permdock 0.7.0 → 0.9.0

package/dist/{verify-pe8rL_Qw.js → verify-DlUcTDBz.js}

@@ -1,47 +1,46 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
-import { l as isConditionRef, o as hasConditionOp } from "./refs-CNJBiTFo.js";
-import { A as memoryCustomRoleSource, b as memoryRelationSource } from "./src-DLFrtrrC.js";
-import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { f as nowMillis, u as isoAt } from "./time-DkWjdL98.js";
+import { l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
+import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { f as nowMillis, u as isoAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships } from "./scopes-BHsc-wp-.js";
-import { o as requiresStandIn } from "./delegation-C5rOdTp5.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-C6P1Tvol.js";
-import { p as scopeField } from "./tenancy-CmeBQ6Nv.js";
-import { c as policyLevels } from "./policy-DaJy4nK4.js";
+import { f as scopeList, l as rootScope, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
+import { o as requiresStandIn } from "./delegation-CDB6_keF.js";
+import { p as scopeField } from "./tenancy-5d1zVBvK.js";
+import { l as policyLevels, t as coveredLevels } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-B_oqFbWC.js";
-import { t as getPermDock } from "./permdock-BfWEeMqk.js";
-import { a as describeError, i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
-import { o as loadPolicyAt } from "./load-DxroEzH1.js";
-import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-B96movIM.js";
-import { c as relationArmSql, i as scopeMembershipTable, r as scopeColumn, u as restrictedRowsSql } from "./compile-BAEO5bOk.js";
-import "./budget-NbEtbJC_.js";
-import "./sources-B-zYB4GS.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
+import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
+import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
+import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
+import "./budget-BELja5A9.js";
+import "./sources-CMAM-2A3.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-BTMW6zgU.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-fMKOv8hP.js";
-import { B as sqlFunctionNames, F as collectGrants, H as graphHelper, N as breakGlassHolder, P as breakGlassKey, R as compileConditionSql, U as graphSqlName, V as CLOSURE, W as graphSqlText, at as activeUserSql, et as permittedIdsHelper, h as accessSql, k as apiKeyAllowsCall, m as requiresSql, q as linkHelper, rt as scopeTable, tt as restrictedHelper, x as capabilityAccessSql, y as tokenScopeAllowsCall, z as contextRefs } from "./ownership-Z2LpxsGa.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
+import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-Afctg7B0.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-BqrxBCir.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-DA5YdYTm.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-B2lZIurj.js";
-import { s as viewName, t as FIELD_VIEWS } from "./fields-ClcQLrVc.js";
+import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
+import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
 import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts
 /** Postgres truncates identifiers longer than this, in bytes. */
 const MAX_IDENT = 63;
 /**
-* The row fields `condition` compares with the subject, a claim or a
-* membership (`ownerId: principal.id`, `memberOf`), through `and` and `or`:
-* the selective comparisons an index serves. A comparison with a constant
-* (`status: 'sent'`) narrows rows the scope key already found, a negation
-* scans anyway, and a dotted field is a JSON path a plain index does not serve.
+* The row fields `condition` compares with the subject, a claim or a membership
+* (`ownerId: principal.id`, `memberOf`), through `and` and `or`: the selective
+* comparisons an index serves. A comparison with a constant (`status: 'sent'`)
+* narrows rows the scope key already found, a negation scans anyway, and a
+* dotted field is a JSON path a plain index does not serve.
 */
 function indexedFields(condition) {
 	if (condition === void 0) return [];
@@ -71,9 +70,9 @@ function plainField(field) {
 	return field.includes(".") ? [] : [field];
 }
 /**
-* Every index the generated SQL reads through: the row columns policies
-* filter on (scope keys and selective condition fields), and the membership
-* tables' user column, followed by the scope column the helpers select.
+* Every index the generated SQL reads through: the row columns policies filter
+* on (scope keys and selective condition fields), and the membership tables'
+* user column, followed by the scope column the helpers select.
 */
 function indexTargets(ctx, rowColumns) {
 	const targets = /* @__PURE__ */ new Map();
@@ -106,7 +105,10 @@ function indexName(target) {
 function indexesSql(targets) {
 	return targets.map((target) => `create index if not exists ${quoteIdent(indexName(target))} on ${quoteTable(target.table)} (${target.columns.map(quoteIdent).join(", ")});`).join("\n");
 }
-/** Every live column of the tables in `$1` (`schema.table`), as `target` and `name`. */
+/**
+* Every live column of the tables in `$1` (`schema.table`), as `target` and
+* `name`.
