permdock 0.3.1 → 0.5.0

package/dist/{rls-DiinlRML.js → rls-j6t43t7n.js}

@@ -1,27 +1,33 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { _ as listPermissions, y as renamedKeys } from "./permissions-DVoF6dMt.js";
-import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { E as listRoles, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { h as scopeField } from "./validity-uOp8UpYn.js";
-import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-Br4jSNVi.js";
+import { i as dateAt } from "./time-DkWjdL98.js";
+import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { p as scopeField } from "./tenancy-DN2QAx9z.js";
+import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-CWTY6uih.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { c as requirePolicy } from "./load-DFS_ry0W.js";
 import "./budget-NbEtbJC_.js";
-import { n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import "./sources-4p0-4xQm.js";
-import { i as SEEDS_MARKER, r as INDEXES_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
-import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-Bj3iDH2I.js";
-import { $ as sessionLiveHelperSql, G as quoteIdent$1, K as quoteLiteral, Q as scopeTypeOf, R as memberIdsHelper, T as graphSqlName, U as permittedIdsHelper, V as parseMembershipsFlag, W as qualifiedTable$1, X as scopeSources, Z as scopeTable, f as SESSION_LIVE_HELPER, o as qualified$1, q as quoteTable, r as HELPERS, rt as subjectIdSql, tt as subjectClaimJsonSql, w as graphHelper, y as checkSuspension } from "./rls-shared-Cewd_-zI.js";
-import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-CZOMlwHl.js";
-import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-CHwx0V8q.js";
-import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-DcYlZ09B.js";
-import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-ntETYCQu.js";
-import { n as runRlsVerify } from "./rls-verify-CMv9H3wV.js";
-import { t as supautilsRejections } from "./supautils-u8jXTGrt.js";
-import { basename, delimiter, join, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
-//#region src/cli/rls-advisors.ts
+import { i as qualifySqlTable, r as escapeSqlIdent, u as sqlTextArray } from "./sql-B5T1IL83.js";
+import { l as roleColumn } from "./sources-vs5dGOsS.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-DzhEc3Y9.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-C6joDI3o.js";
+import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-C8swJ2GH.js";
+import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
+import { t as fetchProjectPolicy } from "./pull-BgIfno6w.js";
+import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
+import { c as approvalsSql, d as resolveAuthorize, h as schemasRefusal, l as parseRbacAuthorize, m as resolveSchemas, o as supabaseHookSql, p as isSupabaseSchemas, s as permissionHoldersSql, t as grantsLabel, u as rbacScaffold } from "./supabase-hook-DdDQhMlw.js";
+import { C as parseMembershipsFlag, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent$1, O as tenantTypeOf, P as quoteLiteral, _ as subjectClaimJsonSql, a as customRolesOn, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-CD11nBbC.js";
+import { a as splitUndiffed } from "./deciding-columns-Sq12mEA6.js";
+import { a as readOnlyActorKinds, c as branchClauses, d as connectPgPool, i as orSql, n as actorMayWriteSql, o as readOnlyActorPolicies, r as assemblePolicies, t as ACTOR_MAY_WRITE } from "./policies-CO1oOymN.js";
+import { $ as checkSuspension, A as roleNames, D as breakGlassHolder, E as apiKeysPlan, F as graphHelper, I as graphSqlName, O as breakGlassKey, S as byKey, W as memberIdsHelper, X as scopeTable, Y as scopeSources, _ as currentKeyExpr, f as permittedByPermissionHelper, g as seedSql, h as helpersSql, i as assignmentSql, k as collectGrants, m as accessSql, n as ownershipSql, q as permittedIdsHelper, t as ownershipRules, u as permissionHelpersSql, x as byCodeUnit } from "./ownership-BatFgAA4.js";
+import { _ as indexesSql, a as graphSql, c as callsHelper, g as indexTargets, h as COLUMNS_SQL, i as graphPlan, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as closureDepths, v as pruneIndexTargets, y as readTableIndexFacts } from "./verify-DbCL9bnB.js";
+import { a as fieldViewsSql, i as fieldViews, n as columnGrantSql, o as rowBranches, r as columnRevokeSql } from "./fields-D9tPVUUS.js";
+import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
+import { basename, delimiter, join } from "node:path";
+import { spawn } from "node:child_process";
+//#region src/cli/rls/advisors.ts
 /** The PermDock doctor check that reports the same problem in migrations. */
 const ADVISOR_CODES = {
 	function_search_path_mutable: "PD048",
@@ -31,19 +37,41 @@ const ADVISOR_CODES = {
 	anon_security_definer_function_executable: "PD049",
 	authenticated_security_definer_function_executable: "PD046"
 };
-const defaultExec = (command, args, options) => {
-	const result = spawnSync(command, [...args], {
+const defaultExec = (command, args, options) => new Promise((resolve) => {
+	const child = spawn(command, [...args], {
 		cwd: options.cwd,
 		env: options.env,
-		encoding: "utf8"
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		...options.signal === void 0 ? {} : { signal: options.signal }
 	});
-	return {
-		status: result.status,
-		stdout: result.stdout ?? "",
-		stderr: result.stderr ?? "",
-		...result.error === void 0 ? {} : { error: result.error }
-	};
-};
+	let stdout = "";
+	let stderr = "";
+	child.stdout.setEncoding("utf8").on("data", (chunk) => {
+		stdout += chunk;
+	});
+	child.stderr.setEncoding("utf8").on("data", (chunk) => {
+		stderr += chunk;
+	});
+	child.once("error", (error) => {
+		resolve({
+			status: null,
+			stdout,
+			stderr,
+			error
+		});
+	});
+	child.once("close", (status) => {
+		resolve({
+			status,
+			stdout,
+			stderr
+		});
+	});
+});
 function text(value, key) {
 	const field = typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
 	return typeof field === "string" ? field : "";
@@ -64,16 +92,19 @@ function findingsOf(value) {
 		return code === void 0 ? finding : Object.assign(finding, { code });
 	});
 }
-const INSTALL = "rls verify --advisors runs the Supabase CLI: install it with npm install --save-dev supabase (or brew install supabase/tap/supabase)";
+function installHint(agent) {
+	return `rls verify --advisors runs the Supabase CLI: install it with ${addLine(agent, ["supabase"], { dev: true })} (or brew install supabase/tap/supabase)`;
+}
 /**
-* `supabase db advisors --type security` against `--db` or the local stack.
-* Exit 1 on a WARN or ERROR row, 2 when the CLI is missing or fails.
+* `supabase db advisors --type security` against `--db-url` or the local stack,
+* from the project's `node_modules/.bin` first, then `PATH`. Exit 1 on a WARN
+* or ERROR row, 2 when the CLI is missing or fails.
 */
-function runRlsAdvisors(input) {
+async function runRlsAdvisors(input) {
 	const exec = input.exec ?? defaultExec;
 	const bin = join(input.cwd, "node_modules", ".bin");
 	const path = input.env["PATH"];
-	const result = exec("supabase", [
+	const result = await exec("supabase", [
 		"db",
 		"advisors",
 		...input.db === void 0 ? ["--local"] : ["--db-url", input.db],
@@ -86,11 +117,12 @@ function runRlsAdvisors(input) {
 		env: {
 			...input.env,
 			PATH: path === void 0 ? bin : `${bin}${delimiter}${path}`
-		}
+		},
+		...input.signal === void 0 ? {} : { signal: input.signal }
 	});
 	if (result.error !== void 0) return {
 		code: 2,
-		output: INSTALL
+		output: installHint(await packageManagerOf(input.cwd))
 	};
 	let parsed;
 	try {
@@ -127,578 +159,487 @@ function runRlsAdvisors(input) {
 	};
 }
 //#endregion
-//#region src/cli/approval-schema.ts
-/** An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no `format`. */
-const INSTANT = String.raw`^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$`;
-const STRINGS = {
-	type: "array",
-	items: { type: "string" }
-};
-/**
-* `schemas/approval-request-v1.json`: the `ApprovalRequest` an approval store
-* holds. Self-contained (`$defs`, no remote `$ref`) so `rls.jsonSchema` can
-* inline it into a pg_jsonschema check constraint.
-*/
-const APPROVAL_REQUEST_SCHEMA = {
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	$id: "https://permdock.com/schemas/approval-request-v1.json",
-	title: "PermDock approval request",
-	description: "An ApprovalRequest as an ApprovalStore holds it, wire format v1. Unknown properties are allowed so a v1 minor release can add one.",
-	type: "object",
-	required: [
-		"v",
-		"token",
-		"permission",
-		"scope",
-		"resource",
-		"subject",
-		"detail",
-		"createdAt",
-		"expiresAt",
-		"status"
-	],
-	properties: {
-		v: { const: 1 },
-		token: {
-			type: "string",
-			minLength: 1
-		},
-		permission: {
-			type: "string",
-			minLength: 1
-		},
-		scope: { type: "string" },
-		resource: {
-			type: "object",
-			required: ["type"],
-			properties: {
-				type: { type: "string" },
-				id: { type: "string" }
-			}
-		},
-		subject: { $ref: "#/$defs/subject" },
-		membership: {
-			type: "object",
-			required: ["roles"],
-			properties: { roles: STRINGS }
-		},
-		approvers: { type: "object" },
-		detail: { type: "string" },
-		adapter: { type: "string" },
-		createdAt: { $ref: "#/$defs/instant" },
-		expiresAt: { $ref: "#/$defs/instant" },
-		status: { enum: [
-			"pending",
-			"approved",
-			"rejected",
-			"expired"
-		] },
-		approvals: {
-			type: "array",
-			items: { $ref: "#/$defs/signature" }
-		},
-		resolvedAt: { $ref: "#/$defs/instant" },
-		resolvedBy: { type: "string" },
-		vouched: { type: "string" },
-		note: { type: "string" },
-		consumedAt: { $ref: "#/$defs/instant" }
-	},
-	$defs: {
-		instant: {
-			type: "string",
-			pattern: INSTANT
-		},
-		subject: {
-			type: "object",
-			required: ["principal"],
-			properties: {
-				principal: { anyOf: [{ type: "null" }, {
-					type: "object",
-					required: ["id", "roles"],
-					properties: {
-						id: { type: "string" },
-						roles: STRINGS,
-						tenant: { type: "string" }
-					}
-				}] },
-				actor: {
-					type: "object",
-					required: ["id", "kind"],
-					properties: {
-						id: { type: "string" },
-						kind: { type: "string" }
-					}
-				},
-				session: { type: "string" },
-				delegation: { type: "object" }
-			}
+//#region src/cli/rls/generate-context.ts
+/** The scopes an `rls.migrate` `role` helper names, so `rls generate` writes their role-filtered member helper. */
+function roleMemberScopesOf(migrate) {
+	const scopes = [...new Set(Object.values(migrate?.helpers ?? {}).flatMap((helper) => helper.form === "role" ? [helper.scope] : []))].toSorted();
+	return scopes.length === 0 ? {} : { roleMemberScopes: scopes };
+}
+/** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
+function writeRequirement(policy, requires) {
+	if (requires === void 0) return {};
+	const leaves = listPermissions(policy.permissions);
+	const keys = requires === "manageRoles" ? leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key) : [...requires];
+	if (keys.length === 0) return { error: requires === "manageRoles" ? "rls.customRoleWrites.requires is 'manageRoles', but no permission declares meta.manageRoles" : "rls.customRoleWrites.requires names no permission" };
+	const known = new Set(leaves.map((leaf) => leaf.key));
+	const unknown = keys.filter((key) => !known.has(key));
+	if (unknown.length > 0) return { error: `rls.customRoleWrites.requires names undeclared permissions: ${unknown.join(", ")}` };
+	return { keys: [...new Set(keys)].toSorted() };
+}
+/** Declared role names, and those a tenant admin may compose into custom roles. */
+function customRoleNames(policy, requires) {
+	const declared = [...roleNames(policy)].toSorted();
+	const assignable = declared.filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
+	const renamed = renamedKeys(policy.vocabulary.permissions);
+	const leaves = listPermissions(policy.permissions);
+	const manage = leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key);
+	return {
+		declared,
+		assignable,
+		...renamed.size === 0 ? {} : { renamed: Object.fromEntries(renamed) },
+		permissions: leaves.map((leaf) => leaf.key).toSorted(),
+		...manage.length === 0 ? {} : { manage: manage.toSorted() },
+		...requires === void 0 ? {} : { requires },
+		...policy.levels === void 0 ? {} : { levels: true }
+	};
+}
+function skippedOwnershipTriggers(triggers, scopes) {
+	if (triggers === false) return "all";
+	return Object.keys(triggers).map((key) => {
+		const name = resolveScope(scopes, key);
+		if (name === void 0) throw configError(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
+		return name;
+	});
+}
+/** The SQL context every emitter reads, from the flags, `rls` config and the policy. */
+function buildContext(input, policy, options) {
+	const rls = input.config.rls;
+	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
+	if (input.rbac && input.dialect !== "supabase") return { refusal: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})` };
+	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
+	const authorize = resolveAuthorize(input.config, {
+		authorize: input.authorize,
+		rbac: input.rbac,
+		memberships
+	});
+	const memberSources = rls?.membershipSources ?? input.config.supabase?.hook?.memberships;
+	const sources = authorize === "database" ? memberSources : void 0;
+	const scopes = scopeList(policy.scopes);
+	const suspension = checkSuspension(rls?.suspension, scopes);
+	const hookRoles = input.config.supabase?.hook?.roles;
+	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
+	if (roles !== void 0 && input.rbac) return { refusal: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag" };
+	const requires = writeRequirement(policy, rls?.customRoleWrites?.requires);
+	if (requires.error !== void 0) return { refusal: requires.error };
+	const readers = rls?.trustedReaders;
+	if (readers !== void 0 && (!Array.isArray(readers) || !readers.every((name) => typeof name === "string" && name !== ""))) return { refusal: "rls.trustedReaders must list Postgres role names, such as ['service_role']" };
+	const ownership = ownershipRules(policy, scopes);
+	const graph = graphPlan(policy);
+	const apiKeys = apiKeysPlan(rls?.apiKeys, new Set(roleNames(policy)), Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
+	return {
+		ctx: {
+			dialect: input.dialect,
+			scopes,
+			tenantClaim: rls?.tenantClaim ?? "tenant_id",
+			...roleMemberScopesOf(rls?.migrate),
+			...rls?.roleValues === void 0 ? {} : { roleValues: rls.roleValues },
+			...rls?.tenants === "all" ? { tenants: "all" } : {},
+			gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
+			...rls?.actions === void 0 ? {} : { actions: rls.actions },
+			inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
+			schema,
+			authorize,
+			roleClaim: rls?.roleClaim ?? "user_role",
+			tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
+			...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+			...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
+			...memberships === void 0 ? {} : { memberships },
+			...sources === void 0 || sources.length === 0 ? {} : { sources },
+			...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
+			...suspension === void 0 ? {} : { suspension },
+			...roles === void 0 ? {} : { roles },
+			...input.customRoles === true || customRolesOn(rls) ? { customRoles: {
+				...customRoleNames(policy, requires.keys),
+				...rls?.customRoleWrites?.roles === void 0 ? {} : { table: rls.customRoleWrites.roles }
+			} } : {},
+			...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
+			...apiKeys === void 0 ? {} : { apiKeys },
+			...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
+			...ownership === void 0 ? {} : { ownership },
+			...rls?.ownershipTriggers === void 0 ? {} : { skipOwnershipTriggers: skippedOwnershipTriggers(rls.ownershipTriggers, scopes) },
+			...rls?.assignments === void 0 ? {} : { assignments: rls.assignments === true ? { tables: [] } : {
+				tables: rls.assignments.tables ?? [],
+				...rls.assignments.ownRole === void 0 ? {} : { ownRole: rls.assignments.ownRole }
+			} },
+			...options.fieldsMode === void 0 ? {} : { fields: options.fieldsMode },
+			...graph.size === 0 ? {} : { graph: {
+				closures: closureDepths(graph),
+				resources: policy.resources,
+				...rls?.tables === void 0 ? {} : { tables: rls.tables }
+			} }
 		},
-		signature: {
-			type: "object",
-			required: ["by", "at"],
-			properties: {
-				by: { type: "string" },
-				at: { $ref: "#/$defs/instant" },
-				stage: {
-					type: "integer",
-					minimum: 0
-				},
-				vouched: { type: "string" }
-			}
-		}
-	}
-};
-//#endregion
-//#region src/cli/rls-approvals.ts
-/** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
-const APPROVAL_STORE = {
-	table: "approval_requests",
-	open: "permdock_approval_open",
-	get: "permdock_approval_get",
-	resolve: "permdock_approval_resolve",
-	consume: "permdock_approval_consume",
-	list: "permdock_approval_list",
-	expire: "permdock_approval_expire",
-	cancel: "permdock_approval_cancel"
-};
-/** `body` as the row's filter columns hold it. */
-const COLUMNS = `p_request ->> 'token',
-    p_request,
-    p_request ->> 'status',
-    p_request #>> '{subject,principal,tenant}',
-    p_request #>> '{subject,principal,id}',
-    p_request #>> '{subject,actor,id}',
-    p_request #>> '{subject,session}',
-    coalesce(jsonb_array_length(p_request -> 'approvals'), 0),
-    p_request ->> 'createdAt',
-    (p_request ->> 'expiresAt')::timestamptz,
-    (p_request ->> 'consumedAt')::timestamptz`;
-/** The `ApprovalListFilter` in `p_filter`, over the row aliased `a`. */
-const FILTER = `(p_filter ->> 'status' is null or a.status = p_filter ->> 'status')
-    and (p_filter ->> 'tenant' is null or a.tenant = p_filter ->> 'tenant')
-    and (p_filter ->> 'principalId' is null or a.principal_id = p_filter ->> 'principalId')
-    and (p_filter ->> 'actorId' is null or a.actor_id = p_filter ->> 'actorId')
-    and (p_filter ->> 'session' is null or a.session = p_filter ->> 'session')`;
-function serverOnly(fn, args) {
-	return `revoke execute on function ${fn}(${args}) from public, anon, authenticated;`;
-}
-const BODY_CHECK = `${APPROVAL_STORE.table}_body_schema`;
-/**
-* `rls.jsonSchema`: a pg_jsonschema check that `body` matches
-* `approval-request-v1.json`, added `not valid` and then validated. `auto`
-* adds it only where the extension is available.
