permdock 0.3.1 → 0.4.0

package/dist/{rls-DiinlRML.js → rls-BEktUaqg.js}

@@ -1,27 +1,28 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { _ as listPermissions, y as renamedKeys } from "./permissions-DVoF6dMt.js";
-import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { E as listRoles, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { h as scopeField } from "./validity-uOp8UpYn.js";
-import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { d as scopeList, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-BsblpB-z.js";
+import { o as flattenGrantee, v as listRoles } from "./grantee-CXY-0C87.js";
+import { p as scopeField } from "./tenancy-DshjqY0n.js";
+import { a as exitCodeOf, i as describeError, n as cliErrorKind, o as usageResult } from "./errors-CWfoNg9N.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { c as requirePolicy } from "./load-C3_oTHyO.js";
 import "./budget-NbEtbJC_.js";
-import { n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import "./sources-4p0-4xQm.js";
-import { i as SEEDS_MARKER, r as INDEXES_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
+import { l as sqlTextArray, n as escapeSqlIdent, r as qualifySqlTable } from "./sql-t8teWOfo.js";
+import { l as roleColumn } from "./sources-B1-b-R0t.js";
+import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-CiwAOZtO.js";
 import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-Bj3iDH2I.js";
-import { $ as sessionLiveHelperSql, G as quoteIdent$1, K as quoteLiteral, Q as scopeTypeOf, R as memberIdsHelper, T as graphSqlName, U as permittedIdsHelper, V as parseMembershipsFlag, W as qualifiedTable$1, X as scopeSources, Z as scopeTable, f as SESSION_LIVE_HELPER, o as qualified$1, q as quoteTable, r as HELPERS, rt as subjectIdSql, tt as subjectClaimJsonSql, w as graphHelper, y as checkSuspension } from "./rls-shared-Cewd_-zI.js";
-import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-CZOMlwHl.js";
-import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-CHwx0V8q.js";
-import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-DcYlZ09B.js";
-import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-ntETYCQu.js";
-import { n as runRlsVerify } from "./rls-verify-CMv9H3wV.js";
-import { t as supautilsRejections } from "./supautils-u8jXTGrt.js";
-import { basename, delimiter, join, resolve } from "node:path";
+import { c as rbacScaffold, l as resolveAuthorize, o as supabaseHookSql, p as supabaseConfig, s as parseRbacAuthorize, t as grantsLabel } from "./supabase-hook-Cva3ikXz.js";
+import { C as parseMembershipsFlag, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent$1, O as tenantTypeOf, P as quoteLiteral, _ as subjectClaimJsonSql, a as customRolesOn, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-1uhI-e-b.js";
+import { a as parseSplit, c as seedsMigration, i as isSeedsDirectory, l as writeOutputFiles, n as driftOf, o as partPath, s as pgDeltaPath, t as dataMigrationFile } from "./output-files-CgIsvdSa.js";
+import { a as splitUndiffed } from "./deciding-columns-Sq12mEA6.js";
+import { B as memberIdsHelper, C as apiKeysPlan, D as roleNames, E as collectGrants, G as scopeSources, K as scopeTable, M as graphHelper, N as graphSqlName, T as breakGlassKey, U as permittedIdsHelper, X as connectPgPool, Y as checkSuspension, a as accessSql, o as helpersSql, r as permittedByPermissionHelper, s as seedSql, t as permissionHelpersSql, v as currentKeyExpr, w as breakGlassHolder } from "./permission-keys-B26jeyUv.js";
+import { n as ownershipSql, r as assignmentSql, t as ownershipRules } from "./ownership-BgnbOJFT.js";
+import { _ as indexTargets, a as fieldViewsSql, b as readTableIndexFacts, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as COLUMNS_SQL, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, r as columnRevokeSql, u as readOnlyActorKinds, v as indexesSql, y as pruneIndexTargets } from "./fields-fwfXN01n.js";
+import { a as graphSql, c as callsHelper, i as graphPlan, l as helperCallKeys, n as runRlsVerify, o as HELPER_TABLES, r as closureDepths } from "./verify-BztUB3GX.js";
+import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
+import { basename, delimiter, join } from "node:path";
 import { spawnSync } from "node:child_process";
-//#region src/cli/rls-advisors.ts
+//#region src/cli/rls/advisors.ts
 /** The PermDock doctor check that reports the same problem in migrations. */
 const ADVISOR_CODES = {
 	function_search_path_mutable: "PD048",
@@ -127,6 +128,255 @@ function runRlsAdvisors(input) {
 	};
 }
 //#endregion
+//#region src/cli/rls/generate-context.ts
+/** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
+function writeRequirement(policy, requires) {
+	if (requires === void 0) return {};
+	const leaves = listPermissions(policy.permissions);
+	const keys = requires === "manageRoles" ? leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key) : [...requires];
+	if (keys.length === 0) return { error: requires === "manageRoles" ? "rls.customRoleWrites.requires is 'manageRoles', but no permission declares meta.manageRoles" : "rls.customRoleWrites.requires names no permission" };
+	const known = new Set(leaves.map((leaf) => leaf.key));
+	const unknown = keys.filter((key) => !known.has(key));
+	if (unknown.length > 0) return { error: `rls.customRoleWrites.requires names undeclared permissions: ${unknown.join(", ")}` };
+	return { keys: [...new Set(keys)].toSorted() };
+}
+/** Declared role names, and those a tenant admin may compose into custom roles. */
+function customRoleNames(policy, requires) {
+	const declared = [...roleNames(policy)].toSorted();
+	const assignable = declared.filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
+	const renamed = renamedKeys(policy.vocabulary.permissions);
+	const leaves = listPermissions(policy.permissions);
+	const manage = leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key);
+	return {
+		declared,
+		assignable,
+		...renamed.size === 0 ? {} : { renamed: Object.fromEntries(renamed) },
+		permissions: leaves.map((leaf) => leaf.key).toSorted(),
+		...manage.length === 0 ? {} : { manage: manage.toSorted() },
+		...requires === void 0 ? {} : { requires },
+		...policy.levels === void 0 ? {} : { levels: true }
+	};
+}
+function skippedOwnershipTriggers(triggers, scopes) {
+	if (triggers === false) return "all";
+	return Object.keys(triggers).map((key) => {
+		const name = resolveScope(scopes, key);
+		if (name === void 0) throw new Error(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
+		return name;
+	});
+}
+/** The SQL context every emitter reads, from the flags, `rls` config and the policy. */
+function buildContext(input, policy, options) {
+	const rls = input.config.rls;
+	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
+	if (input.rbac && input.dialect !== "supabase") return { refusal: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})` };
+	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
+	const authorize = resolveAuthorize(input.config, {
+		authorize: input.authorize,
+		rbac: input.rbac,
+		memberships
+	});
+	const memberSources = rls?.membershipSources ?? input.config.supabase?.hook?.memberships;
+	const sources = authorize === "database" ? memberSources : void 0;
+	const scopes = scopeList(policy.scopes);
+	const suspension = checkSuspension(rls?.suspension, scopes);
+	const hookRoles = input.config.supabase?.hook?.roles;
+	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
+	if (roles !== void 0 && input.rbac) return { refusal: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag" };
+	const requires = writeRequirement(policy, rls?.customRoleWrites?.requires);
+	if (requires.error !== void 0) return { refusal: requires.error };
+	const readers = rls?.trustedReaders;
+	if (readers !== void 0 && (!Array.isArray(readers) || !readers.every((name) => typeof name === "string" && name !== ""))) return { refusal: "rls.trustedReaders must list Postgres role names, such as ['service_role']" };
+	const ownership = ownershipRules(policy, scopes);
+	const graph = graphPlan(policy);
+	const apiKeys = apiKeysPlan(rls?.apiKeys, new Set(roleNames(policy)), Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
+	return {
+		ctx: {
+			dialect: input.dialect,
+			scopes,
+			tenantClaim: rls?.tenantClaim ?? "tenant_id",
+			...rls?.tenants === "all" ? { tenants: "all" } : {},
+			gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
+			...rls?.actions === void 0 ? {} : { actions: rls.actions },
+			inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
+			schema,
+			authorize,
+			roleClaim: rls?.roleClaim ?? "user_role",
+			tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
+			...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+			...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
+			...memberships === void 0 ? {} : { memberships },
+			...sources === void 0 || sources.length === 0 ? {} : { sources },
+			...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
+			...suspension === void 0 ? {} : { suspension },
+			...roles === void 0 ? {} : { roles },
+			...input.customRoles === true || customRolesOn(rls) ? { customRoles: {
+				...customRoleNames(policy, requires.keys),
+				...rls?.customRoleWrites?.roles === void 0 ? {} : { table: rls.customRoleWrites.roles }
+			} } : {},
+			...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
+			...apiKeys === void 0 ? {} : { apiKeys },
+			...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
+			...ownership === void 0 ? {} : { ownership },
+			...rls?.ownershipTriggers === void 0 ? {} : { skipOwnershipTriggers: skippedOwnershipTriggers(rls.ownershipTriggers, scopes) },
+			...rls?.assignments === void 0 ? {} : { assignments: rls.assignments === true ? { tables: [] } : {
+				tables: rls.assignments.tables ?? [],
+				...rls.assignments.ownRole === void 0 ? {} : { ownRole: rls.assignments.ownRole }
+			} },
+			...options.fieldsMode === void 0 ? {} : { fields: options.fieldsMode },
+			...graph.size === 0 ? {} : { graph: {
+				closures: closureDepths(graph),
+				resources: policy.resources,
+				...rls?.tables === void 0 ? {} : { tables: rls.tables }
+			} }
+		},
+		graph,
+		ownership,
+		schema,
+		authorize
+	};
+}
+//#endregion
+//#region src/cli/rls/generate-options.ts
+function isRefusal(value) {
+	return "refusal" in value;
+}
+/** The checks that need no policy: `--fields` and `--revoke-columns`. */