+*/
 const COLUMNS_SQL = `select n.nspname || '.' || c.relname as target, a.attname as name
 from pg_attribute a
 join pg_class c on c.oid = a.attrelid
@@ -191,25 +193,30 @@ function levelReachOf(policy, keys) {
 		const { item } = entry;
 		const { grant } = item;
 		if (item.access.kind !== "role" || grant.effect !== "allow" || grant.permission.kind !== "instance" || grant.level !== void 0) continue;
-		const levels = policyLevels(policy, grant.permission.resource);
+		const resource = grant.permission.resource;
+		const levels = policyLevels(policy, resource);
 		if (levels.length > 0) {
 			const set = reach.get(grantKey) ?? /* @__PURE__ */ new Set();
-			for (const name of reachedLevels(grant.where, levels)) set.add(name);
+			const reached = coveredLevels(policy, resource, reachedLevels(grant.where, levels));
+			for (const name of reached) set.add(name);
 			reach.set(grantKey, set);
 		}
 	}
+	const resourceOf = new Map([...keys].map(([entry, grantKey]) => [grantKey, entry.item.grant.permission.resource]));
 	const out = [];
 	for (const grantKey of new Set(keys.values())) {
 		const at = grantKey.lastIndexOf("@");
 		const base = at === -1 ? grantKey : grantKey.slice(0, at);
 		const level = at === -1 ? void 0 : grantKey.slice(at + 1);
-		for (const name of reach.get(base) ?? []) if (level === void 0 || level === name) out.push([grantKey, name]);
+		const covered = level === void 0 ? void 0 : coveredLevels(policy, resourceOf.get(grantKey) ?? "", [level]);
+		for (const name of reach.get(base) ?? []) if (covered === void 0 || covered.includes(name)) out.push([grantKey, name]);
 	}
 	return out.toSorted(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
 }
 /**
-* The SQL command `action` compiles to: `rls.actions` first, then the six default verbs.
-* Any other verb is `undefined`, as `'none'` is: no policy, and its grants are still seeded.
+* The SQL command `action` compiles to: `rls.actions` first, then the six
+* default verbs. Any other verb is `undefined`, as `'none'` is: no policy, and
+* its grants are still seeded.
 */
 function commandFor(action, actions) {
 	if (actions !== void 0 && Object.hasOwn(actions, action)) {
@@ -218,7 +225,7 @@ function commandFor(action, actions) {
 	}
 	return defaultSqlCommand(action);
 }
-function tableFor$1(resource, tables) {
+function tableFor(resource, tables) {
 	return tables?.[resource] ?? resource;
 }
 function ancestorsOf(policy, name) {
@@ -266,8 +273,8 @@ function resourceCondition(item, policy, ctx) {
 }
 /**
 * The access a link capability has to a resource-scoped grant, over the same
-* holders as `resourceCondition`. It reads the claim, so ancestor hops need
-* no memberships table. `undefined` when no holder is on the row's chain.
+* holders as `resourceCondition`. It reads the claim, so ancestor hops need no
+* memberships table. `undefined` when no holder is on the row's chain.
 */
 function capabilityAccess(item, policy, ctx) {
 	if (item.access.kind !== "resource") return;
@@ -310,7 +317,7 @@ function prepare(item, tables, warnings, skipClosures, sql, rowActions = false)
 	}
 	const tableless = sql.tableless?.has(grant.permission.resource) === true;
 	const command = tableless ? void 0 : commandFor(grant.permission.action, sql.actions);
-	const table = tableFor$1(grant.permission.resource, tables);
+	const table = tableFor(grant.permission.resource, tables);
 	if (command === void 0) {
 		if (tableless && item.access.kind !== "role") {
 			warnings.push(`skipped ${label}/${grant.permission.key}: rls.tables.${grant.permission.resource} is false, so the resource has no table, and only role grants are seeded`);
@@ -359,9 +366,9 @@ function signature(entry, byFields) {
 /**
 * Grant keys per permission: the key is the permission, split into
 * `permission#n` when role grants carry different portable conditions (or
-* effects), one key per condition group; a group whose grants set `group`
-* is `permission#<group>` instead. With field views, grants that differ
-* only in `fields` get their own keys too, so a view can tell them apart.
+* effects), one key per condition group; a group whose grants set `group` is
+* `permission#<group>` instead. With field views, grants that differ only in
+* `fields` get their own keys too, so a view can tell them apart.
 */
 function assignKeys(entries, byFields) {
 	const groups = /* @__PURE__ */ new Map();
@@ -381,7 +388,7 @@ function assignKeys(entries, byFields) {
 			const group = groupOf(permission, list);
 			if (group !== void 0 && named.has(group)) throw configError(`PermDock CLI: grants of ${permission} with different conditions share group '${group}'; a group names one condition`);
 			if (group !== void 0) named.add(group);
-			const grantKey = group !== void 0 ? `${permission}#${group}` : lists.length === 1 ? permission : `${permission}#${index + 1}`;
+			const grantKey = group === void 0 ? lists.length === 1 ? permission : `${permission}#${index + 1}` : `${permission}#${group}`;
 			for (const entry of list) keys.set(entry, grantKey);
 		}
 	}
@@ -432,11 +439,14 @@ function noteConditions(entry, warnings) {
 	if (hasConditionOp(entry.using, "opaque") || hasConditionOp(entry.check, "opaque")) warnings.push(`opaque SQL on ${label}/${grant.permission.key} is untestable app-side`);
 }
 /**
-* Compiles every grant (role and top-level) to branches whose role check is
-* a helper call keyed by grant key. Nothing in a branch is per-row except the
+* Compiles every grant (role and top-level) to branches whose role check is a
+* helper call keyed by grant key. Nothing in a branch is per-row except the
 * portable row condition and resource-membership joins.
 */
-/** A Supabase token from a permanent user: anonymous sign-ins carry `is_anonymous: true`. */
+/**
+* A Supabase token from a permanent user: anonymous sign-ins carry
+* `is_anonymous: true`.