-*/
-function bodySchemaSql(table, mode, body = "body", check = BODY_CHECK) {
-	const statements = [
-		"create schema if not exists extensions;",
-		"create extension if not exists pg_jsonschema with schema extensions;",
-		`alter table ${table} drop constraint if exists "${check}";`,
-		`alter table ${table} add constraint "${check}" check (extensions.jsonb_matches_schema(${quoteLiteral(JSON.stringify(APPROVAL_REQUEST_SCHEMA))}::json, ${body})) not valid;`,
-		`alter table ${table} validate constraint "${check}";`
-	];
-	const comment = "-- approval store: body matches schemas/approval-request-v1.json through pg_jsonschema";
-	if (mode === true) return `\n${comment}\n${statements.join("\n")}\n`;
-	return `\n${comment}, where the extension is available
-do $permdock$
-begin
-  if exists (select 1 from pg_available_extensions where name = 'pg_jsonschema') then
-${statements.map((statement) => `    ${statement}`).join("\n")}
-  end if;
-end
-$permdock$;\n`;
+		graph,
+		ownership,
+		schema,
+		authorize
+	};
 }
-/**
-* The approval store (`rls.approvals`): one table of `ApprovalRequest`
-* bodies with the columns a list filters on, and one `security definer`
-* function per `ApprovalStore` method, each one atomic statement. No client
-* role may read the table or execute the functions: approvals are opened and
-* resolved by the server, which grants its own role.
-*/
-function approvalStoreSql(ctx, jsonSchema = false) {
-	const table = qualified$1(ctx, APPROVAL_STORE.table);
-	const fn = (name) => qualified$1(ctx, name);
-	const index = (name) => `"${APPROVAL_STORE.table}_${name}"`;
-	return `-- approval store: ApprovalRequest bodies, opened, resolved and consumed through the functions below; supabaseApprovalStore calls them
-create table if not exists ${table} (
-  token text primary key,
-  body jsonb not null,
-  status text not null check (status in ('pending', 'approved', 'rejected', 'expired')),
-  tenant text,
-  principal_id text,
-  actor_id text,
-  session text,
-  approvals integer not null default 0,
-  created_at text not null,
-  expires_at timestamptz not null,
-  consumed_at timestamptz
-);
-create index if not exists ${index("page")} on ${table} (created_at collate "C", token collate "C");
-create index if not exists ${index("pending")} on ${table} (status, expires_at);
-alter table ${table} enable row level security;
-revoke all on table ${table} from anon, authenticated, public;
-${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema)}
--- open a request; a repeated ask keeps the open record and replaces only an expired one
-create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
-returns void
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  insert into ${table} as a (token, body, status, tenant, principal_id, actor_id, session, approvals, created_at, expires_at, consumed_at)
-  values (
-    ${COLUMNS}
-  )
-  on conflict (token) do update
-    set body = excluded.body, status = excluded.status, tenant = excluded.tenant,
-      principal_id = excluded.principal_id, actor_id = excluded.actor_id, session = excluded.session,
-      approvals = excluded.approvals, created_at = excluded.created_at,
-      expires_at = excluded.expires_at, consumed_at = excluded.consumed_at
-    where a.status = 'expired' or a.expires_at <= now()
-$$;
-${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
-
-create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
-returns jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.body from ${table} a where a.token = p_token
-$$;
-${serverOnly(fn(APPROVAL_STORE.get), "text")}
-
--- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
-create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set body = p_next,
-    status = p_next ->> 'status',
-    approvals = coalesce(jsonb_array_length(p_next -> 'approvals'), 0)
-  where a.token = p_token
-    and a.status = 'pending'
-    and a.expires_at > now()
-    and a.approvals = p_seen
-  returning a.body
-$$;
-${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
-
--- consume an approved, unexpired, unconsumed request once
-create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set consumed_at = p_now::timestamptz,
-    body = a.body || jsonb_build_object('consumedAt', p_now)
-  where a.token = p_token
-    and a.status = 'approved'
-    and a.consumed_at is null
-    and a.expires_at > p_now::timestamptz
-  returning a.body
-$$;
-${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
-
--- one page in (createdAt, token) order after the cursor position
-create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
-returns setof jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.body
-  from ${table} a
-  where ${FILTER}
-    and (p_after_created is null
-      or (a.created_at collate "C", a.token collate "C") > (p_after_created collate "C", p_after_token collate "C"))
-  order by a.created_at collate "C", a.token collate "C"
-  limit p_limit
-$$;
-${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
-
-create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with expired as (
-    update ${table} a
-    set status = 'expired', body = a.body || '{"status":"expired"}'::jsonb
-    where a.status = 'pending' and a.expires_at <= p_now::timestamptz
-    returning 1
-  )
-  select count(*)::integer from expired
-$$;
-${serverOnly(fn(APPROVAL_STORE.expire), "text")}
-
--- reject every pending request the filter matches, as system:<by>
-create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with cancelled as (
-    update ${table} a
-    set status = 'rejected',
-      body = (a.body - 'note') || jsonb_strip_nulls(jsonb_build_object(
-        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
-      ))
-    where a.status = 'pending'
-      and ${FILTER.replaceAll("\n    ", "\n      ")}
-    returning 1
-  )
-  select count(*)::integer from cancelled
-$$;
-${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
-`;
+//#endregion
+//#region src/cli/rls/generate-options.ts
+function isRefusal(value) {
+	return "refusal" in value;
 }
-/** The request fields an adopted table may mirror into its own columns, as SQL over a body. */
-const MIRRORS = {
-	status: (body) => `${body} ->> 'status'`,
-	permission: (body) => `${body} ->> 'permission'`,
-	tenant: (body) => `${body} #>> '{subject,principal,tenant}'`,
-	principalId: (body) => `${body} #>> '{subject,principal,id}'`,
-	actorId: (body) => `${body} #>> '{subject,actor,id}'`,
-	session: (body) => `${body} #>> '{subject,session}'`,
-	approvals: (body) => `coalesce(jsonb_array_length(${body} -> 'approvals'), 0)`,
-	createdAt: (body) => `${body} ->> 'createdAt'`,
-	expiresAt: (body) => `${body} ->> 'expiresAt'`,
-	resolvedAt: (body) => `${body} ->> 'resolvedAt'`,
-	resolvedBy: (body) => `${body} ->> 'resolvedBy'`,
-	consumedAt: (body) => `${body} ->> 'consumedAt'`
-};
-function mirrorsOf(adopt) {
-	const out = [];
-	for (const [field, column] of Object.entries(adopt.mirror ?? {})) {
-		if (!Object.hasOwn(MIRRORS, field)) throw new Error(`PermDock CLI: rls.approvals.mirror.${field} is not a request field; use ${Object.keys(MIRRORS).join(", ")}`);
-		if (typeof column !== "string") throw new TypeError(`PermDock CLI: rls.approvals.mirror.${field} must be a column name`);
-		out.push([column, field]);
-	}
-	return out;
+/** The checks that need no policy: `--fields` and `--revoke-columns`. */
+function generateOptions(input) {
+	const rls = input.config.rls;
+	const fieldsMode = input.fields ?? rls?.fields;
+	if (fieldsMode !== void 0 && fieldsMode !== "views") return { refusal: `rls generate --fields must be views (got ${fieldsMode})` };
+	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
+	if (revokeColumns && fieldsMode === void 0) return { refusal: "rls generate --revoke-columns needs --fields views" };
+	return {
+		fieldsMode,
+		revokeColumns
+	};
 }
-/** One row of `table` from `values` (column, SQL), each converted to the column's own type. */
-function populate(table, values) {
-	return `pg_catalog.jsonb_populate_record(null::${table}, pg_catalog.jsonb_build_object(${values.map(([column, sql]) => `${quoteLiteral(column)}, ${sql}`).join(", ")}))`;
+/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
+function splitsPart(raw, part) {
+	const split = parseSplit(raw);
+	return typeof split !== "string" && split?.includes(part) === true;
 }
-/** The mirrored columns' values for the request `body`. */
-function mirrorRow(table, mirror, body) {
-	return populate(table, mirror.map(([column, field]) => [column, MIRRORS[field](body)]));
+//#endregion
+//#region src/cli/rls/generate-output.ts
+function moveUndiffed(sql, label, part) {
+	const { kept, moved } = splitUndiffed(sql);
+	const [first = "", ...rest] = kept.split("\n");
+	return {
+		sql: [
+			first,
+			`-- what supabase db diff drops from this part is in ${label}`,
+			...rest
+		].join("\n"),
+		grants: `-- the privileges and view options supabase db diff drops from the ${part} part\n${moved.join("\n")}`
+	};
 }
-/** `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty without mirrors. */
-function mirrorSet(table, mirror, body) {
-	if (mirror.length === 0) return "";
-	const columns = mirror.map(([column]) => quoteIdent$1(column));
-	const picked = columns.map((column) => `r.${column}`).join(", ");
-	return `,\n    ${columns.length === 1 ? columns[0] ?? "" : `(${columns.join(", ")})`} = (select ${picked} from ${mirrorRow(table, mirror, body)} r)`;
+/** Why `--split` cannot be written for `mode`, or `undefined`. */
+function splitRefusal(mode, plan) {
+	const seedsWithoutOut = plan.split.includes("seeds") && plan.seedsOut === void 0;
+	const helpersWithoutSeeds = plan.split.includes("helpers") && !plan.split.includes("seeds");
+	switch (mode) {
+		case "pg-delta":
+			if (plan.explicitOut && !plan.placeholder) return `rls generate --split needs {part} in --out, or no --out for pg-delta's per-schema layout (got ${plan.outRel})`;
+			if (plan.grantsOut !== void 0) return "rls generate --grants-out is for --schemas migra: pg-delta keeps the grants in each part, so drop --grants-out";
+			if (helpersWithoutSeeds) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
+			if (seedsWithoutOut) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
+			return;
+		case "migra":
+			if (!plan.placeholder) return `rls generate --split under migra needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
+			if (helpersWithoutSeeds) return "rls generate --split helpers under migra needs the seeds part with --seeds-out: supabase db diff does not carry the role_permissions rows from a schema file";
+			if (seedsWithoutOut) return "rls generate --split seeds under migra needs --seeds-out: supabase db diff does not carry the role_permissions rows, so they go in a migration";
+			return;
+		case "migrations":
+			if (!plan.placeholder) return `rls generate --split needs {part} in --out, for example supabase/migrations/20260101000000_permdock_{part}.sql (got ${plan.outRel})`;
+			if (plan.grantsOut !== void 0) return "rls generate --grants-out is for --schemas migra: a hand-written migration keeps its grants, so drop --grants-out";
+			return;
+		default: return mode;
+	}
 }
-/**
-* The approval store over a table the app already has (`rls.approvals:
-* { table, token?, body?, mirror? }`): the same `permdock_approval_*`
-* functions, reading every field from the request body in `body`, keyed by
-* the text column `token`, and copying the fields `mirror` names into the
-* app's own columns, converted to their types, on every write. The table's
-* grants and policies stay the app's.