+function generateOptions(input) {
+	const rls = input.config.rls;
+	const fieldsMode = input.fields ?? rls?.fields;
+	if (fieldsMode !== void 0 && fieldsMode !== "views") return { refusal: `rls generate --fields must be views (got ${fieldsMode})` };
+	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
+	if (revokeColumns && fieldsMode === void 0) return { refusal: "rls generate --revoke-columns needs --fields views" };
+	return {
+		fieldsMode,
+		revokeColumns
+	};
+}
+/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
+function splitsPart(raw, part) {
+	const split = parseSplit(raw);
+	return typeof split !== "string" && split?.includes(part) === true;
+}
+//#endregion
+//#region src/cli/rls/generate-output.ts
+function moveUndiffed(sql, label, part) {
+	const { kept, moved } = splitUndiffed(sql);
+	const [first = "", ...rest] = kept.split("\n");
+	return {
+		sql: [
+			first,
+			`-- what supabase db diff drops from this part is in ${label}`,
+			...rest
+		].join("\n"),
+		grants: `-- the privileges and view options supabase db diff drops from the ${part} part\n${moved.join("\n")}`
+	};
+}
+/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants. */
+function outputFiles(plan) {
+	const { input } = plan;
+	const split = parseSplit(input.split);
+	if (typeof split === "string") return split;
+	if (split?.includes("policies") === true && plan.helpersOnly) return "rls generate --helpers-only writes no policies part; drop it from --split";
+	if (split === void 0) {
+		if (input.grantsOut !== void 0) return "rls generate --grants-out needs --split with the helpers or hook part";
+		if (input.seedsOut !== void 0) return "rls generate --seeds-out needs --split with the seeds part";
+		return [{
+			part: "rls",
+			rel: plan.outRel,
+			text: plan.text
+		}];
+	}
+	if (input.target !== "sql") return "rls generate --split needs --target sql";
+	const pgDelta = input.out === void 0 && input.config.rls?.out === void 0 ? supabaseConfig(input.cwd).pgDelta : void 0;
+	if (pgDelta === void 0 && !plan.outRel.includes("{part}")) return `rls generate --split needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
+	if (pgDelta !== void 0 && split.includes("helpers") && !split.includes("seeds")) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
+	if (pgDelta !== void 0 && split.includes("seeds") && input.seedsOut === void 0) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
+	const at = (part, schema = plan.schema) => pgDelta === void 0 ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
+	if (input.grantsOut !== void 0 && !split.includes("hook") && !split.includes("helpers")) return "rls generate --grants-out needs the helpers or hook part in --split";
+	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
+	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
+	const sql = plan.sql();
+	const relocated = pgDelta === void 0 ? void 0 : sql.servicePolicies;
+	if (relocated !== void 0 && split.includes("policies") && !split.includes("seeds")) return "rls generate --split policies under pg-delta with rls.realtime or rls.storage needs the seeds part with --seeds-out: the shadow database has no realtime.messages or storage.objects, so their policies go in that migration";
+	const seeds = relocated === void 0 || !split.includes("policies") ? sql.seeds : `${sql.seeds}\n${relocated}`;
+	const files = [];
+	const label = grantsLabel(input.grantsOut);
+	let grantsMarker = `${GRANTS_MARKER} schema=${plan.schema}`;
+	const grants = [];
+	for (const part of split) switch (part) {
+		case "helpers": {
+			if (label === void 0) {
+				files.push({
+					part,
+					rel: at(part),
+					text: sql.helpers
+				});
+				break;
+			}
+			const moved = moveUndiffed(sql.helpers, label, part);
+			files.push({
+				part,
+				rel: at(part),
+				text: moved.sql
+			});
+			grants.push(moved.grants);
+			break;
+		}
+		case "seeds": {
+			const out = input.seedsOut;
+			if (out !== void 0 && isSeedsDirectory(input.cwd, out)) {
+				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? /* @__PURE__ */ new Date());
+				if (!planned.current || input.check) files.push({
+					part,
+					rel: planned.rel,
+					text: seeds
+				});
+				break;
+			}
+			files.push({
+				part,
+				rel: out ?? at(part),
+				text: seeds
+			});
+			break;
+		}
+		case "indexes":
+			files.push({
+				part,
+				rel: at(part),
+				text: sql.indexes
+			});
+			break;
+		case "policies":
+			files.push({
+				part,
+				rel: at(part),
+				text: pgDelta === void 0 ? sql.policies : sql.declarativePolicies
+			});
+			break;
+		case "hook": {
+			const hook = supabaseHookSql(plan.scopes, input.config, {}, label);
+			files.push({
+				part,
+				rel: at(part, hook.manifest.hook.schema),
+				text: hook.sql
+			});
+			const [marker = grantsMarker, ...rest] = hook.grants.split("\n");
+			grantsMarker = marker;
+			grants.push(rest.join("\n").trimEnd());
+			break;
+		}
+		default: return part;
+	}
+	if (input.grantsOut !== void 0) files.push({
+		part: "grants",
+		rel: input.grantsOut,
+		text: `${[grantsMarker, ...grants].join("\n")}\n`
+	});
+	return files;
+}
+//#endregion
 //#region src/cli/approval-schema.ts
 /** An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no `format`. */
 const INSTANT = String.raw`^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$`;
@@ -249,7 +499,7 @@ const APPROVAL_REQUEST_SCHEMA = {
 	}
 };
 //#endregion
-//#region src/cli/rls-approvals.ts
+//#region src/cli/rls/approvals.ts
 /** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
 const APPROVAL_STORE = {
 	table: "approval_requests",
@@ -315,8 +565,8 @@ $permdock$;\n`;
 * resolved by the server, which grants its own role.
 */
 function approvalStoreSql(ctx, jsonSchema = false) {
-	const table = qualified$1(ctx, APPROVAL_STORE.table);
-	const fn = (name) => qualified$1(ctx, name);
+	const table = qualified(ctx, APPROVAL_STORE.table);
+	const fn = (name) => qualified(ctx, name);
 	const index = (name) => `"${APPROVAL_STORE.table}_${name}"`;
 	return `-- approval store: ApprovalRequest bodies, opened, resolved and consumed through the functions below; supabaseApprovalStore calls them
 create table if not exists ${table} (
@@ -514,7 +764,7 @@ function mirrorSet(table, mirror, body) {
 * grants and policies stay the app's.
 */
 function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
-	const table = quoteTable(qualifiedTable$1(adopt.table));
+	const table = quoteQualified(adopt.table);
 	const base = adopt.table.split(".").at(-1) ?? adopt.table;
 	const token = quoteIdent$1(adopt.token ?? "token");
 	const body = quoteIdent$1(adopt.body ?? "body");
@@ -524,7 +774,7 @@ function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
 	if (open !== "insert" && open !== "attach") throw new Error(`PermDock CLI: rls.approvals.open must be 'insert' or 'attach', got '${String(open)}'`);
 	const schema = adopt.schema;
 	if (schema !== void 0 && (typeof schema !== "string" || schema === "")) throw new Error("PermDock CLI: rls.approvals.schema must be a schema name");
-	const fn = (name) => schema === void 0 ? qualified$1(ctx, name) : `${quoteIdent$1(schema)}.${name}`;
+	const fn = (name) => schema === void 0 ? qualified(ctx, name) : `${quoteIdent$1(schema)}.${name}`;
 	const index = (name) => quoteIdent$1(`${base}_permdock_${name}`);
 	const status = `a.${body} ->> 'status'`;
 	const expires = `(a.${body} ->> 'expiresAt')::timestamptz`;
@@ -695,10 +945,200 @@ ${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
 `;
 }
 //#endregion
-//#region src/cli/rls-break-glass.ts
+//#region src/cli/rls/backfill.ts
+const PREFIX$1 = "PermDock CLI";
+/** A column of the roles-table row `r`. */
+function col(name) {
+	return `r.${quoteIdent$1(name)}`;
+}
+function schemaOf(table) {
+	return table.includes(".") ? table.split(".")[0] ?? "public" : "public";
+}
+/** The roles-table column a reference joins on, after checking it points at `roles`. */
+function roleRef(role, table, roles, label) {
+	const pairs = Object.entries(role.on);
+	const [pair] = pairs;
+	if (pair === void 0 || pairs.length !== 1) throw new Error(`${PREFIX$1}: ${label}.on must map exactly one column of ${table} to ${role.through}, for example { role_id: 'id' }`);
+	const through = role.through.includes(".") ? role.through : `${schemaOf(table)}.${role.through}`;
+	if (qualifySqlTable(through) !== qualifySqlTable(roles.table)) throw new Error(`${PREFIX$1}: ${label}.through must be rls.customRoleWrites.roles.table (${roles.table}), got ${role.through}`);
+	if (role.column !== roles.key) throw new Error(`${PREFIX$1}: ${label}.column must be rls.customRoleWrites.roles.key (${roles.key}), got ${role.column}`);
+	const [ref, id] = pair;
+	return {
+		ref,
+		id
+	};
+}
+/**
+* A legacy key as SQL the way `mapKey` maps it: `rls.migrate.keys`, then
+* `renamed`, then the longest `rls.migrate.prefixes` match, and a former key
+* read as its current key.
+*/
+function legacyKeySql(expr, migrate, renamed) {
+	const exact = new Map(Object.entries(renamed));
+	for (const [from, to] of Object.entries(migrate?.keys ?? {})) exact.set(from, to);
+	const prefixes = Object.entries(migrate?.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length || (a < b ? -1 : a > b ? 1 : 0));
+	const prefixed = prefixes.length === 0 ? expr : `(case ${prefixes.map(([from, to]) => `when left(${expr}, ${String(from.length)}) = ${quoteLiteral(from)} then ${quoteLiteral(to)} || substr(${expr}, ${String(from.length + 1)})`).join(" ")} else ${expr} end)`;
+	const mapped = exact.size === 0 ? prefixed : `(case ${expr} ${[...exact.entries()].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else ${prefixed} end)`;
+	const renames = Object.entries(renamed).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	return currentKeyExpr(renames, mapped);
+}
+function sourceSql(source, table, label) {
+	return roleColumn(source, table, "x", {
+		label,
+		prefix: PREFIX$1
+	}).lookup;
+}
+/**
+* The `--backfill-out` migration: every custom role in the application's
+* roles table that has no rows in `custom_role_permissions` or
+* `custom_role_includes` yet is saved through
+* `permdock_trusted_replace_custom_role_grants`, with the entries PermDock
+* cannot hold left out and listed in one warning. Running it again copies
+* nothing, so a role edited after the copy keeps its edits.
