permdock 0.6.0 → 0.8.0

package/dist/{ownership-DqaJNJPn.js → tables-DeMNEy6V.js}

@@ -1,17 +1,15 @@
-import { a as sole, n as isReadonlyArray, r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { l as isSqlFunctionField } from "./refs-K6eWUJ0H.js";
-import { u as isoAt } from "./time-DkWjdL98.js";
-import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { t as isoInstant } from "./instant-BluqDvyS.js";
-import { m as findRole, v as listRoles } from "./grantee-hxrUsbpM.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { l as partitionsOf, p as scopeField } from "./tenancy-DN2QAx9z.js";
-import { i as configError } from "./errors-CWTY6uih.js";
-import { i as scopeMembershipTable, o as relatedSql, r as scopeColumn } from "./compile-CMqMx_IN.js";
-import { i as qualifySqlTable, t as SQL_IDENT, u as sqlTextArray } from "./sql-B5T1IL83.js";
-import { d as keptKeys, l as roleColumn, u as roleManifest } from "./sources-vs5dGOsS.js";
-import { A as declaredArray, D as sqlType, E as scopeTypeOf, F as quoteQualified, I as quoteTable, L as textArrayLiteral, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, S as CLAIM, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as helperSchema, k as CLI, m as memberVia, n as GLOBAL_ROLES, o as rootName, p as liveSessionSql, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, x as userIdHelperSql, y as subjectIdSql } from "./shared-BAK8t4Uo.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { l as partitionsOf, p as scopeField } from "./tenancy-5d1zVBvK.js";
+import { a as delegatedScopeMap } from "./permdock-L-_I_3zP.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { d as sqlTextArray, i as qualifySqlTable, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
+import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-EzEMB-7v.js";
+import { d as keptKeys, l as roleColumn, u as roleManifest } from "./sources-CMAM-2A3.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, _ as subjectClaimJsonSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as quoteTable, k as quoteLiteral, m as memberVia, n as GLOBAL_ROLES, o as rootName, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, w as CLI, x as userIdHelperSql, y as subjectIdSql } from "./shared-Afctg7B0.js";
 //#region src/cli/sql/active.ts
 function checkActiveRow(label, row) {
 	quoteTable(row.table);
@@ -84,16 +82,19 @@ function activeUserSql(ctx, user = subjectIdSql(ctx)) {
 	const row = ctx.suspension?.users;
 	return row === void 0 ? [] : [activeRowSql(row, user)];
 }
-/** The permission of a grant key held in `grant`: `key#group` and `key@level` name `key`. */
+/**
+* The permission of a grant key held in `grant`: `key#group` and `key@level`
+* name `key`.
+*/
 function grantPermissionSql(grant) {
 	return { sql: `split_part(split_part(${grant}, '#', 1), '@', 1)` };
 }
 /**
-* The active-instance check for every suspendable scope on `scope`'s chain:
-* its own and each ancestor's. `idOf` gives the SQL for the id the membership
-* holds for a scope on that chain. A scope's `keep` lets `permission` through
-* a suspended instance: a kept key known now drops its check, and one read
-* at run time is compared with the kept keys.
+* The active-instance check for every suspendable scope on `scope`'s chain: its
+* own and each ancestor's. `idOf` gives the SQL for the id the membership holds
+* for a scope on that chain. A scope's `keep` lets `permission` through a
+* suspended instance: a kept key known now drops its check, and one read at run
+* time is compared with the kept keys.
 */
 function activeInstancesSql(ctx, scope, idOf, permission = ctx.permission === void 0 ? void 0 : { key: ctx.permission }) {
 	const parts = [];
@@ -115,8 +116,8 @@ function activeInstancesSql(ctx, scope, idOf, permission = ctx.permission === vo
 const CLOSURE = { table: "permdock_closure" };
 /**
 * The snake_case SQL name of a resource or link (`chatThread` becomes
-* `chat_thread`), or `undefined` when it is not made of ASCII letters,
-* digits and underscores starting with a letter.
+* `chat_thread`), or `undefined` when it is not made of ASCII letters, digits
+* and underscores starting with a letter.
 */
 function graphSqlName(name) {
 	if (!/^[A-Za-z][A-Za-z0-9_]*$/u.test(name)) return;
@@ -127,21 +128,30 @@ function sqlNameOf(name, label) {
 	if (sql === void 0) throw configError(`PermDock CLI: ${label} is not a SQL name (letters, digits and underscores, starting with a letter), so rls generate cannot name its helper`);
 	return sql;
 }
-/** The helper returning the ids of `resource` the subject holds a relation on: `permitted_<snake_case resource>_ids`. */
+/**
+* The helper returning the ids of `resource` the subject holds a relation on:
+* `permitted_<snake_case resource>_ids`.
+*/
 function graphHelper(resource) {
 	return permittedIdsHelper(sqlNameOf(resource, `resource '${resource}'`));
 }
 function inheritedRowsHelper(resource) {
 	return `permitted_${sqlNameOf(resource, `resource '${resource}'`)}_rows`;
 }
-/** The helper returning the ids of `resource` whose `link` points into the ids it is given. */
+/**
+* The helper returning the ids of `resource` whose `link` points into the ids
+* it is given.
+*/
 function linkHelper(resource, link) {
 	return `permdock_link_${sqlNameOf(resource, `resource '${resource}'`)}_${sqlNameOf(link, `link '${link}' on ${resource}`)}`;
 }
 function restrictedHelper(resource) {
 	return `permdock_restricted_${sqlNameOf(resource, `resource '${resource}'`)}`;
 }
-/** Graph SQL parts as RLS text: values inline as literals, the subject from the dialect's claim. */
+/**
+* Graph SQL parts as RLS text: values inline as literals, the subject from the
+* dialect's claim.
+*/
 function graphSqlText(parts, ctx) {
 	return parts.map((part) => {
 		if ("text" in part) return part.text;
@@ -168,23 +178,51 @@ function permittedIdsHelper(name) {
 	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw configError(`PermDock CLI: unsafe scope name '${name}'`);
 	return `permitted_${name}_ids`;
 }
-/** `permitted_<scope>_ids_for(p_user, p_grant)`: the same ids for a user the caller names. */
+/**
+* `permitted_<scope>_ids_for(p_user, p_grant)`: the same ids for a user the
+* caller names.
+*/
 function permittedForHelper(name) {
 	return `${permittedIdsHelper(name)}_for`;
 }
-/** The helper returning the ids of scope `name` the subject holds any live membership of. */
+/**
+* The helper returning the ids of scope `name` the subject holds any live
+* membership of.
+*/
 function memberIdsHelper(name) {
 	if (!/^[a-z][a-z0-9_]*$/u.test(name)) throw configError(`PermDock CLI: unsafe scope name '${name}'`);
 	return `member_${name}_ids`;
 }
-/** `member_<scope>_ids_for(p_user uuid)`: the same rows for a user the caller names; the token hook's helper. */
+/**
+* `member_<scope>_ids_for(p_user uuid)`: the same rows for a user the caller
+* names; the token hook's helper.
+*/
 function memberForHelper(name) {
 	return `${memberIdsHelper(name)}_for`;
 }
 /**
-* Whether `member_<scope>_ids_for` is generated for `name`: Supabase only
-* (its one caller is `supabase_auth_admin`), and only where `memberships` maps
-* a table for the scope or a membership source can hold it.
+* `member_<scope>_ids_of(p_user uuid)`: `member_<scope>_ids_for(p_user)` when
+* `p_user` is the caller and no rows otherwise, so `authenticated` may execute
+* it; better-supabase's `teamIdsOf` template calls it.
+*/
+function memberOfHelper(name) {
+	return `${memberIdsHelper(name)}_of`;
+}
+/** A scope better-supabase reads as its teams: `team` or `teams` (doctor BS417). */
+function isTeamScope(name) {
+	return /^teams?$/u.test(name);
+}
+/**
+* Whether `member_<scope>_ids_of` is generated: a team scope with
+* `member_<scope>_ids_for`.
+*/
+function hasMemberOf(input, name) {
+	return isTeamScope(name) && hasMemberFor(input, name);
+}
+/**
+* Whether `member_<scope>_ids_for` is generated for `name`: Supabase only (its
+* one caller is `supabase_auth_admin`), and only where `memberships` maps a
+* table for the scope or a membership source can hold it.
 */
 function hasMemberFor(input, name) {
 	if (input.dialect !== "supabase") return false;
@@ -199,26 +237,36 @@ function hasPermittedUsers(input, name) {
 	const sources = memberForSources(input, name);
 	return sources.length > 0 && sources.every((source) => source.sql.holders !== void 0);
 }
-/** The table `member_<scope>_ids_for` reads for scope `name`, when `memberships` maps one with its id column. */
+/**
+* The table `member_<scope>_ids_for` reads for scope `name`, when `memberships`
+* maps one with its id column.
+*/
 function memberForTable(input, name) {
 	const table = scopeMembershipTable(input.memberships, input.scopes, name);
 	return table !== void 0 && scopeColumn(table, input.scopes, name) !== void 0 ? table : void 0;
 }
-/** The sources `member_<scope>_ids_for` reads: none when a table is mapped, as in `database` mode. */
+/**
+* The sources `member_<scope>_ids_for` reads: none when a table is mapped, as
+* in `database` mode.
+*/
 function memberForSources(input, name) {
 	if (memberForTable(input, name) !== void 0) return [];
 	return (input.memberSources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
 }
 /**
-* The membership sources that can hold scope `name` when `memberships` maps
-* no table for it: every `tableMembershipSource` source and the `junctionMembershipSource` sources of
-* that scope. Empty outside `database` mode.
+* The membership sources that can hold scope `name` when `memberships` maps no
+* table for it: every `tableMembershipSource` source and the
+* `junctionMembershipSource` sources of that scope. Empty outside `database`
+* mode.
 */
 function scopeSources(ctx, name) {
 	if (ctx.authorize !== "database" || scopeTable(ctx, name) !== void 0) return [];
 	return (ctx.sources ?? []).filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
 }
-/** The membership table mapped for scope `name`, with the column of its id and of the first scope's id. */
+/**
+* The membership table mapped for scope `name`, with the column of its id and
+* of the first scope's id.
+*/
 function scopeTable(ctx, name) {
 	const table = scopeMembershipTable(ctx.memberships, ctx.scopes, name);
 	if (table === void 0) return;
@@ -236,477 +284,6 @@ function scopeTable(ctx, name) {
 	};
 }
 //#endregion
-//#region src/cli/sql/conditions.ts
-const MAX_CLAIM_DEPTH = 8;
-/**
-* The claim path of a `principal.claim.*` / `principal.claims.*` ref, one
-* segment per JSON key; `undefined` for any other ref.
-*/
-function claimPath(ref) {
-	const prefix = ["principal.claim.", "principal.claims."].find((item) => ref.startsWith(item));
-	if (prefix === void 0) return;
-	const segments = ref.slice(prefix.length).split(".");
-	if (segments.length > MAX_CLAIM_DEPTH) throw configError(`PermDock CLI: claim path '${ref}' is deeper than ${MAX_CLAIM_DEPTH}`);
-	for (const segment of segments) if (!CLAIM.test(segment) || isForbiddenKey(segment)) throw configError(`PermDock CLI: unsafe claim name '${segment}'`);
-	return segments;
-}
-function jsonPath(base, keys, last) {
-	let sql = base;
-	for (const [index, key] of keys.entries()) sql += ` ${index === keys.length - 1 ? last : "->"} ${quoteLiteral(key)}`;
-	return sql;
-}
-/**
-* The JSON document a claim path starts from and the keys to walk in it. The
-* `guc` dialect keeps each top-level claim in its own setting as JSON text.
-*/
-function claimRoot(ctx, path) {
-	const [head, ...rest] = path;
-	if (head === void 0) throw configError("PermDock CLI: empty claim path");
-	switch (ctx.dialect) {
-		case "supabase": return {
-			root: "(select auth.jwt())",
-			keys: path
-		};
-		case "neon": return {
-			root: "(select auth.session())",
-			keys: path
-		};
-		case "guc": return {
-			root: subjectClaimJsonSql(ctx, head),
-			keys: rest
-		};
-		default: return ctx.dialect;
-	}
-}
-/** The claim at `path` as `jsonb`. */
-function claimJsonSql(ctx, path) {
-	const { root, keys } = claimRoot(ctx, path);
-	return keys.length === 0 ? root : `(${jsonPath(root, keys, "->")})`;
-}
-/** The claim at `path` as text: `->>` on the last key, or the plain setting for a one-segment `guc` claim. */
-function claimTextSql(ctx, path) {
-	const [head] = path;
-	if (path.length === 1 && head !== void 0) return subjectClaimSql(ctx, head);
-	const { root, keys } = claimRoot(ctx, path);
-	return `(${jsonPath(root, keys, "->>")})`;
-}
-/** The JSON kind a claim must have to compare with a column of `type`. */
-function jsonKindOf(type) {
-	if (type === "numeric") return "number";
-	return type === "boolean" ? "boolean" : "string";
-}
-/**
-* A claim compared with a column of `type`. Numbers and booleans must be JSON
-* of that kind (anything else is `null`, so the comparison is false, as in
-* memory); other types cast the text form. A one-segment `guc` claim is text
-* and is cast as is.
-*/
-function typedClaimSql(ctx, path, type) {
-	const text = claimTextSql(ctx, path);
-	if (type === void 0 || type === "text") return text;
-	const cast = `${text}::${sqlType(type)}`;
-	const kind = jsonKindOf(type);
-	if (kind === "string" || ctx.dialect === "guc" && path.length === 1) return `(${cast})`;
-	return `(case when jsonb_typeof(${claimJsonSql(ctx, path)}) = '${kind}' then ${cast} end)`;
-}
-/**
-* The elements of an array claim as a Postgres array of the column's type,
-* built once per statement (an uncorrelated `array(select ...)` is an InitPlan).
-* A missing or non-array claim is the empty array; elements of another JSON
-* kind are left out.
-*/
-function claimArraySql(ctx, path, type) {
-	const json = claimJsonSql(ctx, path);
-	return `array(select ${type === void 0 || type === "text" ? `(e #>> '{}')` : `(e #>> '{}')::${sqlType(type)}`} from jsonb_array_elements(case when jsonb_typeof(${json}) = 'array' then ${json} else '[]'::jsonb end) e where jsonb_typeof(e) = '${jsonKindOf(type)}')`;
-}
-function sqlValue(value, ctx, field) {
-	if (value !== null && typeof value === "object" && "ref" in value) return compileRef(value.ref, ctx, field);
-	if (value !== null && typeof value === "object" && "date" in value) {
-		const instant = isoInstant(value.date);
-		return instant === void 0 ? "null" : quoteLiteral(isoAt(instant));
-	}
-	if (isReadonlyArray(value)) return `array[${value.map((item) => sqlValue(item, ctx)).join(", ")}]`;
-	if (value === null) return "null";
-	if (typeof value === "boolean") return value ? "true" : "false";
-	if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
-	if (typeof value === "string") return quoteLiteral(value);
-	throw configError("PermDock CLI: non-portable condition value");
-}
-function compileRef(ref, ctx, field) {
-	if (ref === "principal.id") return subjectIdSql(ctx);
-	if (ref === "now") return "now()";
-	const path = claimPath(ref);
-	if (ref === "principal.tenant" || path?.length === 1 && path[0] === ctx.tenantClaim) return tenantClaimSql(ctx);
-	if (path !== void 0) return typedClaimSql(ctx, path, field === void 0 ? void 0 : ctx.columnTypes?.[field]);
-	if (ref === "context" || ref.startsWith("context.")) throw configError(`PermDock CLI: '${ref}' is request context, which is not in the token; RLS cannot read it (permdock doctor PD027)`);
-	throw configError(`PermDock CLI: non-portable subject ref '${ref}'`);
-}
-/** `value` with `\`, `%` and `_` escaped for `like ... escape '\'`, as `escapeLike` does in process. */
-function likeLiteralSql(value) {
-	return `replace(replace(replace(${value}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`;
-}
-function compareSql(op, field, value) {
-	const left = quoteIdent(field);
-	switch (op) {
-		case "eq": return `${left} = ${value}`;
-		case "ne": return `${left} <> ${value}`;
-		case "gt": return `${left} > ${value}`;
-		case "gte": return `${left} >= ${value}`;
-		case "lt": return `${left} < ${value}`;
-		case "lte": return `${left} <= ${value}`;
-		case "contains": return `${left}::text like '%' || ${likeLiteralSql(`${value}::text`)} || '%' escape '\\'`;
-		default: return op;
-	}
-}
-/**
-* Whether the row's `rowField` is among the ids in `table.rowColumn` the
-* subject holds a matching membership on. The row field stays outside the
-* subquery: inside it, an unqualified name resolves to the membership table
-* first, so `m.org_id = "org_id"` would compare the membership with itself.