-*/
-function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
-	const table = quoteTable(qualifiedTable$1(adopt.table));
-	const base = adopt.table.split(".").at(-1) ?? adopt.table;
-	const token = quoteIdent$1(adopt.token ?? "token");
-	const body = quoteIdent$1(adopt.body ?? "body");
-	const mirror = mirrorsOf(adopt);
-	for (const [column] of mirror) if (column === (adopt.token ?? "token") || column === (adopt.body ?? "body")) throw new Error(`PermDock CLI: rls.approvals.mirror names the ${column} column, which already holds the token or the body`);
-	const open = adopt.open ?? "insert";
-	if (open !== "insert" && open !== "attach") throw new Error(`PermDock CLI: rls.approvals.open must be 'insert' or 'attach', got '${String(open)}'`);
-	const schema = adopt.schema;
-	if (schema !== void 0 && (typeof schema !== "string" || schema === "")) throw new Error("PermDock CLI: rls.approvals.schema must be a schema name");
-	const fn = (name) => schema === void 0 ? qualified$1(ctx, name) : `${quoteIdent$1(schema)}.${name}`;
-	const index = (name) => quoteIdent$1(`${base}_permdock_${name}`);
-	const status = `a.${body} ->> 'status'`;
-	const expires = `(a.${body} ->> 'expiresAt')::timestamptz`;
-	const created = `(a.${body} ->> 'createdAt')`;
-	const filter = `(p_filter ->> 'status' is null or ${status} = p_filter ->> 'status')
-    and (p_filter ->> 'tenant' is null or a.${body} #>> '{subject,principal,tenant}' = p_filter ->> 'tenant')
-    and (p_filter ->> 'principalId' is null or a.${body} #>> '{subject,principal,id}' = p_filter ->> 'principalId')
-    and (p_filter ->> 'actorId' is null or a.${body} #>> '{subject,actor,id}' = p_filter ->> 'actorId')
-    and (p_filter ->> 'session' is null or a.${body} #>> '{subject,session}' = p_filter ->> 'session')`;
-	const columns = [
-		token,
-		body,
-		...mirror.map(([column]) => quoteIdent$1(column))
-	];
-	const inserted = populate(table, [
-		[adopt.token ?? "token", "p_request ->> 'token'"],
-		[adopt.body ?? "body", "p_request"],
-		...mirror.map(([column, field]) => [column, MIRRORS[field]("p_request")])
-	]);
-	const insertSql = `-- open a request; a repeated ask keeps the open record and replaces only an expired one
-create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
-returns void
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  insert into ${table} as a (${columns.join(", ")})
-  select ${columns.map((column) => `r.${column}`).join(", ")}
-  from ${inserted} r
-  on conflict (${token}) do update
-    set ${columns.filter((column) => column !== token).map((column) => `${column} = excluded.${column}`).join(", ")}
-    where ${status} = 'expired' or ${expires} <= now()
-$$;`;
-	const attachSql = `create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
-returns void
-language plpgsql
-volatile
-security definer
-set search_path = ''
-as $$
-begin
-  update ${table} a
-  set ${body} = p_request${mirrorSet(table, mirror, "p_request")}
-  where a.${token} = p_request ->> 'token'
-    and (a.${body} is null or ${status} = 'expired' or ${expires} <= now());
-  if not found and not exists (select 1 from ${table} a where a.${token} = p_request ->> 'token') then
-    raise exception using
-      errcode = 'P0002',
-      message = 'permdock: no row of ${adopt.table.replaceAll("'", "''")} holds approval token ' || (p_request ->> 'token'),
-      hint = 'insert the application row with this token before opening the request';
-  end if;
-end;
-$$;`;
-	return `-- approval store adopted onto ${adopt.table}: ApprovalRequest bodies in ${adopt.body ?? "body"}, keyed by ${adopt.token ?? "token"}; supabaseApprovalStore calls the functions below
-alter table ${table} add column if not exists ${token} text;
-alter table ${table} add column if not exists ${body} jsonb;
-create unique index if not exists ${index("token")} on ${table} (${token});
-create index if not exists ${index("page")} on ${table} ((${body} ->> 'createdAt') collate "C", ${token} collate "C");
-create index if not exists ${index("status")} on ${table} ((${body} ->> 'status'));
-${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema, body, `${base}_permdock_body_schema`)}
-${open === "attach" ? attachSql : insertSql}
-${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
-
-create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
-returns jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.${body} from ${table} a where a.${token} = p_token
-$$;
-${serverOnly(fn(APPROVAL_STORE.get), "text")}
-
--- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
-create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set ${body} = p_next${mirrorSet(table, mirror, "p_next")}
-  where a.${token} = p_token
-    and ${status} = 'pending'
-    and ${expires} > now()
-    and coalesce(jsonb_array_length(a.${body} -> 'approvals'), 0) = p_seen
-  returning a.${body}
-$$;
-${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
-
--- consume an approved, unexpired, unconsumed request once
-create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set ${body} = a.${body} || jsonb_build_object('consumedAt', p_now)${mirrorSet(table, mirror, `(a.${body} || jsonb_build_object('consumedAt', p_now))`)}
-  where a.${token} = p_token
-    and ${status} = 'approved'
-    and a.${body} ->> 'consumedAt' is null
-    and ${expires} > p_now::timestamptz
-  returning a.${body}
-$$;
-${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
-
--- one page in (createdAt, token) order after the cursor position
-create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
-returns setof jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.${body}
-  from ${table} a
-  where a.${body} is not null
-    and ${filter}
-    and (p_after_created is null
-      or (${created} collate "C", a.${token} collate "C") > (p_after_created collate "C", p_after_token collate "C"))
-  order by ${created} collate "C", a.${token} collate "C"
-  limit p_limit
-$$;
-${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
-
-create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with expired as (
-    update ${table} a
-    set ${body} = a.${body} || '{"status":"expired"}'::jsonb${mirrorSet(table, mirror, `(a.${body} || '{"status":"expired"}'::jsonb)`)}
-    where ${status} = 'pending' and ${expires} <= p_now::timestamptz
-    returning 1
-  )
-  select count(*)::integer from expired
-$$;
-${serverOnly(fn(APPROVAL_STORE.expire), "text")}
-
--- reject every pending request the filter matches, as system:<by>
-create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with cancelled as (
-    update ${table} a
-    set ${body} = (a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object(
-        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
-      ))${mirrorSet(table, mirror, `((a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object('status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note)))`)}
-    where ${status} = 'pending'
-      and ${filter.replaceAll("\n    ", "\n      ")}
-    returning 1
-  )
-  select count(*)::integer from cancelled
-$$;
-${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
+/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants under migra. */
+function outputFiles(plan) {
+	const { input } = plan;
+	const split = parseSplit(input.split);
+	if (typeof split === "string") return split;
+	if (split?.includes("policies") === true && plan.helpersOnly) return "rls generate --helpers-only writes no policies part; drop it from --split";
+	if (split === void 0) {
+		if (input.grantsOut !== void 0) return "rls generate --grants-out needs --split with the helpers or hook part";
+		if (input.seedsOut !== void 0) return "rls generate --seeds-out needs --split with the seeds part";
+		return [{
+			part: "rls",
+			rel: plan.outRel,
+			text: plan.text
+		}];
+	}
+	if (input.target !== "sql") return "rls generate --split needs --target sql";
+	const schemas = resolveSchemas(input.cwd, input.config, input.schemas);
+	const pgDelta = schemas.mode === "pg-delta" ? schemas : void 0;
+	const placeholder = plan.outRel.includes("{part}");
+	const refused = splitRefusal(schemas.mode, {
+		split,
+		placeholder,
+		explicitOut: input.out !== void 0,
+		outRel: plan.outRel,
+		grantsOut: input.grantsOut,
+		seedsOut: input.seedsOut
+	});
+	if (refused !== void 0) return refused;
+	const at = (part, schema = plan.schema) => pgDelta === void 0 || placeholder ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
+	if (input.grantsOut !== void 0 && !split.includes("hook") && !split.includes("helpers")) return "rls generate --grants-out needs the helpers or hook part in --split";
+	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
+	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
+	const sql = plan.sql();
+	const relocated = pgDelta === void 0 ? void 0 : sql.servicePolicies;
+	if (relocated !== void 0 && split.includes("policies") && !split.includes("seeds")) return "rls generate --split policies under pg-delta with rls.realtime or rls.storage needs the seeds part with --seeds-out: the declarative sync shadow database has no realtime.messages or storage.objects, so their policies go in that migration";
+	const seeds = relocated === void 0 || !split.includes("policies") ? sql.seeds : `${sql.seeds}\n${relocated}`;
+	const files = [];
+	const label = grantsLabel(input.grantsOut);
+	let grantsMarker = `${GRANTS_MARKER} schema=${plan.schema}`;
+	const grants = [];
+	for (const part of split) switch (part) {
+		case "helpers": {
+			if (label === void 0) {
+				files.push({
+					part,
+					rel: at(part),
+					text: sql.helpers
+				});
+				break;
+			}
+			const moved = moveUndiffed(sql.helpers, label, part);
+			files.push({
+				part,
+				rel: at(part),
+				text: moved.sql
+			});
+			grants.push(moved.grants);
+			break;
+		}
+		case "seeds": {
+			const out = input.seedsOut;
+			if (out !== void 0 && isSeedsDirectory(input.cwd, out)) {
+				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? dateAt());
+				if (!planned.current || input.check) files.push({
+					part,
+					rel: planned.rel,
+					text: seeds
+				});
+				break;
+			}
+			files.push({
+				part,
+				rel: out ?? at(part),
+				text: seeds
+			});
+			break;
+		}
+		case "indexes":
+			files.push({
+				part,
+				rel: at(part),
+				text: sql.indexes
+			});
+			break;
+		case "policies":
+			files.push({
+				part,
+				rel: at(part),
+				text: pgDelta === void 0 ? sql.policies : sql.declarativePolicies
+			});
+			break;
+		case "hook": {
+			const hook = supabaseHookSql(plan.scopes, input.config, {}, label);
+			files.push({
+				part,
+				rel: at(part, hook.manifest.hook.schema),
+				text: hook.sql
+			});
+			const [marker = grantsMarker, ...rest] = hook.grants.split("\n");
+			grantsMarker = marker;
+			grants.push(rest.join("\n").trimEnd());
+			break;
+		}
+		default: return part;
+	}
+	if (input.grantsOut !== void 0) files.push({
+		part: "grants",
+		rel: input.grantsOut,
+		text: `${[grantsMarker, ...grants].join("\n")}\n`
+	});
+	return files;
+}
+//#endregion
+//#region src/cli/rls/backfill.ts
+const PREFIX$1 = "PermDock CLI";
+/** A column of the roles-table row `r`. */
+function col(name) {
+	return `r.${quoteIdent$1(name)}`;
+}
+function schemaOf(table) {
+	return table.includes(".") ? beforeFirst(table, ".") : "public";
+}
+/** The roles-table column a reference joins on, after checking it points at `roles`. */
+function roleRef(role, table, roles, label) {
+	const pairs = Object.entries(role.on);
+	const [pair] = pairs;
+	if (pair === void 0 || pairs.length !== 1) throw configError(`${PREFIX$1}: ${label}.on must map exactly one column of ${table} to ${role.through}, for example { role_id: 'id' }`);
+	const through = role.through.includes(".") ? role.through : `${schemaOf(table)}.${role.through}`;
+	if (qualifySqlTable(through) !== qualifySqlTable(roles.table)) throw configError(`${PREFIX$1}: ${label}.through must be rls.customRoleWrites.roles.table (${roles.table}), got ${role.through}`);
+	if (role.column !== roles.key) throw configError(`${PREFIX$1}: ${label}.column must be rls.customRoleWrites.roles.key (${roles.key}), got ${role.column}`);
+	const [ref, id] = pair;
+	return {
+		ref,
+		id
+	};
+}
+/**
+* A legacy key as SQL the way `mapKey` maps it: `rls.migrate.keys`, then
+* `renamed`, then the longest `rls.migrate.prefixes` match, and a former key
+* read as its current key.
+*/
+function legacyKeySql(expr, migrate, renamed) {
+	const exact = new Map(Object.entries(renamed));
+	for (const [from, to] of Object.entries(migrate?.keys ?? {})) exact.set(from, to);
+	const prefixes = Object.entries(migrate?.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length || byCodeUnit(a, b));
+	const prefixed = prefixes.length === 0 ? expr : `(case ${prefixes.map(([from, to]) => `when left(${expr}, ${String(from.length)}) = ${quoteLiteral(from)} then ${quoteLiteral(to)} || substr(${expr}, ${String(from.length + 1)})`).join(" ")} else ${expr} end)`;
+	const mapped = exact.size === 0 ? prefixed : `(case ${expr} ${[...exact.entries()].toSorted(byKey).map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else ${prefixed} end)`;
+	const renames = Object.entries(renamed).toSorted(byKey);
+	return currentKeyExpr(renames, mapped);
+}
+function sourceSql(source, table, label) {
+	return roleColumn(source, table, "x", {
+		label,
+		prefix: PREFIX$1
+	}).lookup;
+}
+/**
+* The `--backfill-out` migration: every custom role in the application's
+* roles table that has no rows in `custom_role_permissions` or
+* `custom_role_includes` yet is saved through
+* `permdock_trusted_replace_custom_role_grants`, with the entries PermDock
+* cannot hold left out and listed in one warning. Running it again copies
+* nothing, so a role edited after the copy keeps its edits.