+*/
+function backfillSql(ctx, from, migrate) {
+	const custom = ctx.customRoles;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || root === void 0) throw new Error(`${PREFIX$1}: rls.customRoles.from needs custom roles on`);
+	if (ctx.authorize !== "database") throw new Error(`${PREFIX$1}: rls.customRoles.from needs database mode; in jwt mode custom roles ride the token, so build the grants claim with customRoleClaim`);
+	const roles = custom.table;
+	if (roles === void 0) throw new Error(`${PREFIX$1}: rls.customRoles.from needs rls.customRoleWrites.roles, the roles table each row belongs to`);
+	const leveled = custom.levels === true;
+	if (from.permissions.level !== void 0 && !leveled) throw new Error(`${PREFIX$1}: rls.customRoles.from.permissions.level is set, but no resource declares levels`);
+	const tenantType = tenantTypeOf(ctx);
+	const rolesTable = quoteQualified(roles.table);
+	const tenant = roles.tenant === void 0 ? `null::${tenantType}` : `${col(roles.tenant)}::${tenantType}`;
+	const scope = roles.scope === void 0 ? `case when ${tenant} is null then 'global' else ${quoteLiteral(root)} end` : `case when ${tenant} is null then 'global' else ${col(roles.scope)}::text end`;
+	const scopeId = roles.id === void 0 ? "null::text" : `${col(roles.id)}::text`;
+	const skipped = roles.skip === void 0 ? "false" : `coalesce(${col(roles.skip)}, false)`;
+	const renamed = custom.renamed ?? {};
+	const renames = Object.entries(renamed).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const current = (expr) => currentKeyExpr(renames, expr);
+	const known = sqlTextArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
+	const declared = sqlTextArray(custom.declared);
+	const scopes = sqlTextArray(ctx.scopes.map((item) => item.name));
+	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
+	const rp = qualified(ctx, "role_permissions");
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const replace = qualified(ctx, CUSTOM_ROLES.trustedReplace);
+	const p = from.permissions;
+	const pTable = qualifySqlTable(p.table);
+	const pRef = roleRef(p.role, p.table, roles, "rls.customRoles.from.permissions.role");
+	const legacy = sourceSql(p.permission, pTable, "rls.customRoles.from.permissions.permission");
+	const effect = p.effect === void 0 ? "'allow'" : `coalesce(lower(x.${quoteIdent$1(p.effect)}::text), 'allow')`;
+	const level = p.level === void 0 ? "null::text" : `nullif(x.${quoteIdent$1(p.level)}::text, '')`;
+	const inCeiling = (key) => `exists (select 1 from ${ceiling} c where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = ${key})`;
+	const levelCheck = leveled ? `
+          when m.effect = 'allow' and m.level is not null and not exists (
+            select 1 from ${ceiling} c
+            where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = m.key
+              and split_part(c.grant_key, '@', 2) = m.level
+          ) then 'level ' || m.level || ' is not declared'` : "";
+	const allowEntry = leveled ? "j.key || coalesce('@' || j.level, '')" : "j.key";
+	const i = from.includes;
+	const iTable = i === void 0 ? void 0 : qualifySqlTable(i.table);
+	const iRef = i === void 0 || iTable === void 0 ? void 0 : roleRef(i.role, i.table, roles, "rls.customRoles.from.includes.role");
+	const included = i === void 0 || iTable === void 0 ? void 0 : sourceSql(i.include, iTable, "rls.customRoles.from.includes.include");
+	const refs = [`${col(pRef.id)} as permissions_ref`, ...iRef === void 0 ? [] : [`${col(iRef.id)} as includes_ref`]].join(", ");
+	const includeBlock = i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 ? "    v_include := null;" : `    with raw as (
+      select ${included} as role
+      from ${quoteTable(iTable)} x
+      where x.${quoteIdent$1(iRef.ref)} = v.includes_ref
+    ),
+    judged as (
+      select n.role, case
+          when n.role is null or not (n.role = any(${declared})) then 'not a declared role'
+          when exists (
+            select 1 from ${rp} rp
+            where rp.role = n.role and rp.effect = 'allow'
+              and not ${inCeiling(current("rp.permission"))}
+          ) then 'allows permissions outside the ceiling of ' || v.scope
+        end as dropped
+      from raw n
+    )
+    select array_agg(distinct j.role) filter (where j.dropped is null),
+      array_agg(v.role || ': includes ' || coalesce(j.role, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
+    into v_include, v_lost
+    from judged j;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
+	return `${BACKFILL_MARKER} schema=${ctx.schema ?? "permdock"}
+-- custom roles copied from ${qualifySqlTable(roles.table)} (rls.customRoles.from) through ${replace}
+-- a role that already has rows is left as it is; entries PermDock cannot hold are dropped and listed in one warning
+do $permdock$
+declare
+  v record;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_lost text[];
+  v_dropped text[] := '{}'::text[];
+  v_copied integer := 0;
+  v_present integer := 0;
+begin
+  for v in
+    select ${tenant} as tenant_id, ${scope} as scope, ${scopeId} as scope_id, ${col(roles.key)}::text as role, ${refs}
+    from ${rolesTable} r
+    where not ${skipped} and not (${col(roles.key)}::text = any(${declared}))
+    order by 4, 2, 1, 3
+  loop
+    if v.role is null or not (v.scope = 'global' or v.scope = any(${scopes})) then
+      v_dropped := v_dropped || (coalesce(v.role, 'null') || ': scope ' || coalesce(v.scope, 'null') || ' is not declared');
+      continue;
+    end if;
+    if exists (
+      select 1 from ${perms} c
+      where c.tenant_id is not distinct from v.tenant_id and c.scope = v.scope and c.scope_id is not distinct from v.scope_id and c.role = v.role
+    ) or exists (
+      select 1 from ${includes} c
+      where c.tenant_id is not distinct from v.tenant_id and c.scope = v.scope and c.scope_id is not distinct from v.scope_id and c.role = v.role
+    ) then
+      v_present := v_present + 1;
+      continue;
+    end if;
+    with raw as (
+      select ${legacy} as legacy, ${effect} as effect, ${level} as level
+      from ${quoteTable(pTable)} x
+      where x.${quoteIdent$1(pRef.ref)} = v.permissions_ref
+    ),
+    mapped as (
+      select n.legacy, ${legacyKeySql("n.legacy", migrate, renamed)} as key, n.effect, n.level
+      from raw n
+    ),
+    judged as (
+      select m.*, case
+          when m.effect not in ('allow', 'deny') then 'effect ' || m.effect || ' is not allow or deny'
+          when m.key is null or not (m.key = any(${known})) then 'not a declared permission'
+          when m.effect = 'allow' and not ${inCeiling("m.key")} then 'outside the ceiling of ' || v.scope${levelCheck}
+        end as dropped
+      from mapped m
+    )
+    select array_agg(distinct ${allowEntry}) filter (where j.dropped is null and j.effect = 'allow'),
+      array_agg(distinct j.key) filter (where j.dropped is null and j.effect = 'deny'),
+      array_agg(v.role || ': ' || coalesce(j.legacy, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
+    into v_allow, v_deny, v_lost
+    from judged j;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);
+${includeBlock}
+    if v_allow is null and v_deny is null and v_include is null then
+      continue;
+    end if;
+    perform ${replace}(v.tenant_id, v.scope, v.scope_id, v.role, v_allow, v_deny, v_include);
+    v_copied := v_copied + 1;
+  end loop;
+  raise notice 'permdock backfill: copied % custom role(s), % already present', v_copied, v_present;
+  if cardinality(v_dropped) > 0 then
+    raise warning 'permdock backfill: dropped % entr(ies) PermDock cannot hold: %', cardinality(v_dropped), array_to_string(v_dropped[1:50], '; ');
+  end if;
+end
+$permdock$;
+`;
+}
+//#endregion
+//#region src/cli/rls/break-glass.ts
 /** The audit table every generated break-glass read writes to. Part of the SQL contract. */
 const BREAK_GLASS_AUDIT = "permdock_break_glass_audit";
-const IDENT = /^[a-z][a-z0-9_]*$/u;
+const IDENT$1 = /^[a-z][a-z0-9_]*$/u;
 /**
 * The resources a `breakGlass` grant targets, with the table each reads. A
 * break-glass grant is non-portable, so `compileGrants` never turns it into a
@@ -747,22 +1187,19 @@ function rowsFilter(ctx, entry) {
 		const asked = `p_permission = ${quoteLiteral(grant.permission)}`;
 		if (grant.scope === "anyone") {
 			if (grant.root === void 0) return [`(${asked})`];
-			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified$1(ctx, memberIdsHelper(grant.root))}()))`];
+			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified(ctx, memberIdsHelper(grant.root))}()))`];
 		}
 		if (grant.scope !== "global" && grant.column === void 0) return [];
 		return [`(${asked} and ${accessSql(ctx, grant.scope, breakGlassKey(grant.permission), grant.column)})`];
 	});
 	return arms.length === 0 ? "false" : [...new Set(arms)].join("\n    or ");
 }
-function functionName(resource) {
-	if (!IDENT.test(resource)) throw new Error(`PermDock CLI: unsafe break-glass resource '${resource}'`);
+function functionName$1(resource) {
+	if (!IDENT$1.test(resource)) throw new Error(`PermDock CLI: unsafe break-glass resource '${resource}'`);
 	return `permdock_break_glass_${resource}`;
 }
-function qualifiedTable(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
-}
-function auditSql(ctx) {
-	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+function auditSql$1(ctx) {
+	const audit = qualified(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
 	return `-- break-glass audit: one row per session that read restricted data
 -- RLS never compiles a break-glass override, so restricted rows stay denied to a direct read
 create table if not exists ${audit} (
@@ -777,9 +1214,9 @@ alter table ${audit} enable row level security;
 revoke all on table ${audit} from anon, authenticated, public;`;
 }
 function readFunctionSql(ctx, entry) {
-	const fn = qualified$1(ctx, functionName(entry.resource));
-	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
-	const table = qualifiedTable(entry.table);
+	const fn = qualified(ctx, functionName$1(entry.resource));
+	const audit = qualified(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+	const table = quoteQualified(entry.table);
 	const session = subjectClaimJsonSql(ctx, "break_glass");
 	const subject = subjectIdSql(ctx);
 	return `-- ${entry.resource}: reads restricted rows through a checked, audited break-glass session
@@ -827,10 +1264,10 @@ grant execute on function ${fn}(text) to authenticated;`;
 */
 function breakGlassSql(ctx, entries) {
 	if (entries.length === 0) return "";
-	return [auditSql(ctx), ...entries.map((entry) => readFunctionSql(ctx, entry))].join("\n\n");
+	return [auditSql$1(ctx), ...entries.map((entry) => readFunctionSql(ctx, entry))].join("\n\n");
 }
 //#endregion
-//#region src/cli/rls-emit.ts
+//#region src/cli/rls/emit.ts
 const HEADER = "-- generated by permdock rls generate\n-- fail-closed: never target a bypass role\n";
 const TRUSTED_READER_GRANT = /^grant execute on function [^\n]+\.permdock_trusted_role_permissions\([^)\n]*\) to [^\n;]+;$/gmu;
 function assertNoServiceRole(text) {
@@ -855,7 +1292,7 @@ function tablesOf(policies) {
 /** Enable (and force) row level security, then the table grants for the commands a policy allows. */
 function tableSql(table, policies, force, views) {
 	const closed = views.find((view) => view.table === table && view.companion !== void 0);
-	const target = quoteTable(qualifiedTable$1(table));
+	const target = quoteQualified(table);
 	const lines = [`alter table ${target} enable row level security;`];
 	if (force) lines.push(`alter table ${target} force row level security;`);
 	lines.push(`revoke all on table ${target} from anon, authenticated;`);
@@ -875,7 +1312,7 @@ function tableSql(table, policies, force, views) {
 }
 /** `drop policy if exists` and `create policy` for one policy, without the table's grants. */
 function policySql(item) {
-	const target = quoteTable(qualifiedTable$1(item.table));
+	const target = quoteQualified(item.table);
 	const lines = [
 		`drop policy if exists ${quoteIdent$1(item.name)} on ${target};`,
 		`create policy ${quoteIdent$1(item.name)}`,
@@ -1018,7 +1455,7 @@ function defaultOut(target) {
 	}
 }
 //#endregion
-//#region src/cli/rls-realtime-storage.ts
+//#region src/cli/rls/realtime-storage.ts
 const SCOPE_SEGMENT = /^\{([a-z][a-z0-9_]*)\}$/u;
 const LITERAL_SEGMENT = /^[^{}:\s]+$/u;
 const TOPIC = "(select realtime.topic())";
@@ -1044,7 +1481,7 @@ function declaredScope(facts, scope, where) {
 * relationship or a `where` on the same permission never widens it.
