permdock 0.4.0 → 0.5.0

package/dist/{verify-BztUB3GX.js → verify-DbCL9bnB.js}

@@ -1,25 +1,624 @@
-import { r as isRecord } from "./compact-CAf557ZB.js";
-import { a as hasConditionOp } from "./refs-f3imMjNW.js";
-import { f as memoryRelations, g as memoryRoleSource } from "./src-Bb7no-hS.js";
-import { d as scopeList } from "./scopes-tvpa34ep.js";
-import { c as listPermissions, n as findPermission } from "./permission-registry-BsblpB-z.js";
-import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
-import { o as flattenGrantee } from "./grantee-CXY-0C87.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-MQs5NIuX.js";
-import { g as customRoleScope, t as createPermDock, v as membershipsClaim } from "./permdock-L26udHSk.js";
-import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
+import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
+import { a as hasConditionOp, c as isConditionRef } from "./refs-K6eWUJ0H.js";
+import { E as memoryCustomRoleSource, g as memoryRelationSource } from "./src-DLfUWFAI.js";
+import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { f as nowMillis, u as isoAt } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { d as scopeList } from "./scopes-CUPSjo9q.js";
+import { o as requiresStandIn } from "./delegation-DaXVdDhM.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { p as scopeField } from "./tenancy-DN2QAx9z.js";
+import { s as policyLevels } from "./policy-DLZJ5gAp.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { _ as membershipsClaim, c as andWhere, g as leveled, p as customRoleScope } from "./evaluate-_R8QkWaf.js";
+import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-CWTY6uih.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DWtg0gGR.js";
-import { o as loadPolicyAt } from "./load-C3_oTHyO.js";
-import { c as relationArmSql, u as restrictedRowsSql } from "./compile-CcEu2ZQ1.js";
+import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { o as loadPolicyAt } from "./load-DFS_ry0W.js";
+import { c as relationArmSql, u as restrictedRowsSql } from "./compile-CMqMx_IN.js";
 import "./budget-NbEtbJC_.js";
-import { r as qualifySqlTable } from "./sql-t8teWOfo.js";
-import "./sources-B1-b-R0t.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-h2eG2OZV.js";
-import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, a as customRolesOn, j as helperSchema, r as HELPERS } from "./shared-1uhI-e-b.js";
-import { I as linkHelper, J as activeUserSql, M as graphHelper, N as graphSqlName, P as graphSqlText, W as restrictedHelper, Z as pgConnector, j as CLOSURE } from "./permission-keys-B26jeyUv.js";
-import { p as commandFor, s as viewName, t as FIELD_VIEWS } from "./fields-fwfXN01n.js";
-import { randomUUID } from "node:crypto";
+import { i as qualifySqlTable, n as defaultSqlCommand } from "./sql-B5T1IL83.js";
+import "./sources-vs5dGOsS.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
+import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as helperSchema, r as HELPERS, v as subjectClaimSql, w as arrayColumnsOf } from "./shared-CD11nBbC.js";
+import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-CO1oOymN.js";
+import { B as linkHelper, D as breakGlassHolder, F as graphHelper, I as graphSqlName, J as restrictedHelper, L as graphSqlText, M as contextRefs, N as sqlFunctionNames, O as breakGlassKey, P as CLOSURE, Q as activeUserSql, X as scopeTable, j as compileConditionSql, k as collectGrants, m as accessSql, p as requiresSql, v as capabilityAccessSql, w as apiKeyAllowsCall } from "./ownership-BatFgAA4.js";
+import { s as viewName, t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { createHash, randomUUID } from "node:crypto";
+//#region src/cli/rls/indexes.ts
+/** Postgres truncates identifiers longer than this, in bytes. */
+const MAX_IDENT = 63;
+/**
+* The row fields `condition` compares with the subject, a claim or a
+* membership (`ownerId: principal.id`, `memberOf`), through `and` and `or`:
+* the selective comparisons an index serves. A comparison with a constant
+* (`status: 'sent'`) narrows rows the scope key already found, a negation
+* scans anyway, and a dotted field is a JSON path a plain index does not serve.
+*/
+function indexedFields(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "and":
+		case "or": return condition.conditions.flatMap(indexedFields);
+		case "memberOf": return plainField(condition.field);
+		case "eq":
+		case "in": return isConditionRef(condition.value) ? plainField(condition.field) : [];
+		case "not":
+		case "sqlFunction":
+		case "opaque":
+		case "related":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "notIn":
+		case "isNull":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+function plainField(field) {
+	return field.includes(".") ? [] : [field];
+}
+/**
+* Every index the generated SQL reads through: the row columns policies
+* filter on (scope keys and selective condition fields), and the membership
+* tables' user column, followed by the scope column the helpers select.
