permdock 0.4.0 → 0.6.0

package/dist/hosted-BPk51-kX.d.ts

@@ -0,0 +1,78 @@
+import { T as Policy, a as ApprovalRequirement, bn as Grantee, ur as Condition } from "./policy-types-n0uRTsW8.js";
+//#region src/core/hosted.d.ts
+/** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
+type HostedGrant = {
+  readonly id: string;
+  readonly permission: string;
+  readonly effect?: "allow" | "deny";
+  readonly to: Grantee | readonly Grantee[];
+  readonly where?: Condition;
+  readonly check?: Condition;
+  readonly approval?: "human" | ApprovalRequirement;
+  readonly fields?: readonly string[];
+};
+/**
+ * PolicyDocument v1. Signed as a `vnd.permdock.policy+jwt`, the `policy`
+ * claim carries every field but `id` and `issuedAt`, which are the token's
+ * `jti` and `iat` (`policyDocumentFromClaims`).
+ */
+type PolicyDocument = {
+  readonly v: 1;
+  readonly id: string;
+  readonly fingerprint: string;
+  /** The catalog fingerprint the document was authored against. */
+  readonly catalog: string;
+  /** RFC 3339. */
+  readonly issuedAt: string;
+  readonly grants: readonly HostedGrant[];
+};
+/**
+ * The channel for hosted grants. `getPermDock` reads `current()` once;
+ * the application calls `refresh()` on its own schedule, never a check.
+ */
+type PolicySource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  current(): PolicyDocument | null;
+  refresh(): Promise<void>;
+};
+type HostedGrantDropReason = "not-hostable" | "unknown-permission" | "unknown-grantee" | "non-portable" | "weaker-approval" | "invalid";
+/** Reported through `on('error')` when a hosted grant is not merged; never thrown. */
+type HostedGrantDropped = {
+  readonly kind: "hosted-grant-dropped";
+  readonly document: string;
+  readonly grant: string;
+  readonly reason: HostedGrantDropReason;
+};
+declare function memoryPolicySource(document?: PolicyDocument | null): PolicySource;
+/** Validates the document envelope; per-grant checks happen at merge time. */
+declare function parsePolicyDocument(json: unknown): PolicyDocument;
+/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+declare function policyDocumentFromClaims(claims: Readonly<Record<string, unknown>>): PolicyDocument;
+/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+declare function isPortableCondition(value: unknown): value is Condition;
+/**
+ * The code policy plus the hosted grants that pass every rule. Hosted
+ * allows OR with code allows and any deny still wins, so a hosted grant can
+ * never override a code deny; one that fails a rule is dropped, not thrown.
+ */
+declare function mergeHostedGrants(policy: Policy, document: PolicyDocument | null): {
+  readonly policy: Policy;
+  readonly dropped: readonly HostedGrantDropped[];
+};
+/**
+ * Hosted grants as an instance option: `policies: hostedPolicies(source)`.
+ * The merge code ships only with an app that imports this function.
+ * `source.current()` is read once per instance; a throw keeps the code
+ * policy and is reported as an error event.
+ */
+type HostedPolicies = {
+  readonly feature: "hosted-policies";
+  readonly apply: (policy: Policy) => {
+    readonly policy: Policy;
+    readonly errors: readonly unknown[];
+  };
+};
+declare function hostedPolicies(source: PolicySource): HostedPolicies;
+//#endregion
+export { PolicyDocument as a, isPortableCondition as c, parsePolicyDocument as d, policyDocumentFromClaims as f, HostedPolicies as i, memoryPolicySource as l, HostedGrantDropReason as n, PolicySource as o, HostedGrantDropped as r, hostedPolicies as s, HostedGrant as t, mergeHostedGrants as u };