 */
 function permitted(ctx, value, scope, key) {
-	return `${value} in (select x::text from ${qualified$1(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
+	return `${value} in (select x::text from ${qualified(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
 }
 function escapeRegex(text) {
 	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
@@ -1161,7 +1598,7 @@ function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 	return policies;
 }
 //#endregion
-//#region src/cli/rls-rows.ts
+//#region src/cli/rls/rows.ts
 /** `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject may act on with one permission. */
 function rowsHelper(resource) {
 	const name = graphSqlName(resource);
@@ -1243,7 +1680,7 @@ function inheritTargets(policy) {
 	return [...out].toSorted();
 }
 function stubSql(ctx, resource) {
-	return `create or replace function ${qualified$1(ctx, rowsHelper(resource))}(p_permission text)
+	return `create or replace function ${qualified(ctx, rowsHelper(resource))}(p_permission text)
 returns setof text
 language sql
 stable
@@ -1254,7 +1691,7 @@ as $$
 $$;`;
 }
 function rowSql(ctx, rows, table, where) {
-	const fn = qualified$1(ctx, rows.replace(/_rows$/u, "_row"));
+	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
 	return `create or replace function ${fn}(p_row ${table}, p_permission text)
 returns boolean
 language sql
@@ -1269,8 +1706,8 @@ grant execute on function ${fn}(${table}, text) to authenticated;`;
 }
 function resourceSql(ctx, node, branches, tables) {
 	const name = rowsHelper(node.name);
-	const fn = qualified$1(ctx, name);
-	const table = quoteTable(qualifiedTable$1(tableFor(node.name, tables)));
+	const fn = qualified(ctx, name);
+	const table = quoteQualified(tableFor(node.name, tables));
 	const cases = [...branches.keys()].toSorted().flatMap((key) => {
 		const sql = permissionCase(key, branches.get(key) ?? []);
 		return sql === void 0 ? [] : [sql];
@@ -1293,7 +1730,7 @@ ${rowSql(ctx, name, table, where)}`;
 	if (ctx.dialect === "neon") return rows;
 	return `${rows}
 -- the same rows for a user the caller names, with claims it supplies; no client role may execute it
-${forUserSql(ctx, qualified$1(ctx, `${name}_for`), fn)}`;
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
 }
 /**
 * `permitted_<resource>_rows(p_permission)` for each resource `select`
@@ -1320,43 +1757,125 @@ function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
 	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
 }
 //#endregion
-//#region src/cli/rls-shims.ts
-const NAME = /^[a-z_][a-z0-9_]*$/u;
+//#region src/cli/rls/generate-policies.ts
+const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
 /**
-* The key a legacy caller passes, mapped the way `rls migrate` maps it:
-* `keys` and `renamed` exactly, then the longest `prefixes` entry.
+* A `realtime.messages` or `storage.objects` policy that applies only where
+* the table exists. The Realtime and Storage services create those tables, so
+* a local stack with the service off, and pg-delta's shadow database, have
+* none.
 */
-function mappedKey(config, renamed) {
-	const exact = {
-		...renamed,
-		...config.keys
-	};
-	const prefixes = Object.entries(config.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length);
-	const fallback = prefixes.length === 0 ? "p_key" : `case ${prefixes.map(([from, to]) => `when pg_catalog.starts_with(p_key, ${quoteLiteral(from)}) then ${quoteLiteral(to)} || pg_catalog.substr(p_key, ${String(from.length + 1)})`).join(" ")} else p_key end`;
-	if (Object.keys(exact).length === 0) return fallback;
-	return `coalesce(${quoteLiteral(JSON.stringify(exact))}::jsonb ->> p_key, ${fallback})`;
+function guardedPolicySql(item) {
+	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
+	return `do $permdock$
+begin
+  if to_regclass(${quoteLiteral(qualifySqlTable(item.table))}) is not null then
+${body}
+  end if;
+end
+$permdock$;
+`;
 }
-function scopeOf(ctx, scope) {
-	if (!ctx.scopes.some((item) => item.name === scope)) throw new Error(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
-	return scope;
+/** Appends the `realtime.messages` and `storage.objects` policies, which never get `tableSql`. */
+function withHelperTables(sql, helperTables) {
+	if (helperTables === void 0) return sql;
+	const tables = `${helperTables.trimEnd()}\n`;
+	return sql.trim() === "" ? tables : `${sql.trimEnd()}\n\n${tables}`;
 }
-function addKey(list, key) {
-	if (!list.includes(key)) list.push(key);
+function databaseModeWarnings(policy, { ctx }, warnings) {
+	if (ctx.authorize !== "database") return;
+	for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
 }
-/**
-* The grant keys behind each permission, per scope: the keys of its
-* unconditional allows, and every deny key. A shim cannot apply a row
-* condition or a validity window, so a conditional allow answers nothing and
-* a conditional deny always subtracts; the conditioned keys are listed apart.
-* A break-glass key answers only the break-glass read, so it is left out too.
-* Rows seeded under a former key are left out; the shim maps a former key to
-* the current one first.
-*/
-function shimGrants(rows, conditioned, renamed) {
-	const byScope = /* @__PURE__ */ new Map();
-	for (const row of rows.toSorted((a, b) => a.grantKey < b.grantKey ? -1 : a.grantKey > b.grantKey ? 1 : 0)) {
-		if (Object.hasOwn(renamed, row.permission) || row.effect === "allow" && row.grantKey === breakGlassKey(row.permission)) continue;
-		const scope = byScope.get(row.scope) ?? {};
+/** The grants compiled into table policies, and the Realtime and Storage policies beside them. */
+function generatePolicies(input, policy, options, built, warnings) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const { fieldsMode, revokeColumns } = options;
+	databaseModeWarnings(policy, built, warnings);
+	const compiled = compileGrants(policy, ctx, rls?.tables, warnings, input.skipClosures, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0);
+	const helpersOnly = input.helpersOnly === true || rls?.helpersOnly === true;
+	if (helpersOnly && (input.target !== "sql" || revokeColumns)) return { refusal: "rls generate --helpers-only needs --target sql and no --revoke-columns: the table grants are hand-written, so revoke the restricted columns there" };
+	const views = fieldsMode === void 0 ? [] : fieldViews(policy, ctx, compiled.branches, {
+		revokeColumns,
+		helpersOnly
+	}, warnings);
+	const force = input.force === true || rls?.force === true;
+	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
+	const policyName = input.policyName ?? rls?.policyName;
+	const assembled = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
+		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
+		...policyName === void 0 ? {} : { name: policyName }
+	});
+	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
+	if (actorKinds !== void 0 && helpersOnly) warnings.push("rls.readOnlyActors adds policies, and --helpers-only writes none: add the restrictive read-only policies to the hand-written ones");
+	const withActors = (items) => actorKinds === void 0 ? items : [...items, ...readOnlyActorPolicies(items, subjectClaimJsonSql(ctx, "act"), actorKinds)];
+	let tablePolicies;
+	try {
+		tablePolicies = realtimeStoragePolicies(ctx, {
+			scopes: new Set(ctx.scopes.map((scope) => scope.name)),
+			keys: new Set(listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key)),
+			rowConditions: new Set(policyRowConditionKeys(policy))
+		}, compact({
+			realtime: rls?.realtime,
+			storage: rls?.storage
+		}), warnings);
+	} catch (cause) {
+		return { refusal: describeError(cause) };
+	}
+	if (tablePolicies.length > 0 && helpersOnly) warnings.push("rls.realtime and rls.storage add policies, and --helpers-only writes none: no realtime.messages or storage.objects policy is written");
+	const servicePolicies = tablePolicies.length === 0 || helpersOnly ? [] : withActors(tablePolicies);
+	const generated = {
+		compiled,
+		helpersOnly,
+		force,
+		views,
+		policies: withActors(assembled)
+	};
+	if (servicePolicies.length === 0) return generated;
+	return {
+		...generated,
+		helperTables: [SERVICE_TABLES_HEADER, ...servicePolicies.map(policySql)].join("\n"),
+		guardedTables: [`${SERVICE_TABLES_HEADER} A stack without the service has no table, so each policy is skipped there.`, ...servicePolicies.map(guardedPolicySql)].join("\n")
+	};
+}
+//#endregion
+//#region src/cli/rls/shims.ts
+const NAME = /^[a-z_][a-z0-9_]*$/u;
+/**
+* The key a legacy caller passes, mapped the way `rls migrate` maps it:
+* `keys` and `renamed` exactly, then the longest `prefixes` entry.
+*/
+function mappedKey(config, renamed) {
+	const exact = {
+		...renamed,
+		...config.keys
+	};
+	const prefixes = Object.entries(config.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length);
+	const fallback = prefixes.length === 0 ? "p_key" : `case ${prefixes.map(([from, to]) => `when pg_catalog.starts_with(p_key, ${quoteLiteral(from)}) then ${quoteLiteral(to)} || pg_catalog.substr(p_key, ${String(from.length + 1)})`).join(" ")} else p_key end`;
+	if (Object.keys(exact).length === 0) return fallback;
+	return `coalesce(${quoteLiteral(JSON.stringify(exact))}::jsonb ->> p_key, ${fallback})`;
+}
+function scopeOf(ctx, scope) {
+	if (!ctx.scopes.some((item) => item.name === scope)) throw new Error(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
+	return scope;
+}
+function addKey(list, key) {
+	if (!list.includes(key)) list.push(key);
+}
+/**
+* The grant keys behind each permission, per scope: the keys of its
+* unconditional allows, and every deny key. A shim cannot apply a row
+* condition or a validity window, so a conditional allow answers nothing and
+* a conditional deny always subtracts; the conditioned keys are listed apart.
