permdock 0.3.1 → 0.4.0

package/dist/fields-fwfXN01n.js

@@ -0,0 +1,1016 @@
+import { a as sole } from "./compact-CAf557ZB.js";
+import { a as hasConditionOp, c as isConditionRef } from "./refs-f3imMjNW.js";
+import { u as requiresStandIn } from "./snapshot-Dc9CHPME.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-BsblpB-z.js";
+import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
+import { p as scopeField } from "./tenancy-DshjqY0n.js";
+import { u as policyLevels } from "./hosted-CBHgkzDl.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { _ as leveled, p as andWhere } from "./permdock-L26udHSk.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DWtg0gGR.js";
+import { r as qualifySqlTable } from "./sql-t8teWOfo.js";
+import { F as quoteQualified, I as quoteTable, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, _ as subjectClaimJsonSql, j as helperSchema, s as signedIn, v as subjectClaimSql, w as arrayColumnsOf } from "./shared-1uhI-e-b.js";
+import { A as sqlFunctionNames, E as collectGrants, K as scopeTable, O as compileConditionSql, T as breakGlassKey, X as connectPgPool, a as accessSql, c as capabilityAccessSql, i as requiresSql, k as contextRefs, w as breakGlassHolder, x as apiKeyAllowsCall } from "./permission-keys-B26jeyUv.js";
+import { createHash } from "node:crypto";
+//#region src/cli/rls/indexes.ts
+/** Postgres truncates identifiers longer than this, in bytes. */
+const MAX_IDENT = 63;
+/**
+* The row fields `condition` compares with the subject, a claim or a
+* membership (`ownerId: principal.id`, `memberOf`), through `and` and `or`:
+* the selective comparisons an index serves. A comparison with a constant
+* (`status: 'sent'`) narrows rows the scope key already found, a negation
+* scans anyway, and a dotted field is a JSON path a plain index does not serve.
+*/
+function indexedFields(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "and":
+		case "or": return condition.conditions.flatMap(indexedFields);
+		case "memberOf": return plainField(condition.field);
+		case "eq":
+		case "in": return isConditionRef(condition.value) ? plainField(condition.field) : [];
+		case "not":
+		case "sqlFunction":
+		case "opaque":
+		case "related":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "notIn":
+		case "isNull":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+function plainField(field) {
+	return field.includes(".") ? [] : [field];
+}
+/**
+* Every index the generated SQL reads through: the row columns policies
+* filter on (scope keys and selective condition fields), and the membership
+* tables' user column, followed by the scope column the helpers select.
+*/
+function indexTargets(ctx, rowColumns) {
+	const targets = /* @__PURE__ */ new Map();
+	const add = (table, columns) => {
+		const target = {
+			table: qualifySqlTable(table),
+			columns
+		};
+		targets.set(`${target.table}\u0000${columns[0] ?? ""}`, target);
+	};
+	for (const { table, column } of rowColumns) add(table, [column]);
+	for (const scope of ctx.scopes) {
+		const mapped = scopeTable(ctx, scope.name);
+		if (mapped !== void 0) add(mapped.table.table, [mapped.table.user, mapped.column]);
+	}
+	for (const source of [...ctx.sources ?? [], ...ctx.memberSources ?? []]) {
+		add(source.sql.table, [source.sql.user]);
+		const users = source.sql.userThrough;
+		if (users !== void 0) add(users.table, [users.key]);
+	}
+	return [...targets.values()].toSorted((a, b) => `${a.table}.${a.columns.join(",")}` < `${b.table}.${b.columns.join(",")}` ? -1 : 1);
+}
+/** A stable index name under Postgres' identifier limit. */
+function indexName(target) {
+	const name = `permdock_${target.table.slice(target.table.lastIndexOf(".") + 1)}_${target.columns.join("_")}_idx`;
+	if (Buffer.byteLength(name) <= MAX_IDENT) return name;
+	return `permdock_${createHash("sha256").update(name).digest("hex").slice(0, 8)}_idx`;
+}
+/** `create index if not exists` for every target, one per line. */
+function indexesSql(targets) {
+	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
+}
+/** Every live column of the tables in `$1` (`schema.table`), as `target` and `name`. */
+const COLUMNS_SQL = `select n.nspname || '.' || c.relname as target, a.attname as name
+from pg_attribute a
+join pg_class c on c.oid = a.attrelid
+join pg_namespace n on n.oid = c.relnamespace
+where a.attnum > 0 and not a.attisdropped
+  and n.nspname || '.' || c.relname = any($1::text[])`;
+const INDEX_COLUMNS_SQL = `select n.nspname || '.' || c.relname as target,
+  array(
+    select a.attname::text
+    from unnest(i.indkey) with ordinality k(attnum, ord)
+    left join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum and k.attnum > 0
+    where k.ord <= i.indnkeyatts
+    order by k.ord
+  ) as columns
+from pg_index i
+join pg_class c on c.oid = i.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
+function strings(value) {
+	return Array.isArray(value) ? value.map((item) => typeof item === "string" ? item : null) : [];
+}
+/** Reads the columns and index key columns of `tables` (`schema.table`). */
+async function readTableIndexFacts(db, tables, connect = (url) => connectPgPool(url, "permdock rls generate --db")) {
+	const client = await connect(db);
+	try {
+		const [columns, indexes] = await Promise.all([client.query(COLUMNS_SQL, [[...tables]]), client.query(INDEX_COLUMNS_SQL, [[...tables]])]);
+		const byTable = {};
+		for (const row of columns.rows) (byTable[String(row["target"])] ??= []).push(String(row["name"]));
+		const keys = {};
+		for (const row of indexes.rows) {
+			const list = strings(row["columns"]);
+			const end = list.indexOf(null);
+			const lead = end === -1 ? list : list.slice(0, end);
+			if (lead.length > 0) (keys[String(row["target"])] ??= []).push(lead);
+		}
+		return {
+			columns: byTable,
+			indexes: keys
+		};
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Drops the targets a database already serves or cannot hold: a target on a
+* table or column the database lacks (with a warning), and one an existing
+* index leads with (its key columns start with the target's).
