permdock 0.6.0 → 0.8.0

package/dist/ownership-B4L59T9u.js

@@ -0,0 +1,1054 @@
+import { a as sole, n as isReadonlyArray, r as isRecord } from "./compact-CAf557ZB.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
+import { u as isoAt } from "./time-nR1JesoH.js";
+import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { t as isoInstant } from "./instant-DK3Iz83e.js";
+import { m as findRole, v as listRoles } from "./grantee-Dke-9rd1.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
+import { a as scopeMembershipTable, i as scopeColumn, s as relatedSql } from "./compile-EzEMB-7v.js";
+import { l as roleColumn } from "./sources-CMAM-2A3.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, L as sqlType, M as textArrayLiteral, O as quoteIdent, R as tenantTypeOf, S as CLAIM, T as declaredArray, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, j as quoteTable, k as quoteLiteral, m as memberVia, p as liveSessionSql, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, y as subjectIdSql } from "./shared-Afctg7B0.js";
+import { $ as graphSqlText, A as claimKeptLines, B as hasCustomRoleChecksFor, F as globalRoleRows, I as membershipRows, L as roleRows, M as memberColumn, N as sourceFilters, P as sourcesKeep, U as storedTenant, X as CLOSURE, Z as graphHelper, _t as activeMembershipSql, c as holderSources, ct as memberIdsHelper, d as sourceRowsSql, f as sourceTransferTriggerSql, g as OWNERSHIP, gt as activeInstancesSql, h as ASSIGNMENTS, ht as scopeTable, it as linkHelper, j as disabledColumn, l as pairsSql, m as transferTriggerSql, mt as scopeSources, nt as inheritedRowsHelper, p as holdersTriggerSql, pt as restrictedHelper, st as memberForTable, u as sourceHoldersTriggerSql, ut as memberRoleOf, yt as activeUserSql } from "./tables-DeMNEy6V.js";
+//#region src/cli/sql/conditions.ts
+const MAX_CLAIM_DEPTH = 8;
+/**
+* The claim path of a `principal.claim.*` / `principal.claims.*` ref, one
+* segment per JSON key; `undefined` for any other ref.
+*/
+function claimPath(ref) {
+	const prefix = ["principal.claim.", "principal.claims."].find((item) => ref.startsWith(item));
+	if (prefix === void 0) return;
+	const segments = ref.slice(prefix.length).split(".");
+	if (segments.length > MAX_CLAIM_DEPTH) throw configError(`PermDock CLI: claim path '${ref}' is deeper than ${MAX_CLAIM_DEPTH}`);
+	for (const segment of segments) if (!CLAIM.test(segment) || isForbiddenKey(segment)) throw configError(`PermDock CLI: unsafe claim name '${segment}'`);
+	return segments;
+}
+function jsonPath(base, keys, last) {
+	let sql = base;
+	for (const [index, key] of keys.entries()) sql += ` ${index === keys.length - 1 ? last : "->"} ${quoteLiteral(key)}`;
+	return sql;
+}
+/**
+* The JSON document a claim path starts from and the keys to walk in it. The
+* `guc` dialect keeps each top-level claim in its own setting as JSON text.
+*/
+function claimRoot(ctx, path) {
+	const [head, ...rest] = path;
+	if (head === void 0) throw configError("PermDock CLI: empty claim path");
+	switch (ctx.dialect) {
+		case "supabase": return {
+			root: "(select auth.jwt())",
+			keys: path
+		};
+		case "neon": return {
+			root: "(select auth.session())",
+			keys: path
+		};
+		case "guc": return {
+			root: subjectClaimJsonSql(ctx, head),
+			keys: rest
+		};
+		default: return ctx.dialect;
+	}
+}
+/** The claim at `path` as `jsonb`. */
+function claimJsonSql(ctx, path) {
+	const { root, keys } = claimRoot(ctx, path);
+	return keys.length === 0 ? root : `(${jsonPath(root, keys, "->")})`;
+}
+/**
+* The claim at `path` as text: `->>` on the last key, or the plain setting for
+* a one-segment `guc` claim.
+*/
+function claimTextSql(ctx, path) {
+	const [head] = path;
+	if (path.length === 1 && head !== void 0) return subjectClaimSql(ctx, head);
+	const { root, keys } = claimRoot(ctx, path);
+	return `(${jsonPath(root, keys, "->>")})`;
+}
+/** The JSON kind a claim must have to compare with a column of `type`. */
+function jsonKindOf(type) {
+	if (type === "numeric") return "number";
+	return type === "boolean" ? "boolean" : "string";
+}
+/**
+* A claim compared with a column of `type`. Numbers and booleans must be JSON
+* of that kind (anything else is `null`, so the comparison is false, as in
+* memory); other types cast the text form. A one-segment `guc` claim is text
+* and is cast as is.
+*/
+function typedClaimSql(ctx, path, type) {
+	const text = claimTextSql(ctx, path);
+	if (type === void 0 || type === "text") return text;
+	const cast = `${text}::${sqlType(type)}`;
+	const kind = jsonKindOf(type);
+	if (kind === "string" || ctx.dialect === "guc" && path.length === 1) return `(${cast})`;
+	return `(case when jsonb_typeof(${claimJsonSql(ctx, path)}) = '${kind}' then ${cast} end)`;
+}
+/**
+* The elements of an array claim as a Postgres array of the column's type,
+* built once per statement (an uncorrelated `array(select ...)` is an
+* InitPlan). A missing or non-array claim is the empty array; elements of
+* another JSON kind are left out.