package/dist/{http-DPuDaChb.d.ts → http-B_LphE5Y.d.ts}

@@ -7,7 +7,6 @@ type NodeRequest = IncomingMessage & {
 };
 declare function toRequest(req: NodeRequest, stream?: IncomingMessage | null): Request;
 declare function sendResponse(res: ServerResponse, response: Response): Promise<void>;
-declare const fromResponse: typeof sendResponse;
 declare function isServerResponse(value: unknown): value is ServerResponse;
 //#endregion
-export { toRequest as a, sendResponse as i, fromResponse as n, isServerResponse as r, NodeRequest as t };
+export { toRequest as i, isServerResponse as n, sendResponse as r, NodeRequest as t };

package/dist/http-DXJ37RDA.js

@@ -0,0 +1,46 @@
+import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+import { a as describeError, n as CliError } from "./errors-CWTY6uih.js";
+import { s as cliVersion } from "./version-CEbQ5UeM.js";
+import "./device-BARQ8eYG.js";
+//#region src/cli/core/http.ts
+/** `permdock-cli/<version> node/<version> <platform>`, sent on every request the CLI makes. */
+function userAgent() {
+	return `permdock-cli/${cliVersion()} node/${process.versions.node} ${process.platform}`;
+}
+/**
+* Every outbound request: the user agent, a timeout joined to the run's
+* abort signal, and a `network_error` CLI error when nothing answers.
+*/
+async function httpRequest(io, request) {
+	const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+	try {
+		return await fetchImpl(request.url, {
+			method: request.method ?? "GET",
+			headers: {
+				"user-agent": userAgent(),
+				...request.headers
+			},
+			...request.body === void 0 ? {} : { body: request.body },
+			signal: timeoutSignal(request.timeoutMs ?? 1e4, io.signal)
+		});
+	} catch (error) {
+		throw new CliError("unavailable", `${request.service} unreachable: ${describeError(error)}`, {
+			code: "network_error",
+			cause: error
+		});
+	}
+}
+/**
+* A 401 or 403 as an `auth_required` action: the credential is missing,
+* expired or lacks a scope, and `next` says how to get one.
+*/
+function authFailure(response, message, next) {
+	if (response.status !== 401 && response.status !== 403) return;
+	return new CliError("action", `${message} (HTTP ${String(response.status)})`, {
+		code: "auth_required",
+		extensions: { status: response.status },
+		next
+	});
+}
+//#endregion
+export { httpRequest as n, authFailure as t };

package/dist/{http-BEbdMZ05.js → http-ujKm0JXE.js}

@@ -65,9 +65,8 @@ async function sendResponse(res, response) {
 	const body = Buffer.from(await response.arrayBuffer());
 	res.end(body);
 }
-const fromResponse = sendResponse;
 function isServerResponse(value) {
 	return typeof value === "object" && value !== null && "setHeader" in value && typeof value.setHeader === "function" && "end" in value;
 }
 //#endregion
-export { toRequest as i, isServerResponse as n, sendResponse as r, fromResponse as t };
+export { sendResponse as n, toRequest as r, isServerResponse as t };