-*/
-function membershipSql(table, rowColumn, rowField, roles, ctx, tenantColumn, scope) {
-	const parts = [`m.${quoteIdent(table.user)} = ${subjectIdSql(ctx)}`];
-	const role = memberRoleOf(table);
-	if (roles.length > 0) {
-		const held = role.through === void 0 && !role.lateral ? `m.${quoteIdent(role.column)}` : role.lookup;
-		parts.push(`${held} = any(${textArrayLiteral(roles)})`);
-		const via = memberVia(table);
-		const single = sole(roles);
-		const kind = single === void 0 ? kindFilterSql(ctx, role.lookup, via) : roleKindSql(ctx, single, via);
-		if (kind !== void 0) parts.push(kind);
-	}
-	if (table.expiresAt !== void 0) parts.push(`(m.${quoteIdent(table.expiresAt)} is null or m.${quoteIdent(table.expiresAt)} > now())`);
-	parts.push(...activeMembershipSql(ctx, table.disabledAt === void 0 ? void 0 : `m.${quoteIdent(table.disabledAt)}`));
-	if (tenantColumn !== void 0 && ctx.tenants !== "all") parts.push(`m.${quoteIdent(tenantColumn)} = ${tenantClaimSql(ctx)}`);
-	parts.push(...activeUserSql(ctx));
-	if (scope !== void 0) {
-		const tenantOf = scope === rootScope(ctx.scopes) ? rowColumn : tenantColumn;
-		const keyed = keyTenantSql(ctx, tenantOf === void 0 ? void 0 : `m.${quoteIdent(tenantOf)}`);
-		if (keyed !== void 0) parts.push(keyed);
-		parts.push(...activeInstancesSql(ctx, scope, (name) => {
-			const held = scopeColumn(table, ctx.scopes, name);
-			return held === void 0 ? void 0 : `m.${quoteIdent(held)}`;
-		}));
-	}
-	const expand = roles.length > 0 && role.lateral ? role.join : "";
-	return `${quoteIdent(rowField)} in (select m.${quoteIdent(rowColumn)} from ${quoteTable(table.table)} m${expand} where ${parts.join(" and ")})`;
-}
-function compileMemberOf(condition, ctx) {
-	const scope = condition.scope === "resource" ? void 0 : resolveScope(ctx.scopes, condition.scope);
-	if (condition.scope !== "resource" && scope === void 0) throw configError(`PermDock CLI: memberOf ${condition.scope} names a scope the policy does not declare`);
-	const mapping = scope === void 0 ? condition.resource === void 0 ? void 0 : ctx.memberships?.resource?.[condition.resource] : scopeMembershipTable(ctx.memberships, ctx.scopes, scope);
-	if (mapping !== void 0) {
-		const named = scope === void 0 ? void 0 : scopeTable(ctx, scope);
-		const rowColumn = scope === void 0 ? mapping.id : named?.column;
-		if (rowColumn === void 0) throw configError(`PermDock CLI: memberships mapping for ${condition.scope} is missing the row column`);
-		const tenantColumn = scope === void 0 || scope === rootScope(ctx.scopes) ? void 0 : named?.tenantColumn;
-		const primary = membershipSql(mapping, rowColumn, condition.field, condition.roles, ctx, tenantColumn, scope);
-		if (condition.scope !== "resource" || condition.parents === void 0) return primary;
-		return `(${[primary, ...condition.parents.flatMap((parent) => {
-			if (typeof parent === "string") return [membershipSql(mapping, rowColumn, parent, condition.roles, ctx, tenantColumn)];
-			const hopTable = ctx.memberships?.resource?.[parent.resource];
-			return hopTable?.id === void 0 ? [] : [membershipSql(hopTable, hopTable.id, parent.field, condition.roles, ctx)];
-		})].join(" or ")})`;
-	}
-	if (scope !== void 0 && condition.roles.length === 0 && scopeSources(ctx, scope).length > 0) return `${quoteIdent(condition.field)} in (select ${qualified(ctx, memberIdsHelper(scope))}())`;
-	if (scope !== void 0 && scope === rootScope(ctx.scopes)) {
-		const parts = [
-			ctx.tenants === "all" ? `${quoteIdent(condition.field)} in (select ${qualified(ctx, memberIdsHelper(scope))}())` : `${quoteIdent(condition.field)} = ${tenantClaimSql(ctx)}`,
-			...ctx.tenants === "all" ? [] : [keyTenantSql(ctx, quoteIdent(condition.field))].filter((part) => part !== void 0),
-			...activeUserSql(ctx),
-			...activeInstancesSql(ctx, scope, () => quoteIdent(condition.field))
-		];
-		return parts.length === 1 ? parts.join("") : `(${parts.join(" and ")})`;
-	}
-	throw configError(`PermDock CLI: memberOf ${condition.scope} needs a memberships table mapping`);
-}
-function compileConditionSql(condition, ctx) {
-	switch (condition.op) {
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte": return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
-		case "contains": {
-			const element = ctx.arrayColumns?.[condition.field];
-			if (element !== void 0) return `${sqlValue(condition.value, {
-				...ctx,
-				columnTypes: {
-					...ctx.columnTypes,
-					[condition.field]: element
-				}
-			}, condition.field)} = any(${quoteIdent(condition.field)})`;
-			return compareSql(condition.op, condition.field, sqlValue(condition.value, ctx, condition.field));
-		}
-		case "in":
-		case "notIn": {
-			const keyword = condition.op === "in" ? "in" : "not in";
-			if (!Array.isArray(condition.value) && typeof condition.value === "object" && "ref" in condition.value) {
-				const path = claimPath(condition.value.ref);
-				if (path === void 0) {
-					compileRef(condition.value.ref, ctx);
-					throw configError(`PermDock CLI: non-portable ${condition.op} against '${condition.value.ref}'`);
-				}
-				const column = quoteIdent(condition.field);
-				const list = claimArraySql(ctx, path, ctx.columnTypes?.[condition.field]);
-				return condition.op === "in" ? `${column} = any (${list})` : `(${column} is not null and not (${column} = any (${list})))`;
-			}
-			const values = condition.value.map((item) => sqlValue(item, ctx));
-			if (values.length === 0) return condition.op === "in" ? "false" : `${quoteIdent(condition.field)} is not null`;
-			return `${quoteIdent(condition.field)} ${keyword} (${values.join(", ")})`;
-		}
-		case "isNull": return `${quoteIdent(condition.field)} is ${condition.value ? "" : "not "}null`;
-		case "and": return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" and ")})`;
-		case "or":
-			if (condition.conditions.length === 0) return "false";
-			return `(${condition.conditions.map((item) => compileConditionSql(item, ctx)).join(" or ")})`;
-		case "not": return `(${compileConditionSql(condition.condition, ctx)}) is not true`;
-		case "memberOf": return compileMemberOf(condition, ctx);
-		case "related": return compileRelatedSql(condition, ctx);
-		case "sqlFunction":
-			if (ctx.inlineFunctions === true) return compileConditionSql(condition.twin, ctx);
-			return `${quoteTable(condition.name)}(${condition.args.map((arg) => isSqlFunctionField(arg) ? quoteIdent(arg.field) : sqlValue(arg, ctx)).join(", ")})`;
-		case "opaque": return condition.sql;
-		case "liveSession": return liveSessionSql(ctx);
-		default: return condition;
-	}
-}
-function andConditions(left, right) {
-	if (left === void 0) return right;
-	if (right === void 0) return left;
-	return {
-		op: "and",
-		conditions: [left, right]
-	};
-}
-function valueContextRefs(value) {
-	if (Array.isArray(value)) return value.flatMap(valueContextRefs);
-	if (isRecord(value) && typeof value["ref"] === "string" && (value["ref"] === "context" || value["ref"].startsWith("context."))) return [value["ref"]];
-	return [];
-}
-/**
-* The `context.*` refs a condition reads. The request context is not in the
-* token, so RLS cannot evaluate them.
-*/
-function contextRefs(condition) {
-	if (condition === void 0) return [];
-	switch (condition.op) {
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte":
-		case "contains":
-		case "in":
-		case "notIn": return valueContextRefs(condition.value);
-		case "and":
-		case "or": return condition.conditions.flatMap((child) => contextRefs(child));
-		case "not": return contextRefs(condition.condition);
-		case "sqlFunction": return [...condition.args.flatMap(valueContextRefs), ...contextRefs(condition.twin)];
-		case "isNull":
-		case "memberOf":
-		case "related":
-		case "opaque":
-		case "liveSession": return [];
-		default: return condition;
-	}
-}
-function sqlFunctionNames(condition) {
-	if (condition === void 0) return [];
-	switch (condition.op) {
-		case "sqlFunction": return [condition.name, ...sqlFunctionNames(condition.twin)];
-		case "and":
-		case "or": return condition.conditions.flatMap((child) => sqlFunctionNames(child));
-		case "not": return sqlFunctionNames(condition.condition);
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte":
-		case "contains":
-		case "in":
-		case "notIn":
-		case "isNull":
-		case "memberOf":
-		case "related":
-		case "opaque":
-		case "liveSession": return [];
-		default: return condition;
-	}
-}
-/**
-* A `related` condition as uncorrelated subqueries, so Postgres runs the
-* helper once per statement: the row's field in the closure's descendants of
-* the ids the subject holds the relation on (or those ids alone at depth 0).
-* The helper sits in `array(...)` so it stays an InitPlan; a plain `in` gets
-* pulled into a join that can rescan it per closure row.
-*/
-function compileRelatedSql(condition, ctx) {
-	if (condition.hops !== void 0 && condition.hops.length > 0) return compileHoppedSql(condition, ctx);
-	const type = ctx.columnTypes?.[condition.field];
-	const cast = type === void 0 || type === "text" ? "" : `::${type}`;
-	const column = type === void 0 ? `${quoteIdent(condition.field)}::text` : quoteIdent(condition.field);
-	const helper = condition.permission === void 0 ? `${qualified(ctx, graphHelper(condition.resource))}(${quoteLiteral(condition.relation)})` : `${qualified(ctx, inheritedRowsHelper(condition.resource))}(${quoteLiteral(condition.permission)})`;
-	const cap = ctx.graph?.closures[condition.resource];
-	let inner;
-	if (condition.depth > 0 && cap !== void 0) {
-		const depth = condition.depth < cap ? ` and depth <= ${String(condition.depth)}` : "";
-		inner = `select descendant${cast} from ${qualified(ctx, CLOSURE.table)} where resource = ${quoteLiteral(condition.resource)}${depth} and ancestor = any (array(select ${helper}))`;
-	} else inner = cast === "" ? `select ${helper}` : `select p.id${cast} from ${helper} as p(id)`;
-	const reach = `${column} in (${inner})`;
-	if (condition.parent === true && condition.restricted !== void 0) return `(${reach} and ${quoteIdent(condition.restricted)} is not true)`;
-	return reach;
-}
-/**
-* A `related` condition that crosses link hops: the reached instances of the
-* last resource, carried back over each link by its security definer helper,
-* so the hop reads a table the subject may not see.
-*/
-function compileHoppedSql(condition, ctx) {
-	const resources = ctx.graph?.resources;
-	if (resources === void 0) throw configError("PermDock CLI: a related condition with link hops needs the policy resources in the RLS context");
-	const schema = quoteIdent(helperSchema(ctx));
-	return graphSqlText(relatedSql(condition, {
-		resources,
-		...ctx.graph?.tables === void 0 ? {} : { tables: ctx.graph.tables },
-		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
-		closureDepths: ctx.graph?.closures ?? {},
-		qualify: qualifySqlTable,
-		holders: (resource, relation) => [{ text: `select ${schema}.${graphHelper(resource)}(${quoteLiteral(relation)})` }],
-		permitted: (resource, permission) => [{ text: `select ${schema}.${inheritedRowsHelper(resource)}(${quoteLiteral(permission)})` }],
-		restrictedRows: (resource) => [{ text: `select ${schema}.${restrictedHelper(resource)}()` }],
-		linked: (resource, link, targets) => [
-			{ text: `select ${schema}.${linkHelper(resource, link)}(array(` },
-			...targets,
-			{ text: "))" }
-		]
-	}), ctx);
-}
-//#endregion
-//#region src/cli/sql/grants.ts
-/**
-* The `role_permissions` grant key of a break-glass grant. It differs from
-* the permission key, so `authorize()` and the table policies never count it;
-* only the break-glass read asks for it.
-*/
-function breakGlassKey(permission) {
-	return `${permission}#break-glass`;
-}
-/**
-* The role and scope holding a break-glass grant. `breakGlass()` sets
-* `to: authenticated`, so inside `role()` the role is on the grant itself.
-*/
-function breakGlassHolder(item) {
-	if (item.access.kind === "role") return {
-		role: item.access.role,
-		scope: item.access.scope
-	};
-	const { role, scope } = item.grant;
-	return role === null || typeof scope !== "string" ? void 0 : {
-		role,
-		scope
-	};
-}
-function granteeItems(to) {
-	return Array.isArray(to) ? to : [to];
-}
-function relationWhere(policy, grant, grantee) {
-	const node = policy.resources.get(grant.permission.resource);
-	const where = relationCondition(grantee, node, scopeList(policy.scopes), {
-		resources: policy.resources,
-		now: { ref: "now" }
-	});
-	if (where === void 0) throw configError(`PermDock CLI: grant ${grant.permission.key} names relation '${grantee.relation}', which ${grant.permission.resource} does not declare`);
-	return where;
-}
-function inheritWhere(policy, grant, grantee) {
-	const where = inheritCondition(grantee, policy.resources.get(grant.permission.resource), policy.resources);
-	if (where === void 0) throw configError(`PermDock CLI: grant ${grant.permission.key} inherits ${grantee.permission}, which ${grant.permission.resource} cannot reach`);
-	return where;
-}
-/** Only a deny for `oauth-client` actors compiles: Postgres sees `client_id` and `act`, not other actor kinds. */
-function actorAccess(grant, grantee, others) {
-	if (grant.effect !== "deny" || grantee.actor !== "oauth-client" || others > 0) throw configError(`PermDock CLI: grant ${grant.permission.key} is limited to an actor grantee; RLS compiles only deny(…, { to: actor('oauth-client') }) on its own, so enforce it in the application`);
-	return {
-		kind: "actor",
-		actor: "oauth-client"
-	};
-}
-function accessOf(grant, roles, anyone) {
-	const [held, ...more] = roles;
-	if (more.length > 0) throw configError(`PermDock CLI: grant ${grant.permission.key} requires several roles at once (${roles.map((item) => item.role).join(", ")}); RLS compiles one role per grant`);
-	if (held === void 0) return anyone ? { kind: "anyone" } : { kind: "authenticated" };
-	if (typeof held.scope === "object") return {
-		kind: "resource",
-		role: held.role,
-		resource: held.scope.resource
-	};
-	return {
-		kind: "role",
-		role: held.role,
-		scope: held.scope
-	};
-}
-/**
-* Every grant RLS must enforce: role grants and top-level
-* `definePolicy({ grants })` alike (`policy.grants` holds both). A grantee
-* Postgres cannot see (plan, actor, assurance) fails with the permission named.
-*/
-function collectGrants(policy) {
-	return policy.grants.map((grant) => {
-		const items = granteeItems(grant.to);
-		const roles = [];
-		let anyone = true;
-		let where = grant.where;
-		let delegated;
-		for (const item of items) switch (item.kind) {
-			case "role":
-				roles.push(item);
-				break;
-			case "anyone": break;
-			case "authenticated":
-				anyone = false;
-				break;
-			case "relation":
-				anyone = false;
-				where = andConditions(where, relationWhere(policy, grant, item));
-				break;
-			case "inherit":
-				anyone = false;
-				where = andConditions(where, inheritWhere(policy, grant, item));
-				break;
-			case "actor":
-				delegated = actorAccess(grant, item, items.length - 1);
-				break;
-			case "plan":
-			case "assurance": throw configError(`PermDock CLI: grant ${grant.permission.key} is limited to a ${item.kind} grantee, which RLS cannot compile; enforce it in the application`);
-			default: return item;
-		}
-		const access = delegated ?? accessOf(grant, roles, anyone);
-		const label = access.kind === "role" || access.kind === "resource" ? access.role : access.kind;
-		return where === void 0 ? {
-			grant,
-			label,
-			access
-		} : {
-			grant,
-			label,
-			access,
-			where
-		};
-	});
-}
-/** Declared role names (bindings and `defineRoles` leaves) plus any role a top-level grant names. */
-function roleNames(policy) {
-	const names = new Set(policy.roles.map((item) => item.name));
-	for (const leaf of listRoles(policy.vocabulary.roles)) names.add(leaf.key);
-	for (const item of collectGrants(policy)) if (item.access.kind === "role" || item.access.kind === "resource") names.add(item.access.role);
-	return [...names];
-}
-//#endregion
 //#region src/cli/rls/api-keys.ts
 const API_KEY_ALLOWS = "permdock_api_key_allows";
 const DEFAULTS = {
@@ -832,7 +409,10 @@ ${body}
 }
 //#endregion
 //#region src/cli/shared/compare.ts
-/** UTF-16 code-unit order, never `localeCompare`: generated SQL must match byte for byte on every machine. */
+/**
+* UTF-16 code-unit order, never `localeCompare`: generated SQL must match byte
+* for byte on every machine.