+*/
 const PERMANENT_USER = `((select auth.jwt()) ->> 'is_anonymous') is distinct from 'true'`;
 function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions = false) {
 	const items = collectGrants(policy);
@@ -501,7 +511,7 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 				};
 				rows.set(`${row.role}\u0000${row.grantKey}\u0000${row.scope}`, row);
 			}
-			if (!rowActions || ctx.tableless?.has(grant.permission.resource)) continue;
+			if (!rowActions || ctx.tableless?.has(grant.permission.resource) === true) continue;
 		}
 		const actionOnly = entry.command === "none";
 		const command = actionOnly ? "select" : entry.command;
@@ -589,8 +599,8 @@ function compileGrants(policy, ctx, tables, warnings, skipClosures, rowActions =
 }
 /**
 * Each row again under every key its permission was renamed from, so SQL that
-* still calls `permdock_has('<old key>')` keeps the access the current key
-* has. A split grant key (`key#n`) keeps its suffix; break-glass rows are not
+* still calls `permdock_has('<old key>')` keeps the access the current key has.
+* A split grant key (`key#n`) keeps its suffix; break-glass rows are not
 * copied.
 */
 function withAliasRows(policy, rows) {
@@ -609,8 +619,8 @@ function withAliasRows(policy, rows) {
 }
 /**
 * Postgres needs SELECT access to find rows for UPDATE / DELETE and for
-* RETURNING, so a table with only update or delete grants gets matching
-* SELECT branches.
+* RETURNING, so a table with only update or delete grants gets matching SELECT
+* branches.
 */
 function ensureSelectCoverage(branches, warnings) {
 	const extra = [];
@@ -640,18 +650,21 @@ function ensureSelectCoverage(branches, warnings) {
 const HELPER_TABLES = ["storage.objects", "realtime.messages"];
 const HELPER_CALL = new RegExp(String.raw`\b(${HELPERS.has}(?:_permission)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?)\s*\(\s*'((?:[^']|'')+)'(\s*,\s*(false\b)?)?`, "giu");
 const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}(?:_permission)?(?:_for)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?(?:_for)?|member_[a-z][a-z0-9_]*_ids(?:_for)?)\s*\(`, "iu");
-/** Whether a policy expression calls any generated helper, the key-less `member_<scope>_ids` included. */
+/**
+* Whether a policy expression calls any generated helper, the key-less
+* `member_<scope>_ids` included.
+*/
 function callsHelper(sql) {
 	return ANY_HELPER.test(sql);
 }
 /**
 * The permission keys a policy expression passes to `permdock_has`,
 * `permitted_<scope>_ids` or their permission-key forms, `#n` stripped. With
-* `blind`, only the calls that ignore row conditions: the grant-key forms,
-* and a permission-key form asked for conditioned allows. A plain
+* `blind`, only the calls that ignore row conditions: the grant-key forms, and
+* a permission-key form asked for conditioned allows. A plain
 * `permdock_has_permission(key)` or `permitted_<scope>_ids_by_permission(key)`
-* counts only allows without a row condition, so it never grants more than
-* the application does.
+* counts only allows without a row condition, so it never grants more than the
+* application does.
 */
 function helperCallKeys(sql, blind = false) {
 	const keys = /* @__PURE__ */ new Set();
@@ -671,7 +684,10 @@ function helperTable(name) {
 	const table = tableName(name);
 	return HELPER_TABLES.find((candidate) => candidate === table);
 }
-/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their condition-blind helper calls pass. */
+/**
+* `create policy` statements on {@link HELPER_TABLES} in migration SQL, with
+* the keys their condition-blind helper calls pass.
+*/
 function helperTablePolicies(sql) {
 	const text = sql.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
 	const found = [];
@@ -686,19 +702,25 @@ function helperTablePolicies(sql) {
 	}
 	return found;
 }
-/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db-url-stdin`. */
+/**
+* `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify
+* --db-url-stdin`.
+*/
 const HELPER_TABLE_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, coalesce(qual, '') || ' ' || coalesce(with_check, '') as body
 from pg_policies
 where (schemaname, tablename) in (('storage', 'objects'), ('realtime', 'messages'))`;
+function textOf(value) {
+	return typeof value === "string" ? value : "";
+}
 /** The same rows as {@link helperTablePolicies}, from `pg_policies`. */
 function helperTablePoliciesFromRows(rows) {
 	const found = [];
 	for (const row of rows) {
-		const table = helperTable(String(row["target"] ?? ""));
-		const keys = helperCallKeys(String(row["body"] ?? ""), true);
+		const table = helperTable(textOf(row["target"]));
+		const keys = helperCallKeys(textOf(row["body"]), true);
 		if (table !== void 0 && keys.length > 0) found.push({
 			table,
-			name: String(row["policyname"] ?? ""),
+			name: textOf(row["policyname"]),
 			keys
 		});
 	}
@@ -710,53 +732,6 @@ function rowConditionMessage(policy, keys) {
 }
 const ROW_CONDITION_FIX = "call permitted_<scope>_ids_by_permission('<key>') or permdock_has_permission('<key>'), which count only the allows without a row condition (a relationship grant never reaches a topic or a folder), or use a permission whose catalog entry has rowConditions: false";
 //#endregion
-//#region src/cli/sql/tables.ts
-/** The `schema.table` an `rls.tables` entry names, or `resource` when it names none or is `false`. */
