foir-io/demesne ? reverse-engineered prompt

Build me a Go library and CLI for authorization rules that are written once in a single spec file and then compiled into Postgres Row Level Security, plus a small app side permission map for actions like publish or manage.

I want the spec to describe a tenancy shape, subjects, objects, relations, permissions, role stores, and scoped grants, then turn that into generated SQL, trusted database helper functions, JWT claims, and a Go and TypeScript capability surface. The app should be able to parse and validate the spec, emit the artifacts, introspect vocabularies and presets for a permission admin UI, and compare a spec against a live Postgres database to detect drift.

Make it feel like a real developer tool, with examples, tests, and a clean CLI for generating or checking output. If anything in the docs is unclear, look up the current Postgres RLS behavior online and make sensible choices that fail closed.