+*/
 function byCodeUnit(a, b) {
 	return a < b ? -1 : a > b ? 1 : 0;
 }
@@ -848,10 +428,10 @@ const READERS = {
 	trusted: "permdock_trusted_role_permissions"
 };
 /**
-* The custom-role objects: the tables (`database` mode), the ceiling view
-* over the `assignable` declared roles, and `permdock_custom_keys`, which
-* resolves one custom role to the grant keys it holds in a scope. A row in
-* the tables can never reach a key outside the view.
+* The custom-role objects: the tables (`database` mode), the ceiling view over
+* the `assignable` declared roles, and `permdock_custom_keys`, which resolves
+* one custom role to the grant keys it holds in a scope. A row in the tables
+* can never reach a key outside the view.
 */
 function customRolesSql(ctx) {
 	const custom = ctx.customRoles;
@@ -978,7 +558,10 @@ revoke execute on function ${keys}(text[], text[], text[], text) from public, an
 	if (shared !== "") chunks.push(shared);
 	return chunks.join("\n\n");
 }
-/** `permdock_is_shared_role(p_scope, p_role)` (`database` mode): whether a shared custom role of that name exists at the scope. */
+/**
+* `permdock_is_shared_role(p_scope, p_role)` (`database` mode): whether a
+* shared custom role of that name exists at the scope.
+*/
 function sharedRoleSql(ctx) {
 	if (ctx.authorize !== "database") return "";
 	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
@@ -1000,8 +583,8 @@ $$;
 revoke execute on function ${shared}(text, text) from public, anon, authenticated;`;
 }
 /**
-* `permdock_custom_keys` when resources declare levels. An allow entry is
-* `key` or `key@level`. A level reaches only the ceiling's `<grant key>@<level>`
+* `permdock_custom_keys` when resources declare levels. An allow entry is `key`
+* or `key@level`. A level reaches only the ceiling's `<grant key>@<level>`
 * keys, plus the ceiling denies of that permission; a level no ceiling key
 * carries removes the permission, as `resolveCustomRole` drops it with
 * `unknown-level`.
@@ -1106,8 +689,8 @@ function currentKeysSql(array) {
 }
 /**
 * SQL fragments that read a stored former key as its current key inside
-* `permdock_custom_keys`. Without renames they are the plain column and
-* array reads.
+* `permdock_custom_keys`. Without renames they are the plain column and array
+* reads.
 */
 function renamesSql(renames) {
 	if (renames.length === 0) return {
@@ -1131,14 +714,14 @@ function renamesSql(renames) {
 }
 /**
 * The catalog reader `permdock_permission_keys()` and the role reader
-* `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)`, both
-* for `authenticated`. A declared role answers from `role_permissions`, which
-* is the catalog. A custom role (`database` mode) answers from the tenant's
-* own rows through `permdock_custom_keys`, only to a member of the tenant or
-* a holder of a `meta.manageRoles` permission for a platform role; a shared
-* role (no tenant below global) to any signed-in caller. The
-* effect is `deny` for a deny the role carries after the ceiling, as
-* `resolveCustomRole` returns it, never for a deny that merely removes an allow.
+* `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)`, both for
+* `authenticated`. A declared role answers from `role_permissions`, which is
+* the catalog. A custom role (`database` mode) answers from the tenant's own
+* rows through `permdock_custom_keys`, only to a member of the tenant or a
+* holder of a `meta.manageRoles` permission for a platform role; a shared role
+* (no tenant below global) to any signed-in caller. The effect is `deny` for a
+* deny the role carries after the ceiling, as `resolveCustomRole` returns it,
+* never for a deny that merely removes an allow.
 */
 function roleReadersSql(ctx, permissions, trustedReaders) {
 	const rp = qualified(ctx, "role_permissions");
@@ -1205,7 +788,7 @@ end;`;
           and ${qualified(ctx, HELPERS.has)}(m.grant_key)
       )`;
 		const match = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.scope_id is not distinct from p_scope_id and c.role = p_role`;
-		const allowEntryOf = custom.levels === true ? "c.permission || coalesce('@' || c.level, '')" : "c.permission";
+		const allowEntryOf = `c.${allowEntry(ctx)}`;
 		const checked = (gate) => `begin
   if p_role = any(${sqlTextArray(custom.declared)}) then
     return query
@@ -1248,7 +831,7 @@ revoke execute on function ${reader}(text, text, ${tenantType}, text) from publi
 grant execute on function ${reader}(text, text, ${tenantType}, text) to authenticated;`);
 	const trusted = qualified(ctx, READERS.trusted);
 	const signature = `text, text, ${tenantType}, text`;
-	const grants = trustedReaders === void 0 || trustedReaders.length === 0 ? "" : `\ngrant execute on function ${trusted}(${signature}) to ${trustedReaders.map(quoteIdent).join(", ")};`;
+	const grants = trustedReaders === void 0 || trustedReaders.length === 0 ? "" : `\n${trustedReaderGrants(ctx, `${trusted}(${signature})`, trustedReaders)}`;
 	chunks.push(`create or replace function ${trusted}(p_role text, p_scope text, p_tenant ${tenantType} default null, p_scope_id text default null)
 returns table (permission text, effect text)
 language plpgsql
@@ -1261,33 +844,42 @@ $$;
 revoke execute on function ${trusted}(${signature}) from public, anon, authenticated;${grants}`);
 	return chunks.join("\n\n");
 }
-/** The stored definition of `p_role` at `p_scope` for `p_tenant`: the shared rows when a shared role has the name. */
+/**
+* The stored definition of `p_role` at `p_scope` for `p_tenant`: the shared
+* rows when a shared role has the name.
+*/
 function storedTenant(ctx) {
 	return `case when ${qualified(ctx, CUSTOM_ROLES.shared)}(p_scope, p_role) then c.tenant_id is null else c.tenant_id is not distinct from p_tenant end`;
 }
 /**
-* The tenant half of a custom-role row match for a membership: the
-* membership's tenant, or no tenant when a shared role of that name exists at
-* the scope, so a shared role shadows a tenant role of the same name.
+* The tenant half of a custom-role row match for a membership: the membership's
+* tenant, or no tenant when a shared role of that name exists at the scope, so
+* a shared role shadows a tenant role of the same name.
 */
 function customTenantMatch(ctx, tenant, scope, role) {
 	return `case when ${qualified(ctx, CUSTOM_ROLES.shared)}(${quoteLiteral(scope)}, ${role}) then c.tenant_id is null else c.tenant_id::text = ${tenant} end`;
 }
 /**
-* The scope of a row of the application's roles table: its scope column (or
-* the first scope) with a tenant; with no tenant, the same scope when the
-* `shared` column is true, else `'global'`.
+* The scope of a row of the application's roles table: its scope column (or the
+* first scope) with a tenant; with no tenant, the same scope when the `shared`
+* column is true, else `'global'`.
 */
 function rolesTableScope(table, tenant, root, column) {
 	const own = table.scope === void 0 ? quoteLiteral(root) : `${column(table.scope)}::text`;
 	return `case when ${tenant} is null then ${table.shared === void 0 ? "'global'" : `case when coalesce(${column(table.shared)}, false) then ${own} else 'global' end`} else ${own} end`;
 }
-/** `expr` read as its current key: a former key maps to the key it was renamed to. */
+/**
+* `expr` read as its current key: a former key maps to the key it was renamed
+* to.
+*/
 function currentKeyExpr(renames, expr) {
 	if (renames.length === 0) return expr;
 	return `(case ${expr} ${renames.map(([former, current]) => `when ${quoteLiteral(former)} then ${quoteLiteral(current)}`).join(" ")} else ${expr} end)`;
 }
-/** `case p_scope when '<scope>' then <sql for scope> ... else false end` over the declared scopes. */
+/**
+* `case p_scope when '<scope>' then <sql for scope> ... else false end` over
+* the declared scopes.
+*/
 function perScope(ctx, sql) {
 	const arms = ctx.scopes.map((scope) => `when ${quoteLiteral(scope.name)} then ${sql(scope.name)}`).join(" ");
 	return arms === "" ? "false" : `(case p_scope ${arms} else false end)`;
@@ -1301,6 +893,16 @@ ${indent}  hint = ${quoteLiteral(hint)};`;
 function hasCustomRoleChecksFor(ctx) {
 	return ctx.authorize === "database" && ctx.customRoles !== void 0 && ctx.scopes.length > 0 && ctx.scopes.every((scope) => hasMemberFor(ctx, scope.name));
 }
+/**
+* The grants a `rls.trustedReaders` role needs for one reader: usage on the
+* helper schema, which no client role reaches through these lines, and execute
+* on the function.
+*/
+function trustedReaderGrants(ctx, fn, readers) {
+	const to = readers.map(quoteIdent).join(", ");
+	return `grant usage on schema ${quoteIdent(helperSchema(ctx))} to ${to};
+grant execute on function ${fn} to ${to};`;
+}
 //#endregion
 //#region src/cli/sql/global-roles.ts
 function qualify(name, schema) {
@@ -1310,7 +912,10 @@ function throughTenant(through, roles) {
 	if (through === void 0 || roles?.tenant === void 0) return;
 	return qualify(roles.table, "public") === through.table ? roles.tenant : void 0;
 }
-/** Resolves `source` against `schema`, aliasing the table `alias` and the roles table `<alias>k`. */
+/**
+* Resolves `source` against `schema`, aliasing the table `alias` and the roles
+* table `<alias>k`.
+*/
 function globalRoleSource(source, schema, alias, roles) {
 	const table = qualify(source.table, schema);
 	const user = source.user ?? "user_id";
@@ -1328,6 +933,7 @@ function globalRoleSource(source, schema, alias, roles) {
 		from: `${quoteTable(table)} ${alias}${role.join}${global}`,
 		userSql: `${alias}.${quoteIdent(user)}`,
 		roleSql: role.sql,
+		nullable: role.nullable,
 		role: roleManifest(role),
 		...role.through === void 0 ? {} : { through: role.through },
 		...tenant === void 0 ? {} : { tenant },
@@ -1343,11 +949,17 @@ function keyTenantLine(ctx, scope, tenant) {
 	const keyed = keyTenantSql(ctx, underRoot(ctx, scope) ? tenant : void 0);
 	return keyed === void 0 ? "" : `\n    and ${keyed}`;
 }
-/** Whether the helper for `scope` narrows to the tenant claim: unless `rls.tenants` is `'all'`, when the first scope is on its chain. */
+/**
+* Whether the helper for `scope` narrows to the tenant claim: unless
+* `rls.tenants` is `'all'`, when the first scope is on its chain.
+*/
 function narrowsTo(ctx, scope) {
 	return ctx.tenants !== "all" && underRoot(ctx, scope);
 }
-/** Whether the active tenant narrows memberships of `scope`: the first scope is on its chain. */
+/**
+* Whether the active tenant narrows memberships of `scope`: the first scope is
+* on its chain.
+*/
 function underRoot(ctx, scope) {
 	const root = ctx.scopes[0]?.name;
 	let current = ctx.scopes.find((item) => item.name === scope);
@@ -1360,11 +972,17 @@ function underRoot(ctx, scope) {
 	}
 	return false;
 }
-/** `and exists (...)` lines for an active user; empty without `rls.suspension.users`. */
+/**
+* `and exists (...)` lines for an active user; empty without
+* `rls.suspension.users`.
+*/
 function userActive(ctx, indent, user) {
 	return activeUserSql(ctx, user).map((part) => `${indent}and ${part}`);
 }
-/** `and exists (...)` lines for every suspendable instance on the chain of `scope`'s membership. */
+/**
+* `and exists (...)` lines for every suspendable instance on the chain of
+* `scope`'s membership.
+*/
 function instancesActive(ctx, scope, idOf, indent, permission) {
 	return activeInstancesSql(ctx, scope, idOf, permission).map((part) => `${indent}and ${part}`);
 }
@@ -1503,7 +1121,10 @@ function hasBody(ctx) {
       ${customKeysSql(ctx, "global", claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)")).trimStart()}
   ))`;
 }
-/** The claim `jwt` mode reads platform custom roles from: `customRoleClaim(globalRoles)`. */
+/**
+* The claim `jwt` mode reads platform custom roles from:
+* `customRoleClaim(globalRoles)`.
+*/
 const GLOBAL_GRANTS_CLAIM = "role_grants";
 function memberColumn(name) {
 	return `m.${quoteIdent(name)}`;
@@ -1646,8 +1267,8 @@ ${customKeysSql(ctx, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), c
 }
 /**
 * The rows the membership sources select for the subject, one per instance
-* (`scope`, `id`, `within`, `roles`, `via`), with each source's own expiry
-* and suspension filters: the statements the token hook runs.
+* (`scope`, `id`, `within`, `roles`, `via`), with each source's own expiry and
+* suspension filters: the statements the token hook runs.
 */
 function sourcesKeep(sources) {
 	return sources.some((source) => source.sql.keeps);
@@ -1671,7 +1292,10 @@ function sourcesBodyOf(sql, sources, user) {
 		vars: sources.map((source, index) => `${sourceUser(index)} ${source.sql.userType} := ${user};`)
 	};
 }
-/** `language sql`, or `plpgsql` returning the query when the body declares variables. */
+/**
+* `language sql`, or `plpgsql` returning the query when the body declares
+* variables.
+*/
 function functionBody(body) {
 	if (body.vars.length === 0) return `language sql
 stable
@@ -1738,7 +1362,7 @@ ${rows}
   union
   select (ms.id)::${type}, ck.grant_key
 ${rows}
-${customKeysJoin(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}
+${customKeysJoin(ctx, scope, entries(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}
   where ${signedIn(ctx)}
     and ms.scope = ${quoteLiteral(scope)}
     and not (r.role = any(${sqlTextArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("ck.grant_key"), sourcesKeep(sources))}`, sources, subjectIdSql(ctx));
@@ -1749,7 +1373,7 @@ ${rows}
   where ${signedIn(ctx)}
     and ms.scope = ${quoteLiteral(scope)}
     and not (r.role = any(${sqlTextArray(custom.declared)}))${narrow}${sourceFilters(ctx, scope, subjectIdSql(ctx), grantPermissionSql("p_grant"), sourcesKeep(sources))}
-${customKeysSql(ctx, scope, entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}`, sources, subjectIdSql(ctx));
+${customKeysSql(ctx, scope, entries(CUSTOM_ROLES.permissions, allowEntry(ctx), " and c.effect = 'allow'"), entries(CUSTOM_ROLES.permissions, "permission", " and c.effect = 'deny'"), entries(CUSTOM_ROLES.includes, "include_role", ""))}`, sources, subjectIdSql(ctx));
 }
 function scopedBody(ctx, scope, type) {
 	if (ctx.authorize !== "database") return sqlBody(claimBody(ctx, scope, type));
@@ -1757,7 +1381,10 @@ function scopedBody(ctx, scope, type) {
 }
 //#endregion
 //#region src/cli/rls/capabilities.ts
-/** The helper `--capabilities` adds: ids of one resource a link capability claim reaches. Part of the SQL contract. */
+/**
+* The helper `--capabilities` adds: ids of one resource a link capability claim
+* reaches. Part of the SQL contract.
+*/
 const CAPABILITIES = { ids: "permdock_capability_ids" };
 /**
 * The `anon` branch access for a resource-scoped grant reached through a link
@@ -1799,6 +1426,137 @@ revoke execute on function ${fn}(text, text, text) from public;
 grant execute on function ${fn}(text, text, text) to anon, authenticated;`;
 }
 //#endregion
+//#region src/cli/rls/custom-role-by-id.ts
+const PREFIX = "PermDock CLI";
+const col = (name) => `r.${quoteIdent(name)}`;
+/**
+* Custom-role functions keyed by the application's role row
+* (`rls.customRoleWrites.roles.primaryKey`): the tenant, scope, instance and
+* name come from the row, never from the caller. The writers delegate to
+* `permdock_replace_custom_role_grants` (or its trusted variant), so every
+* caller and definition check applies, and keep the stored denies and includes.
