permdock 0.7.0 → 0.8.0

package/dist/hono/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { r as PermDockRevokedError } from "../errors-BKy0EfhN.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
-import { t as problemFromError } from "../map-error-BQGyDm_M.js";
-import { r as bindKernel } from "../bind-D1nO6fiC.js";
-import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
+import { r as PermDockRevokedError } from "../errors-B6R_lg2a.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts
 function socket(connection, events) {

package/dist/{hosted-BmjzxQhp.d.ts → hosted-Cmtxogd0.d.ts}

@@ -1,6 +1,9 @@
-import { T as Policy, a as ApprovalRequirement, mr as Condition, wn as Grantee } from "./policy-types-B-F-qAZk.js";
+import { T as Policy, a as ApprovalRequirement, mr as Condition, wn as Grantee } from "./policy-types-CCiDRZBH.js";
 //#region src/core/hosted.d.ts
-/** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
+/**
+ * One grant authored in PermDock Cloud; its grantee is a declared role, plan or
+ * relation.
+ */
 type HostedGrant = {
   readonly id: string;
   readonly permission: string;
@@ -12,9 +15,9 @@ type HostedGrant = {
   readonly fields?: readonly string[];
 };
 /**
- * PolicyDocument v1. Signed as a `vnd.permdock.policy+jwt`, the `policy`
- * claim carries every field but `id` and `issuedAt`, which are the token's
- * `jti` and `iat` (`policyDocumentFromClaims`).
+ * PolicyDocument v1. Signed as a `vnd.permdock.policy+jwt`, the `policy` claim
+ * carries every field but `id` and `issuedAt`, which are the token's `jti` and
+ * `iat` (`policyDocumentFromClaims`).
  */
 type PolicyDocument = {
   readonly v: 1;
@@ -27,17 +30,20 @@ type PolicyDocument = {
   readonly grants: readonly HostedGrant[];
 };
 /**
- * The channel for hosted grants. `getPermDock` reads `current()` once;
- * the application calls `refresh()` on its own schedule, never a check.
+ * The channel for hosted grants. `getPermDock` reads `current()` once; the
+ * application calls `refresh()` on its own schedule, never a check.
  */
 type PolicySource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  current(): PolicyDocument | null;
-  refresh(): Promise<void>;
+  current: () => PolicyDocument | null;
+  refresh: () => Promise<void>;
 };
 type HostedGrantDropReason = "not-hostable" | "unknown-permission" | "unknown-grantee" | "non-portable" | "weaker-approval" | "invalid";
-/** Reported through `on('error')` when a hosted grant is not merged; never thrown. */
+/**
+ * Reported through `on('error')` when a hosted grant is not merged; never
+ * thrown.
+ */
 type HostedGrantDropped = {
   readonly kind: "hosted-grant-dropped";
   readonly document: string;
@@ -47,9 +53,15 @@ type HostedGrantDropped = {
 declare function memoryPolicySource(document?: PolicyDocument | null): PolicySource;
 /** Validates the document envelope; per-grant checks happen at merge time. */
 declare function parsePolicyDocument(json: unknown): PolicyDocument;
-/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+/**
+ * The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with
+ * `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`.
+ */
 declare function policyDocumentFromClaims(claims: Readonly<Record<string, unknown>>): PolicyDocument;
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+/**
+ * True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown
+ * op.
+ */
 declare function isPortableCondition(value: unknown): value is Condition;
 type HostedGrantCheck = {
   readonly ok: true;
@@ -59,24 +71,24 @@ type HostedGrantCheck = {
 };
 /**
  * Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
- * drop reason it would report when not. Needs no `PolicyDocument`, so a
- * grant form can check a grant before it publishes one.
+ * drop reason it would report when not. Needs no `PolicyDocument`, so a grant
+ * form can check a grant before it publishes one.
  */
 declare function checkHostedGrant(policy: Policy, grant: unknown): HostedGrantCheck;
 /**
- * The code policy plus the hosted grants that pass every rule. Hosted
- * allows OR with code allows and any deny still wins, so a hosted grant can
- * never override a code deny; one that fails a rule is dropped, not thrown.
+ * The code policy plus the hosted grants that pass every rule. Hosted allows OR
+ * with code allows and any deny still wins, so a hosted grant can never
+ * override a code deny; one that fails a rule is dropped, not thrown.
  */
 declare function mergeHostedGrants(policy: Policy, document: PolicyDocument | null): {
   readonly policy: Policy;
   readonly dropped: readonly HostedGrantDropped[];
 };
 /**
- * Hosted grants as an instance option: `policies: hostedPolicies(source)`.
- * The merge code ships only with an app that imports this function.
- * `source.current()` is read once per instance; a throw keeps the code
- * policy and is reported as an error event.
+ * Hosted grants as an instance option: `policies: hostedPolicies(source)`. The
+ * merge code ships only with an app that imports this function.
+ * `source.current()` is read once per instance; a throw keeps the code policy
+ * and is reported as an error event.
  */
 type HostedPolicies = {
   readonly feature: "hosted-policies";

