [];
-		case "not":
-		case "sqlFunction":
-		case "opaque":
-		case "related":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte":
-		case "contains":
-		case "notIn":
-		case "isNull":
-		case "liveSession": return [];
-		default: return condition;
-	}
-}
-function plainField(field) {
-	return field.includes(".") ? [] : [field];
+);`;
 }
 /**
-* Every index the generated SQL reads through: the row columns policies
-* filter on (scope keys and selective condition fields), and the membership
-* tables' user column, followed by the scope column the helpers select.
+* `role_permissions`, its seeds, and the three `security definer` helpers
+* with `search_path = ''`. `execute` goes to `authenticated` only.
 */
-function indexTargets(ctx, rowColumns) {
-	const targets = /* @__PURE__ */ new Map();
-	const add = (table, columns) => {
-		const target = {
-			table: qualifiedTable(table),
-			columns
-		};
-		targets.set(`${target.table}\u0000${columns[0] ?? ""}`, target);
-	};
-	for (const { table, column } of rowColumns) add(table, [column]);
+function helpersSql(ctx, rows, options) {
+	const schema = helperSchema(ctx);
+	const s = quoteIdent(schema);
+	const rp = qualified(ctx, "role_permissions");
+	const chunks = [`-- permdock helpers (${ctx.authorize === "database" ? "database: reads the membership and user_roles tables" : "jwt: reads the role and memberships claims"})
+-- policies call them uncorrelated, so Postgres evaluates each once per statement`];
+	if (schema !== "public") chunks.push(`create schema if not exists ${s};\nrevoke all on schema ${s} from public;\ngrant usage on schema ${s} to ${options.anonExecute === true ? "anon, authenticated" : "authenticated"};`);
+	if (ctx.dialect === "supabase") chunks.push(userIdSql(ctx, options.anonExecute === true));
+	chunks.push(`create table if not exists ${rp} (
+  role text not null,
+  permission text not null,
+  grant_key text not null,
+  scope text not null check (scope ~ '^[a-z][a-z0-9_]*$'),
+  effect text not null default 'allow' check (effect in ('allow', 'deny')),
+  primary key (role, grant_key, scope)
+);
+alter table ${rp} enable row level security;
+revoke all on table ${rp} from anon, authenticated, public;`);
+	if (options.withoutSeeds !== true) chunks.push(seedSql(ctx, rows));
+	if (ctx.authorize === "database" && options.userRoles && ctx.roles === void 0) {
+		const ur = qualified(ctx, "user_roles");
+		chunks.push(`create table if not exists ${ur} (
+  user_id ${userIdType(ctx)},
+  role text not null,
+  primary key (user_id, role)
+);
+alter table ${ur} enable row level security;
+revoke all on table ${ur} from anon, authenticated, public;`);
+	}
+	const custom = customRolesSql(ctx);
+	if (custom !== "") chunks.push(custom);
+	const anon = options.anonExecute === true;
+	const keys = ctx.apiKeys;
+	if (keys !== void 0) chunks.push(apiKeyAllowsSql(ctx, keys, anon));
+	const bodies = grantBodies(ctx);
+	chunks.push(helperFunction(ctx, HELPERS.has, "boolean", bodies.has, anon));
+	const capabilities = capabilitiesSql(ctx);
+	if (capabilities !== "") chunks.push(capabilities);
 	for (const scope of ctx.scopes) {
-		const mapped = scopeTable(ctx, scope.name);
-		if (mapped !== void 0) add(mapped.table.table, [mapped.table.user, mapped.column]);
+		const type = scopeTypeOf(ctx, scope.name);
+		chunks.push(helperFunction(ctx, permittedIdsHelper(scope.name), `setof ${type}`, bodies.ids(scope.name), anon));
+		chunks.push(memberFunction(ctx, scope.name, type, anon));
+		if (hasMemberFor(ctx, scope.name)) chunks.push(memberForFunction(ctx, scope.name, type));
 	}
-	for (const source of [...ctx.sources ?? [], ...ctx.memberSources ?? []]) {
-		add(source.sql.table, [source.sql.user]);
-		const users = source.sql.userThrough;
-		if (users !== void 0) add(users.table, [users.key]);
+	const forUser = forUserSql(ctx);
+	if (forUser !== "") chunks.push(forUser);
+	const writes = customRoleWritesSql(ctx, options.levelReach ?? []);
+	if (writes !== "") {
+		chunks.push(writes);
+		const cascade = customRoleCascadeSql(ctx);
+		if (cascade !== "") chunks.push(cascade);
 	}
-	return [...targets.values()].toSorted((a, b) => `${a.table}.${a.columns.join(",")}` < `${b.table}.${b.columns.join(",")}` ? -1 : 1);
-}
-/** A stable index name under Postgres' identifier limit. */
-function indexName(target) {
-	const name = `permdock_${target.table.slice(target.table.lastIndexOf(".") + 1)}_${target.columns.join("_")}_idx`;
-	if (Buffer.byteLength(name) <= MAX_IDENT) return name;
-	return `permdock_${createHash("sha256").update(name).digest("hex").slice(0, 8)}_idx`;
-}
-/** `create index if not exists` for every target, one per line. */
-function indexesSql(targets) {
-	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
-}
-/** Every live column of the tables in `$1` (`schema.table`), as `target` and `name`. */
-const COLUMNS_SQL = `select n.nspname || '.' || c.relname as target, a.attname as name
-from pg_attribute a
-join pg_class c on c.oid = a.attrelid
-join pg_namespace n on n.oid = c.relnamespace
-where a.attnum > 0 and not a.attisdropped
-  and n.nspname || '.' || c.relname = any($1::text[])`;
-const INDEX_COLUMNS_SQL = `select n.nspname || '.' || c.relname as target,
-  array(
-    select a.attname::text
-    from unnest(i.indkey) with ordinality k(attnum, ord)
-    left join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum and k.attnum > 0
-    where k.ord <= i.indnkeyatts
-    order by k.ord
-  ) as columns
-from pg_index i
-join pg_class c on c.oid = i.indrelid
-join pg_namespace n on n.oid = c.relnamespace
-where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
-function strings(value) {
-	return Array.isArray(value) ? value.map((item) => typeof item === "string" ? item : null) : [];
-}
-/** Reads the columns and index key columns of `tables` (`schema.table`). */
-async function readTableIndexFacts(db, tables, connect = (url) => connectPgPool(url, "permdock rls generate --db")) {
-	const client = await connect(db);
-	try {
-		const [columns, indexes] = await Promise.all([client.query(COLUMNS_SQL, [[...tables]]), client.query(INDEX_COLUMNS_SQL, [[...tables]])]);
-		const byTable = {};
-		for (const row of columns.rows) (byTable[String(row["target"])] ??= []).push(String(row["name"]));
-		const keys = {};
-		for (const row of indexes.rows) {
-			const list = strings(row["columns"]);
-			const end = list.indexOf(null);
-			const lead = end === -1 ? list : list.slice(0, end);
-			if (lead.length > 0) (keys[String(row["target"])] ??= []).push(lead);
+	const globalRoles = globalRolesSql(ctx);
+	if (globalRoles !== "") chunks.push(globalRoles);
+	const readers = roleReadersSql(ctx, options.permissions, options.trustedReaders);
+	if (readers !== "") chunks.push(readers);
+	return `${chunks.join("\n\n")}\n`;
+}
+function grantBodies(ctx) {
+	const keys = ctx.apiKeys;
+	const set = ctx.grantSet === true;
+	const allows = apiKeyAllowsCall(ctx, set ? "ids.grant_key" : "p_grant");
+	const keyTenant = keyTenantSql(ctx, void 0) ?? "true";
+	return {
+		has: sqlBody(keys === void 0 ? hasBody(ctx) : set ? `  select g.grant_key
+  from (
+${hasBody(ctx)}
+  ) g(grant_key)
+  where ${apiKeyAllowsCall(ctx, "g.grant_key")} and ${keyTenant}` : ceilingHasSql(hasBody(ctx), `${allows} and ${keyTenant}`)),
+		ids: (scope) => {
+			const type = scopeTypeOf(ctx, scope);
+			const body = scopedBody(ctx, scope, type);
+			if (keys === void 0) return body;
+			const sql = scope === rootName(ctx) ? `${body.sql}\n  union\n${serviceKeyIdsSql(ctx, keys, scope, type)}` : body.sql;
+			return {
+				sql: set ? `  select ids.id, ids.grant_key
+  from (
+${sql}
+  ) ids(id, grant_key)
+  where ${allows}` : ceilingIdsSql(sql, allows),
+				vars: body.vars
+			};
 		}
-		return {
-			columns: byTable,
-			indexes: keys
-		};
-	} finally {
-		await client.end();
-	}
+	};
 }
-/**
-* Drops the targets a database already serves or cannot hold: a target on a
-* table or column the database lacks (with a warning), and one an existing
-* index leads with (its key columns start with the target's).