+* The reader returns declared allow keys only and is executable by
+* `rls.trustedReaders` alone.
+*/
+function customRoleByIdSql(ctx, trustedReaders) {
+	const custom = ctx.customRoles;
+	const roles = custom?.table;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || roles?.primaryKey === void 0 || ctx.authorize !== "database" || root === void 0) return "";
+	const pk = roles.primaryKey;
+	if (pk === "") throw configError(`${PREFIX}: rls.customRoleWrites.roles.primaryKey names no column`);
+	const leveled = custom.levels === true;
+	const tenantType = tenantTypeOf(ctx);
+	const table = quoteQualified(roles.table);
+	const idType = `${table}.${quoteIdent(pk)}%type`;
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const replace = qualified(ctx, CUSTOM_ROLES.replace);
+	const trustedReplace = qualified(ctx, CUSTOM_ROLES.trustedReplace);
+	const byId = qualified(ctx, CUSTOM_ROLES.replaceById);
+	const trustedById = qualified(ctx, CUSTOM_ROLES.trustedReplaceById);
+	const reader = qualified(ctx, CUSTOM_ROLES.trustedReadById);
+	const renames = Object.entries(custom.renamed ?? {}).toSorted(byKey);
+	const current = (expr) => currentKeyExpr(renames, expr);
+	const declaredKeys = sqlTextArray(custom.permissions ?? []);
+	const declaredRoles = sqlTextArray(custom.declared);
+	const tenant = roles.tenant === void 0 ? `null::${tenantType}` : `${col(roles.tenant)}::${tenantType}`;
+	const scope = rolesTableScope(roles, tenant, root, col);
+	const scopeId = roles.id === void 0 || roles.tenant === void 0 ? "null::text" : `case when ${tenant} is null then null else ${col(roles.id)}::text end`;
+	const skipped = roles.skip === void 0 || roles.tenant === void 0 ? "false" : `(${tenant} is not null and coalesce(${col(roles.skip)}, false))`;
+	const match = "c.tenant_id is not distinct from v_tenant and c.scope = v_scope and c.scope_id is not distinct from v_scope_id and c.role = v_key";
+	const audit = custom.audit;
+	const auditCall = audit === void 0 ? "" : `
+  perform ${quoteQualified(audit.function)}(${[
+		"event_type => 'permdock.custom_role.replaced'",
+		"target_type => 'role'",
+		"record_id => p_role_id::text",
+		"tenant => v_tenant",
+		"metadata => jsonb_build_object('operation', 'replace', 'role', v_key, 'permissions', p_permissions)",
+		...Object.entries(audit.args ?? {}).toSorted(byKey).map(([name, value]) => `${quoteIdent(name)} => ${quoteLiteral(value)}`)
+	].join(", ")});`;
+	const body = (write) => `declare
+  v_tenant ${tenantType};
+  v_scope text;
+  v_scope_id text;
+  v_key text;
+  v_skipped boolean;
+  v_deny text[];
+  v_include text[];
+begin
+  select ${tenant}, ${scope}, ${scopeId}, ${col(roles.key)}::text, ${skipped}
+  into v_tenant, v_scope, v_scope_id, v_key, v_skipped
+  from ${table} r
+  where ${col(pk)} = p_role_id;
+  if not found then
+${raiseSql("    ", "P0002", "'permdock: no role row has id ' || coalesce(p_role_id::text, 'null')", "unknown-role")}
+  end if;
+  if v_skipped or v_key = any(${declaredRoles}) then
+${raiseSql("    ", "22023", "'permdock: ' || coalesce(v_key, 'null') || ' is a declared role, not a custom role'", "declared-role")}
+  end if;
+  select array_agg(c.permission) into v_deny
+  from ${perms} c
+  where ${match} and c.effect = 'deny';
+  select array_agg(c.include_role) into v_include
+  from ${includes} c
+  where ${match};
+  perform ${write}(v_tenant, v_scope, v_scope_id, v_key, p_permissions, v_deny, v_include);${auditCall}
+end;`;
+	const writer = (comment, name, write, member) => `-- ${comment}
+create or replace function ${name}(p_role_id ${idType}, p_permissions text[])
+returns void
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+${body(write)}
+$$;
+${member ? `revoke execute on function ${name}(${idType}, text[]) from public, anon;
+grant execute on function ${name}(${idType}, text[]) to authenticated;` : `revoke execute on function ${name}(${idType}, text[]) from public, anon, authenticated;`}`;
+	const readerEntry = leveled ? `${current("c.permission")} || coalesce('@' || c.level, '')` : current("c.permission");
+	const readerGrant = trustedReaders === void 0 || trustedReaders.length === 0 ? "" : `\n${trustedReaderGrants(ctx, `${reader}(text[], ${tenantType})`, trustedReaders)}`;
+	return `${writer("save a custom role by its row id: the row supplies tenant, scope, instance and name; the caller checks of permdock_replace_custom_role_grants apply, and stored denies and includes stay", byId, replace, true)}
+
+${writer("save a custom role by its row id for a trusted caller: the definition checks without the caller checks", trustedById, trustedReplace, false)}
+
+-- the declared allow keys of custom roles by their row ids as text, for a trusted reader; with p_tenant, an id of another tenant is refused
+create or replace function ${reader}(p_role_ids text[], p_tenant ${tenantType} default null)
+returns table (role_id text, permission text)
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+begin
+  if p_tenant is not null and exists (
+    select 1 from ${table} r
+    where ${col(pk)}::text = any(p_role_ids) and ${tenant} is distinct from p_tenant
+  ) then
+${raiseSql("    ", "42501", "'permdock: a role id belongs to another tenant than ' || p_tenant::text", "not-member")}
+  end if;
+  return query
+  select distinct v.role_id, ${readerEntry}
+  from (
+    select ${col(pk)}::text as role_id, ${tenant} as tenant_id, ${scope} as scope, ${scopeId} as scope_id, ${col(roles.key)}::text as role
+    from ${table} r
+    where ${col(pk)}::text = any(p_role_ids)
+      and not ${skipped}
+      and not (${col(roles.key)}::text = any(${declaredRoles}))
+  ) v
+  join ${perms} c
+    on c.tenant_id is not distinct from v.tenant_id
+    and c.scope = v.scope
+    and c.scope_id is not distinct from v.scope_id
+    and c.role = v.role
+  where c.effect = 'allow'
+    and ${current("c.permission")} = any(${declaredKeys})
+  order by 1, 2;
+end;
+$$;
+revoke execute on function ${reader}(text[], ${tenantType}) from public, anon, authenticated;${readerGrant}`;
+}
+//#endregion
 //#region src/cli/rls/custom-role-cascade.ts
 /** `row.column`, for a trigger's `old` or `new`. */
 function rowColumn(row, name) {
@@ -1811,12 +1569,11 @@ function cascadeMatch(prefix) {
 /**
 * The trigger on the application's roles table (`rls.customRoleWrites.roles`):
 * a rename, a move to another tenant, scope or instance, or a delete of a
-* custom role's row carries its grants and includes along. A signed-in
-* caller at trigger depth 1 passes the write functions' checks: authority
-* over the stored definition where it was, and, after a move, membership
-* and authority where it lands and entries inside that scope's ceiling.
-* Other paths (a migration, a job, a nested trigger) move the rows as the
-* function owner.
+* custom role's row carries its grants and includes along. A signed-in caller
+* at trigger depth 1 passes the write functions' checks: authority over the
+* stored definition where it was, and, after a move, membership and authority
+* where it lands and entries inside that scope's ceiling. Other paths (a
+* migration, a job, a nested trigger) move the rows as the function owner.
 */
 function customRoleCascadeSql(ctx) {
 	const custom = ctx.customRoles;
@@ -1830,11 +1587,11 @@ function customRoleCascadeSql(ctx) {
 	const target = quoteTable(qualifySqlTable(table.table));
 	const tenant = (row) => table.tenant === void 0 ? `null::${tenantType}` : `${rowColumn(row, table.tenant)}::${tenantType}`;
 	const scope = (row) => rolesTableScope(table, tenant(row), root, (name) => rowColumn(row, name));
-	const id = (row) => table.id === void 0 ? "null::text" : `${rowColumn(row, table.id)}::text`;
-	const skipped = (row) => table.skip === void 0 ? "false" : `coalesce(${rowColumn(row, table.skip)}, false)`;
+	const id = (row) => table.id === void 0 || table.tenant === void 0 ? "null::text" : `case when ${tenant(row)} is null then null else ${rowColumn(row, table.id)}::text end`;
+	const skipped = (row) => table.skip === void 0 || table.tenant === void 0 ? "false" : `(${tenant(row)} is not null and coalesce(${rowColumn(row, table.skip)}, false))`;
 	const guard = qualified(ctx, CUSTOM_ROLES.guard);
 	const entries = qualified(ctx, CUSTOM_ROLES.entries);
-	const allowEntryOf = custom.levels === true ? "c.permission || coalesce('@' || c.level, '')" : "c.permission";
+	const allowEntryOf = `c.${allowEntry(ctx)}`;
 	return `-- the application's roles table: renames, moves and deletes of a custom role carry its grants and includes
 create or replace function ${fn}()
 returns trigger
@@ -1913,6 +1670,58 @@ create trigger "permdock_custom_role_cascade"
 `;
 }
 //#endregion
+//#region src/cli/rls/custom-role-guard.ts
+/** A column of the roles-table row a trigger sees as `new`. */
+function column(name) {
+	return `new.${quoteIdent(name)}`;
+}
+/**
+* The trigger on the application's roles table (`rls.customRoleWrites.roles`)
+* that refuses a tenant row named like a declared role (`declared-role`) or
+* like a shared custom role (`name-taken`). A row the `skip` column marks is a
+* system role of the tenant and passes. Empty without a tenant column: then no
+* row is a tenant row.
+*/
+function customRoleNameGuardSql(ctx) {
+	const custom = ctx.customRoles;
+	const table = custom?.table;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || table?.tenant === void 0 || root === void 0) return "";
+	const tenant = `${column(table.tenant)}::${tenantTypeOf(ctx)}`;
+	const skipped = table.skip === void 0 ? "false" : `coalesce(${column(table.skip)}, false)`;
+	const fn = qualified(ctx, CUSTOM_ROLES.nameGuard);
+	const target = quoteTable(qualifySqlTable(table.table));
+	const key = `${column(table.key)}::text`;
+	const scope = rolesTableScope(table, tenant, root, column);
+	return `-- the application's roles table: a tenant row cannot take the name of a declared or a shared role
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+begin
+  if ${tenant} is null or ${skipped} then
+    return new;
+  end if;
+  if ${key} = any(${sqlTextArray(custom.declared)}) then
+${raiseSql("    ", "22023", `'permdock: ' || ${key} || ' is a declared role'`, "declared-role")}
+  end if;
+  if ${qualified(ctx, CUSTOM_ROLES.shared)}(${scope}, ${key}) then
+${raiseSql("    ", "22023", `'permdock: ' || ${key} || ' is a shared role'`, "name-taken")}
+  end if;
+  return new;
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists "permdock_custom_role_name_guard" on ${target};
+create trigger "permdock_custom_role_name_guard"
+  before insert or update on ${target}
+  for each row execute function ${fn}();
+`;
+}
+//#endregion
 //#region src/cli/rls/custom-role-writes.ts
 function callerFunctionsSql(ctx, custom, root, levelReach, forUser) {
 	const leveled = custom.levels === true;
@@ -2038,8 +1847,8 @@ revoke execute on function ${guard}(${userArg}${tenantType}, text, text, text) f
 	};
 }
 /**
-* The functions an application calls to save, rename and delete a custom
-* role in \`database\` mode, with the rules of \`validateCustomRole\` and
+* The functions an application calls to save, rename and delete a custom role
+* in \`database\` mode, with the rules of \`validateCustomRole\` and
 * \`assignablePermissions\`: entries inside the ceiling of the role's scope,
 * includes naming declared roles, and only permissions and levels the caller
 * may hand out, for the new definition and the stored one alike. A platform
@@ -2063,6 +1872,7 @@ function customRoleWritesSql(ctx, levelReach) {
 	const guard = qualified(ctx, CUSTOM_ROLES.guard);
 	const shape = qualified(ctx, CUSTOM_ROLES.shape);
 	const entries = qualified(ctx, CUSTOM_ROLES.entries);
+	const problem = qualified(ctx, CUSTOM_ROLES.entryProblem);
 	const renames = Object.entries(custom.renamed ?? {}).toSorted(byKey);
 	const current = (expr) => currentKeyExpr(renames, expr);
 	const known = sqlTextArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
@@ -2150,6 +1960,38 @@ ${callerFunctionsSql(ctx, custom, root, levelReach, true).beyond}
 
 ${callerFunctionsSql(ctx, custom, root, levelReach, true).guard}
 ` : ""}
+-- null when an allow entry is a declared permission inside the ceiling of the scope${leveled ? ", at a level the resource declares" : ""}; else unknown-permission, outside-ceiling${leveled ? " or unknown-level" : ""}
+create or replace function ${problem}(p_scope text, p_entry text)
+returns text
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_key text := ${current(leveled ? "split_part(p_entry, '@', 1)" : "p_entry")};
+begin
+  if p_entry is null or not (v_key = any(${known})) then
+    return 'unknown-permission';
+  end if;
+  if not exists (
+    select 1 from ${ceiling} c
+    where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
+  ) then
+    return 'outside-ceiling';
+  end if;${leveled ? `
+  if strpos(p_entry, '@') > 0 and not exists (
+    select 1 from ${ceiling} c
+    where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
+      and split_part(c.grant_key, '@', 2) = split_part(p_entry, '@', 2)
+  ) then
+    return 'unknown-level';
+  end if;` : ""}
+  return null;
+end;
+$$;
+revoke execute on function ${problem}(text, text) from public, anon, authenticated;
+
 -- the entries of a definition: declared keys and levels inside the ceiling of the scope, and declared includes
 create or replace function ${entries}(p_scope text, p_allow text[], p_deny text[], p_include text[])
 returns void
@@ -2161,23 +2003,18 @@ as $$
 declare
   v_entry text;
   v_key text;
+  v_problem text;
 begin
   foreach v_entry in array coalesce(p_allow, '{}'::text[]) loop
     v_key := ${current(leveled ? "split_part(v_entry, '@', 1)" : "v_entry")};
-    if not (v_key = any(${known})) then
+    v_problem := ${problem}(p_scope, v_entry);
+    if v_problem = 'unknown-permission' then
 ${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' is not a declared permission'`, "unknown-permission")}
     end if;
-    if not exists (
-      select 1 from ${ceiling} c
-      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
-    ) then
+    if v_problem = 'outside-ceiling' then
 ${raiseSql("      ", "22023", `'permdock: ' || v_key || ' is outside the ceiling of ' || p_scope`, "outside-ceiling")}
     end if;${leveled ? `
-    if strpos(v_entry, '@') > 0 and not exists (
-      select 1 from ${ceiling} c
-      where c.scope = p_scope and c.effect = 'allow' and ${current("c.permission")} = v_key
-        and split_part(c.grant_key, '@', 2) = split_part(v_entry, '@', 2)
-    ) then
+    if v_problem = 'unknown-level' then
 ${raiseSql("      ", "22023", `'permdock: ' || v_entry || ' names a level the resource does not declare'`, "unknown-level")}
     end if;` : ""}
   end loop;
@@ -2249,9 +2086,9 @@ end;`, false)}`;
 //#region src/cli/rls/global-roles.ts
 /**
 * `permdock_replace_global_roles(p_user, p_roles)`: sets the global roles of
-* one user in `rls.roles` in one statement pair. It runs as the invoker, so
-* the table's policies and the `rls.assignments` trigger judge every row it
-* deletes or inserts.
+* one user in `rls.roles` in one statement pair. It runs as the invoker, so the
+* table's policies and the `rls.assignments` trigger judge every row it deletes
+* or inserts.
 */
 function globalRolesSql(ctx) {
 	if (ctx.roles === void 0) return "";
@@ -2324,9 +2161,9 @@ grant execute on function ${fn}(${args}) to authenticated;`;
 //#endregion
 //#region src/cli/rls/helper-members.ts
 /**
-* The body of `member_<scope>_ids()`: instances of `scope` the subject holds
-* a live membership of, with any role. Not narrowed to the active tenant, and
-* no cascade: a membership of a child scope is not one of its parent.