+*/
+function claimArraySql(ctx, path, type) {
+	const json = claimJsonSql(ctx, path);
+	return `array(select ${type === void 0 || type === "text" ? `(e #>> '{}')` : `(e #>> '{}')::${sqlType(type)}`} from jsonb_array_elements(case when jsonb_typeof(${json}) = 'array' then ${json} else '[]'::jsonb end) e where jsonb_typeof(e) = '${jsonKindOf(type)}')`;
+}
+function sqlValue(value, ctx, field) {
+	if (value !== null && typeof value === "object" && "ref" in value) return compileRef(value.ref, ctx, field);
+	if (value !== null && typeof value === "object" && "date" in value) {
+		const instant = isoInstant(value.date);
+		return instant === void 0 ? "null" : quoteLiteral(isoAt(instant));
+	}
+	if (isReadonlyArray(value)) return `array[${value.map((item) => sqlValue(item, ctx)).join(", ")}]`;
+	if (value === null) return "null";
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
+	if (typeof value === "string") return quoteLiteral(value);
+	throw configError("PermDock CLI: non-portable condition value");
+}
+function compileRef(ref, ctx, field) {
+	if (ref === "principal.id") return subjectIdSql(ctx);
+	if (ref === "now") return "now()";
+	const path = claimPath(ref);
+	if (ref === "principal.tenant" || path?.length === 1 && path[0] === ctx.tenantClaim) return tenantClaimSql(ctx);
+	if (path !== void 0) return typedClaimSql(ctx, path, field === void 0 ? void 0 : ctx.columnTypes?.[field]);
+	if (ref === "context" || ref.startsWith("context.")) throw configError(`PermDock CLI: '${ref}' is request context, which is not in the token; RLS cannot read it (permdock doctor PD027)`);
+	throw configError(`PermDock CLI: non-portable subject ref '${ref}'`);
+}
+/**
+* `value` with `\`, `%` and `_` escaped for `like ... escape '\'`, as
+* `escapeLike` does in process.
+*/
+function likeLiteralSql(value) {
+	return `replace(replace(replace(${value}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`;
+}
+function compareSql(op, field, value) {
+	const left = quoteIdent(field);
+	switch (op) {
+		case "eq": return `${left} = ${value}`;
+		case "ne": return `${left} <> ${value}`;
+		case "gt": return `${left} > ${value}`;
+		case "gte": return `${left} >= ${value}`;
+		case "lt": return `${left} < ${value}`;
+		case "lte": return `${left} <= ${value}`;
+		case "contains": return `${left}::text like '%' || ${likeLiteralSql(`${value}::text`)} || '%' escape '\\'`;
+		default: return op;
+	}
+}
+/**
+* Whether the row's `rowField` is among the ids in `table.rowColumn` the
+* subject holds a matching membership on. The row field stays outside the
+* subquery: inside it, an unqualified name resolves to the membership table
+* first, so `m.org_id = "org_id"` would compare the membership with itself.
+*/
+function membershipSql(table, rowColumn, rowField, roles, ctx, tenantColumn, scope) {
+	const parts = [`m.${quoteIdent(table.user)} = ${subjectIdSql(ctx)}`];
+	const role = memberRoleOf(table);
+	if (roles.length > 0) {
+		const held = role.through === void 0 && !role.lateral ? `m.${quoteIdent(role.column)}` : role.lookup;
+		parts.push(`${held} = any(${textArrayLiteral(roles)})`);
+		const via = memberVia(table);
+		const single = sole(roles);
+		const kind = single === void 0 ? kindFilterSql(ctx, role.lookup, via) : roleKindSql(ctx, single, via);
+		if (kind !== void 0) parts.push(kind);
+	}
+	if (table.expiresAt !== void 0) parts.push(`(m.${quoteIdent(table.expiresAt)} is null or m.${quoteIdent(table.expiresAt)} > now())`);
+	parts.push(...activeMembershipSql(ctx, table.disabledAt === void 0 ? void 0 : `m.${quoteIdent(table.disabledAt)}`));
+	if (tenantColumn !== void 0 && ctx.tenants !== "all") parts.push(`m.${quoteIdent(tenantColumn)} = ${tenantClaimSql(ctx)}`);
+	parts.push(...activeUserSql(ctx));
+	if (scope !== void 0) {
+		const tenantOf = scope === rootScope(ctx.scopes) ? rowColumn : tenantColumn;
+		const keyed = keyTenantSql(ctx, tenantOf === void 0 ? void 0 : `m.${quoteIdent(tenantOf)}`);
+		if (keyed !== void 0) parts.push(keyed);
+		parts.push(...activeInstancesSql(ctx, scope, (name) => {
+			const held = scopeColumn(table, ctx.scopes, name);
+			return held === void 0 ? void 0 : `m.${quoteIdent(held)}`;
+		}));
+	}
+	const expand = roles.length > 0 && role.lateral ? role.join : "";
+	return `${quoteIdent(rowField)} in (select m.${quoteIdent(rowColumn)} from ${quoteTable(table.table)} m${expand} where ${parts.join(" and ")})`;
+}
+function compileMemberOf(condition, ctx) {
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(ctx.scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) throw configError(`PermDock CLI: memberOf ${condition.scope} names a scope the policy does not declare`);
+	const mapping = scope === void 0 ? condition.resource === void 0 ? void 0 : ctx.memberships?.resource?.[condition.resource] : scopeMembershipTable(ctx.memberships, ctx.scopes, scope);
+	if (mapping !== void 0) {
+		const named = scope === void 0 ? void 0 : scopeTable(ctx, scope);
+		const rowColumn = scope === void 0 ? mapping.id : named?.column;
+		if (rowColumn === void 0) throw configError(`PermDock CLI: memberships mapping for ${condition.scope} is missing the row column`);
+		const tenantColumn = scope === void 0 || scope === rootScope(ctx.scopes) ? void 0 : named?.tenantColumn;
+		const primary = membershipSql(mapping, rowColumn, condition.field, condition.roles, ctx, tenantColumn, scope);
+		if (condition.scope !== "resource" || condition.parents === void 0) return primary;
+		return `(${[primary, ...condition.parents.flatMap((parent) => {
+			if (typeof parent === "string") return [membershipSql(mapping, rowColumn, parent, condition.roles, ctx, tenantColumn)];
+			const hopTable = ctx.memberships?.resource?.[parent.resource];
+			return hopTable?.id === void 0 ? [] : [membershipSql(hopTable, hopTable.id, parent.field, condition.roles, ctx)];
+		})].join(" or ")})`;
+	}
+	if (scope !== void 0 && condition.roles.length === 0 && scopeSources(ctx, scope).length > 0) return `${quoteIdent(condition.field)} in (select ${qualified(ctx, memberIdsHelper(scope))}())`;
+	if (scope !== void 0 && scope === rootScope(ctx.scopes)) {
+		const parts = [
+			ctx.tenants === "all" ? `${quoteIdent(condition.field)} in (select ${qualified(ctx, memberIdsHelper(scope))}())` : `${quoteIdent(condition.field)} = ${tenantClaimSql(ctx)}`,