-*/
-function pruneIndexTargets(targets, facts) {
-	const warnings = [];
+function forUserContext(ctx) {
+	const { apiKeys: _apiKeys, ...unkeyed } = ctx;
 	return {
-		targets: targets.filter((target) => {
-			const columns = facts.columns[target.table];
-			if (columns === void 0) {
-				warnings.push(`no index suggested on ${target.table}: the database has no such table`);
-				return false;
-			}
-			const absent = target.columns.filter((column) => !columns.includes(column));
-			if (absent.length > 0) {
-				warnings.push(`no index suggested on ${target.table} (${target.columns.join(", ")}): the table has no column ${absent.join(", ")}`);
-				return false;
-			}
-			return !(facts.indexes[target.table] ?? []).some((index) => target.columns.every((column, at) => index[at] === column));
-		}),
-		warnings
+		...unkeyed,
+		subjectId: "p_user",
+		tenants: "all"
 	};
 }
 //#endregion
-//#region src/cli/rls-permission-keys.ts
+//#region src/cli/rls/permission-keys.ts
 /** The helpers that take a permission key instead of a grant key. Names are part of the SQL contract. */
 const PERMISSION_HELPERS = {
 	grantKeys: "grant_keys",
@@ -2531,9 +2613,9 @@ function permittedByPermissionHelper(scope) {
 */
 function requiresSql(ctx, key, resource) {
 	const literal = quoteLiteral(key);
-	return `(${[`(select ${qualified$1(ctx, PERMISSION_HELPERS.has)}(${literal}))`, ...(resource === void 0 ? [] : partitionsOf(resource, ctx.scopes)).map((scope) => {
+	return `(${[`(select ${qualified(ctx, PERMISSION_HELPERS.has)}(${literal}))`, ...(resource === void 0 ? [] : partitionsOf(resource, ctx.scopes)).map((scope) => {
 		const field = scopeField(resource, scope, ctx.scopes) ?? scope;
-		return `${quoteIdent(field)} in (select ${qualified$1(ctx, checkName(permittedByPermissionHelper(scope)))}(${literal}))`;
+		return `${quoteIdent(field)} in (select ${qualified(ctx, checkName(permittedByPermissionHelper(scope)))}(${literal}))`;
 	})].join(" or ")})`;
 }
 /** Postgres truncates an identifier past 63 bytes, which would merge two helpers. */
@@ -2542,7 +2624,7 @@ function checkName(name) {
 	return name;
 }
 function grantsFunction(ctx, grants, renamed, anonExecute) {
-	const fn = qualified$1(ctx, PERMISSION_HELPERS.grantKeys);
+	const fn = qualified(ctx, PERMISSION_HELPERS.grantKeys);
 	const map = Object.fromEntries([...grants].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
 	const current = Object.keys(renamed).length === 0 ? "p_permission" : `coalesce(${quoteLiteral(JSON.stringify(renamed))}::jsonb ->> p_permission, p_permission)`;
 	return `-- the grant keys a permission key reaches on one scope: its unconditional allows, with p_effect 'deny' every deny, and with 'conditioned-allow' or 'conditioned-deny' the allows or denies that carry a row condition
@@ -2600,7 +2682,7 @@ ${access}`;
 * caller, as `permittedIds(..., { conditioned: true })` does in process.
 */
 function permissionHelpersSql(ctx, grants, renamed, anonExecute) {
-	const keys = qualified$1(ctx, PERMISSION_HELPERS.grantKeys);
+	const keys = qualified(ctx, PERMISSION_HELPERS.grantKeys);
 	const allowKeys = (scope) => `${keys}(p_permission, ${quoteLiteral(scope)}) g(grant_key)`;
 	const denyKeys = (scope) => `${keys}(p_permission, ${quoteLiteral(scope)}, 'deny') g(grant_key)`;
 	const has = (helper, user) => `  select exists (select 1 from ${allowKeys("global")} where ${helper}(${user}g.grant_key))
@@ -2676,13 +2758,13 @@ ${idsBody.sql}
 		};
 	};
 	const chunks = [grantsFunction(ctx, grants, renamed, anonExecute), `-- the helpers by permission key: unconditional allows minus any deny
-${definer(qualified$1(ctx, PERMISSION_HELPERS.has), "p_permission text", "boolean", has(qualified$1(ctx, HELPERS.has), ""))}
-${grantsSql(qualified$1(ctx, PERMISSION_HELPERS.has), "text", anonExecute)}`];
+${definer(qualified(ctx, PERMISSION_HELPERS.has), "p_permission text", "boolean", has(qualified(ctx, HELPERS.has), ""))}
+${grantsSql(qualified(ctx, PERMISSION_HELPERS.has), "text", anonExecute)}`];
 	for (const scope of ctx.scopes) {
-		const fn = qualified$1(ctx, checkName(permittedByPermissionHelper(scope.name)));
-		chunks.push(`${definer(fn, "p_permission text", `setof ${scopeTypeOf(ctx, scope.name)}`, ids(qualified$1(ctx, permittedIdsHelper(scope.name)), scope.name, ""))}
+		const fn = qualified(ctx, checkName(permittedByPermissionHelper(scope.name)));
+		chunks.push(`${definer(fn, "p_permission text", `setof ${scopeTypeOf(ctx, scope.name)}`, ids(qualified(ctx, permittedIdsHelper(scope.name)), scope.name, ""))}
 ${grantsSql(fn, "text", anonExecute)}`);
-		const keysFn = qualified$1(ctx, checkName(permissionKeysHelper(scope.name)));
+		const keysFn = qualified(ctx, checkName(permissionKeysHelper(scope.name)));
 		const type = scopeTypeOf(ctx, scope.name);
 		const caller = grantBodies({
 			...ctx,
@@ -2692,23 +2774,23 @@ ${grantsSql(fn, "text", anonExecute)}`);
 ${keysFunction(keysFn, `p_id ${type}`, keysBody(scope.name, caller, false), grantsSql(keysFn, type, anonExecute))}
 ${keysFunction(keysFn, `p_id ${type}, p_keys text[]`, keysBody(scope.name, caller, true), grantsSql(keysFn, `${type}, text[]`, anonExecute))}`);
 		chunks.push(`-- with p_conditioned true, also the instances a conditioned allow reaches, minus only unconditional denies: the caller applies the row condition
-${definer(fn, "p_permission text, p_conditioned boolean", `setof ${scopeTypeOf(ctx, scope.name)}`, conditionedIds(qualified$1(ctx, permittedIdsHelper(scope.name)), scope.name, ""))}
+${definer(fn, "p_permission text, p_conditioned boolean", `setof ${scopeTypeOf(ctx, scope.name)}`, conditionedIds(qualified(ctx, permittedIdsHelper(scope.name)), scope.name, ""))}
 ${grantsSql(fn, "text, boolean", anonExecute)}`);
 	}
 	if (ctx.authorize !== "database") return `${chunks.join("\n\n")}\n`;
 	const user = ctx.dialect === "supabase" ? "uuid" : "text";
