permdock 0.3.1 → 0.5.0

package/dist/verify-DbCL9bnB.js

@@ -0,0 +1,1770 @@
+import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
+import { a as hasConditionOp, c as isConditionRef } from "./refs-K6eWUJ0H.js";
+import { E as memoryCustomRoleSource, g as memoryRelationSource } from "./src-DLfUWFAI.js";
+import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { f as nowMillis, u as isoAt } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { d as scopeList } from "./scopes-CUPSjo9q.js";
+import { o as requiresStandIn } from "./delegation-DaXVdDhM.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { p as scopeField } from "./tenancy-DN2QAx9z.js";
+import { s as policyLevels } from "./policy-DLZJ5gAp.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { _ as membershipsClaim, c as andWhere, g as leveled, p as customRoleScope } from "./evaluate-_R8QkWaf.js";
+import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-CWTY6uih.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
+import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { o as loadPolicyAt } from "./load-DFS_ry0W.js";
+import { c as relationArmSql, u as restrictedRowsSql } from "./compile-CMqMx_IN.js";
+import "./budget-NbEtbJC_.js";
+import { i as qualifySqlTable, n as defaultSqlCommand } from "./sql-B5T1IL83.js";
+import "./sources-vs5dGOsS.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
+import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as helperSchema, r as HELPERS, v as subjectClaimSql, w as arrayColumnsOf } from "./shared-CD11nBbC.js";
+import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-CO1oOymN.js";
+import { B as linkHelper, D as breakGlassHolder, F as graphHelper, I as graphSqlName, J as restrictedHelper, L as graphSqlText, M as contextRefs, N as sqlFunctionNames, O as breakGlassKey, P as CLOSURE, Q as activeUserSql, X as scopeTable, j as compileConditionSql, k as collectGrants, m as accessSql, p as requiresSql, v as capabilityAccessSql, w as apiKeyAllowsCall } from "./ownership-BatFgAA4.js";
+import { s as viewName, t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { createHash, randomUUID } from "node:crypto";
+//#region src/cli/rls/indexes.ts
+/** Postgres truncates identifiers longer than this, in bytes. */
+const MAX_IDENT = 63;
+/**
+* The row fields `condition` compares with the subject, a claim or a
+* membership (`ownerId: principal.id`, `memberOf`), through `and` and `or`:
+* the selective comparisons an index serves. A comparison with a constant
+* (`status: 'sent'`) narrows rows the scope key already found, a negation
+* scans anyway, and a dotted field is a JSON path a plain index does not serve.
+*/
+function indexedFields(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "and":
+		case "or": return condition.conditions.flatMap(indexedFields);
+		case "memberOf": return plainField(condition.field);
+		case "eq":
+		case "in": return isConditionRef(condition.value) ? plainField(condition.field) : [];
+		case "not":
+		case "sqlFunction":
+		case "opaque":
+		case "related":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "notIn":
+		case "isNull":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+function plainField(field) {
+	return field.includes(".") ? [] : [field];
+}
+/**
+* Every index the generated SQL reads through: the row columns policies
+* filter on (scope keys and selective condition fields), and the membership
+* tables' user column, followed by the scope column the helpers select.
+*/
+function indexTargets(ctx, rowColumns) {
+	const targets = /* @__PURE__ */ new Map();
+	const add = (table, columns) => {
+		const target = {
+			table: qualifySqlTable(table),
+			columns
+		};
+		targets.set(`${target.table}\u0000${columns[0] ?? ""}`, target);
+	};
+	for (const { table, column } of rowColumns) add(table, [column]);
+	for (const scope of ctx.scopes) {
+		const mapped = scopeTable(ctx, scope.name);
+		if (mapped !== void 0) add(mapped.table.table, [mapped.table.user, mapped.column]);
+	}
+	for (const source of [...ctx.sources ?? [], ...ctx.memberSources ?? []]) {
+		add(source.sql.table, [source.sql.user]);
+		const users = source.sql.userThrough;
+		if (users !== void 0) add(users.table, [users.key]);
+	}
+	return [...targets.values()].toSorted((a, b) => `${a.table}.${a.columns.join(",")}` < `${b.table}.${b.columns.join(",")}` ? -1 : 1);
+}
+/** A stable index name under Postgres' identifier limit. */
+function indexName(target) {
+	const name = `permdock_${target.table.slice(target.table.lastIndexOf(".") + 1)}_${target.columns.join("_")}_idx`;
+	if (Buffer.byteLength(name) <= MAX_IDENT) return name;
+	return `permdock_${createHash("sha256").update(name).digest("hex").slice(0, 8)}_idx`;
+}
+/** `create index if not exists` for every target, one per line. */
+function indexesSql(targets) {
+	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
+}
+/** Every live column of the tables in `$1` (`schema.table`), as `target` and `name`. */
+const COLUMNS_SQL = `select n.nspname || '.' || c.relname as target, a.attname as name
+from pg_attribute a
+join pg_class c on c.oid = a.attrelid
+join pg_namespace n on n.oid = c.relnamespace
+where a.attnum > 0 and not a.attisdropped
+  and n.nspname || '.' || c.relname = any($1::text[])`;
+const INDEX_COLUMNS_SQL = `select n.nspname || '.' || c.relname as target,
+  array(
+    select a.attname::text
+    from unnest(i.indkey) with ordinality k(attnum, ord)
+    left join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum and k.attnum > 0
+    where k.ord <= i.indnkeyatts
+    order by k.ord
+  ) as columns
+from pg_index i
+join pg_class c on c.oid = i.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
+function strings(value) {
+	return Array.isArray(value) ? value.map((item) => typeof item === "string" ? item : null) : [];
+}
+/** Reads the columns and index key columns of `tables` (`schema.table`). */
+async function readTableIndexFacts(db, tables, connect = (url) => connectPgPool(url, "permdock rls generate --db-url-stdin")) {
+	const client = await connect(db);
+	try {
+		const [columns, indexes] = await Promise.all([client.query(COLUMNS_SQL, [[...tables]]), client.query(INDEX_COLUMNS_SQL, [[...tables]])]);
+		const byTable = {};
+		for (const row of columns.rows) (byTable[String(row["target"])] ??= []).push(String(row["name"]));
+		const keys = {};
+		for (const row of indexes.rows) {
+			const list = strings(row["columns"]);
+			const end = list.indexOf(null);
+			const lead = end === -1 ? list : list.slice(0, end);
+			if (lead.length > 0) (keys[String(row["target"])] ??= []).push(lead);
+		}
+		return {
+			columns: byTable,
+			indexes: keys
+		};
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Drops the targets a database already serves or cannot hold: a target on a
+* table or column the database lacks (with a warning), and one an existing
+* index leads with (its key columns start with the target's).
+*/
+function pruneIndexTargets(targets, facts) {
+	const warnings = [];
+	return {
+		targets: targets.filter((target) => {
+			const columns = facts.columns[target.table];
+			if (columns === void 0) {
+				warnings.push(`no index suggested on ${target.table}: the database has no such table`);
+				return false;
+			}
+			const absent = target.columns.filter((column) => !columns.includes(column));
+			if (absent.length > 0) {
+				warnings.push(`no index suggested on ${target.table} (${target.columns.join(", ")}): the table has no column ${absent.join(", ")}`);
+				return false;
+			}
+			return !(facts.indexes[target.table] ?? []).some((index) => target.columns.every((column, at) => index[at] === column));
+		}),
+		warnings
+	};
+}
+//#endregion
+//#region src/cli/sql/compile.ts
+/**
+* The levels an allow reaches: every level without a row condition, else the
+* levels whose condition equals its condition.
+*/
+function reachedLevels(where, levels) {
+	if (where === void 0) return levels.map(([name]) => name);
+	const held = canonicalJson(where);
+	return levels.filter(([, condition]) => canonicalJson(condition) === held).map(([name]) => name);
+}
+function levelReachOf(policy, keys) {
+	const reach = /* @__PURE__ */ new Map();
+	for (const [entry, grantKey] of keys) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || grant.level !== void 0) continue;
+		const levels = policyLevels(policy, grant.permission.resource);
+		if (levels.length > 0) {
+			const set = reach.get(grantKey) ?? /* @__PURE__ */ new Set();
+			for (const name of reachedLevels(grant.where, levels)) set.add(name);
+			reach.set(grantKey, set);
+		}
+	}
+	const out = [];
+	for (const grantKey of new Set(keys.values())) {
+		const at = grantKey.lastIndexOf("@");
+		const base = at === -1 ? grantKey : grantKey.slice(0, at);
+		const level = at === -1 ? void 0 : grantKey.slice(at + 1);
+		for (const name of reach.get(base) ?? []) if (level === void 0 || level === name) out.push([grantKey, name]);
+	}
+	return out.toSorted(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
+}
+/**
+* The SQL command `action` compiles to: `rls.actions` first, then the six default verbs.
+* Any other verb is `undefined`, as `'none'` is: no policy, and its grants are still seeded.