+			...ctx.tenants === "all" ? [] : [keyTenantSql(ctx, quoteIdent(condition.field))].filter((part) => part !== void 0),
+			...activeUserSql(ctx),
+			...activeInstancesSql(ctx, scope, () => quoteIdent(condition.field))
+		];
+		return parts.length === 1 ? parts.join("") : `(${parts.join(" and ")})`;
+	}
+	throw configError(`PermDock CLI: memberOf ${condition.scope} needs a memberships table mapping`);
+}
+function compileConditionSql(condition, ctx) {
+	switch (condition.op) {
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
+		case "contains": {
+			const element = ctx.arrayColumns?.[condition.field];
+			if (element !== void 0) return `${sqlValue(condition.value, {
+				...ctx,
+				columnTypes: {
+					...ctx.columnTypes,
+					[condition.field]: element
+				}
+			}, condition.field)} = any(${quoteIdent(condition.field)})`;
+			return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
+		}
+		case "in":
+		case "notIn": {
+			const keyword = condition.op === "in" ? "in" : "not in";
+			if (!Array.isArray(condition.value) && typeof condition.value === "object" && "ref" in condition.value) {
+				const path = claimPath(condition.value.ref);
+				if (path === void 0) {
+					compileRef(condition.value.ref, ctx);
+					throw configError(`PermDock CLI: non-portable ${condition.op} against '${condition.value.ref}'`);
+				}
+				const column = quoteIdent(condition.field);
+				const list = claimArraySql(ctx, path, ctx.columnTypes?.[condition.field]);
+				return condition.op === "in" ? `${column} = any (${list})` : `(${column} is not null and not (${column} = any (${list})))`;
+			}
+			const values = condition.value.map((item) => sqlValue(item, ctx));
+			if (values.length === 0) return condition.op === "in" ? "false" : `${quoteIdent(condition.field)} is not null`;
+			return `${quoteIdent(condition.field)} ${keyword} (${values.join(", ")})`;
+		}
+		case "isNull": return `${quoteIdent(condition.field)} is ${condition.value ? "" : "not "}null`;
+		case "and": return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" and ")})`;
+		case "or":
+			if (condition.conditions.length === 0) return "false";
+			return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" or ")})`;
+		case "not": return `(${compileConditionSql(condition.condition, ctx)}) is not true`;
+		case "memberOf": return compileMemberOf(condition, ctx);
+		case "related": return compileRelatedSql(condition, ctx);
+		case "sqlFunction":
+			if (ctx.inlineFunctions === true) return compileConditionSql(condition.twin, ctx);
+			return `${quoteTable(condition.name)}(${condition.args.map((arg) => isSqlFunctionField(arg) ? quoteIdent(arg.field) : sqlValue(arg, ctx)).join(", ")})`;
+		case "opaque": return condition.sql;
+		case "liveSession": return liveSessionSql(ctx);
+		default: return condition;
+	}
+}
+function andConditions(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	return {
+		op: "and",
+		conditions: [left, right]
+	};
+}
+function valueContextRefs(value) {
+	if (Array.isArray(value)) return value.flatMap(valueContextRefs);
+	if (isRecord(value) && typeof value["ref"] === "string" && (value["ref"] === "context" || value["ref"].startsWith("context."))) return [value["ref"]];
+	return [];
+}
+/**
+* The `context.*` refs a condition reads. The request context is not in the
+* token, so RLS cannot evaluate them.
+*/
+function contextRefs(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn": return valueContextRefs(condition.value);
+		case "and":
+		case "or": return condition.conditions.flatMap((child) => contextRefs(child));
+		case "not": return contextRefs(condition.condition);
+		case "sqlFunction": return [...condition.args.flatMap(valueContextRefs), ...contextRefs(condition.twin)];
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+function sqlFunctionNames(condition) {
+	if (condition === void 0) return [];
+	switch (condition.op) {
+		case "sqlFunction": return [condition.name, ...sqlFunctionNames(condition.twin)];
+		case "and":
+		case "or": return condition.conditions.flatMap((child) => sqlFunctionNames(child));
+		case "not": return sqlFunctionNames(condition.condition);
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn":
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque":
+		case "liveSession": return [];
+		default: return condition;
+	}
+}
+/**
+* A `related` condition as uncorrelated subqueries, so Postgres runs the helper
+* once per statement: the row's field in the closure's descendants of the ids
+* the subject holds the relation on (or those ids alone at depth 0). The helper
+* sits in `array(...)` so it stays an InitPlan; a plain `in` gets pulled into a
+* join that can rescan it per closure row.
+*/
+function compileRelatedSql(condition, ctx) {
+	if (condition.hops !== void 0 && condition.hops.length > 0) return compileHoppedSql(condition, ctx);
+	const type = ctx.columnTypes?.[condition.field];
+	const cast = type === void 0 || type === "text" ? "" : `::${type}`;
+	const column = type === void 0 ? `${quoteIdent(condition.field)}::text` : quoteIdent(condition.field);
+	const helper = condition.permission === void 0 ? `${qualified(ctx, graphHelper(condition.resource))}(${quoteLiteral(condition.relation)})` : `${qualified(ctx, inheritedRowsHelper(condition.resource))}(${quoteLiteral(condition.permission)})`;
+	const cap = ctx.graph?.closures[condition.resource];
+	let inner;
+	if (condition.depth > 0 && cap !== void 0) {
+		const depth = condition.depth < cap ? ` and depth <= ${String(condition.depth)}` : "";
+		inner = `select descendant${cast} from ${qualified(ctx, CLOSURE.table)} where resource = ${quoteLiteral(condition.resource)}${depth} and ancestor = any (array(select ${helper}))`;
+	} else inner = cast === "" ? `select ${helper}` : `select p.id${cast} from ${helper} as p(id)`;
+	const reach = `${column} in (${inner})`;
+	if (condition.parent === true && condition.restricted !== void 0) return `(${reach} and ${quoteIdent(condition.restricted)} is not true)`;
+	return reach;
+}
+/**
+* A `related` condition that crosses link hops: the reached instances of the
+* last resource, carried back over each link by its security definer helper, so
+* the hop reads a table the subject may not see.