 	const revoke = (fn) => `revoke execute on function ${fn}(${user}, text) from public, anon, authenticated;`;
-	const hasFor = qualified$1(ctx, PERMISSION_HELPERS.hasFor);
+	const hasFor = qualified(ctx, PERMISSION_HELPERS.hasFor);
 	chunks.push(`-- the same for a user the caller names; no client role may execute them
-${definer(hasFor, `p_user ${user}, p_permission text`, "boolean", has(qualified$1(ctx, HELPERS.hasFor), "p_user, "))}
+${definer(hasFor, `p_user ${user}, p_permission text`, "boolean", has(qualified(ctx, HELPERS.hasFor), "p_user, "))}
 ${revoke(hasFor)}`);
 	for (const scope of ctx.scopes) {
-		const fn = qualified$1(ctx, checkName(`${permittedByPermissionHelper(scope.name)}_for`));
-		chunks.push(`${definer(fn, `p_user ${user}, p_permission text`, `setof ${scopeTypeOf(ctx, scope.name)}`, ids(qualified$1(ctx, permittedForHelper(scope.name)), scope.name, "p_user, "))}
+		const fn = qualified(ctx, checkName(`${permittedByPermissionHelper(scope.name)}_for`));
+		chunks.push(`${definer(fn, `p_user ${user}, p_permission text`, `setof ${scopeTypeOf(ctx, scope.name)}`, ids(qualified(ctx, permittedForHelper(scope.name)), scope.name, "p_user, "))}
 ${revoke(fn)}`);
-		chunks.push(`${definer(fn, `p_user ${user}, p_permission text, p_conditioned boolean`, `setof ${scopeTypeOf(ctx, scope.name)}`, conditionedIds(qualified$1(ctx, permittedForHelper(scope.name)), scope.name, "p_user, "))}
+		chunks.push(`${definer(fn, `p_user ${user}, p_permission text, p_conditioned boolean`, `setof ${scopeTypeOf(ctx, scope.name)}`, conditionedIds(qualified(ctx, permittedForHelper(scope.name)), scope.name, "p_user, "))}
 revoke execute on function ${fn}(${user}, text, boolean) from public, anon, authenticated;`);
-		const keysFor = qualified$1(ctx, checkName(permissionKeysForHelper(scope.name)));
+		const keysFor = qualified(ctx, checkName(permissionKeysForHelper(scope.name)));
 		const type = scopeTypeOf(ctx, scope.name);
 		const named = grantBodies({
 			...forUserContext(ctx),
@@ -2720,863 +2802,4 @@ ${keysFunction(keysFor, `p_user ${user}, p_id ${type}, p_keys text[]`, keysBody(
 	return `${chunks.join("\n\n")}\n`;
 }
 //#endregion
-//#region src/cli/rls-compile.ts
-/**
-* The levels an allow reaches: every level without a row condition, else the
-* levels whose condition equals its condition.
-*/
-function reachedLevels(where, levels) {
-	if (where === void 0) return levels.map(([name]) => name);
-	const held = canonicalJson(where);
-	return levels.filter(([, condition]) => canonicalJson(condition) === held).map(([name]) => name);
-}
-function levelReachOf(policy, keys) {
-	const reach = /* @__PURE__ */ new Map();
-	for (const [entry, grantKey] of keys) {
-		const { item } = entry;
-		const { grant } = item;
-		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || grant.level !== void 0) continue;
-		const levels = policyLevels(policy, grant.permission.resource);
-		if (levels.length > 0) {
-			const set = reach.get(grantKey) ?? /* @__PURE__ */ new Set();
-			for (const name of reachedLevels(grant.where, levels)) set.add(name);
-			reach.set(grantKey, set);
-		}
-	}
-	const out = [];
-	for (const grantKey of new Set(keys.values())) {
-		const at = grantKey.lastIndexOf("@");
-		const base = at === -1 ? grantKey : grantKey.slice(0, at);
-		const level = at === -1 ? void 0 : grantKey.slice(at + 1);
-		for (const name of reach.get(base) ?? []) if (level === void 0 || level === name) out.push([grantKey, name]);
-	}
-	return out.toSorted(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
-}
-/** The SQL command `action` compiles to: `rls.actions` first, then the six default verbs. */
-function commandFor(action, actions) {
-	if (actions !== void 0 && Object.hasOwn(actions, action)) {
-		const configured = actions[action];
-		return configured === "none" ? void 0 : configured;
-	}
-	switch (action) {
-		case "read":
-		case "list":
-		case "get": return "select";
-		case "create": return "insert";
-		case "update": return "update";
-		case "delete": return "delete";
-		default: return;
-	}
-}
-function tableFor(resource, tables) {
-	return tables?.[resource] ?? resource;
-}
-function ancestorsOf(policy, name) {
-	const names = [];
-	let current = policy.resources.get(name);
-	while (current?.parent !== void 0 && !names.includes(current.parent.resource)) {
-		names.push(current.parent.resource);
-		current = policy.resources.get(current.parent.resource);
-	}
-	return names;
-}
-function membershipField(policy, resource, holder) {
-	if (resource === void 0) return;
-	if (resource.name === holder) return resource.id ?? "id";
-	let current = resource;
-	const seen = /* @__PURE__ */ new Set();
-	while (current?.parent !== void 0 && !seen.has(current.name)) {
-		seen.add(current.name);
-		if (current.parent.resource === holder) return current.parent.field;
-		current = policy.resources.get(current.parent.resource);
-	}
-}
-function resourceCondition(item, policy, ctx) {
-	if (item.access.kind !== "resource") throw new Error("PermDock CLI: resourceCondition needs a resource role");
-	const { role, resource: roleResource } = item.access;
-	const target = policy.resources.get(item.grant.permission.resource);
-	const holders = [roleResource, ...ancestorsOf(policy, roleResource)];
-	const hops = [];
-	for (const [index, holder] of holders.entries()) {
-		const field = membershipField(policy, target, holder);
-		if (field === void 0) continue;
-		if (index > 0 && ctx.memberships?.resource?.[holder] === void 0) continue;
-		hops.push({
-			op: "memberOf",
-			scope: "resource",
-			field,
-			roles: [role],
-			resource: holder
-		});
-	}
-	return sole(hops) ?? {
-		op: "or",
-		conditions: hops
-	};
-}
-/**
-* The access a link capability has to a resource-scoped grant, over the same
-* holders as `resourceCondition`. It reads the claim, so ancestor hops need
-* no memberships table. `undefined` when no holder is on the row's chain.