+*/
+function commandFor(action, actions) {
+	if (actions !== void 0 && Object.hasOwn(actions, action)) {
+		const configured = actions[action];
+		return configured === "none" ? void 0 : configured;
+	}
+	return defaultSqlCommand(action);
+}
+function tableFor$1(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+function ancestorsOf(policy, name) {
+	const names = [];
+	let current = policy.resources.get(name);
+	while (current?.parent !== void 0 && !names.includes(current.parent.resource)) {
+		names.push(current.parent.resource);
+		current = policy.resources.get(current.parent.resource);
+	}
+	return names;
+}
+function membershipField(policy, resource, holder) {
+	if (resource === void 0) return;
+	if (resource.name === holder) return resource.id ?? "id";
+	let current = resource;
+	const seen = /* @__PURE__ */ new Set();
+	while (current?.parent !== void 0 && !seen.has(current.name)) {
+		seen.add(current.name);
+		if (current.parent.resource === holder) return current.parent.field;
+		current = policy.resources.get(current.parent.resource);
+	}
+}
+function resourceCondition(item, policy, ctx) {
+	if (item.access.kind !== "resource") throw configError("PermDock CLI: resourceCondition needs a resource role");
+	const { role, resource: roleResource } = item.access;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const holders = [roleResource, ...ancestorsOf(policy, roleResource)];
+	const hops = [];
+	for (const [index, holder] of holders.entries()) {
+		const field = membershipField(policy, target, holder);
+		if (field === void 0) continue;
+		if (index > 0 && ctx.memberships?.resource?.[holder] === void 0) continue;
+		hops.push({
+			op: "memberOf",
+			scope: "resource",
+			field,
+			roles: [role],
+			resource: holder
+		});
+	}
+	return sole(hops) ?? {
+		op: "or",
+		conditions: hops
+	};
+}
+/**
+* The access a link capability has to a resource-scoped grant, over the same
+* holders as `resourceCondition`. It reads the claim, so ancestor hops need
+* no memberships table. `undefined` when no holder is on the row's chain.
+*/
+function capabilityAccess(item, policy, ctx) {
+	if (item.access.kind !== "resource") return;
+	const { role, resource: roleResource } = item.access;
+	const kinds = ctx.ownership?.kinds[role];
+	if (kinds !== void 0 && !kinds.includes("link")) return;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const hops = [];
+	for (const holder of [roleResource, ...ancestorsOf(policy, roleResource)]) {
+		const field = membershipField(policy, target, holder);
+		if (field !== void 0) hops.push(capabilityAccessSql(ctx, field, holder, role, item.grant.permission.key));
+	}
+	if (hops.length === 0) return;
+	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
+}
+function prepare(item, tables, warnings, skipClosures, actions, rowActions = false) {
+	const { grant, label } = item;
+	if (grant.breakGlass !== void 0) {
+		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
+		return;
+	}
+	if (grant.closure !== void 0 || grant.portable === false) {
+		if (skipClosures) {
+			warnings.push(`skipped non-portable grant ${label}/${grant.permission.key}`);
+			return;
+		}
+		throw configError(`PermDock CLI: closure grant ${label}/${grant.permission.key} is not portable; rewrite it or pass --skip-closures`);
+	}
+	const context = [.../* @__PURE__ */ new Set([...contextRefs(item.where), ...contextRefs(grant.check)])];
+	if (context.length > 0) {
+		if (skipClosures) {
+			warnings.push(`skipped grant ${label}/${grant.permission.key}: it reads ${context.join(", ")}, which is not in the token`);
+			return;
+		}
+		throw configError(`PermDock CLI: grant ${label}/${grant.permission.key} reads ${context.join(", ")}; request context is not in the token, so RLS cannot compile it. Move the value to a server-set claim (principal.claims.*) or pass --skip-closures (permdock doctor PD027)`);
+	}
+	if (requiresApproval(grant.approval)) {
+		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
+		return;
+	}
+	const command = commandFor(grant.permission.action, actions);
+	const table = tableFor$1(grant.permission.resource, tables);
+	if (command === void 0) {
+		if (item.access.kind !== "role" && rowActions) return {
+			item,
+			command: "none",
+			table,
+			...item.where === void 0 ? {} : { using: item.where }
+		};
+		if (item.access.kind !== "role") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions) and only role grants are seeded`);
+			return;
+		}
+		if (grant.validity !== void 0 && grant.effect === "allow") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: a role_permissions row cannot carry validFrom / validUntil, so a time-bounded grant on an action with no SQL command is not seeded`);
+			return;
+		}
+		return {
+			item,
+			command: "none",
+			table,
+			...item.where === void 0 ? {} : { using: item.where },
+			...grant.check === void 0 ? {} : { check: grant.check }
+		};
+	}
+	const using = command === "insert" ? void 0 : item.where;
+	const check = command === "insert" ? grant.check ?? item.where : command === "update" ? grant.check ?? item.where : void 0;
+	return {
+		item,
+		command,
+		table,
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+function signature(entry, byFields) {
+	const base = [
+		entry.item.grant.effect,
+		entry.using ?? null,
+		entry.check ?? null
+	];
+	return JSON.stringify(byFields ? [...base, entry.item.grant.fields ?? null] : base);
+}
+/**
+* Grant keys per permission: the key is the permission, split into
+* `permission#n` when role grants carry different portable conditions (or
+* effects), one key per condition group; a group whose grants set `group`
+* is `permission#<group>` instead. With field views, grants that differ
+* only in `fields` get their own keys too, so a view can tell them apart.
+*/
+function assignKeys(entries, byFields) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (entry.item.access.kind !== "role") continue;
+		const key = entry.item.grant.permission.key;
+		const byCondition = groups.get(key) ?? /* @__PURE__ */ new Map();
+		const sig = signature(entry, byFields);
+		byCondition.set(sig, [...byCondition.get(sig) ?? [], entry]);
+		groups.set(key, byCondition);
+	}
+	const keys = /* @__PURE__ */ new Map();
+	for (const [permission, byCondition] of groups) {
+		const lists = [...byCondition.values()];
+		const named = /* @__PURE__ */ new Set();
+		for (const [index, list] of lists.entries()) {
+			const group = groupOf(permission, list);
+			if (group !== void 0 && named.has(group)) throw configError(`PermDock CLI: grants of ${permission} with different conditions share group '${group}'; a group names one condition`);
+			if (group !== void 0) named.add(group);
+			const grantKey = group !== void 0 ? `${permission}#${group}` : lists.length === 1 ? permission : `${permission}#${index + 1}`;
+			for (const entry of list) keys.set(entry, grantKey);
+		}
+	}
+	return keys;
+}
+function groupOf(permission, list) {
+	const names = [...new Set(list.flatMap((entry) => entry.item.grant.group === void 0 ? [] : [entry.item.grant.group]))].toSorted();
+	if (names.length > 1) throw configError(`PermDock CLI: grants of ${permission} with one condition name the groups ${names.join(", ")}; give them one group`);
+	return names[0];
+}
+/**
+* One entry per level for every allow of an assignable role on a resource
+* with levels, keyed `<grant key>@<level>`. Only `permdock_custom_keys`
+* hands these keys out, to a custom role whose stored allow names the level.
+*/
+function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
+	const custom = ctx.customRoles;
+	if (custom?.levels !== true) return [];
+	const assignable = new Set(custom.assignable);
+	const out = [];
+	for (const [entry, grantKey] of Array.from(keys)) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || !assignable.has(item.access.role)) continue;
+		if (grant.permission.key.includes("@")) throw configError(`PermDock CLI: permission key '${grant.permission.key}' holds '@', which separates a level in custom-role grant keys`);
+		for (const [level, condition] of policyLevels(policy, grant.permission.resource)) {
+			const where = andWhere(item.where, condition);
+			const prepared = prepare({
+				...item,
+				grant: leveled(grant, level, condition),
+				...where === void 0 ? {} : { where }
+			}, tables, warnings, skipClosures, ctx.actions);
+			if (prepared !== void 0) {
+				keys.set(prepared, `${grantKey}@${level}`);
+				out.push(prepared);
+			}
+		}
+	}
+	return out;
+}
+function compileOptional(condition, ctx) {
+	return condition === void 0 ? void 0 : compileConditionSql(condition, ctx);
+}
+function noteConditions(entry, warnings) {
+	const { label, grant } = entry.item;
+	const names = [...sqlFunctionNames(entry.using), ...sqlFunctionNames(entry.check)];
+	if (names.length > 0) warnings.push(`sqlFunction ${[...new Set(names)].join(", ")} on ${label}/${grant.permission.key} is portable via twin`);
+	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
+}
+/**
+* Compiles every grant (role and top-level) to branches whose role check is
+* a helper call keyed by grant key. Nothing in a branch is per-row except the
+* portable row condition and resource-membership joins.