-function tableNameOf(entry, resource) {
-	if (entry === void 0 || entry === false) return resource;
-	return typeof entry === "string" ? entry : entry.table ?? resource;
-}
-/** `rls.tables` as resource to table name, the `via` objects reduced to their `table` and the `false` entries left out. */
-function tableNames(tables) {
-	return tables === void 0 ? void 0 : Object.fromEntries(Object.entries(tables).filter(([, entry]) => entry !== false).map(([resource, entry]) => [resource, tableNameOf(entry, resource)]));
-}
-/** The resources `rls.tables` marks `false`: no table, so no policies. */
-function tablelessResources(tables) {
-	return new Set(Object.entries(tables ?? {}).filter(([, entry]) => entry === false).map(([resource]) => resource));
-}
-function singular(name) {
-	if (name.endsWith("ies")) return `${name.slice(0, -3)}y`;
-	if (name.endsWith("sses")) return name.slice(0, -2);
-	return name.endsWith("s") && !name.endsWith("ss") ? name.slice(0, -1) : name;
-}
-/** The `via` entries of `rls.tables`, by resource. */
-function resolveVias(tables, scopes, dialect) {
-	const out = {};
-	for (const [resource, entry] of Object.entries(tables ?? {})) {
-		if (typeof entry === "string" || entry === false) continue;
-		const { via } = entry;
-		const scope = via.scope ?? scopes[0]?.name;
-		if (scope === void 0 || !scopes.some((item) => item.name === scope)) throw configError(`PermDock CLI: rls.tables.${resource}.via.scope '${scope ?? ""}' is not a scope of the policy (${scopes.map((item) => item.name).join(", ")})`);
-		const name = singular(via.table.slice(via.table.lastIndexOf(".") + 1));
-		out[resource] = {
-			helper: permittedIdsHelper(name),
-			key: via.key ?? `${name}_id`,
-			scope,
-			table: via.table.includes(".") ? via.table : `public.${via.table}`,
-			column: via.column,
-			id: via.id ?? "id",
-			type: via.type ?? (dialect === "supabase" ? "uuid" : "text")
-		};
-	}
-	const helpers = /* @__PURE__ */ new Map();
-	for (const [resource, via] of Object.entries(out)) {
-		const seen = helpers.get(via.helper);
-		if (seen !== void 0 && (seen.table !== via.table || seen.column !== via.column || seen.id !== via.id || seen.scope !== via.scope || seen.type !== via.type)) throw configError(`PermDock CLI: rls.tables.${resource}.via names ${via.helper}, which another resource defines over a different parent; give the parents different table names`);
-		helpers.set(via.helper, via);
-	}
-	return Object.keys(out).length === 0 ? void 0 : out;
-}
-//#endregion
 //#region src/cli/rls/verify-findings.ts
 const VERIFY_DOCS = `${DOCS_BASE}/rls#verify`;
 function rlsFinding(code, table, key, message, severity = "error") {
@@ -790,7 +765,10 @@ function verifyIgnores(config, flags = []) {
 	});
 	return out;
 }
-/** Splits `findings` by `ignores`; an id listed twice counts once, with its first reason. */
+/**
+* Splits `findings` by `ignores`; an id listed twice counts once, with its
+* first reason.
+*/
 function applyIgnores(findings, ignores) {
 	const reasons = /* @__PURE__ */ new Map();
 	for (const entry of ignores) if (!reasons.has(entry.id)) reasons.set(entry.id, entry.reason);
@@ -832,8 +810,8 @@ function prefixOf(severity) {
 }
 /**
 * The `rls verify` result: exit 1 when an error finding is left after the
-* ignores. Text lines carry each finding's id; `--json` data is
-* `{ findings, ignored, stale }`; `--format github|sarif` renders `findings`.
+* ignores. Text lines carry each finding's id; `--json` data is `{ findings,
+* ignored, stale }`; `--format github|sarif` renders `findings`.
 */
 function verifyResult(input) {
 	const report = applyIgnores(input.findings, input.ignore);
@@ -870,7 +848,10 @@ function verifyResult(input) {
 function insert(table, columns) {
 	return `insert into ${quoteTable(table)} (${columns.map(([name]) => quoteIdent(name)).join(", ")}) values (${columns.map(([, value]) => quoteLiteral(value)).join(", ")}) on conflict do nothing;`;
 }
-/** The rows of a table mapped by `rls.memberships`: one per role, for a plain role column. */
+/**
+* The rows of a table mapped by `rls.memberships`: one per role, for a plain
+* role column.
+*/
 function mappedRows(config, scopes, user, membership) {
 	const { scope, id } = membership;
 	if (scope === void 0 || id === void 0) return [];
@@ -894,7 +875,10 @@ function mappedRows(config, scopes, user, membership) {
 		[roleColumn, role]
 	]));
 }
-/** The rows of a `membershipSources` source: only a source whose columns are plain, never a `through` or `map`. */
+/**
+* The rows of a `membershipSources` source: only a source whose columns are
+* plain, never a `through` or `map`.
+*/
 function sourceRows(source, scopes, user, membership) {
 	const { scope, id } = membership;
 	if (scope === void 0 || id === void 0) return [];
@@ -919,9 +903,9 @@ function sourceRows(source, scopes, user, membership) {
 }
 /**
 * The statements that put a fixture's memberships into the configured
-* membership tables and sources, so the helpers of `authorize: 'database'`
-* find them. A membership no plain table or source can hold (a `through`
-* or mapped role column, an `on` membership) is listed in a comment.
+* membership tables and sources, so the helpers of `authorize: 'database'` find
+* them. A membership no plain table or source can hold (a `through` or mapped
+* role column, an `on` membership) is listed in a comment.