package/dist/{import-UHk1N7vH.js → import-CNV7I2Dw.js}

@@ -1,10 +1,12 @@
-import { t as validateOpenapi } from "./schema-Bol6gqXA.js";
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
+import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { n as httpRequest } from "./http-DXJ37RDA.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { t as validateOpenapi } from "./schema-yLuBWWsh.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js
 const ALIAS = Symbol.for("yaml.alias");
 const DOC = Symbol.for("yaml.document");
@@ -5813,15 +5815,15 @@ function readMap(cwd, file) {
 	return map;
 }
 async function readSource(cwd, doc, io) {
-	if (/^https?:\/\//u.test(doc)) {
-		const fetcher = io.fetch ?? globalThis.fetch;
-		try {
-			const response = await fetcher(doc);
-			if (!response.ok) return `could not fetch ${doc}: HTTP ${response.status}`;
-			return { text: await response.text() };
-		} catch {
-			return `could not fetch ${doc}`;
-		}
+	if (/^https?:\/\//u.test(doc)) try {
+		const response = await httpRequest(io, {
+			url: doc,
+			service: doc
+		});
+		if (!response.ok) return `could not fetch ${doc}: HTTP ${response.status}`;
+		return { text: await response.text() };
+	} catch {
+		return `could not fetch ${doc}`;
 	}
 	const path = resolve(cwd, doc);
 	if (!existsSync(path)) return `document not found: ${doc}`;
@@ -5940,14 +5942,17 @@ async function runOpenapiImport(input) {
 		};
 		return input.schema === void 0 ? resource : Object.assign(resource, { schema: schemaExpression(input.schema, entry.schema ?? { type: "object" }, resolveRef) });
 	});
-	const outPath = resolve(input.cwd, input.out);
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, emitPermissionsModule({
-		generator: "openapi import",
-		schema: input.schema,
-		resources
-	}));
-	if (input.annotate && source.local !== void 0) writeFileSync(source.local, annotated(source.text, parsed.yaml, document, permissions));
+	applyFiles(input.cwd, [{
+		path: input.out,
+		text: emitPermissionsModule({
+			generator: "openapi import",
+			schema: input.schema,
+			resources
+		})
+	}, ...input.annotate && source.local !== void 0 ? [{
+		path: source.local,
+		text: annotated(source.text, parsed.yaml, document, permissions)
+	}] : []]);
 	const leaves = resources.reduce((total, item) => total + Object.keys(item.actions).length + Object.keys(item.collection).length, 0);
 	return {
 		code: 0,