+*/
+/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
+const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
+function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
+	const items = collectGrants(policy);
+	const entries = items.flatMap((item) => {
+		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions, rowActions);
+		return entry === void 0 ? [] : [entry];
+	});
+	const keys = assignKeys(entries, ctx.fields === "views");
+	entries.push(...levelEntries(policy, ctx, keys, tables, warnings, skipClosures));
+	const conditionedKeys = /* @__PURE__ */ new Set();
+	for (const [entry, grantKey] of keys) if (entry.using !== void 0 || entry.check !== void 0 || entry.item.grant.validity !== void 0 || entry.item.grant.requires !== void 0) conditionedKeys.add(grantKey);
+	const rows = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const holder = item.grant.breakGlass === void 0 ? void 0 : breakGlassHolder(item);
+		if (holder !== void 0) {
+			const row = {
+				role: holder.role,
+				permission: item.grant.permission.key,
+				grantKey: breakGlassKey(item.grant.permission.key),
+				scope: holder.scope,
+				effect: item.grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+	}
+	const branches = [];
+	const actionBranches = [];
+	const rowColumns = /* @__PURE__ */ new Map();
+	const filters = (resource, table, column) => {
+		rowColumns.set(`${table}\u0000${column}`, {
+			resource,
+			table,
+			column
+		});
+	};
+	const typed = /* @__PURE__ */ new Map();
+	const contextFor = (name) => {
+		const known = typed.get(name);
+		if (known !== void 0) return known;
+		const node = policy.resources.get(name);
+		const schema = node === void 0 ? void 0 : jsonSchemaOf(node);
+		const next = {
+			...ctx,
+			columnTypes: columnTypesOf(schema),
+			arrayColumns: arrayColumnsOf(schema)
+		};
+		typed.set(name, next);
+		return next;
+	};
+	for (const entry of entries) {
+		const { item, table } = entry;
+		const { grant, access, label } = item;
+		if (entry.command === "none") {
+			const grantKey = keys.get(entry);
+			if (access.kind === "role" && grantKey !== void 0) {
+				const row = {
+					role: access.role,
+					permission: grant.permission.key,
+					grantKey,
+					scope: access.scope,
+					effect: grant.effect
+				};
+				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+			}
+			if (!rowActions) continue;
+		}
+		const actionOnly = entry.command === "none";
+		const command = actionOnly ? "select" : entry.command;
+		const target = actionOnly ? actionBranches : branches;
+		const rowCtx = {
+			...contextFor(item.grant.permission.resource),
+			permission: grant.permission.key
+		};
+		noteConditions(entry, warnings);
+		for (const field of [...indexedFields(entry.using), ...indexedFields(entry.check)]) filters(grant.permission.resource, table, field);
+		const grantKey = keys.get(entry);
+		let accessExpr;
+		if (access.kind === "role" && grantKey !== void 0) {
+			const column = access.scope === "global" ? void 0 : scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
+			accessExpr = accessSql(ctx, access.scope, grantKey, column);
+			if (column !== void 0) filters(grant.permission.resource, table, column);
+			const row = {
+				role: access.role,
+				permission: grant.permission.key,
+				grantKey,
+				scope: access.scope,
+				effect: grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+		const linkOnly = access.kind === "resource" && ctx.capabilities === true && ctx.memberships?.resource?.[access.resource] === void 0;
+		if (access.kind === "actor") accessExpr = `${subjectClaimSql(ctx, "client_id")} is not null or ${subjectClaimJsonSql(ctx, "act")} is not null`;
+		if (access.kind === "resource" && !linkOnly) accessExpr = compileConditionSql(resourceCondition(item, policy, ctx), {
+			...ctx,
+			permission: grant.permission.key
+		});
+		if (linkOnly) warnings.push(`no ${access.resource} memberships table: only link capabilities reach ${label}/${grant.permission.key}`);
+		const validity = validitySql(grant.validity);
+		accessExpr = andSql(accessExpr, validity);
+		for (const key of grant.requires ?? []) accessExpr = andSql(accessExpr, requiresSql(ctx, key, policy.resources.get(grant.permission.resource)));
+		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
+		if (ctx.apiKeys !== void 0 && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
+			const calls = (requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []]).map((key) => `(select ${apiKeyAllowsCall(ctx, quoteLiteral(key))})`);
+			accessExpr = andSql(accessExpr, calls.length === 1 ? calls[0] ?? "" : `(${calls.join(" and ")})`);
+		}
+		const using = compileOptional(entry.using, rowCtx);
+		const check = compileOptional(entry.check, rowCtx);
+		const fields = grant.fields === void 0 ? {} : { fields: grant.fields };
+		if (!linkOnly) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: access.kind === "anyone" ? ["anon", "authenticated"] : ["authenticated"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			...grantKey === void 0 ? {} : { grantKey },
+			...accessExpr === void 0 ? {} : { access: accessExpr },
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+		const linked = ctx.capabilities === true ? capabilityAccess(item, policy, ctx) : void 0;
+		if (linked !== void 0) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: ["anon"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			access: andSql(linked, validity) ?? linked,
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+	}
+	return {
+		branches: ensureSelectCoverage(branches, warnings),
+		actionBranches,
+		rolePermissions: withAliasRows(policy, [...rows.values()]),
+		conditionedKeys,
+		rowColumns: [...rowColumns.values()],
+		levelReach: ctx.customRoles?.levels === true ? levelReachOf(policy, keys) : []
+	};
+}
+/**
+* Each row again under every key its permission was renamed from, so SQL that
+* still calls `permdock_has('<old key>')` keeps the access the current key
+* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
+* copied.
+*/
+function withAliasRows(policy, rows) {
+	const former = new Map(listPermissions(policy.permissions).map((leaf) => [leaf.key, formerKeys(leaf)]));
+	const out = [...rows];
+	for (const row of rows) {
+		const suffix = row.grantKey.slice(row.permission.length);
+		if (!row.grantKey.startsWith(row.permission) || suffix !== "" && (!/^#[a-z0-9][a-z0-9_-]*$/u.test(suffix) || suffix === "#break-glass")) continue;
+		for (const old of former.get(row.permission) ?? []) out.push({
+			...row,
+			permission: old,
+			grantKey: `${old}${suffix}`
+		});
+	}
+	return out;
+}
+/**
+* Postgres needs SELECT access to find rows for UPDATE / DELETE and for
+* RETURNING, so a table with only update or delete grants gets matching
+* SELECT branches.
+*/
+function ensureSelectCoverage(branches, warnings) {
+	const extra = [];
+	const readable = new Set(branches.filter((item) => item.command === "select" && item.effect === "allow").map((item) => item.table));
+	const covered = /* @__PURE__ */ new Set();
+	for (const item of branches) {
+		if (item.effect !== "allow" || item.command !== "update" && item.command !== "delete" || readable.has(item.table)) continue;
+		const { check: _check, ...rest } = item;
+		extra.push({
+			...rest,
+			command: "select",
+			coverage: true
+		});
+		if (!covered.has(item.table)) {
+			covered.add(item.table);
+			warnings.push(`added SELECT coverage for ${item.table} (${item.permissionKey})`);
+		}
+	}
+	return [...branches, ...extra];
+}
+//#endregion
+//#region src/cli/sql/helper-calls.ts
+/**
+* Tables whose policies other packages write by calling the SQL helpers
+* directly (storage buckets and realtime topics).
+*/
+const HELPER_TABLES = ["storage.objects", "realtime.messages"];
+const HELPER_CALL = new RegExp(String.raw`\b(${HELPERS.has}(?:_permission)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?)\s*\(\s*'((?:[^']|'')+)'(\s*,\s*(false\b)?)?`, "giu");
+const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}(?:_permission)?(?:_for)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?(?:_for)?|member_[a-z][a-z0-9_]*_ids(?:_for)?)\s*\(`, "iu");
+/** Whether a policy expression calls any generated helper, the key-less `member_<scope>_ids` included. */
+function callsHelper(sql) {
+	return ANY_HELPER.test(sql);
+}
+/**
+* The permission keys a policy expression passes to `permdock_has`,
+* `permitted_<scope>_ids` or their permission-key forms, `#n` stripped. With
+* `blind`, only the calls that ignore row conditions: the grant-key forms,
+* and a permission-key form asked for conditioned allows. A plain
+* `permdock_has_permission(key)` or `permitted_<scope>_ids_by_permission(key)`
+* counts only allows without a row condition, so it never grants more than
+* the application does.