+*/
+function compileHoppedSql(condition, ctx) {
+	const resources = ctx.graph?.resources;
+	if (resources === void 0) throw configError("PermDock CLI: a related condition with link hops needs the policy resources in the RLS context");
+	const schema = quoteIdent(helperSchema(ctx));
+	return graphSqlText(relatedSql(condition, {
+		resources,
+		...ctx.graph?.tables === void 0 ? {} : { tables: ctx.graph.tables },
+		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
+		closureDepths: ctx.graph?.closures ?? {},
+		qualify: qualifySqlTable,
+		holders: (resource, relation) => [{ text: `select ${schema}.${graphHelper(resource)}(${quoteLiteral(relation)})` }],
+		permitted: (resource, permission) => [{ text: `select ${schema}.${inheritedRowsHelper(resource)}(${quoteLiteral(permission)})` }],
+		restrictedRows: (resource) => [{ text: `select ${schema}.${restrictedHelper(resource)}()` }],
+		linked: (resource, link, targets) => [
+			{ text: `select ${schema}.${linkHelper(resource, link)}(array(` },
+			...targets,
+			{ text: "))" }
+		]
+	}), ctx);
+}
+//#endregion
+//#region src/cli/sql/grants.ts
+/**
+* The `role_permissions` grant key of a break-glass grant. It differs from the
+* permission key, so `authorize()` and the table policies never count it; only
+* the break-glass read asks for it.
+*/
+function breakGlassKey(permission) {
+	return `${permission}#break-glass`;
+}
+/**
+* The role and scope holding a break-glass grant. `breakGlass()` sets `to:
+* authenticated`, so inside `role()` the role is on the grant itself.
+*/
+function breakGlassHolder(item) {
+	if (item.access.kind === "role") return {
+		role: item.access.role,
+		scope: item.access.scope
+	};
+	const { role, scope } = item.grant;
+	return role === null || typeof scope !== "string" ? void 0 : {
+		role,
+		scope
+	};
+}
+function granteeItems(to) {
+	return Array.isArray(to) ? to : [to];
+}
+function relationWhere(policy, grant, grantee) {
+	const node = policy.resources.get(grant.permission.resource);
+	const where = relationCondition(grantee, node, scopeList(policy.scopes), {
+		resources: policy.resources,
+		now: { ref: "now" }
+	});
+	if (where === void 0) throw configError(`PermDock CLI: grant ${grant.permission.key} names relation '${grantee.relation}', which ${grant.permission.resource} does not declare`);
+	return where;
+}
+function inheritWhere(policy, grant, grantee) {
+	const where = inheritCondition(grantee, policy.resources.get(grant.permission.resource), policy.resources);
+	if (where === void 0) throw configError(`PermDock CLI: grant ${grant.permission.key} inherits ${grantee.permission}, which ${grant.permission.resource} cannot reach`);
+	return where;
+}
+/**
+* Only a deny for `oauth-client` actors compiles: Postgres sees `client_id` and
+* `act`, not other actor kinds.
+*/
+function actorAccess(grant, grantee, others) {
+	if (grant.effect !== "deny" || grantee.actor !== "oauth-client" || others > 0) throw configError(`PermDock CLI: grant ${grant.permission.key} is limited to an actor grantee; RLS compiles only deny(…, { to: actor('oauth-client') }) on its own, so enforce it in the application`);
+	return {
+		kind: "actor",
+		actor: "oauth-client"
+	};
+}
+function accessOf(grant, roles, anyone) {
+	const [held, ...more] = roles;
+	if (more.length > 0) throw configError(`PermDock CLI: grant ${grant.permission.key} requires several roles at once (${roles.map((item) => item.role).join(", ")}); RLS compiles one role per grant`);
+	if (held === void 0) return anyone ? { kind: "anyone" } : { kind: "authenticated" };
+	if (typeof held.scope === "object") return {
+		kind: "resource",
+		role: held.role,
+		resource: held.scope.resource
+	};
+	return {
+		kind: "role",
+		role: held.role,
+		scope: held.scope
+	};
+}
+/**
+* Every grant RLS must enforce: role grants and top-level `definePolicy({
+* grants })` alike (`policy.grants` holds both). A grantee Postgres cannot see
+* (plan, actor, assurance) fails with the permission named.
+*/
+function collectGrants(policy) {
+	return policy.grants.map((grant) => {
+		const items = granteeItems(grant.to);
+		const roles = [];
+		let anyone = true;
+		let where = grant.where;
+		let delegated;
+		for (const item of items) switch (item.kind) {
+			case "role":
+				roles.push(item);
+				break;
+			case "anyone": break;
+			case "authenticated":
+				anyone = false;
+				break;
+			case "relation":
+				anyone = false;
+				where = andConditions(where, relationWhere(policy, grant, item));
+				break;
+			case "inherit":
+				anyone = false;
+				where = andConditions(where, inheritWhere(policy, grant, item));
+				break;
+			case "actor":
+				delegated = actorAccess(grant, item, items.length - 1);
+				break;
+			case "plan":
+			case "assurance": throw configError(`PermDock CLI: grant ${grant.permission.key} is limited to a ${item.kind} grantee, which RLS cannot compile; enforce it in the application`);
+			default: return item;
+		}
+		const access = delegated ?? accessOf(grant, roles, anyone);
+		const label = access.kind === "role" || access.kind === "resource" ? access.role : access.kind;
+		return where === void 0 ? {
+			grant,
+			label,
+			access
+		} : {
+			grant,
+			label,
+			access,
+			where
+		};
+	});
+}
+/**
+* The declared roles a custom role may draw grants from: the custom-role
+* ceiling.
+*/
+function assignableRoles(policy) {
+	return [...roleNames(policy)].toSorted().filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
+}
+/**
+* Declared role names (bindings and `defineRoles` leaves) plus any role a
+* top-level grant names.
