permdock 0.10.0 → 0.13.0

package/dist/{adoption-scan-0oFt2RD5.js → adoption-scan-oks22j9J.js}

@@ -1,5 +1,5 @@
 import { r as listSourceFiles } from "./files-BSjrtIHw.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts

package/dist/{arazzo-DhxDfYt-.js → arazzo-BzVfXbhf.js}

@@ -3,7 +3,7 @@ import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as ARAZZO_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/{arazzo-DA9PCXew.js → arazzo-CBBIhC40.js}

@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-DhxDfYt-.js")).runArazzo({
+		return (await import("./arazzo-BzVfXbhf.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/better-supabase/index.d.ts

@@ -414,6 +414,14 @@ type AuthorizationProviderOptions = {
    * stays unset and doctor BS409 has nothing to compare.
    */
   readonly activeTenant?: BetterSupabaseActiveTenant;
+  /**
+   * Fill better-supabase's `rowsWith` (and `rowsWithFor` when the `_for`
+   * helpers exist) from the `rls.rowHelpers` helpers the manifest names, so a
+   * `config.records.<type>.permissions.<action>` entry with `rows` checks the
+   * rows the caller holds a permission on. Needs better-supabase 0.22 or later,
+   * whose config takes those templates.
+   */
+  readonly rowHelpers?: boolean;
 };
 /**
  * better-supabase's `authorization` config value, built from PermDock's

package/dist/better-supabase/index.js

@@ -928,6 +928,32 @@ function permittedTemplate(schema, scopes, tenantScope, catalog) {
 	const otherwise = complete === void 0 ? atTenant : complete.length === 0 ? `false and ${atTenant}` : `{permission} in (${complete.join(", ")}) and ${atTenant}`;
 	return `case ${branches.join(" ")} else ${otherwise} end`;
 }
+/**
+* better-supabase's `rowsWith` and `rowsWithFor` over the
+* `permitted_<resource>_rows` helpers: `{resource}` is the resource's SQL name,
+* `rowsWith` takes the candidate ids being checked, and `rowsWithFor` runs the
+* helper's `_for` form, which `rls generate` writes beside it for Supabase.
+*/
+function rowTemplatesOf(schema, manifest, requires, problems) {
+	const rows = Object.values(manifest.names?.resources ?? {}).flatMap((names) => names.rows === void 0 ? [] : [names.rows]);
+	if (rows.length === 0) {
+		problems.push("rowHelpers: the manifest names no permitted_<resource>_rows helper. Set rls.rowHelpers, run `permdock rls generate`, then `permdock supabase inspect --out`.");
+		return {};
+	}
+	for (const name of rows) requires.push({
+		function: `${schema}.${sqlIdent(name)}`,
+		args: "text, text[]",
+		role: "authenticated"
+	}, {
+		function: `${schema}.${sqlIdent(`${name}_for`)}`,
+		args: "uuid, text, jsonb",
+		role: "postgres"
+	});
+	return {
+		rowsWith: `${schema}.permitted_{resource}_rows({permission}, {ids})`,
+		rowsWithFor: `${schema}.permitted_{resource}_rows_for({user}, {permission})`
+	};
+}
 const RISKS = {
 	low: "low",
 	medium: "medium",
@@ -1099,6 +1125,7 @@ function authorizationProvider(options) {
 	}
 	const permitted = listed("idsWith", tenantScope) ? permittedTemplate(schema, scopeNames.filter((scope) => listed("idsWith", scope)), tenantScope, catalog) : void 0;
 	const functions = {
+		...options.rowHelpers === true ? rowTemplatesOf(schema, manifest, requires, problems) : {},
 		...optional,
 		idsWith: `${schema}.${TEMPLATES.idsWith.sql}`,
 		isPlatform: `${schema}.${TEMPLATES.isPlatform.sql}`,

package/dist/{casbin-BJu2liqU.js → casbin-BunKq48W.js}

@@ -1,4 +1,4 @@
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-DpCUAST3.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{casbin-BkhqGh2z.js → casbin-C8r5trwy.js}

@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-BJu2liqU.js");
+		const { runCasbinImport } = await import("./casbin-BunKq48W.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-BATawNVH.js"),
+		import("../run-BqW8S5TM.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.js