package/dist/{hosted-XBgU6RGT.js → hosted-D0IzESu_.js}

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
-import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-C1VJzvcr.js";
-import { a as getResource, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
-import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-DkWjdL98.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { i as indexPolicy, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-CUvURzHp.js";
+import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-BK2-T6oD.js";
+import { a as getResource, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { d as isSelfParented } from "./resource-relations-8-pCScBO.js";
+import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-nR1JesoH.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { a as indexPolicy, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);
@@ -37,7 +37,10 @@ function parsePolicyDocument(json) {
 	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || !isRfc3339(copy["issuedAt"]) || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
 	return freezeDeep(copy);
 }
-/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+/**
+* The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with
+* `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`.
+*/
 function policyDocumentFromClaims(claims) {
 	const claim = claims["policy"];
 	const jti = claims["jti"];
@@ -71,7 +74,10 @@ function portableValue(value) {
 	if (keys[0] === "ref") return safePath(value["ref"]);
 	return keys[0] === "date" && typeof value["date"] === "string";
 }
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+/**
+* True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown
+* op.
+*/
 function isPortableCondition(value) {
 	if (!isRecord(value) || typeof value["op"] !== "string") return false;
 	const op = value["op"];
@@ -105,7 +111,10 @@ function approvalRank(approval) {
 		escalates: approval.escalation !== void 0
 	};
 }
-/** A hosted approval must meet every approval a code allow requires on the permission. */
+/**
+* A hosted approval must meet every approval a code allow requires on the
+* permission.
+*/
 function approvalAtLeast(hosted, code) {
 	const mine = approvalRank(hosted);
 	for (const required of code) {
@@ -120,11 +129,17 @@ function approvalAtLeast(hosted, code) {
 	}
 	return true;
 }
-/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
+/**
+* A grantee kind this build does not know is never declared, so the hosted
+* grant is dropped.
+*/
 function undeclaredKind(_grantee) {
 	return false;
 }
-/** Whether a hosted grant may name `grantee` on a permission of `permissionResource`. */
+/**
+* Whether a hosted grant may name `grantee` on a permission of
+* `permissionResource`.
+*/
 function declaredGrantee(policy, grantee, permissionResource) {
 	switch (grantee.kind) {
 		case "role": return declaredRoleNames(policy).has(grantee.role);
@@ -157,7 +172,10 @@ function granteesAcceptable(policy, raw, permissionResource) {
 	const items = flattenGrantee(raw);
 	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
 }
-/** The approvals the code allows on `key` carry; a hosted allow must meet each one. */
+/**
+* The approvals the code allows on `key` carry; a hosted allow must meet each
+* one.
+*/
 function codeApprovals(policy, key) {
 	return policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === key).map((grant) => grant.approval);
 }
@@ -246,8 +264,8 @@ const CHECKED_DOCUMENT = Object.freeze({
 });
 /**
 * Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
-* drop reason it would report when not. Needs no `PolicyDocument`, so a
-* grant form can check a grant before it publishes one.
+* drop reason it would report when not. Needs no `PolicyDocument`, so a grant
+* form can check a grant before it publishes one.
 */
 function checkHostedGrant(policy, grant) {
 	const result = buildGrant(policy, CHECKED_DOCUMENT, grant);
@@ -256,7 +274,10 @@ function checkHostedGrant(policy, grant) {
 		reason: result.reason
 	};
 }
-/** The grants of `document` that `policy` drops, in document order; `permdock/catalog` turns them into drift findings. */
+/**
+* The grants of `document` that `policy` drops, in document order;
+* `permdock/catalog` turns them into drift findings.
+*/
 function hostedGrantDrops(policy, document) {
 	return document.grants.flatMap((raw) => {
 		const result = buildGrant(policy, document, raw);
@@ -269,9 +290,9 @@ function hostedGrantDrops(policy, document) {
 	});
 }
 /**
-* The code policy plus the hosted grants that pass every rule. Hosted
-* allows OR with code allows and any deny still wins, so a hosted grant can
-* never override a code deny; one that fails a rule is dropped, not thrown.
+* The code policy plus the hosted grants that pass every rule. Hosted allows OR
+* with code allows and any deny still wins, so a hosted grant can never
+* override a code deny; one that fails a rule is dropped, not thrown.
 */
 function mergeHostedGrants(policy, document) {
 	if (document === null || document.grants.length === 0) return {