+*/
+function indexTargets(ctx, rowColumns) {
+	const targets = /* @__PURE__ */ new Map();
+	const add = (table, columns) => {
+		const target = {
+			table: qualifySqlTable(table),
+			columns
+		};
+		targets.set(`${target.table}\u0000${columns[0] ?? ""}`, target);
+	};
+	for (const { table, column } of rowColumns) add(table, [column]);
+	for (const scope of ctx.scopes) {
+		const mapped = scopeTable(ctx, scope.name);
+		if (mapped !== void 0) add(mapped.table.table, [mapped.table.user, mapped.column]);
+	}
+	for (const source of [...ctx.sources ?? [], ...ctx.memberSources ?? []]) {
+		add(source.sql.table, [source.sql.user]);
+		const users = source.sql.userThrough;
+		if (users !== void 0) add(users.table, [users.key]);
+	}
+	return [...targets.values()].toSorted((a, b) => `${a.table}.${a.columns.join(",")}` < `${b.table}.${b.columns.join(",")}` ? -1 : 1);
+}
+/** A stable index name under Postgres' identifier limit. */
+function indexName(target) {
+	const name = `permdock_${target.table.slice(target.table.lastIndexOf(".") + 1)}_${target.columns.join("_")}_idx`;
+	if (Buffer.byteLength(name) <= MAX_IDENT) return name;
+	return `permdock_${createHash("sha256").update(name).digest("hex").slice(0, 8)}_idx`;
+}
+/** `create index if not exists` for every target, one per line. */
+function indexesSql(targets) {
+	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
+}
+/** Every live column of the tables in `$1` (`schema.table`), as `target` and `name`. */
+const COLUMNS_SQL = `select n.nspname || '.' || c.relname as target, a.attname as name
+from pg_attribute a
+join pg_class c on c.oid = a.attrelid
+join pg_namespace n on n.oid = c.relnamespace
+where a.attnum > 0 and not a.attisdropped
+  and n.nspname || '.' || c.relname = any($1::text[])`;
+const INDEX_COLUMNS_SQL = `select n.nspname || '.' || c.relname as target,
+  array(
+    select a.attname::text
+    from unnest(i.indkey) with ordinality k(attnum, ord)
+    left join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum and k.attnum > 0
+    where k.ord <= i.indnkeyatts
+    order by k.ord
+  ) as columns
+from pg_index i
+join pg_class c on c.oid = i.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
+function strings(value) {
+	return Array.isArray(value) ? value.map((item) => typeof item === "string" ? item : null) : [];
+}
+/** Reads the columns and index key columns of `tables` (`schema.table`). */
+async function readTableIndexFacts(db, tables, connect = (url) => connectPgPool(url, "permdock rls generate --db-url-stdin")) {
+	const client = await connect(db);
+	try {
+		const [columns, indexes] = await Promise.all([client.query(COLUMNS_SQL, [[...tables]]), client.query(INDEX_COLUMNS_SQL, [[...tables]])]);
+		const byTable = {};
+		for (const row of columns.rows) (byTable[String(row["target"])] ??= []).push(String(row["name"]));
+		const keys = {};
+		for (const row of indexes.rows) {
+			const list = strings(row["columns"]);
+			const end = list.indexOf(null);
+			const lead = end === -1 ? list : list.slice(0, end);
+			if (lead.length > 0) (keys[String(row["target"])] ??= []).push(lead);
+		}
+		return {
+			columns: byTable,
+			indexes: keys
+		};
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Drops the targets a database already serves or cannot hold: a target on a
+* table or column the database lacks (with a warning), and one an existing
+* index leads with (its key columns start with the target's).
+*/
+function pruneIndexTargets(targets, facts) {
+	const warnings = [];
+	return {
+		targets: targets.filter((target) => {
+			const columns = facts.columns[target.table];
+			if (columns === void 0) {
+				warnings.push(`no index suggested on ${target.table}: the database has no such table`);
+				return false;
+			}
+			const absent = target.columns.filter((column) => !columns.includes(column));
+			if (absent.length > 0) {
+				warnings.push(`no index suggested on ${target.table} (${target.columns.join(", ")}): the table has no column ${absent.join(", ")}`);
+				return false;
+			}
+			return !(facts.indexes[target.table] ?? []).some((index) => target.columns.every((column, at) => index[at] === column));
+		}),
+		warnings
+	};
+}
+//#endregion
+//#region src/cli/sql/compile.ts
+/**
+* The levels an allow reaches: every level without a row condition, else the
+* levels whose condition equals its condition.