+*/
+function helperCallKeys(sql, blind = false) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [, name = "", literal = "", extra, falsy] of sql.matchAll(HELPER_CALL)) {
+		const byPermission = /_permission$/iu.test(name);
+		if (blind && byPermission && (extra === void 0 || falsy !== void 0)) continue;
+		const key = beforeFirst(literal.replaceAll("''", "'"), "#");
+		if (key !== "") keys.add(key);
+	}
+	return [...keys];
+}
+const CREATE_POLICY = /\bcreate\s+policy\s+("(?:[^"]|"")+"|\w+)\s+on\s+((?:"[^"]+"|\w+)\.(?:"[^"]+"|\w+))([\s\S]*?);/giu;
+function tableName(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+function helperTable(name) {
+	const table = tableName(name);
+	return HELPER_TABLES.find((candidate) => candidate === table);
+}
+/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their condition-blind helper calls pass. */
+function helperTablePolicies(sql) {
+	const text = sql.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+	const found = [];
+	for (const [, name = "", target = "", body = ""] of text.matchAll(CREATE_POLICY)) {
+		const table = helperTable(target);
+		const keys = helperCallKeys(body, true);
+		if (table !== void 0 && keys.length > 0) found.push({
+			table,
+			name: name.replaceAll("\"", ""),
+			keys
+		});
+	}
+	return found;
+}
+/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db-url-stdin`. */
+const HELPER_TABLE_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, coalesce(qual, '') || ' ' || coalesce(with_check, '') as body
+from pg_policies
+where (schemaname, tablename) in (('storage', 'objects'), ('realtime', 'messages'))`;
+/** The same rows as {@link helperTablePolicies}, from `pg_policies`. */
+function helperTablePoliciesFromRows(rows) {
+	const found = [];
+	for (const row of rows) {
+		const table = helperTable(String(row["target"] ?? ""));
+		const keys = helperCallKeys(String(row["body"] ?? ""), true);
+		if (table !== void 0 && keys.length > 0) found.push({
+			table,
+			name: String(row["policyname"] ?? ""),
+			keys
+		});
+	}
+	return found;
+}
+/** The message PD037 and `rls verify --db-url-stdin` report for one policy. */
+function rowConditionMessage(policy, keys) {
+	return `${policy.table} policy '${policy.name}' calls the SQL helpers with ${keys.join(", ")}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`;
+}
+const ROW_CONDITION_FIX = "call permitted_<scope>_ids_by_permission('<key>') or permdock_has_permission('<key>'), which count only the allows without a row condition (a relationship grant never reaches a topic or a folder), or use a permission whose catalog entry has rowConditions: false";
+//#endregion
+//#region src/cli/rls/verify-pgtap.ts
+/** A custom role's scope and pinned instance, as the `custom_role_*` tables store them. */
+function customRoleAt(role, scopes) {
+	return {
+		scope: customRoleScope(role, scopes),
+		id: role.scope === void 0 ? role.team : role.id
+	};
+}
+function columnsOf(row) {
+	return isRecord(row) ? Object.entries(row).filter(([, value]) => value !== void 0 && typeof value !== "object") : [];
+}
+/**
+* The statement a fixture runs: `create` inserts the whole row, `update` writes
+* `newRow` when given. Each reads back only the key, so `--revoke-columns`
+* (which keeps only unrestricted columns readable) does not reject it.
+*/
+function statementFor(fixture, action, table) {
+	const quoted = quoteTable(table);
+	const id = quoteIdent("id");
+	const key = rowId(fixture.row);
+	const command = defaultSqlCommand(action) ?? "select";
+	switch (command) {
+		case "select": return {
+			sql: `select ${id} from ${quoted} where ${id} = $1`,
+			values: [key]
+		};
+		case "update": {
+			const next = columnsOf(fixture.newRow).filter(([name]) => name !== "id");
+			return {
+				sql: `update ${quoted} set ${next.length === 0 ? `${id} = ${id}` : next.map(([name], index) => `${quoteIdent(name)} = $${index + 2}`).join(", ")} where ${id} = $1 returning ${id}`,
+				values: [key, ...next.map(([, value]) => value)]
+			};
+		}
+		case "insert": {
+			const cols = columnsOf(fixture.row);
+			if (cols.length === 0) return {
+				sql: `insert into ${quoted} (${id}) values ($1) returning ${id}`,
+				values: [key]
+			};
+			return {
+				sql: `insert into ${quoted} (${cols.map(([name]) => quoteIdent(name)).join(", ")}) values (${cols.map((_, index) => `$${index + 1}`).join(", ")}) returning ${id}`,
+				values: cols.map(([, value]) => value)
+			};
+		}
+		case "delete": return {
+			sql: `delete from ${quoted} where ${id} = $1 returning ${id}`,
+			values: [key]
+		};
+		default: return command;
+	}
+}
+function rowId(row) {
+	if (isRecord(row) && "id" in row) return row["id"];
+}
+/** A fixture value as a SQL literal; untyped, so it coerces to the column like a bound parameter. */
+function sqlValue(value) {
+	if (value === null || value === void 0) return "null";
+	return quoteLiteral(typeof value === "string" ? value : JSON.stringify(value));
+}
+function inlineStatement(statement) {
+	return statement.sql.replaceAll(/\$(\d+)/gu, (_, index) => sqlValue(statement.values[Number(index) - 1]));
+}
+const PGTAP_DECISION = "pg_temp.permdock_decision";
+const PGTAP_DECISION_SQL = `create function ${PGTAP_DECISION}(statement text) returns text
+language plpgsql
+as $$
+declare
+  affected bigint;
+begin
+  execute statement;
+  get diagnostics affected = row_count;
+  return case when affected > 0 then 'granted' else 'denied' end;
+exception
+  when others then
+    return 'denied';
+end;
+$$;`;
+function subjectOf(config, customRoles, scopes) {
+	return {
+		dialect: config.rls?.dialect ?? "supabase",
+		gucPrefix: config.rls?.gucPrefix ?? "app",
+		tenantClaim: config.rls?.tenantClaim ?? "tenant_id",
+		roleClaim: config.rls?.roleClaim ?? "user_role",
+		customRoles,
+		scopes
+	};
+}
+/** The settings that bind a fixture's subject: the GUCs, or the Supabase JWT claims. */
+function subjectSettings(fixture, subject) {
+	const roles = fixture.subject.roles ?? [];
+	const memberships = membershipsClaim(fixture.subject.memberships ?? [], subject.customRoles, subject.scopes);
+	if (subject.dialect === "guc") {
+		const settings = [
+			[`${subject.gucPrefix}.user_id`, fixture.subject.id],
+			[`${subject.gucPrefix}.${subject.roleClaim}`, roles.join(",")],
+			[`${subject.gucPrefix}.memberships`, JSON.stringify(memberships)]
+		];
+		if (fixture.subject.tenant !== void 0) settings.push([`${subject.gucPrefix}.${subject.tenantClaim}`, fixture.subject.tenant]);
+		return settings;
+	}
+	const claims = {
+		...fixture.subject.claims,
+		sub: fixture.subject.id,
+		role: "authenticated",
+		[subject.roleClaim]: roles.length === 1 ? roles[0] : roles,
+		[subject.tenantClaim]: fixture.subject.tenant,
+		memberships
+	};
+	return [["request.jwt.claims", JSON.stringify(claims)]];
+}
+/** The `custom_role_*` rows for the fixtures' custom roles; existing rows are kept. */
+function customRoleRows(schema, customRoles, scopes) {
+	const table = (name) => `${quoteIdent(schema)}.${quoteIdent(name)}`;
+	const rows = [];
+	for (const role of customRoles) {
+		const at = customRoleAt(role, scopes);
+		if (at.scope === void 0) continue;
+		for (const grant of role.grants ?? []) rows.push({
+			sql: grant.level === void 0 ? `insert into ${table("custom_role_permissions")} (tenant_id, scope, scope_id, role, permission, effect) values ($1, $2, $3, $4, $5, $6) on conflict do nothing` : `insert into ${table("custom_role_permissions")} (tenant_id, scope, scope_id, role, permission, effect, level) values ($1, $2, $3, $4, $5, $6, $7) on conflict do nothing`,
+			values: [
+				role.tenant ?? null,
+				at.scope,
+				at.id ?? null,
+				role.name,
+				grant.permission,
+				grant.effect ?? "allow",
+				...grant.level === void 0 ? [] : [grant.level]
+			]
+		});
+		for (const name of role.includes ?? []) rows.push({
+			sql: `insert into ${table("custom_role_includes")} (tenant_id, scope, scope_id, role, include_role) values ($1, $2, $3, $4, $5) on conflict do nothing`,
+			values: [
+				role.tenant ?? null,
+				at.scope,
+				at.id ?? null,
+				role.name,
+				name
+			]
+		});
+	}
+	return rows;
+}
+function seedsCustomRoleTables(config) {
+	const rls = config.rls;
+	return customRolesOn(rls) && (rls?.authorize ?? rls?.rbac?.authorize ?? "jwt") === "database";
+}
+function customRoleSchema(config) {
+	return config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
+}
+/**
+* A pgTAP script that runs each fixture's statement under the fixture's
+* subject and asserts the outcome `can()` gave in-process.