package/dist/{http-ujKm0JXE.js → http-DH94eh6f.js}

@@ -1,4 +1,4 @@
-import { i as headersFrom, n as firstHeader, t as fetchRequest } from "./http-BBoKefeS.js";
+import { i as headersFrom, n as firstHeader, t as fetchRequest } from "./http-DKLXrFGk.js";
 //#region src/node/http.ts
 function toRequest(req, stream = req) {
 	const host = firstHeader(req.headers.host) ?? "localhost";
@@ -9,9 +9,9 @@ function chunkOf(chunk) {
 	return typeof chunk === "string" ? Buffer.from(chunk) : new Uint8Array(chunk);
 }
 /**
-* Pull-based with `highWaterMark: 0`: nothing is read from `req` until the
-* Web body is consumed, so a later body parser (multer, `express.json()`)
-* still sees the whole stream.
+* Pull-based with `highWaterMark: 0`: nothing is read from `req` until the Web
+* body is consumed, so a later body parser (multer, `express.json()`) still
+* sees the whole stream.
 */
 function incomingBody(req) {
 	return new ReadableStream({ pull(controller) {

package/dist/{http-BBoKefeS.js → http-DKLXrFGk.js}

@@ -1,5 +1,8 @@
 //#region src/server/http.ts
-/** Node-style headers (`IncomingHttpHeaders`, Fastify's) as Fetch `Headers`; repeated values stay separate. */
+/**
+* Node-style headers (`IncomingHttpHeaders`, Fastify's) as Fetch `Headers`;
+* repeated values stay separate.
+*/
 function headersFrom(source) {
 	const headers = new Headers();
 	for (const [key, value] of Object.entries(source)) {
@@ -16,9 +19,9 @@ function firstHeader(value) {
 	return value?.[0];
 }
 /**
-* A body a framework already parsed, as the text a Fetch `Request` carries.
-* A non-string body is serialised as JSON and, without a `content-type`,
-* labelled `application/json` on `headers`.
+* A body a framework already parsed, as the text a Fetch `Request` carries. A
+* non-string body is serialised as JSON and, without a `content-type`, labelled
+* `application/json` on `headers`.
 */
 function parsedBody(body, headers) {
 	if (body === void 0) return;
@@ -27,8 +30,8 @@ function parsedBody(body, headers) {
 	return JSON.stringify(body);
 }
 /**
-* A Fetch `Request` for a framework request. A `GET` or `HEAD` carries no
-* body; otherwise the body the framework parsed, or else `stream()`.
+* A Fetch `Request` for a framework request. A `GET` or `HEAD` carries no body;
+* otherwise the body the framework parsed, or else `stream()`.
 */
 function fetchRequest(url, method, headers, body, stream) {
 	if (method === "GET" || method === "HEAD") return new Request(url, {
@@ -64,7 +67,10 @@ function requestFromContext(context) {
 	if ("request" in context && context.request instanceof Request) return context.request;
 	if ("req" in context && context.req instanceof Request) return context.req;
 }
-/** Whether the caller sent credentials, which turns a `401` into a `WWW-Authenticate` challenge. */
+/**
+* Whether the caller sent credentials, which turns a `401` into a
+* `WWW-Authenticate` challenge.
+*/
 function hasCredentials(request) {
 	return request instanceof Request ? request.headers.has("authorization") : request.headers.authorization !== void 0;
 }