+* A break-glass key answers only the break-glass read, so it is left out too.
+* Rows seeded under a former key are left out; the shim maps a former key to
+* the current one first.
+*/
+function shimGrants(rows, conditioned, renamed) {
+	const byScope = /* @__PURE__ */ new Map();
+	for (const row of rows.toSorted((a, b) => a.grantKey < b.grantKey ? -1 : a.grantKey > b.grantKey ? 1 : 0)) {
+		if (Object.hasOwn(renamed, row.permission) || row.effect === "allow" && row.grantKey === breakGlassKey(row.permission)) continue;
+		const scope = byScope.get(row.scope) ?? {};
 		byScope.set(row.scope, scope);
 		const keys = (Object.hasOwn(scope, row.permission) ? scope[row.permission] : void 0) ?? {
 			allow: [],
@@ -1404,7 +1923,7 @@ function grantKeys(keys, scope, effect) {
 }
 /** The instances of `scope` the caller holds an unconditional allow of the key in, minus those it holds a deny in. */
 function idsSql(ctx, keys, scope) {
-	const helper = qualified$1(ctx, permittedIdsHelper(scope));
+	const helper = qualified(ctx, permittedIdsHelper(scope));
 	return `  select a.id
   from ${grantKeys(keys, scope, "allow")}
   cross join lateral ${helper}(g.grant_key) a(id)
@@ -1414,7 +1933,7 @@ function idsSql(ctx, keys, scope) {
   cross join lateral ${helper}(g.grant_key) d(id)`;
 }
 function hasSql(ctx, keys) {
-	const has = qualified$1(ctx, HELPERS.has);
+	const has = qualified(ctx, HELPERS.has);
 	return `exists (select 1 from ${grantKeys(keys, "global", "allow")} where ${has}(g.grant_key))
     and not exists (select 1 from ${grantKeys(keys, "global", "deny")} where ${has}(g.grant_key))`;
 }
@@ -1432,7 +1951,7 @@ function shim(ctx, config, keys, fn, helper) {
 		case "membership": {
 			const scope = scopeOf(ctx, helper.scope);
 			const type = scopeTypeOf(ctx, scope);
-			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified$1(ctx, memberIdsHelper(scope))}()), false)`);
+			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified(ctx, memberIdsHelper(scope))}()), false)`);
 		}
 		case "global": return shimFunction(fn, "p_key text", "text", "boolean", `  select ${hasSql(ctx, keys)}`);
 		case "scoped": {
@@ -1468,222 +1987,111 @@ function shimsSql(ctx, config, shims, renamed, grants) {
 	return `${chunks.join("\n\n")}\n`;
 }
 //#endregion
-//#region src/cli/rls-generate.ts
-async function loadPolicy(cwd, config, from) {
-	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
-	if (policyPath === void 0) throw new Error("PermDock CLI: rls generate needs policy in permdock.config.ts or --from");
-	return asPolicy(pickNamed(await loadModule(resolve(cwd, policyPath)), ["policy"]));
-}
-/** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
-function writeRequirement(policy, requires) {
-	if (requires === void 0) return {};
-	const leaves = listPermissions(policy.permissions);
-	const keys = requires === "manageRoles" ? leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key) : [...requires];
-	if (keys.length === 0) return { error: requires === "manageRoles" ? "rls.customRoleWrites.requires is 'manageRoles', but no permission declares meta.manageRoles" : "rls.customRoleWrites.requires names no permission" };
-	const known = new Set(leaves.map((leaf) => leaf.key));
-	const unknown = keys.filter((key) => !known.has(key));
-	if (unknown.length > 0) return { error: `rls.customRoleWrites.requires names undeclared permissions: ${unknown.join(", ")}` };
-	return { keys: [...new Set(keys)].toSorted() };
-}
-/** Declared role names, and those a tenant admin may compose into custom roles. */
-function customRoleNames(policy, requires) {
-	const declared = [...roleNames(policy)].toSorted();
-	const assignable = declared.filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
-	const renamed = renamedKeys(policy.vocabulary.permissions);
-	const leaves = listPermissions(policy.permissions);
-	const manage = leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key);
-	return {
-		declared,
-		assignable,
-		...renamed.size === 0 ? {} : { renamed: Object.fromEntries(renamed) },
-		permissions: leaves.map((leaf) => leaf.key).toSorted(),
-		...manage.length === 0 ? {} : { manage: manage.toSorted() },
-		...requires === void 0 ? {} : { requires },
-		...policy.levels === void 0 ? {} : { levels: true }
-	};
-}
-function moveUndiffed(sql, label, part) {
-	const { kept, moved } = splitUndiffed(sql);
-	const [first = "", ...rest] = kept.split("\n");
-	return {
-		sql: [
-			first,
-			`-- what supabase db diff drops from this part is in ${label}`,
-			...rest
-		].join("\n"),
-		grants: `-- the privileges and view options supabase db diff drops from the ${part} part\n${moved.join("\n")}`
-	};
+//#region src/cli/rls/triggers.ts
+const PREFIX = "PermDock CLI";
+const EVENTS = /* @__PURE__ */ new Set([
+	"insert",
+	"update",
+	"delete",
+	"truncate"
+]);
+const AUDITED = [
+	CUSTOM_ROLES.permissions,
+	CUSTOM_ROLES.includes,
+	"user_roles"
+];
+const IDENT = /^[a-z_][a-z0-9_$]*$/u;
+/** The tables `sql` creates in `schema`, by name without the schema. */
+function generatedTables(sql, schema) {
+	const prefix = `create table if not exists ${quoteIdent$1(schema)}.`;
+	const found = /* @__PURE__ */ new Set();
+	for (const line of sql.split("\n")) {
+		if (!line.startsWith(prefix)) continue;
+		const name = /^"?([A-Za-z_][\w$]*)"?/u.exec(line.slice(prefix.length))?.[1];
+		if (name !== void 0) found.add(name);
+	}
+	return [...found].toSorted();
+}
+function functionName(name, label) {
+	if (typeof name !== "string" || name.split(".").length !== 2) throw new Error(`${PREFIX}: ${label} must be a schema-qualified function such as audit.log_change, got ${JSON.stringify(name)}`);
+	return quoteTable(name);
+}
+function knownTable(table, tables, label) {
+	if (!tables.includes(table)) throw new Error(`${PREFIX}: ${label} names ${table}, which rls generate does not create with this config; it creates ${tables.join(", ")}`);
+}
+function triggerSql(table, trigger, label) {
+	if (typeof trigger.name !== "string" || trigger.name === "" || trigger.name.toLowerCase().startsWith("permdock_")) throw new Error(`${PREFIX}: ${label}.name must be a name outside permdock_, which generated triggers use, got ${JSON.stringify(trigger.name)}`);
+	if (trigger.when !== "before" && trigger.when !== "after") throw new Error(`${PREFIX}: ${label}.when must be before or after`);
+	const events = trigger.events;
+	if (events.length === 0 || !events.every((event) => EVENTS.has(event))) throw new Error(`${PREFIX}: ${label}.events must list insert, update, delete or truncate`);
+	const level = trigger.level ?? "row";
+	if (level !== "row" && level !== "statement") throw new Error(`${PREFIX}: ${label}.level must be row or statement`);
+	if (level === "row" && events.includes("truncate")) throw new Error(`${PREFIX}: ${label} fires on truncate, which Postgres allows only with level: 'statement'`);
+	const fn = functionName(trigger.function, `${label}.function`);
+	const args = (trigger.args ?? []).map((arg) => quoteLiteral(arg));
+	const name = quoteIdent$1(trigger.name);
+	return `drop trigger if exists ${name} on ${table};
+create trigger ${name}
+  ${trigger.when} ${[...new Set(events)].join(" or ")} on ${table}
+  for each ${level} execute function ${fn}(${args.join(", ")});`;
 }
 /**
-* The row columns that belong to a table. With `rls.tables` set, a resource
-* it does not name is a table only when generated policies are written for
-* it; with `--helpers-only` it has none, so it gets no index.
+* `rls.triggers`: the application's triggers on generated tables, after the
+* tables. A table this run does not create is an error, so a trigger never
+* silently goes missing.