+*/
+function backfillSql(ctx, from, migrate) {
+	const custom = ctx.customRoles;
+	const root = ctx.scopes[0]?.name;
+	if (custom === void 0 || root === void 0) throw configError(`${PREFIX$1}: rls.customRoles.from needs custom roles on`);
+	if (ctx.authorize !== "database") throw configError(`${PREFIX$1}: rls.customRoles.from needs database mode; in jwt mode custom roles ride the token, so build the grants claim with customRoleClaim`);
+	const roles = custom.table;
+	if (roles === void 0) throw configError(`${PREFIX$1}: rls.customRoles.from needs rls.customRoleWrites.roles, the roles table each row belongs to`);
+	const leveled = custom.levels === true;
+	if (from.permissions.level !== void 0 && !leveled) throw configError(`${PREFIX$1}: rls.customRoles.from.permissions.level is set, but no resource declares levels`);
+	const tenantType = tenantTypeOf(ctx);
+	const rolesTable = quoteQualified(roles.table);
+	const tenant = roles.tenant === void 0 ? `null::${tenantType}` : `${col(roles.tenant)}::${tenantType}`;
+	const scope = roles.scope === void 0 ? `case when ${tenant} is null then 'global' else ${quoteLiteral(root)} end` : `case when ${tenant} is null then 'global' else ${col(roles.scope)}::text end`;
+	const scopeId = roles.id === void 0 ? "null::text" : `${col(roles.id)}::text`;
+	const skipped = roles.skip === void 0 ? "false" : `coalesce(${col(roles.skip)}, false)`;
+	const renamed = custom.renamed ?? {};
+	const renames = Object.entries(renamed).toSorted(byKey);
+	const current = (expr) => currentKeyExpr(renames, expr);
+	const known = sqlTextArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
+	const declared = sqlTextArray(custom.declared);
+	const scopes = sqlTextArray(ctx.scopes.map((item) => item.name));
+	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
+	const rp = qualified(ctx, "role_permissions");
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const replace = qualified(ctx, CUSTOM_ROLES.trustedReplace);
+	const p = from.permissions;
+	const pTable = qualifySqlTable(p.table);
+	const pRef = roleRef(p.role, p.table, roles, "rls.customRoles.from.permissions.role");
+	const legacy = sourceSql(p.permission, pTable, "rls.customRoles.from.permissions.permission");
+	const effect = p.effect === void 0 ? "'allow'" : `coalesce(lower(x.${quoteIdent$1(p.effect)}::text), 'allow')`;
+	const level = p.level === void 0 ? "null::text" : `nullif(x.${quoteIdent$1(p.level)}::text, '')`;
+	const inCeiling = (key) => `exists (select 1 from ${ceiling} c where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = ${key})`;
+	const levelCheck = leveled ? `
+          when m.effect = 'allow' and m.level is not null and not exists (
+            select 1 from ${ceiling} c
+            where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = m.key
+              and split_part(c.grant_key, '@', 2) = m.level
+          ) then 'level ' || m.level || ' is not declared'` : "";
+	const allowEntry = leveled ? "j.key || coalesce('@' || j.level, '')" : "j.key";
+	const i = from.includes;
+	const iTable = i === void 0 ? void 0 : qualifySqlTable(i.table);
+	const iRef = i === void 0 || iTable === void 0 ? void 0 : roleRef(i.role, i.table, roles, "rls.customRoles.from.includes.role");
+	const included = i === void 0 || iTable === void 0 ? void 0 : sourceSql(i.include, iTable, "rls.customRoles.from.includes.include");
+	const refs = [`${col(pRef.id)} as permissions_ref`, ...iRef === void 0 ? [] : [`${col(iRef.id)} as includes_ref`]].join(", ");
+	const includeBlock = i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 ? "    v_include := null;" : `    with raw as (
+      select ${included} as role
+      from ${quoteTable(iTable)} x
+      where x.${quoteIdent$1(iRef.ref)} = v.includes_ref
+    ),
+    judged as (
+      select n.role, case
+          when n.role is null or not (n.role = any(${declared})) then 'not a declared role'
+          when exists (
+            select 1 from ${rp} rp
+            where rp.role = n.role and rp.effect = 'allow'
+              and not ${inCeiling(current("rp.permission"))}
+          ) then 'allows permissions outside the ceiling of ' || v.scope
+        end as dropped
+      from raw n
+    )
+    select array_agg(distinct j.role) filter (where j.dropped is null),
+      array_agg(v.role || ': includes ' || coalesce(j.role, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
+    into v_include, v_lost
+    from judged j;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
+	return `${BACKFILL_MARKER} schema=${ctx.schema ?? "permdock"}
+-- custom roles copied from ${qualifySqlTable(roles.table)} (rls.customRoles.from) through ${replace}
+-- a role that already has rows is left as it is; entries PermDock cannot hold are dropped and listed in one warning
+do $permdock$
+declare
+  v record;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_lost text[];
+  v_dropped text[] := '{}'::text[];
+  v_copied integer := 0;
+  v_present integer := 0;
+begin
+  for v in
+    select ${tenant} as tenant_id, ${scope} as scope, ${scopeId} as scope_id, ${col(roles.key)}::text as role, ${refs}
+    from ${rolesTable} r
+    where not ${skipped} and not (${col(roles.key)}::text = any(${declared}))
+    order by 4, 2, 1, 3
+  loop
+    if v.role is null or not (v.scope = 'global' or v.scope = any(${scopes})) then
+      v_dropped := v_dropped || (coalesce(v.role, 'null') || ': scope ' || coalesce(v.scope, 'null') || ' is not declared');
+      continue;
+    end if;
+    if exists (
+      select 1 from ${perms} c
+      where c.tenant_id is not distinct from v.tenant_id and c.scope = v.scope and c.scope_id is not distinct from v.scope_id and c.role = v.role
+    ) or exists (
+      select 1 from ${includes} c
+      where c.tenant_id is not distinct from v.tenant_id and c.scope = v.scope and c.scope_id is not distinct from v.scope_id and c.role = v.role
+    ) then
+      v_present := v_present + 1;
+      continue;
+    end if;
+    with raw as (
+      select ${legacy} as legacy, ${effect} as effect, ${level} as level
+      from ${quoteTable(pTable)} x
+      where x.${quoteIdent$1(pRef.ref)} = v.permissions_ref
+    ),
+    mapped as (
+      select n.legacy, ${legacyKeySql("n.legacy", migrate, renamed)} as key, n.effect, n.level
+      from raw n
+    ),
+    judged as (
+      select m.*, case
+          when m.effect not in ('allow', 'deny') then 'effect ' || m.effect || ' is not allow or deny'
+          when m.key is null or not (m.key = any(${known})) then 'not a declared permission'
+          when m.effect = 'allow' and not ${inCeiling("m.key")} then 'outside the ceiling of ' || v.scope${levelCheck}
+        end as dropped
+      from mapped m
+    )
+    select array_agg(distinct ${allowEntry}) filter (where j.dropped is null and j.effect = 'allow'),
+      array_agg(distinct j.key) filter (where j.dropped is null and j.effect = 'deny'),
+      array_agg(v.role || ': ' || coalesce(j.legacy, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
+    into v_allow, v_deny, v_lost
+    from judged j;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);
+${includeBlock}
+    if v_allow is null and v_deny is null and v_include is null then
+      continue;
+    end if;
+    perform ${replace}(v.tenant_id, v.scope, v.scope_id, v.role, v_allow, v_deny, v_include);
+    v_copied := v_copied + 1;
+  end loop;
+  raise notice 'permdock backfill: copied % custom role(s), % already present', v_copied, v_present;
+  if cardinality(v_dropped) > 0 then
+    raise warning 'permdock backfill: dropped % entr(ies) PermDock cannot hold: %', cardinality(v_dropped), array_to_string(v_dropped[1:50], '; ');
+  end if;
+end
+$permdock$;
 `;
 }
 //#endregion
-//#region src/cli/rls-break-glass.ts
+//#region src/cli/rls/break-glass.ts
 /** The audit table every generated break-glass read writes to. Part of the SQL contract. */
 const BREAK_GLASS_AUDIT = "permdock_break_glass_audit";
-const IDENT = /^[a-z][a-z0-9_]*$/u;
+const IDENT$1 = /^[a-z][a-z0-9_]*$/u;
 /**
 * The resources a `breakGlass` grant targets, with the table each reads. A
 * break-glass grant is non-portable, so `compileGrants` never turns it into a
@@ -747,22 +688,19 @@ function rowsFilter(ctx, entry) {
 		const asked = `p_permission = ${quoteLiteral(grant.permission)}`;
 		if (grant.scope === "anyone") {
 			if (grant.root === void 0) return [`(${asked})`];
-			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified$1(ctx, memberIdsHelper(grant.root))}()))`];
+			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified(ctx, memberIdsHelper(grant.root))}()))`];
 		}
 		if (grant.scope !== "global" && grant.column === void 0) return [];
 		return [`(${asked} and ${accessSql(ctx, grant.scope, breakGlassKey(grant.permission), grant.column)})`];
 	});
 	return arms.length === 0 ? "false" : [...new Set(arms)].join("\n    or ");
 }
-function functionName(resource) {
-	if (!IDENT.test(resource)) throw new Error(`PermDock CLI: unsafe break-glass resource '${resource}'`);
+function functionName$1(resource) {
+	if (!IDENT$1.test(resource)) throw configError(`PermDock CLI: unsafe break-glass resource '${resource}'`);
 	return `permdock_break_glass_${resource}`;
 }
-function qualifiedTable(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
-}
-function auditSql(ctx) {
-	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+function auditSql$1(ctx) {
+	const audit = qualified(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
 	return `-- break-glass audit: one row per session that read restricted data
 -- RLS never compiles a break-glass override, so restricted rows stay denied to a direct read
 create table if not exists ${audit} (
@@ -777,9 +715,9 @@ alter table ${audit} enable row level security;
 revoke all on table ${audit} from anon, authenticated, public;`;
 }
 function readFunctionSql(ctx, entry) {
-	const fn = qualified$1(ctx, functionName(entry.resource));
-	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
-	const table = qualifiedTable(entry.table);
+	const fn = qualified(ctx, functionName$1(entry.resource));
+	const audit = qualified(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+	const table = quoteQualified(entry.table);
 	const session = subjectClaimJsonSql(ctx, "break_glass");
 	const subject = subjectIdSql(ctx);
 	return `-- ${entry.resource}: reads restricted rows through a checked, audited break-glass session
@@ -797,8 +735,8 @@ begin
     or session ->> 'v' <> '1'
     or session ->> 'permission' <> p_permission
     or coalesce(session ->> 'reason', '') = ''
-    or jsonb_typeof(session -> 'expiresAt') <> 'number'
-    or (session ->> 'expiresAt')::numeric <= extract(epoch from now())
+    or jsonb_typeof(session -> 'expires_at') <> 'number'
+    or (session ->> 'expires_at')::numeric <= extract(epoch from now())
   then
     raise exception 'PermDock: no valid break-glass session for %', p_permission
       using errcode = '42501';
@@ -827,10 +765,10 @@ grant execute on function ${fn}(text) to authenticated;`;
 */
 function breakGlassSql(ctx, entries) {
 	if (entries.length === 0) return "";
-	return [auditSql(ctx), ...entries.map((entry) => readFunctionSql(ctx, entry))].join("\n\n");
+	return [auditSql$1(ctx), ...entries.map((entry) => readFunctionSql(ctx, entry))].join("\n\n");
 }
 //#endregion
-//#region src/cli/rls-emit.ts
+//#region src/cli/rls/emit.ts
 const HEADER = "-- generated by permdock rls generate\n-- fail-closed: never target a bypass role\n";
 const TRUSTED_READER_GRANT = /^grant execute on function [^\n]+\.permdock_trusted_role_permissions\([^)\n]*\) to [^\n;]+;$/gmu;
 function assertNoServiceRole(text) {
@@ -855,7 +793,7 @@ function tablesOf(policies) {
 /** Enable (and force) row level security, then the table grants for the commands a policy allows. */
 function tableSql(table, policies, force, views) {
 	const closed = views.find((view) => view.table === table && view.companion !== void 0);
-	const target = quoteTable(qualifiedTable$1(table));
+	const target = quoteQualified(table);
 	const lines = [`alter table ${target} enable row level security;`];
 	if (force) lines.push(`alter table ${target} force row level security;`);
 	lines.push(`revoke all on table ${target} from anon, authenticated;`);
@@ -875,7 +813,7 @@ function tableSql(table, policies, force, views) {
 }
 /** `drop policy if exists` and `create policy` for one policy, without the table's grants. */
 function policySql(item) {
-	const target = quoteTable(qualifiedTable$1(item.table));
+	const target = quoteQualified(item.table);
 	const lines = [
 		`drop policy if exists ${quoteIdent$1(item.name)} on ${target};`,
 		`create policy ${quoteIdent$1(item.name)}`,
@@ -930,7 +868,7 @@ function pascalCase(name) {
 }
 const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
 function identifier(name, what) {
-	if (!IDENTIFIER.test(name)) throw new Error(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
+	if (!IDENTIFIER.test(name)) throw configError(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
 	return name;
 }
 function quoted(text) {
@@ -994,7 +932,7 @@ function emitPrisma(policies, options = {}) {
 		""
 	];
 	for (const item of policies) {
-		if (item.effect === "deny") throw new Error(`PermDock CLI: Prisma policy blocks are permissive only, so ${item.name} (a deny) needs --target sql`);
+		if (item.effect === "deny") throw configError(`PermDock CLI: Prisma policy blocks are permissive only, so ${item.name} (a deny) needs --target sql`);
 		lines.push(`policy_${item.command} ${identifier(item.name, "policy name")} {`, `  target = ${modelOf(item.table)}`, `  roles  = [${item.roles.join(", ")}]`);
 		if (item.using !== void 0) lines.push(`  using  = ${JSON.stringify(item.using)}`);
 		if (item.check !== void 0) lines.push(`  withCheck = ${JSON.stringify(item.check)}`);
@@ -1018,24 +956,24 @@ function defaultOut(target) {
 	}
 }
 //#endregion
-//#region src/cli/rls-realtime-storage.ts
+//#region src/cli/rls/realtime-storage.ts
 const SCOPE_SEGMENT = /^\{([a-z][a-z0-9_]*)\}$/u;
 const LITERAL_SEGMENT = /^[^{}:\s]+$/u;
 const TOPIC = "(select realtime.topic())";
 function policyName(prefix, name, command) {
 	const full = `permdock_${prefix}_${name.replaceAll(/[^A-Za-z0-9]+/gu, "_").replaceAll(/^_|_$/gu, "")}_${command}`;
-	if (new TextEncoder().encode(full).length > 63) throw new Error(`PermDock CLI: the ${prefix} policy name ${full} is longer than Postgres's 63 bytes; shorten '${name}'`);
+	if (new TextEncoder().encode(full).length > 63) throw configError(`PermDock CLI: the ${prefix} policy name ${full} is longer than Postgres's 63 bytes; shorten '${name}'`);
 	return full;
 }
 function grantKey(facts, ref, where, warnings) {
 	if (ref === void 0) return;
 	const key = typeof ref === "object" && ref !== null ? Reflect.get(ref, "key") : ref;
-	if (typeof key !== "string" || !facts.keys.has(key)) throw new Error(`PermDock CLI: ${where} must be a permission reference from the definitions (got ${JSON.stringify(key)})`);
+	if (typeof key !== "string" || !facts.keys.has(key)) throw configError(`PermDock CLI: ${where} must be a permission reference from the definitions (got ${JSON.stringify(key)})`);
 	if (facts.rowConditions.has(key)) warnings.push(`${where} is ${key}, whose grants carry row conditions (a relation, a where or another condition): the policy admits only the instances its role allows without a condition reach, through permitted_<scope>_ids_by_permission`);
 	return key;
 }
 function declaredScope(facts, scope, where) {
-	if (!facts.scopes.has(scope)) throw new Error(`PermDock CLI: ${where} names the scope '${scope}', which definePolicy({ scopes }) does not declare`);
+	if (!facts.scopes.has(scope)) throw configError(`PermDock CLI: ${where} names the scope '${scope}', which definePolicy({ scopes }) does not declare`);
 	return scope;
 }
 /**
@@ -1044,7 +982,7 @@ function declaredScope(facts, scope, where) {
 * relationship or a `where` on the same permission never widens it.