+*/
+function roleNames(policy) {
+	const names = new Set(policy.roles.map((item) => item.name));
+	for (const leaf of listRoles(policy.vocabulary.roles)) names.add(leaf.key);
+	for (const item of collectGrants(policy)) if (item.access.kind === "role" || item.access.kind === "resource") names.add(item.access.role);
+	return [...names];
+}
+//#endregion
+//#region src/cli/rls/assignments.ts
+/**
+* The client roles whose writes the assignment triggers check; any other role
+* is a trusted path.
+*/
+const CLIENT_ROLES = [
+	"anon",
+	"anonymous",
+	"authenticated"
+];
+/**
+* The mapped membership tables, `rls.assignments.tables` and the global-roles
+* table `rls.roles`.
+*/
+function assignedTables(ctx) {
+	const out = [];
+	for (const { name } of ctx.scopes) {
+		const mapped = scopeTable(ctx, name);
+		if (mapped === void 0) continue;
+		out.push({
+			table: mapped.table.table,
+			scope: name,
+			id: mapped.column,
+			tenant: mapped.tenantColumn ?? mapped.column,
+			role: mapped.table.role,
+			user: mapped.table.user
+		});
+	}
+	if (ctx.roles !== void 0) out.push({
+		table: ctx.roles.table,
+		scope: "global",
+		role: ctx.roles.role ?? "role",
+		user: ctx.roles.user ?? "user_id"
+	});
+	for (const extra of ctx.assignments?.tables ?? []) {
+		const scope = resolveScope(ctx.scopes, extra.scope);
+		if (scope === void 0) throw configError(`PermDock CLI: rls.assignments.tables names scope '${extra.scope}', which the policy does not declare`);
+		if (scope !== ctx.scopes[0]?.name && extra.tenant === void 0) throw configError(`PermDock CLI: rls.assignments.tables entry ${extra.table} assigns at ${scope}, below the first scope: name its tenant column`);
+		out.push({
+			table: extra.table,
+			scope,
+			id: extra.id,
+			tenant: extra.tenant ?? extra.id,
+			role: extra.role,
+			...extra.user === void 0 ? {} : { user: extra.user }
+		});
+	}
+	return out;
+}
+/**
+* The tables `rls.assignments.ownRole` refuses a caller's own rows on, by table
+* key.
+*/
+function ownRoleTables(ctx, tables) {
+	const own = ctx.assignments?.ownRole;
+	if (own === void 0) return /* @__PURE__ */ new Set();
+	if (own === "refuse") return new Set(tables.filter((entry) => entry.user !== void 0).map((entry) => qualifySqlTable(entry.table)));
+	const out = /* @__PURE__ */ new Set();
+	for (const [name, value] of Object.entries(own)) {
+		const entry = tables.find((table) => qualifySqlTable(table.table) === qualifySqlTable(name));
+		if (entry === void 0) throw configError(`PermDock CLI: rls.assignments.ownRole names ${name}, which no assignment trigger guards`);
+		if (value !== "refuse") throw configError(`PermDock CLI: rls.assignments.ownRole.${name} must be 'refuse'`);
+		if (entry.user === void 0) throw configError(`PermDock CLI: rls.assignments.ownRole names ${name}, which has no user column: set its user in rls.assignments.tables`);
+		out.add(qualifySqlTable(entry.table));
+	}
+	return out;
+}
+/**
+* The tables `rls.assignments` guards, schema-qualified: each scope's mapped
+* membership table, the global-roles table (`rls.roles`, else
+* `supabase.hook.roles`) and `rls.assignments.tables`. Empty without
+* `rls.assignments`.
+*/
+function guardedTables(config, scopes) {
+	const rls = config.rls;
+	if (rls?.assignments === void 0) return [];
+	const hook = config.supabase?.hook?.roles;
+	const roles = rls.roles ?? (hook === false ? void 0 : hook);
+	const tables = [
+		...scopes.flatMap((scope) => {
+			const mapped = memberForTable({
+				scopes,
+				...rls.memberships === void 0 ? {} : { memberships: rls.memberships }
+			}, scope.name);
+			return mapped === void 0 ? [] : [mapped.table];
+		}),
+		...roles === void 0 ? [] : [roles.table],
+		...(rls.assignments === true ? [] : rls.assignments.tables ?? []).map((entry) => entry.table)
+	];
+	return [...new Set(tables.map(qualifySqlTable))];
+}
+function isRoleList(role) {
+	return Array.isArray(role);
+}
+/** The role keys a row variable holds, one scalar per role source. */
+function rowRoles(entry, row) {
+	return (isRoleList(entry.role) ? entry.role : [entry.role]).map((part) => roleColumn(part, qualifySqlTable(entry.table), row, {
+		label: `rls.assignments ${entry.table} role`,
+		prefix: "PermDock CLI"
+	}).lookup);
+}
+/**
+* `permdock_can_assign_custom_role`: whether the signed-in caller may assign a
+* custom role of the tenant at the instance, by the checks the custom-role
+* write functions run on its stored definition.
+*/
+function canAssignCustomSql(ctx, forUser = false) {
+	const tenantType = tenantTypeOf(ctx);
+	const fn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const guard = qualified(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
+	const userParam = forUser ? "p_user uuid, " : "";
+	const userArg = forUser ? "uuid, " : "";
+	const stored = `${storedTenant(ctx)} and c.scope = p_scope and c.role = p_role and (c.scope_id is null or c.scope_id = p_scope_id)`;
+	const grants = forUser ? `revoke execute on function ${fn}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(${tenantType}, text, text, text) from public, anon;
+grant execute on function ${fn}(${tenantType}, text, text, text) to authenticated;`;
+	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign custom role p_role at instance p_scope_id (a platform role: null tenant, scope global): the custom-role write checks on its stored definition${forUser ? "; no client role may execute it" : ""}
+create or replace function ${fn}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_scope_id text;
+  v_found boolean := false;
+begin
+  select true, c.scope_id into v_found, v_scope_id
+  from (
+    select c.scope_id from ${perms} c where ${stored}
+    union all
+    select c.scope_id from ${includes} c where ${stored}
+  ) c
+  order by c.scope_id nulls first
+  limit 1;
+  if not coalesce(v_found, false) then
+    return false;
+  end if;
+  perform ${guard}(${forUser ? "p_user, " : ""}p_tenant, p_scope, v_scope_id, p_role);
+  return true;
+exception
+  when insufficient_privilege or invalid_parameter_value then
+    return false;
+end;
+$$;
+${grants}`;
+}
+/**
+* The assignment triggers (\`rls.assignments\`): before a client role inserts,
+* updates or deletes a row that assigns a role, every role the old and new row
+* hold must be one the caller may assign at that instance, by
+* \`permdock_can_assign\` for a declared role and
+* \`permdock_can_assign_custom_role\` for a custom one. The functions run as
+* the invoker, so \`current_user\` tells a client write from a trusted one.