+*/
+function emitPgtap(input) {
+	const scopes = scopeList(input.policy.scopes);
+	const subject = subjectOf(input.config, input.customRoles, scopes);
+	const lines = [
+		"begin;",
+		`select plan(${String(input.fixtures.length)});`,
+		PGTAP_DECISION_SQL
+	];
+	if (seedsCustomRoleTables(input.config)) for (const row of customRoleRows(customRoleSchema(input.config), input.customRoles, scopes)) lines.push(`${inlineStatement(row)};`);
+	for (const [index, fixture] of input.fixtures.entries()) {
+		const permission = findPermission(input.policy.permissions, fixture.action);
+		const status = input.inProcess[index];
+		const label = `fixture ${String(index)} ${fixture.action}`;
+		if (permission === void 0 || status === void 0) continue;
+		if (status.kind === "opaque") {
+			lines.push(`select skip(${quoteLiteral(`${label}: opaque grant untestable app-side`)}, 1);`);
+			continue;
+		}
+		const outcome = status.granted ? "granted" : "denied";
+		const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
+		const statement = inlineStatement(statementFor(fixture, permission.action, table));
+		lines.push(`-- ${label}`, "savepoint permdock_fixture;", "set local role \"authenticated\";", ...subjectSettings(fixture, subject).map(([name, value]) => `select set_config(${quoteLiteral(name)}, ${quoteLiteral(value)}, true);`), `select is(${PGTAP_DECISION}(${quoteLiteral(statement)}), ${quoteLiteral(outcome)}, ${quoteLiteral(`${label} ${outcome}`)});`, "rollback to savepoint permdock_fixture;");
+	}
+	lines.push("select * from finish();", "rollback;");
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls/graph.ts
+function tableFor(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+/** Every `related` condition the policy's grants compile to, with the resource graph they need, groups included. */
+function graphPlan(policy) {
+	const scopes = scopeList(policy.scopes);
+	const plan = /* @__PURE__ */ new Map();
+	const entryFor = (node) => {
+		const entry = plan.get(node.name) ?? {
+			node,
+			relations: /* @__PURE__ */ new Set(),
+			links: /* @__PURE__ */ new Set()
+		};
+		plan.set(node.name, entry);
+		return entry;
+	};
+	const addRelation = (node, relation) => {
+		const entry = entryFor(node);
+		if (entry.relations.has(relation)) return;
+		entry.relations.add(relation);
+		for (const name of expandRelation(node, relation)) {
+			const spec = node.relations[name];
+			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
+			for (const { resource, relation: groupRelation } of groupEntries(spec)) {
+				const target = policy.resources.get(resource);
+				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
+			}
+		}
+	};
+	const addLinks = (hops) => {
+		for (let index = 1; index < hops.length; index += 1) {
+			const from = policy.resources.get(hops[index - 1]?.resource ?? "");
+			const hop = hops[index];
+			if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
+		}
+	};
+	const addAbove = (above) => {
+		const node = above === void 0 ? void 0 : policy.resources.get(above.resource);
+		if (above === void 0 || node === void 0) return;
+		const entry = entryFor(node);
+		entry.closure = Math.max(entry.closure ?? 0, above.depth);
+		entry.restrictedAncestors = above;
+	};
+	for (const grant of policy.grants) {
+		const row = policy.resources.get(grant.permission.resource);
+		for (const item of flattenGrantee(grant.to)) {
+			if (item.kind === "inherit") {
+				const inherited = inheritCondition(item, row, policy.resources);
+				addLinks(inherited?.hops ?? []);
+				addAbove(inherited?.restrictedAncestors);
+				continue;
+			}
+			if (item.kind !== "relation") continue;
+			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
+			if (condition?.op !== "related") continue;
+			const node = policy.resources.get(condition.resource);
+			if (node === void 0) continue;
+			addRelation(node, condition.relation);
+			const entry = entryFor(node);
+			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
+			addLinks(condition.hops ?? []);
+			addAbove(condition.restrictedAncestors);
+		}
+	}
+	return plan;
+}
+/** The closure depth per walked resource, as `RlsSqlContext.graph` carries it. */
+function closureDepths(plan) {
+	const out = {};
+	for (const [name, entry] of plan) if (entry.closure !== void 0) out[name] = entry.closure;
+	return out;
+}
+/**
+* The `permitted_<resource>_ids(relation)` arm for one concrete relation:
+* ids of `resource` the subject holds it on, directly or through a group.
+* `asked` are the relation names that include it, so a call for any of them
+* (or for all, with null) reads this arm.
+*/
+function relationArm(ctx, plan, node, relation, asked, tables) {
+	const spec = node.relations[relation];
+	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw configError(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
+	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
+	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifySqlTable,
+		holders: (resource, groupRelation) => [{ text: `select ${qualified(ctx, graphHelper(resource))}(${quoteLiteral(groupRelation)})` }]
+	}), ctx)}) a\n  where ${guard}${activeUserSql(ctx).map((part) => ` and ${part}`).join("")}`;
+}
+function permittedSql(ctx, plan, entry, tables) {
+	const fn = qualified(ctx, graphHelper(entry.node.name));
+	const asked = [...entry.relations].toSorted();
+	const arms = [...new Set(asked.flatMap((name) => expandRelation(entry.node, name)))].toSorted().map((relation) => relationArm(ctx, plan, entry.node, relation, asked.filter((name) => expandRelation(entry.node, name).includes(relation)), tables));
+	if (arms.length === 0) arms.push("  select null::text where false");
+	return `-- ${entry.node.name}: ids the subject holds a relation on (all relations when p_relation is null)
+create or replace function ${fn}(p_relation text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+${arms.join("\n  union\n")}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+}
+/** `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points into `ids`, read past the table's own policies. */
+function linkSql(ctx, node, link, tables) {
+	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
+	if (spec === void 0) throw configError(`PermDock CLI: ${node.name} has no link '${link}'`);
+	const fn = qualified(ctx, linkHelper(node.name, link));
+	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
+create or replace function ${fn}(p_ids text[])
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select t.${quoteIdent(node.id)}::text from ${quoteQualified(tableFor(node.name, tables))} t
+  where t.${quoteIdent(spec.field)}::text = any(p_ids)
+$$;
+revoke execute on function ${fn}(text[]) from public, anon;
+grant execute on function ${fn}(text[]) to authenticated;`;
+}
+function closureTableSql(ctx) {
+	const table = qualified(ctx, CLOSURE.table);
+	return `-- the object graph: one row per (ancestor, descendant) within each walked resource's depth,
+-- never crossing a restricted row; kept current by statement triggers on each self-parented table
+create table if not exists ${table} (
+  resource text not null,
+  ancestor text not null,
+  descendant text not null,
+  depth integer not null check (depth >= 0),
+  primary key (resource, descendant, ancestor)
+);
+create index if not exists ${quoteIdent(`${CLOSURE.table}_ancestor`)} on ${table} (resource, ancestor);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;
+grant select on table ${table} to authenticated;`;
+}
+function closureObjectsSql(ctx, entry, depth, tables) {
+	const { node } = entry;
+	const parent = node.parent;
+	if (parent === void 0) return "";
+	const name = node.name;
+	const sqlName = graphSqlName(name) ?? name;
+	const closure = qualified(ctx, CLOSURE.table);
+	const table = quoteQualified(tableFor(name, tables));
+	const id = quoteIdent(node.id);
+	const up = quoteIdent(parent.field);
+	const restricted = restrictedFor(node, "parent");
+	const stop = restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(restricted)}, false)`;
+	const stopParent = restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(restricted)}, false)`;
+	const refresh = qualified(ctx, `${CLOSURE.table}_${sqlName}`);
+	const changed = qualified(ctx, `${CLOSURE.table}_${sqlName}_changed`);
+	const literal = quoteLiteral(name);
+	const restrictedChanged = restricted === void 0 ? "" : ` or n.${quoteIdent(restricted)} is distinct from o.${quoteIdent(restricted)}`;
+	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${sqlName}_${suffix}`);
+	return `-- ${name}: ${restricted === void 0 ? `rows reach their ancestors up to depth ${String(depth)}` : `rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row`}
+drop policy if exists ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure};
+create policy ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure}
+  for select to authenticated
+  using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
+create or replace function ${refresh}(p_ids text[])
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_cycle text;
+  v_affected text[];
+begin
+  with recursive walk(start, next, path) as (
+    select t.${id}, t.${up}, array[t.${id}::text]
+    from ${table} t
+    where t.${id}::text = any(p_ids)
+    union all
+    select walk.start, t.${up}, walk.path || t.${id}::text
+    from walk join ${table} t on t.${id} = walk.next
+    where not (walk.next::text = any(walk.path))
+  )
+  select walk.start::text into v_cycle
+  from walk
+  where walk.next::text = any(walk.path)
+  limit 1;
+  if v_cycle is not null then
+    raise exception 'permdock: % % is its own ancestor', ${literal}, v_cycle
+      using errcode = 'check_violation';
+  end if;
+  with recursive down(id, level) as (
+    select t.${id}, 0
+    from ${table} t
+    where t.${id}::text = any(p_ids) or t.${up}::text = any(p_ids)
+    union
+    select t.${id}, down.level + 1
+    from down join ${table} t on t.${up} = down.id
+    where down.level < ${String(depth)}
+  )
+  select coalesce(array_agg(distinct down.id::text), '{}') into v_affected from down;
+  delete from ${closure} c
+  where c.resource = ${literal}
+    and (c.descendant = any(p_ids) or c.descendant = any(v_affected));
+  insert into ${closure} (resource, ancestor, descendant, depth)
+  with recursive walk(descendant, ancestor, parent, depth, stop) as (
+    select t.${id}::text, t.${id}, t.${up}, 0, ${stop}
+    from ${table} t
+    where t.${id}::text = any(v_affected)
+    union all
+    select walk.descendant, p.${id}, p.${up}, walk.depth + 1, ${stopParent}
+    from walk join ${table} p on p.${id} = walk.parent
+    where not walk.stop and walk.depth < ${String(depth)}
+  )
+  select ${literal}, walk.ancestor::text, walk.descendant, walk.depth from walk
+  on conflict do nothing;
+end
+$$;
+revoke execute on function ${refresh}(text[]) from public, anon, authenticated;
+create or replace function ${changed}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'TRUNCATE' then
+    delete from ${closure} where resource = ${literal};
+  elsif tg_op = 'INSERT' then
+    perform ${refresh}(array(select n.${id}::text from new_rows n));
+  elsif tg_op = 'DELETE' then
+    perform ${refresh}(array(select o.${id}::text from old_rows o));
+  else
+    perform ${refresh}(array(
+      select n.${id}::text
+      from new_rows n left join old_rows o on o.${id} = n.${id}
+      where o.${id} is null or n.${up} is distinct from o.${up}${restrictedChanged}
+      union
+      select o.${id}::text
+      from old_rows o left join new_rows n on n.${id} = o.${id}
+      where n.${id} is null
+    ));
+  end if;
+  return null;
+end
+$$;
+revoke execute on function ${changed}() from public, anon, authenticated;
+drop trigger if exists ${trigger("insert")} on ${table};
+create trigger ${trigger("insert")} after insert on ${table}
+  referencing new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("update")} on ${table};
+create trigger ${trigger("update")} after update on ${table}
+  referencing old table as old_rows new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("delete")} on ${table};
+create trigger ${trigger("delete")} after delete on ${table}
+  referencing old table as old_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("truncate")} on ${table};
+create trigger ${trigger("truncate")} after truncate on ${table}
+  for each statement execute function ${changed}();
+select ${refresh}(array(select t.${id}::text from ${table} t));`;
+}
+function restrictedRowsHelperSql(ctx, plan, entry, tables) {
+	const above = entry.restrictedAncestors;
+	if (above === void 0) return "";
+	const fn = qualified(ctx, restrictedHelper(entry.node.name));
+	const body = graphSqlText(restrictedRowsSql(above, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifySqlTable,
+		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
+		closureDepths: closureDepths(plan)
+	}), ctx);
+	return `-- ${entry.node.name}: rows a stopped link does not reach below: restricted, under a restricted row within ${String(above.depth - 1)} levels, or deeper
+create or replace function ${fn}()
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  ${body}
+$$;
+revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;`;
+}
+/** Group resources a resource's asked relations name, other than itself. */
+function groupTargets(entry) {
+	const out = /* @__PURE__ */ new Set();
+	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
+		const spec = entry.node.relations[name];
+		const resources = isEdgeRelation(spec) ? groupEntries(spec).map((group) => group.resource) : [];
+		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
+	}
+	return [...out].toSorted();
+}
+/** Plan entries by name, each after the group resources its helper calls (SQL function bodies are checked on create). */
+function dependencyOrder(plan) {
+	const out = [];
+	const done = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		const entry = plan.get(name);
+		if (entry === void 0 || done.has(name)) return;
+		done.add(name);
+		for (const target of groupTargets(entry)) visit(target);
+		out.push(entry);
+	};
+	for (const name of [...plan.keys()].toSorted()) visit(name);
+	return out;
+}
+/**
+* The graph preamble: `permitted_<resource>_ids` for every resource a graph
+* grant reads, and the closure table with its triggers for every
+* self-parented resource a grant walks. Empty when no grant is a graph grant.