package/dist/{import-BFIlhetD.js → import-wyqXUyjm.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
 import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { n as escapeSqlIdent, o as quoteSqlLiteral } from "./sql-t8teWOfo.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-1uhI-e-b.js";
-import { Z as pgConnector } from "./permission-keys-B26jeyUv.js";
-import { t as FIELD_VIEWS } from "./fields-fwfXN01n.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-BAK8t4Uo.js";
+import { f as pgConnector } from "./policies-DP2nqRoF.js";
+import { t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
@@ -89,33 +89,50 @@ function selectFromTable(selectNode) {
 	const relname = asNode$1(asNode$1(from[0])?.["RangeVar"])?.["relname"];
 	return typeof relname === "string" ? relname : void 0;
 }
-function sublinkTable(value, kinds) {
+function sublinkSelect(value, kinds) {
 	const sub = asNode$1(asNode$1(unwrap(value))?.["SubLink"]);
 	if (sub === void 0) return;
 	const kind = sub["subLinkType"];
 	if (kind === void 0 || !kinds.has(kind)) return;
-	return selectFromTable(sub["subselect"]);
-}
-function membershipTable(value) {
-	const exists = sublinkTable(value, /* @__PURE__ */ new Set(["EXISTS_SUBLINK", 0]));
-	if (exists !== void 0) return exists;
-	const anyDirect = sublinkTable(value, /* @__PURE__ */ new Set([
-		"ANY_SUBLINK",
-		"IN_SUBLINK",
-		2
-	]));
-	if (anyDirect !== void 0) return anyDirect;
-	const expr = asNode$1(asNode$1(unwrap(value))?.["A_Expr"]);
+	return selectFromTable(sub["subselect"]) === void 0 ? void 0 : sub["subselect"];
+}
+const EXISTS = /* @__PURE__ */ new Set(["EXISTS_SUBLINK", 0]);
+const IN_OR_ANY = /* @__PURE__ */ new Set([
+	"ANY_SUBLINK",
+	"IN_SUBLINK",
+	2
+]);
+function subquery(select, field) {
+	const table = selectFromTable(select);
+	if (table === void 0) return;
+	return field === void 0 ? {
+		select,
+		table
+	} : {
+		select,
+		table,
+		field
+	};
+}
+function membershipSubquery(value) {
+	const node = asNode$1(unwrap(value));
+	const exists = sublinkSelect(value, EXISTS);
+	if (exists !== void 0) return subquery(exists, void 0);
+	const sub = asNode$1(node?.["SubLink"]);
+	const anyDirect = sublinkSelect(value, IN_OR_ANY);
+	if (anyDirect !== void 0) return subquery(anyDirect, columnName(sub?.["testexpr"]));
+	const expr = asNode$1(node?.["A_Expr"]);
 	if (expr === void 0) return;
-	const fromRight = sublinkTable(unwrap(expr["rexpr"]), /* @__PURE__ */ new Set([
-		"ANY_SUBLINK",
-		"IN_SUBLINK",
-		"EXISTS_SUBLINK",
-		0,
-		2
-	]));
-	if (fromRight !== void 0) return fromRight;
-	if (Array.isArray(expr["rexpr"]) && expr["rexpr"][0] !== void 0) return selectFromTable(expr["rexpr"][0]);
+	const right = unwrap(expr["rexpr"]);
+	const existsRight = sublinkSelect(right, EXISTS);
+	if (existsRight !== void 0) return subquery(existsRight, void 0);
+	const anyRight = sublinkSelect(right, IN_OR_ANY);
+	if (anyRight !== void 0) return subquery(anyRight, columnName(expr["lexpr"]));
+	if (Array.isArray(expr["rexpr"]) && expr["rexpr"][0] !== void 0) return subquery(expr["rexpr"][0], columnName(expr["lexpr"]));
+}
+/** The `where` clause of a `select` node. */
+function selectWhere(selectNode) {
+	return asNode$1(asNode$1(selectNode)?.["SelectStmt"])?.["whereClause"];
 }
 function operatorName(value) {
 	const names = asNode$1(asNode$1(unwrap(value))?.["A_Expr"])?.["name"];
@@ -183,6 +200,122 @@ function isJwtCall(value) {
 	return name === "auth.jwt" || name === "auth.session";
 }
 //#endregion
+//#region src/cli/rls/import-membership.ts
+/**
+* What the `where` of a membership subquery on `table` says, or `undefined`
+* when any part of it cannot be read as one. A subquery imports as
+* `memberOf` only when it binds the membership row to the signed-in user
+* and to the policy row, and filters roles with string literals at most:
+* a predicate left unread would widen the imported condition.
+*/
+function membershipRoles(subquery, table) {
+	const where = selectWhere(subquery.select);
+	if (where === void 0) return;
+	const scopeColumns = new Set([
+		...Object.values(table.columns ?? {}),
+		table.tenant,
+		table.team,
+		table.id