+*/
+function assignmentSql(ctx) {
+	const own = ctx.ownership;
+	if (ctx.assignments === void 0 || own === void 0 || own.assigns.length === 0) return "";
+	const canAssign = qualified(ctx, OWNERSHIP.canAssign);
+	const custom = ctx.customRoles !== void 0 && ctx.authorize === "database";
+	const declared = ctx.customRoles?.declared;
+	const tenantType = tenantTypeOf(ctx);
+	const chunks = [];
+	const clients = `current_user::text = any(array[${CLIENT_ROLES.map(quoteLiteral).join(", ")}])`;
+	const tables = assignedTables(ctx);
+	const ownRole = ownRoleTables(ctx, tables);
+	for (const entry of tables) {
+		const table = quoteQualified(entry.table);
+		const suffix = entry.table.replaceAll(/[^a-z0-9_]/gu, "_");
+		const fn = qualified(ctx, quoteIdent(`${ASSIGNMENTS.trigger}_${suffix}`));
+		const ownUser = entry.user !== void 0 && ownRole.has(qualifySqlTable(entry.table)) ? entry.user : void 0;
+		const ownCheck = (row, reason) => ownUser === void 0 ? "" : `    if ${row}.${quoteIdent(ownUser)}::text = (${subjectIdSql(ctx)})::text then
+      raise exception using
+        errcode = '42501',
+        message = 'permdock: the caller may not change their own roles',
+        hint = '${reason}';
+    end if;
+`;
+		const check = (row) => {
+			const id = entry.id === void 0 ? "null::text" : `${row}.${quoteIdent(entry.id)}::text`;
+			const customFn = qualified(ctx, ASSIGNMENTS.custom);
+			let allowed = `${canAssign}(v_role, ${id})`;
+			if (custom && declared !== void 0) {
+				const platform = `${customFn}(null, 'global', null, v_role)`;
+				allowed = entry.id === void 0 || entry.tenant === void 0 ? `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) else ${platform} end` : `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) when ${id} is null then ${platform} else ${customFn}(${row}.${quoteIdent(entry.tenant)}::${tenantType}, ${quoteLiteral(entry.scope)}, ${id}, v_role) end`;
+			}
+			return `    foreach v_role in array array[${rowRoles(entry, row).join(", ")}]::text[] loop
+      if v_role is not null and not coalesce(${allowed}, false) then
+        raise exception using
+          errcode = '42501',
+          message = 'permdock: the caller may not assign ' || v_role || ' in ' || coalesce(${id}, 'null'),
+          hint = 'not-assignable-by';
+      end if;
+    end loop;`;
+		};
+		const what = entry.id === void 0 ? "global roles" : `${entry.scope} roles`;
+		chunks.push(`-- ${entry.table}: a client role may write only the ${what} it may assign${ownUser === void 0 ? "" : ", and none on its own rows"}
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+set search_path = ''
+as $$
+declare
+  v_role text;
+begin
+  if not (${clients}) then
+    return coalesce(new, old);
+  end if;
+  if tg_op in ('UPDATE', 'DELETE') then
+${ownCheck("old", "self-demotion")}${check("old")}
+  end if;
+  if tg_op in ('INSERT', 'UPDATE') then
+${ownCheck("new", "not-assignable-by")}${check("new")}
+  end if;
+  return coalesce(new, old);
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists "permdock_assignment" on ${table};
+create trigger "permdock_assignment"
+  before insert or update or delete on ${table}
+  for each row execute function ${fn}();`);
+	}
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/rls/can-assign.ts
+/**
+* Whether the signed-in user (or `p_user` in the `_for` form) holds, in
+* instance `p_scope_id`, a role whose `assigns` lists `p_role`.