package/dist/{http-Ca3Sr5x1.js → http-DOL33cO0.js}

@@ -1,15 +1,18 @@
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-import { a as describeError, n as CliError } from "./errors-DpP_U6Bf.js";
-import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import "./device-BARQ8eYG.js";
+import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { s as cliVersion } from "./version-DMQ0dnN5.js";
+import "./device-BwbJNmb2.js";
 //#region src/cli/core/http.ts
-/** `permdock-cli/<version> node/<version> <platform>`, sent on every request the CLI makes. */
+/**
+* `permdock-cli/<version> node/<version> <platform>`, sent on every request the
+* CLI makes.
+*/
 function userAgent() {
 	return `permdock-cli/${cliVersion()} node/${process.versions.node} ${process.platform}`;
 }
 /**
-* Every outbound request: the user agent, a timeout joined to the run's
-* abort signal, and a `network_error` CLI error when nothing answers.
+* Every outbound request: the user agent, a timeout joined to the run's abort
+* signal, and a `network_error` CLI error when nothing answers.
 */
 async function httpRequest(io, request) {
 	const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
@@ -31,8 +34,8 @@ async function httpRequest(io, request) {
 	}
 }
 /**
-* A 401 or 403 as an `auth_required` action: the credential is missing,
-* expired or lacks a scope, and `next` says how to get one.
+* A 401 or 403 as an `auth_required` action: the credential is missing, expired
+* or lacks a scope, and `next` says how to get one.
 */
 function authFailure(response, message, next) {
 	if (response.status !== 401 && response.status !== 403) return;