+* The body of `member_<scope>_ids()`: instances of `scope` the subject holds a
+* live membership of, with any role. Not narrowed to the active tenant, and no
+* cascade: a membership of a child scope is not one of its parent.
 */
 function memberBody(ctx, scope, type, roles) {
 	if (ctx.authorize !== "database") return sqlBody(`  select distinct (m ->> 'id')::${type}
@@ -2426,8 +2263,8 @@ ${grants}`;
 /**
 * `member_<scope>_ids_for(p_user uuid)`: `member_<scope>_ids()` for a user the
 * caller names, read from the membership sources (or the mapped table) in
-* either mode, so a token hook can call it before any claim exists. Naming
-* the user is why no client role may execute it; the hook's grants give
+* either mode, so a token hook can call it before any claim exists. Naming the
+* user is why no client role may execute it; the hook's grants give
 * `supabase_auth_admin` execute.
 */
 function memberForFunction(ctx, scope, type) {
@@ -2437,18 +2274,125 @@ returns setof ${type}
 ${functionBody(memberRowsBody(ctx, scope, type, "p_user", memberForSources(ctx, scope)))}
 revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
 }
+/**
+* `member_<scope>_ids_of(p_user uuid)`: `member_<scope>_ids_for(p_user)` for
+* the caller only. Any other `p_user` returns no rows, so a client role may
+* execute it without learning another user's memberships.
+*/
+function memberOfFunction(ctx, scope, type) {
+	const fn = qualified(ctx, memberOfHelper(scope));
+	return `create or replace function ${fn}(p_user uuid)
+returns setof ${type}
+${functionBody(sqlBody(`  select m.id
+  from ${qualified(ctx, memberForHelper(scope))}(p_user) as m(id)
+  where p_user = ${subjectIdSql(ctx)}`))}
+revoke execute on function ${fn}(uuid) from public, anon;
+grant execute on function ${fn}(uuid) to authenticated;`;
+}
+//#endregion
+//#region src/cli/rls/token-scopes.ts
+const TOKEN_SCOPE_ALLOWS = "permdock_token_scope_allows";
+/**
+* `rls.tokenScopes` as the SQL generator needs it, or `undefined` when it is
+* off.
+*/
+function tokenScopesPlan(setting, policy) {
+	if (setting !== true) return;
+	const permissions = listPermissions(policy.permissions).map((leaf) => ({
+		key: leaf.key,
+		scope: leaf.scope,
+		renamedFrom: formerKeys(leaf)
+	}));
+	return { scopes: delegatedScopeMap(permissions, policy.oauthScopes) };
+}
+function tokenScopeAllowsCall(ctx, grant) {
+	return `${qualified(ctx, TOKEN_SCOPE_ALLOWS)}(${grant})`;
+}
+/**
+* The token's scopes as rows of `s(scope)`: a space-separated string or,
+* outside `guc`, a JSON array.
+*/
+function tokenScopeRows(ctx) {
+	if (ctx.dialect === "guc") return `regexp_split_to_table(btrim(coalesce(${subjectClaimSql(ctx, "scope")}, '')), '\\s+') s(scope)`;
+	const scope = subjectClaimJsonSql(ctx, "scope");
+	return `unnest(case jsonb_typeof(${scope})
+      when 'string' then regexp_split_to_array(btrim(${scope} #>> '{}'), '\\s+')
+      when 'array' then array(select jsonb_array_elements_text(${scope}))
+      else '{}'::text[]
+    end) s(scope)`;
+}
+/**
+* `permdock_token_scope_allows(p_grant)`: a delegated token (a `client_id`, or
+* an `act` that is not a support or impersonation session) reaches a grant key
+* only when one of its scopes maps to the key's permission. better-supabase's
+* `cap_allows` reads the same tokens the same way.
+*/
+function tokenScopeAllowsSql(ctx, plan, anonExecute) {
+	const fn = qualified(ctx, TOKEN_SCOPE_ALLOWS);
+	const act = subjectClaimJsonSql(ctx, "act");
+	const grants = anonExecute ? `revoke execute on function ${fn}(text) from public;
+grant execute on function ${fn}(text) to anon, authenticated;` : `revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+	return `-- Token scopes: a delegated token holds only the permissions its scope claim maps to; denies always apply, and a token without client_id or an agent act is not limited
+create or replace function ${fn}(p_grant text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select case
+    when coalesce(${subjectClaimSql(ctx, "client_id")}, '') = ''
+      and (${act} is null
+        or ${act} = 'null'::jsonb
+        or (jsonb_typeof(${act}) = 'object'
+          and ${act} ->> 'kind' in ('support', 'impersonation'))) then true
+    when exists (
+      select 1 from ${qualified(ctx, "role_permissions")} rp
+      where rp.grant_key = p_grant and rp.effect = 'deny'
+    ) then true
+    else exists (
+      select 1
+      from ${tokenScopeRows(ctx)}
+      where s.scope <> ''
+        and coalesce(${quoteLiteral(JSON.stringify(plan.scopes))}::jsonb -> s.scope, '[]'::jsonb)
+          ? split_part(split_part(p_grant, '#', 1), '@', 1)
+    )
+  end
+$$;
+${grants}`;
+}
 //#endregion
 //#region src/cli/rls/helpers.ts
 /**
-* The policy-side call for a grant key. Every form is uncorrelated, so
-* Postgres runs the helper once per statement (an InitPlan, or a hashed
-* SubPlan for `in`), never once per row.
+* The policy-side call for a grant key. Every form is uncorrelated, so Postgres
+* runs the helper once per statement (an InitPlan, or a hashed SubPlan for
+* `in`), never once per row.
 */
-function accessSql(ctx, scope, grantKey, column) {
+function accessSql(ctx, scope, grantKey, column, helper) {
 	const key = quoteLiteral(grantKey);
 	if (scope === "global") return `(select ${qualified(ctx, HELPERS.has)}(${key}))`;
 	if (column === void 0) throw configError(`PermDock CLI: ${scope}-scoped grant needs definePolicy({ scopes.${scope} })`);
-	return `${quoteIdent(column)} in (select ${qualified(ctx, permittedIdsHelper(scope))}(${key}))`;
+	return `${quoteIdent(column)} in (select ${qualified(ctx, helper ?? permittedIdsHelper(scope))}(${key}))`;
+}
+/**
+* `permitted_<parent>_ids(p_grant)` for each \`rls.tables\` \`via\`: the parent
+* rows whose scope instance the grant reaches. \`security definer\`, so the
+* caller needs no read on the parent, and called uncorrelated like
+* \`permitted_<scope>_ids\`.
+*/
+function viaHelpersSql(ctx, anonExecute) {
+	const done = /* @__PURE__ */ new Set();
+	const chunks = [];
+	for (const via of Object.values(ctx.vias ?? {})) {
+		if (done.has(via.helper)) continue;
+		done.add(via.helper);
+		chunks.push(`-- rows of ${via.table} whose ${via.column} is a ${via.scope} the grant reaches
+${helperFunction(ctx, via.helper, `setof ${via.type}`, sqlBody(`  select p.${quoteIdent(via.id)}
+  from ${quoteQualified(via.table)} p
+  where p.${quoteIdent(via.column)} in (select ${qualified(ctx, permittedIdsHelper(via.scope))}(p_grant))`), anonExecute)}`);
+	}
+	return chunks;
 }
 function userIdSql(ctx, anonExecute) {
 	const fn = userIdHelperSql(ctx);
@@ -2482,11 +2426,11 @@ ${grants}`;
 * `permdock_has_for(p_user, p_grant)` and one
 * `permitted_<scope>_ids_for(p_user, p_grant)` per scope in `database` mode:
 * the bodies of `permdock_has` and `permitted_<scope>_ids` with `p_user` for
-* the signed-in user and no tenant-claim narrowing, since a named user has
-* no token. For trusted SQL that acts for a stored user (jobs, triggers,
-* approvals resolved later). Naming the user is why no client role may
-* execute them: `security definer` callers run them as their owner, and a
-* backend role needs its own grant.
+* the signed-in user and no tenant-claim narrowing, since a named user has no
+* token. For trusted SQL that acts for a stored user (jobs, triggers, approvals
+* resolved later). Naming the user is why no client role may execute them:
+* `security definer` callers run them as their owner, and a backend role needs
+* its own grant.
 */
 function forUserSql(ctx) {
 	if (ctx.authorize !== "database") return "";
@@ -2509,8 +2453,8 @@ function userIdType(ctx) {
 	return ctx.dialect === "supabase" ? "uuid not null references auth.users on delete cascade" : "text not null";
 }
 /**
-* The `role_permissions` rows the policy compiles to: an upsert and a delete
-* of every other row. Data, not schema, so `supabase db diff` drops it from a
+* The `role_permissions` rows the policy compiles to: an upsert and a delete of
+* every other row. Data, not schema, so `supabase db diff` drops it from a
 * declarative schema; `--split ...,seeds` writes it as its own migration.
 */
 function seedSql(ctx, rows) {
@@ -2536,8 +2480,45 @@ ${rows.map((row) => `  (${[
 );`;
 }
 /**
-* `role_permissions`, its seeds, and the three `security definer` helpers
-* with `search_path = ''`. `execute` goes to `authenticated` only.
+* `role_permissions` as a view over the compiled rows (`rls.seeds: 'view'`).
+* `security_invoker` makes the view read as its caller, so it adds no
+* privilege; the table's revoke applies to the view the same way.
+*/
+function seedViewSql(ctx, rows) {
+	const view = qualified(ctx, "role_permissions");
+	const columns = "role, permission, grant_key, scope, effect";
+	return `-- rls.seeds: 'view': role_permissions is a view, so the rows travel with the schema
+create or replace view ${view} (${columns}) with (security_invoker = true) as
+${rows.length === 0 ? `select null::text, null::text, null::text, null::text, null::text where false` : `select * from (values\n${rows.map((row) => `  (${[
+		row.role,
+		row.permission,
+		row.grantKey,
+		row.scope,
+		row.effect
+	].map(quoteLiteral).join(", ")})`).join(",\n")}\n) as v(${columns})`};
+revoke all on table ${view} from anon, authenticated, public;`;
+}
+/**
+* `<schema>.seed()`: the same upsert and delete as `seedSql`, for a declarative
+* schema that carries no rows.
+*/
+function seedFunctionSql(ctx, rows) {
+	const fn = qualified(ctx, "seed");
+	return `-- rls.seeds: 'function': the role_permissions rows are data, so a declarative diff leaves them out; run select ${fn}(); after each deploy
+create or replace function ${fn}()
+returns void
+language sql
+volatile
+security definer
+set search_path = ''
+as $permdock$
+${seedSql(ctx, rows)}
+$permdock$;
+revoke execute on function ${fn}() from public, anon, authenticated;`;
+}
+/**
+* `role_permissions`, its seeds, and the three `security definer` helpers with
+* `search_path = ''`. `execute` goes to `authenticated` only.
 */
 function helpersSql(ctx, rows, options) {
 	const schema = helperSchema(ctx);
@@ -2545,9 +2526,13 @@ function helpersSql(ctx, rows, options) {
 	const rp = qualified(ctx, "role_permissions");
 	const chunks = [`-- permdock helpers (${ctx.authorize === "database" ? "database: reads the membership and user_roles tables" : "jwt: reads the role and memberships claims"})
 -- policies call them uncorrelated, so Postgres evaluates each once per statement`];
-	if (schema !== "public") chunks.push(`create schema if not exists ${s};\nrevoke all on schema ${s} from public;\ngrant usage on schema ${s} to ${options.anonExecute === true ? "anon, authenticated" : "authenticated"};`);
+	if (schema !== "public") {
+		const anonUsage = options.anonExecute === true || ctx.capabilities === true;
+		chunks.push(`create schema if not exists ${s};\nrevoke all on schema ${s} from public;\ngrant usage on schema ${s} to ${anonUsage ? "anon, authenticated" : "authenticated"};`);
+	}
 	if (ctx.dialect === "supabase") chunks.push(userIdSql(ctx, options.anonExecute === true));
-	chunks.push(`create table if not exists ${rp} (
+	if (ctx.seeds === "view") chunks.push(seedViewSql(ctx, rows));
+	else chunks.push(`create table if not exists ${rp} (
   role text not null,
   permission text not null,
   grant_key text not null,
@@ -2557,7 +2542,8 @@ function helpersSql(ctx, rows, options) {
 );
 alter table ${rp} enable row level security;
 revoke all on table ${rp} from anon, authenticated, public;`);
-	if (options.withoutSeeds !== true) chunks.push(seedSql(ctx, rows));
+	if (ctx.seeds === "function") chunks.push(seedFunctionSql(ctx, rows));
+	else if (options.withoutSeeds !== true && ctx.seeds !== "view") chunks.push(seedSql(ctx, rows));
 	if (ctx.authorize === "database" && options.userRoles && ctx.roles === void 0) {
 		const ur = qualified(ctx, "user_roles");
 		chunks.push(`create table if not exists ${ur} (
@@ -2573,6 +2559,7 @@ revoke all on table ${ur} from anon, authenticated, public;`);
 	const anon = options.anonExecute === true;
 	const keys = ctx.apiKeys;
 	if (keys !== void 0) chunks.push(apiKeyAllowsSql(ctx, keys, anon));
+	if (ctx.tokenScopes !== void 0) chunks.push(tokenScopeAllowsSql(ctx, ctx.tokenScopes, anon));
 	const bodies = grantBodies(ctx);
 	chunks.push(helperFunction(ctx, HELPERS.has, "boolean", bodies.has, anon));
 	const capabilities = capabilitiesSql(ctx);
@@ -2583,7 +2570,9 @@ revoke all on table ${ur} from anon, authenticated, public;`);
 		chunks.push(memberFunction(ctx, scope.name, type, anon));
 		if (ctx.roleMemberScopes?.includes(scope.name) === true) chunks.push(memberRolesFunction(ctx, scope.name, type, anon));
 		if (hasMemberFor(ctx, scope.name)) chunks.push(memberForFunction(ctx, scope.name, type));
+		if (hasMemberOf(ctx, scope.name)) chunks.push(memberOfFunction(ctx, scope.name, type));
 	}
+	chunks.push(...viaHelpersSql(ctx, anon));
 	const forUser = forUserSql(ctx);
 	if (forUser !== "") chunks.push(forUser);
 	const writes = customRoleWritesSql(ctx, options.levelReach ?? []);
@@ -2591,6 +2580,12 @@ revoke all on table ${ur} from anon, authenticated, public;`);
 		chunks.push(writes);
 		const cascade = customRoleCascadeSql(ctx);
 		if (cascade !== "") chunks.push(cascade);
+		const sync = ctx.customRoles?.sync;
+		if (sync !== void 0) chunks.push(sync);
+		const byId = customRoleByIdSql(ctx, options.trustedReaders);
+		if (byId !== "") chunks.push(byId);
+		const nameGuard = customRoleNameGuardSql(ctx);
+		if (nameGuard !== "") chunks.push(nameGuard);
 	}
 	const globalRoles = globalRolesSql(ctx);
 	if (globalRoles !== "") chunks.push(globalRoles);
@@ -2600,20 +2595,26 @@ revoke all on table ${ur} from anon, authenticated, public;`);
 }
 function grantBodies(ctx) {
 	const keys = ctx.apiKeys;
+	const scoped = ctx.tokenScopes !== void 0;
 	const set = ctx.grantSet === true;
-	const allows = apiKeyAllowsCall(ctx, set ? "ids.grant_key" : "p_grant");
-	const keyTenant = keyTenantSql(ctx, void 0) ?? "true";
+	const ceiling = (grant) => {
+		const calls = [...keys === void 0 ? [] : [apiKeyAllowsCall(ctx, grant)], ...scoped ? [tokenScopeAllowsCall(ctx, grant)] : []];
+		return calls.length === 0 ? void 0 : calls.join(" and ");
+	};
+	const allows = ceiling(set ? "ids.grant_key" : "p_grant");
+	const keyTenant = keys === void 0 ? "" : ` and ${keyTenantSql(ctx, void 0) ?? "true"}`;
+	const hasAllows = ceiling(set ? "g.grant_key" : "p_grant");
 	return {
-		has: sqlBody(keys === void 0 ? hasBody(ctx) : set ? `  select g.grant_key
+		has: sqlBody(hasAllows === void 0 ? hasBody(ctx) : set ? `  select g.grant_key
   from (
 ${hasBody(ctx)}
   ) g(grant_key)
-  where ${apiKeyAllowsCall(ctx, "g.grant_key")} and ${keyTenant}` : ceilingHasSql(hasBody(ctx), `${allows} and ${keyTenant}`)),
+  where ${hasAllows}${keyTenant}` : ceilingHasSql(hasBody(ctx), `${hasAllows}${keyTenant}`)),
 		ids: (scope) => {
 			const type = scopeTypeOf(ctx, scope);
 			const body = scopedBody(ctx, scope, type);
-			if (keys === void 0) return body;
-			const sql = scope === rootName(ctx) ? `${body.sql}\n  union\n${serviceKeyIdsSql(ctx, keys, scope, type)}` : body.sql;
+			if (allows === void 0) return body;
+			const sql = keys !== void 0 && scope === rootName(ctx) ? `${body.sql}\n  union\n${serviceKeyIdsSql(ctx, keys, scope, type)}` : body.sql;
 			return {
 				sql: set ? `  select ids.id, ids.grant_key
   from (
@@ -2626,7 +2627,7 @@ ${sql}
 	};
 }
 function forUserContext(ctx) {
-	const { apiKeys: _apiKeys, ...unkeyed } = ctx;
+	const { apiKeys: _apiKeys, tokenScopes: _tokenScopes, ...unkeyed } = ctx;
 	return {
 		...unkeyed,
 		subjectId: "p_user",
@@ -2635,18 +2636,27 @@ function forUserContext(ctx) {
 }
 //#endregion
 //#region src/cli/rls/permission-keys.ts
-/** The helpers that take a permission key instead of a grant key. Names are part of the SQL contract. */
+/**
+* The helpers that take a permission key instead of a grant key. Names are part
+* of the SQL contract.