+*/
+function pruneIndexTargets(targets, facts) {
+	const warnings = [];
+	return {
+		targets: targets.filter((target) => {
+			const columns = facts.columns[target.table];
+			if (columns === void 0) {
+				warnings.push(`no index suggested on ${target.table}: the database has no such table`);
+				return false;
+			}
+			const absent = target.columns.filter((column) => !columns.includes(column));
+			if (absent.length > 0) {
+				warnings.push(`no index suggested on ${target.table} (${target.columns.join(", ")}): the table has no column ${absent.join(", ")}`);
+				return false;
+			}
+			return !(facts.indexes[target.table] ?? []).some((index) => target.columns.every((column, at) => index[at] === column));
+		}),
+		warnings
+	};
+}
+//#endregion
+//#region src/cli/sql/compile.ts
+/**
+* The levels an allow reaches: every level without a row condition, else the
+* levels whose condition equals its condition.
+*/
+function reachedLevels(where, levels) {
+	if (where === void 0) return levels.map(([name]) => name);
+	const held = canonicalJson(where);
+	return levels.filter(([, condition]) => canonicalJson(condition) === held).map(([name]) => name);
+}
+function levelReachOf(policy, keys) {
+	const reach = /* @__PURE__ */ new Map();
+	for (const [entry, grantKey] of keys) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || grant.level !== void 0) continue;
+		const levels = policyLevels(policy, grant.permission.resource);
+		if (levels.length > 0) {
+			const set = reach.get(grantKey) ?? /* @__PURE__ */ new Set();
+			for (const name of reachedLevels(grant.where, levels)) set.add(name);
+			reach.set(grantKey, set);
+		}
+	}
+	const out = [];
+	for (const grantKey of new Set(keys.values())) {
+		const at = grantKey.lastIndexOf("@");
+		const base = at === -1 ? grantKey : grantKey.slice(0, at);
+		const level = at === -1 ? void 0 : grantKey.slice(at + 1);
+		for (const name of reach.get(base) ?? []) if (level === void 0 || level === name) out.push([grantKey, name]);
+	}
+	return out.toSorted(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
+}
+/** The SQL command `action` compiles to: `rls.actions` first, then the six default verbs. */
+function commandFor(action, actions) {
+	if (actions !== void 0 && Object.hasOwn(actions, action)) {
+		const configured = actions[action];
+		return configured === "none" ? void 0 : configured;
+	}
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return "select";
+		case "create": return "insert";
+		case "update": return "update";
+		case "delete": return "delete";
+		default: return;
+	}
+}
+function tableFor(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+function ancestorsOf(policy, name) {
+	const names = [];
+	let current = policy.resources.get(name);
+	while (current?.parent !== void 0 && !names.includes(current.parent.resource)) {
+		names.push(current.parent.resource);
+		current = policy.resources.get(current.parent.resource);
+	}
+	return names;
+}
+function membershipField(policy, resource, holder) {
+	if (resource === void 0) return;
+	if (resource.name === holder) return resource.id ?? "id";
+	let current = resource;
+	const seen = /* @__PURE__ */ new Set();
+	while (current?.parent !== void 0 && !seen.has(current.name)) {
+		seen.add(current.name);
+		if (current.parent.resource === holder) return current.parent.field;
+		current = policy.resources.get(current.parent.resource);
+	}
+}
+function resourceCondition(item, policy, ctx) {
+	if (item.access.kind !== "resource") throw new Error("PermDock CLI: resourceCondition needs a resource role");
+	const { role, resource: roleResource } = item.access;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const holders = [roleResource, ...ancestorsOf(policy, roleResource)];
+	const hops = [];
+	for (const [index, holder] of holders.entries()) {
+		const field = membershipField(policy, target, holder);
+		if (field === void 0) continue;
+		if (index > 0 && ctx.memberships?.resource?.[holder] === void 0) continue;
+		hops.push({
+			op: "memberOf",
+			scope: "resource",
+			field,
+			roles: [role],
+			resource: holder
+		});
+	}
+	return sole(hops) ?? {
+		op: "or",
+		conditions: hops
+	};
+}
+/**
+* The access a link capability has to a resource-scoped grant, over the same
+* holders as `resourceCondition`. It reads the claim, so ancestor hops need
+* no memberships table. `undefined` when no holder is on the row's chain.