-*/
-function capabilityAccess(item, policy, ctx) {
-	if (item.access.kind !== "resource") return;
-	const { role, resource: roleResource } = item.access;
-	const kinds = ctx.ownership?.kinds[role];
-	if (kinds !== void 0 && !kinds.includes("link")) return;
-	const target = policy.resources.get(item.grant.permission.resource);
-	const hops = [];
-	for (const holder of [roleResource, ...ancestorsOf(policy, roleResource)]) {
-		const field = membershipField(policy, target, holder);
-		if (field !== void 0) hops.push(capabilityAccessSql(ctx, field, holder, role, item.grant.permission.key));
-	}
-	if (hops.length === 0) return;
-	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
-}
-function prepare(item, tables, warnings, skipClosures, actions, rowActions = false) {
-	const { grant, label } = item;
-	if (grant.breakGlass !== void 0) {
-		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
-		return;
-	}
-	if (grant.closure !== void 0 || grant.portable === false) {
-		if (skipClosures) {
-			warnings.push(`skipped non-portable grant ${label}/${grant.permission.key}`);
-			return;
-		}
-		throw new Error(`PermDock CLI: closure grant ${label}/${grant.permission.key} is not portable; rewrite it or pass --skip-closures`);
-	}
-	const context = [.../* @__PURE__ */ new Set([...contextRefs(item.where), ...contextRefs(grant.check)])];
-	if (context.length > 0) {
-		if (skipClosures) {
-			warnings.push(`skipped grant ${label}/${grant.permission.key}: it reads ${context.join(", ")}, which is not in the token`);
-			return;
-		}
-		throw new Error(`PermDock CLI: grant ${label}/${grant.permission.key} reads ${context.join(", ")}; request context is not in the token, so RLS cannot compile it. Move the value to a server-set claim (principal.claims.*) or pass --skip-closures (permdock doctor PD027)`);
-	}
-	if (requiresApproval(grant.approval)) {
-		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
-		return;
-	}
-	const command = commandFor(grant.permission.action, actions);
-	const table = tableFor(grant.permission.resource, tables);
-	if (command === void 0) {
-		if (item.access.kind !== "role" && rowActions) {
-			warnings.push(`no policy for ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions); only permitted_<resource>_rows answers it`);
-			return {
-				item,
-				command: "none",
-				table,
-				...item.where === void 0 ? {} : { using: item.where }
-			};
-		}
-		if (item.access.kind !== "role") {
-			warnings.push(`skipped ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions) and only role grants are seeded`);
-			return;
-		}
-		if (grant.validity !== void 0 && grant.effect === "allow") {
-			warnings.push(`skipped ${label}/${grant.permission.key}: a role_permissions row cannot carry validFrom / validUntil, so a time-bounded grant on an action with no SQL command is not seeded`);
-			return;
-		}
-		warnings.push(`no policy for ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions); seeded for permdock_has and permitted_<scope>_ids`);
-		return {
-			item,
-			command: "none",
-			table,
-			...item.where === void 0 ? {} : { using: item.where },
-			...grant.check === void 0 ? {} : { check: grant.check }
-		};
-	}
-	const using = command === "insert" ? void 0 : item.where;
-	const check = command === "insert" ? grant.check ?? item.where : command === "update" ? grant.check ?? item.where : void 0;
-	return {
-		item,
-		command,
-		table,
-		...using === void 0 ? {} : { using },
-		...check === void 0 ? {} : { check }
-	};
-}
-function signature(entry, byFields) {
-	const base = [
-		entry.item.grant.effect,
-		entry.using ?? null,
-		entry.check ?? null
-	];
-	return JSON.stringify(byFields ? [...base, entry.item.grant.fields ?? null] : base);
-}
-/**
-* Grant keys per permission: the key is the permission, split into
-* `permission#n` when role grants carry different portable conditions (or
-* effects), one key per condition group; a group whose grants set `group`
-* is `permission#<group>` instead. With field views, grants that differ
-* only in `fields` get their own keys too, so a view can tell them apart.
-*/
-function assignKeys(entries, byFields) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		if (entry.item.access.kind !== "role") continue;
-		const key = entry.item.grant.permission.key;
-		const byCondition = groups.get(key) ?? /* @__PURE__ */ new Map();
-		const sig = signature(entry, byFields);
-		byCondition.set(sig, [...byCondition.get(sig) ?? [], entry]);
-		groups.set(key, byCondition);
-	}
-	const keys = /* @__PURE__ */ new Map();
-	for (const [permission, byCondition] of groups) {
-		const lists = [...byCondition.values()];
-		const named = /* @__PURE__ */ new Set();
-		for (const [index, list] of lists.entries()) {
-			const group = groupOf(permission, list);
-			if (group !== void 0 && named.has(group)) throw new Error(`PermDock CLI: grants of ${permission} with different conditions share group '${group}'; a group names one condition`);
-			if (group !== void 0) named.add(group);
-			const grantKey = group !== void 0 ? `${permission}#${group}` : lists.length === 1 ? permission : `${permission}#${index + 1}`;
-			for (const entry of list) keys.set(entry, grantKey);
-		}
-	}
-	return keys;
-}
-function groupOf(permission, list) {
-	const names = [...new Set(list.flatMap((entry) => entry.item.grant.group === void 0 ? [] : [entry.item.grant.group]))].toSorted();
-	if (names.length > 1) throw new Error(`PermDock CLI: grants of ${permission} with one condition name the groups ${names.join(", ")}; give them one group`);
-	return names[0];
-}
-/**
-* One entry per level for every allow of an assignable role on a resource
-* with levels, keyed `<grant key>@<level>`. Only `permdock_custom_keys`
-* hands these keys out, to a custom role whose stored allow names the level.
-*/
-function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
-	const custom = ctx.customRoles;
-	if (custom?.levels !== true) return [];
-	const assignable = new Set(custom.assignable);
-	const out = [];
-	for (const [entry, grantKey] of Array.from(keys)) {
-		const { item } = entry;
-		const { grant } = item;
-		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || !assignable.has(item.access.role)) continue;
-		if (grant.permission.key.includes("@")) throw new Error(`PermDock CLI: permission key '${grant.permission.key}' holds '@', which separates a level in custom-role grant keys`);
-		for (const [level, condition] of policyLevels(policy, grant.permission.resource)) {
-			const where = andWhere(item.where, condition);
-			const prepared = prepare({
-				...item,
-				grant: leveled(grant, level, condition),
-				...where === void 0 ? {} : { where }
-			}, tables, warnings, skipClosures, ctx.actions);
-			if (prepared !== void 0) {
-				keys.set(prepared, `${grantKey}@${level}`);
-				out.push(prepared);
-			}
-		}
-	}
-	return out;
-}
-function compileOptional(condition, ctx) {
-	return condition === void 0 ? void 0 : compileConditionSql(condition, ctx);
-}
-function noteConditions(entry, warnings) {
-	const { label, grant } = entry.item;
-	const names = [...sqlFunctionNames(entry.using), ...sqlFunctionNames(entry.check)];
-	if (names.length > 0) warnings.push(`sqlFunction ${[...new Set(names)].join(", ")} on ${label}/${grant.permission.key} is portable via twin`);
-	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
-}
-/**
-* Compiles every grant (role and top-level) to branches whose role check is
-* a helper call keyed by grant key. Nothing in a branch is per-row except the
-* portable row condition and resource-membership joins.