 */
 function permitted(ctx, value, scope, key) {
-	return `${value} in (select x::text from ${qualified$1(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
+	return `${value} in (select x::text from ${qualified(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
 }
 function escapeRegex(text) {
 	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
@@ -1061,7 +999,7 @@ function realtimePolicies(ctx, facts, realtime, warnings) {
 			}];
 		});
 		const [placeholder] = placeholders;
-		if (placeholder === void 0 || placeholders.length > 1 || segments.some((segment, index) => index !== placeholder.index && !LITERAL_SEGMENT.test(segment))) throw new Error(`PermDock CLI: ${where} must be ':'-separated segments with exactly one '{<scope>}' segment, such as 'org:{organization}:chat'`);
+		if (placeholder === void 0 || placeholders.length > 1 || segments.some((segment, index) => index !== placeholder.index && !LITERAL_SEGMENT.test(segment))) throw configError(`PermDock CLI: ${where} must be ':'-separated segments with exactly one '{<scope>}' segment, such as 'org:{organization}:chat'`);
 		const scope = declaredScope(facts, placeholder.scope, where);
 		const regex = `^${segments.map((segment, index) => index === placeholder.index ? "[^:]+" : escapeRegex(segment)).join(":")}$`;
 		const id = `split_part(${TOPIC}, ':', ${String(placeholder.index + 1)})`;
@@ -1070,7 +1008,7 @@ function realtimePolicies(ctx, facts, realtime, warnings) {
     and ${permitted(ctx, id, scope, key)}`;
 		const read = grantKey(facts, topic.read, `${where}.read`, warnings);
 		const write = grantKey(facts, topic.write, `${where}.write`, warnings);
-		if (read === void 0) throw new Error(`PermDock CLI: ${where}.read is required`);
+		if (read === void 0) throw configError(`PermDock CLI: ${where}.read is required`);
 		const policies = [{
 			name: policyName("realtime", pattern, "select"),
 			table: "realtime.messages",
@@ -1092,7 +1030,7 @@ function realtimePolicies(ctx, facts, realtime, warnings) {
 }
 function folderOf(bucket, where) {
 	const folder = bucket.folder ?? 1;
-	if (!Number.isInteger(folder) || folder < 1) throw new Error(`PermDock CLI: ${where}.folder must be a positive integer (got ${String(folder)})`);
+	if (!Number.isInteger(folder) || folder < 1) throw configError(`PermDock CLI: ${where}.folder must be a positive integer (got ${String(folder)})`);
 	return folder;
 }
 function storagePolicies(ctx, facts, storage, warnings) {
@@ -1137,7 +1075,7 @@ function storagePolicies(ctx, facts, storage, warnings) {
 				...command === "select" || command === "delete" ? {} : { check: expression }
 			}];
 		});
-		if (policies.length === 0) throw new Error(`PermDock CLI: ${where} needs read, write or delete`);
+		if (policies.length === 0) throw configError(`PermDock CLI: ${where} needs read, write or delete`);
 		return policies;
 	});
 }
@@ -1151,22 +1089,22 @@ function storagePolicies(ctx, facts, storage, warnings) {
 */
 function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 	if (config.realtime === void 0 && config.storage === void 0) return [];
-	if (ctx.dialect !== "supabase") throw new Error(`PermDock CLI: rls.realtime and rls.storage need --dialect supabase (got ${ctx.dialect})`);
+	if (ctx.dialect !== "supabase") throw configError(`PermDock CLI: rls.realtime and rls.storage need --dialect supabase (got ${ctx.dialect})`);
 	const policies = [...config.realtime === void 0 ? [] : realtimePolicies(ctx, facts, config.realtime, warnings), ...config.storage === void 0 ? [] : storagePolicies(ctx, facts, config.storage, warnings)];
 	const seen = /* @__PURE__ */ new Set();
 	for (const { name } of policies) {
-		if (seen.has(name)) throw new Error(`PermDock CLI: two rls.realtime or rls.storage entries both name the policy ${name}; rename one`);
+		if (seen.has(name)) throw configError(`PermDock CLI: two rls.realtime or rls.storage entries both name the policy ${name}; rename one`);
 		seen.add(name);
 	}
 	return policies;
 }
 //#endregion
-//#region src/cli/rls-rows.ts
+//#region src/cli/rls/rows.ts
 /** `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject may act on with one permission. */
 function rowsHelper(resource) {
 	const name = graphSqlName(resource);
 	const helper = `permitted_${name ?? resource}_rows`;
-	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw new Error(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
+	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
 	return helper;
 }
 /** The branches a row check of a permission reads: its allows and denies on rows that exist, for signed-in callers. */
@@ -1243,7 +1181,7 @@ function inheritTargets(policy) {
 	return [...out].toSorted();
 }
 function stubSql(ctx, resource) {
-	return `create or replace function ${qualified$1(ctx, rowsHelper(resource))}(p_permission text)
+	return `create or replace function ${qualified(ctx, rowsHelper(resource))}(p_permission text)
 returns setof text
 language sql
 stable
@@ -1254,7 +1192,7 @@ as $$
 $$;`;
 }
 function rowSql(ctx, rows, table, where) {
-	const fn = qualified$1(ctx, rows.replace(/_rows$/u, "_row"));
+	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
 	return `create or replace function ${fn}(p_row ${table}, p_permission text)
 returns boolean
 language sql
@@ -1269,8 +1207,8 @@ grant execute on function ${fn}(${table}, text) to authenticated;`;
 }
 function resourceSql(ctx, node, branches, tables) {
 	const name = rowsHelper(node.name);
-	const fn = qualified$1(ctx, name);
-	const table = quoteTable(qualifiedTable$1(tableFor(node.name, tables)));
+	const fn = qualified(ctx, name);
+	const table = quoteQualified(tableFor(node.name, tables));
 	const cases = [...branches.keys()].toSorted().flatMap((key) => {
 		const sql = permissionCase(key, branches.get(key) ?? []);
 		return sql === void 0 ? [] : [sql];
@@ -1293,7 +1231,7 @@ ${rowSql(ctx, name, table, where)}`;
 	if (ctx.dialect === "neon") return rows;
 	return `${rows}
 -- the same rows for a user the caller names, with claims it supplies; no client role may execute it
-${forUserSql(ctx, qualified$1(ctx, `${name}_for`), fn)}`;
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
 }
 /**
 * `permitted_<resource>_rows(p_permission)` for each resource `select`
@@ -1313,14 +1251,96 @@ function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
 	const chunks = called.map((name) => stubSql(ctx, name));
 	for (const name of names) {
 		const node = policy.resources.get(name);
-		if (node === void 0) throw new Error(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
+		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
 		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), tables));
 	}
 	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
 	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
 }
 //#endregion
-//#region src/cli/rls-shims.ts
+//#region src/cli/rls/generate-policies.ts
+const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
+/**
+* A `realtime.messages` or `storage.objects` policy that applies only where
+* the table exists. The Realtime and Storage services create those tables, so
+* a local stack with the service off, and pg-delta's shadow database, have
+* none.
+*/
+function guardedPolicySql(item) {
+	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
+	return `do $permdock$
+begin
+  if to_regclass(${quoteLiteral(qualifySqlTable(item.table))}) is not null then
+${body}
+  end if;
+end
+$permdock$;
+`;
+}
+/** Appends the `realtime.messages` and `storage.objects` policies, which never get `tableSql`. */
+function withHelperTables(sql, helperTables) {
+	if (helperTables === void 0) return sql;
+	const tables = `${helperTables.trimEnd()}\n`;
+	return sql.trim() === "" ? tables : `${sql.trimEnd()}\n\n${tables}`;
+}
+function databaseModeWarnings(policy, { ctx }, warnings) {
+	if (ctx.authorize !== "database") return;
+	for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
+}
+/** The grants compiled into table policies, and the Realtime and Storage policies beside them. */
+function generatePolicies(input, policy, options, built, warnings) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const { fieldsMode, revokeColumns } = options;
+	databaseModeWarnings(policy, built, warnings);
+	const compiled = compileGrants(policy, ctx, rls?.tables, warnings, input.skipClosures, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0);
+	const helpersOnly = input.helpersOnly === true || rls?.helpersOnly === true;
+	if (helpersOnly && (input.target !== "sql" || revokeColumns)) return { refusal: "rls generate --helpers-only needs --target sql and no --revoke-columns: the table grants are hand-written, so revoke the restricted columns there" };
+	const views = fieldsMode === void 0 ? [] : fieldViews(policy, ctx, compiled.branches, {
+		revokeColumns,
+		helpersOnly
+	}, warnings);
+	const force = input.force === true || rls?.force === true;
+	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
+	const policyName = input.policyName ?? rls?.policyName;
+	const assembled = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
+		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
+		...policyName === void 0 ? {} : { name: policyName }
+	});
+	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
+	if (actorKinds !== void 0 && helpersOnly) warnings.push(`rls.readOnlyActors with --helpers-only writes no policies: add \`and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())\` to each hand-written insert, update and delete policy, or a restrictive policy that calls it`);
+	const withActors = (items) => actorKinds === void 0 ? items : [...items, ...readOnlyActorPolicies(items, subjectClaimJsonSql(ctx, "act"), actorKinds)];
+	let tablePolicies;
+	try {
+		tablePolicies = realtimeStoragePolicies(ctx, {
+			scopes: new Set(ctx.scopes.map((scope) => scope.name)),
+			keys: new Set(listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key)),
+			rowConditions: new Set(policyRowConditionKeys(policy))
+		}, compact({
+			realtime: rls?.realtime,
+			storage: rls?.storage
+		}), warnings);
+	} catch (cause) {
+		return { refusal: describeError(cause) };
+	}
+	if (tablePolicies.length > 0 && helpersOnly) warnings.push("rls.realtime and rls.storage add policies, and --helpers-only writes none: no realtime.messages or storage.objects policy is written");
+	const servicePolicies = tablePolicies.length === 0 || helpersOnly ? [] : withActors(tablePolicies);
+	const generated = {
+		compiled,
+		helpersOnly,
+		force,
+		views,
+		policies: withActors(assembled)
+	};
+	if (servicePolicies.length === 0) return generated;
+	return {
+		...generated,
+		helperTables: [SERVICE_TABLES_HEADER, ...servicePolicies.map(policySql)].join("\n"),
+		guardedTables: [`${SERVICE_TABLES_HEADER} A stack without the service has no table, so each policy is skipped there.`, ...servicePolicies.map(guardedPolicySql)].join("\n")
+	};
+}
+//#endregion
+//#region src/cli/rls/shims.ts
 const NAME = /^[a-z_][a-z0-9_]*$/u;
 /**
 * The key a legacy caller passes, mapped the way `rls migrate` maps it:
@@ -1337,7 +1357,7 @@ function mappedKey(config, renamed) {
 	return `coalesce(${quoteLiteral(JSON.stringify(exact))}::jsonb ->> p_key, ${fallback})`;
 }
 function scopeOf(ctx, scope) {
-	if (!ctx.scopes.some((item) => item.name === scope)) throw new Error(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
+	if (!ctx.scopes.some((item) => item.name === scope)) throw configError(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
 	return scope;
 }
 function addKey(list, key) {
@@ -1404,7 +1424,7 @@ function grantKeys(keys, scope, effect) {
 }
 /** The instances of `scope` the caller holds an unconditional allow of the key in, minus those it holds a deny in. */
 function idsSql(ctx, keys, scope) {
-	const helper = qualified$1(ctx, permittedIdsHelper(scope));
+	const helper = qualified(ctx, permittedIdsHelper(scope));
 	return `  select a.id
   from ${grantKeys(keys, scope, "allow")}
   cross join lateral ${helper}(g.grant_key) a(id)
@@ -1414,7 +1434,7 @@ function idsSql(ctx, keys, scope) {
   cross join lateral ${helper}(g.grant_key) d(id)`;
 }
 function hasSql(ctx, keys) {
-	const has = qualified$1(ctx, HELPERS.has);
+	const has = qualified(ctx, HELPERS.has);
 	return `exists (select 1 from ${grantKeys(keys, "global", "allow")} where ${has}(g.grant_key))
     and not exists (select 1 from ${grantKeys(keys, "global", "deny")} where ${has}(g.grant_key))`;
 }
@@ -1432,7 +1452,14 @@ function shim(ctx, config, keys, fn, helper) {
 		case "membership": {
 			const scope = scopeOf(ctx, helper.scope);
 			const type = scopeTypeOf(ctx, scope);
-			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified$1(ctx, memberIdsHelper(scope))}()), false)`);
+			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified(ctx, memberIdsHelper(scope))}()), false)`);
+		}
+		case "role": {
+			const scope = scopeOf(ctx, helper.scope);
+			const type = scopeTypeOf(ctx, scope);
+			const values = Object.entries(ctx.roleValues ?? {});
+			const role = values.length === 0 ? "p_role" : `case p_role ${values.map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else p_role end`;
+			return shimFunction(fn, `p_id ${type}, p_role text`, `${type}, text`, "boolean", `  select coalesce(p_id in (select ${qualified(ctx, memberIdsHelper(scope))}(array[${role}])), false)`);
 		}
 		case "global": return shimFunction(fn, "p_key text", "text", "boolean", `  select ${hasSql(ctx, keys)}`);
 		case "scoped": {
@@ -1461,229 +1488,118 @@ function shimsSql(ctx, config, shims, renamed, grants) {