package/dist/{import-Bz0GefWg.js → import-CST57XLp.js}

@@ -1,11 +1,11 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
-import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B96movIM.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-fMKOv8hP.js";
-import { f as pgConnector } from "./policies-B2lZIurj.js";
-import { t as FIELD_VIEWS } from "./fields-ClcQLrVc.js";
-import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
+import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-Afctg7B0.js";
+import { n as pgConnector } from "./pg-DQTqRrou.js";
+import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { createHash } from "node:crypto";
@@ -42,7 +42,10 @@ function funcName(value) {
 	if (!Array.isArray(names) || names.length === 0) return;
 	return names.map((item) => stringVal(item) ?? "").join(".");
 }
-/** The expression of a scalar `(select <expr>)`, the InitPlan form generate writes. */
+/**
+* The expression of a scalar `(select <expr>)`, the InitPlan form generate
+* writes.
+*/
 function scalarSubselect(value) {
 	const targets = asNode$1(asNode$1(asNode$1(asNode$1(unwrap(value))?.["SubLink"])?.["subselect"])?.["SelectStmt"])?.["targetList"];
 	if (!Array.isArray(targets) || targets[0] === void 0) return;
@@ -175,7 +178,7 @@ async function fingerprintSql(sql) {
 		const deparsed = await deparse(parsed);
 		return createHash("sha256").update(deparsed).digest("hex").slice(0, 16);
 	} catch {
-		return createHash("sha256").update(sql.replaceAll(/\s+/g, " ").trim().toLowerCase()).digest("hex").slice(0, 16);
+		return createHash("sha256").update(sql.replaceAll(/\s+/gu, " ").trim().toLowerCase()).digest("hex").slice(0, 16);
 	}
 }
 function nodeStmt(first) {
@@ -192,7 +195,10 @@ function jwtClaim(value) {
 	const claim = constValue(expr["rexpr"]);
 	return typeof claim === "string" ? claim : void 0;
 }
-/** `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's `->>` is row data, not a claim. */
+/**
+* `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's
+* `->>` is row data, not a claim.
+*/
 function isJwtCall(value) {
 	const inner = scalarSubselect(value);
 	if (inner !== void 0) return isJwtCall(inner);
@@ -203,20 +209,15 @@ function isJwtCall(value) {
 //#region src/cli/rls/import-membership.ts
 /**
 * What the `where` of a membership subquery on `table` says, or `undefined`
-* when any part of it cannot be read as one. A subquery imports as
-* `memberOf` only when it binds the membership row to the signed-in user
-* and to the policy row, and filters roles with string literals at most:
-* a predicate left unread would widen the imported condition.
+* when any part of it cannot be read as one. A subquery imports as `memberOf`
+* only when it binds the membership row to the signed-in user and to the policy
+* row, and filters roles with string literals at most: a predicate left unread
+* would widen the imported condition.
 */
 function membershipRoles(subquery, table) {
 	const where = selectWhere(subquery.select);
 	if (where === void 0) return;
-	const scopeColumns = new Set([
-		...Object.values(table.columns ?? {}),
-		table.tenant,
-		table.team,
-		table.id
-	].filter((column) => column !== void 0));
+	const scopeColumns = new Set([...Object.values(table.columns ?? {}), table.id].filter((column) => column !== void 0));
 	if (subquery.field !== void 0 && !scopeColumns.has(selectTarget(subquery.select) ?? "")) return;
 	const roleColumn = typeof table.role === "string" ? table.role : void 0;
 	const roles = [];
@@ -393,7 +394,10 @@ function helperCall(value) {
 	} : void 0;
 }
 const MEMBER = /^member_([a-z][a-z0-9_]*)_ids$/u;
-/** `col in (select member_<scope>_ids())`: any live membership of the row's instance. */
+/**
+* `col in (select member_<scope>_ids())`: any live membership of the row's
+* instance.
+*/
 function memberCall(value) {
 	const sub = asNode$1(asNode$1(unwrap(value))?.["SubLink"]);
 	const kind = sub?.["subLinkType"];
@@ -442,8 +446,8 @@ function helperCalls(conjunct) {
 /**
 * The role structure of a policy that calls the helpers: each OR branch's
 * helper calls become grants (roles from the `role_permissions` seeds), the
-* branch's other conjuncts become their `where`. Restrictive policies are
-* read through their outer `not`.
+* branch's other conjuncts become their `where`. Restrictive policies are read
+* through their outer `not`.
 */
 async function helperGrants(sql, memberships, functions, seeds) {
 	if (sql === void 0) return [];
@@ -480,10 +484,10 @@ async function helperGrants(sql, memberships, functions, seeds) {
 			else rest.push(mapped);
 		}