+	].filter((column) => column !== void 0));
+	if (subquery.field !== void 0 && !scopeColumns.has(selectTarget(subquery.select) ?? "")) return;
+	const roleColumn = typeof table.role === "string" ? table.role : void 0;
+	const roles = [];
+	let user = false;
+	let field = subquery.field;
+	for (const conjunct of conjuncts(where)) {
+		const read = readConjunct(conjunct, table, roleColumn, scopeColumns);
+		if (read === void 0) return;
+		if (read.kind === "user") user = true;
+		else if (read.kind === "row") {
+			if (field !== void 0 && field !== read.field) return;
+			field = read.field;
+		} else if (read.kind === "roles") roles.push(...read.roles);
+	}
+	return user && field !== void 0 ? {
+		field,
+		roles: [...new Set(roles)]
+	} : void 0;
+}
+/** The column a `select <column> from …` returns. */
+function selectTarget(select) {
+	const targets = asNode$1(asNode$1(select)?.["SelectStmt"])?.["targetList"];
+	if (!Array.isArray(targets) || targets.length !== 1) return;
+	return columnName(asNode$1(asNode$1(targets[0])?.["ResTarget"])?.["val"]);
+}
+function conjuncts(value) {
+	if (boolOp(value) !== "and") return [value];
+	const args = asNode$1(asNode$1(unwrap(value))?.["BoolExpr"])?.["args"];
+	return Array.isArray(args) ? args.flatMap((arg) => conjuncts(arg)) : [];
+}
+function readConjunct(value, table, roleColumn, scopeColumns) {
+	const node = asNode$1(unwrap(value));
+	const nullTest = asNode$1(node?.["NullTest"]);
+	if (nullTest !== void 0) {
+		const column = columnName(nullTest["arg"]);
+		return (nullTest["nulltesttype"] === "IS_NULL" || nullTest["nulltesttype"] === 0 || nullTest["nulltesttype"] === void 0) && column !== void 0 && (column === table.disabledAt || column === table.expiresAt) ? { kind: "active" } : void 0;
+	}
+	const expr = asNode$1(node?.["A_Expr"]);
+	if (expr === void 0 || operatorName(node) !== "=") return;
+	const kind = expr["kind"];
+	const left = columnName(expr["lexpr"]);
+	if (kind === "AEXPR_OP_ANY" || kind === 2) {
+		const elements = asNode$1(asNode$1(unwrap(expr["rexpr"]))?.["A_ArrayExpr"])?.["elements"];
+		if (left === void 0 || left !== roleColumn || !Array.isArray(elements) || elements.length === 0) return;
+		const values = elements.map((item) => constValue(item));
+		return values.every((item) => typeof item === "string") ? {
+			kind: "roles",
+			roles: values
+		} : void 0;
+	}
+	if (kind === "AEXPR_IN" || kind === 7) {
+		const raw = expr["rexpr"];
+		const items = asNode$1(raw)?.["List"];
+		const list = Array.isArray(raw) ? raw : asNode$1(items)?.["items"];
+		if (left === void 0 || left !== roleColumn || !Array.isArray(list) || list.length === 0) return;
+		const values = list.map((item) => constValue(item));
+		return values.every((item) => typeof item === "string") ? {
+			kind: "roles",
+			roles: values
+		} : void 0;
+	}
+	const right = columnName(expr["rexpr"]);
+	for (const [column, other, otherColumn] of [[
+		left,
+		expr["rexpr"],
+		right
+	], [
+		right,
+		expr["lexpr"],
+		left
+	]]) {
+		if (column === void 0) continue;
+		if (column === table.user && (isAuthUid(other) || isCurrentSettingUserId(other))) return { kind: "user" };
+		if (column === roleColumn) {
+			const role = constValue(other);
+			return typeof role === "string" ? {
+				kind: "roles",
+				roles: [role]
+			} : void 0;
+		}
+		if (scopeColumns.has(column) && otherColumn !== void 0) return {
+			kind: "row",
+			field: otherColumn
+		};
+	}
+}
+/**
+* `condition` with every `memberOf` role read through `rls.roleValues`, so a
+* legacy role value imports as the PermDock role it stands for.
+*/
+function mapRoleValues(condition, roleValues) {
+	if (roleValues === void 0 || condition === null) return condition;
+	if (Array.isArray(condition)) return condition.map((item) => mapRoleValues(item, roleValues));
+	if (typeof condition !== "object") return condition;
+	const mapped = Object.fromEntries(Object.entries(condition).map(([key, value]) => [key, mapRoleValues(value, roleValues)]));
+	if (mapped["op"] === "memberOf" && Array.isArray(mapped["roles"])) mapped["roles"] = mapped["roles"].map((role) => typeof role === "string" && Object.hasOwn(roleValues, role) ? roleValues[role] : role);