+*/
+function capabilityAccess(item, policy, ctx) {
+	if (item.access.kind !== "resource") return;
+	const { role, resource: roleResource } = item.access;
+	const kinds = ctx.ownership?.kinds[role];
+	if (kinds !== void 0 && !kinds.includes("link")) return;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const hops = [];
+	for (const holder of [roleResource, ...ancestorsOf(policy, roleResource)]) {
+		const field = membershipField(policy, target, holder);
+		if (field !== void 0) hops.push(capabilityAccessSql(ctx, field, holder, role, item.grant.permission.key));
+	}
+	if (hops.length === 0) return;
+	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
+}
+function prepare(item, tables, warnings, skipClosures, actions, rowActions = false) {
+	const { grant, label } = item;
+	if (grant.breakGlass !== void 0) {
+		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
+		return;
+	}
+	if (grant.closure !== void 0 || grant.portable === false) {
+		if (skipClosures) {
+			warnings.push(`skipped non-portable grant ${label}/${grant.permission.key}`);
+			return;
+		}
+		throw new Error(`PermDock CLI: closure grant ${label}/${grant.permission.key} is not portable; rewrite it or pass --skip-closures`);
+	}
+	const context = [.../* @__PURE__ */ new Set([...contextRefs(item.where), ...contextRefs(grant.check)])];
+	if (context.length > 0) {
+		if (skipClosures) {
+			warnings.push(`skipped grant ${label}/${grant.permission.key}: it reads ${context.join(", ")}, which is not in the token`);
+			return;
+		}
+		throw new Error(`PermDock CLI: grant ${label}/${grant.permission.key} reads ${context.join(", ")}; request context is not in the token, so RLS cannot compile it. Move the value to a server-set claim (principal.claims.*) or pass --skip-closures (permdock doctor PD027)`);
+	}
+	if (requiresApproval(grant.approval)) {
+		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
+		return;
+	}
+	const command = commandFor(grant.permission.action, actions);
+	const table = tableFor(grant.permission.resource, tables);
+	if (command === void 0) {
+		if (item.access.kind !== "role" && rowActions) {
+			warnings.push(`no policy for ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions); only permitted_<resource>_rows answers it`);
+			return {
+				item,
+				command: "none",
+				table,
+				...item.where === void 0 ? {} : { using: item.where }
+			};
+		}
+		if (item.access.kind !== "role") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions) and only role grants are seeded`);
+			return;
+		}
+		if (grant.validity !== void 0 && grant.effect === "allow") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: a role_permissions row cannot carry validFrom / validUntil, so a time-bounded grant on an action with no SQL command is not seeded`);
+			return;
+		}
+		warnings.push(`no policy for ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions); seeded for permdock_has and permitted_<scope>_ids`);
+		return {
+			item,
+			command: "none",
+			table,
+			...item.where === void 0 ? {} : { using: item.where },
+			...grant.check === void 0 ? {} : { check: grant.check }
+		};
+	}
+	const using = command === "insert" ? void 0 : item.where;
+	const check = command === "insert" ? grant.check ?? item.where : command === "update" ? grant.check ?? item.where : void 0;
+	return {
+		item,
+		command,
+		table,
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+function signature(entry, byFields) {
+	const base = [
+		entry.item.grant.effect,
+		entry.using ?? null,
+		entry.check ?? null
+	];
+	return JSON.stringify(byFields ? [...base, entry.item.grant.fields ?? null] : base);
+}
+/**
+* Grant keys per permission: the key is the permission, split into
+* `permission#n` when role grants carry different portable conditions (or
+* effects), one key per condition group; a group whose grants set `group`
+* is `permission#<group>` instead. With field views, grants that differ
+* only in `fields` get their own keys too, so a view can tell them apart.
+*/
+function assignKeys(entries, byFields) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (entry.item.access.kind !== "role") continue;
+		const key = entry.item.grant.permission.key;
+		const byCondition = groups.get(key) ?? /* @__PURE__ */ new Map();
+		const sig = signature(entry, byFields);
+		byCondition.set(sig, [...byCondition.get(sig) ?? [], entry]);
+		groups.set(key, byCondition);
+	}
+	const keys = /* @__PURE__ */ new Map();
+	for (const [permission, byCondition] of groups) {
+		const lists = [...byCondition.values()];
+		const named = /* @__PURE__ */ new Set();
+		for (const [index, list] of lists.entries()) {
+			const group = groupOf(permission, list);
+			if (group !== void 0 && named.has(group)) throw new Error(`PermDock CLI: grants of ${permission} with different conditions share group '${group}'; a group names one condition`);
+			if (group !== void 0) named.add(group);
+			const grantKey = group !== void 0 ? `${permission}#${group}` : lists.length === 1 ? permission : `${permission}#${index + 1}`;
+			for (const entry of list) keys.set(entry, grantKey);
+		}
+	}
+	return keys;
+}
+function groupOf(permission, list) {
+	const names = [...new Set(list.flatMap((entry) => entry.item.grant.group === void 0 ? [] : [entry.item.grant.group]))].toSorted();
+	if (names.length > 1) throw new Error(`PermDock CLI: grants of ${permission} with one condition name the groups ${names.join(", ")}; give them one group`);
+	return names[0];
+}
+/**
+* One entry per level for every allow of an assignable role on a resource
+* with levels, keyed `<grant key>@<level>`. Only `permdock_custom_keys`
+* hands these keys out, to a custom role whose stored allow names the level.