@@ -2,7 +2,7 @@ import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
 import { t as defineConfig } from "../config-BR23fL8m.js";
 import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-CLP_fQUF.js";
+import { t as run } from "../run-CjFdAzqE.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",

package/dist/{cloud-3RIuS4E9.js → cloud-C_Mau1q2.js}

@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-DYbyod1f.js")).runCloudPull({
+		return (await import("./pull-3OQCgxUf.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-DLcp-B6v.js → codemod-BqYPToUJ.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-DRl_w-bY.js")).codemodVersions();
+			return (await import("./codemod-CpMCbp0G.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-DRl_w-bY.js")).runCodemod({
+		return (await import("./codemod-CpMCbp0G.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{codemod-DRl_w-bY.js → codemod-CpMCbp0G.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-B4ENCp2I.js";
+import { n as ROOT } from "./manifest-Cl6yHiVK.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";

package/dist/{completion-VSWvaaPO.js → completion-Cq4fbT2S.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-B4ENCp2I.js";
+import { a as resolve } from "./manifest-Cl6yHiVK.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-kL36AxkE.js → config-0xxCmoD8.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-osnfUNg5.js");
+		const { runConfig } = await import("./config-report-C1-r59VY.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-osnfUNg5.js → config-report-C1-r59VY.js}

@@ -3,7 +3,7 @@ import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
 import "./sources-C4vkzZJV.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{doctor-DfTnMaUt.js → doctor-CDfzrMQB.js}

@@ -24,23 +24,23 @@ import { t as parseCatalog } from "./parse-1_ZheTW5.js";
 import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-LsbLe41I.js";
-import { i as runSkillsInstall } from "./skills-iwbRxavw.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-DpCUAST3.js";
+import { i as runSkillsInstall } from "./skills-5XWpNzCi.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-BT2P9wah.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-CyuD9Wau.js";
 import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DimBcVWY.js";
 import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
 import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-t_nXnwCW.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-jHrbmn-E.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DUT-UKgw.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-DBKOoyjn.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-hMYVFsN5.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-CmTiQ-yM.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-BTLk8GSl.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-PRhfO-bL.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";

package/dist/{doctor-B9FY9H0F.js → doctor-Dea6IqRw.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-DfTnMaUt.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-CDfzrMQB.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-DfTnMaUt.js")).runDoctor({
+		return (await import("./doctor-CDfzrMQB.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{import-Iuk9mx8A.js → import-PP7uH8rC.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-3PJ8wAeL.js";
+import { t as validateOpenapi } from "./schema-CeQZY6bO.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{init-DeoSvkh2.js → init-BuUt4bLJ.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-DpCUAST3.js";
 import { t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";

package/dist/{init-fNF_XmTa.js → init-n1gkKHvc.js}

@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DeoSvkh2.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BuUt4bLJ.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeoSvkh2.js");
+		const { runPreset } = await import("./init-BuUt4bLJ.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeoSvkh2.js");
+		const { runPreset } = await import("./init-BuUt4bLJ.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{login-DYazeWc9.js → login-DyQNWJok.js}

@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-CutVtcmQ.js");
+		const { runLogin } = await import("./login-YsrgkAQo.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-CutVtcmQ.js");
+		const { runLogout } = await import("./login-YsrgkAQo.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-CutVtcmQ.js");
+		const { runWhoami } = await import("./login-YsrgkAQo.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{login-CutVtcmQ.js → login-YsrgkAQo.js}

@@ -3,7 +3,7 @@ import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-DpCUAST3.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";