+*/
+function graphSql(ctx, plan, tables) {
+	if (plan.size === 0) return "";
+	const sqlNames = /* @__PURE__ */ new Map();
+	for (const name of plan.keys()) {
+		const helper = graphHelper(name);
+		const sql = graphSqlName(name) ?? name;
+		if (ctx.scopes.some((scope) => scope.name === sql)) throw configError(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
+		const other = sqlNames.get(sql);
+		if (other !== void 0) throw configError(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
+		sqlNames.set(sql, name);
+	}
+	const entries = dependencyOrder(plan);
+	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 && entry.closure === void 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
+	const walked = entries.filter((entry) => entry.closure !== void 0);
+	if (walked.length > 0) {
+		chunks.push(closureTableSql(ctx));
+		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
+		for (const entry of walked) {
+			const helper = restrictedRowsHelperSql(ctx, plan, entry, tables);
+			if (helper !== "") chunks.push(helper);
+		}
+	}
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls/verify-tree.ts
+const SYSTEM_ENTROPY = Object.freeze({
+	now: () => nowMillis(),
+	randomUUID: () => randomUUID()
+});
+const SUBJECTS = 3;
+function idFactory(node, entropy) {
+	const type = columnTypesOf(jsonSchemaOf(node))[node.id];
+	let next = 9e5;
+	return type === "numeric" ? () => {
+		next += 1;
+		return next;
+	} : () => entropy.randomUUID();
+}
+/**
+* Two spines one level deeper than the walk depth, so the depth cap is
+* crossed; side branches under the first levels alternate restricted, and
+* the second spine is restricted two levels down.
+*/
+function generateTree(node, depth, entropy) {
+	const id = idFactory(node, entropy);
+	const nodes = [];
+	for (const spine of [0, 1]) {
+		let parent = null;
+		for (let level = 0; level <= depth + 1; level += 1) {
+			const current = id();
+			nodes.push({
+				id: current,
+				parent,
+				restricted: node.restricted !== void 0 && spine === 1 && level === 2
+			});
+			if (spine === 0 && level >= 1 && level <= 3) {
+				const side = id();
+				nodes.push({
+					id: side,
+					parent: current,
+					restricted: node.restricted !== void 0 && level % 2 === 1
+				});
+				nodes.push({
+					id: id(),
+					parent: side,
+					restricted: false
+				});
+			}
+			parent = current;
+		}
+	}
+	return nodes;
+}
+function insertSql(table, rows) {
+	const columns = Object.keys(rows[0] ?? {});
+	const values = [];
+	const tuples = rows.map((row) => `(${columns.map((column) => {
+		values.push(row[column]);
+		return `$${String(values.length)}`;
+	}).join(", ")})`);
+	return {
+		sql: `insert into ${quoteQualified(table)} (${columns.map(quoteIdent).join(", ")}) values ${tuples.join(", ")} returning *`,
+		values
+	};
+}
+const REQUIRED_COLUMNS_SQL = `select a.attname as name,
+  format_type(a.atttypid, a.atttypmod) as type,
+  k.confrelid::regclass::text as "refTable",
+  r.attname as "refColumn",
+  (select e.enumlabel from pg_enum e where e.enumtypid = a.atttypid order by e.enumsortorder limit 1) as "enumLabel",
+  array(
+    select pg_get_constraintdef(c.oid) from pg_constraint c
+    where c.conrelid = a.attrelid and c.contype = 'c' and c.conkey = array[a.attnum]
+    order by c.conname
+  ) as checks
+from pg_attribute a
+left join pg_constraint k
+  on k.conrelid = a.attrelid and k.contype = 'f' and k.conkey = array[a.attnum]
+left join pg_attribute r
+  on r.attrelid = k.confrelid and r.attnum = k.confkey[1]
+where a.attrelid = $1::regclass and a.attnum > 0 and not a.attisdropped
+  and a.attnotnull and not a.atthasdef
+  and a.attidentity = '' and a.attgenerated = ''`;
+const UNIQUE_COLUMNS_SQL = `select distinct a.attname as name
+from pg_index i
+join pg_attribute a on a.attrelid = i.indrelid
+where i.indrelid = $1::regclass and i.indisunique
+  and a.attnum > 0 and not a.attisdropped
+  and (
+    a.attnum = any(i.indkey)
+    or exists (
+      select 1 from pg_depend d
+      where d.classid = 'pg_class'::regclass and d.objid = i.indexrelid
+        and d.refclassid = 'pg_class'::regclass and d.refobjid = i.indrelid
+        and d.refobjsubid = a.attnum
+    )
+  )`;
+function checkedValue(checks) {
+	for (const check of checks) {
+		const literal = /'((?:[^']|'')*)'/u.exec(check);
+		if (literal?.[1] !== void 0 && /[=]|\bin\b/iu.test(check)) return literal[1].replaceAll("''", "'");
+		const bound = /(>=?)\s*\(?(-?\d+(?:\.\d+)?)/u.exec(check);
+		if (bound?.[1] !== void 0 && bound[2] !== void 0) {
+			const value = Number(bound[2]);
+			return bound[1] === ">" ? Math.floor(value) + 1 : value;
+		}
+	}
+}
+function placeholder(column, entropy) {
+	if (column.enumLabel !== null) return column.enumLabel;
+	const checked = checkedValue(column.checks);
+	if (checked !== void 0) return checked;
+	const type = column.type;
+	if (type === "uuid") return entropy.randomUUID();
+	if (type === "boolean") return false;
+	if (/^(smallint|integer|bigint|numeric|real|double precision)/u.test(type)) return 0;
+	if (type.startsWith("timestamp") || type === "date") return isoAt(entropy.now());
+	if (type === "json" || type === "jsonb") return {};
+	return "permdock-tree";
+}
+function distinctPlaceholder(column, index, entropy) {
+	const value = placeholder(column, entropy);
+	if (column.enumLabel !== null) return value;
+	if (typeof value === "number") return value + index;
+	if (typeof value !== "string" || checkedValue(column.checks) !== void 0) return value;
+	if (column.type === "uuid") return value;
+	if (column.type.startsWith("timestamp") || column.type === "date") return isoAt(Date.parse(value) + index * 864e5);
+	return `${value}-${String(index + 1)}`;
+}
+function asRequiredColumn(row) {
+	const { name, type, refTable, refColumn, enumLabel, checks } = row;
+	if (typeof name !== "string" || typeof type !== "string") return;
+	return {
+		name,
+		type,
+		refTable: typeof refTable === "string" ? refTable : null,
+		refColumn: typeof refColumn === "string" ? refColumn : null,
+		enumLabel: typeof enumLabel === "string" ? enumLabel : null,
+		checks: Array.isArray(checks) ? checks.filter((check) => typeof check === "string") : []
+	};
+}
+/**
+* Values for the required columns a generated row leaves out, such as a
+* tenant column or a name: an existing value of the referenced table for a
+* foreign key, a placeholder of the column's type otherwise.