+*/
 const PERMISSION_HELPERS = {
 	grantKeys: "grant_keys",
 	has: "permdock_has_permission",
 	hasFor: "permdock_has_permission_for"
 };
-/** `permitted_<scope>_permission_keys(p_id)`: every permission key the subject holds on one instance. */
+/**
+* `permitted_<scope>_permission_keys(p_id)`: every permission key the subject
+* holds on one instance.
+*/
 function permissionKeysHelper(scope) {
 	permittedIdsHelper(scope);
 	return `permitted_${scope}_permission_keys`;
 }
-/** `permitted_<scope>_permission_keys_for(p_user, p_id)`, written in `database` mode. */
+/**
+* `permitted_<scope>_permission_keys_for(p_user, p_id)`, written in `database`
+* mode.
+*/
 function permissionKeysForHelper(scope) {
 	return `${permissionKeysHelper(scope)}_for`;
 }
@@ -2666,7 +2676,10 @@ function requiresSql(ctx, key, resource) {
 		return `${quoteIdent(field)} in (select ${qualified(ctx, checkName(permittedByPermissionHelper(scope)))}(${literal}))`;
 	})].join(" or ")})`;
 }
-/** Postgres truncates an identifier past 63 bytes, which would merge two helpers. */
+/**
+* Postgres truncates an identifier past 63 bytes, which would merge two
+* helpers.
+*/
 function checkName(name) {
 	if (new TextEncoder().encode(name).length > 63) throw configError(`PermDock CLI: the helper name ${name} is longer than 63 bytes; use a shorter scope name`);
 	return name;
@@ -2717,17 +2730,17 @@ ${access}`;
 }
 /**
 * The permission-key forms of the helpers: `grant_keys`, which maps a
-* permission key to the grant keys of its unconditional allows on a scope
-* (or every deny key, or the conditioned allow or deny keys),
+* permission key to the grant keys of its unconditional allows on a scope (or
+* every deny key, or the conditioned allow or deny keys),
 * `permdock_has_permission(p_permission)` and one
 * `permitted_<scope>_ids_by_permission(p_permission)` per scope, plus their
 * `_for(p_user, ...)` forms in `database` mode. They answer with the
-* unconditional allows minus any deny, so a permission whose allows all carry
-* a row condition answers nothing. The
+* unconditional allows minus any deny, so a permission whose allows all carry a
+* row condition answers nothing. The
 * `permitted_<scope>_ids_by_permission(p_permission, p_conditioned)` overload
 * with `true` also lists the instances a conditioned allow reaches and
-* subtracts only unconditional denies, leaving the row condition to the
-* caller, as `permittedIds(..., { conditioned: true })` does in process.
+* subtracts only unconditional denies, leaving the row condition to the caller,
+* as `permittedIds(..., { conditioned: true })` does in process.
 */
 function permissionHelpersSql(ctx, grants, renamed, anonExecute) {
 	const keys = qualified(ctx, PERMISSION_HELPERS.grantKeys);
@@ -2851,7 +2864,10 @@ ${keysFunction(keysFor, `p_user ${user}, p_id ${type}, p_keys text[]`, keysBody(
 }
 //#endregion
 //#region src/cli/rls/ownership-names.ts
-/** Objects the ownership rules add next to the helpers. Names are part of the SQL contract. */
+/**
+* Objects the ownership rules add next to the helpers. Names are part of the
+* SQL contract.
+*/
 const OWNERSHIP = {
 	canAssign: "permdock_can_assign",
 	canAssignFor: "permdock_can_assign_for",
@@ -2867,231 +2883,14 @@ const ASSIGNMENTS = {
 	trigger: "permdock_assignment"
 };
 //#endregion
-//#region src/cli/rls/assignments.ts
-/** The client roles whose writes the assignment triggers check; any other role is a trusted path. */
-const CLIENT_ROLES = [
-	"anon",
-	"anonymous",
-	"authenticated"
-];
-/** The mapped membership tables, `rls.assignments.tables` and the global-roles table `rls.roles`. */
-function assignedTables(ctx) {
-	const out = [];
-	for (const { name } of ctx.scopes) {
-		const mapped = scopeTable(ctx, name);
-		if (mapped === void 0) continue;
-		out.push({
-			table: mapped.table.table,
-			scope: name,
-			id: mapped.column,
-			tenant: mapped.tenantColumn ?? mapped.column,
-			role: mapped.table.role,
-			user: mapped.table.user
-		});
-	}
-	if (ctx.roles !== void 0) out.push({
-		table: ctx.roles.table,
-		scope: "global",
-		role: ctx.roles.role ?? "role",
-		user: ctx.roles.user ?? "user_id"
-	});
-	for (const extra of ctx.assignments?.tables ?? []) {
-		const scope = resolveScope(ctx.scopes, extra.scope);
-		if (scope === void 0) throw configError(`PermDock CLI: rls.assignments.tables names scope '${extra.scope}', which the policy does not declare`);
-		if (scope !== ctx.scopes[0]?.name && extra.tenant === void 0) throw configError(`PermDock CLI: rls.assignments.tables entry ${extra.table} assigns at ${scope}, below the first scope: name its tenant column`);
-		out.push({
-			table: extra.table,
-			scope,
-			id: extra.id,
-			tenant: extra.tenant ?? extra.id,
-			role: extra.role,
-			...extra.user === void 0 ? {} : { user: extra.user }
-		});
-	}
-	return out;
-}
-/** The tables `rls.assignments.ownRole` refuses a caller's own rows on, by table key. */
-function ownRoleTables(ctx, tables) {
-	const own = ctx.assignments?.ownRole;
-	if (own === void 0) return /* @__PURE__ */ new Set();
-	if (own === "refuse") return new Set(tables.filter((entry) => entry.user !== void 0).map((entry) => qualifySqlTable(entry.table)));
-	const out = /* @__PURE__ */ new Set();
-	for (const [name, value] of Object.entries(own)) {
-		const entry = tables.find((table) => qualifySqlTable(table.table) === qualifySqlTable(name));
-		if (entry === void 0) throw configError(`PermDock CLI: rls.assignments.ownRole names ${name}, which no assignment trigger guards`);
-		if (value !== "refuse") throw configError(`PermDock CLI: rls.assignments.ownRole.${name} must be 'refuse'`);
-		if (entry.user === void 0) throw configError(`PermDock CLI: rls.assignments.ownRole names ${name}, which has no user column: set its user in rls.assignments.tables`);
-		out.add(qualifySqlTable(entry.table));
-	}
-	return out;
-}
-/**
-* The tables `rls.assignments` guards, schema-qualified: each scope's mapped
-* membership table, the global-roles table (`rls.roles`, else
-* `supabase.hook.roles`) and `rls.assignments.tables`. Empty without
-* `rls.assignments`.
-*/
-function guardedTables(config, scopes) {
-	const rls = config.rls;
-	if (rls?.assignments === void 0) return [];
-	const hook = config.supabase?.hook?.roles;
-	const roles = rls.roles ?? (hook === false ? void 0 : hook);
-	const tables = [
-		...scopes.flatMap((scope) => {
-			const mapped = memberForTable({
-				scopes,
-				...rls.memberships === void 0 ? {} : { memberships: rls.memberships }
-			}, scope.name);
-			return mapped === void 0 ? [] : [mapped.table];
-		}),
-		...roles === void 0 ? [] : [roles.table],
-		...(rls.assignments === true ? [] : rls.assignments.tables ?? []).map((entry) => entry.table)
-	];
-	return [...new Set(tables.map(qualifySqlTable))];
-}
-function isRoleList(role) {
-	return Array.isArray(role);
-}
-/** The role keys a row variable holds, one scalar per role source. */
-function rowRoles(entry, row) {
-	return (isRoleList(entry.role) ? entry.role : [entry.role]).map((part) => roleColumn(part, qualifySqlTable(entry.table), row, {
-		label: `rls.assignments ${entry.table} role`,
-		prefix: "PermDock CLI"
-	}).lookup);
-}
-/**
-* `permdock_can_assign_custom_role`: whether the signed-in caller may assign a
-* custom role of the tenant at the instance, by the checks the custom-role
-* write functions run on its stored definition.
-*/
-function canAssignCustomSql(ctx, forUser = false) {
-	const tenantType = tenantTypeOf(ctx);
-	const fn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
-	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
-	const includes = qualified(ctx, CUSTOM_ROLES.includes);
-	const guard = qualified(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
-	const userParam = forUser ? "p_user uuid, " : "";
-	const userArg = forUser ? "uuid, " : "";
-	const stored = `${storedTenant(ctx)} and c.scope = p_scope and c.role = p_role and (c.scope_id is null or c.scope_id = p_scope_id)`;
-	const grants = forUser ? `revoke execute on function ${fn}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(${tenantType}, text, text, text) from public, anon;
-grant execute on function ${fn}(${tenantType}, text, text, text) to authenticated;`;
-	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign custom role p_role at instance p_scope_id (a platform role: null tenant, scope global): the custom-role write checks on its stored definition${forUser ? "; no client role may execute it" : ""}
-create or replace function ${fn}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
-returns boolean
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  v_scope_id text;
-  v_found boolean := false;
-begin
-  select true, c.scope_id into v_found, v_scope_id
-  from (
-    select c.scope_id from ${perms} c where ${stored}
-    union all
-    select c.scope_id from ${includes} c where ${stored}
-  ) c
-  order by c.scope_id nulls first
-  limit 1;
-  if not coalesce(v_found, false) then
-    return false;
-  end if;
-  perform ${guard}(${forUser ? "p_user, " : ""}p_tenant, p_scope, v_scope_id, p_role);
-  return true;
-exception
-  when insufficient_privilege or invalid_parameter_value then
-    return false;
-end;
-$$;
-${grants}`;
-}
-/**
-* The assignment triggers (\`rls.assignments\`): before a client role inserts,
-* updates or deletes a row that assigns a role, every role the old and new
-* row hold must be one the caller may assign at that instance, by
-* \`permdock_can_assign\` for a declared role and
-* \`permdock_can_assign_custom_role\` for a custom one. The functions run as
-* the invoker, so \`current_user\` tells a client write from a trusted one.
-*/
-function assignmentSql(ctx) {
-	const own = ctx.ownership;
-	if (ctx.assignments === void 0 || own === void 0 || own.assigns.length === 0) return "";
-	const canAssign = qualified(ctx, OWNERSHIP.canAssign);
-	const custom = ctx.customRoles !== void 0 && ctx.authorize === "database";
-	const declared = ctx.customRoles?.declared;
-	const tenantType = tenantTypeOf(ctx);
-	const chunks = [];
-	const clients = `current_user::text = any(array[${CLIENT_ROLES.map(quoteLiteral).join(", ")}])`;
-	const tables = assignedTables(ctx);
-	const ownRole = ownRoleTables(ctx, tables);
-	for (const entry of tables) {
-		const table = quoteQualified(entry.table);
-		const suffix = entry.table.replaceAll(/[^a-z0-9_]/gu, "_");
-		const fn = qualified(ctx, quoteIdent(`${ASSIGNMENTS.trigger}_${suffix}`));
-		const ownUser = entry.user !== void 0 && ownRole.has(qualifySqlTable(entry.table)) ? entry.user : void 0;
-		const ownCheck = (row, reason) => ownUser === void 0 ? "" : `    if ${row}.${quoteIdent(ownUser)}::text = (${subjectIdSql(ctx)})::text then
-      raise exception using
-        errcode = '42501',
-        message = 'permdock: the caller may not change their own roles',
-        hint = '${reason}';
-    end if;
-`;
-		const check = (row) => {
-			const id = entry.id === void 0 ? "null::text" : `${row}.${quoteIdent(entry.id)}::text`;
-			const customFn = qualified(ctx, ASSIGNMENTS.custom);
-			let allowed = `${canAssign}(v_role, ${id})`;
-			if (custom && declared !== void 0) {
-				const platform = `${customFn}(null, 'global', null, v_role)`;
-				allowed = entry.id === void 0 || entry.tenant === void 0 ? `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) else ${platform} end` : `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) when ${id} is null then ${platform} else ${customFn}(${row}.${quoteIdent(entry.tenant)}::${tenantType}, ${quoteLiteral(entry.scope)}, ${id}, v_role) end`;
-			}
-			return `    foreach v_role in array array[${rowRoles(entry, row).join(", ")}]::text[] loop
-      if v_role is not null and not coalesce(${allowed}, false) then
-        raise exception using
-          errcode = '42501',
-          message = 'permdock: the caller may not assign ' || v_role || ' in ' || coalesce(${id}, 'null'),
-          hint = 'not-assignable-by';
-      end if;
-    end loop;`;
-		};
-		const what = entry.id === void 0 ? "global roles" : `${entry.scope} roles`;
-		chunks.push(`-- ${entry.table}: a client role may write only the ${what} it may assign${ownUser === void 0 ? "" : ", and none on its own rows"}
-create or replace function ${fn}()
-returns trigger
-language plpgsql
-volatile
-set search_path = ''
-as $$
-declare
-  v_role text;
-begin
-  if not (${clients}) then
-    return coalesce(new, old);
-  end if;
-  if tg_op in ('UPDATE', 'DELETE') then
-${ownCheck("old", "self-demotion")}${check("old")}
-  end if;
-  if tg_op in ('INSERT', 'UPDATE') then
-${ownCheck("new", "not-assignable-by")}${check("new")}
-  end if;
-  return coalesce(new, old);
-end;
-$$;
-revoke execute on function ${fn}() from public, anon, authenticated;
-drop trigger if exists "permdock_assignment" on ${table};
-create trigger "permdock_assignment"
-  before insert or update or delete on ${table}
-  for each row execute function ${fn}();`);
-	}
-	return `${chunks.join("\n\n")}\n`;
-}
-//#endregion
 //#region src/cli/rls/ownership-triggers.ts
 function objectName(prefix, scope) {
 	return quoteIdent(`${prefix}_${scope}`);
 }
-/** Live holders of `roleExpr` in instance `idExpr`, with the same kind and expiry rules as the helpers. */
+/**
+* Live holders of `roleExpr` in instance `idExpr`, with the same kind and
+* expiry rules as the helpers.
+*/
 function holdersSql(ctx, table, column, idExpr, role, into) {
 	const roleExpr = typeof role === "string" ? quoteLiteral(role) : role.expr;
 	const held = memberRoleOf(table, "m", "      ");
@@ -3168,10 +2967,10 @@ create constraint trigger ${objectName(OWNERSHIP.holders, scope)}
   for each row execute function ${fn}();`;
 }
 /**
-* `transferOnly` as statement triggers over transition tables: a statement
-* that changes a role's holder count in an instance that had holders before
-* and still has some after is refused. Creating the first holder and removing
-* the last (which `min` guards) are not transfers.
+* `transferOnly` as statement triggers over transition tables: a statement that
+* changes a role's holder count in an instance that had holders before and
+* still has some after is refused. Creating the first holder and removing the
+* last (which `min` guards) are not transfers.
 */
 function transferTriggerSql(ctx, scope, table, column, roles) {
 	const fn = qualified(ctx, `${OWNERSHIP.transferOnly}_${scope}`);
@@ -3234,8 +3033,8 @@ ${trigger("delete")}`;
 //#endregion
 //#region src/cli/rls/ownership-sources.ts
 /**
-* The membership sources holding scope `name`: `undefined` when there are
-* none, `'not-tables'` when one of them carries no table to put a trigger on.