+*/
+function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
+	const custom = ctx.customRoles;
+	if (custom?.levels !== true) return [];
+	const assignable = new Set(custom.assignable);
+	const out = [];
+	for (const [entry, grantKey] of Array.from(keys)) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || !assignable.has(item.access.role)) continue;
+		if (grant.permission.key.includes("@")) throw new Error(`PermDock CLI: permission key '${grant.permission.key}' holds '@', which separates a level in custom-role grant keys`);
+		for (const [level, condition] of policyLevels(policy, grant.permission.resource)) {
+			const where = andWhere(item.where, condition);
+			const prepared = prepare({
+				...item,
+				grant: leveled(grant, level, condition),
+				...where === void 0 ? {} : { where }
+			}, tables, warnings, skipClosures, ctx.actions);
+			if (prepared !== void 0) {
+				keys.set(prepared, `${grantKey}@${level}`);
+				out.push(prepared);
+			}
+		}
+	}
+	return out;
+}
+function compileOptional(condition, ctx) {
+	return condition === void 0 ? void 0 : compileConditionSql(condition, ctx);
+}
+function noteConditions(entry, warnings) {
+	const { label, grant } = entry.item;
+	const names = [...sqlFunctionNames(entry.using), ...sqlFunctionNames(entry.check)];
+	if (names.length > 0) warnings.push(`sqlFunction ${[...new Set(names)].join(", ")} on ${label}/${grant.permission.key} is portable via twin`);
+	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
+}
+/**
+* Compiles every grant (role and top-level) to branches whose role check is
+* a helper call keyed by grant key. Nothing in a branch is per-row except the
+* portable row condition and resource-membership joins.
+*/
+/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
+const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
+function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
+	const items = collectGrants(policy);
+	const entries = items.flatMap((item) => {
+		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions, rowActions);
+		return entry === void 0 ? [] : [entry];
+	});
+	const keys = assignKeys(entries, ctx.fields === "views");
+	entries.push(...levelEntries(policy, ctx, keys, tables, warnings, skipClosures));
+	const conditionedKeys = /* @__PURE__ */ new Set();
+	for (const [entry, grantKey] of keys) if (entry.using !== void 0 || entry.check !== void 0 || entry.item.grant.validity !== void 0 || entry.item.grant.requires !== void 0) conditionedKeys.add(grantKey);
+	const rows = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const holder = item.grant.breakGlass === void 0 ? void 0 : breakGlassHolder(item);
+		if (holder !== void 0) {
+			const row = {
+				role: holder.role,
+				permission: item.grant.permission.key,
+				grantKey: breakGlassKey(item.grant.permission.key),
+				scope: holder.scope,
+				effect: item.grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+	}
+	const branches = [];
+	const actionBranches = [];
+	const rowColumns = /* @__PURE__ */ new Map();
+	const filters = (resource, table, column) => {
+		rowColumns.set(`${table}\u0000${column}`, {
+			resource,
+			table,
+			column
+		});
+	};
+	const typed = /* @__PURE__ */ new Map();
+	const contextFor = (name) => {
+		const known = typed.get(name);
+		if (known !== void 0) return known;
+		const node = policy.resources.get(name);
+		const schema = node === void 0 ? void 0 : jsonSchemaOf(node);
+		const next = {
+			...ctx,
+			columnTypes: columnTypesOf(schema),
+			arrayColumns: arrayColumnsOf(schema)
+		};
+		typed.set(name, next);
+		return next;
+	};
+	for (const entry of entries) {
+		const { item, table } = entry;
+		const { grant, access, label } = item;
+		if (entry.command === "none") {
+			const grantKey = keys.get(entry);
+			if (access.kind === "role" && grantKey !== void 0) {
+				const row = {
+					role: access.role,
+					permission: grant.permission.key,
+					grantKey,
+					scope: access.scope,
+					effect: grant.effect
+				};
+				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+			}
+			if (!rowActions) continue;
+		}
+		const actionOnly = entry.command === "none";
+		const command = actionOnly ? "select" : entry.command;
+		const target = actionOnly ? actionBranches : branches;
+		const rowCtx = {
+			...contextFor(item.grant.permission.resource),
+			permission: grant.permission.key
+		};
+		noteConditions(entry, warnings);
+		for (const field of [...indexedFields(entry.using), ...indexedFields(entry.check)]) filters(grant.permission.resource, table, field);
+		const grantKey = keys.get(entry);
+		let accessExpr;
+		if (access.kind === "role" && grantKey !== void 0) {
+			const column = access.scope === "global" ? void 0 : scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
+			accessExpr = accessSql(ctx, access.scope, grantKey, column);
+			if (column !== void 0) filters(grant.permission.resource, table, column);
+			const row = {
+				role: access.role,
+				permission: grant.permission.key,
+				grantKey,
+				scope: access.scope,
+				effect: grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+		const linkOnly = access.kind === "resource" && ctx.capabilities === true && ctx.memberships?.resource?.[access.resource] === void 0;
+		if (access.kind === "actor") accessExpr = `${subjectClaimSql(ctx, "client_id")} is not null or ${subjectClaimJsonSql(ctx, "act")} is not null`;
+		if (access.kind === "resource" && !linkOnly) accessExpr = compileConditionSql(resourceCondition(item, policy, ctx), {
+			...ctx,
+			permission: grant.permission.key
+		});
+		if (linkOnly) warnings.push(`no ${access.resource} memberships table: only link capabilities reach ${label}/${grant.permission.key}`);
+		const validity = validitySql(grant.validity);
+		accessExpr = andSql(accessExpr, validity);
+		for (const key of grant.requires ?? []) accessExpr = andSql(accessExpr, requiresSql(ctx, key, policy.resources.get(grant.permission.resource)));
+		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
+		if (ctx.apiKeys !== void 0 && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
+			const calls = (requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []]).map((key) => `(select ${apiKeyAllowsCall(ctx, quoteLiteral(key))})`);
+			accessExpr = andSql(accessExpr, calls.length === 1 ? calls[0] ?? "" : `(${calls.join(" and ")})`);
+		}
+		const using = compileOptional(entry.using, rowCtx);
+		const check = compileOptional(entry.check, rowCtx);
+		const fields = grant.fields === void 0 ? {} : { fields: grant.fields };
+		if (!linkOnly) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: access.kind === "anyone" ? ["anon", "authenticated"] : ["authenticated"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			...grantKey === void 0 ? {} : { grantKey },
+			...accessExpr === void 0 ? {} : { access: accessExpr },
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+		const linked = ctx.capabilities === true ? capabilityAccess(item, policy, ctx) : void 0;
+		if (linked !== void 0) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: ["anon"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			access: andSql(linked, validity) ?? linked,
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+	}
+	return {
+		branches: ensureSelectCoverage(branches, warnings),
+		actionBranches,
+		rolePermissions: withAliasRows(policy, [...rows.values()]),
+		conditionedKeys,
+		rowColumns: [...rowColumns.values()],
+		levelReach: ctx.customRoles?.levels === true ? levelReachOf(policy, keys) : []
+	};
+}
+/**
+* Each row again under every key its permission was renamed from, so SQL that
+* still calls `permdock_has('<old key>')` keeps the access the current key
+* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
+* copied.