+*/
+function reachedLevels(where, levels) {
+	if (where === void 0) return levels.map(([name]) => name);
+	const held = canonicalJson(where);
+	return levels.filter(([, condition]) => canonicalJson(condition) === held).map(([name]) => name);
+}
+function levelReachOf(policy, keys) {
+	const reach = /* @__PURE__ */ new Map();
+	for (const [entry, grantKey] of keys) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || grant.level !== void 0) continue;
+		const levels = policyLevels(policy, grant.permission.resource);
+		if (levels.length > 0) {
+			const set = reach.get(grantKey) ?? /* @__PURE__ */ new Set();
+			for (const name of reachedLevels(grant.where, levels)) set.add(name);
+			reach.set(grantKey, set);
+		}
+	}
+	const out = [];
+	for (const grantKey of new Set(keys.values())) {
+		const at = grantKey.lastIndexOf("@");
+		const base = at === -1 ? grantKey : grantKey.slice(0, at);
+		const level = at === -1 ? void 0 : grantKey.slice(at + 1);
+		for (const name of reach.get(base) ?? []) if (level === void 0 || level === name) out.push([grantKey, name]);
+	}
+	return out.toSorted(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
+}
+/**
+* The SQL command `action` compiles to: `rls.actions` first, then the six default verbs.
+* Any other verb is `undefined`, as `'none'` is: no policy, and its grants are still seeded.
+*/
+function commandFor(action, actions) {
+	if (actions !== void 0 && Object.hasOwn(actions, action)) {
+		const configured = actions[action];
+		return configured === "none" ? void 0 : configured;
+	}
+	return defaultSqlCommand(action);
+}
+function tableFor$1(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+function ancestorsOf(policy, name) {
+	const names = [];
+	let current = policy.resources.get(name);
+	while (current?.parent !== void 0 && !names.includes(current.parent.resource)) {
+		names.push(current.parent.resource);
+		current = policy.resources.get(current.parent.resource);
+	}
+	return names;
+}
+function membershipField(policy, resource, holder) {
+	if (resource === void 0) return;
+	if (resource.name === holder) return resource.id ?? "id";
+	let current = resource;
+	const seen = /* @__PURE__ */ new Set();
+	while (current?.parent !== void 0 && !seen.has(current.name)) {
+		seen.add(current.name);
+		if (current.parent.resource === holder) return current.parent.field;
+		current = policy.resources.get(current.parent.resource);
+	}
+}
+function resourceCondition(item, policy, ctx) {
+	if (item.access.kind !== "resource") throw configError("PermDock CLI: resourceCondition needs a resource role");
+	const { role, resource: roleResource } = item.access;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const holders = [roleResource, ...ancestorsOf(policy, roleResource)];
+	const hops = [];
+	for (const [index, holder] of holders.entries()) {
+		const field = membershipField(policy, target, holder);
+		if (field === void 0) continue;
+		if (index > 0 && ctx.memberships?.resource?.[holder] === void 0) continue;
+		hops.push({
+			op: "memberOf",
+			scope: "resource",
+			field,
+			roles: [role],
+			resource: holder
+		});
+	}
+	return sole(hops) ?? {
+		op: "or",
+		conditions: hops
+	};
+}
+/**
+* The access a link capability has to a resource-scoped grant, over the same
+* holders as `resourceCondition`. It reads the claim, so ancestor hops need
+* no memberships table. `undefined` when no holder is on the row's chain.
+*/
+function capabilityAccess(item, policy, ctx) {
+	if (item.access.kind !== "resource") return;
+	const { role, resource: roleResource } = item.access;
+	const kinds = ctx.ownership?.kinds[role];
+	if (kinds !== void 0 && !kinds.includes("link")) return;
+	const target = policy.resources.get(item.grant.permission.resource);
+	const hops = [];
+	for (const holder of [roleResource, ...ancestorsOf(policy, roleResource)]) {
+		const field = membershipField(policy, target, holder);
+		if (field !== void 0) hops.push(capabilityAccessSql(ctx, field, holder, role, item.grant.permission.key));
+	}
+	if (hops.length === 0) return;
+	return hops.length === 1 ? hops[0] : hops.map(wrapSql).join(" or ");
+}
+function prepare(item, tables, warnings, skipClosures, actions, rowActions = false) {
+	const { grant, label } = item;
+	if (grant.breakGlass !== void 0) {
+		warnings.push(`break-glass grant ${label}/${grant.permission.key} reads through permdock_break_glass_${grant.permission.resource}, not a policy`);
+		return;
+	}
+	if (grant.closure !== void 0 || grant.portable === false) {
+		if (skipClosures) {
+			warnings.push(`skipped non-portable grant ${label}/${grant.permission.key}`);
+			return;
+		}
+		throw configError(`PermDock CLI: closure grant ${label}/${grant.permission.key} is not portable; rewrite it or pass --skip-closures`);
+	}
+	const context = [.../* @__PURE__ */ new Set([...contextRefs(item.where), ...contextRefs(grant.check)])];
+	if (context.length > 0) {
+		if (skipClosures) {
+			warnings.push(`skipped grant ${label}/${grant.permission.key}: it reads ${context.join(", ")}, which is not in the token`);
+			return;
+		}
+		throw configError(`PermDock CLI: grant ${label}/${grant.permission.key} reads ${context.join(", ")}; request context is not in the token, so RLS cannot compile it. Move the value to a server-set claim (principal.claims.*) or pass --skip-closures (permdock doctor PD027)`);
+	}
+	if (requiresApproval(grant.approval)) {