 */
-function tableColumns(rowColumns, tables, helpersOnly, warnings) {
-	if (tables === void 0) return rowColumns;
-	const unmapped = [...new Set(rowColumns.map((item) => item.resource).filter((resource) => !Object.hasOwn(tables, resource)))].toSorted();
-	if (unmapped.length === 0) return rowColumns;
-	if (helpersOnly) {
-		warnings.push(`no index is suggested for resources without an rls.tables entry: ${unmapped.join(", ")}; map each one that is a table`);
-		return rowColumns.filter((item) => Object.hasOwn(tables, item.resource));
+function triggersSql(triggers, schema, tables) {
+	if (triggers === void 0) return "";
+	const chunks = [];
+	for (const [table, list] of Object.entries(triggers).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+		knownTable(table, tables, `rls.triggers.${table}`);
+		const target = `${quoteIdent$1(schema)}.${quoteIdent$1(table)}`;
+		for (const [index, trigger] of list.entries()) chunks.push(triggerSql(target, trigger, `rls.triggers.${table}[${String(index)}]`));
 	}
-	warnings.push(`policies for resources without an rls.tables entry target a table named after the resource: ${unmapped.map((resource) => qualifiedTable$1(resource)).join(", ")}; map each one to its table`);
-	return rowColumns;
+	return chunks.length === 0 ? "" : `-- rls.triggers: triggers the application owns on generated tables\n${chunks.join("\n")}\n`;
 }
-async function runRlsGenerate(input) {
-	const rls = input.config.rls;
-	const fieldsMode = input.fields ?? rls?.fields;
-	if (fieldsMode !== void 0 && fieldsMode !== "views") return {
-		code: 2,
-		output: `rls generate --fields must be views (got ${fieldsMode})`,
-		text: ""
-	};
-	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
-	if (revokeColumns && fieldsMode === void 0) return {
-		code: 2,
-		output: "rls generate --revoke-columns needs --fields views",
-		text: ""
-	};
-	const policy = await loadPolicy(input.cwd, input.config, input.from);
-	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
-	if (input.rbac && input.dialect !== "supabase") return {
-		code: 2,
-		output: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})`,
-		text: ""
-	};
-	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
-	const authorize = resolveAuthorize(input.config, {
-		authorize: input.authorize,
-		rbac: input.rbac,
-		memberships
-	});
-	const memberSources = rls?.membershipSources ?? input.config.supabase?.hook?.memberships;
-	const sources = authorize === "database" ? memberSources : void 0;
-	const scopes = scopeList(policy.scopes);
-	const suspension = checkSuspension(rls?.suspension, scopes);
-	const hookRoles = input.config.supabase?.hook?.roles;
-	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
-	if (roles !== void 0 && input.rbac) return {
-		code: 2,
-		output: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag",
-		text: ""
-	};
-	const requires = writeRequirement(policy, rls?.customRoleWrites?.requires);
-	if (requires.error !== void 0) return {
-		code: 2,
-		output: requires.error,
-		text: ""
-	};
-	const readers = rls?.trustedReaders;
-	if (readers !== void 0 && (!Array.isArray(readers) || !readers.every((name) => typeof name === "string" && name !== ""))) return {
-		code: 2,
-		output: "rls.trustedReaders must list Postgres role names, such as ['service_role']",
-		text: ""
-	};
-	const ownership = ownershipRules(policy, scopes);
-	const graph = graphPlan(policy);
-	const apiKeys = apiKeysPlan(rls?.apiKeys, new Set(roleNames(policy)), Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
-	const ctx = {
-		dialect: input.dialect,
-		scopes,
-		tenantClaim: rls?.tenantClaim ?? "tenant_id",
-		...rls?.tenants === "all" ? { tenants: "all" } : {},
-		gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
-		...rls?.actions === void 0 ? {} : { actions: rls.actions },
-		inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
-		schema,
-		authorize,
-		roleClaim: rls?.roleClaim ?? "user_role",
-		tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
-		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
-		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
-		...memberships === void 0 ? {} : { memberships },
-		...sources === void 0 || sources.length === 0 ? {} : { sources },
-		...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
-		...suspension === void 0 ? {} : { suspension },
-		...roles === void 0 ? {} : { roles },
-		...input.customRoles === true || rls?.customRoles === true ? { customRoles: {
-			...customRoleNames(policy, requires.keys),
-			...rls?.customRoleWrites?.roles === void 0 ? {} : { table: rls.customRoleWrites.roles }
-		} } : {},
-		...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
-		...apiKeys === void 0 ? {} : { apiKeys },
-		...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
-		...ownership === void 0 ? {} : { ownership },
-		...rls?.ownershipTriggers === void 0 ? {} : { skipOwnershipTriggers: rls.ownershipTriggers === false ? "all" : Object.keys(rls.ownershipTriggers).map((key) => {
-			const name = resolveScope(scopes, key);
-			if (name === void 0) throw new Error(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
-			return name;
-		}) },
-		...rls?.assignments === void 0 ? {} : { assignments: rls.assignments === true ? { tables: [] } : {
-			tables: rls.assignments.tables ?? [],
-			...rls.assignments.ownRole === void 0 ? {} : { ownRole: rls.assignments.ownRole }
-		} },
-		...fieldsMode === void 0 ? {} : { fields: fieldsMode },
-		...graph.size === 0 ? {} : { graph: {
-			closures: closureDepths(graph),
-			resources: policy.resources,
-			...rls?.tables === void 0 ? {} : { tables: rls.tables }
-		} }
-	};
-	if (ctx.anonymousSignIns === "deny" && ctx.dialect !== "supabase") return {
-		code: 2,
-		output: `rls.anonymousSignIns needs --dialect supabase (got ${ctx.dialect})`,
-		text: ""
-	};
-	const jsonSchema = rls?.jsonSchema;
-	if (jsonSchema !== void 0 && jsonSchema !== "auto" && typeof jsonSchema !== "boolean") return {
-		code: 2,
-		output: `rls.jsonSchema must be 'auto', true or false (got ${JSON.stringify(jsonSchema)})`,
-		text: ""
-	};
-	const warnings = [];
-	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
-	if (authorize === "database") {
-		for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
-	}
-	const compiled = compileGrants(policy, ctx, rls?.tables, warnings, input.skipClosures, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0);
-	const helpersOnly = input.helpersOnly === true || rls?.helpersOnly === true;
-	if (helpersOnly && (input.target !== "sql" || revokeColumns)) return {
-		code: 2,
-		output: "rls generate --helpers-only needs --target sql and no --revoke-columns: the table grants are hand-written, so revoke the restricted columns there",
-		text: ""
-	};
-	const views = fieldsMode === void 0 ? [] : fieldViews(policy, ctx, compiled.branches, {
-		revokeColumns,
-		helpersOnly
-	}, warnings);
-	const force = input.force === true || rls?.force === true;
-	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
-	const policyName = input.policyName ?? rls?.policyName;
-	const assembled = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
-		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
-		...policyName === void 0 ? {} : { name: policyName }
+/**
+* `rls.audit`: one call of the audit function per generated table, which
+* registers the table with the application's audit module. Statements that
+* run code, so they travel with the seeds.
+*/
+function auditSql(audit, schema, tables) {
+	if (audit === void 0) return "";
+	const fn = functionName(audit.function, "rls.audit.function");
+	const listed = audit.tables;
+	if (listed !== void 0) for (const table of listed) knownTable(table, tables, "rls.audit.tables");
+	const targets = listed ?? AUDITED.filter((table) => tables.includes(table));
+	const args = Object.entries(audit.args ?? {}).map(([name, value]) => {
+		if (!IDENT.test(name)) throw new Error(`${PREFIX}: rls.audit.args names ${JSON.stringify(name)}, which is not a lower-case parameter name`);
+		return `, ${quoteIdent$1(name)} => ${quoteLiteral(value)}`;
 	});
-	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
-	if (actorKinds !== void 0 && helpersOnly) warnings.push("rls.readOnlyActors adds policies, and --helpers-only writes none: add the restrictive read-only policies to the hand-written ones");
-	const policies = actorKinds === void 0 ? assembled : [...assembled, ...readOnlyActorPolicies(assembled, subjectClaimJsonSql(ctx, "act"), actorKinds)];
-	let tablePolicies;
-	try {
-		tablePolicies = realtimeStoragePolicies(ctx, {
-			scopes: new Set(ctx.scopes.map((scope) => scope.name)),
-			keys: new Set(listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key)),
-			rowConditions: new Set(policyRowConditionKeys(policy))
-		}, compact({
-			realtime: rls?.realtime,
-			storage: rls?.storage
-		}), warnings);
+	if (targets.length === 0) return "";
+	return `-- rls.audit: generated tables registered with ${audit.function}
+${targets.map((table) => `select ${fn}(${quoteLiteral(`${quoteIdent$1(schema)}.${quoteIdent$1(table)}`)}::regclass${args.join("")});`).join("\n")}
+`;
+}
+//#endregion
+//#region src/cli/rls/generate-sql.ts
+/** The checks that need the SQL context: `--backfill-out`, `rls.anonymousSignIns`, `rls.jsonSchema`. */
+function preflight(input, { ctx }) {
+	const rls = input.config.rls;
+	const from = typeof rls?.customRoles === "object" ? rls.customRoles.from : void 0;
+	if (input.backfillOut !== void 0 && from === void 0) return { refusal: "rls generate --backfill-out needs rls.customRoles.from in permdock.config.ts" };
+	let backfill;
+	if (from !== void 0) try {
+		backfill = backfillSql(ctx, from, rls?.migrate);
 	} catch (cause) {
-		return {
-			code: 2,
-			output: describeError(cause),
-			text: ""
-		};
+		return { refusal: describeError(cause) };
 	}
-	if (tablePolicies.length > 0 && helpersOnly) warnings.push("rls.realtime and rls.storage add policies, and --helpers-only writes none: no realtime.messages or storage.objects policy is written");
-	const servicePolicies = tablePolicies.length === 0 || helpersOnly ? [] : [...tablePolicies, ...actorKinds === void 0 ? [] : readOnlyActorPolicies(tablePolicies, subjectClaimJsonSql(ctx, "act"), actorKinds)];
-	const helperTables = servicePolicies.length === 0 ? void 0 : [SERVICE_TABLES_HEADER, ...servicePolicies.map(policySql)].join("\n");
-	const guardedTables = servicePolicies.length === 0 ? void 0 : [`${SERVICE_TABLES_HEADER} A stack without the service has no table, so each policy is skipped there.`, ...servicePolicies.map(guardedPolicySql)].join("\n");
+	if (ctx.anonymousSignIns === "deny" && ctx.dialect !== "supabase") return { refusal: `rls.anonymousSignIns needs --dialect supabase (got ${ctx.dialect})` };
+	const jsonSchema = rls?.jsonSchema;
+	if (jsonSchema !== void 0 && jsonSchema !== "auto" && typeof jsonSchema !== "boolean") return { refusal: `rls.jsonSchema must be 'auto', true or false (got ${JSON.stringify(jsonSchema)})` };
+	return {
+		backfill,
+		jsonSchema
+	};
+}
+function rbacPart(input, policy, { ctx, schema, authorize }, warnings) {
 	const rootMapped = ctx.scopes[0] === void 0 ? void 0 : scopeTable(ctx, ctx.scopes[0].name);
 	const rootTable = rootMapped === void 0 ? void 0 : {
 		...rootMapped.table,
@@ -1702,51 +2110,66 @@ async function runRlsGenerate(input) {
 	}) : void 0;
 	if (rbac !== void 0) warnings.push(...rbac.warnings);
 	if (input.rbac) warnings.push("the token hook that writes user_role and memberships comes from permdock supabase hook generate");
+	return rbac;
+}
+/** The ownership, approval store, graph, row-helper and break-glass sections. */
+function sectionsSql(input, policy, options, built, generated, jsonSchema, warnings) {
+	const rls = input.config.rls;
+	const { ctx, graph, ownership } = built;
+	const { compiled } = generated;
 	const owned = [ownershipSql(ctx), assignmentSql(ctx)].filter((part) => part !== "").join("\n");
 	if (ctx.assignments !== void 0 && (ownership === void 0 || ownership.assigns.length === 0)) warnings.push("rls.assignments needs a role that declares assigns: no assignment trigger is written");
 	let approvals;
 	try {
 		approvals = rls?.approvals === true ? approvalStoreSql(ctx, jsonSchema ?? false) : typeof rls?.approvals === "object" ? adoptedApprovalStoreSql(ctx, rls.approvals, jsonSchema ?? false) : void 0;