+* The membership sources holding scope `name`: `undefined` when there are none,
+* `'not-tables'` when one of them carries no table to put a trigger on.
 */
 function holderSources(ctx, name) {
 	const sources = memberForSources(ctx, name);
@@ -3253,7 +3052,10 @@ function holderSources(ctx, name) {
 function indent(sql, by) {
 	return sql.replaceAll(/^/gmu, by);
 }
-/** Every source's rows of one instance, each compared with its own typed `v_key_<n>`. */
+/**
+* Every source's rows of one instance, each compared with its own typed
+* `v_key_<n>`.
+*/
 function sourceRowsOf(scope, sources) {
 	return sources.map((source, index) => indent(source.holders.rows(scope, { id: `v_key_${String(index)}` }), "        ")).join("\n        union all\n");
 }
@@ -3269,7 +3071,10 @@ function regclassOf(table) {
 function sourceTables(sources) {
 	return [...new Set(sources.map((source) => quoteQualified(source.table)))];
 }
-/** `min` and `max` over membership sources: the same commit-time check as on a mapped table, counted over every source of the scope. */
+/**
+* `min` and `max` over membership sources: the same commit-time check as on a
+* mapped table, counted over every source of the scope.
+*/
 function sourceHoldersTriggerSql(ctx, scope, sources, counted) {
 	const fn = qualified(ctx, `${OWNERSHIP.holders}_${scope}`);
 	const keys = sourceKeys(sources);
@@ -3342,7 +3147,10 @@ ${triggers.join("\n")}`;
 function collectChangesSql(changed) {
 	return `      v_changes := v_changes || coalesce((select jsonb_agg(to_jsonb(c)) from (${changed}) c), '[]'::jsonb);`;
 }
-/** `transferOnly` over membership sources: each source table's statement triggers diff its transition tables, and the count after reads every source. */
+/**
+* `transferOnly` over membership sources: each source table's statement
+* triggers diff its transition tables, and the count after reads every source.
+*/
 function sourceTransferTriggerSql(ctx, scope, sources, roles) {
 	const fn = qualified(ctx, `${OWNERSHIP.transferOnly}_${scope}`);
 	const keys = sourceKeys(sources);
@@ -3420,278 +3228,410 @@ function sourceRowsSql(sources, user) {
 	return sources.map((source) => source.sql.select(user(source), keep).replaceAll(/^/gmu, "        ")).join("\n        union all\n");
 }
 //#endregion
-//#region src/cli/rls/can-assign.ts
-/** Whether the signed-in user (or `p_user` in the `_for` form) holds, in instance `p_scope_id`, a role whose `assigns` lists `p_role`. */
-function canAssignSql(base, own, forUser = false) {
-	const ctx = forUser ? {
-		...base,
-		subjectId: "p_user",
-		tenants: "all"
-	} : base;
-	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
-	const parts = [];
-	const used = [];
-	const userOf = (source) => {
-		const index = used.includes(source) ? used.indexOf(source) : used.push(source) - 1;
-		return `v_user_${String(index)}`;
+//#region src/cli/rls/graph.ts
+function tableFor(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+/**
+* Every `related` condition the policy's grants compile to, with the resource
+* graph they need, groups included.
+*/
+function graphPlan(policy) {
+	const scopes = scopeList(policy.scopes);
+	const plan = /* @__PURE__ */ new Map();
+	const entryFor = (node) => {
+		const entry = plan.get(node.name) ?? {
+			node,
+			relations: /* @__PURE__ */ new Set(),
+			links: /* @__PURE__ */ new Set()
+		};
+		plan.set(node.name, entry);
+		return entry;
 	};
-	const global = own.assigns.filter((pair) => pair.scope === "global");
-	for (const [instance, pairs] of [["p_scope_id is not null", global.filter((pair) => pair.at !== "global")], ["p_scope_id is null", global.filter((pair) => pair.at === "global")]]) {
-		if (pairs.length === 0) continue;
-		if (ctx.authorize === "database") {
-			const ur = globalRoleRows(ctx);
-			const kind = globalKindFilterSql(ctx, ur.roleSql);
-			parts.push(`${instance} and exists (
-      select 1 from ${ur.from}
-      where ${ur.userSql} = ${subjectIdSql(ctx)}
-        and (${ur.roleSql}, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
-    )`);
-		} else {
-			const kind = globalKindFilterSql(ctx, "r.role");
-			parts.push(`${instance} and exists (
-      select 1 from ${roleRows(ctx)}
-      where (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
-    )`);
+	const addRelation = (node, relation) => {
+		const entry = entryFor(node);
+		if (entry.relations.has(relation)) return;
+		entry.relations.add(relation);
+		for (const name of expandRelation(node, relation)) {
+			const spec = node.relations[name];
+			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
+			for (const { resource, relation: groupRelation } of groupEntries(spec)) {
+				const target = policy.resources.get(resource);
+				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
+			}
 		}
-	}
-	for (const { name } of ctx.scopes) {
-		const pairs = own.assigns.filter((pair) => pair.scope === name);
-		if (pairs.length === 0) continue;
-		const sources = scopeSources(ctx, name);
-		if (sources.length > 0) {
-			const kind = kindFilterSql(ctx, "r.role", "ms.via");
-			parts.push(`exists (
-      select 1
-      from (
-${sourceRowsSql(sources, userOf)}
-      ) ms
-      cross join lateral jsonb_array_elements_text(
-        case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
-      ) r(role)
-      where ms.scope = ${quoteLiteral(name)}
-        and ms.id = p_scope_id
-        and (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}${sourceFilters(ctx, name, void 0, void 0, sourcesKeep(sources)).replaceAll("\n    and ", "\n        and ")}
-    )`);
-			continue;
+	};
+	const addLinks = (hops) => {
+		for (let index = 1; index < hops.length; index += 1) {
+			const from = policy.resources.get(hops[index - 1]?.resource ?? "");
+			const hop = hops[index];
+			if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
 		}
-		if (ctx.authorize === "database") {
-			const mapped = scopeTable(ctx, name);
-			if (mapped === void 0) continue;
-			const { table, column } = mapped;
-			const role = memberRoleOf(table, "m", "      ");
-			const filters = [
-				`${memberColumn(table.user)} = ${subjectIdSql(ctx)}`,
-				`${memberColumn(column)}::text = p_scope_id`,
-				`(${role.sql}, p_role) in (${pairsSql(pairs)})`
-			];
-			if (table.expiresAt !== void 0) {
-				const expires = memberColumn(table.expiresAt);
-				filters.push(`(${expires} is null or ${expires} > now())`);
+	};
+	const addAbove = (above) => {
+		const node = above === void 0 ? void 0 : policy.resources.get(above.resource);
+		if (above === void 0 || node === void 0) return;
+		const entry = entryFor(node);
+		entry.closure = Math.max(entry.closure ?? 0, above.depth);
+		entry.restrictedAncestors = above;
+	};
+	for (const grant of policy.grants) {
+		const row = policy.resources.get(grant.permission.resource);
+		for (const item of flattenGrantee(grant.to)) {
+			if (item.kind === "inherit") {
+				const inherited = inheritCondition(item, row, policy.resources);
+				addLinks(inherited?.hops ?? []);
+				addAbove(inherited?.restrictedAncestors);
+				continue;
 			}
-			const disabled = disabledColumn(table);
-			if (disabled !== void 0) filters.push(`${disabled} is null`);
-			const kind = kindFilterSql(ctx, role.sql, memberVia(table));
-			if (kind !== void 0) filters.push(kind);
-			parts.push(`exists (
-      select 1 from ${quoteQualified(table.table)} m${role.join}
-      where ${filters.join("\n        and ")}
-    )`);
-		} else {
-			const kind = kindFilterSql(ctx, "r.role", "m ->> 'via'");
-			parts.push(`exists (
-      select 1 from ${membershipRows(ctx)}
-      where m ->> 'scope' = ${quoteLiteral(name)}
-        and m ->> 'id' = p_scope_id
-        and (r.role, p_role) in (${pairsSql(pairs)})
-        and case jsonb_typeof(m -> 'expires_at')
-          when 'number' then (m ->> 'expires_at')::numeric > extract(epoch from now())
-          else true
-        end${kind === void 0 ? "" : `\n        and ${kind}`}${claimKeptLines(ctx, "        ").map((line) => `\n${line}`).join("")}
-    )`);
+			if (item.kind !== "relation") continue;
+			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
+			if (condition?.op !== "related") continue;
+			const node = policy.resources.get(condition.resource);
+			if (node === void 0) continue;
+			addRelation(node, condition.relation);
+			const entry = entryFor(node);
+			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
+			addLinks(condition.hops ?? []);
+			addAbove(condition.restrictedAncestors);
 		}
 	}
-	const body = parts.length === 0 ? "false" : parts.join("\n    or ");
-	const language = used.length === 0 ? `language sql
+	return plan;
+}
+/** The closure depth per walked resource, as `RlsSqlContext.graph` carries it. */
+function closureDepths(plan) {
+	const out = {};
+	for (const [name, entry] of plan) if (entry.closure !== void 0) out[name] = entry.closure;
+	return out;
+}
+/**
+* The `permitted_<resource>_ids(relation)` arm for one concrete relation: ids
+* of `resource` the subject holds it on, directly or through a group. `asked`
+* are the relation names that include it, so a call for any of them (or for
+* all, with null) reads this arm.
+*/
+function relationArm(ctx, plan, node, relation, asked, tables) {
+	const spec = node.relations[relation];
+	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw configError(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
+	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
+	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifySqlTable,
+		holders: (resource, groupRelation) => [{ text: `select ${qualified(ctx, graphHelper(resource))}(${quoteLiteral(groupRelation)})` }]
+	}), ctx)}) a\n  where ${guard}${activeUserSql(ctx).map((part) => ` and ${part}`).join("")}`;
+}
+function permittedSql(ctx, plan, entry, tables) {
+	const fn = qualified(ctx, graphHelper(entry.node.name));
+	const asked = [...entry.relations].toSorted();
+	const arms = [...new Set(asked.flatMap((name) => expandRelation(entry.node, name)))].toSorted().map((relation) => relationArm(ctx, plan, entry.node, relation, asked.filter((name) => expandRelation(entry.node, name).includes(relation)), tables));
+	if (arms.length === 0) arms.push("  select null::text where false");
+	return `-- ${entry.node.name}: ids the subject holds a relation on (all relations when p_relation is null)
+create or replace function ${fn}(p_relation text)
+returns setof text
+language sql
 stable
 security definer
 set search_path = ''
 as $$
-  select ${signedIn(ctx)} and (
-    ${body}
-  )
-$$;` : `language plpgsql
+${arms.join("\n  union\n")}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+}
+/**
+* `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points
+* into `ids`, read past the table's own policies.
+*/
+function linkSql(ctx, node, link, tables) {
+	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
+	if (spec === void 0) throw configError(`PermDock CLI: ${node.name} has no link '${link}'`);
+	const fn = qualified(ctx, linkHelper(node.name, link));
+	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
+create or replace function ${fn}(p_ids text[])
+returns setof text
+language sql
 stable
 security definer
 set search_path = ''
+as $$
+  select t.${quoteIdent(node.id)}::text from ${quoteQualified(tableFor(node.name, tables))} t
+  where t.${quoteIdent(spec.field)}::text = any(p_ids)
+$$;
+revoke execute on function ${fn}(text[]) from public, anon;
+grant execute on function ${fn}(text[]) to authenticated;`;
+}
+function closureTableSql(ctx) {
+	const table = qualified(ctx, CLOSURE.table);
+	return `-- the object graph: one row per (ancestor, descendant) within each walked resource's depth,
+-- never crossing a restricted row; kept current by statement triggers on each self-parented table
+create table if not exists ${table} (
+  resource text not null,
+  ancestor text not null,
+  descendant text not null,
+  depth integer not null check (depth >= 0),
+  primary key (resource, descendant, ancestor)
+);
+create index if not exists ${quoteIdent(`${CLOSURE.table}_ancestor`)} on ${table} (resource, ancestor);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;
+grant select on table ${table} to authenticated;`;
+}
+function closureObjectsSql(ctx, entry, depth, tables) {
+	const { node } = entry;
+	const parent = node.parent;
+	if (parent === void 0) return "";
+	const name = node.name;
+	const sqlName = graphSqlName(name) ?? name;
+	const closure = qualified(ctx, CLOSURE.table);
+	const table = quoteQualified(tableFor(name, tables));
+	const id = quoteIdent(node.id);
+	const up = quoteIdent(parent.field);
+	const restricted = restrictedFor(node, "parent");
+	const stop = restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(restricted)}, false)`;
+	const stopParent = restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(restricted)}, false)`;
+	const refresh = qualified(ctx, `${CLOSURE.table}_${sqlName}`);
+	const changed = qualified(ctx, `${CLOSURE.table}_${sqlName}_changed`);
+	const literal = quoteLiteral(name);
+	const restrictedChanged = restricted === void 0 ? "" : ` or n.${quoteIdent(restricted)} is distinct from o.${quoteIdent(restricted)}`;
+	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${sqlName}_${suffix}`);
+	return `-- ${name}: ${restricted === void 0 ? `rows reach their ancestors up to depth ${String(depth)}` : `rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row`}
+drop policy if exists ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure};
+create policy ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure}
+  for select to authenticated
+  using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
+create or replace function ${refresh}(p_ids text[])
+returns void
+language plpgsql
+security definer
+set search_path = ''
 as $$
 declare
-${used.map((source, index) => `  v_user_${String(index)} ${source.sql.userType} := ${subjectIdSql(ctx)};`).join("\n")}
+  v_cycle text;
+  v_affected text[];
 begin
-  return ${signedIn(ctx)} and (
-    ${body}
-  );
-end;
-$$;`;
-	if (forUser) {
-		const user = ctx.dialect === "supabase" ? "uuid" : "text";
-		return `-- who may assign, for a user the caller names: trusted SQL acting later for a stored user; no client role may execute it
-create or replace function ${fn}(p_user ${user}, p_role text, p_scope_id text)
-returns boolean
-${language}
-revoke execute on function ${fn}(${user}, text, text) from public, anon, authenticated;`;
-	}
-	return `-- who may assign: a held role whose assigns lists p_role, in instance p_scope_id (its scope or an ancestor's); a null p_scope_id assigns a global role, which only global assigners may
-create or replace function ${fn}(p_role text, p_scope_id text)
-returns boolean
-${language}
-revoke execute on function ${fn}(text, text) from public, anon;
-grant execute on function ${fn}(text, text) to authenticated;`;
-}
-/** Whether the helpers keep custom roles in tables, so assigning one is checked against its stored definition. */
-function assignsCustomRoles(ctx) {
-	return ctx.customRoles !== void 0 && ctx.authorize === "database";
-}
-/** Whether `permdock_can_assign_any_for` is written: every function it calls has a `_for` form. */
-function hasCanAssignAnyFor(ctx) {
-	return ctx.authorize === "database" && (!assignsCustomRoles(ctx) || hasCustomRoleChecksFor(ctx));
-}
-/**
-* `permdock_can_assign_any`: one check for a declared or a custom role, so
-* SQL that assigns roles calls one function: `permdock_can_assign` for a
-* declared role, `permdock_can_assign_custom_role` for a custom one. `p_scope`
-* `'global'` (no tenant, no instance) assigns a platform role.