 		if (calls.length === 0) continue;
-		const condition = !portable ? unportable : rest.length === 0 ? void 0 : rest.length === 1 ? rest[0] : {
+		const condition = portable ? rest.length === 0 ? void 0 : rest.length === 1 ? rest[0] : {
 			op: "and",
 			conditions: rest
-		};
+		} : unportable;
 		for (const call of calls) {
 			const permission = seeds.find((seed) => seed.grantKey === call.key)?.permission ?? call.key.replace(/#[a-z0-9][a-z0-9_-]*$/u, "");
 			grants.push({
@@ -543,10 +547,7 @@ function mapNode(value, ctx) {
 	const subquery = membershipSubquery(node);
 	if (subquery !== void 0) {
 		const { table } = subquery;
-		const mappedScopes = Object.entries(memberships?.scopes ?? {});
-		if (memberships?.tenant !== void 0) mappedScopes.push(["tenant", memberships.tenant]);
-		if (memberships?.team !== void 0) mappedScopes.push(["team", memberships.team]);
-		const matches = mappedScopes.filter(([, mapped]) => mapped.table === table);
+		const matches = Object.entries(memberships?.scopes ?? {}).filter(([, mapped]) => mapped.table === table);
 		if (matches.length > 0) {
 			for (const [scope, mapped] of matches) {
 				const read = membershipRoles(subquery, mapped);
@@ -631,7 +632,10 @@ function seedFromRow(row) {
 		effect: row["effect"] === "deny" ? "deny" : "allow"
 	};
 }
-/** `role_permissions` rows from the `insert ... values` statements of a SQL dump. */
+/**
+* `role_permissions` rows from the `insert ... values` statements of a SQL
+* dump.
+*/
 async function seedsFromSql(sql) {
 	let parsed;
 	try {
@@ -754,7 +758,10 @@ function sourceOf(select) {
 		companion: right
 	};
 }
-/** A mask is `allow`, `not deny` or `allow and not deny`; the generator puts the deny last. */
+/**
+* A mask is `allow`, `not deny` or `allow and not deny`; the generator puts the
+* deny last.
+*/
 function splitMask(mask) {
 	const bool = asNode(asNode(mask)?.["BoolExpr"]);
 	if (bool?.["boolop"] === "NOT_EXPR") return { deny: list(bool["args"])[0] };
@@ -778,9 +785,9 @@ async function grantsOf(node, memberships, functions, seeds) {
 }
 /**
 * Reads back the field views `rls generate --fields views` writes: a
-* `security_invoker` `<table>_visible` whose restricted columns are
-* `case when <mask> then col end`, either inline or through the
-* `<table>_visible_fields` companion it joins. Other views are ignored.
+* `security_invoker` `<table>_visible` whose restricted columns are `case when
+* <mask> then col end`, either inline or through the `<table>_visible_fields`
+* companion it joins. Other views are ignored.
 */
 async function fieldViewsFromSql(sql, memberships, functions, seeds) {
 	let stmts;
@@ -830,7 +837,10 @@ async function fieldViewsFromSql(sql, memberships, functions, seeds) {
 	return out;
 }
 const quote = escapeSqlIdent;
-/** `create view` statements for every view in the database, from `pg_get_viewdef` and the view's options. */
+/**
+* `create view` statements for every view in the database, from
+* `pg_get_viewdef` and the view's options.
+*/
 async function viewsSqlFromDb(query) {
 	return (await query(`select n.nspname as schema, c.relname as name, c.reloptions as options, pg_get_viewdef(c.oid) as definition
      from pg_class c join pg_namespace n on n.oid = c.relnamespace
@@ -845,9 +855,9 @@ async function viewsSqlFromDb(query) {
 }
 //#endregion
 //#region src/cli/rls/import.ts
-const POLICY_RE = /create\s+policy\s+"?([A-Za-z0-9_]+)"?\s+on\s+"?([A-Za-z0-9_]+)"?([\s\S]*?);/gi;
+const POLICY_RE = /create\s+policy\s+"?([A-Za-z0-9_]+)"?\s+on\s+"?([A-Za-z0-9_]+)"?([\s\S]*?);/giu;
 function extractParenClause(sql, keyword) {
-	const match = new RegExp(`\\b${keyword}\\s*\\(`, "i").exec(sql);
+	const match = new RegExp(`\\b${keyword}\\s*\\(`, "iu").exec(sql);
 	if (match?.index === void 0) return;
 	const start = match.index + match[0].length;
 	let depth = 1;
@@ -866,11 +876,11 @@ function splitPolicies(sql) {
 		const name = match[1] ?? "policy";
 		const table = match[2] ?? "table";
 		const body = match[3] ?? "";
-		const clauses = body.search(/\b(?:using|with\s+check)\s*\(/i);
+		const clauses = body.search(/\b(?:using|with\s+check)\s*\(/iu);
 		const header = clauses === -1 ? body : body.slice(0, clauses);
-		const asRestrictive = /\bas\s+restrictive\b/i.test(header);
-		const cmdMatch = /\bfor\s+(all|select|insert|update|delete)\b/i.exec(header);
-		const toMatch = /\bto\s+([^\n]+)/i.exec(header);
+		const asRestrictive = /\bas\s+restrictive\b/iu.test(header);
+		const cmdMatch = /\bfor\s+(all|select|insert|update|delete)\b/iu.exec(header);
+		const toMatch = /\bto\s+([^\n]+)/iu.exec(header);
 		const using = extractParenClause(body, "using");