-*/
-/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
-const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
-function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
-	const items = collectGrants(policy);
-	const entries = items.flatMap((item) => {
-		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions, rowActions);
-		return entry === void 0 ? [] : [entry];
-	});
-	const keys = assignKeys(entries, ctx.fields === "views");
-	entries.push(...levelEntries(policy, ctx, keys, tables, warnings, skipClosures));
-	const conditionedKeys = /* @__PURE__ */ new Set();
-	for (const [entry, grantKey] of keys) if (entry.using !== void 0 || entry.check !== void 0 || entry.item.grant.validity !== void 0 || entry.item.grant.requires !== void 0) conditionedKeys.add(grantKey);
-	const rows = /* @__PURE__ */ new Map();
-	for (const item of items) {
-		const holder = item.grant.breakGlass === void 0 ? void 0 : breakGlassHolder(item);
-		if (holder !== void 0) {
-			const row = {
-				role: holder.role,
-				permission: item.grant.permission.key,
-				grantKey: breakGlassKey(item.grant.permission.key),
-				scope: holder.scope,
-				effect: item.grant.effect
-			};
-			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
-		}
-	}
-	const branches = [];
-	const actionBranches = [];
-	const rowColumns = /* @__PURE__ */ new Map();
-	const filters = (resource, table, column) => {
-		rowColumns.set(`${table}\u0000${column}`, {
-			resource,
-			table,
-			column
-		});
-	};
-	const typed = /* @__PURE__ */ new Map();
-	const contextFor = (name) => {
-		const known = typed.get(name);
-		if (known !== void 0) return known;
-		const node = policy.resources.get(name);
-		const schema = node === void 0 ? void 0 : jsonSchemaOf(node);
-		const next = {
-			...ctx,
-			columnTypes: columnTypesOf(schema),
-			arrayColumns: arrayColumnsOf(schema)
-		};
-		typed.set(name, next);
-		return next;
-	};
-	for (const entry of entries) {
-		const { item, table } = entry;
-		const { grant, access, label } = item;
-		if (entry.command === "none") {
-			const grantKey = keys.get(entry);
-			if (access.kind === "role" && grantKey !== void 0) {
-				const row = {
-					role: access.role,
-					permission: grant.permission.key,
-					grantKey,
-					scope: access.scope,
-					effect: grant.effect
-				};
-				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
-			}
-			if (!rowActions) continue;
-		}
-		const actionOnly = entry.command === "none";
-		const command = actionOnly ? "select" : entry.command;
-		const target = actionOnly ? actionBranches : branches;
-		const rowCtx = {
-			...contextFor(item.grant.permission.resource),
-			permission: grant.permission.key
-		};
-		noteConditions(entry, warnings);
-		for (const field of [...indexedFields(entry.using), ...indexedFields(entry.check)]) filters(grant.permission.resource, table, field);
-		const grantKey = keys.get(entry);
-		let accessExpr;
-		if (access.kind === "role" && grantKey !== void 0) {
-			const column = access.scope === "global" ? void 0 : scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
-			accessExpr = accessSql(ctx, access.scope, grantKey, column);
-			if (column !== void 0) filters(grant.permission.resource, table, column);
-			const row = {
-				role: access.role,
-				permission: grant.permission.key,
-				grantKey,
-				scope: access.scope,
-				effect: grant.effect
-			};
-			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
-		}
-		const linkOnly = access.kind === "resource" && ctx.capabilities === true && ctx.memberships?.resource?.[access.resource] === void 0;
-		if (access.kind === "actor") accessExpr = `${subjectClaimSql(ctx, "client_id")} is not null or ${subjectClaimJsonSql(ctx, "act")} is not null`;
-		if (access.kind === "resource" && !linkOnly) accessExpr = compileConditionSql(resourceCondition(item, policy, ctx), {
-			...ctx,
-			permission: grant.permission.key
-		});
-		if (linkOnly) warnings.push(`no ${access.resource} memberships table: only link capabilities reach ${label}/${grant.permission.key}`);
-		const validity = validitySql(grant.validity);
-		accessExpr = andSql(accessExpr, validity);
-		for (const key of grant.requires ?? []) accessExpr = andSql(accessExpr, requiresSql(ctx, key, policy.resources.get(grant.permission.resource)));
-		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
-		if (ctx.apiKeys !== void 0 && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
-			const calls = (requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []]).map((key) => `(select ${apiKeyAllowsCall(ctx, quoteLiteral(key))})`);
-			accessExpr = andSql(accessExpr, calls.length === 1 ? calls[0] ?? "" : `(${calls.join(" and ")})`);
-		}
-		const using = compileOptional(entry.using, rowCtx);
-		const check = compileOptional(entry.check, rowCtx);
-		const fields = grant.fields === void 0 ? {} : { fields: grant.fields };
-		if (!linkOnly) target.push({
-			table,
-			command,
-			effect: grant.effect,
-			roles: access.kind === "anyone" ? ["anon", "authenticated"] : ["authenticated"],
-			label,
-			resource: grant.permission.resource,
-			permissionKey: grant.permission.key,
-			...fields,
-			...grantKey === void 0 ? {} : { grantKey },
-			...accessExpr === void 0 ? {} : { access: accessExpr },
-			...using === void 0 ? {} : { using },
-			...check === void 0 ? {} : { check }
-		});
-		const linked = ctx.capabilities === true ? capabilityAccess(item, policy, ctx) : void 0;
-		if (linked !== void 0) target.push({
-			table,
-			command,
-			effect: grant.effect,
-			roles: ["anon"],
-			label,
-			resource: grant.permission.resource,
-			permissionKey: grant.permission.key,
-			...fields,
-			access: andSql(linked, validity) ?? linked,
-			...using === void 0 ? {} : { using },
-			...check === void 0 ? {} : { check }
-		});
-	}
-	return {
-		branches: ensureSelectCoverage(branches, warnings),
-		actionBranches,
-		rolePermissions: withAliasRows(policy, [...rows.values()]),
-		conditionedKeys,
-		rowColumns: [...rowColumns.values()],
-		levelReach: ctx.customRoles?.levels === true ? levelReachOf(policy, keys) : []
-	};
-}
-/**
-* Each row again under every key its permission was renamed from, so SQL that
-* still calls `permdock_has('<old key>')` keeps the access the current key
-* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
-* copied.
-*/
-function withAliasRows(policy, rows) {
-	const former = new Map(listPermissions(policy.permissions).map((leaf) => [leaf.key, formerKeys(leaf)]));
-	const out = [...rows];
-	for (const row of rows) {
-		const suffix = row.grantKey.slice(row.permission.length);
-		if (!row.grantKey.startsWith(row.permission) || suffix !== "" && (!/^#[a-z0-9][a-z0-9_-]*$/u.test(suffix) || suffix === "#break-glass")) continue;
-		for (const old of former.get(row.permission) ?? []) out.push({
-			...row,
-			permission: old,
-			grantKey: `${old}${suffix}`
-		});
-	}
-	return out;
-}
-/**
-* Postgres needs SELECT access to find rows for UPDATE / DELETE and for
-* RETURNING, so a table with only update or delete grants gets matching
-* SELECT branches.