+*/
+async function requiredValues(query, table, set, entropy) {
+	const columns = (await query(REQUIRED_COLUMNS_SQL, [table])).rows.map(asRequiredColumn).filter((column) => column !== void 0 && !set.has(column.name));
+	const unique = new Set(columns.length === 0 ? [] : (await query(UNIQUE_COLUMNS_SQL, [table])).rows.map((row) => String(row["name"])));
+	const values = {};
+	const distinct = [];
+	for (const column of columns) if (column.refTable !== null && column.refColumn !== null) {
+		const existing = await query(`select ${quoteIdent(column.refColumn)} as value from ${column.refTable} limit 1`);
+		values[column.name] = existing.rows[0]?.["value"] ?? null;
+	} else if (unique.has(column.name)) distinct.push(column);
+	else values[column.name] = placeholder(column, entropy);
+	return (index) => {
+		const row = { ...values };
+		for (const column of distinct) row[column.name] = distinctPlaceholder(column, index, entropy);
+		return row;
+	};
+}
+/** Inserts `rows` after filling the required columns they leave out. */
+async function seedRows(query, table, rows, given, entropy) {
+	const fill = await requiredValues(query, quoteQualified(table), /* @__PURE__ */ new Set([...Object.keys(rows[0] ?? {}), ...Object.keys(given)]), entropy);
+	const inserted = insertSql(table, rows.map((row, index) => ({
+		...fill(index),
+		...given,
+		...row
+	})));
+	return (await query(inserted.sql, inserted.values)).rows;
+}
+/**
+* Parity between `decide` and RLS on a generated object graph: for every
+* self-parented resource a graph grant walks, a tree with restricted
+* branches and a chain past the walk depth, child rows under it, and edges
+* for a few generated principals. Everything runs in one transaction that
+* is rolled back.
+*/
+async function verifyTree(input) {
+	const { policy, query } = input;
+	const entropy = input.entropy ?? SYSTEM_ENTROPY;
+	const tables = input.config.rls?.tables;
+	const treeValues = input.config.rls?.treeValues ?? {};
+	const seed = (table, list) => seedRows(query, table, list, treeValues[table] ?? {}, entropy);
+	const walked = [...graphPlan(policy).values()].filter((entry) => entry.closure !== void 0);
+	if (walked.length === 0) return {
+		checked: 0,
+		granted: 0,
+		mismatches: [],
+		notes: ["no graph grant walks a self-parented resource"]
+	};
+	const subjects = Array.from({ length: SUBJECTS }, () => entropy.randomUUID());
+	const rows = {};
+	const edges = {};
+	const now = entropy.now();
+	for (const entry of walked) {
+		const node = entry.node;
+		const parent = node.parent;
+		if (parent === void 0) continue;
+		const tree = generateTree(node, entry.closure ?? 0, entropy);
+		const seeded = tree.map((item, index) => {
+			const row = {
+				[node.id]: item.id,
+				[parent.field]: item.parent
+			};
+			if (node.restricted !== void 0) row[node.restricted] = item.restricted;
+			for (const name of entry.relations) {
+				const spec = node.relations[name];
+				const column = isFieldRelation(spec) ? spec.memberOf === void 0 ? spec.field : void 0 : isPrincipalRelation(spec) ? spec.principal : void 0;
+				if (column !== void 0 && column !== parent.field) row[column] = index % 4 === 0 ? subjects[index % SUBJECTS] : entropy.randomUUID();
+			}
+			return row;
+		});
+		if ([...entry.relations].some((name) => {
+			const spec = node.relations[name];
+			return isPrincipalRelation(spec) && spec.principal === parent.field || isFieldRelation(spec) && spec.field === parent.field;
+		})) subjects.push(...tree.filter((_, index) => index % 3 === 0).map((item) => String(item.id)));
+		rows[node.name] = [...await seed(tables?.[node.name] ?? node.name, seeded)];
+		for (const name of entry.relations) {
+			const spec = node.relations[name];
+			if (!isEdgeRelation(spec)) continue;
+			const object = spec.object ?? `${node.name}_id`;
+			const subject = spec.subject ?? "user_id";
+			const list = [];
+			const edgeRows = [];
+			for (const [index, item] of tree.entries()) {
+				const holder = subjects[index % SUBJECTS];
+				if (holder === void 0 || index % 5 !== 1) continue;
+				const expiresAt = spec.expiresAt !== void 0 && index % 10 === 6 ? now - 864e5 : void 0;
+				edgeRows.push({
+					[object]: item.id,
+					[subject]: holder,
+					...spec.expiresAt === void 0 ? {} : { [spec.expiresAt]: expiresAt === void 0 ? null : isoAt(expiresAt) }
+				});
+				list.push({
+					id: String(item.id),
+					principal: holder,
+					...expiresAt === void 0 ? {} : { expiresAt: expiresAt / 1e3 }
+				});
+			}
+			if (edgeRows.length > 0) await seed(spec.edge, edgeRows);
+			edges[node.name] = {
+				...edges[node.name],
+				[name]: list
+			};
+		}
+		for (const child of policy.resources.values()) {
+			if (child.name === node.name || child.parent?.resource !== node.name) continue;
+			const make = idFactory(child, entropy);
+			const childRows = tree.map((item, index) => {
+				const row = {
+					[child.id]: make(),
+					[child.parent?.field ?? ""]: item.id
+				};
+				if (child.restricted !== void 0) row[child.restricted] = index % 7 === 3;
+				return row;
+			});
+			rows[child.name] = [...await seed(tables?.[child.name] ?? child.name, childRows)];
+		}
+	}
+	const relations = memoryRelationSource(policy.permissions, {
+		rows,
+		edges
+	});
+	const mismatches = [];
+	let checked = 0;
+	let granted = 0;
+	const reads = listPermissions(policy.permissions).filter((leaf) => leaf.kind === "instance" && commandFor(leaf.action, input.config.rls?.actions) === "select" && rows[leaf.resource] !== void 0);
+	for (const subject of subjects) {
+		const permdock = await getPermDock(policy, {
+			principal: {
+				id: subject,
+				roles: []
+			},
+			context: {}
+		}, { relations });
+		await input.bind(subject);
+		for (const permission of reads) {
+			const node = policy.resources.get(permission.resource);
+			const list = rows[permission.resource] ?? [];
+			if (node === void 0 || list.length === 0) continue;
+			const ids = list.map((row) => String(row[node.id]));
+			const visible = await query(`select ${quoteIdent(node.id)}::text as id from ${quoteQualified(tables?.[node.name] ?? node.name)} where ${quoteIdent(node.id)} = any($1)`, [ids]);
+			const seen = new Set(visible.rows.map((row) => String(row["id"])));
+			for (const row of list) {
+				checked += 1;
+				const id = String(row[node.id]);
+				const allowed = permdock.can(permission, row);
+				if (allowed !== seen.has(id)) mismatches.push(`${permission.key} ${id}: in-process ${allowed ? "granted" : "denied"}, database ${seen.has(id) ? "allowed" : "filtered"}`);
+				else if (allowed) granted += 1;
+			}
+		}
+	}
+	return {
+		checked,
+		granted,
+		mismatches,
+		notes: []
+	};
+}
+//#endregion
+//#region src/cli/rls/verify-database.ts
+/** Columns of `row` that hold a value; a masked column reads as null. */
+function valuedColumns(row) {
+	return isRecord(row) ? Object.keys(row).filter((name) => row[name] !== null && row[name] !== void 0).toSorted() : [];
+}
+/**
+* What a field view returns for a row: nothing for a denied row, otherwise
+* `pick`'s columns with a value plus the key, which always passes through.