 	} catch (cause) {
-		return {
-			code: 2,
-			output: describeError(cause),
-			text: ""
-		};
+		return { refusal: describeError(cause) };
 	}
 	const graphed = graphSql(ctx, graph, rls?.tables);
 	let rowHelpers = "";
 	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) try {
-		rowHelpers = rowHelpersSql(ctx, policy, [...fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], rls?.tables, warnings);
+		rowHelpers = rowHelpersSql(ctx, policy, [...options.fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], rls?.tables, warnings);
 	} catch (cause) {
-		return {
-			code: 2,
-			output: describeError(cause),
-			text: ""
-		};
+		return { refusal: describeError(cause) };
 	}
 	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, rls?.tables));
-	const configured = rls?.shims;
-	const shimsConfig = typeof configured === "object" ? configured : configured === true || input.shims === true ? {} : void 0;
-	if (shimsConfig !== void 0 && rls?.migrate === void 0) return {
-		code: 2,
-		output: "PermDock CLI: rls generate --shims needs rls.migrate.helpers in permdock.config.ts",
-		text: ""
-	};
-	const renamed = Object.fromEntries(renamedKeys(policy.vocabulary.permissions));
-	const grants = shimGrants(compiled.rolePermissions, compiled.conditionedKeys, renamed);
-	const anonExecute = rls?.anonExecute === true || views.some((view) => view.roles.includes("anon")) || compiled.branches.some((branch) => branch.roles.includes("anon") && [
+	return [
+		approvals,
+		owned === "" ? void 0 : owned,
+		graphed === "" ? void 0 : graphed,
+		breakGlass === "" ? void 0 : breakGlass,
+		rowHelpers === "" ? void 0 : rowHelpers
+	];
+}
+/** Whether `anon` calls a helper: `rls.anonExecute`, an anon field view or an anon branch reading the user id. */
+function anonExecutes(input, { compiled, views }) {
+	return input.config.rls?.anonExecute === true || views.some((view) => view.roles.includes("anon")) || compiled.branches.some((branch) => branch.roles.includes("anon") && [
 		branch.access,
 		branch.using,
 		branch.check
 	].some((sql) => sql?.includes("permdock_user_id") === true));
+}
+/** Everything before the table policies: helpers, sections, shims, scaffold and triggers. */
+function preambleSql(input, policy, options, built, generated, jsonSchema, warnings) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const { compiled } = generated;
+	const rbac = rbacPart(input, policy, built, warnings);
+	const sections = sectionsSql(input, policy, options, built, generated, jsonSchema, warnings);
+	if (isRefusal(sections)) return sections;
+	const configured = rls?.shims;
+	const shimsConfig = typeof configured === "object" ? configured : configured === true || input.shims === true ? {} : void 0;
+	if (shimsConfig !== void 0 && rls?.migrate === void 0) return { refusal: "PermDock CLI: rls generate --shims needs rls.migrate.helpers in permdock.config.ts" };
+	const renamed = Object.fromEntries(renamedKeys(policy.vocabulary.permissions));
+	const grants = shimGrants(compiled.rolePermissions, compiled.conditionedKeys, renamed);
+	const anonExecute = anonExecutes(input, generated);
 	const usesLiveSession = compiled.branches.some((branch) => [
 		branch.access,
 		branch.using,
 		branch.check
 	].some((sql) => sql?.includes(SESSION_LIVE_HELPER) === true));
 	const shims = shimsConfig === void 0 || rls?.migrate === void 0 ? void 0 : shimsSql(ctx, rls.migrate, shimsConfig, renamed, grants);
-	const preamble = [
+	const core = [
 		rbac?.head,
 		helpersSql(ctx, compiled.rolePermissions, {
 			levelReach: compiled.levelReach,
@@ -1758,18 +2181,56 @@ async function runRlsGenerate(input) {
 		}),
 		permissionHelpersSql(ctx, grants, renamed, anonExecute),
 		usesLiveSession ? sessionLiveHelperSql(ctx) : void 0,
-		approvals,
-		owned === "" ? void 0 : owned,
-		graphed === "" ? void 0 : graphed,
-		breakGlass === "" ? void 0 : breakGlass,
-		rowHelpers === "" ? void 0 : rowHelpers,
+		...sections,
 		shims,
 		rbac?.tail
 	].filter((part) => part !== void 0).join("\n");
-	if (force) for (const entry of graph.values()) {
+	const created = generatedTables(core, built.schema);
+	let ownTriggers;
+	let audit;
+	try {
+		ownTriggers = triggersSql(rls?.triggers, built.schema, created);
+		audit = auditSql(rls?.audit, built.schema, created);
+	} catch (cause) {
+		return { refusal: describeError(cause) };
+	}
+	const seedsSplit = splitsPart(input.split, "seeds");
+	return {
+		preamble: [
+			core,
+			ownTriggers,
+			seedsSplit ? "" : audit
+		].filter((part) => part !== "").join("\n"),
+		audit
+	};
+}
+function forceWarnings({ graph }, warnings) {
+	for (const entry of graph.values()) {
 		const own = [...entry.relations].filter((name) => !("edge" in (entry.node.relations[name] ?? {})));
 		if (own.length > 0) warnings.push(`--force: ${entry.node.name} relations ${own.join(", ")} are read from the ${entry.node.name} table itself, so ${graphHelper(entry.node.name)} would recurse through its own policy; keep ${entry.node.name} unforced or move them to edge tables`);
 	}
+}
+/**
+* The row columns that belong to a table. With `rls.tables` set, a resource
+* it does not name is a table only when generated policies are written for
+* it; with `--helpers-only` it has none, so it gets no index.
+*/
+function tableColumns(rowColumns, tables, helpersOnly, warnings) {
+	if (tables === void 0) return rowColumns;
+	const unmapped = [...new Set(rowColumns.map((item) => item.resource).filter((resource) => !Object.hasOwn(tables, resource)))].toSorted();
+	if (unmapped.length === 0) return rowColumns;
+	if (helpersOnly) {
+		warnings.push(`no index is suggested for resources without an rls.tables entry: ${unmapped.join(", ")}; map each one that is a table`);
+		return rowColumns.filter((item) => Object.hasOwn(tables, item.resource));
+	}
+	warnings.push(`policies for resources without an rls.tables entry target a table named after the resource: ${unmapped.map((resource) => qualifySqlTable(resource)).join(", ")}; map each one to its table`);
+	return rowColumns;
+}
+/** The `--target` file, and for Drizzle and Prisma the SQL migration beside it. */
+function emitTarget(input, built, generated, preamble) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const { policies, force, views, helperTables } = generated;
 	const outRel = input.out ?? rls?.out ?? defaultOut(input.target);
 	const migration = input.target === "sql" ? "" : dialectRoles(migrationSql(policies, withHelperTables(preamble, helperTables), force, views), ctx.dialect);
 	const migrationRel = migration === "" ? void 0 : migrationOut(outRel);
@@ -1795,14 +2256,77 @@ async function runRlsGenerate(input) {
 			break;
 		default: return input.target;
 	}
-	let indexes = indexTargets(ctx, tableColumns(compiled.rowColumns, rls?.tables, helpersOnly, warnings));
+	return {
+		text,
+		migration,
+		migrationRel,
+		outRel
+	};
+}
+/** The generated SQL for one run, before `--db` prunes the index targets. */
+function generateSql(input, policy, options, built, warnings) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const checked = preflight(input, built);
+	if (isRefusal(checked)) return checked;
+	const { jsonSchema } = checked;
+	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
+	const generated = generatePolicies(input, policy, options, built, warnings);
+	if (isRefusal(generated)) return generated;
+	const assembled = preambleSql(input, policy, options, built, generated, jsonSchema, warnings);
+	if (isRefusal(assembled)) return assembled;
+	const { preamble, audit } = assembled;
+	if (generated.force) forceWarnings(built, warnings);
+	const emitted = emitTarget(input, built, generated, preamble);
+	const { policies, force, views, helperTables, guardedTables, helpersOnly } = generated;
+	const seedsSplit = splitsPart(input.split, "seeds");
+	return {
+		...generated,
+		...emitted,
+		backfill: checked.backfill,
+		indexes: indexTargets(ctx, tableColumns(generated.compiled.rowColumns, rls?.tables, helpersOnly, warnings)),
+		parts: (indexes) => ({
+			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
+			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
+			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
+			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
+			seeds: `${SEEDS_MARKER} schema=${built.schema}\n${seedSql(ctx, generated.compiled.rolePermissions)}\n${seedsSplit ? audit : ""}`,
+			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
+		})
+	};
+}
+//#endregion
+//#region src/cli/rls/generate.ts
+function loadPolicy(cwd, config, from) {
+	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
+	return requirePolicy(cwd, policyPath, "rls generate needs policy in permdock.config.ts or --from");
+}
+function refused(output) {
+	return {
+		code: 2,
+		output,
+		text: ""
+	};
+}
+async function runRlsGenerate(input) {
+	const options = generateOptions(input);
+	if (isRefusal(options)) return refused(options.refusal);
+	const policy = await loadPolicy(input.cwd, input.config, input.from);
+	const built = buildContext(input, policy, options);
+	if (isRefusal(built)) return refused(built.refusal);
+	const warnings = [];
+	const generated = generateSql(input, policy, options, built, warnings);
+	if (isRefusal(generated)) return refused(generated.refusal);
+	const { ctx } = built;
+	const { text, migration, migrationRel, helpersOnly } = generated;
+	let indexes = generated.indexes;
 	if (input.db !== void 0) try {
 		const pruned = pruneIndexTargets(indexes, await readTableIndexFacts(input.db, [...new Set(indexes.map((target) => target.table))], input.connect));
 		indexes = pruned.targets;
 		warnings.push(...pruned.warnings);
 	} catch (cause) {
 		return {
-			code: 2,
+			code: exitCodeOf(cliErrorKind(cause)),
 			output: describeError(cause),
 			text: ""
 		};
@@ -1813,33 +2337,26 @@ async function runRlsGenerate(input) {
 		code: 0,
 		output: warnings.join("\n"),
 		text,
-		policies,
-		seeds: compiled.rolePermissions,
+		policies: generated.policies,
+		seeds: generated.compiled.rolePermissions,
 		indexes,
 		keys: {
 			permissions: listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key),
 			rowConditions: [...policyRowConditionKeys(policy)],
 			renamed: Object.fromEntries(renamedKeys(policy.vocabulary.permissions))
 		},
-		schema,
+		schema: built.schema,
 		helpersOnly,
 		...extras
 	};
 	const planned = outputFiles({
 		input,
-		outRel,
+		outRel: generated.outRel,
 		text,
 		helpersOnly,
-		sql: () => ({
-			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
-			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
-			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
-			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
-			seeds: `${SEEDS_MARKER} schema=${schema}\n${seedSql(ctx, compiled.rolePermissions)}\n`,
-			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
-		}),
-		scopes,
-		schema
+		sql: () => generated.parts(indexes),
+		scopes: ctx.scopes,
+		schema: built.schema
 	});
 	if (typeof planned === "string") return {
 		code: 2,
@@ -1853,6 +2370,18 @@ async function runRlsGenerate(input) {
 		rel: migrationRel,
 		text: migration
 	});
+	if (input.backfillOut !== void 0 && generated.backfill !== void 0) {
+		const file = dataMigrationFile({
+			cwd: input.cwd,
+			out: input.backfillOut,
+			part: "backfill",
+			marker: BACKFILL_MARKER,
+			text: generated.backfill,
+			now: input.io.now?.() ?? /* @__PURE__ */ new Date(),
+			check: input.check
+		});
+		if (file !== void 0) files.push(file);
+	}
 	if (input.check) {
 		const drift = driftOf(input.cwd, files);
 		return drift.length === 0 ? {
@@ -1867,7 +2396,7 @@ async function runRlsGenerate(input) {
 			...extras
 		};
 	}
-	const written = writeSqlFiles(input.cwd, files);
+	const written = writeOutputFiles(input.cwd, files);
 	const extra = warnings.length === 0 ? "" : `\n${warnings.join("\n")}`;
 	return {
 		code: 0,
@@ -1876,141 +2405,8 @@ async function runRlsGenerate(input) {
 		...extras
 	};
 }
-/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
-const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
-/**
-* A `realtime.messages` or `storage.objects` policy that applies only where
-* the table exists. The Realtime and Storage services create those tables, so
-* a local stack with the service off, and pg-delta's shadow database, have
-* none.