+*/
+function withAliasRows(policy, rows) {
+	const former = new Map(listPermissions(policy.permissions).map((leaf) => [leaf.key, formerKeys(leaf)]));
+	const out = [...rows];
+	for (const row of rows) {
+		const suffix = row.grantKey.slice(row.permission.length);
+		if (!row.grantKey.startsWith(row.permission) || suffix !== "" && (!/^#[a-z0-9][a-z0-9_-]*$/u.test(suffix) || suffix === "#break-glass")) continue;
+		for (const old of former.get(row.permission) ?? []) out.push({
+			...row,
+			permission: old,
+			grantKey: `${old}${suffix}`
+		});
+	}
+	return out;
+}
+/**
+* Postgres needs SELECT access to find rows for UPDATE / DELETE and for
+* RETURNING, so a table with only update or delete grants gets matching
+* SELECT branches.
+*/
+function ensureSelectCoverage(branches, warnings) {
+	const extra = [];
+	const readable = new Set(branches.filter((item) => item.command === "select" && item.effect === "allow").map((item) => item.table));
+	const covered = /* @__PURE__ */ new Set();
+	for (const item of branches) {
+		if (item.effect !== "allow" || item.command !== "update" && item.command !== "delete" || readable.has(item.table)) continue;
+		const { check: _check, ...rest } = item;
+		extra.push({
+			...rest,
+			command: "select",
+			coverage: true
+		});
+		if (!covered.has(item.table)) {
+			covered.add(item.table);
+			warnings.push(`added SELECT coverage for ${item.table} (${item.permissionKey})`);
+		}
+	}
+	return [...branches, ...extra];
+}
+/** True when `sql` is one parenthesised expression, so AND / OR need not wrap it again. */
+function isWrapped(sql) {
+	if (!sql.startsWith("(") || !sql.endsWith(")")) return false;
+	let depth = 0;
+	let quoted = false;
+	for (let index = 0; index < sql.length; index += 1) {
+		const ch = sql[index];
+		if (ch === "'") quoted = !quoted;
+		else if (!quoted && ch === "(") depth += 1;
+		else if (!quoted && ch === ")") {
+			depth -= 1;
+			if (depth === 0 && index < sql.length - 1) return false;
+		}
+	}
+	return depth === 0;
+}
+function wrapSql(sql) {
+	return isWrapped(sql) ? sql : `(${sql})`;
+}
+/**
+* The grant's `validFrom` / `validUntil` as a clock check: `from` inclusive,
+* `until` exclusive, matching the in-process evaluator.