 		map: (scope) => `${quoteLiteral(shimMap(grants, scope))}::jsonb`
 	};
 	const chunks = [`-- permdock shims: legacy helper names over the permdock helpers; drop each once doctor reports no caller (PD056)`];
-	for (const [name, helper] of Object.entries(config.helpers).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
-		if (!NAME.test(name)) throw new Error(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
+	for (const [name, helper] of Object.entries(config.helpers).toSorted(byKey)) {
+		if (!NAME.test(name)) throw configError(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
 		chunks.push(shim(ctx, config, keys, `${quoteIdent$1(schema)}.${name}`, helper));
 	}
 	return `${chunks.join("\n\n")}\n`;
 }
 //#endregion
-//#region src/cli/rls-generate.ts
-async function loadPolicy(cwd, config, from) {
-	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
-	if (policyPath === void 0) throw new Error("PermDock CLI: rls generate needs policy in permdock.config.ts or --from");
-	return asPolicy(pickNamed(await loadModule(resolve(cwd, policyPath)), ["policy"]));
-}
-/** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
-function writeRequirement(policy, requires) {
-	if (requires === void 0) return {};
-	const leaves = listPermissions(policy.permissions);
-	const keys = requires === "manageRoles" ? leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key) : [...requires];
-	if (keys.length === 0) return { error: requires === "manageRoles" ? "rls.customRoleWrites.requires is 'manageRoles', but no permission declares meta.manageRoles" : "rls.customRoleWrites.requires names no permission" };
-	const known = new Set(leaves.map((leaf) => leaf.key));
-	const unknown = keys.filter((key) => !known.has(key));
-	if (unknown.length > 0) return { error: `rls.customRoleWrites.requires names undeclared permissions: ${unknown.join(", ")}` };
-	return { keys: [...new Set(keys)].toSorted() };
-}
-/** Declared role names, and those a tenant admin may compose into custom roles. */
-function customRoleNames(policy, requires) {
-	const declared = [...roleNames(policy)].toSorted();
-	const assignable = declared.filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
-	const renamed = renamedKeys(policy.vocabulary.permissions);
-	const leaves = listPermissions(policy.permissions);
-	const manage = leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key);
-	return {
-		declared,
-		assignable,
-		...renamed.size === 0 ? {} : { renamed: Object.fromEntries(renamed) },
-		permissions: leaves.map((leaf) => leaf.key).toSorted(),
-		...manage.length === 0 ? {} : { manage: manage.toSorted() },
-		...requires === void 0 ? {} : { requires },
-		...policy.levels === void 0 ? {} : { levels: true }
-	};
-}
-function moveUndiffed(sql, label, part) {
-	const { kept, moved } = splitUndiffed(sql);
-	const [first = "", ...rest] = kept.split("\n");
-	return {
-		sql: [
-			first,
-			`-- what supabase db diff drops from this part is in ${label}`,
-			...rest
-		].join("\n"),
-		grants: `-- the privileges and view options supabase db diff drops from the ${part} part\n${moved.join("\n")}`
-	};
+//#region src/cli/rls/triggers.ts
+const PREFIX = "PermDock CLI";
+const EVENTS = /* @__PURE__ */ new Set([
+	"insert",
+	"update",
+	"delete",
+	"truncate"
+]);
+const AUDITED = [
+	CUSTOM_ROLES.permissions,
+	CUSTOM_ROLES.includes,
+	"user_roles"
+];
+const IDENT = /^[a-z_][a-z0-9_$]*$/u;
+/** The tables `sql` creates in `schema`, by name without the schema. */
+function generatedTables(sql, schema) {
+	const prefix = `create table if not exists ${quoteIdent$1(schema)}.`;
+	const found = /* @__PURE__ */ new Set();
+	for (const line of sql.split("\n")) {
+		if (!line.startsWith(prefix)) continue;
+		const name = /^"?([A-Za-z_][\w$]*)"?/u.exec(line.slice(prefix.length))?.[1];
+		if (name !== void 0) found.add(name);
+	}
+	return [...found].toSorted();
+}
+function functionName(name, label) {
+	if (typeof name !== "string" || name.split(".").length !== 2) throw configError(`${PREFIX}: ${label} must be a schema-qualified function such as audit.log_change, got ${JSON.stringify(name)}`);
+	return quoteTable(name);
+}
+function knownTable(table, tables, label) {
+	if (!tables.includes(table)) throw configError(`${PREFIX}: ${label} names ${table}, which rls generate does not create with this config; it creates ${tables.join(", ")}`);
+}
+function triggerSql(table, trigger, label) {
+	if (typeof trigger.name !== "string" || trigger.name === "" || trigger.name.toLowerCase().startsWith("permdock_")) throw configError(`${PREFIX}: ${label}.name must be a name outside permdock_, which generated triggers use, got ${JSON.stringify(trigger.name)}`);
+	if (trigger.when !== "before" && trigger.when !== "after") throw configError(`${PREFIX}: ${label}.when must be before or after`);
+	const events = trigger.events;
+	if (events.length === 0 || !events.every((event) => EVENTS.has(event))) throw configError(`${PREFIX}: ${label}.events must list insert, update, delete or truncate`);
+	const level = trigger.level ?? "row";
+	if (level !== "row" && level !== "statement") throw configError(`${PREFIX}: ${label}.level must be row or statement`);
+	if (level === "row" && events.includes("truncate")) throw configError(`${PREFIX}: ${label} fires on truncate, which Postgres allows only with level: 'statement'`);
+	const fn = functionName(trigger.function, `${label}.function`);
+	const args = (trigger.args ?? []).map((arg) => quoteLiteral(arg));
+	const name = quoteIdent$1(trigger.name);
+	return `drop trigger if exists ${name} on ${table};
+create trigger ${name}
+  ${trigger.when} ${[...new Set(events)].join(" or ")} on ${table}
+  for each ${level} execute function ${fn}(${args.join(", ")});`;
 }
 /**
-* The row columns that belong to a table. With `rls.tables` set, a resource
-* it does not name is a table only when generated policies are written for
-* it; with `--helpers-only` it has none, so it gets no index.
+* `rls.triggers`: the application's triggers on generated tables, after the
+* tables. A table this run does not create is an error, so a trigger never
+* silently goes missing.
 */
-function tableColumns(rowColumns, tables, helpersOnly, warnings) {
-	if (tables === void 0) return rowColumns;
-	const unmapped = [...new Set(rowColumns.map((item) => item.resource).filter((resource) => !Object.hasOwn(tables, resource)))].toSorted();
-	if (unmapped.length === 0) return rowColumns;
-	if (helpersOnly) {
-		warnings.push(`no index is suggested for resources without an rls.tables entry: ${unmapped.join(", ")}; map each one that is a table`);
-		return rowColumns.filter((item) => Object.hasOwn(tables, item.resource));
+function triggersSql(triggers, schema, tables) {
+	if (triggers === void 0) return "";
+	const chunks = [];
+	for (const [table, list] of Object.entries(triggers).toSorted(byKey)) {
+		knownTable(table, tables, `rls.triggers.${table}`);
+		const target = `${quoteIdent$1(schema)}.${quoteIdent$1(table)}`;
+		for (const [index, trigger] of list.entries()) chunks.push(triggerSql(target, trigger, `rls.triggers.${table}[${String(index)}]`));
 	}
-	warnings.push(`policies for resources without an rls.tables entry target a table named after the resource: ${unmapped.map((resource) => qualifiedTable$1(resource)).join(", ")}; map each one to its table`);
-	return rowColumns;
+	return chunks.length === 0 ? "" : `-- rls.triggers: triggers the application owns on generated tables\n${chunks.join("\n")}\n`;
 }
-async function runRlsGenerate(input) {
-	const rls = input.config.rls;
-	const fieldsMode = input.fields ?? rls?.fields;
-	if (fieldsMode !== void 0 && fieldsMode !== "views") return {
-		code: 2,
-		output: `rls generate --fields must be views (got ${fieldsMode})`,
-		text: ""
-	};
-	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
-	if (revokeColumns && fieldsMode === void 0) return {
-		code: 2,
-		output: "rls generate --revoke-columns needs --fields views",
-		text: ""
-	};
-	const policy = await loadPolicy(input.cwd, input.config, input.from);
-	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
-	if (input.rbac && input.dialect !== "supabase") return {
-		code: 2,
-		output: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})`,
-		text: ""
-	};
-	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
-	const authorize = resolveAuthorize(input.config, {
-		authorize: input.authorize,
-		rbac: input.rbac,
-		memberships
-	});
-	const memberSources = rls?.membershipSources ?? input.config.supabase?.hook?.memberships;
-	const sources = authorize === "database" ? memberSources : void 0;
-	const scopes = scopeList(policy.scopes);
-	const suspension = checkSuspension(rls?.suspension, scopes);
-	const hookRoles = input.config.supabase?.hook?.roles;
-	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
-	if (roles !== void 0 && input.rbac) return {
-		code: 2,
-		output: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag",
-		text: ""
-	};
-	const requires = writeRequirement(policy, rls?.customRoleWrites?.requires);
-	if (requires.error !== void 0) return {
-		code: 2,
-		output: requires.error,
-		text: ""
-	};
-	const readers = rls?.trustedReaders;
-	if (readers !== void 0 && (!Array.isArray(readers) || !readers.every((name) => typeof name === "string" && name !== ""))) return {
-		code: 2,
-		output: "rls.trustedReaders must list Postgres role names, such as ['service_role']",
-		text: ""
-	};
-	const ownership = ownershipRules(policy, scopes);
-	const graph = graphPlan(policy);
-	const apiKeys = apiKeysPlan(rls?.apiKeys, new Set(roleNames(policy)), Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
-	const ctx = {
-		dialect: input.dialect,
-		scopes,
-		tenantClaim: rls?.tenantClaim ?? "tenant_id",
-		...rls?.tenants === "all" ? { tenants: "all" } : {},
-		gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
-		...rls?.actions === void 0 ? {} : { actions: rls.actions },
-		inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
-		schema,
-		authorize,
-		roleClaim: rls?.roleClaim ?? "user_role",
-		tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
-		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
-		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
-		...memberships === void 0 ? {} : { memberships },
-		...sources === void 0 || sources.length === 0 ? {} : { sources },
-		...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
-		...suspension === void 0 ? {} : { suspension },
-		...roles === void 0 ? {} : { roles },
-		...input.customRoles === true || rls?.customRoles === true ? { customRoles: {
-			...customRoleNames(policy, requires.keys),
-			...rls?.customRoleWrites?.roles === void 0 ? {} : { table: rls.customRoleWrites.roles }
-		} } : {},
-		...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
-		...apiKeys === void 0 ? {} : { apiKeys },
-		...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
-		...ownership === void 0 ? {} : { ownership },
-		...rls?.ownershipTriggers === void 0 ? {} : { skipOwnershipTriggers: rls.ownershipTriggers === false ? "all" : Object.keys(rls.ownershipTriggers).map((key) => {
-			const name = resolveScope(scopes, key);
-			if (name === void 0) throw new Error(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
-			return name;
-		}) },
-		...rls?.assignments === void 0 ? {} : { assignments: rls.assignments === true ? { tables: [] } : {
-			tables: rls.assignments.tables ?? [],
-			...rls.assignments.ownRole === void 0 ? {} : { ownRole: rls.assignments.ownRole }
-		} },
-		...fieldsMode === void 0 ? {} : { fields: fieldsMode },
-		...graph.size === 0 ? {} : { graph: {
-			closures: closureDepths(graph),
-			resources: policy.resources,
-			...rls?.tables === void 0 ? {} : { tables: rls.tables }
-		} }
-	};
-	if (ctx.anonymousSignIns === "deny" && ctx.dialect !== "supabase") return {
-		code: 2,
-		output: `rls.anonymousSignIns needs --dialect supabase (got ${ctx.dialect})`,
-		text: ""
-	};
-	const jsonSchema = rls?.jsonSchema;
-	if (jsonSchema !== void 0 && jsonSchema !== "auto" && typeof jsonSchema !== "boolean") return {
-		code: 2,
-		output: `rls.jsonSchema must be 'auto', true or false (got ${JSON.stringify(jsonSchema)})`,
-		text: ""
-	};
-	const warnings = [];
-	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
-	if (authorize === "database") {
-		for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
-	}
-	const compiled = compileGrants(policy, ctx, rls?.tables, warnings, input.skipClosures, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0);
-	const helpersOnly = input.helpersOnly === true || rls?.helpersOnly === true;
-	if (helpersOnly && (input.target !== "sql" || revokeColumns)) return {
-		code: 2,
-		output: "rls generate --helpers-only needs --target sql and no --revoke-columns: the table grants are hand-written, so revoke the restricted columns there",
-		text: ""
-	};
-	const views = fieldsMode === void 0 ? [] : fieldViews(policy, ctx, compiled.branches, {
-		revokeColumns,
-		helpersOnly
-	}, warnings);
-	const force = input.force === true || rls?.force === true;
-	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
-	const policyName = input.policyName ?? rls?.policyName;
-	const assembled = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
-		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
-		...policyName === void 0 ? {} : { name: policyName }
+/**
+* `rls.audit`: one call of the audit function per generated table, which
+* registers the table with the application's audit module. Statements that
+* run code, so they travel with the seeds.