+*/
+function expectedFields(granted, picked, key, row) {
+	if (!granted) return [];
+	const kept = new Set(valuedColumns(picked));
+	if (isRecord(row) && row[key] !== null && row[key] !== void 0) kept.add(key);
+	return [...kept].toSorted();
+}
+function fieldsMismatch(fixture, want, seen) {
+	const kept = want.join(", ");
+	if (typeof seen === "string") return [`${fixture.action}: field view read failed (${seen}), pick keeps [${kept}]`];
+	return seen.join(", ") === kept ? [] : [`${fixture.action} ${String(rowId(fixture.row))}: field view returns [${seen.join(", ")}], pick keeps [${kept}]`];
+}
+/** The field view's columns for the fixture's row: the view, or the table itself when no grant limits its fields. */
+async function viewFields(query, table, key) {
+	const view = quoteTable(viewName(table, FIELD_VIEWS.view));
+	const id = quoteIdent("id");
+	await query("savepoint permdock_fields");
+	const result = await query(`select * from ${view} where ${id} = $1`, [key]);
+	if (result.code === void 0) return valuedColumns(result.rows[0]);
+	await query("rollback to savepoint permdock_fields");
+	if (result.code !== "42P01") return result.code;
+	const base = await query(`select * from ${quoteTable(table)} where ${id} = $1`, [key]);
+	return base.code ?? valuedColumns(base.rows[0]);
+}
+/** Writes the custom roles into the `database`-mode tables; the fixture transaction rolls them back. */
+async function seedCustomRoles(query, schema, customRoles, scopes) {
+	for (const row of customRoleRows(schema, customRoles, scopes)) {
+		const result = await query(row.sql, row.values);
+		if (result.code !== void 0) throw new Error(`PermDock CLI: rls verify --db-url-stdin could not seed custom roles (${result.code}); connect as a role that owns the custom_role_* tables`);
+	}
+}
+async function bindSubject(query, fixture, subject) {
+	await query("set local role \"authenticated\"");
+	for (const [name, value] of subjectSettings(fixture, subject)) await query("select set_config($1, $2, true)", [name, value]);
+}
+async function verifyAgainstDatabase(input) {
+	const client = await input.connect(input.db);
+	const seedsTables = seedsCustomRoleTables(input.config);
+	const schema = customRoleSchema(input.config);
+	const scopes = scopeList(input.policy.scopes);
+	const subject = subjectOf(input.config, input.customRoles, scopes);
+	const query = async (sql, values) => {
+		try {
+			const result = await client.query(sql, values === void 0 ? [] : [...values]);
+			return {
+				rows: result.rows,
+				rowCount: result.rowCount ?? result.rows.length
+			};
+		} catch (cause) {
+			const code = cause !== null && typeof cause === "object" && "code" in cause && typeof cause.code === "string" ? cause.code : void 0;
+			return {
+				rows: [],
+				rowCount: 0,
+				...code === void 0 ? {} : { code }
+			};
+		}
+	};
+	const mismatches = [];
+	const notes = [];
+	try {
+		const conditioned = policyRowConditionKeys(input.policy);
+		for (const found of helperTablePoliciesFromRows((await query(HELPER_TABLE_POLICIES_SQL)).rows)) {
+			const keys = found.keys.filter((key) => conditioned.has(key));
+			if (keys.length > 0) mismatches.push(`PD037 ${rowConditionMessage(found, keys)}`);
+		}
+		for (const [index, fixture] of input.fixtures.entries()) {
+			const permission = findPermission(input.policy.permissions, fixture.action);
+			const status = input.inProcess[index];
+			if (permission === void 0 || status === void 0) continue;
+			if (status.kind === "opaque") {
+				notes.push(`${fixture.action}: opaque grant untestable app-side`);
+				continue;
+			}
+			const table = input.config.rls?.tables?.[permission.resource] ?? permission.resource;
+			await query("begin");
+			try {
+				if (seedsTables) await seedCustomRoles(query, schema, input.customRoles, scopes);
+				await bindSubject(query, fixture, subject);
+				const statement = statementFor(fixture, permission.action, table);
+				const result = await query(statement.sql, statement.values);
+				const count = result.rowCount ?? result.rows.length;
+				const database = result.code === "42501" ? "rejected" : count > 0 ? "allowed" : "filtered";
+				if (!(status.granted ? database === "allowed" : database === "filtered" || database === "rejected")) mismatches.push(`${fixture.action}: in-process ${status.granted ? "granted" : "denied"}, database ${database}`);
+				else if (status.kind === "sqlFunction") notes.push(`${fixture.action}: verified through twin`);
+				mismatches.push(...status.fields === void 0 ? [] : fieldsMismatch(fixture, status.fields, await viewFields(query, table, rowId(fixture.row))));
+			} finally {
+				await query("rollback");
+			}
+		}
+	} finally {
+		await client.end();
+	}
+	return {
+		mismatches,
+		notes
+	};
+}
+/** `--tree`: seeds a generated object graph in a rolled-back transaction and compares `can()` with RLS. */
+async function verifyTreeAgainstDatabase(db, policy, config, connect) {
+	const client = await connect(db);
+	const scopes = scopeList(policy.scopes);
+	const query = async (sql, values) => {
+		return { rows: (await client.query(sql, values === void 0 ? [] : [...values])).rows };
+	};
+	const loose = async (sql, values) => {
+		await query(sql, values);
+		return { rows: [] };
+	};
+	try {
+		await query("begin");
+		const result = await verifyTree({
+			policy,
+			config,
+			query,
+			bind: (subject) => bindSubject(loose, {
+				subject: { id: subject },
+				row: {},
+				action: "read"
+			}, subjectOf(config, [], scopes))
+		});
+		if (result.mismatches.length > 0) return {
+			code: 1,
+			output: [...result.mismatches, ...result.notes].join("\n")
+		};
+		const verified = `verified ${String(result.checked)} tree check(s) against the database (${String(result.granted)} granted)`;
+		return {
+			code: 0,
+			output: result.notes.length === 0 ? verified : `${verified}\n${result.notes.join("\n")}`
+		};
+	} catch (cause) {
+		return {
+			code: 2,
+			output: `PermDock CLI: rls verify --tree could not seed the tree (${describeError(cause)}); connect as a role that owns the tables and is a member of authenticated`
+		};
+	} finally {
+		await client.query("rollback", []).catch(() => void 0);
+		await client.end();
+	}
+}
+//#endregion
+//#region src/cli/rls/verify.ts
+function canFixture(permdock, permission, row) {
+	if (permission.kind === "collection") return permdock.can(permission, row);
+	return permdock.can(permission, row);
+}
+function grantKind(policy, key) {
+	const grants = policy.grants.filter((grant) => grant.permission.key === key);
+	if (grants.some((grant) => hasConditionOp(grant.where, "opaque") || hasConditionOp(grant.check, "opaque"))) return "opaque";
+	if (grants.some((grant) => hasConditionOp(grant.where, "sqlFunction") || hasConditionOp(grant.check, "sqlFunction"))) return "sqlFunction";
+	return "portable";
+}
+async function runRlsVerify(input) {
+	const connect = input.connect ?? pgConnector("permdock rls verify --db-url-stdin", input.cwd);
+	const policyPath = input.from ?? input.config.policy;
+	if (policyPath === void 0) return {
+		code: 2,
+		output: "PermDock CLI: rls verify needs policy in the config or --policy"
+	};
+	const policy = await loadPolicyAt(input.cwd, policyPath);
+	if (input.tree === true) {
+		if (input.db === void 0) return {
+			code: 2,
+			output: "PermDock CLI: rls verify --tree needs a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
+		};
+		try {
+			return await verifyTreeAgainstDatabase(input.db, policy, input.config, connect);
+		} catch (cause) {
+			return usageResult(cause);
+		}
+	}
+	const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
+	const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
+	const mismatches = [];
+	const notes = [];
+	const inProcess = [];
+	const fieldsMode = input.config.rls?.fields === "views";
+	for (const fixture of fixtures) {
+		const permission = findPermission(policy.permissions, fixture.action);
+		if (permission === void 0) {
+			mismatches.push(`${fixture.action}: unknown permission`);
+			inProcess.push({
+				action: fixture.action,
+				granted: false,
+				kind: "portable"
+			});
+			continue;
+		}
+		const kind = grantKind(policy, fixture.action);
+		const permdock = await getPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) });
+		const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
+		const outcome = granted ? "granted" : "denied";
+		if (fixture.expected !== void 0 && fixture.expected !== outcome) mismatches.push(`${fixture.action}: in-process ${outcome}, expected ${fixture.expected}`);
+		if (kind === "opaque") notes.push(`${fixture.action}: opaque grant untestable app-side`);
+		const fields = fieldsMode && permission.kind === "instance" && commandFor(permission.action, input.config.rls?.actions) === "select" ? expectedFields(granted, permdock.pick(permission, fixture.row), policy.resources.get(permission.resource)?.id ?? "id", fixture.row) : void 0;
+		inProcess.push({
+			action: fixture.action,
+			granted,
+			kind,
+			...fields === void 0 ? {} : { fields }
+		});
+	}
+	if (input.format === "pgtap") return mismatches.length > 0 ? {
+		code: 1,
+		output: mismatches.join("\n")
+	} : {
+		code: 0,
+		output: emitPgtap({
+			fixtures,
+			inProcess,
+			policy,
+			config: input.config,
+			customRoles
+		})
+	};
+	if (input.db !== void 0) try {
+		const database = await verifyAgainstDatabase({
+			db: input.db,
+			policy,
+			fixtures,
+			customRoles,
+			config: input.config,
+			inProcess,
+			connect
+		});
+		mismatches.push(...database.mismatches);
+		notes.push(...database.notes);
+	} catch (cause) {
+		return usageResult(cause);
+	}
+	if (mismatches.length > 0) return {
+		code: 1,
+		output: [...mismatches, ...notes].join("\n")
+	};
+	const verified = `verified ${String(fixtures.length)} fixture(s) ${input.db === void 0 ? "in-process" : "in-process and against the database"}`;
+	return {
+		code: 0,
+		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
+	};
+}
+//#endregion
+export { indexesSql as _, graphSql as a, callsHelper as c, rowConditionMessage as d, commandFor as f, indexTargets as g, COLUMNS_SQL as h, graphPlan as i, helperCallKeys as l, tableFor$1 as m, runRlsVerify as n, HELPER_TABLES as o, compileGrants as p, closureDepths as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u, pruneIndexTargets as v, readTableIndexFacts as y };