-*/
-function canAssignAnySql(ctx, custom, forUser = false) {
-	const tenantType = tenantTypeOf(ctx);
-	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignAnyFor : OWNERSHIP.canAssignAny);
-	const declaredFn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
-	const customFn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
-	const userType = ctx.dialect === "supabase" ? "uuid" : "text";
-	const userParam = forUser ? `p_user ${userType}, ` : "";
-	const userArg = forUser ? `${userType}, ` : "";
-	const user = forUser ? "p_user, " : "";
-	const declared = `${declaredFn}(${user}p_role, case when p_scope = 'global' then null else p_scope_id end)`;
-	const body = custom && ctx.customRoles !== void 0 ? `case
-    when p_role = any(${declaredArray(ctx.customRoles.declared)}) then ${declared}
-    when p_scope = 'global' then ${customFn}(${user}null, 'global', null, p_role)
-    else ${customFn}(${user}p_tenant, p_scope, p_scope_id, p_role)
-  end` : declared;
-	const grants = forUser ? `revoke execute on function ${fn}(${userArg}text, ${tenantType}, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(text, ${tenantType}, text, text) from public, anon;
-grant execute on function ${fn}(text, ${tenantType}, text, text) to authenticated;`;
-	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign p_role at instance p_scope_id of p_scope in tenant p_tenant, declared or custom (p_scope 'global' for a platform role)${forUser ? "; no client role may execute it" : ""}
-create or replace function ${fn}(${userParam}p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text)
-returns boolean
+  with recursive walk(start, next, path) as (
+    select t.${id}, t.${up}, array[t.${id}::text]
+    from ${table} t
+    where t.${id}::text = any(p_ids)
+    union all
+    select walk.start, t.${up}, walk.path || t.${id}::text
+    from walk join ${table} t on t.${id} = walk.next
+    where not (walk.next::text = any(walk.path))
+  )
+  select walk.start::text into v_cycle
+  from walk
+  where walk.next::text = any(walk.path)
+  limit 1;
+  if v_cycle is not null then
+    raise exception 'permdock: % % is its own ancestor', ${literal}, v_cycle
+      using errcode = 'check_violation';
+  end if;
+  with recursive down(id, level) as (
+    select t.${id}, 0
+    from ${table} t
+    where t.${id}::text = any(p_ids) or t.${up}::text = any(p_ids)
+    union
+    select t.${id}, down.level + 1
+    from down join ${table} t on t.${up} = down.id
+    where down.level < ${String(depth)}
+  )
+  select coalesce(array_agg(distinct down.id::text), '{}') into v_affected from down;
+  delete from ${closure} c
+  where c.resource = ${literal}
+    and (c.descendant = any(p_ids) or c.descendant = any(v_affected));
+  insert into ${closure} (resource, ancestor, descendant, depth)
+  with recursive walk(descendant, ancestor, parent, depth, stop) as (
+    select t.${id}::text, t.${id}, t.${up}, 0, ${stop}
+    from ${table} t
+    where t.${id}::text = any(v_affected)
+    union all
+    select walk.descendant, p.${id}, p.${up}, walk.depth + 1, ${stopParent}
+    from walk join ${table} p on p.${id} = walk.parent
+    where not walk.stop and walk.depth < ${String(depth)}
+  )
+  select ${literal}, walk.ancestor::text, walk.descendant, walk.depth from walk
+  on conflict do nothing;
+end
+$$;
+revoke execute on function ${refresh}(text[]) from public, anon, authenticated;
+create or replace function ${changed}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'TRUNCATE' then
+    delete from ${closure} where resource = ${literal};
+  elsif tg_op = 'INSERT' then
+    perform ${refresh}(array(select n.${id}::text from new_rows n));
+  elsif tg_op = 'DELETE' then
+    perform ${refresh}(array(select o.${id}::text from old_rows o));
+  else
+    perform ${refresh}(array(
+      select n.${id}::text
+      from new_rows n left join old_rows o on o.${id} = n.${id}
+      where o.${id} is null or n.${up} is distinct from o.${up}${restrictedChanged}
+      union
+      select o.${id}::text
+      from old_rows o left join new_rows n on n.${id} = o.${id}
+      where n.${id} is null
+    ));
+  end if;
+  return null;
+end
+$$;
+revoke execute on function ${changed}() from public, anon, authenticated;
+drop trigger if exists ${trigger("insert")} on ${table};
+create trigger ${trigger("insert")} after insert on ${table}
+  referencing new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("update")} on ${table};
+create trigger ${trigger("update")} after update on ${table}
+  referencing old table as old_rows new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("delete")} on ${table};
+create trigger ${trigger("delete")} after delete on ${table}
+  referencing old table as old_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("truncate")} on ${table};
+create trigger ${trigger("truncate")} after truncate on ${table}
+  for each statement execute function ${changed}();
+select ${refresh}(array(select t.${id}::text from ${table} t));`;
+}
+function restrictedRowsHelperSql(ctx, plan, entry, tables) {
+	const above = entry.restrictedAncestors;
+	if (above === void 0) return "";
+	const fn = qualified(ctx, restrictedHelper(entry.node.name));
+	const body = graphSqlText(restrictedRowsSql(above, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifySqlTable,
+		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
+		closureDepths: closureDepths(plan)
+	}), ctx);
+	return `-- ${entry.node.name}: rows a stopped link does not reach below: restricted, under a restricted row within ${String(above.depth - 1)} levels, or deeper
+create or replace function ${fn}()
+returns setof text
 language sql
 stable
 security definer
 set search_path = ''
 as $$
-  select coalesce(${body}, false)
+  ${body}
 $$;
-${grants}`;
+revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;`;
 }
-//#endregion
-//#region src/cli/rls/ownership.ts
-function roleScope(policy, scopes, name) {
-	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
-	return typeof on === "string" ? resolveScope(scopes, on) : void 0;
-}
-function isGlobalRole(policy, name) {
-	const binding = policy.rolesByName.get(name);
-	if (binding !== void 0) return binding.on === void 0;
-	const leaf = findRole(policy.vocabulary.roles, name);
-	return leaf !== void 0 && leaf.on === void 0;
-}
-/** The rules `rls generate` enforces; `undefined` when no role declares one. */
-function ownershipRules(policy, scopes) {
-	const kinds = {};
-	const assigns = [];
-	const counted = [];
-	for (const binding of policy.roles) {
-		const scope = roleScope(policy, scopes, binding.name);
-		if (binding.for !== void 0) kinds[binding.name] = binding.for;
-		const assigner = scope ?? (binding.on === void 0 ? "global" : void 0);
-		for (const target of binding.assigns ?? []) {
-			const at = roleScope(policy, scopes, target);
-			if (assigner !== void 0 && at !== void 0 && (assigner === "global" || scopeChain(scopes, at).includes(assigner))) assigns.push({
-				assigner: binding.name,
-				scope: assigner,
-				role: target,
-				at
-			});
-			else if (assigner === "global" && isGlobalRole(policy, target)) assigns.push({
-				assigner: binding.name,
-				scope: "global",
-				role: target,
-				at: "global"
-			});
-		}
-		const min = binding.min ?? 0;
-		const transferOnly = binding.transferOnly === true;
-		if (scope !== void 0 && (min > 0 || binding.max !== void 0 || transferOnly)) counted.push(binding.max === void 0 ? {
-			role: binding.name,
-			scope,
-			min,
-			transferOnly
-		} : {
-			role: binding.name,
-			scope,
-			min,
-			max: binding.max,
-			transferOnly
-		});
+/** Group resources a resource's asked relations name, other than itself. */
+function groupTargets(entry) {
+	const out = /* @__PURE__ */ new Set();
+	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
+		const spec = entry.node.relations[name];
+		const resources = isEdgeRelation(spec) ? groupEntries(spec).map((group) => group.resource) : [];
+		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
 	}
-	if (Object.keys(kinds).length === 0 && assigns.length === 0 && counted.length === 0) return;
-	return {
-		kinds,
-		assigns,
-		counted
+	return [...out].toSorted();
+}
+/**
+* Plan entries by name, each after the group resources its helper calls (SQL
+* function bodies are checked on create).
+*/
+function dependencyOrder(plan) {
+	const out = [];
+	const done = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		const entry = plan.get(name);
+		if (entry === void 0 || done.has(name)) return;
+		done.add(name);
+		for (const target of groupTargets(entry)) visit(target);
+		out.push(entry);
 	};
+	for (const name of [...plan.keys()].toSorted()) visit(name);
+	return out;
 }
 /**
-* The ownership objects: holder-count and transfer-only triggers on each
-* scope's membership table, and `permdock_can_assign` for the application's
-* own policies on those tables. Empty when no role declares a rule.
+* The graph preamble: `permitted_<resource>_ids` for every resource a graph
+* grant reads, and the closure table with its triggers for every self-parented
+* resource a grant walks. Empty when no grant is a graph grant.
 */
-function ownershipSql(ctx) {
-	const own = ctx.ownership;
-	if (own === void 0) return "";
-	const chunks = [];
-	const skipped = ctx.skipOwnershipTriggers;
-	for (const { name } of ctx.scopes) {
-		const counted = own.counted.filter((rule) => rule.scope === name);
-		if (counted.length === 0) continue;
-		if (skipped === "all" || skipped?.includes(name) === true) {
-			chunks.push(`-- ${name}: rls.ownershipTriggers leaves out the triggers, so min, max and transferOnly are checked only by decideRoleChange`);
-			continue;
-		}
-		const transfer = counted.filter((rule) => rule.transferOnly).map((rule) => rule.role);
-		const mapped = scopeTable(ctx, name);
-		if (mapped === void 0) {
-			const sources = holderSources(ctx, name);
-			if (sources === void 0) chunks.push(`-- ${name}: no memberships table configured, so min, max and transferOnly are checked only by decideRoleChange`);
-			else if (sources === "not-tables") chunks.push(`-- ${name}: a membership source is not a table, so min, max and transferOnly are checked only by decideRoleChange`);
-			else {
-				chunks.push(sourceHoldersTriggerSql(ctx, name, sources, counted));
-				if (transfer.length > 0) chunks.push(sourceTransferTriggerSql(ctx, name, sources, transfer));
-			}
-			continue;
-		}
-		chunks.push(holdersTriggerSql(ctx, name, mapped.table, mapped.column, counted));
-		if (transfer.length > 0) chunks.push(transferTriggerSql(ctx, name, mapped.table, mapped.column, transfer));
+function graphSql(ctx, plan, tables) {
+	if (plan.size === 0) return "";
+	const sqlNames = /* @__PURE__ */ new Map();
+	for (const name of plan.keys()) {
+		const helper = graphHelper(name);
+		const sql = graphSqlName(name) ?? name;
+		if (ctx.scopes.some((scope) => scope.name === sql)) throw configError(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
+		const other = sqlNames.get(sql);
+		if (other !== void 0) throw configError(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
+		sqlNames.set(sql, name);
 	}
-	if (own.assigns.length > 0) {
-		chunks.push(canAssignSql(ctx, own));
-		if (ctx.authorize === "database") chunks.push(canAssignSql(ctx, own, true));
-		const custom = assignsCustomRoles(ctx);
-		if (custom) {
-			chunks.push(canAssignCustomSql(ctx));
-			if (hasCustomRoleChecksFor(ctx)) chunks.push(canAssignCustomSql(ctx, true));
+	const entries = dependencyOrder(plan);
+	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 && entry.closure === void 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
+	const walked = entries.filter((entry) => entry.closure !== void 0);
+	if (walked.length > 0) {
+		chunks.push(closureTableSql(ctx));
+		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
+		for (const entry of walked) {
+			const helper = restrictedRowsHelperSql(ctx, plan, entry, tables);
+			if (helper !== "") chunks.push(helper);
 		}
-		chunks.push(canAssignAnySql(ctx, custom));
-		if (hasCanAssignAnyFor(ctx)) chunks.push(canAssignAnySql(ctx, custom, true));
 	}
-	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/sql/tables.ts
+/**
+* The `schema.table` an `rls.tables` entry names, or `resource` when it names
+* none or is `false`.
+*/
+function tableNameOf(entry, resource) {
+	if (entry === void 0 || entry === false) return resource;
+	return typeof entry === "string" ? entry : entry.table ?? resource;
+}
+/**
+* `rls.tables` as resource to table name, the `via` objects reduced to their
+* `table` and the `false` entries left out.
+*/
+function tableNames(tables) {
+	return tables === void 0 ? void 0 : Object.fromEntries(Object.entries(tables).filter(([, entry]) => entry !== false).map(([resource, entry]) => [resource, tableNameOf(entry, resource)]));
+}
+/** The resources `rls.tables` marks `false`: no table, so no policies. */
+function tablelessResources(tables) {
+	return new Set(Object.entries(tables ?? {}).filter(([, entry]) => entry === false).map(([resource]) => resource));
+}
+function singular(name) {
+	if (name.endsWith("ies")) return `${name.slice(0, -3)}y`;
+	if (name.endsWith("sses")) return name.slice(0, -2);
+	return name.endsWith("s") && !name.endsWith("ss") ? name.slice(0, -1) : name;
+}
+/** The `via` entries of `rls.tables`, by resource. */
+function resolveVias(tables, scopes, dialect) {
+	const out = {};
+	for (const [resource, entry] of Object.entries(tables ?? {})) {
+		if (typeof entry === "string" || entry === false) continue;
+		const { via } = entry;
+		const scope = via.scope ?? scopes[0]?.name;
+		if (scope === void 0 || !scopes.some((item) => item.name === scope)) throw configError(`PermDock CLI: rls.tables.${resource}.via.scope '${scope ?? ""}' is not a scope of the policy (${scopes.map((item) => item.name).join(", ")})`);
+		const name = singular(via.table.slice(via.table.lastIndexOf(".") + 1));
+		out[resource] = {
+			helper: permittedIdsHelper(name),
+			key: via.key ?? `${name}_id`,
+			scope,
+			table: via.table.includes(".") ? via.table : `public.${via.table}`,
+			column: via.column,
+			id: via.id ?? "id",
+			type: via.type ?? (dialect === "supabase" ? "uuid" : "text")
+		};
+	}
+	const helpers = /* @__PURE__ */ new Map();
+	for (const [resource, via] of Object.entries(out)) {
+		const seen = helpers.get(via.helper);
+		if (seen !== void 0 && (seen.table !== via.table || seen.column !== via.column || seen.id !== via.id || seen.scope !== via.scope || seen.type !== via.type)) throw configError(`PermDock CLI: rls.tables.${resource}.via names ${via.helper}, which another resource defines over a different parent; give the parents different table names`);
+		helpers.set(via.helper, via);
+	}
+	return Object.keys(out).length === 0 ? void 0 : out;
 }
 //#endregion
-export { activeUserSql as $, collectGrants as A, hasPermittedUsers as B, byKey as C, apiKeysPlan as D, apiKeyFields as E, CLOSURE as F, memberIdsHelper as G, memberForHelper as H, graphHelper as I, permittedIdsHelper as J, memberRoleOf as K, graphSqlName as L, compileConditionSql as M, contextRefs as N, breakGlassHolder as O, sqlFunctionNames as P, activeRowSql as Q, graphSqlText as R, byCodeUnit as S, apiKeyAllowsCall as T, memberForSources as U, linkHelper as V, memberForTable as W, scopeSources as X, restrictedHelper as Y, scopeTable as Z, capabilityAccessSql as _, guardedTables as a, currentKeyExpr as b, PERMISSION_HELPERS as c, permissionKeysForHelper as d, checkSuspension as et, permittedByPermissionHelper as f, seedSql as g, helpersSql as h, assignmentSql as i, roleNames as j, breakGlassKey as k, checkName as l, accessSql as m, ownershipSql as n, ASSIGNMENTS as o, requiresSql as p, permittedForHelper as q, holderSources as r, OWNERSHIP as s, ownershipRules as t, permissionHelpersSql as u, globalRoleRows as v, API_KEY_ALLOWS as w, rolesTableScope as x, globalRoleSource as y, hasMemberFor as z };
+export { graphSqlText as $, claimKeptLines as A, hasCustomRoleChecksFor as B, accessSql as C, tokenScopeAllowsCall as D, TOKEN_SCOPE_ALLOWS as E, globalRoleRows as F, byKey as G, rolesTableScope as H, membershipRows as I, apiKeyFields as J, API_KEY_ALLOWS as K, roleRows as L, memberColumn as M, sourceFilters as N, tokenScopesPlan as O, sourcesKeep as P, graphSqlName as Q, globalRoleSource as R, requiresSql as S, seedSql as T, storedTenant as U, raiseSql as V, byCodeUnit as W, CLOSURE as X, apiKeysPlan as Y, graphHelper as Z, PERMISSION_HELPERS as _, activeMembershipSql as _t, closureDepths as a, memberForHelper as at, permissionKeysForHelper as b, checkSuspension as bt, holderSources as c, memberIdsHelper as ct, sourceRowsSql as d, permittedForHelper as dt, hasMemberFor as et, sourceTransferTriggerSql as f, permittedIdsHelper as ft, OWNERSHIP as g, activeInstancesSql as gt, ASSIGNMENTS as h, scopeTable as ht, tablelessResources as i, linkHelper as it, disabledColumn as j, capabilityAccessSql as k, pairsSql as l, memberOfHelper as lt, transferTriggerSql as m, scopeSources as mt, tableNameOf as n, inheritedRowsHelper as nt, graphPlan as o, memberForSources as ot, holdersTriggerSql as p, restrictedHelper as pt, apiKeyAllowsCall as q, tableNames as r, isTeamScope as rt, graphSql as s, memberForTable as st, resolveVias as t, hasPermittedUsers as tt, sourceHoldersTriggerSql as u, memberRoleOf as ut, checkName as v, activeRowSql as vt, helpersSql as w, permittedByPermissionHelper as x, permissionHelpersSql as y, activeUserSql as yt, currentKeyExpr as z };