package/dist/{manifest-B4ENCp2I.js → manifest-Cl6yHiVK.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-fNF_XmTa.js")).init
+				load: async () => (await import("./init-n1gkKHvc.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-fNF_XmTa.js")).presetDecode
+				load: async () => (await import("./init-n1gkKHvc.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-fNF_XmTa.js")).presetUrl
+				load: async () => (await import("./init-n1gkKHvc.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-BUI8DMqy.js")).install
+					load: async () => (await import("./skills-CfkYP7GG.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-BUI8DMqy.js")).update
+					load: async () => (await import("./skills-CfkYP7GG.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-BUI8DMqy.js")).list
+					load: async () => (await import("./skills-CfkYP7GG.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-B9FY9H0F.js")).doctor
+				load: async () => (await import("./doctor-Dea6IqRw.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-VSWvaaPO.js")).completion
+				load: async () => (await import("./completion-Cq4fbT2S.js")).completion
 			})
 		]
 	},
@@ -132,7 +132,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-B1ZJOUdr.js")).usage
+				load: async () => (await import("./usage-BfzSfOpD.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-kL36AxkE.js")).config
+				load: async () => (await import("./config-0xxCmoD8.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).generate
+					load: async () => (await import("./rls-C8nxX0RV.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).importPolicies
+					load: async () => (await import("./rls-C8nxX0RV.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).verify
+					load: async () => (await import("./rls-C8nxX0RV.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).migrate
+					load: async () => (await import("./rls-C8nxX0RV.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).explain
+					load: async () => (await import("./rls-C8nxX0RV.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -205,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-BaizG0n7.js")).hookGenerate
+				load: async () => (await import("./supabase-CBEK6KEo.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-BaizG0n7.js")).inspect
+				load: async () => (await import("./supabase-CBEK6KEo.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-B_8uwz7f.js")).generate
+				load: async () => (await import("./powersync-Bm3ZjHwD.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-B_8uwz7f.js")).verify
+				load: async () => (await import("./powersync-Bm3ZjHwD.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-DFj0cirS.js")).emit
+				load: async () => (await import("./openapi-BFyBIe9J.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-DFj0cirS.js")).importDocument
+				load: async () => (await import("./openapi-BFyBIe9J.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-DA9PCXew.js")).check
+				load: async () => (await import("./arazzo-CBBIhC40.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,7 +269,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-B7xrAvRm.js")).scan
+				load: async () => (await import("./scan-COIQvTMg.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -283,7 +283,7 @@ const SECTIONS = [
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-BkhqGh2z.js")).casbinImport
+				load: async () => (await import("./casbin-C8r5trwy.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-DYazeWc9.js")).login
+				load: async () => (await import("./login-DyQNWJok.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-DYazeWc9.js")).logout
+				load: async () => (await import("./login-DyQNWJok.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-DYazeWc9.js")).whoami
+				load: async () => (await import("./login-DyQNWJok.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-3RIuS4E9.js")).push
+				load: async () => (await import("./cloud-C_Mau1q2.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-3RIuS4E9.js")).pull
+				load: async () => (await import("./cloud-C_Mau1q2.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-DLcp-B6v.js")).codemod
+			load: async () => (await import("./codemod-BqYPToUJ.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-VSWvaaPO.js")).complete
+	load: async () => (await import("./completion-Cq4fbT2S.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{openapi-DFj0cirS.js → openapi-BFyBIe9J.js}

@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-C-ADypaY.js")).runOpenapi({
+		return (await import("./openapi-D8JQtO8k.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-Iuk9mx8A.js")).runOpenapiImport({
+		return (await import("./import-PP7uH8rC.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{openapi-C-ADypaY.js → openapi-D8JQtO8k.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-3PJ8wAeL.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-CeQZY6bO.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{output-LsbLe41I.js → output-DpCUAST3.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/{powersync-DUT-UKgw.js → powersync-BTLk8GSl.js}

@@ -19,7 +19,7 @@ import { r as tableNames } from "./tables-DimBcVWY.js";
 import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-jHrbmn-E.js";
+import { m as tableFor, t as canFixture } from "./verify-CmTiQ-yM.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {

package/dist/{powersync-B_8uwz7f.js → powersync-Bm3ZjHwD.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CSzDCHRu.js");
+		const { runPowerSync } = await import("./powersync-CObULVRk.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CSzDCHRu.js");
+		const { runPowerSync } = await import("./powersync-CObULVRk.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-CObULVRk.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-BTLk8GSl.js";

package/dist/pull-3OQCgxUf.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-iVPQZsnI.js";

package/dist/{pull-DQCgvJSC.js → pull-iVPQZsnI.js}

@@ -7,7 +7,7 @@ import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-DpCUAST3.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/{rls-B57mIeVq.js → rls-BItB4vkC.js}