+		warnings.push(`skipped approval grant ${label}/${grant.permission.key}`);
+		return;
+	}
+	const command = commandFor(grant.permission.action, actions);
+	const table = tableFor$1(grant.permission.resource, tables);
+	if (command === void 0) {
+		if (item.access.kind !== "role" && rowActions) return {
+			item,
+			command: "none",
+			table,
+			...item.where === void 0 ? {} : { using: item.where }
+		};
+		if (item.access.kind !== "role") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: action '${grant.permission.action}' has no SQL command (rls.actions) and only role grants are seeded`);
+			return;
+		}
+		if (grant.validity !== void 0 && grant.effect === "allow") {
+			warnings.push(`skipped ${label}/${grant.permission.key}: a role_permissions row cannot carry validFrom / validUntil, so a time-bounded grant on an action with no SQL command is not seeded`);
+			return;
+		}
+		return {
+			item,
+			command: "none",
+			table,
+			...item.where === void 0 ? {} : { using: item.where },
+			...grant.check === void 0 ? {} : { check: grant.check }
+		};
+	}
+	const using = command === "insert" ? void 0 : item.where;
+	const check = command === "insert" ? grant.check ?? item.where : command === "update" ? grant.check ?? item.where : void 0;
+	return {
+		item,
+		command,
+		table,
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+function signature(entry, byFields) {
+	const base = [
+		entry.item.grant.effect,
+		entry.using ?? null,
+		entry.check ?? null
+	];
+	return JSON.stringify(byFields ? [...base, entry.item.grant.fields ?? null] : base);
+}
+/**
+* Grant keys per permission: the key is the permission, split into
+* `permission#n` when role grants carry different portable conditions (or
+* effects), one key per condition group; a group whose grants set `group`
+* is `permission#<group>` instead. With field views, grants that differ
+* only in `fields` get their own keys too, so a view can tell them apart.
+*/
+function assignKeys(entries, byFields) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (entry.item.access.kind !== "role") continue;
+		const key = entry.item.grant.permission.key;
+		const byCondition = groups.get(key) ?? /* @__PURE__ */ new Map();
+		const sig = signature(entry, byFields);
+		byCondition.set(sig, [...byCondition.get(sig) ?? [], entry]);
+		groups.set(key, byCondition);
+	}
+	const keys = /* @__PURE__ */ new Map();
+	for (const [permission, byCondition] of groups) {
+		const lists = [...byCondition.values()];
+		const named = /* @__PURE__ */ new Set();
+		for (const [index, list] of lists.entries()) {
+			const group = groupOf(permission, list);
+			if (group !== void 0 && named.has(group)) throw configError(`PermDock CLI: grants of ${permission} with different conditions share group '${group}'; a group names one condition`);
+			if (group !== void 0) named.add(group);
+			const grantKey = group !== void 0 ? `${permission}#${group}` : lists.length === 1 ? permission : `${permission}#${index + 1}`;
+			for (const entry of list) keys.set(entry, grantKey);
+		}
+	}
+	return keys;
+}
+function groupOf(permission, list) {
+	const names = [...new Set(list.flatMap((entry) => entry.item.grant.group === void 0 ? [] : [entry.item.grant.group]))].toSorted();
+	if (names.length > 1) throw configError(`PermDock CLI: grants of ${permission} with one condition name the groups ${names.join(", ")}; give them one group`);
+	return names[0];
+}
+/**
+* One entry per level for every allow of an assignable role on a resource
+* with levels, keyed `<grant key>@<level>`. Only `permdock_custom_keys`
+* hands these keys out, to a custom role whose stored allow names the level.
+*/
+function levelEntries(policy, ctx, keys, tables, warnings, skipClosures) {
+	const custom = ctx.customRoles;
+	if (custom?.levels !== true) return [];
+	const assignable = new Set(custom.assignable);
+	const out = [];
+	for (const [entry, grantKey] of Array.from(keys)) {
+		const { item } = entry;
+		const { grant } = item;
+		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || !assignable.has(item.access.role)) continue;
+		if (grant.permission.key.includes("@")) throw configError(`PermDock CLI: permission key '${grant.permission.key}' holds '@', which separates a level in custom-role grant keys`);
+		for (const [level, condition] of policyLevels(policy, grant.permission.resource)) {
+			const where = andWhere(item.where, condition);
+			const prepared = prepare({
+				...item,
+				grant: leveled(grant, level, condition),
+				...where === void 0 ? {} : { where }
+			}, tables, warnings, skipClosures, ctx.actions);
+			if (prepared !== void 0) {
+				keys.set(prepared, `${grantKey}@${level}`);
+				out.push(prepared);
+			}
+		}
+	}
+	return out;
+}
+function compileOptional(condition, ctx) {
+	return condition === void 0 ? void 0 : compileConditionSql(condition, ctx);
+}
+function noteConditions(entry, warnings) {
+	const { label, grant } = entry.item;
+	const names = [...sqlFunctionNames(entry.using), ...sqlFunctionNames(entry.check)];
+	if (names.length > 0) warnings.push(`sqlFunction ${[...new Set(names)].join(", ")} on ${label}/${grant.permission.key} is portable via twin`);
+	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
+}
+/**
+* Compiles every grant (role and top-level) to branches whose role check is
+* a helper call keyed by grant key. Nothing in a branch is per-row except the
+* portable row condition and resource-membership joins.