+*/
+function auditSql(audit, schema, tables) {
+	if (audit === void 0) return "";
+	const fn = functionName(audit.function, "rls.audit.function");
+	const listed = audit.tables;
+	if (listed !== void 0) for (const table of listed) knownTable(table, tables, "rls.audit.tables");
+	const targets = listed ?? AUDITED.filter((table) => tables.includes(table));
+	const args = Object.entries(audit.args ?? {}).map(([name, value]) => {
+		if (!IDENT.test(name)) throw configError(`${PREFIX}: rls.audit.args names ${JSON.stringify(name)}, which is not a lower-case parameter name`);
+		return `, ${quoteIdent$1(name)} => ${quoteLiteral(value)}`;
 	});
-	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
-	if (actorKinds !== void 0 && helpersOnly) warnings.push("rls.readOnlyActors adds policies, and --helpers-only writes none: add the restrictive read-only policies to the hand-written ones");
-	const policies = actorKinds === void 0 ? assembled : [...assembled, ...readOnlyActorPolicies(assembled, subjectClaimJsonSql(ctx, "act"), actorKinds)];
-	let tablePolicies;
-	try {
-		tablePolicies = realtimeStoragePolicies(ctx, {
-			scopes: new Set(ctx.scopes.map((scope) => scope.name)),
-			keys: new Set(listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key)),
-			rowConditions: new Set(policyRowConditionKeys(policy))
-		}, compact({
-			realtime: rls?.realtime,
-			storage: rls?.storage
-		}), warnings);
-	} catch (cause) {
-		return {
-			code: 2,
-			output: describeError(cause),
-			text: ""
-		};
+	if (targets.length === 0) return "";
+	return `-- rls.audit: generated tables registered with ${audit.function}
+${targets.map((table) => `select ${fn}(${quoteLiteral(`${quoteIdent$1(schema)}.${quoteIdent$1(table)}`)}::regclass${args.join("")});`).join("\n")}
+`;
+}
+//#endregion
+//#region src/cli/rls/generate-sql.ts
+/** The checks that need the SQL context: `--backfill-out`, `rls.anonymousSignIns`, `rls.jsonSchema`. */
+function preflight(input, { ctx }) {
+	const rls = input.config.rls;
+	const from = typeof rls?.customRoles === "object" ? rls.customRoles.from : void 0;
+	if (input.backfillOut !== void 0 && from === void 0) return { refusal: "rls generate --backfill-out needs rls.customRoles.from in permdock.config.ts" };
+	let backfill;
+	if (from !== void 0) try {
+		backfill = backfillSql(ctx, from, rls?.migrate);
+	} catch (cause) {
+		return { refusal: describeError(cause) };
 	}
-	if (tablePolicies.length > 0 && helpersOnly) warnings.push("rls.realtime and rls.storage add policies, and --helpers-only writes none: no realtime.messages or storage.objects policy is written");
-	const servicePolicies = tablePolicies.length === 0 || helpersOnly ? [] : [...tablePolicies, ...actorKinds === void 0 ? [] : readOnlyActorPolicies(tablePolicies, subjectClaimJsonSql(ctx, "act"), actorKinds)];
-	const helperTables = servicePolicies.length === 0 ? void 0 : [SERVICE_TABLES_HEADER, ...servicePolicies.map(policySql)].join("\n");
-	const guardedTables = servicePolicies.length === 0 ? void 0 : [`${SERVICE_TABLES_HEADER} A stack without the service has no table, so each policy is skipped there.`, ...servicePolicies.map(guardedPolicySql)].join("\n");
+	if (ctx.anonymousSignIns === "deny" && ctx.dialect !== "supabase") return { refusal: `rls.anonymousSignIns needs --dialect supabase (got ${ctx.dialect})` };
+	const jsonSchema = rls?.jsonSchema;
+	if (jsonSchema !== void 0 && jsonSchema !== "auto" && typeof jsonSchema !== "boolean") return { refusal: `rls.jsonSchema must be 'auto', true or false (got ${JSON.stringify(jsonSchema)})` };
+	return {
+		backfill,
+		jsonSchema
+	};
+}
+function rbacPart(input, policy, { ctx, schema, authorize }, warnings) {
 	const rootMapped = ctx.scopes[0] === void 0 ? void 0 : scopeTable(ctx, ctx.scopes[0].name);
 	const rootTable = rootMapped === void 0 ? void 0 : {
 		...rootMapped.table,
@@ -1702,51 +1618,67 @@ async function runRlsGenerate(input) {
 	}) : void 0;
 	if (rbac !== void 0) warnings.push(...rbac.warnings);
 	if (input.rbac) warnings.push("the token hook that writes user_role and memberships comes from permdock supabase hook generate");
+	return rbac;
+}
+/** The ownership, approval store, graph, row-helper and break-glass sections. */
+function sectionsSql(input, policy, options, built, generated, jsonSchema, warnings) {
+	const rls = input.config.rls;
+	const { ctx, graph, ownership } = built;
+	const { compiled } = generated;
 	const owned = [ownershipSql(ctx), assignmentSql(ctx)].filter((part) => part !== "").join("\n");
 	if (ctx.assignments !== void 0 && (ownership === void 0 || ownership.assigns.length === 0)) warnings.push("rls.assignments needs a role that declares assigns: no assignment trigger is written");
 	let approvals;
 	try {
-		approvals = rls?.approvals === true ? approvalStoreSql(ctx, jsonSchema ?? false) : typeof rls?.approvals === "object" ? adoptedApprovalStoreSql(ctx, rls.approvals, jsonSchema ?? false) : void 0;
+		approvals = approvalsSql(ctx, rls?.approvals, jsonSchema ?? false);
 	} catch (cause) {
-		return {
-			code: 2,
-			output: describeError(cause),
-			text: ""
-		};
+		return { refusal: describeError(cause) };
 	}
 	const graphed = graphSql(ctx, graph, rls?.tables);
 	let rowHelpers = "";
 	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) try {
-		rowHelpers = rowHelpersSql(ctx, policy, [...fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], rls?.tables, warnings);
+		rowHelpers = rowHelpersSql(ctx, policy, [...options.fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], rls?.tables, warnings);
 	} catch (cause) {
-		return {
-			code: 2,
-			output: describeError(cause),
-			text: ""
-		};
+		return { refusal: describeError(cause) };
 	}
 	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, rls?.tables));
-	const configured = rls?.shims;
-	const shimsConfig = typeof configured === "object" ? configured : configured === true || input.shims === true ? {} : void 0;
-	if (shimsConfig !== void 0 && rls?.migrate === void 0) return {
-		code: 2,
-		output: "PermDock CLI: rls generate --shims needs rls.migrate.helpers in permdock.config.ts",
-		text: ""
-	};
-	const renamed = Object.fromEntries(renamedKeys(policy.vocabulary.permissions));
-	const grants = shimGrants(compiled.rolePermissions, compiled.conditionedKeys, renamed);
-	const anonExecute = rls?.anonExecute === true || views.some((view) => view.roles.includes("anon")) || compiled.branches.some((branch) => branch.roles.includes("anon") && [
+	return [
+		approvals,
+		owned === "" ? void 0 : owned,
+		graphed === "" ? void 0 : graphed,
+		breakGlass === "" ? void 0 : breakGlass,
+		rowHelpers === "" ? void 0 : rowHelpers
+	];
+}
+/** Whether `anon` calls a helper: `rls.anonExecute`, an anon field view or an anon branch reading the user id. */
+function anonExecutes(input, { compiled, views }) {
+	return input.config.rls?.anonExecute === true || views.some((view) => view.roles.includes("anon")) || compiled.branches.some((branch) => branch.roles.includes("anon") && [
 		branch.access,
 		branch.using,
 		branch.check
 	].some((sql) => sql?.includes("permdock_user_id") === true));
+}
+/** Everything before the table policies: helpers, sections, shims, scaffold and triggers. */
+function preambleSql(input, policy, options, built, generated, jsonSchema, warnings) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const { compiled } = generated;
+	const rbac = rbacPart(input, policy, built, warnings);
+	const sections = sectionsSql(input, policy, options, built, generated, jsonSchema, warnings);
+	if (isRefusal(sections)) return sections;
+	const configured = rls?.shims;
+	const shimsConfig = typeof configured === "object" ? configured : configured === true || input.shims === true ? {} : void 0;
+	if (shimsConfig !== void 0 && rls?.migrate === void 0) return { refusal: "PermDock CLI: rls generate --shims needs rls.migrate.helpers in permdock.config.ts" };
+	const renamed = Object.fromEntries(renamedKeys(policy.vocabulary.permissions));
+	const grants = shimGrants(compiled.rolePermissions, compiled.conditionedKeys, renamed);
+	const anonExecute = anonExecutes(input, generated);
+	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
 	const usesLiveSession = compiled.branches.some((branch) => [
 		branch.access,
 		branch.using,
 		branch.check
 	].some((sql) => sql?.includes(SESSION_LIVE_HELPER) === true));
 	const shims = shimsConfig === void 0 || rls?.migrate === void 0 ? void 0 : shimsSql(ctx, rls.migrate, shimsConfig, renamed, grants);
-	const preamble = [
+	const core = [
 		rbac?.head,
 		helpersSql(ctx, compiled.rolePermissions, {
 			levelReach: compiled.levelReach,
@@ -1757,19 +1689,59 @@ async function runRlsGenerate(input) {
 			...rls?.trustedReaders === void 0 ? {} : { trustedReaders: rls.trustedReaders }
 		}),
 		permissionHelpersSql(ctx, grants, renamed, anonExecute),
+		permissionHoldersSql(ctx) || void 0,
+		actorKinds === void 0 ? void 0 : actorMayWriteSql(ctx, actorKinds),
 		usesLiveSession ? sessionLiveHelperSql(ctx) : void 0,
-		approvals,
-		owned === "" ? void 0 : owned,
-		graphed === "" ? void 0 : graphed,
-		breakGlass === "" ? void 0 : breakGlass,
-		rowHelpers === "" ? void 0 : rowHelpers,
+		...sections,
 		shims,
 		rbac?.tail
 	].filter((part) => part !== void 0).join("\n");
-	if (force) for (const entry of graph.values()) {
+	const created = generatedTables(core, built.schema);
+	let ownTriggers;
+	let audit;
+	try {
+		ownTriggers = triggersSql(rls?.triggers, built.schema, created);
+		audit = auditSql(rls?.audit, built.schema, created);
+	} catch (cause) {
+		return { refusal: describeError(cause) };
+	}
+	const seedsSplit = splitsPart(input.split, "seeds");
+	return {
+		preamble: [
+			core,
+			ownTriggers,
+			seedsSplit ? "" : audit
+		].filter((part) => part !== "").join("\n"),
+		audit
+	};
+}
+function forceWarnings({ graph }, warnings) {
+	for (const entry of graph.values()) {
 		const own = [...entry.relations].filter((name) => !("edge" in (entry.node.relations[name] ?? {})));
 		if (own.length > 0) warnings.push(`--force: ${entry.node.name} relations ${own.join(", ")} are read from the ${entry.node.name} table itself, so ${graphHelper(entry.node.name)} would recurse through its own policy; keep ${entry.node.name} unforced or move them to edge tables`);
 	}
+}
+/**
+* The row columns that belong to a table. With `rls.tables` set, a resource
+* it does not name is a table only when generated policies are written for
+* it; with `--helpers-only` it has none, so it gets no index.
+*/
+function tableColumns(rowColumns, tables, helpersOnly, warnings) {
+	if (tables === void 0) return rowColumns;
+	const unmapped = [...new Set(rowColumns.map((item) => item.resource).filter((resource) => !Object.hasOwn(tables, resource)))].toSorted();
+	if (unmapped.length === 0) return rowColumns;
+	if (helpersOnly) {
+		warnings.push(`no index is suggested for resources without an rls.tables entry: ${unmapped.join(", ")}; map each one that is a table`);
+		return rowColumns.filter((item) => Object.hasOwn(tables, item.resource));
+	}
+	warnings.push(`policies for resources without an rls.tables entry target a table named after the resource: ${unmapped.map((resource) => qualifySqlTable(resource)).join(", ")}; map each one to its table`);
+	return rowColumns;
+}
+/** The `--target` file, and for Drizzle and Prisma the SQL migration beside it. */
+function emitTarget(input, built, generated, preamble) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const { policies, force, views, helperTables } = generated;
 	const outRel = input.out ?? rls?.out ?? defaultOut(input.target);
 	const migration = input.target === "sql" ? "" : dialectRoles(migrationSql(policies, withHelperTables(preamble, helperTables), force, views), ctx.dialect);
 	const migrationRel = migration === "" ? void 0 : migrationOut(outRel);
@@ -1795,14 +1767,130 @@ async function runRlsGenerate(input) {
 			break;
 		default: return input.target;
 	}
-	let indexes = indexTargets(ctx, tableColumns(compiled.rowColumns, rls?.tables, helpersOnly, warnings));
+	return {
+		text,
+		migration,
+		migrationRel,
+		outRel
+	};
+}
+/** The generated SQL for one run, before `--db-url-stdin` prunes the index targets. */
+function generateSql(input, policy, options, built, warnings) {
+	const rls = input.config.rls;
+	const { ctx } = built;
+	const checked = preflight(input, built);
+	if (isRefusal(checked)) return checked;
+	const { jsonSchema } = checked;
+	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
+	const generated = generatePolicies(input, policy, options, built, warnings);
+	if (isRefusal(generated)) return generated;
+	const assembled = preambleSql(input, policy, options, built, generated, jsonSchema, warnings);
+	if (isRefusal(assembled)) return assembled;
+	const { preamble, audit } = assembled;
+	if (generated.force) forceWarnings(built, warnings);
+	const emitted = emitTarget(input, built, generated, preamble);
+	const { policies, force, views, helperTables, guardedTables, helpersOnly } = generated;
+	const seedsSplit = splitsPart(input.split, "seeds");
+	return {
+		...generated,
+		...emitted,
+		backfill: checked.backfill,
+		indexes: indexTargets(ctx, tableColumns(generated.compiled.rowColumns, rls?.tables, helpersOnly, warnings)),
+		parts: (indexes) => ({
+			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
+			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
+			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
+			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
+			seeds: `${SEEDS_MARKER} schema=${built.schema}\n${seedSql(ctx, generated.compiled.rolePermissions)}\n${seedsSplit ? audit : ""}`,
+			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
+		})
+	};
+}
+//#endregion
+//#region src/cli/rls/generate.ts
+function loadPolicy(cwd, config, from) {
+	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
+	return requirePolicy(cwd, policyPath, "rls generate needs policy in permdock.config.ts or --policy");
+}
+const PROJECT_COMMAND = "permdock rls generate";
+/**
+* The policy `policyFromCatalog` rebuilds from the project's pushed catalog
+* and policy; a project with no pushed policy fails with `policy-not-published`.