+*/
+function validitySql(validity) {
+	if (validity === void 0) return;
+	return andSql(validity.from === void 0 ? void 0 : `now() >= to_timestamp(${validity.from})`, validity.until === void 0 ? void 0 : `now() < to_timestamp(${validity.until})`);
+}
+function andSql(...parts) {
+	const present = parts.filter((part) => part !== void 0 && part !== "true");
+	if (present.length === 0) return;
+	return present.length === 1 ? present[0] : present.map(wrapSql).join(" and ");
+}
+/** `USING` and `WITH CHECK` for a branch: its access check ANDed with its row conditions. */
+function branchClauses(branch) {
+	const using = branch.command === "insert" ? void 0 : andSql(branch.access, branch.using) ?? "true";
+	const check = branch.command === "insert" || branch.command === "update" ? andSql(branch.access, branch.check) ?? "true" : void 0;
+	return {
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+//#endregion
+//#region src/cli/rls/policies.ts
+/** Each database role gets its own policy, so no role sees two permissive policies for one command. */
+const AUDIENCES = ["authenticated", "anon"];
+const DEFAULT_POLICY_NAME = "{table}_{op}";
+const DEFAULT_PER_ROLE_NAME = "{role}_{permission}";
+const PLACEHOLDER = /\{(table|op|role|permission)\}/gu;
+function sanitize(name) {
+	return name.replaceAll(/[^A-Za-z0-9_]/g, "_");
+}
+function render(template, values) {
+	return sanitize(template.replaceAll(PLACEHOLDER, (_match, key) => values[key]));
+}
+/** Rejects a template that cannot name every policy of the chosen shape uniquely. */
+function assertPolicyName(template, perRole) {
+	if (!perRole && /\{(role|permission)\}/u.test(template)) throw new Error("PermDock CLI: --policy-name {role} and {permission} need --policy-per-role; a collapsed policy covers several roles");
+	if (!perRole && !(template.includes("{table}") && template.includes("{op}"))) throw new Error("PermDock CLI: --policy-name needs {table} and {op} so each table and command gets its own policy");
+}
+function orSql(parts) {
+	const distinct = [...new Set(parts)];
+	if (distinct.includes("true")) return "true";
+	return sole(distinct) ?? distinct.map(wrapSql).join(" or ");
+}
+function negate(sql) {
+	return sql === void 0 ? void 0 : `(${sql}) is not true`;
+}
+function policyOf(name, branch, using, check) {
+	const deny = branch.effect === "deny";
+	const policy = {
+		name,
+		table: branch.table,
+		command: branch.command,
+		effect: branch.effect,
+		roles: branch.roles
+	};
+	const finalUsing = deny ? negate(using) : using;
+	const finalCheck = deny ? negate(check) : check;
+	if (finalUsing !== void 0) policy.using = finalUsing;
+	if (finalCheck !== void 0) policy.check = finalCheck;
+	return policy;
+}
+function uniqueName(names, name) {
+	const seen = names.get(name) ?? 0;
+	names.set(name, seen + 1);
+	return seen === 0 ? name : `${name}_${seen + 1}`;
+}
+function perRolePolicies(branches, template) {
+	const names = /* @__PURE__ */ new Map();
+	return branches.map((branch) => {
+		const clauses = branchClauses(branch);
+		const deny = branch.effect === "deny";
+		const base = render(template, {
+			table: branch.table,
+			op: branch.command,
+			role: branch.label,
+			permission: branch.permissionKey
+		});
+		const name = `${deny ? "deny_" : ""}${base}${branch.coverage === true ? "_select_coverage" : ""}`;
+		return policyOf(uniqueName(names, name), branch, clauses.using, clauses.check);
+	});
+}
+/**
+* Branches of one grant-key group share their row condition, so the group
+* becomes one OR branch whose access ORs the helper calls of each scope.
+*/
+function mergeGroups(branches) {
+	const merged = [];
+	const byKey = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		const id = branch.grantKey === void 0 ? void 0 : `${branch.table}\u0000${branch.command}\u0000${branch.grantKey}\u0000${branch.coverage === true}`;
+		const entry = id === void 0 ? void 0 : byKey.get(id);
+		if (entry === void 0) {
+			const created = {
+				branch,
+				accesses: branch.access === void 0 ? [] : [branch.access]
+			};
+			if (id !== void 0) byKey.set(id, created);
+			merged.push(created);
+			continue;
+		}
+		if (branch.access !== void 0 && !entry.accesses.includes(branch.access)) entry.accesses.push(branch.access);
+	}
+	return merged.map(({ branch, accesses }) => accesses.length <= 1 ? branch : withAccess(branch, orSql(accesses)));
+}
+function withAccess(branch, access) {
+	return {
+		...branch,
+		access
+	};
+}
+function collapsedPolicies(branches, template) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const branch of mergeGroups(branches)) {
+		const id = `${branch.table}\u0000${branch.command}\u0000${branch.effect}`;
+		groups.set(id, [...groups.get(id) ?? [], branch]);
+	}
+	const names = /* @__PURE__ */ new Map();
+	return [...groups.values()].flatMap((group) => AUDIENCES.flatMap((audience) => {
+		const members = group.filter((branch) => branch.roles.includes(audience));
+		const [first] = members;
+		if (first === void 0) return [];
+		const deny = first.effect === "deny";
+		const clauses = members.map(branchClauses);
+		const usings = clauses.flatMap((item) => item.using === void 0 ? [] : [item.using]);
+		const checks = clauses.flatMap((item) => item.check === void 0 ? [] : [item.check]);
+		const base = render(template, {
+			table: first.table,
+			op: first.command,
+			role: first.label,
+			permission: first.permissionKey
+		});
+		return [policyOf(uniqueName(names, `${deny ? "deny_" : ""}${base}${audience === "anon" ? "_anon" : ""}`), {
+			...first,
+			roles: [audience]
+		}, usings.length === 0 ? void 0 : orSql(usings), checks.length === 0 ? void 0 : orSql(checks))];
+	}));
+}
+/**
+* Assembles policies. The default is one PERMISSIVE policy per table,
+* command and database role (Splinter `multiple_permissive_policies` stays
+* quiet), with denies in one RESTRICTIVE policy per table, command and role.