-*/
-function ensureSelectCoverage(branches, warnings) {
-	const extra = [];
-	const readable = new Set(branches.filter((item) => item.command === "select" && item.effect === "allow").map((item) => item.table));
-	const covered = /* @__PURE__ */ new Set();
-	for (const item of branches) {
-		if (item.effect !== "allow" || item.command !== "update" && item.command !== "delete" || readable.has(item.table)) continue;
-		const { check: _check, ...rest } = item;
-		extra.push({
-			...rest,
-			command: "select",
-			coverage: true
-		});
-		if (!covered.has(item.table)) {
-			covered.add(item.table);
-			warnings.push(`added SELECT coverage for ${item.table} (${item.permissionKey})`);
-		}
-	}
-	return [...branches, ...extra];
-}
-/** True when `sql` is one parenthesised expression, so AND / OR need not wrap it again. */
-function isWrapped(sql) {
-	if (!sql.startsWith("(") || !sql.endsWith(")")) return false;
-	let depth = 0;
-	let quoted = false;
-	for (let index = 0; index < sql.length; index += 1) {
-		const ch = sql[index];
-		if (ch === "'") quoted = !quoted;
-		else if (!quoted && ch === "(") depth += 1;
-		else if (!quoted && ch === ")") {
-			depth -= 1;
-			if (depth === 0 && index < sql.length - 1) return false;
-		}
-	}
-	return depth === 0;
-}
-function wrapSql(sql) {
-	return isWrapped(sql) ? sql : `(${sql})`;
-}
-/**
-* The grant's `validFrom` / `validUntil` as a clock check: `from` inclusive,
-* `until` exclusive, matching the in-process evaluator.
-*/
-function validitySql(validity) {
-	if (validity === void 0) return;
-	return andSql(validity.from === void 0 ? void 0 : `now() >= to_timestamp(${validity.from})`, validity.until === void 0 ? void 0 : `now() < to_timestamp(${validity.until})`);
-}
-function andSql(...parts) {
-	const present = parts.filter((part) => part !== void 0 && part !== "true");
-	if (present.length === 0) return;
-	return present.length === 1 ? present[0] : present.map(wrapSql).join(" and ");
-}
-/** `USING` and `WITH CHECK` for a branch: its access check ANDed with its row conditions. */
-function branchClauses(branch) {
-	const using = branch.command === "insert" ? void 0 : andSql(branch.access, branch.using) ?? "true";
-	const check = branch.command === "insert" || branch.command === "update" ? andSql(branch.access, branch.check) ?? "true" : void 0;
-	return {
-		...using === void 0 ? {} : { using },
-		...check === void 0 ? {} : { check }
-	};
-}
-//#endregion
-//#region src/cli/rls-policies.ts
-/** Each database role gets its own policy, so no role sees two permissive policies for one command. */
-const AUDIENCES = ["authenticated", "anon"];
-const DEFAULT_POLICY_NAME = "{table}_{op}";
-const DEFAULT_PER_ROLE_NAME = "{role}_{permission}";
-const PLACEHOLDER = /\{(table|op|role|permission)\}/gu;
-function sanitize(name) {
-	return name.replaceAll(/[^A-Za-z0-9_]/g, "_");
-}
-function render(template, values) {
-	return sanitize(template.replaceAll(PLACEHOLDER, (_match, key) => values[key]));
-}
-/** Rejects a template that cannot name every policy of the chosen shape uniquely. */
-function assertPolicyName(template, perRole) {
-	if (!perRole && /\{(role|permission)\}/u.test(template)) throw new Error("PermDock CLI: --policy-name {role} and {permission} need --policy-per-role; a collapsed policy covers several roles");
-	if (!perRole && !(template.includes("{table}") && template.includes("{op}"))) throw new Error("PermDock CLI: --policy-name needs {table} and {op} so each table and command gets its own policy");
-}
-function orSql(parts) {
-	const distinct = [...new Set(parts)];
-	if (distinct.includes("true")) return "true";
-	return sole(distinct) ?? distinct.map(wrapSql).join(" or ");
-}
-function negate(sql) {
-	return sql === void 0 ? void 0 : `(${sql}) is not true`;
-}
-function policyOf(name, branch, using, check) {
-	const deny = branch.effect === "deny";
-	const policy = {
-		name,
-		table: branch.table,
-		command: branch.command,
-		effect: branch.effect,
-		roles: branch.roles
-	};
-	const finalUsing = deny ? negate(using) : using;
-	const finalCheck = deny ? negate(check) : check;
-	if (finalUsing !== void 0) policy.using = finalUsing;
-	if (finalCheck !== void 0) policy.check = finalCheck;
-	return policy;
-}
-function uniqueName(names, name) {
-	const seen = names.get(name) ?? 0;
-	names.set(name, seen + 1);
-	return seen === 0 ? name : `${name}_${seen + 1}`;
-}
-function perRolePolicies(branches, template) {
-	const names = /* @__PURE__ */ new Map();
-	return branches.map((branch) => {
-		const clauses = branchClauses(branch);
-		const deny = branch.effect === "deny";
-		const base = render(template, {
-			table: branch.table,
-			op: branch.command,
-			role: branch.label,
-			permission: branch.permissionKey
-		});
-		const name = `${deny ? "deny_" : ""}${base}${branch.coverage === true ? "_select_coverage" : ""}`;
-		return policyOf(uniqueName(names, name), branch, clauses.using, clauses.check);
-	});
-}
-/**
-* Branches of one grant-key group share their row condition, so the group
-* becomes one OR branch whose access ORs the helper calls of each scope.
-*/
-function mergeGroups(branches) {
-	const merged = [];
-	const byKey = /* @__PURE__ */ new Map();
-	for (const branch of branches) {
-		const id = branch.grantKey === void 0 ? void 0 : `${branch.table}\u0000${branch.command}\u0000${branch.grantKey}\u0000${branch.coverage === true}`;
-		const entry = id === void 0 ? void 0 : byKey.get(id);
-		if (entry === void 0) {
-			const created = {
-				branch,
-				accesses: branch.access === void 0 ? [] : [branch.access]
-			};
-			if (id !== void 0) byKey.set(id, created);
-			merged.push(created);
-			continue;
-		}
-		if (branch.access !== void 0 && !entry.accesses.includes(branch.access)) entry.accesses.push(branch.access);
-	}
-	return merged.map(({ branch, accesses }) => accesses.length <= 1 ? branch : withAccess(branch, orSql(accesses)));
-}
-function withAccess(branch, access) {
-	return {
-		...branch,
-		access
-	};
-}
-function collapsedPolicies(branches, template) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const branch of mergeGroups(branches)) {
-		const id = `${branch.table}\u0000${branch.command}\u0000${branch.effect}`;
-		groups.set(id, [...groups.get(id) ?? [], branch]);
-	}
-	const names = /* @__PURE__ */ new Map();
-	return [...groups.values()].flatMap((group) => AUDIENCES.flatMap((audience) => {
-		const members = group.filter((branch) => branch.roles.includes(audience));
-		const [first] = members;
-		if (first === void 0) return [];
-		const deny = first.effect === "deny";
-		const clauses = members.map(branchClauses);
-		const usings = clauses.flatMap((item) => item.using === void 0 ? [] : [item.using]);
-		const checks = clauses.flatMap((item) => item.check === void 0 ? [] : [item.check]);
-		const base = render(template, {
-			table: first.table,
-			op: first.command,
-			role: first.label,
-			permission: first.permissionKey
-		});
-		return [policyOf(uniqueName(names, `${deny ? "deny_" : ""}${base}${audience === "anon" ? "_anon" : ""}`), {
-			...first,
-			roles: [audience]
-		}, usings.length === 0 ? void 0 : orSql(usings), checks.length === 0 ? void 0 : orSql(checks))];
-	}));
-}
-/**
-* Assembles policies. The default is one PERMISSIVE policy per table,
-* command and database role (Splinter `multiple_permissive_policies` stays
-* quiet), with denies in one RESTRICTIVE policy per table, command and role.