 */
 function fixtureMembershipSql(config, scopes, fixture, sources) {
 	const lines = [];
@@ -934,7 +918,10 @@ function fixtureMembershipSql(config, scopes, fixture, sources) {
 }
 //#endregion
 //#region src/cli/rls/verify-pgtap.ts
-/** A custom role's scope and pinned instance, as the `custom_role_*` tables store them. */
+/**
+* A custom role's scope and pinned instance, as the `custom_role_*` tables
+* store them.
+*/
 function customRoleAt(role, scopes) {
 	return {
 		scope: customRoleScope(role, scopes),
@@ -987,7 +974,10 @@ function statementFor(fixture, action, table) {
 function rowId(row) {
 	if (isRecord(row) && "id" in row) return row["id"];
 }
-/** A fixture value as a SQL literal; untyped, so it coerces to the column like a bound parameter. */
+/**
+* A fixture value as a SQL literal; untyped, so it coerces to the column like a
+* bound parameter.
+*/
 function sqlValue(value) {
 	if (value === null || value === void 0) return "null";
 	return quoteLiteral(typeof value === "string" ? value : JSON.stringify(value));
@@ -1020,7 +1010,10 @@ function subjectOf(config, customRoles, scopes) {
 		scopes
 	};
 }
-/** The settings that bind a fixture's subject: the GUCs, or the Supabase JWT claims. */
+/**
+* The settings that bind a fixture's subject: the GUCs, or the Supabase JWT
+* claims.
+*/
 function subjectSettings(fixture, subject) {
 	const roles = fixture.subject.roles ?? [];
 	const memberships = membershipsClaim(fixture.subject.memberships ?? [], subject.customRoles, subject.scopes);
@@ -1052,7 +1045,10 @@ function subjectSettings(fixture, subject) {
 	};
 	return [["request.jwt.claims", JSON.stringify(claims)]];
 }
-/** The `custom_role_*` rows for the fixtures' custom roles; existing rows are kept. */
+/**
+* The `custom_role_*` rows for the fixtures' custom roles; existing rows are
+* kept.
+*/
 function customRoleRows(schema, customRoles, scopes) {
 	const table = (name) => `${quoteIdent(schema)}.${quoteIdent(name)}`;
 	const rows = [];
@@ -1095,8 +1091,8 @@ function customRoleSchema(config) {
 	return config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
 }
 /**
-* A pgTAP script that runs each fixture's statement under the fixture's
-* subject and asserts the outcome `can()` gave in-process.
+* A pgTAP script that runs each fixture's statement under the fixture's subject
+* and asserts the outcome `can()` gave in-process.
 */
 function emitPgtap(input) {
 	const scopes = scopeList(input.policy.scopes);
@@ -1130,350 +1126,6 @@ function emitPgtap(input) {
 	return `${lines.join("\n")}\n`;
 }
 //#endregion
-//#region src/cli/rls/graph.ts
-function tableFor(resource, tables) {
-	return tables?.[resource] ?? resource;
-}
-/** Every `related` condition the policy's grants compile to, with the resource graph they need, groups included. */
-function graphPlan(policy) {
-	const scopes = scopeList(policy.scopes);
-	const plan = /* @__PURE__ */ new Map();
-	const entryFor = (node) => {
-		const entry = plan.get(node.name) ?? {
-			node,
-			relations: /* @__PURE__ */ new Set(),
-			links: /* @__PURE__ */ new Set()
-		};
-		plan.set(node.name, entry);
-		return entry;
-	};
-	const addRelation = (node, relation) => {
-		const entry = entryFor(node);
-		if (entry.relations.has(relation)) return;
-		entry.relations.add(relation);
-		for (const name of expandRelation(node, relation)) {
-			const spec = node.relations[name];
-			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
-			for (const { resource, relation: groupRelation } of groupEntries(spec)) {
-				const target = policy.resources.get(resource);
-				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
-			}
-		}
-	};
-	const addLinks = (hops) => {
-		for (let index = 1; index < hops.length; index += 1) {
-			const from = policy.resources.get(hops[index - 1]?.resource ?? "");
-			const hop = hops[index];
-			if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
-		}
-	};
-	const addAbove = (above) => {
-		const node = above === void 0 ? void 0 : policy.resources.get(above.resource);
-		if (above === void 0 || node === void 0) return;
-		const entry = entryFor(node);
-		entry.closure = Math.max(entry.closure ?? 0, above.depth);
-		entry.restrictedAncestors = above;
-	};
-	for (const grant of policy.grants) {
-		const row = policy.resources.get(grant.permission.resource);
-		for (const item of flattenGrantee(grant.to)) {
-			if (item.kind === "inherit") {
-				const inherited = inheritCondition(item, row, policy.resources);
-				addLinks(inherited?.hops ?? []);
-				addAbove(inherited?.restrictedAncestors);
-				continue;
-			}
-			if (item.kind !== "relation") continue;
-			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
-			if (condition?.op !== "related") continue;
-			const node = policy.resources.get(condition.resource);
-			if (node === void 0) continue;
-			addRelation(node, condition.relation);
-			const entry = entryFor(node);
-			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
-			addLinks(condition.hops ?? []);
-			addAbove(condition.restrictedAncestors);
-		}
-	}
-	return plan;
-}
-/** The closure depth per walked resource, as `RlsSqlContext.graph` carries it. */
-function closureDepths(plan) {
-	const out = {};
-	for (const [name, entry] of plan) if (entry.closure !== void 0) out[name] = entry.closure;
-	return out;
-}
-/**
-* The `permitted_<resource>_ids(relation)` arm for one concrete relation:
-* ids of `resource` the subject holds it on, directly or through a group.