+*/
+function canAssignSql(base, own, forUser = false) {
+	const ctx = forUser ? {
+		...base,
+		subjectId: "p_user",
+		tenants: "all"
+	} : base;
+	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
+	const parts = [];
+	const used = [];
+	const userOf = (source) => {
+		const index = used.includes(source) ? used.indexOf(source) : used.push(source) - 1;
+		return `v_user_${String(index)}`;
+	};
+	const global = own.assigns.filter((pair) => pair.scope === "global");
+	for (const [instance, pairs] of [["p_scope_id is not null", global.filter((pair) => pair.at !== "global")], ["p_scope_id is null", global.filter((pair) => pair.at === "global")]]) {
+		if (pairs.length === 0) continue;
+		if (ctx.authorize === "database") {
+			const ur = globalRoleRows(ctx);
+			const kind = globalKindFilterSql(ctx, ur.roleSql);
+			parts.push(`${instance} and exists (
+      select 1 from ${ur.from}
+      where ${ur.userSql} = ${subjectIdSql(ctx)}
+        and (${ur.roleSql}, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
+    )`);
+		} else {
+			const kind = globalKindFilterSql(ctx, "r.role");
+			parts.push(`${instance} and exists (
+      select 1 from ${roleRows(ctx)}
+      where (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
+    )`);
+		}
+	}
+	for (const { name } of ctx.scopes) {
+		const pairs = own.assigns.filter((pair) => pair.scope === name);
+		if (pairs.length === 0) continue;
+		const sources = scopeSources(ctx, name);
+		if (sources.length > 0) {
+			const kind = kindFilterSql(ctx, "r.role", "ms.via");
+			parts.push(`exists (
+      select 1
+      from (
+${sourceRowsSql(sources, userOf)}
+      ) ms
+      cross join lateral jsonb_array_elements_text(
+        case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
+      ) r(role)
+      where ms.scope = ${quoteLiteral(name)}
+        and ms.id = p_scope_id
+        and (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}${sourceFilters(ctx, name, void 0, void 0, sourcesKeep(sources)).replaceAll("\n    and ", "\n        and ")}
+    )`);
+			continue;
+		}
+		if (ctx.authorize === "database") {
+			const mapped = scopeTable(ctx, name);
+			if (mapped === void 0) continue;
+			const { table, column } = mapped;
+			const role = memberRoleOf(table, "m", "      ");
+			const filters = [
+				`${memberColumn(table.user)} = ${subjectIdSql(ctx)}`,
+				`${memberColumn(column)}::text = p_scope_id`,
+				`(${role.sql}, p_role) in (${pairsSql(pairs)})`
+			];
+			if (table.expiresAt !== void 0) {
+				const expires = memberColumn(table.expiresAt);
+				filters.push(`(${expires} is null or ${expires} > now())`);
+			}
+			const disabled = disabledColumn(table);
+			if (disabled !== void 0) filters.push(`${disabled} is null`);
+			const kind = kindFilterSql(ctx, role.sql, memberVia(table));
+			if (kind !== void 0) filters.push(kind);
+			parts.push(`exists (
+      select 1 from ${quoteQualified(table.table)} m${role.join}
+      where ${filters.join("\n        and ")}
+    )`);
+		} else {
+			const kind = kindFilterSql(ctx, "r.role", "m ->> 'via'");
+			parts.push(`exists (
+      select 1 from ${membershipRows(ctx)}
+      where m ->> 'scope' = ${quoteLiteral(name)}
+        and m ->> 'id' = p_scope_id
+        and (r.role, p_role) in (${pairsSql(pairs)})
+        and case jsonb_typeof(m -> 'expires_at')
+          when 'number' then (m ->> 'expires_at')::numeric > extract(epoch from now())
+          else true
+        end${kind === void 0 ? "" : `\n        and ${kind}`}${claimKeptLines(ctx, "        ").map((line) => `\n${line}`).join("")}
+    )`);
+		}
+	}
+	const body = parts.length === 0 ? "false" : parts.join("\n    or ");
+	const language = used.length === 0 ? `language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${signedIn(ctx)} and (
+    ${body}
+  )
+$$;` : `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${used.map((source, index) => `  v_user_${String(index)} ${source.sql.userType} := ${subjectIdSql(ctx)};`).join("\n")}
+begin
+  return ${signedIn(ctx)} and (
+    ${body}
+  );
+end;
+$$;`;
+	if (forUser) {
+		const user = ctx.dialect === "supabase" ? "uuid" : "text";
+		return `-- who may assign, for a user the caller names: trusted SQL acting later for a stored user; no client role may execute it
+create or replace function ${fn}(p_user ${user}, p_role text, p_scope_id text)
+returns boolean
+${language}
+revoke execute on function ${fn}(${user}, text, text) from public, anon, authenticated;`;
+	}
+	return `-- who may assign: a held role whose assigns lists p_role, in instance p_scope_id (its scope or an ancestor's); a null p_scope_id assigns a global role, which only global assigners may
+create or replace function ${fn}(p_role text, p_scope_id text)
+returns boolean
+${language}
+revoke execute on function ${fn}(text, text) from public, anon;
+grant execute on function ${fn}(text, text) to authenticated;`;
+}
+/**
+* Whether the helpers keep custom roles in tables, so assigning one is checked
+* against its stored definition.
+*/
+function assignsCustomRoles(ctx) {
+	return ctx.customRoles !== void 0 && ctx.authorize === "database";
+}
+/**
+* Whether `permdock_can_assign_any_for` is written: every function it calls has
+* a `_for` form.
+*/
+function hasCanAssignAnyFor(ctx) {
+	return ctx.authorize === "database" && (!assignsCustomRoles(ctx) || hasCustomRoleChecksFor(ctx));
+}
+/**
+* `permdock_can_assign_any`: one check for a declared or a custom role, so SQL
+* that assigns roles calls one function: `permdock_can_assign` for a declared
+* role, `permdock_can_assign_custom_role` for a custom one. `p_scope`
+* `'global'` (no tenant, no instance) assigns a platform role.