+*/
+/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
+const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
+function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
+	const items = collectGrants(policy);
+	const entries = items.flatMap((item) => {
+		const entry = prepare(item, tables, warnings, skipClosures, ctx.actions, rowActions);
+		return entry === void 0 ? [] : [entry];
+	});
+	const keys = assignKeys(entries, ctx.fields === "views");
+	entries.push(...levelEntries(policy, ctx, keys, tables, warnings, skipClosures));
+	const conditionedKeys = /* @__PURE__ */ new Set();
+	for (const [entry, grantKey] of keys) if (entry.using !== void 0 || entry.check !== void 0 || entry.item.grant.validity !== void 0 || entry.item.grant.requires !== void 0) conditionedKeys.add(grantKey);
+	const rows = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const holder = item.grant.breakGlass === void 0 ? void 0 : breakGlassHolder(item);
+		if (holder !== void 0) {
+			const row = {
+				role: holder.role,
+				permission: item.grant.permission.key,
+				grantKey: breakGlassKey(item.grant.permission.key),
+				scope: holder.scope,
+				effect: item.grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+	}
+	const branches = [];
+	const actionBranches = [];
+	const rowColumns = /* @__PURE__ */ new Map();
+	const filters = (resource, table, column) => {
+		rowColumns.set(`${table}\u0000${column}`, {
+			resource,
+			table,
+			column
+		});
+	};
+	const typed = /* @__PURE__ */ new Map();
+	const contextFor = (name) => {
+		const known = typed.get(name);
+		if (known !== void 0) return known;
+		const node = policy.resources.get(name);
+		const schema = node === void 0 ? void 0 : jsonSchemaOf(node);
+		const next = {
+			...ctx,
+			columnTypes: columnTypesOf(schema),
+			arrayColumns: arrayColumnsOf(schema)
+		};
+		typed.set(name, next);
+		return next;
+	};
+	for (const entry of entries) {
+		const { item, table } = entry;
+		const { grant, access, label } = item;
+		if (entry.command === "none") {
+			const grantKey = keys.get(entry);
+			if (access.kind === "role" && grantKey !== void 0) {
+				const row = {
+					role: access.role,
+					permission: grant.permission.key,
+					grantKey,
+					scope: access.scope,
+					effect: grant.effect
+				};
+				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+			}
+			if (!rowActions) continue;
+		}
+		const actionOnly = entry.command === "none";
+		const command = actionOnly ? "select" : entry.command;
+		const target = actionOnly ? actionBranches : branches;
+		const rowCtx = {
+			...contextFor(item.grant.permission.resource),
+			permission: grant.permission.key
+		};
+		noteConditions(entry, warnings);
+		for (const field of [...indexedFields(entry.using), ...indexedFields(entry.check)]) filters(grant.permission.resource, table, field);
+		const grantKey = keys.get(entry);
+		let accessExpr;
+		if (access.kind === "role" && grantKey !== void 0) {
+			const column = access.scope === "global" ? void 0 : scopeField(policy.resources.get(grant.permission.resource), access.scope, policy.scopes);
+			accessExpr = accessSql(ctx, access.scope, grantKey, column);
+			if (column !== void 0) filters(grant.permission.resource, table, column);
+			const row = {
+				role: access.role,
+				permission: grant.permission.key,
+				grantKey,
+				scope: access.scope,
+				effect: grant.effect
+			};
+			rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
+		}
+		const linkOnly = access.kind === "resource" && ctx.capabilities === true && ctx.memberships?.resource?.[access.resource] === void 0;
+		if (access.kind === "actor") accessExpr = `${subjectClaimSql(ctx, "client_id")} is not null or ${subjectClaimJsonSql(ctx, "act")} is not null`;
+		if (access.kind === "resource" && !linkOnly) accessExpr = compileConditionSql(resourceCondition(item, policy, ctx), {
+			...ctx,
+			permission: grant.permission.key
+		});
+		if (linkOnly) warnings.push(`no ${access.resource} memberships table: only link capabilities reach ${label}/${grant.permission.key}`);
+		const validity = validitySql(grant.validity);
+		accessExpr = andSql(accessExpr, validity);
+		for (const key of grant.requires ?? []) accessExpr = andSql(accessExpr, requiresSql(ctx, key, policy.resources.get(grant.permission.resource)));
+		if (ctx.anonymousSignIns === "deny" && access.kind !== "anyone") accessExpr = andSql(accessExpr, PERMANENT_USER);
+		if (ctx.apiKeys !== void 0 && grant.effect === "allow" && access.kind !== "anyone" && access.kind !== "role") {