@@ -11,13 +11,13 @@ import "./sources-C4vkzZJV.js";
 import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-DpCUAST3.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-DQCgvJSC.js";
+import { t as fetchProjectPolicy } from "./pull-iVPQZsnI.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-BT2P9wah.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-CyuD9Wau.js";
 import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
 import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
@@ -25,8 +25,8 @@ import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
 import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-jHrbmn-E.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-DBKOoyjn.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CmTiQ-yM.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-PRhfO-bL.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -1027,11 +1027,13 @@ function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 }
 //#endregion
 //#region src/cli/rls/generate-policies.ts
+const ACTOR_GUARDS_HEADER = "-- rls.readOnlyActors with --helpers-only: restrictive policies on the write commands, which narrow the hand-written policies and grant nothing. A table that does not exist yet is skipped.";
 const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
 /**
-* A `realtime.messages` or `storage.objects` policy that applies only where the
-* table exists. The Realtime and Storage services create those tables, so a
-* local stack with the service off, and pg-delta's shadow database, have none.
+* A policy that applies only where its table exists. The Realtime and Storage
+* services create `realtime.messages` and `storage.objects`, so a local stack
+* with the service off, and pg-delta's shadow database, have none; under
+* `--helpers-only` the app's own migrations create its tables.
 */
 function guardedPolicySql(item) {
 	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
@@ -1053,6 +1055,18 @@ function withHelperTables(sql, helperTables) {
 	const tables = `${helperTables.trimEnd()}\n`;
 	return sql.trim() === "" ? tables : `${sql.trimEnd()}\n\n${tables}`;
 }
+/**
+* The read-only actor policies `--helpers-only` writes: those on a table
+* `rls.tables` names. A resource it does not name has no known table, so its
+* write commands get a warning instead.
+*/
+function helpersOnlyActorGuards(guards, tables, actorMayWrite, warnings) {
+	const named = new Set(Object.values(tableNames(tables) ?? {}).map((table) => qualifySqlTable(table)));
+	const kept = guards.filter((guard) => named.has(qualifySqlTable(guard.table)));
+	const unmapped = [...new Set(guards.filter((guard) => !named.has(qualifySqlTable(guard.table))).map((guard) => qualifySqlTable(guard.table)))].toSorted();
+	if (unmapped.length > 0) warnings.push(`rls.readOnlyActors with --helpers-only writes read-only actor policies only on tables rls.tables names; for ${unmapped.join(", ")}, name the table in rls.tables, or add \`and (select ${actorMayWrite}())\` to each hand-written insert, update and delete policy`);
+	return kept;
+}
 function databaseModeWarnings(policy, { ctx }, warnings) {
 	if (ctx.authorize !== "database") return;
 	for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
@@ -1077,12 +1091,12 @@ function generatePolicies(input, policy, options, built, warnings) {
 	const force = input.force === true || rls?.force === true;
 	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
 	const policyName = input.policyName ?? rls?.policyName;
-	const assembled = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
+	const assembled = assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
 		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
 		...policyName === void 0 ? {} : { name: policyName }
 	});
 	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
-	if (actorKinds !== void 0 && helpersOnly) warnings.push(`rls.readOnlyActors with --helpers-only writes no policies: add \`and (select ${qualified$1(ctx, ACTOR_MAY_WRITE)}())\` to each hand-written insert, update and delete policy, or a restrictive policy that calls it`);
+	const actorGuards = actorKinds === void 0 || !helpersOnly ? [] : helpersOnlyActorGuards(readOnlyActorPolicies(assembled, subjectClaimJsonSql(ctx, "act"), actorKinds), rls?.tables, qualified$1(ctx, ACTOR_MAY_WRITE), warnings);
 	const withActors = (items) => actorKinds === void 0 ? items : [...items, ...readOnlyActorPolicies(items, subjectClaimJsonSql(ctx, "act"), actorKinds)];
 	let tablePolicies;
 	try {
@@ -1104,7 +1118,8 @@ function generatePolicies(input, policy, options, built, warnings) {
 		helpersOnly,
 		force,
 		views,
-		policies: withActors(assembled)
+		policies: helpersOnly ? [] : withActors(assembled),
+		...actorGuards.length === 0 ? {} : { actorGuards: [ACTOR_GUARDS_HEADER, ...actorGuards.map(guardedPolicySql)].join("\n") }
 	};
 	if (servicePolicies.length === 0) return generated;
 	return {
@@ -1543,7 +1558,7 @@ function tableColumns(rowColumns, tables, helpersOnly, warnings) {
 function emitTarget(input, built, generated, preamble) {
 	const rls = input.config.rls;
 	const { ctx } = built;
-	const { policies, force, views, helperTables } = generated;
+	const { policies, force, views, helperTables, actorGuards } = generated;
 	const outRel = input.out ?? rls?.out ?? defaultOut(input.target);
 	const migration = input.target === "sql" ? "" : dialectRoles(migrationSql(policies, withHelperTables(preamble, helperTables), force, views), ctx.dialect);
 	const migrationRel = migration === "" ? void 0 : migrationOut(outRel);
@@ -1551,7 +1566,7 @@ function emitTarget(input, built, generated, preamble) {
 	let text;
 	switch (input.target) {
 		case "sql":
-			text = dialectRoles(withHelperTables(emitSql(policies, preamble, force, views), helperTables), ctx.dialect);
+			text = dialectRoles(withHelperTables(withHelperTables(emitSql(policies, preamble, force, views), helperTables), actorGuards), ctx.dialect);
 			break;
 		case "drizzle":
 			text = emitDrizzle(policies, compact({
@@ -1594,7 +1609,7 @@ function generateSql(input, policy, options, built, warnings) {
 	const { preamble, audit } = assembled;
 	if (generated.force) forceWarnings(built, warnings);
 	const emitted = emitTarget(input, built, generated, preamble);
-	const { policies, force, views, helperTables, guardedTables, helpersOnly } = generated;
+	const { policies, force, views, helperTables, guardedTables, helpersOnly, actorGuards } = generated;
 	const seedsSplit = splitsPart(input.split, "seeds");
 	return {
 		...generated,
@@ -1605,7 +1620,7 @@ function generateSql(input, policy, options, built, warnings) {
 			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
 			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
 			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
-			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
+			helpers: dialectRoles(withHelperTables(emitSql([], preamble, false, helpersOnly ? views : []), actorGuards), ctx.dialect),
 			seeds: `${SEEDS_MARKER} schema=${built.schema}\n${seedsBody(ctx, built.schema, generated.compiled.rolePermissions)}\n${seedsSplit ? audit : ""}`,
 			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
 		})