+*/
+function canAssignAnySql(ctx, custom, forUser = false) {
+	const tenantType = tenantTypeOf(ctx);
+	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignAnyFor : OWNERSHIP.canAssignAny);
+	const declaredFn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
+	const customFn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
+	const userType = ctx.dialect === "supabase" ? "uuid" : "text";
+	const userParam = forUser ? `p_user ${userType}, ` : "";
+	const userArg = forUser ? `${userType}, ` : "";
+	const user = forUser ? "p_user, " : "";
+	const declared = `${declaredFn}(${user}p_role, case when p_scope = 'global' then null else p_scope_id end)`;
+	const body = custom && ctx.customRoles !== void 0 ? `case
+    when p_role = any(${declaredArray(ctx.customRoles.declared)}) then ${declared}
+    when p_scope = 'global' then ${customFn}(${user}null, 'global', null, p_role)
+    else ${customFn}(${user}p_tenant, p_scope, p_scope_id, p_role)
+  end` : declared;
+	const grants = forUser ? `revoke execute on function ${fn}(${userArg}text, ${tenantType}, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(text, ${tenantType}, text, text) from public, anon;
+grant execute on function ${fn}(text, ${tenantType}, text, text) to authenticated;`;
+	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign p_role at instance p_scope_id of p_scope in tenant p_tenant, declared or custom (p_scope 'global' for a platform role)${forUser ? "; no client role may execute it" : ""}
+create or replace function ${fn}(${userParam}p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(${body}, false)
+$$;
+${grants}`;
+}
+//#endregion
+//#region src/cli/rls/ownership.ts
+function roleScope(policy, scopes, name) {
+	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
+	return typeof on === "string" ? resolveScope(scopes, on) : void 0;
+}
+function isGlobalRole(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	if (binding !== void 0) return binding.on === void 0;
+	const leaf = findRole(policy.vocabulary.roles, name);
+	return leaf !== void 0 && leaf.on === void 0;
+}
+/** The rules `rls generate` enforces; `undefined` when no role declares one. */
+function ownershipRules(policy, scopes) {
+	const kinds = {};
+	const assigns = [];
+	const counted = [];
+	for (const binding of policy.roles) {
+		const scope = roleScope(policy, scopes, binding.name);
+		if (binding.for !== void 0) kinds[binding.name] = binding.for;
+		const assigner = scope ?? (binding.on === void 0 ? "global" : void 0);
+		for (const target of binding.assigns ?? []) {
+			const at = roleScope(policy, scopes, target);
+			if (assigner !== void 0 && at !== void 0 && (assigner === "global" || scopeChain(scopes, at).includes(assigner))) assigns.push({
+				assigner: binding.name,
+				scope: assigner,
+				role: target,
+				at
+			});
+			else if (assigner === "global" && isGlobalRole(policy, target)) assigns.push({
+				assigner: binding.name,
+				scope: "global",
+				role: target,
+				at: "global"
+			});
+		}
+		const min = binding.min ?? 0;
+		const transferOnly = binding.transferOnly === true;
+		if (scope !== void 0 && (min > 0 || binding.max !== void 0 || transferOnly)) counted.push(binding.max === void 0 ? {
+			role: binding.name,
+			scope,
+			min,
+			transferOnly
+		} : {
+			role: binding.name,
+			scope,
+			min,
+			max: binding.max,
+			transferOnly
+		});
+	}
+	if (Object.keys(kinds).length === 0 && assigns.length === 0 && counted.length === 0) return;
+	return {
+		kinds,
+		assigns,
+		counted
+	};
+}
+/**
+* The roles whose `for` lists kinds that no membership source of the role's
+* scope can hold: such a role resolves to no one. A `via` read from a column
+* can hold any kind, and so does a source with no `via` (it is not compared)
+* and a scope with no table or source.
+*/
+function unsatisfiedKinds(ctx, policy) {
+	const out = [];
+	for (const [role, kinds] of Object.entries(ctx.ownership?.kinds ?? {})) {
+		const scope = roleScope(policy, ctx.scopes, role);
+		if (scope === void 0) continue;
+		const held = [];
+		const mapped = scopeTable(ctx, scope)?.table;
+		if (mapped === void 0) for (const source of ctx.memberSources ?? ctx.sources ?? []) {
+			if (source.sql.scope !== void 0 && source.sql.scope !== scope) continue;
+			const via = source.sql.manifest.via;
+			held.push({
+				label: source.sql.table,
+				via: via === void 0 ? void 0 : "value" in via && typeof via.value === "string" ? via.value : void 0
+			});
+		}
+		else {
+			const via = memberVia(mapped);
+			held.push({
+				label: mapped.table,
+				via: typeof via === "string" ? void 0 : via.value ?? void 0
+			});
+		}
+		if (held.length === 0 || held.some((entry) => entry.via === void 0 || kinds.includes(entry.via ?? ""))) continue;
+		out.push({
+			role,
+			for: kinds,
+			sources: held.map((entry) => `${entry.label} (via ${entry.via ?? ""})`)
+		});
+	}
+	return out;
+}
+/**
+* The ownership objects: holder-count and transfer-only triggers on each
+* scope's membership table, and `permdock_can_assign` for the application's own
+* policies on those tables. Empty when no role declares a rule.
+*/
+function ownershipSql(ctx) {
+	const own = ctx.ownership;
+	if (own === void 0) return "";
+	const chunks = [];
+	const skipped = ctx.skipOwnershipTriggers;
+	for (const { name } of ctx.scopes) {
+		const counted = own.counted.filter((rule) => rule.scope === name);
+		if (counted.length === 0) continue;
+		if (skipped === "all" || skipped?.includes(name) === true) {
+			chunks.push(`-- ${name}: rls.ownershipTriggers leaves out the triggers, so min, max and transferOnly are checked only by decideRoleChange`);
+			continue;
+		}
+		const transfer = counted.filter((rule) => rule.transferOnly).map((rule) => rule.role);
+		const mapped = scopeTable(ctx, name);
+		if (mapped === void 0) {
+			const sources = holderSources(ctx, name);
+			if (sources === void 0) chunks.push(`-- ${name}: no memberships table configured, so min, max and transferOnly are checked only by decideRoleChange`);
+			else if (sources === "not-tables") chunks.push(`-- ${name}: a membership source is not a table, so min, max and transferOnly are checked only by decideRoleChange`);
+			else {
+				chunks.push(sourceHoldersTriggerSql(ctx, name, sources, counted));
+				if (transfer.length > 0) chunks.push(sourceTransferTriggerSql(ctx, name, sources, transfer));
+			}
+			continue;
+		}
+		chunks.push(holdersTriggerSql(ctx, name, mapped.table, mapped.column, counted));
+		if (transfer.length > 0) chunks.push(transferTriggerSql(ctx, name, mapped.table, mapped.column, transfer));
+	}
+	if (own.assigns.length > 0) {
+		chunks.push(canAssignSql(ctx, own));
+		if (ctx.authorize === "database") chunks.push(canAssignSql(ctx, own, true));
+		const custom = assignsCustomRoles(ctx);
+		if (custom) {
+			chunks.push(canAssignCustomSql(ctx));
+			if (hasCustomRoleChecksFor(ctx)) chunks.push(canAssignCustomSql(ctx, true));
+		}
+		chunks.push(canAssignAnySql(ctx, custom));
+		if (hasCanAssignAnyFor(ctx)) chunks.push(canAssignAnySql(ctx, custom, true));
+	}
+	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+export { guardedTables as a, breakGlassKey as c, andConditions as d, compileConditionSql as f, assignmentSql as i, collectGrants as l, sqlFunctionNames as m, ownershipSql as n, assignableRoles as o, contextRefs as p, unsatisfiedKinds as r, breakGlassHolder as s, ownershipRules as t, roleNames as u };