+*/
+function assemblePolicies(branches, shape) {
+	const template = shape.name ?? (shape.perRole ? DEFAULT_PER_ROLE_NAME : DEFAULT_POLICY_NAME);
+	assertPolicyName(template, shape.perRole);
+	return shape.perRole ? perRolePolicies(branches, template) : collapsedPolicies(branches, template);
+}
+const DEFAULT_READ_ONLY_ACTORS = ["support", "impersonation"];
+const ACTOR_KIND = /^[a-z][a-z0-9_-]*$/u;
+/** The actor kinds `rls.readOnlyActors` names, or `undefined` when it is off. */
+function readOnlyActorKinds(setting) {
+	if (setting === void 0 || setting === false) return;
+	const kinds = setting === true ? DEFAULT_READ_ONLY_ACTORS : setting;
+	if (kinds.length === 0 || kinds.some((kind) => !ACTOR_KIND.test(kind))) throw new Error("PermDock CLI: rls.readOnlyActors must be true or a non-empty list of actor kinds such as 'support'");
+	return [...new Set(kinds)];
+}
+/**
+* One restrictive policy per table and write command the allow policies
+* grant to `authenticated`: the write passes unless the token's `act` claim
+* (`act`, as SQL `jsonb`) is a session of one of `kinds` that is not
+* `read_only: false`. Reads are never touched.
+*/
+function readOnlyActorPolicies(policies, act, kinds) {
+	const list = `array[${kinds.map((kind) => `'${kind}'`).join(", ")}]::text[]`;
+	const passes = `not coalesce(${kinds.includes("support") ? `(${act} ->> 'kind') = any(${list}) or ((${act} ->> 'kind') is null and ${act} ? 'session_id')` : `(${act} ->> 'kind') = any(${list})`}, false) or coalesce((${act} ->> 'read_only') = 'false', false)`;
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const policy of policies) {
+		const key = `${policy.table}\u0000${policy.command}`;
+		if (policy.effect !== "allow" || policy.command === "select" || !policy.roles.includes("authenticated") || seen.has(key)) continue;
+		seen.add(key);
+		out.push({
+			name: sanitize(`${policy.table}_${policy.command}_read_only_actors`),
+			table: policy.table,
+			command: policy.command,
+			effect: "deny",
+			roles: ["authenticated"],
+			...policy.command === "insert" ? {} : { using: passes },
+			...policy.command === "delete" ? {} : { check: passes }
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/cli/rls/fields.ts
+/** Names of the field-view objects. Part of the SQL contract. */
+const FIELD_VIEWS = {
+	/** `<table>_visible`: the `security_invoker` view clients read. */
+	view: "_visible",
+	/** `<table>_visible_fields`: the owner-rights companion `--revoke-columns` adds. */
+	companion: "_visible_fields",
+	/** The companion's row-key column, joined to the base table's key. */
+	key: "permdock_key",
+	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
+	comment: "permdock:field-companion"
+};
+function covers(branch, column) {
+	return branch.fields === void 0 || branch.fields.includes(column);
+}
+/**
+* A read grant that only shapes columns: a field-limited deny (it never
+* denies the row) or an allow with an empty list (it grants nothing). With
+* field views it leaves the row policy and lives in the view's masks.
+*/
+function fieldOnly(branch) {
+	if (branch.command !== "select" || branch.fields === void 0) return false;
+	return branch.effect === "deny" || branch.fields.length === 0;
+}
+/** Branches the row policies keep when field views compile. */
+function rowBranches(branches) {
+	return branches.filter((branch) => !fieldOnly(branch));
+}
+/**
+* Whether the reader is signed in, for branches with no helper call: a grant
+* to any signed-in user relies on `to authenticated` in its policy, which a
+* view does not have.
+*/
+function audience(ctx, branch) {
+	if (branch.access !== void 0 || branch.roles.length !== 1) return;
+	if (branch.roles[0] === "authenticated") return signedIn(ctx);
+	return branch.roles[0] === "anon" ? `not (${signedIn(ctx)})` : void 0;
+}
+function clause(ctx, branch) {
+	return andSql(audience(ctx, branch), branchClauses(branch).using) ?? "true";
+}
+/**
+* `can(permission, row, { field })` in SQL: an allow that covers the column
+* holds for the row and no covering deny does. Every access term is the
+* uncorrelated helper call the row policy uses, so it runs once per statement.
+*/
+function maskSql(ctx, allows, denies, column) {
+	const allowed = allows.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	if (allowed.length === 0) return "false";
+	const denied = denies.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	const allow = orSql(allowed);
+	if (denied.length === 0) return allow;
+	const deny = orSql(denied);
+	return allow === "true" ? `not ${wrapSql(deny)}` : `${wrapSql(allow)} and not ${wrapSql(deny)}`;
+}
+function schemaColumns(policy, resource) {
+	const node = policy.resources.get(resource);
+	const schema = node === void 0 ? null : jsonSchemaOf(node);
+	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
+	return properties !== null && typeof properties === "object" ? Object.keys(properties) : void 0;
+}
+function viewName(table, suffix) {
+	return `${table}${suffix}`;
+}
+/**
+* `<helper schema>.<table>_visible_fields`: outside the Data API's schemas,
+* so its owner rights reach clients only through the `_visible` join.
+*/
+function companionName(ctx, table) {
+	const base = table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
+	return `${helperSchema(ctx)}.${viewName(base, FIELD_VIEWS.companion)}`;
+}
+/**
+* One view per table whose read grants limit fields. A column is restricted
+* when some read allow lists fields without it or some read deny lists it;
+* every other column, and the row key, passes through unchanged.