+	return mapped;
+}
+//#endregion
 //#region src/cli/rls/import-ast.ts
 async function conditionFromAst(sql, memberships, functions, unmapped, joins = [], seeds = []) {
 	if (sql === void 0 || sql.trim() === "" || sql.trim() === "true") return {
@@ -407,29 +540,25 @@ function mapNode(value, ctx) {
 			conditions: children
 		};
 	}
-	const table = membershipTable(node);
-	if (table !== void 0) {
-		for (const [scope, mapped] of Object.entries(memberships?.scopes ?? {})) {
-			const column = mapped.columns?.[scope];
-			if (mapped.table === table && column !== void 0) return {
-				op: "memberOf",
-				scope,
-				field: column,
-				roles: []
-			};
+	const subquery = membershipSubquery(node);
+	if (subquery !== void 0) {
+		const { table } = subquery;
+		const mappedScopes = Object.entries(memberships?.scopes ?? {});
+		if (memberships?.tenant !== void 0) mappedScopes.push(["tenant", memberships.tenant]);
+		if (memberships?.team !== void 0) mappedScopes.push(["team", memberships.team]);
+		const matches = mappedScopes.filter(([, mapped]) => mapped.table === table);
+		if (matches.length > 0) {
+			for (const [scope, mapped] of matches) {
+				const read = membershipRoles(subquery, mapped);
+				if (read !== void 0) return {
+					op: "memberOf",
+					scope,
+					field: read.field,
+					roles: read.roles
+				};
+			}
+			return;
 		}
-		if (memberships?.tenant?.table === table) return {
-			op: "memberOf",
-			scope: "tenant",
-			field: memberships.tenant.tenant ?? "tenant_id",
-			roles: []
-		};
-		if (memberships?.team?.table === table) return {
-			op: "memberOf",
-			scope: "team",
-			field: memberships.team.team ?? "team_id",
-			roles: []
-		};
 		joins.push(table);
 		return;
 	}
@@ -802,7 +931,7 @@ function emitGenerated(catalog, fieldViews, schema) {
 	});
 }
 function assertNoServiceRole(sql) {
-	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw new Error("PermDock CLI: imported SQL must never target service_role");
+	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw configError("PermDock CLI: imported SQL must never target service_role");
 }
 async function seedsFromDb(query) {
 	const schema = (await query(`select table_schema from information_schema.tables where table_name = 'role_permissions' order by table_schema = 'permdock' desc, table_schema = 'public' desc, table_schema limit 1`)).rows[0]?.["table_schema"];
@@ -883,7 +1012,7 @@ async function runRlsImport(input) {
 		policies = splitPolicies(await canonicalDump(sql) ?? sql);
 		if (policies.length === 0) policies = splitPolicies(sql);
 	} else if (input.db !== void 0) try {
-		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db"));
+		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db-url-stdin", input.cwd));
 		policies = fromDb.policies;
 		bodies = fromDb.bodies;
 		seeds = fromDb.seeds;
@@ -893,16 +1022,24 @@ async function runRlsImport(input) {
 	}
 	else return {
 		code: 2,
-		output: "PermDock CLI: rls import needs --sql <file> or --db <url>"
+		output: "PermDock CLI: rls import needs --sql <file> or a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 	};
 	const memberships = parseMembershipsFlag(input.memberships) ?? input.config.rls?.memberships;
+	const roleValues = input.config.rls?.roleValues;
+	if (roleValues !== void 0) seeds = seeds.map((row) => {
+		const mapped = Object.hasOwn(roleValues, row.role) ? roleValues[row.role] : void 0;
+		return mapped === void 0 ? row : {
+			...row,
+			role: mapped
+		};
+	});
 	const functions = input.config.rls?.functions;
 	const unmapped = [];
 	const joins = [];
 	const catalog = [];
 	for (const item of policies) {
 		const sourceSql = item.using ?? item.check ?? "true";
-		const condition = await conditionFromAst(item.using ?? item.check, memberships, functions, unmapped, joins, seeds);
+		const condition = mapRoleValues(await conditionFromAst(item.using ?? item.check, memberships, functions, unmapped, joins, seeds), input.config.rls?.roleValues);
 		const grants = await helperGrants(item.using ?? item.check, memberships, functions, seeds);
 		catalog.push({
 			table: item.table,