package/dist/{rls-j0YrFPpW.js → rls-C8nxX0RV.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-B57mIeVq.js")).runRls(input);
+	return (await import("./rls-BItB4vkC.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/run-BqW8S5TM.js

@@ -0,0 +1 @@
+export { t as run } from "./run-CjFdAzqE.js";

package/dist/{run-CLP_fQUF.js → run-CjFdAzqE.js}

@@ -5,9 +5,9 @@ import { a as resolveCwd, i as readConfig } from "./config-BR23fL8m.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-LsbLe41I.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DpCUAST3.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/{scan-B7xrAvRm.js → scan-COIQvTMg.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-0oFt2RD5.js");
+		const { runAdoptionScan } = await import("./adoption-scan-oks22j9J.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-3PJ8wAeL.js → schema-CeQZY6bO.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-DpCUAST3.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{skills-iwbRxavw.js → skills-5XWpNzCi.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-DpCUAST3.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{skills-BUI8DMqy.js → skills-CfkYP7GG.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-iwbRxavw.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-5XWpNzCi.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/supabase/index.d.ts

@@ -40,6 +40,14 @@ type SupabaseApprovalStoreOptions = {
   readonly schema?: string;
   /** Seconds a request stays open when the caller sets no `ttl`. */
   readonly ttl?: number;
+  /**
+   * Runs on every `create`, before the call that stores the request, with the
+   * request: insert the app's own row holding `request.token`, which `open:
+   * 'attach'` then attaches the request to. A repeated ask and a retried open
+   * run it again, so it must be idempotent, such as an insert that ignores a
+   * conflict on the token. A throw fails the open before anything is stored.
+   */
+  readonly beforeOpen?: (request: ApprovalRequest) => void | Promise<void>;
   /**
    * Runs once per stored request, after the call that stored it, with the
    * stored request: notify the approvers, or cancel the requests this one

package/dist/supabase/index.js

@@ -1,4 +1,4 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-B1EfuD47.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-CC6rIri4.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-C4vkzZJV.js";
 import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAxFltvO.js";

package/dist/{supabase-BaizG0n7.js → supabase-CBEK6KEo.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CbvGAutK.js");
+		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CbvGAutK.js");
+		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{supabase-B1EfuD47.js → supabase-CC6rIri4.js}