-*/
-function assemblePolicies(branches, shape) {
-	const template = shape.name ?? (shape.perRole ? DEFAULT_PER_ROLE_NAME : DEFAULT_POLICY_NAME);
-	assertPolicyName(template, shape.perRole);
-	return shape.perRole ? perRolePolicies(branches, template) : collapsedPolicies(branches, template);
-}
-const DEFAULT_READ_ONLY_ACTORS = ["support", "impersonation"];
-const ACTOR_KIND = /^[a-z][a-z0-9_-]*$/u;
-/** The actor kinds `rls.readOnlyActors` names, or `undefined` when it is off. */
-function readOnlyActorKinds(setting) {
-	if (setting === void 0 || setting === false) return;
-	const kinds = setting === true ? DEFAULT_READ_ONLY_ACTORS : setting;
-	if (kinds.length === 0 || kinds.some((kind) => !ACTOR_KIND.test(kind))) throw new Error("PermDock CLI: rls.readOnlyActors must be true or a non-empty list of actor kinds such as 'support'");
-	return [...new Set(kinds)];
-}
-/**
-* One restrictive policy per table and write command the allow policies
-* grant to `authenticated`: the write passes unless the token's `act` claim
-* (`act`, as SQL `jsonb`) is a session of one of `kinds` that is not
-* `read_only: false`. Reads are never touched.
-*/
-function readOnlyActorPolicies(policies, act, kinds) {
-	const list = `array[${kinds.map((kind) => `'${kind}'`).join(", ")}]::text[]`;
-	const passes = `not coalesce(${kinds.includes("support") ? `(${act} ->> 'kind') = any(${list}) or ((${act} ->> 'kind') is null and ${act} ? 'session_id')` : `(${act} ->> 'kind') = any(${list})`}, false) or coalesce((${act} ->> 'read_only') = 'false', false)`;
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const policy of policies) {
-		const key = `${policy.table}\u0000${policy.command}`;
-		if (policy.effect !== "allow" || policy.command === "select" || !policy.roles.includes("authenticated") || seen.has(key)) continue;
-		seen.add(key);
-		out.push({
-			name: sanitize(`${policy.table}_${policy.command}_read_only_actors`),
-			table: policy.table,
-			command: policy.command,
-			effect: "deny",
-			roles: ["authenticated"],
-			...policy.command === "insert" ? {} : { using: passes },
-			...policy.command === "delete" ? {} : { check: passes }
-		});
-	}
-	return out;
-}
-//#endregion
-//#region src/cli/rls-fields.ts
-/** Names of the field-view objects. Part of the SQL contract. */
-const FIELD_VIEWS = {
-	/** `<table>_visible`: the `security_invoker` view clients read. */
-	view: "_visible",
-	/** `<table>_visible_fields`: the owner-rights companion `--revoke-columns` adds. */
-	companion: "_visible_fields",
-	/** The companion's row-key column, joined to the base table's key. */
-	key: "permdock_key",
-	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
-	comment: "permdock:field-companion"
-};
-function covers(branch, column) {
-	return branch.fields === void 0 || branch.fields.includes(column);
-}
-/**
-* A read grant that only shapes columns: a field-limited deny (it never
-* denies the row) or an allow with an empty list (it grants nothing). With
-* field views it leaves the row policy and lives in the view's masks.
-*/
-function fieldOnly(branch) {
-	if (branch.command !== "select" || branch.fields === void 0) return false;
-	return branch.effect === "deny" || branch.fields.length === 0;
-}
-/** Branches the row policies keep when field views compile. */
-function rowBranches(branches) {
-	return branches.filter((branch) => !fieldOnly(branch));
-}
-/**
-* Whether the reader is signed in, for branches with no helper call: a grant
-* to any signed-in user relies on `to authenticated` in its policy, which a
-* view does not have.
-*/
-function audience(ctx, branch) {
-	if (branch.access !== void 0 || branch.roles.length !== 1) return;
-	if (branch.roles[0] === "authenticated") return signedIn(ctx);
-	return branch.roles[0] === "anon" ? `not (${signedIn(ctx)})` : void 0;
-}
-function clause(ctx, branch) {
-	return andSql(audience(ctx, branch), branchClauses(branch).using) ?? "true";
-}
-/**
-* `can(permission, row, { field })` in SQL: an allow that covers the column
-* holds for the row and no covering deny does. Every access term is the
-* uncorrelated helper call the row policy uses, so it runs once per statement.
-*/
-function maskSql(ctx, allows, denies, column) {
-	const allowed = allows.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
-	if (allowed.length === 0) return "false";
-	const denied = denies.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
-	const allow = orSql(allowed);
-	if (denied.length === 0) return allow;
-	const deny = orSql(denied);
-	return allow === "true" ? `not ${wrapSql(deny)}` : `${wrapSql(allow)} and not ${wrapSql(deny)}`;
-}
-function schemaColumns(policy, resource) {
-	const node = policy.resources.get(resource);
-	const schema = node === void 0 ? null : jsonSchemaOf(node);
-	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
-	return properties !== null && typeof properties === "object" ? Object.keys(properties) : void 0;
-}
-function viewName(table, suffix) {
-	return `${table}${suffix}`;
-}
-/**
-* `<helper schema>.<table>_visible_fields`: outside the Data API's schemas,
-* so its owner rights reach clients only through the `_visible` join.
-*/
-function companionName(ctx, table) {
-	const base = table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
-	return `${helperSchema(ctx)}.${viewName(base, FIELD_VIEWS.companion)}`;
-}
-/**
-* One view per table whose read grants limit fields. A column is restricted
-* when some read allow lists fields without it or some read deny lists it;
-* every other column, and the row key, passes through unchanged.
