[glasstiger]

Summary

Register the new QuestDB Enterprise ACL inspection functions as table-valued functions:

• active_permissions() returns effective permissions across persisted users, groups, and service accounts, including group inheritance.
• active_grants() returns direct grants across those entities.

Both functions are added to the CURSOR section of tableValuedFunctions, in alphabetical order. This makes them available for autocomplete in table-source contexts such as SELECT * FROM active_permissions(), while keeping them out of scalar-expression suggestions.

Autocomplete regression tests cover both the positive FROM context and the negative SELECT expression context.

Dependencies

• Product implementation: questdb/questdb-enterprise#1222
• Documentation: questdb/documentation#566

Verification

• corepack yarn test: 15,105 tests passed, 1 skipped
• corepack yarn vitest run tests/autocomplete.test.ts -t "active": 2 tests passed
• corepack yarn typecheck
• corepack yarn lint

[glasstiger]

Review

No blocking issues. Ready to merge.

Verified

1. Correct category. In questdb/questdb-enterprise#1222 (merged), both functions take no arguments and both factories return isCursor() == true (ActiveGrantsFunctionFactory extends ActivePermissionsFunctionFactory). functions() reports cursor factories as CURSOR, so the CURSOR section is right. Alphabetical order holds (active_grants < active_permissions < all_permissions). Both are registered automatically by the package scan in EntCairoEngine.
2. No grammar changes needed. Parse, toSql round-trip and format all work for FROM active_permissions() and FROM active_grants(), including aliases, JOINs, CTEs and WHERE grant_option.
3. Autocomplete in the right places only. Suggested after FROM, JOIN (including ASOF and CROSS), a comma join, inside CTEs and subqueries, EXPLAIN, INSERT … SELECT and CREATE TABLE … AS (SELECT …). Not suggested in the SELECT list or WHERE.
4. The tests are meaningful.
   • The positive test (FROM act|) fails with the functions.ts change reverted.
   • The negative test (SELECT act|) passes either way, but it's a real guard: about 255 function suggestions come back at SELECT act without prefix filtering, so moving these two into the scalar, aggregate or window lists would fail it.
5. Docs examples work. Every new SQL example in questdb/documentation#566 parses, round-trips and formats idempotently, so adding them to the fixtures later won't break anything. The only exception is the syntax-notation line permissions([entityName]), which isn't SQL.
6. Local checks. yarn test (15,106 passed), yarn typecheck, yarn lint and prettier --check are clean. The branch is up to date with master.

Optional nits

• The new tests sit in "Regression scenarios (bugs that motivated this plan)". That matches the neighbouring gen| and long| tests, but these aren't really regressions. Fine as is.
• Once questdb/documentation#566 merges, consider adding SELECT * FROM active_permissions() and SELECT * FROM active_grants() to tests/fixtures/docs-queries.json, next to all_permissions().
• The PR description still lists questdb/questdb-enterprise#1222 as a dependency, but it has merged. Only the docs PR is still open, and it doesn't block this one.

Out of scope

reload_tick_calendars() (Enterprise, questdb/questdb-enterprise#883) is missing from scalarFunctions. This gap predates this PR and could be a small follow-up.