+			const calls = (requiresStandIn(grant) ? grant.requires ?? [] : [grant.permission.key, ...grant.requires ?? []]).map((key) => `(select ${apiKeyAllowsCall(ctx, quoteLiteral(key))})`);
+			accessExpr = andSql(accessExpr, calls.length === 1 ? calls[0] ?? "" : `(${calls.join(" and ")})`);
+		}
+		const using = compileOptional(entry.using, rowCtx);
+		const check = compileOptional(entry.check, rowCtx);
+		const fields = grant.fields === void 0 ? {} : { fields: grant.fields };
+		if (!linkOnly) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: access.kind === "anyone" ? ["anon", "authenticated"] : ["authenticated"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			...grantKey === void 0 ? {} : { grantKey },
+			...accessExpr === void 0 ? {} : { access: accessExpr },
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+		const linked = ctx.capabilities === true ? capabilityAccess(item, policy, ctx) : void 0;
+		if (linked !== void 0) target.push({
+			table,
+			command,
+			effect: grant.effect,
+			roles: ["anon"],
+			label,
+			resource: grant.permission.resource,
+			permissionKey: grant.permission.key,
+			...fields,
+			access: andSql(linked, validity) ?? linked,
+			...using === void 0 ? {} : { using },
+			...check === void 0 ? {} : { check }
+		});
+	}
+	return {
+		branches: ensureSelectCoverage(branches, warnings),
+		actionBranches,
+		rolePermissions: withAliasRows(policy, [...rows.values()]),
+		conditionedKeys,
+		rowColumns: [...rowColumns.values()],
+		levelReach: ctx.customRoles?.levels === true ? levelReachOf(policy, keys) : []
+	};
+}
+/**
+* Each row again under every key its permission was renamed from, so SQL that
+* still calls `permdock_has('<old key>')` keeps the access the current key
+* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
+* copied.
+*/
+function withAliasRows(policy, rows) {
+	const former = new Map(listPermissions(policy.permissions).map((leaf) => [leaf.key, formerKeys(leaf)]));
+	const out = [...rows];
+	for (const row of rows) {
+		const suffix = row.grantKey.slice(row.permission.length);
+		if (!row.grantKey.startsWith(row.permission) || suffix !== "" && (!/^#[a-z0-9][a-z0-9_-]*$/u.test(suffix) || suffix === "#break-glass")) continue;
+		for (const old of former.get(row.permission) ?? []) out.push({
+			...row,
+			permission: old,
+			grantKey: `${old}${suffix}`
+		});
+	}
+	return out;
+}
+/**
+* Postgres needs SELECT access to find rows for UPDATE / DELETE and for
+* RETURNING, so a table with only update or delete grants gets matching
+* SELECT branches.
+*/
+function ensureSelectCoverage(branches, warnings) {
+	const extra = [];
+	const readable = new Set(branches.filter((item) => item.command === "select" && item.effect === "allow").map((item) => item.table));
+	const covered = /* @__PURE__ */ new Set();
+	for (const item of branches) {
+		if (item.effect !== "allow" || item.command !== "update" && item.command !== "delete" || readable.has(item.table)) continue;
+		const { check: _check, ...rest } = item;
+		extra.push({
+			...rest,
+			command: "select",
+			coverage: true
+		});
+		if (!covered.has(item.table)) {
+			covered.add(item.table);
+			warnings.push(`added SELECT coverage for ${item.table} (${item.permissionKey})`);
+		}
+	}
+	return [...branches, ...extra];
+}
+//#endregion
 //#region src/cli/sql/helper-calls.ts
 /**
 * Tables whose policies other packages write by calling the SQL helpers
@@ -46,7 +645,7 @@ function helperCallKeys(sql, blind = false) {
 	for (const [, name = "", literal = "", extra, falsy] of sql.matchAll(HELPER_CALL)) {
 		const byPermission = /_permission$/iu.test(name);
 		if (blind && byPermission && (extra === void 0 || falsy !== void 0)) continue;
-		const key = literal.replaceAll("''", "'").split("#")[0] ?? "";
+		const key = beforeFirst(literal.replaceAll("''", "'"), "#");
 		if (key !== "") keys.add(key);
 	}
 	return [...keys];
@@ -74,7 +673,7 @@ function helperTablePolicies(sql) {
 	}
 	return found;
 }
-/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db`. */
+/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db-url-stdin`. */
 const HELPER_TABLE_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, coalesce(qual, '') || ' ' || coalesce(with_check, '') as body
 from pg_policies
 where (schemaname, tablename) in (('storage', 'objects'), ('realtime', 'messages'))`;
@@ -92,7 +691,7 @@ function helperTablePoliciesFromRows(rows) {
 	}
 	return found;
 }
-/** The message PD037 and `rls verify --db` report for one policy. */
+/** The message PD037 and `rls verify --db-url-stdin` report for one policy. */
 function rowConditionMessage(policy, keys) {