-*/
-function fieldViews(policy, ctx, branches, options, warnings) {
-	const byTable = /* @__PURE__ */ new Map();
-	for (const branch of branches) {
-		if (branch.command !== "select" || branch.coverage === true) continue;
-		byTable.set(branch.table, [...byTable.get(branch.table) ?? [], branch]);
-	}
-	const views = [];
-	for (const [table, reads] of byTable) {
-		const allows = reads.filter((branch) => branch.effect === "allow" && branch.fields?.length !== 0);
-		const denies = reads.filter((branch) => branch.effect === "deny");
-		const limited = reads.some((branch) => branch.fields !== void 0);
-		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
-		if (!limited || allows.length === 0 || resource === void 0) continue;
-		const names = schemaColumns(policy, resource);
-		if (names === void 0) throw new Error(`PermDock CLI: --fields views needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
-		const key = policy.resources.get(resource)?.id ?? "id";
-		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
-		const columns = names.map((name) => {
-			quoteIdent(name);
-			return restricted(name) ? {
-				name,
-				mask: maskSql(ctx, allows, denies, name)
-			} : { name };
-		});
-		if (columns.every((column) => column.mask === void 0)) continue;
-		const view = viewName(table, FIELD_VIEWS.view);
-		if (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(key))) warnings.push(`field view ${view}: the key ${key} passes through, although a read grant on ${resource} omits it`);
-		const hidden = columns.filter((column) => column.mask !== void 0).map((column) => column.name);
-		if (options.helpersOnly === true) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; revoke select on those columns from client roles in your own grants, or read them through a function`);
-		else if (!options.revokeColumns) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; add --revoke-columns so clients read through the view`);
-		views.push({
-			resource,
-			table,
-			view,
-			key,
-			columns,
-			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
-			...options.revokeColumns ? { companion: companionName(ctx, table) } : {}
-		});
-	}
-	return views;
-}
-/** Columns of `view`'s table that `anon` and `authenticated` keep on the base table with `--revoke-columns`. */
-function readableColumns(view) {
-	return view.columns.filter((column) => column.mask === void 0).map((column) => column.name);
-}
-function restrictedColumns(view) {
-	return view.columns.filter((column) => column.mask !== void 0).map((column) => column.name);
-}
-function columnList(names) {
-	return names.map(quoteIdent).join(", ");
-}
-function selectList(lines) {
-	return lines.map((line) => `  ${line}`).join(",\n");
-}
-function grantView(name, roles) {
-	return [`revoke all on table ${quoteTable(qualifiedTable(name))} from anon, authenticated, public;`, `grant select on table ${quoteTable(qualifiedTable(name))} to ${roles.join(", ")};`].join("\n");
-}
-function inlineViewSql(view) {
-	const targets = view.columns.map((column) => column.mask === void 0 ? quoteIdent(column.name) : `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`);
-	return `create or replace view ${quoteTable(qualifiedTable(view.view))} with (security_invoker = true) as
-select
-${selectList(targets)}
-from ${quoteTable(qualifiedTable(view.table))};`;
-}
-function companionSql(view, companion) {
-	const restricted = view.columns.filter((column) => column.mask !== void 0);
-	const targets = [`${quoteIdent(view.key)} as ${quoteIdent(FIELD_VIEWS.key)}`, ...restricted.map((column) => `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`)];
-	const any = orSql(restricted.map((column) => column.mask ?? "false"));
-	const name = companion.slice(0, companion.indexOf("."));
-	const schema = quoteIdent(name);
-	return `${name === "public" ? "" : `create schema if not exists ${schema};
-revoke all on schema ${schema} from public;
-grant usage on schema ${schema} to ${view.roles.join(", ")};
-`}create or replace view ${quoteTable(qualifiedTable(companion))} with (security_barrier = true) as
-select
-${selectList(targets)}
-from ${quoteTable(qualifiedTable(view.table))}
-where ${any};
-comment on view ${quoteTable(qualifiedTable(companion))} is ${quoteLiteral(`${FIELD_VIEWS.comment} ${view.view}`)};`;
-}
-function joinedViewSql(view, companion) {
-	const targets = view.columns.map((column) => column.mask === void 0 ? `t.${quoteIdent(column.name)}` : `f.${quoteIdent(column.name)}`);
-	return `create or replace view ${quoteTable(qualifiedTable(view.view))} with (security_invoker = true) as
-select
-${selectList(targets)}
-from ${quoteTable(qualifiedTable(view.table))} t
-left join ${quoteTable(qualifiedTable(companion))} f on f.${quoteIdent(FIELD_VIEWS.key)} = t.${quoteIdent(view.key)};`;
-}
-/** `select` on only the unrestricted columns (and the key) of the base table, for `--revoke-columns`. */
-function columnGrantSql(view, role) {
-	return `grant select (${columnList(readableColumns(view))}) on table ${quoteTable(qualifiedTable(view.table))} to ${role};`;
-}
-function columnRevokeSql(view) {
-	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteTable(qualifiedTable(view.table))} from anon, authenticated;`;
-}
-/**
-* The view SQL: the `security_invoker` view, and with `--revoke-columns` the
-* owner-rights companion it joins for the restricted columns. The companion
-* masks every column with the full field decision and keeps only rows where
-* one is readable, so reading it directly shows nothing `pick` would not.
-*/
-function fieldViewsSql(views) {
-	return views.map((view) => {
-		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
-		if (view.companion === void 0) return [
-			head,
-			inlineViewSql(view),
-			grantView(view.view, view.roles)
-		].join("\n");
-		return [
-			head,
-			`-- ${view.companion} reads ${view.table} as its owner; ${view.view} reads the rows as the caller and joins it`,
-			companionSql(view, view.companion),
-			grantView(view.companion, view.roles),
-			joinedViewSql(view, view.companion),
-			grantView(view.view, view.roles)
-		].join("\n");
-	}).join("\n\n");
-}
-//#endregion
-export { helpersSql as A, breakGlassHolder as B, readTableIndexFacts as C, claimKeptLines as D, accessSql as E, seedSql as F, API_KEY_ALLOWS as G, collectGrants as H, sourceFilters as I, apiKeyFields as K, sourcesKeep as L, membershipRows as M, membershipTable as N, disabledColumn as O, roleRows as P, hasCustomRoleChecksFor as R, pruneIndexTargets as S, connectPgPool as T, roleNames as U, breakGlassKey as V, contextRefs as W, permissionKeysForHelper as _, fieldViewsSql as a, indexTargets as b, assemblePolicies as c, readOnlyActorPolicies as d, branchClauses as f, permissionHelpersSql as g, tableFor as h, fieldViews as i, memberColumn as j, globalRoleRows as k, orSql as l, compileGrants as m, columnGrantSql as n, rowBranches as o, commandFor as p, apiKeysPlan as q, columnRevokeSql as r, viewName as s, FIELD_VIEWS as t, readOnlyActorKinds as u, permittedByPermissionHelper as v, connectPg as w, indexesSql as x, COLUMNS_SQL as y, globalRoleSource as z };
+export { sqlFunctionNames as A, memberIdsHelper as B, apiKeysPlan as C, roleNames as D, collectGrants as E, hasMemberFor as F, scopeSources as G, permittedForHelper as H, linkHelper as I, activeUserSql as J, scopeTable as K, memberForHelper as L, graphHelper as M, graphSqlName as N, compileConditionSql as O, graphSqlText as P, memberForSources as R, apiKeyFields as S, breakGlassKey as T, permittedIdsHelper as U, memberRoleOf as V, restrictedHelper as W, connectPgPool as X, checkSuspension as Y, pgConnector as Z, globalRoleSource as _, accessSql as a, API_KEY_ALLOWS as b, capabilityAccessSql as c, memberColumn as d, sourceFilters as f, roleRows as g, membershipRows as h, requiresSql as i, CLOSURE as j, contextRefs as k, claimKeptLines as l, globalRoleRows as m, permissionKeysForHelper as n, helpersSql as o, sourcesKeep as p, activeRowSql as q, permittedByPermissionHelper as r, seedSql as s, permissionHelpersSql as t, disabledColumn as u, currentKeyExpr as v, breakGlassHolder as w, apiKeyAllowsCall as x, hasCustomRoleChecksFor as y, memberForTable as z };