-* `asked` are the relation names that include it, so a call for any of them
-* (or for all, with null) reads this arm.
-*/
-function relationArm(ctx, plan, node, relation, asked, tables) {
-	const spec = node.relations[relation];
-	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw configError(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
-	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
-	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
-		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
-		...tables === void 0 ? {} : { tables },
-		qualify: qualifySqlTable,
-		holders: (resource, groupRelation) => [{ text: `select ${qualified(ctx, graphHelper(resource))}(${quoteLiteral(groupRelation)})` }]
-	}), ctx)}) a\n  where ${guard}${activeUserSql(ctx).map((part) => ` and ${part}`).join("")}`;
-}
-function permittedSql(ctx, plan, entry, tables) {
-	const fn = qualified(ctx, graphHelper(entry.node.name));
-	const asked = [...entry.relations].toSorted();
-	const arms = [...new Set(asked.flatMap((name) => expandRelation(entry.node, name)))].toSorted().map((relation) => relationArm(ctx, plan, entry.node, relation, asked.filter((name) => expandRelation(entry.node, name).includes(relation)), tables));
-	if (arms.length === 0) arms.push("  select null::text where false");
-	return `-- ${entry.node.name}: ids the subject holds a relation on (all relations when p_relation is null)
-create or replace function ${fn}(p_relation text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-${arms.join("\n  union\n")}
-$$;
-revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;`;
-}
-/** `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points into `ids`, read past the table's own policies. */
-function linkSql(ctx, node, link, tables) {
-	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
-	if (spec === void 0) throw configError(`PermDock CLI: ${node.name} has no link '${link}'`);
-	const fn = qualified(ctx, linkHelper(node.name, link));
-	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
-create or replace function ${fn}(p_ids text[])
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select t.${quoteIdent(node.id)}::text from ${quoteQualified(tableFor(node.name, tables))} t
-  where t.${quoteIdent(spec.field)}::text = any(p_ids)
-$$;
-revoke execute on function ${fn}(text[]) from public, anon;
-grant execute on function ${fn}(text[]) to authenticated;`;
-}
-function closureTableSql(ctx) {
-	const table = qualified(ctx, CLOSURE.table);
-	return `-- the object graph: one row per (ancestor, descendant) within each walked resource's depth,
--- never crossing a restricted row; kept current by statement triggers on each self-parented table
-create table if not exists ${table} (
-  resource text not null,
-  ancestor text not null,
-  descendant text not null,
-  depth integer not null check (depth >= 0),
-  primary key (resource, descendant, ancestor)
-);
-create index if not exists ${quoteIdent(`${CLOSURE.table}_ancestor`)} on ${table} (resource, ancestor);
-alter table ${table} enable row level security;
-revoke all on table ${table} from anon, authenticated, public;
-grant select on table ${table} to authenticated;`;
-}
-function closureObjectsSql(ctx, entry, depth, tables) {
-	const { node } = entry;
-	const parent = node.parent;
-	if (parent === void 0) return "";
-	const name = node.name;
-	const sqlName = graphSqlName(name) ?? name;
-	const closure = qualified(ctx, CLOSURE.table);
-	const table = quoteQualified(tableFor(name, tables));
-	const id = quoteIdent(node.id);
-	const up = quoteIdent(parent.field);
-	const restricted = restrictedFor(node, "parent");
-	const stop = restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(restricted)}, false)`;
-	const stopParent = restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(restricted)}, false)`;
-	const refresh = qualified(ctx, `${CLOSURE.table}_${sqlName}`);
-	const changed = qualified(ctx, `${CLOSURE.table}_${sqlName}_changed`);
-	const literal = quoteLiteral(name);
-	const restrictedChanged = restricted === void 0 ? "" : ` or n.${quoteIdent(restricted)} is distinct from o.${quoteIdent(restricted)}`;
-	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${sqlName}_${suffix}`);
-	return `-- ${name}: ${restricted === void 0 ? `rows reach their ancestors up to depth ${String(depth)}` : `rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row`}
-drop policy if exists ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure};
-create policy ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure}
-  for select to authenticated
-  using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
-create or replace function ${refresh}(p_ids text[])
-returns void
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  v_cycle text;
-  v_affected text[];
-begin
-  with recursive walk(start, next, path) as (
-    select t.${id}, t.${up}, array[t.${id}::text]
-    from ${table} t
-    where t.${id}::text = any(p_ids)
-    union all
-    select walk.start, t.${up}, walk.path || t.${id}::text
-    from walk join ${table} t on t.${id} = walk.next
-    where not (walk.next::text = any(walk.path))
-  )
-  select walk.start::text into v_cycle
-  from walk
-  where walk.next::text = any(walk.path)
-  limit 1;
-  if v_cycle is not null then
-    raise exception 'permdock: % % is its own ancestor', ${literal}, v_cycle
-      using errcode = 'check_violation';
-  end if;
-  with recursive down(id, level) as (
-    select t.${id}, 0
-    from ${table} t
-    where t.${id}::text = any(p_ids) or t.${up}::text = any(p_ids)
-    union
-    select t.${id}, down.level + 1
-    from down join ${table} t on t.${up} = down.id
-    where down.level < ${String(depth)}
-  )
-  select coalesce(array_agg(distinct down.id::text), '{}') into v_affected from down;
-  delete from ${closure} c
-  where c.resource = ${literal}
-    and (c.descendant = any(p_ids) or c.descendant = any(v_affected));