 	return `${policy.table} policy '${policy.name}' calls the SQL helpers with ${keys.join(", ")}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`;
 }
@@ -118,10 +717,9 @@ function statementFor(fixture, action, table) {
 	const quoted = quoteTable(table);
 	const id = quoteIdent("id");
 	const key = rowId(fixture.row);
-	switch (action) {
-		case "read":
-		case "list":
-		case "get": return {
+	const command = defaultSqlCommand(action) ?? "select";
+	switch (command) {
+		case "select": return {
 			sql: `select ${id} from ${quoted} where ${id} = $1`,
 			values: [key]
 		};
@@ -132,7 +730,7 @@ function statementFor(fixture, action, table) {
 				values: [key, ...next.map(([, value]) => value)]
 			};
 		}
-		case "create": {
+		case "insert": {
 			const cols = columnsOf(fixture.row);
 			if (cols.length === 0) return {
 				sql: `insert into ${quoted} (${id}) values ($1) returning ${id}`,
@@ -147,10 +745,7 @@ function statementFor(fixture, action, table) {
 			sql: `delete from ${quoted} where ${id} = $1 returning ${id}`,
 			values: [key]
 		};
-		default: return {
-			sql: `select ${id} from ${quoted} where ${id} = $1`,
-			values: [key]
-		};
+		default: return command;
 	}
 }
 function rowId(row) {
@@ -363,7 +958,7 @@ function closureDepths(plan) {
 */
 function relationArm(ctx, plan, node, relation, asked, tables) {
 	const spec = node.relations[relation];
-	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw new Error(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
+	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw configError(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
 	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
 	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
 		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
@@ -393,7 +988,7 @@ grant execute on function ${fn}(text) to authenticated;`;
 /** `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points into `ids`, read past the table's own policies. */
 function linkSql(ctx, node, link, tables) {
 	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
-	if (spec === void 0) throw new Error(`PermDock CLI: ${node.name} has no link '${link}'`);
+	if (spec === void 0) throw configError(`PermDock CLI: ${node.name} has no link '${link}'`);
 	const fn = qualified(ctx, linkHelper(node.name, link));
 	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
 create or replace function ${fn}(p_ids text[])
@@ -607,9 +1202,9 @@ function graphSql(ctx, plan, tables) {
 	for (const name of plan.keys()) {
 		const helper = graphHelper(name);
 		const sql = graphSqlName(name) ?? name;
-		if (ctx.scopes.some((scope) => scope.name === sql)) throw new Error(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
+		if (ctx.scopes.some((scope) => scope.name === sql)) throw configError(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
 		const other = sqlNames.get(sql);
-		if (other !== void 0) throw new Error(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
+		if (other !== void 0) throw configError(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
 		sqlNames.set(sql, name);
 	}
 	const entries = dependencyOrder(plan);
@@ -628,7 +1223,7 @@ function graphSql(ctx, plan, tables) {
 //#endregion
 //#region src/cli/rls/verify-tree.ts
 const SYSTEM_ENTROPY = Object.freeze({
-	now: () => Date.now(),
+	now: () => nowMillis(),
 	randomUUID: () => randomUUID()
 });
 const SUBJECTS = 3;
@@ -738,7 +1333,7 @@ function placeholder(column, entropy) {
 	if (type === "uuid") return entropy.randomUUID();
 	if (type === "boolean") return false;
 	if (/^(smallint|integer|bigint|numeric|real|double precision)/u.test(type)) return 0;
-	if (type.startsWith("timestamp") || type === "date") return new Date(entropy.now()).toISOString();
+	if (type.startsWith("timestamp") || type === "date") return isoAt(entropy.now());
 	if (type === "json" || type === "jsonb") return {};
 	return "permdock-tree";
 }
@@ -748,7 +1343,7 @@ function distinctPlaceholder(column, index, entropy) {
 	if (typeof value === "number") return value + index;
 	if (typeof value !== "string" || checkedValue(column.checks) !== void 0) return value;
 	if (column.type === "uuid") return value;
-	if (column.type.startsWith("timestamp") || column.type === "date") return new Date(Date.parse(value) + index * 864e5).toISOString();
+	if (column.type.startsWith("timestamp") || column.type === "date") return isoAt(Date.parse(value) + index * 864e5);
 	return `${value}-${String(index + 1)}`;
 }
 function asRequiredColumn(row) {
@@ -851,16 +1446,16 @@ async function verifyTree(input) {