 		const check = extractParenClause(body, "with\\s+check");
 		const roles = (toMatch?.[1] ?? "authenticated").split(",").map((item) => item.trim()).filter((item) => item !== "");
@@ -922,7 +932,7 @@ function emitGenerated(catalog, fieldViews, schema) {
 		resources: tables.map((table) => {
 			const { actions, collection } = actionsFor(catalog.filter((item) => item.table === table).map((item) => item.cmd));
 			return {
-				path: [table.replaceAll(/[^A-Za-z0-9_]/g, "_")],
+				path: [table.replaceAll(/[^A-Za-z0-9_]/gu, "_")],
 				schema: emptySchema(kind),
 				actions,
 				collection
@@ -931,7 +941,7 @@ function emitGenerated(catalog, fieldViews, schema) {
 	});
 }
 function assertNoServiceRole(sql) {
-	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw configError("PermDock CLI: imported SQL must never target service_role");
+	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/iu.test(sql)) throw configError("PermDock CLI: imported SQL must never target service_role");
 }
 async function seedsFromDb(query) {
 	const schema = (await query(`select table_schema from information_schema.tables where table_name = 'role_permissions' order by table_schema = 'permdock' desc, table_schema = 'public' desc, table_schema limit 1`)).rows[0]?.["table_schema"];
@@ -945,10 +955,13 @@ async function seedsFromDb(query) {
 		return [];
 	}
 }
-/** `pg_policies.roles` is a `name[]`, which `pg` returns as an array or, untyped, as `{a,b}`. */
+/**
+* `pg_policies.roles` is a `name[]`, which `pg` returns as an array or,
+* untyped, as `{a,b}`.
+*/
 function policyRoles(value) {
 	if (Array.isArray(value)) return value.map(String);
-	return typeof value === "string" ? value.replaceAll(/[{}]/g, "").split(",").map((item) => item.trim()).filter((item) => item !== "") : [];
+	return typeof value === "string" ? value.replaceAll(/[{}]/gu, "").split(",").map((item) => item.trim()).filter((item) => item !== "") : [];
 }
 async function policiesFromDb(db, connect) {
 	const client = await connect(db);
@@ -1011,7 +1024,11 @@ async function runRlsImport(input) {
 		seeds = await seedsFromSql(sql);
 		policies = splitPolicies(await canonicalDump(sql) ?? sql);
 		if (policies.length === 0) policies = splitPolicies(sql);
-	} else if (input.db !== void 0) try {
+	} else if (input.db === void 0) return {
+		code: 2,
+		output: "PermDock CLI: rls import needs --sql <file> or a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
+	};
+	else try {
 		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db-url-stdin", input.cwd));
 		policies = fromDb.policies;
 		bodies = fromDb.bodies;
@@ -1020,10 +1037,6 @@ async function runRlsImport(input) {
 	} catch (cause) {
 		return usageResult(cause);
 	}
-	else return {
-		code: 2,
-		output: "PermDock CLI: rls import needs --sql <file> or a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
-	};
 	const memberships = parseMembershipsFlag(input.memberships) ?? input.config.rls?.memberships;
 	const roleValues = input.config.rls?.roleValues;
 	if (roleValues !== void 0) seeds = seeds.map((row) => {
@@ -1070,7 +1083,7 @@ function fieldViewHint(view) {
 	return `field view ${view.view} over ${view.table}: ${view.restricted.map((item) => item.column).join(", ")} are field-limited; set fields on the read grants that list them (fieldViews export)`;
 }
 function membershipHint(table) {
-	return [`exists over ${table} stayed opaque; if it holds memberships, map it in permdock.config.ts:`, `// rls: { memberships: { tenant: { table: '${table}', user: 'user_id', tenant: 'tenant_id', role: 'role' } } }`].join("\n");
+	return [`exists over ${table} stayed opaque; if it holds memberships, map it in permdock.config.ts:`, `// rls: { memberships: { scopes: { tenant: { table: '${table}', user: 'user_id', columns: { tenant: 'tenant_id' }, role: 'role' } } } }`].join("\n");
 }
 function uniqueHints(names, bodies) {
 	const lines = [];

package/dist/{import-DB2EG_iy.js → import-_YqhhwvX.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as applyFiles } from "./files-acUbNwWt.js";
-import { n as httpRequest } from "./http-Ca3Sr5x1.js";
-import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
-import { t as validateOpenapi } from "./schema-gIcCx7zM.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { i as readJsonFile } from "./files-BSjrtIHw.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
+import { n as httpRequest } from "./http-DOL33cO0.js";
+import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
+import { t as validateOpenapi } from "./schema-Dst9I9Gs.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js