@@ -278,6 +278,7 @@ function supabaseApprovalStore(client, options = {}) {
 	return {
 		...options.ttl === void 0 ? {} : { ttl: options.ttl },
 		async create(request) {
+			await options.beforeOpen?.(request);
 			await call("permdock_approval_open", { p_request: request });
 			if (options.onOpen !== void 0) {
 				const stored = await get(request.token);

package/dist/supabase-hook-CWvEpdCh.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-CyuD9Wau.js";

package/dist/{supabase-hook-BT2P9wah.js → supabase-hook-CyuD9Wau.js}

@@ -8,7 +8,7 @@ import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-B1EfuD47.js";
+import { t as authorizeSql } from "./supabase-CC6rIri4.js";
 import "./budget-BELja5A9.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
 import { o as readMemberships } from "./postgrest-DAxFltvO.js";

package/dist/{supautils-DBKOoyjn.js → supautils-PRhfO-bL.js}

@@ -8,7 +8,7 @@ import "./budget-BELja5A9.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { x as resolveAuthorize } from "./supabase-hook-BT2P9wah.js";
+import { x as resolveAuthorize } from "./supabase-hook-CyuD9Wau.js";
 import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
 import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
 import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
@@ -16,7 +16,7 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-jHrbmn-E.js";
+import { m as tableFor } from "./verify-CmTiQ-yM.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */

package/dist/usage-BDiTP763.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-hMYVFsN5.js";

package/dist/{usage-B1ZJOUdr.js → usage-BfzSfOpD.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-weohzv2f.js")).runUsage({
+		return (await import("./usage-BDiTP763.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{usage-t_nXnwCW.js → usage-hMYVFsN5.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
-import { r as findingOf } from "./output-LsbLe41I.js";
+import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
+import { r as findingOf } from "./output-DpCUAST3.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{verify-jHrbmn-E.js → verify-CmTiQ-yM.js}

@@ -22,7 +22,7 @@ import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.
 import "./budget-BELja5A9.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.10.0",
+  "version": "0.13.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",

package/skills/permdock-approvals/references/stores-and-resume.md

@@ -28,7 +28,7 @@ app.all("/permdock/approvals/*", (c) => handler(c.req.raw));
 
 The store's `ttl` is the window a request stays open when the call sets none; `resumeDecision({ ..., ttl })` sets it per call (milliseconds). A grant's `approval.ttl` only shortens either.
 
-- `memoryApprovalStore` is per process. On serverless or with several replicas, implement `ApprovalStore` over the app's database; the Drizzle recipe on the adapter page is the template, and `cloud().approvals` from `permdock/cloud` is the hosted implementation of the same interface. On Postgres or Supabase, set `rls.approvals: true` and use `supabaseApprovalStore(admin, { onOpen })` from `permdock/supabase` over the generated table and functions; grant the functions to the server's role, and put notifications and superseding older requests in `onOpen`.
+- `memoryApprovalStore` is per process. On serverless or with several replicas, implement `ApprovalStore` over the app's database; the Drizzle recipe on the adapter page is the template, and `cloud().approvals` from `permdock/cloud` is the hosted implementation of the same interface. On Postgres or Supabase, set `rls.approvals: true` and use `supabaseApprovalStore(admin, { onOpen })` from `permdock/supabase` over the generated table and functions; grant the functions to the server's role, and put notifications and superseding older requests in `onOpen`. Over an adopted table with `open: 'attach'`, insert the app's own row holding `request.token` in `beforeOpen`, which runs before every open and must ignore a conflict on the token.
 - A custom store calls `assertApprover(request, by, requireDistinct, now, verdict.relations)` in `resolve` and computes the next record with `applyApprovalVerdict`, which records each signature's `stage`. `verdict.relations` holds `approverRelationKey` values that the handler, or `resolveApproval(store, token, verdict, { relations, permissions })`, computed with `approverRelations`; a store never derives them. `consume` must be atomic: two concurrent calls never both succeed.
 - When the app's own rules decide who approves (a manager chain, delegates, a quorum it counts), record their verdict with `vouchApproval(store, token, { status, by, rule })` from `permdock/approvals` instead of mirroring those rules in `approvers` or copying the verdict into the request by hand. It resolves the request at once and records `vouched: rule`; the actor, requester and repeat checks still apply. Never take `vouched` from a request body.
 - Run `testApprovalStore(store, { reopen, capabilities: { expire } })` from `permdock/testing` on every custom store. `reopen` opens a second client over the same backend; `expire(token)` ages one record so the suite checks that a new ask replaces it.

package/dist/powersync-CSzDCHRu.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-DUT-UKgw.js";

package/dist/pull-DYbyod1f.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-DQCgvJSC.js";

package/dist/run-BATawNVH.js

@@ -1 +0,0 @@
-export { t as run } from "./run-CLP_fQUF.js";

package/dist/supabase-hook-CbvGAutK.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-BT2P9wah.js";

package/dist/usage-weohzv2f.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-t_nXnwCW.js";