 			for (const [index, item] of tree.entries()) {
 				const holder = subjects[index % SUBJECTS];
 				if (holder === void 0 || index % 5 !== 1) continue;
-				const expiresAt = spec.expiresAt !== void 0 && index % 10 === 6 ? /* @__PURE__ */ new Date(now - 864e5) : void 0;
+				const expiresAt = spec.expiresAt !== void 0 && index % 10 === 6 ? now - 864e5 : void 0;
 				edgeRows.push({
 					[object]: item.id,
 					[subject]: holder,
-					...spec.expiresAt === void 0 ? {} : { [spec.expiresAt]: expiresAt ?? null }
+					...spec.expiresAt === void 0 ? {} : { [spec.expiresAt]: expiresAt === void 0 ? null : isoAt(expiresAt) }
 				});
 				list.push({
 					id: String(item.id),
 					principal: holder,
-					...expiresAt === void 0 ? {} : { expiresAt: expiresAt.getTime() / 1e3 }
+					...expiresAt === void 0 ? {} : { expiresAt: expiresAt / 1e3 }
 				});
 			}
 			if (edgeRows.length > 0) await seed(spec.edge, edgeRows);
@@ -883,7 +1478,7 @@ async function verifyTree(input) {
 			rows[child.name] = [...await seed(tables?.[child.name] ?? child.name, childRows)];
 		}
 	}
-	const relations = memoryRelations(policy.permissions, {
+	const relations = memoryRelationSource(policy.permissions, {
 		rows,
 		edges
 	});
@@ -892,7 +1487,7 @@ async function verifyTree(input) {
 	let granted = 0;
 	const reads = listPermissions(policy.permissions).filter((leaf) => leaf.kind === "instance" && commandFor(leaf.action, input.config.rls?.actions) === "select" && rows[leaf.resource] !== void 0);
 	for (const subject of subjects) {
-		const permdock = await createPermDock(policy, {
+		const permdock = await getPermDock(policy, {
 			principal: {
 				id: subject,
 				roles: []
@@ -960,7 +1555,7 @@ async function viewFields(query, table, key) {
 async function seedCustomRoles(query, schema, customRoles, scopes) {
 	for (const row of customRoleRows(schema, customRoles, scopes)) {
 		const result = await query(row.sql, row.values);
-		if (result.code !== void 0) throw new Error(`PermDock CLI: rls verify --db could not seed custom roles (${result.code}); connect as a role that owns the custom_role_* tables`);
+		if (result.code !== void 0) throw new Error(`PermDock CLI: rls verify --db-url-stdin could not seed custom roles (${result.code}); connect as a role that owns the custom_role_* tables`);
 	}
 }
 async function bindSubject(query, fixture, subject) {
@@ -1084,17 +1679,17 @@ function grantKind(policy, key) {
 	return "portable";
 }
 async function runRlsVerify(input) {
-	const connect = input.connect ?? pgConnector("permdock rls verify --db");
+	const connect = input.connect ?? pgConnector("permdock rls verify --db-url-stdin", input.cwd);
 	const policyPath = input.from ?? input.config.policy;
 	if (policyPath === void 0) return {
 		code: 2,
-		output: "PermDock CLI: rls verify needs policy in the config or --from"
+		output: "PermDock CLI: rls verify needs policy in the config or --policy"
 	};
 	const policy = await loadPolicyAt(input.cwd, policyPath);
 	if (input.tree === true) {
 		if (input.db === void 0) return {
 			code: 2,
-			output: "PermDock CLI: rls verify --tree needs --db"
+			output: "PermDock CLI: rls verify --tree needs a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 		};
 		try {
 			return await verifyTreeAgainstDatabase(input.db, policy, input.config, connect);
@@ -1120,7 +1715,7 @@ async function runRlsVerify(input) {
 			continue;
 		}
 		const kind = grantKind(policy, fixture.action);
-		const permdock = await createPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryRoleSource(customRoles) });
+		const permdock = await getPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) });
 		const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
 		const outcome = granted ? "granted" : "denied";
 		if (fixture.expected !== void 0 && fixture.expected !== outcome) mismatches.push(`${fixture.action}: in-process ${outcome}, expected ${fixture.expected}`);
@@ -1172,4 +1767,4 @@ async function runRlsVerify(input) {
 	};
 }
 //#endregion
-export { graphSql as a, callsHelper as c, rowConditionMessage as d, graphPlan as i, helperCallKeys as l, runRlsVerify as n, HELPER_TABLES as o, closureDepths as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u };
+export { indexesSql as _, graphSql as a, callsHelper as c, rowConditionMessage as d, commandFor as f, indexTargets as g, COLUMNS_SQL as h, graphPlan as i, helperCallKeys as l, tableFor$1 as m, runRlsVerify as n, HELPER_TABLES as o, compileGrants as p, closureDepths as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u, pruneIndexTargets as v, readTableIndexFacts as y };