-  insert into ${closure} (resource, ancestor, descendant, depth)
-  with recursive walk(descendant, ancestor, parent, depth, stop) as (
-    select t.${id}::text, t.${id}, t.${up}, 0, ${stop}
-    from ${table} t
-    where t.${id}::text = any(v_affected)
-    union all
-    select walk.descendant, p.${id}, p.${up}, walk.depth + 1, ${stopParent}
-    from walk join ${table} p on p.${id} = walk.parent
-    where not walk.stop and walk.depth < ${String(depth)}
-  )
-  select ${literal}, walk.ancestor::text, walk.descendant, walk.depth from walk
-  on conflict do nothing;
-end
-$$;
-revoke execute on function ${refresh}(text[]) from public, anon, authenticated;
-create or replace function ${changed}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-begin
-  if tg_op = 'TRUNCATE' then
-    delete from ${closure} where resource = ${literal};
-  elsif tg_op = 'INSERT' then
-    perform ${refresh}(array(select n.${id}::text from new_rows n));
-  elsif tg_op = 'DELETE' then
-    perform ${refresh}(array(select o.${id}::text from old_rows o));
-  else
-    perform ${refresh}(array(
-      select n.${id}::text
-      from new_rows n left join old_rows o on o.${id} = n.${id}
-      where o.${id} is null or n.${up} is distinct from o.${up}${restrictedChanged}
-      union
-      select o.${id}::text
-      from old_rows o left join new_rows n on n.${id} = o.${id}
-      where n.${id} is null
-    ));
-  end if;
-  return null;
-end
-$$;
-revoke execute on function ${changed}() from public, anon, authenticated;
-drop trigger if exists ${trigger("insert")} on ${table};
-create trigger ${trigger("insert")} after insert on ${table}
-  referencing new table as new_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("update")} on ${table};
-create trigger ${trigger("update")} after update on ${table}
-  referencing old table as old_rows new table as new_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("delete")} on ${table};
-create trigger ${trigger("delete")} after delete on ${table}
-  referencing old table as old_rows
-  for each statement execute function ${changed}();
-drop trigger if exists ${trigger("truncate")} on ${table};
-create trigger ${trigger("truncate")} after truncate on ${table}
-  for each statement execute function ${changed}();
-select ${refresh}(array(select t.${id}::text from ${table} t));`;
-}
-function restrictedRowsHelperSql(ctx, plan, entry, tables) {
-	const above = entry.restrictedAncestors;
-	if (above === void 0) return "";
-	const fn = qualified(ctx, restrictedHelper(entry.node.name));
-	const body = graphSqlText(restrictedRowsSql(above, {
-		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
-		...tables === void 0 ? {} : { tables },
-		qualify: qualifySqlTable,
-		closure: `${helperSchema(ctx)}.${CLOSURE.table}`,
-		closureDepths: closureDepths(plan)
-	}), ctx);
-	return `-- ${entry.node.name}: rows a stopped link does not reach below: restricted, under a restricted row within ${String(above.depth - 1)} levels, or deeper
-create or replace function ${fn}()
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  ${body}
-$$;
-revoke execute on function ${fn}() from public, anon;
-grant execute on function ${fn}() to authenticated;`;
-}
-/** Group resources a resource's asked relations name, other than itself. */
-function groupTargets(entry) {
-	const out = /* @__PURE__ */ new Set();
-	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
-		const spec = entry.node.relations[name];
-		const resources = isEdgeRelation(spec) ? groupEntries(spec).map((group) => group.resource) : [];
-		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
-	}
-	return [...out].toSorted();
-}
-/** Plan entries by name, each after the group resources its helper calls (SQL function bodies are checked on create). */
-function dependencyOrder(plan) {
-	const out = [];
-	const done = /* @__PURE__ */ new Set();
-	const visit = (name) => {
-		const entry = plan.get(name);
-		if (entry === void 0 || done.has(name)) return;
-		done.add(name);
-		for (const target of groupTargets(entry)) visit(target);
-		out.push(entry);
-	};
-	for (const name of [...plan.keys()].toSorted()) visit(name);
-	return out;
-}
-/**
-* The graph preamble: `permitted_<resource>_ids` for every resource a graph
-* grant reads, and the closure table with its triggers for every
-* self-parented resource a grant walks. Empty when no grant is a graph grant.
-*/
-function graphSql(ctx, plan, tables) {
-	if (plan.size === 0) return "";
-	const sqlNames = /* @__PURE__ */ new Map();
-	for (const name of plan.keys()) {
-		const helper = graphHelper(name);
-		const sql = graphSqlName(name) ?? name;
-		if (ctx.scopes.some((scope) => scope.name === sql)) throw configError(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
-		const other = sqlNames.get(sql);
-		if (other !== void 0) throw configError(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
-		sqlNames.set(sql, name);
-	}
-	const entries = dependencyOrder(plan);
-	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 && entry.closure === void 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
-	const walked = entries.filter((entry) => entry.closure !== void 0);
-	if (walked.length > 0) {
-		chunks.push(closureTableSql(ctx));
-		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
-		for (const entry of walked) {
-			const helper = restrictedRowsHelperSql(ctx, plan, entry, tables);
-			if (helper !== "") chunks.push(helper);
-		}
-	}
-	return `${chunks.join("\n\n")}\n`;
-}
-//#endregion
 //#region src/cli/rls/verify-tree.ts
 const SYSTEM_ENTROPY = Object.freeze({
 	now: () => nowMillis(),
@@ -1489,9 +1141,9 @@ function idFactory(node, entropy) {
 	} : () => entropy.randomUUID();
 }
 /**
-* Two spines one level deeper than the walk depth, so the depth cap is
-* crossed; side branches under the first levels alternate restricted, and
-* the second spine is restricted two levels down.