+*/
+function fieldViews(policy, ctx, branches, options, warnings) {
+	const byTable = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.command !== "select" || branch.coverage === true) continue;
+		byTable.set(branch.table, [...byTable.get(branch.table) ?? [], branch]);
+	}
+	const views = [];
+	for (const [table, reads] of byTable) {
+		const allows = reads.filter((branch) => branch.effect === "allow" && branch.fields?.length !== 0);
+		const denies = reads.filter((branch) => branch.effect === "deny");
+		const limited = reads.some((branch) => branch.fields !== void 0);
+		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
+		if (!limited || allows.length === 0 || resource === void 0) continue;
+		const names = schemaColumns(policy, resource);
+		if (names === void 0) throw new Error(`PermDock CLI: --fields views needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
+		const key = policy.resources.get(resource)?.id ?? "id";
+		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
+		const columns = names.map((name) => {
+			quoteIdent(name);
+			return restricted(name) ? {
+				name,
+				mask: maskSql(ctx, allows, denies, name)
+			} : { name };
+		});
+		if (columns.every((column) => column.mask === void 0)) continue;
+		const view = viewName(table, FIELD_VIEWS.view);
+		if (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(key))) warnings.push(`field view ${view}: the key ${key} passes through, although a read grant on ${resource} omits it`);
+		const hidden = columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+		if (options.helpersOnly === true) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; revoke select on those columns from client roles in your own grants, or read them through a function`);
+		else if (!options.revokeColumns) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; add --revoke-columns so clients read through the view`);
+		views.push({
+			resource,
+			table,
+			view,
+			key,
+			columns,
+			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
+			...options.revokeColumns ? { companion: companionName(ctx, table) } : {}
+		});
+	}
+	return views;
+}
+/** Columns of `view`'s table that `anon` and `authenticated` keep on the base table with `--revoke-columns`. */
+function readableColumns(view) {
+	return view.columns.filter((column) => column.mask === void 0).map((column) => column.name);
+}
+function restrictedColumns(view) {
+	return view.columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+}
+function columnList(names) {
+	return names.map(quoteIdent).join(", ");
+}
+function selectList(lines) {
+	return lines.map((line) => `  ${line}`).join(",\n");
+}
+function grantView(name, roles) {
+	return [`revoke all on table ${quoteQualified(name)} from anon, authenticated, public;`, `grant select on table ${quoteQualified(name)} to ${roles.join(", ")};`].join("\n");
+}
+function inlineViewSql(view) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? quoteIdent(column.name) : `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteQualified(view.view)} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteQualified(view.table)};`;
+}
+function companionSql(view, companion) {
+	const restricted = view.columns.filter((column) => column.mask !== void 0);
+	const targets = [`${quoteIdent(view.key)} as ${quoteIdent(FIELD_VIEWS.key)}`, ...restricted.map((column) => `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`)];
+	const any = orSql(restricted.map((column) => column.mask ?? "false"));
+	const name = companion.slice(0, companion.indexOf("."));
+	const schema = quoteIdent(name);
+	return `${name === "public" ? "" : `create schema if not exists ${schema};
+revoke all on schema ${schema} from public;
+grant usage on schema ${schema} to ${view.roles.join(", ")};
+`}create or replace view ${quoteQualified(companion)} with (security_barrier = true) as
+select
+${selectList(targets)}
+from ${quoteQualified(view.table)}
+where ${any};
+comment on view ${quoteQualified(companion)} is ${quoteLiteral(`${FIELD_VIEWS.comment} ${view.view}`)};`;
+}
+function joinedViewSql(view, companion) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? `t.${quoteIdent(column.name)}` : `f.${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteQualified(view.view)} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteQualified(view.table)} t
+left join ${quoteQualified(companion)} f on f.${quoteIdent(FIELD_VIEWS.key)} = t.${quoteIdent(view.key)};`;
+}
+/** `select` on only the unrestricted columns (and the key) of the base table, for `--revoke-columns`. */
+function columnGrantSql(view, role) {
+	return `grant select (${columnList(readableColumns(view))}) on table ${quoteQualified(view.table)} to ${role};`;
+}
+function columnRevokeSql(view) {
+	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteQualified(view.table)} from anon, authenticated;`;
+}
+/**
+* The view SQL: the `security_invoker` view, and with `--revoke-columns` the
+* owner-rights companion it joins for the restricted columns. The companion
+* masks every column with the full field decision and keeps only rows where
+* one is readable, so reading it directly shows nothing `pick` would not.
+*/
+function fieldViewsSql(views) {
+	return views.map((view) => {
+		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
+		if (view.companion === void 0) return [
+			head,
+			inlineViewSql(view),
+			grantView(view.view, view.roles)
+		].join("\n");
+		return [
+			head,
+			`-- ${view.companion} reads ${view.table} as its owner; ${view.view} reads the rows as the caller and joins it`,
+			companionSql(view, view.companion),
+			grantView(view.companion, view.roles),
+			joinedViewSql(view, view.companion),
+			grantView(view.view, view.roles)
+		].join("\n");
+	}).join("\n\n");
+}
+//#endregion
+export { indexTargets as _, fieldViewsSql as a, readTableIndexFacts as b, assemblePolicies as c, readOnlyActorPolicies as d, branchClauses as f, COLUMNS_SQL as g, tableFor as h, fieldViews as i, orSql as l, compileGrants as m, columnGrantSql as n, rowBranches as o, commandFor as p, columnRevokeSql as r, viewName as s, FIELD_VIEWS as t, readOnlyActorKinds as u, indexesSql as v, pruneIndexTargets as y };