-*/
-function guardedPolicySql(item) {
-	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
-	return `do $permdock$
-begin
-  if to_regclass(${quoteLiteral(qualifiedTable$1(item.table))}) is not null then
-${body}
-  end if;
-end
-$permdock$;
-`;
-}
-/** Appends the `realtime.messages` and `storage.objects` policies, which never get `tableSql`. */
-function withHelperTables(sql, helperTables) {
-	if (helperTables === void 0) return sql;
-	const tables = `${helperTables.trimEnd()}\n`;
-	return sql.trim() === "" ? tables : `${sql.trimEnd()}\n\n${tables}`;
-}
-function splitsPart(raw, part) {
-	const split = parseSplit(raw);
-	return typeof split !== "string" && split?.includes(part) === true;
-}
-/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants. */
-function outputFiles(plan) {
-	const { input } = plan;
-	const split = parseSplit(input.split);
-	if (typeof split === "string") return split;
-	if (split?.includes("policies") === true && plan.helpersOnly) return "rls generate --helpers-only writes no policies part; drop it from --split";
-	if (split === void 0) {
-		if (input.grantsOut !== void 0) return "rls generate --grants-out needs --split with the helpers or hook part";
-		if (input.seedsOut !== void 0) return "rls generate --seeds-out needs --split with the seeds part";
-		return [{
-			part: "rls",
-			rel: plan.outRel,
-			text: plan.text
-		}];
-	}
-	if (input.target !== "sql") return "rls generate --split needs --target sql";
-	const pgDelta = input.out === void 0 && input.config.rls?.out === void 0 ? supabaseConfig(input.cwd).pgDelta : void 0;
-	if (pgDelta === void 0 && !plan.outRel.includes("{part}")) return `rls generate --split needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
-	if (pgDelta !== void 0 && split.includes("helpers") && !split.includes("seeds")) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
-	if (pgDelta !== void 0 && split.includes("seeds") && input.seedsOut === void 0) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
-	const at = (part, schema = plan.schema) => pgDelta === void 0 ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
-	if (input.grantsOut !== void 0 && !split.includes("hook") && !split.includes("helpers")) return "rls generate --grants-out needs the helpers or hook part in --split";
-	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
-	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
-	const sql = plan.sql();
-	const relocated = pgDelta === void 0 ? void 0 : sql.servicePolicies;
-	if (relocated !== void 0 && split.includes("policies") && !split.includes("seeds")) return "rls generate --split policies under pg-delta with rls.realtime or rls.storage needs the seeds part with --seeds-out: the shadow database has no realtime.messages or storage.objects, so their policies go in that migration";
-	const seeds = relocated === void 0 || !split.includes("policies") ? sql.seeds : `${sql.seeds}\n${relocated}`;
-	const files = [];
-	const label = grantsLabel(input.grantsOut);
-	let grantsMarker = `${GRANTS_MARKER} schema=${plan.schema}`;
-	const grants = [];
-	for (const part of split) switch (part) {
-		case "helpers": {
-			if (label === void 0) {
-				files.push({
-					part,
-					rel: at(part),
-					text: sql.helpers
-				});
-				break;
-			}
-			const moved = moveUndiffed(sql.helpers, label, part);
-			files.push({
-				part,
-				rel: at(part),
-				text: moved.sql
-			});
-			grants.push(moved.grants);
-			break;
-		}
-		case "seeds": {
-			const out = input.seedsOut;
-			if (out !== void 0 && isSeedsDirectory(input.cwd, out)) {
-				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? /* @__PURE__ */ new Date());
-				if (!planned.current || input.check) files.push({
-					part,
-					rel: planned.rel,
-					text: seeds
-				});
-				break;
-			}
-			files.push({
-				part,
-				rel: out ?? at(part),
-				text: seeds
-			});
-			break;
-		}
-		case "indexes":
-			files.push({
-				part,
-				rel: at(part),
-				text: sql.indexes
-			});
-			break;
-		case "policies":
-			files.push({
-				part,
-				rel: at(part),
-				text: pgDelta === void 0 ? sql.policies : sql.declarativePolicies
-			});
-			break;
-		case "hook": {
-			const hook = supabaseHookSql(plan.scopes, input.config, {}, label);
-			files.push({
-				part,
-				rel: at(part, hook.manifest.hook.schema),
-				text: hook.sql
-			});
-			const [marker = grantsMarker, ...rest] = hook.grants.split("\n");
-			grantsMarker = marker;
-			grants.push(rest.join("\n").trimEnd());
-			break;
-		}
-		default: return part;
-	}
-	if (input.grantsOut !== void 0) files.push({
-		part: "grants",
-		rel: input.grantsOut,
-		text: `${[grantsMarker, ...grants].join("\n")}\n`
-	});
-	return files;
-}
 //#endregion
-//#region src/cli/rls-introspect.ts
+//#region src/cli/rls/introspect.ts
 const ROLES = ["anon", "authenticated"];
 /** Neon's `anonymous` is the role `rls generate` writes as `anon` for the other dialects. */
 function liveRole(role) {
@@ -2023,7 +2419,7 @@ const PRIVILEGES = [
 	"delete"
 ];
 /** `posts` and `"app"."posts"` as `public.posts` and `app.posts`. */
-function qualified(table) {
+function normalizeTableName(table) {
 	const parts = table.split(".").map((part) => part.replaceAll("\"", ""));
 	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
 }
@@ -2037,19 +2433,19 @@ function helpersOf(sql) {
 	return [...found];
 }
 function expectedRls(policies, sql, indexes = []) {
-	const tables = [...new Set(policies.map((item) => qualified(item.table)))];
+	const tables = [...new Set(policies.map((item) => normalizeTableName(item.table)))];
 	const grants = {};
 	for (const table of tables) {
 		const byRole = {};
 		for (const role of ROLES) {
-			const commands = new Set(policies.filter((item) => qualified(item.table) === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
+			const commands = new Set(policies.filter((item) => normalizeTableName(item.table) === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
 			byRole[role] = PRIVILEGES.filter((privilege) => commands.has(privilege));
 		}
 		grants[table] = byRole;
 	}
 	return {
 		policies: policies.map((item) => ({
-			table: qualified(item.table),
+			table: normalizeTableName(item.table),
 			name: item.name,
 			command: item.command,
 			permissive: item.effect === "allow",
@@ -2060,7 +2456,7 @@ function expectedRls(policies, sql, indexes = []) {
 		helpers: helpersOf(sql),
 		indexes: indexes.map((target) => ({
 			...target,
-			table: qualified(target.table)
+			table: normalizeTableName(target.table)
 		}))
 	};
 }
@@ -2278,7 +2674,7 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 	}
 }
 //#endregion
-//#region src/cli/rls.ts
+//#region src/cli/rls/rls.ts
 const RLS_HELP = `permdock rls generate | import | verify | migrate
 
   generate --target drizzle|sql|prisma --dialect supabase|neon|guc
@@ -2288,15 +2684,16 @@ const RLS_HELP = `permdock rls generate | import | verify | migrate
            [--capabilities] [--fields views [--revoke-columns]]
            [--out <path>] [--check] [--skip-closures] [--inline-functions] [--force] [--guc-prefix app]
            [--split helpers,seeds,policies,hook --out <dir>/056_permdock_{part}.sql]
-           [--grants-out <file>|-] [--seeds-out <file>|-]
+           [--grants-out <file>|-] [--seeds-out <file>|-] [--backfill-out <file>|<dir>/|-]
            [--helpers-only] [--shims] [--db $DATABASE_URL]
   import   --sql schema.sql | --db $DATABASE_URL --out src/permissions.generated.ts
            [--schema zod|valibot|arktype] [--memberships <table>:tenant,user,role]
   verify   [--db $DATABASE_URL] [--fixtures rls.fixtures.ts] [--format pgtap|node] [--tree]
            [--introspect --db $DATABASE_URL, with the generate flags]
            [--advisors [--db $DATABASE_URL] [--json]]: supabase db advisors, security lints
-  migrate  --sql <dir> [--write] [--json], with the generate flags
-           rewrites the rls.migrate helpers' calls in policies onto the generated helpers
+  migrate  --sql <dir> [--write] [--json] [--retire-out <file>|<dir>/|-], with the generate flags
+           rewrites the rls.migrate helpers' calls in policies onto the generated helpers;
+           --retire-out drops each rls.migrate.tables table and its refresh triggers once unread
 
 Never emits service_role, except in the execute grant rls.trustedReaders asks for. memberOf compiles through the dialect memberships mapping.
 `;
@@ -2334,6 +2731,7 @@ function generateInput(input, target, dialect) {
 		...input.split === void 0 ? {} : { split: input.split },
 		...input.grantsOut === void 0 ? {} : { grantsOut: input.grantsOut },
 		...input.seedsOut === void 0 ? {} : { seedsOut: input.seedsOut },
+		...input.backfillOut === void 0 ? {} : { backfillOut: input.backfillOut },
 		helpersOnly: input.helpersOnly,
 		shims: input.shims === true
 	};
@@ -2363,14 +2761,16 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-CN4TlJTO.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-BwlB5-Wk.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
 		config,
 		target: migrateTarget(generated),
 		write: input.write,
-		json: input.json
+		json: input.json,
+		retireOut: input.retireOut,
+		...input.io.now === void 0 ? {} : { now: input.io.now() }
 	});
 }
 /** `verify --introspect` with `--helpers-only`: helpers and seeds exactly, hand-written policies by their keys. */
@@ -2471,7 +2871,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./rls-import-4lLW_pbb.js");
+			const { runRlsImport } = await import("./import-BFIlhetD.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,