+* Two spines one level deeper than the walk depth, so the depth cap is crossed;
+* side branches under the first levels alternate restricted, and the second
+* spine is restricted two levels down.
 */
 function generateTree(node, depth, entropy) {
 	const id = idFactory(node, entropy);
@@ -1612,9 +1264,9 @@ function asRequiredColumn(row) {
 	};
 }
 /**
-* Values for the required columns a generated row leaves out, such as a
-* tenant column or a name: an existing value of the referenced table for a
-* foreign key, a placeholder of the column's type otherwise.
+* Values for the required columns a generated row leaves out, such as a tenant
+* column or a name: an existing value of the referenced table for a foreign
+* key, a placeholder of the column's type otherwise.
 */
 async function requiredValues(query, table, set, entropy) {
 	const columns = (await query(REQUIRED_COLUMNS_SQL, [table])).rows.map(asRequiredColumn).filter((column) => column !== void 0 && !set.has(column.name));
@@ -1644,10 +1296,10 @@ async function seedRows(query, table, rows, given, entropy) {
 }
 /**
 * Parity between `decide` and RLS on a generated object graph: for every
-* self-parented resource a graph grant walks, a tree with restricted
-* branches and a chain past the walk depth, child rows under it, and edges
-* for a few generated principals. Everything runs in one transaction that
-* is rolled back.
+* self-parented resource a graph grant walks, a tree with restricted branches
+* and a chain past the walk depth, child rows under it, and edges for a few
+* generated principals. Everything runs in one transaction that is rolled
+* back.
 */
 async function verifyTree(input) {
 	const { policy, query } = input;
@@ -1797,7 +1449,10 @@ function fieldsMismatch(fixture, want, seen) {
 	if (typeof seen === "string") return [mismatch(`${fixture.action}: field view read failed (${seen}), pick keeps [${kept}]`)];
 	return seen.join(", ") === kept ? [] : [mismatch(`${fixture.action} ${String(rowId(fixture.row))}: field view returns [${seen.join(", ")}], pick keeps [${kept}]`)];
 }
-/** The field view's columns for the fixture's row: the view, or the table itself when no grant limits its fields. */
+/**
+* The field view's columns for the fixture's row: the view, or the table itself
+* when no grant limits its fields.
+*/
 async function viewFields(query, table, key) {
 	const view = quoteTable(viewName(table, FIELD_VIEWS.view));
 	const id = quoteIdent("id");
@@ -1809,7 +1464,10 @@ async function viewFields(query, table, key) {
 	const base = await query(`select * from ${quoteTable(table)} where ${id} = $1`, [key]);
 	return base.code ?? valuedColumns(base.rows[0]);
 }
-/** Writes the custom roles into the `database`-mode tables; the fixture transaction rolls them back. */
+/**
+* Writes the custom roles into the `database`-mode tables; the fixture
+* transaction rolls them back.
+*/
 async function seedCustomRoles(query, schema, customRoles, scopes) {
 	for (const row of customRoleRows(schema, customRoles, scopes)) {
 		const result = await query(row.sql, row.values);
@@ -1886,7 +1544,10 @@ async function verifyAgainstDatabase(input) {
 		notes
 	};
 }
-/** `--tree`: seeds a generated object graph in a rolled-back transaction and compares `can()` with RLS. */
+/**
+* `--tree`: seeds a generated object graph in a rolled-back transaction and
+* compares `can()` with RLS.
+*/
 async function verifyTreeAgainstDatabase(db, policy, config, connect, ignore) {
 	const client = await connect(db);
 	const scopes = scopeList(policy.scopes);
@@ -2034,4 +1695,4 @@ async function runRlsVerify(input) {
 	});
 }
 //#endregion
-export { INDEX_COLUMNS_SQL as C, readTableIndexFacts as D, pruneIndexTargets as E, COLUMNS_SQL as S, indexesSql as T, helperTablePolicies as _, graphSql as a, compileGrants as b, verifyResult as c, tableNames as d, tablelessResources as f, helperCallKeys as g, callsHelper as h, graphPlan as i, resolveVias as l, ROW_CONDITION_FIX as m, runRlsVerify as n, rlsFinding as o, HELPER_TABLES as p, closureDepths as r, verifyIgnores as s, canFixture as t, tableNameOf as u, rowConditionMessage as v, indexTargets as w, tableFor$1 as x, commandFor as y };
+export { indexTargets as _, verifyResult as a, readTableIndexFacts as b, callsHelper as c, rowConditionMessage as d, commandFor as f, INDEX_COLUMNS_SQL as g, COLUMNS_SQL as h, verifyIgnores as i, helperCallKeys as l, tableFor as m, runRlsVerify as n, HELPER_TABLES as o, compileGrants as p, rlsFinding as r, ROW_CONDITION_FIX as s, canFixture as t, helperTablePolicies as u, indexesSql as v, pruneIndexTargets as y };