+*/
+async function projectPolicyOf(input, project) {
+	const fetched = await fetchProjectPolicy({
+		command: PROJECT_COMMAND,
+		url: input.url,
+		project,
+		json: input.json === true,
+		env: input.io.env ?? process.env,
+		io: input.io
+	});
+	if (!fetched.ok) return {
+		...fetched.result,
+		text: ""
+	};
+	const { catalog, policy } = fetched.value;
+	if (policy === void 0) {
+		const detail = `project ${project} has a pushed catalog but no policy; push from a project whose permdock.config.ts names one`;
+		return {
+			code: 1,
+			output: input.json === true ? JSON.stringify({
+				type: POLICY_NOT_PUBLISHED,
+				title: "Policy not published",
+				detail,
+				command: PROJECT_COMMAND,
+				exitCode: 1
+			}, null, 2) : `${PROJECT_COMMAND}: ${detail}`,
+			text: ""
+		};
+	}
+	try {
+		return policyFromCatalog(catalog, policy);
+	} catch (cause) {
+		return {
+			code: 1,
+			output: `${PROJECT_COMMAND}: the pushed policy does not rebuild: ${describeError(cause)}`,
+			text: ""
+		};
+	}
+}
+function isOutcome(value) {
+	return "text" in value && "code" in value;
+}
+function refused(output) {
+	return {
+		code: 2,
+		output,
+		text: ""
+	};
+}
+async function runRlsGenerate(input) {
+	const options = generateOptions(input);
+	if (isRefusal(options)) return refused(options.refusal);
+	if (input.project !== void 0 && input.from !== void 0 && input.from !== "drizzle") return refused("rls generate takes the policy from --project or from a --policy module, not both");
+	let policy;
+	if (input.project === void 0) policy = await loadPolicy(input.cwd, input.config, input.from);
+	else {
+		const loaded = await projectPolicyOf(input, input.project);
+		if (isOutcome(loaded)) return loaded;
+		policy = loaded;
+	}
+	const built = buildContext(input, policy, options);
+	if (isRefusal(built)) return refused(built.refusal);
+	const warnings = [];
+	const generated = generateSql(input, policy, options, built, warnings);
+	if (isRefusal(generated)) return refused(generated.refusal);
+	const { ctx } = built;
+	const { text, migration, migrationRel, helpersOnly } = generated;
+	let indexes = generated.indexes;
 	if (input.db !== void 0) try {
 		const pruned = pruneIndexTargets(indexes, await readTableIndexFacts(input.db, [...new Set(indexes.map((target) => target.table))], input.connect));
 		indexes = pruned.targets;
 		warnings.push(...pruned.warnings);
 	} catch (cause) {
 		return {
-			code: 2,
+			code: exitCodeOfError(cause),
 			output: describeError(cause),
 			text: ""
 		};
@@ -1813,33 +1901,26 @@ async function runRlsGenerate(input) {
 		code: 0,
 		output: warnings.join("\n"),
 		text,
-		policies,
-		seeds: compiled.rolePermissions,
+		policies: generated.policies,
+		seeds: generated.compiled.rolePermissions,
 		indexes,
 		keys: {
 			permissions: listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key),
 			rowConditions: [...policyRowConditionKeys(policy)],
 			renamed: Object.fromEntries(renamedKeys(policy.vocabulary.permissions))
 		},
-		schema,
+		schema: built.schema,
 		helpersOnly,
 		...extras
 	};
 	const planned = outputFiles({
 		input,
-		outRel,
+		outRel: generated.outRel,
 		text,
 		helpersOnly,
-		sql: () => ({
-			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
-			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
-			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
-			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
-			seeds: `${SEEDS_MARKER} schema=${schema}\n${seedSql(ctx, compiled.rolePermissions)}\n`,
-			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
-		}),
-		scopes,
-		schema
+		sql: () => generated.parts(indexes),
+		scopes: ctx.scopes,
+		schema: built.schema
 	});
 	if (typeof planned === "string") return {
 		code: 2,
@@ -1853,6 +1934,19 @@ async function runRlsGenerate(input) {
 		rel: migrationRel,
 		text: migration
 	});
+	if (input.backfillOut !== void 0 && generated.backfill !== void 0) {
+		const file = dataMigrationFile({
+			cwd: input.cwd,
+			out: input.backfillOut,
+			part: "backfill",
+			marker: BACKFILL_MARKER,
+			text: generated.backfill,
+			now: input.io.now?.() ?? dateAt(),
+			check: input.check,
+			reserved: files.map((other) => other.rel)
+		});
+		if (file !== void 0) files.push(file);
+	}
 	if (input.check) {
 		const drift = driftOf(input.cwd, files);
 		return drift.length === 0 ? {
@@ -1867,150 +1961,18 @@ async function runRlsGenerate(input) {
 			...extras
 		};
 	}
-	const written = writeSqlFiles(input.cwd, files);
-	const extra = warnings.length === 0 ? "" : `\n${warnings.join("\n")}`;
+	const written = writeOutputFiles(input.cwd, files);
+	const notes = [...written.wrote.length === 0 ? [] : [`wrote ${written.wrote.join(", ")}`], ...warnings];
+	if (written.printed !== "") for (const note of notes) input.io.stderr(note);
 	return {
 		code: 0,
-		output: `wrote ${written.wrote.join(", ")}${written.printed === "" ? "" : `\n${written.printed}`}${extra}`,
+		output: written.printed === "" ? notes.join("\n") : written.printed,
 		text,
 		...extras
 	};
 }
-/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
-const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
-/**
-* A `realtime.messages` or `storage.objects` policy that applies only where
-* the table exists. The Realtime and Storage services create those tables, so
-* a local stack with the service off, and pg-delta's shadow database, have
-* none.
-*/
-function guardedPolicySql(item) {
-	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
-	return `do $permdock$
-begin
-  if to_regclass(${quoteLiteral(qualifiedTable$1(item.table))}) is not null then
-${body}
-  end if;
-end
-$permdock$;
-`;
-}
-/** Appends the `realtime.messages` and `storage.objects` policies, which never get `tableSql`. */
-function withHelperTables(sql, helperTables) {
-	if (helperTables === void 0) return sql;
-	const tables = `${helperTables.trimEnd()}\n`;
-	return sql.trim() === "" ? tables : `${sql.trimEnd()}\n\n${tables}`;
-}
-function splitsPart(raw, part) {
-	const split = parseSplit(raw);
-	return typeof split !== "string" && split?.includes(part) === true;
-}
-/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants. */
-function outputFiles(plan) {
-	const { input } = plan;
-	const split = parseSplit(input.split);
-	if (typeof split === "string") return split;
-	if (split?.includes("policies") === true && plan.helpersOnly) return "rls generate --helpers-only writes no policies part; drop it from --split";
-	if (split === void 0) {
-		if (input.grantsOut !== void 0) return "rls generate --grants-out needs --split with the helpers or hook part";
-		if (input.seedsOut !== void 0) return "rls generate --seeds-out needs --split with the seeds part";
-		return [{
-			part: "rls",
-			rel: plan.outRel,
-			text: plan.text
-		}];
-	}
-	if (input.target !== "sql") return "rls generate --split needs --target sql";
-	const pgDelta = input.out === void 0 && input.config.rls?.out === void 0 ? supabaseConfig(input.cwd).pgDelta : void 0;
-	if (pgDelta === void 0 && !plan.outRel.includes("{part}")) return `rls generate --split needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
-	if (pgDelta !== void 0 && split.includes("helpers") && !split.includes("seeds")) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
-	if (pgDelta !== void 0 && split.includes("seeds") && input.seedsOut === void 0) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
-	const at = (part, schema = plan.schema) => pgDelta === void 0 ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
-	if (input.grantsOut !== void 0 && !split.includes("hook") && !split.includes("helpers")) return "rls generate --grants-out needs the helpers or hook part in --split";
-	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
-	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
-	const sql = plan.sql();
-	const relocated = pgDelta === void 0 ? void 0 : sql.servicePolicies;
-	if (relocated !== void 0 && split.includes("policies") && !split.includes("seeds")) return "rls generate --split policies under pg-delta with rls.realtime or rls.storage needs the seeds part with --seeds-out: the shadow database has no realtime.messages or storage.objects, so their policies go in that migration";
-	const seeds = relocated === void 0 || !split.includes("policies") ? sql.seeds : `${sql.seeds}\n${relocated}`;
-	const files = [];
-	const label = grantsLabel(input.grantsOut);
-	let grantsMarker = `${GRANTS_MARKER} schema=${plan.schema}`;
-	const grants = [];
-	for (const part of split) switch (part) {
-		case "helpers": {
-			if (label === void 0) {
-				files.push({
-					part,
-					rel: at(part),
-					text: sql.helpers
-				});
-				break;
-			}
-			const moved = moveUndiffed(sql.helpers, label, part);
-			files.push({
-				part,
-				rel: at(part),
-				text: moved.sql
-			});
-			grants.push(moved.grants);
-			break;
-		}
-		case "seeds": {
-			const out = input.seedsOut;
-			if (out !== void 0 && isSeedsDirectory(input.cwd, out)) {
-				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? /* @__PURE__ */ new Date());
-				if (!planned.current || input.check) files.push({
-					part,
-					rel: planned.rel,
-					text: seeds
-				});
-				break;
-			}
-			files.push({
-				part,
-				rel: out ?? at(part),
-				text: seeds
-			});
-			break;
-		}
-		case "indexes":
-			files.push({
-				part,
-				rel: at(part),
-				text: sql.indexes
-			});
-			break;
-		case "policies":
-			files.push({
-				part,
-				rel: at(part),
-				text: pgDelta === void 0 ? sql.policies : sql.declarativePolicies
-			});
-			break;
-		case "hook": {
-			const hook = supabaseHookSql(plan.scopes, input.config, {}, label);
-			files.push({
-				part,
-				rel: at(part, hook.manifest.hook.schema),
-				text: hook.sql
-			});
-			const [marker = grantsMarker, ...rest] = hook.grants.split("\n");
-			grantsMarker = marker;
-			grants.push(rest.join("\n").trimEnd());
-			break;
-		}
-		default: return part;
-	}
-	if (input.grantsOut !== void 0) files.push({
-		part: "grants",
-		rel: input.grantsOut,
-		text: `${[grantsMarker, ...grants].join("\n")}\n`
-	});
-	return files;
-}
 //#endregion
-//#region src/cli/rls-introspect.ts
+//#region src/cli/rls/introspect.ts
 const ROLES = ["anon", "authenticated"];
 /** Neon's `anonymous` is the role `rls generate` writes as `anon` for the other dialects. */
 function liveRole(role) {
@@ -2023,7 +1985,7 @@ const PRIVILEGES = [
 	"delete"
 ];
 /** `posts` and `"app"."posts"` as `public.posts` and `app.posts`. */
-function qualified(table) {
+function normalizeTableName(table) {
 	const parts = table.split(".").map((part) => part.replaceAll("\"", ""));
 	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
 }
@@ -2037,19 +1999,19 @@ function helpersOf(sql) {
 	return [...found];
 }
 function expectedRls(policies, sql, indexes = []) {
-	const tables = [...new Set(policies.map((item) => qualified(item.table)))];
+	const tables = [...new Set(policies.map((item) => normalizeTableName(item.table)))];
 	const grants = {};
 	for (const table of tables) {
 		const byRole = {};
 		for (const role of ROLES) {
-			const commands = new Set(policies.filter((item) => qualified(item.table) === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
+			const commands = new Set(policies.filter((item) => normalizeTableName(item.table) === table && item.effect === "allow" && item.roles.includes(role)).map((item) => item.command));
 			byRole[role] = PRIVILEGES.filter((privilege) => commands.has(privilege));
 		}
 		grants[table] = byRole;
 	}
 	return {
 		policies: policies.map((item) => ({
-			table: qualified(item.table),
+			table: normalizeTableName(item.table),
 			name: item.name,
 			command: item.command,
 			permissive: item.effect === "allow",
@@ -2060,7 +2022,7 @@ function expectedRls(policies, sql, indexes = []) {
 		helpers: helpersOf(sql),
 		indexes: indexes.map((target) => ({
 			...target,
-			table: qualified(target.table)
+			table: normalizeTableName(target.table)
 		}))
 	};
 }
@@ -2195,6 +2157,29 @@ async function introspectRls(db, expected, connect = connectIntrospect) {
 		await client.end();
 	}
 }
+const WRITES = [
+	"insert",
+	"update",
+	"delete"
+];
+/**
+* Each table and write command whose permissive policies reach
+* `authenticated` (or `public`) without the read-only actor check: no
+* restrictive policy for the command calls `permdock_actor_may_write()`, and
+* some permissive one does not.
+*/
+function unguardedWrites(policies, fn) {
+	const out = [];
+	const tables = [...new Set(policies.map((policy) => policy.table))];
+	for (const table of tables) for (const command of WRITES) {
+		const applying = policies.filter((policy) => policy.table === table && (policy.command === command || policy.command === "all"));
+		const permissive = applying.filter((policy) => policy.restrictive !== true && (policy.roles ?? []).some((role) => role === "authenticated" || role === "public"));
+		if (permissive.length === 0) continue;
+		const calls = (expression) => expression.includes(fn);
+		if (!(applying.some((policy) => policy.restrictive === true && calls(policy.expression)) || permissive.every((policy) => calls(policy.expression)))) out.push(`${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`);
+	}
+	return out;
+}
 const SYSTEM_SCHEMAS = [
 	"pg_catalog",
 	"information_schema",
@@ -2214,7 +2199,7 @@ const SYSTEM_SCHEMAS = [
 	"supabase_migrations"
 ];
 function inScope(table) {
-	const schema = table.split(".")[0] ?? "";
+	const schema = beforeFirst(table, ".");
 	return HELPER_TABLES.some((item) => item === table) || !(SYSTEM_SCHEMAS.some((item) => item === schema) || schema.startsWith("pg_"));
 }
 function seedLine(row) {
@@ -2236,13 +2221,16 @@ function diffMixed(expected, actual) {
 		for (const key of helperCallKeys(policy.expression)) if (!permissions.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, which the policy does not declare, so it always denies`);
 		else if (conditioned.has(key) && blind.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`);
 	}
+	if (expected.readOnlyActors === true) drift.push(...unguardedWrites(actual.policies, ACTOR_MAY_WRITE));
 	return {
 		drift,
 		info: actual.rlsTables.filter((table) => !covered.has(table)).map((table) => `${table}: no policy calls a PermDock helper`)
 	};
 }
 const ALL_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname,
-  coalesce(qual, '') || ' ' || coalesce(with_check, '') as expression
+  coalesce(qual, '') || ' ' || coalesce(with_check, '') as expression,
+  lower(cmd) as command, permissive = 'RESTRICTIVE' as restrictive,
+  array_to_string(roles, ',') as roles
 from pg_policies`;
 const RLS_TABLES_SQL = `select n.nspname || '.' || c.relname as target
 from pg_class c
@@ -2269,7 +2257,10 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 			policies: policies.rows.map((row) => ({
 				table: String(row["target"]),
 				name: String(row["policyname"]),
-				expression: String(row["expression"])
+				expression: String(row["expression"]),
+				command: String(row["command"]),
+				restrictive: row["restrictive"] === true,
+				roles: String(row["roles"] ?? "").split(",").filter((role) => role !== "")
 			})).filter((row) => inScope(row.table)),
 			rlsTables: tables.rows.map((row) => String(row["target"])).filter(inScope).toSorted()
 		};
@@ -2278,26 +2269,15 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 	}
 }
 //#endregion
-//#region src/cli/rls.ts
+//#region src/cli/rls/rls.ts
 const RLS_HELP = `permdock rls generate | import | verify | migrate
 
-  generate --target drizzle|sql|prisma --dialect supabase|neon|guc
-           [--rbac supabase] [--rbac-schema public] [--authorize database|jwt]
-           [--memberships <table>:tenant,user,role]
-           [--policy-per-role] [--policy-name '{table}_{op}'] [--tenant-type uuid] [--custom-roles]
-           [--capabilities] [--fields views [--revoke-columns]]
-           [--out <path>] [--check] [--skip-closures] [--inline-functions] [--force] [--guc-prefix app]
-           [--split helpers,seeds,policies,hook --out <dir>/056_permdock_{part}.sql]
-           [--grants-out <file>|-] [--seeds-out <file>|-]
-           [--helpers-only] [--shims] [--db $DATABASE_URL]
-  import   --sql schema.sql | --db $DATABASE_URL --out src/permissions.generated.ts
-           [--schema zod|valibot|arktype] [--memberships <table>:tenant,user,role]
-  verify   [--db $DATABASE_URL] [--fixtures rls.fixtures.ts] [--format pgtap|node] [--tree]
-           [--introspect --db $DATABASE_URL, with the generate flags]
-           [--advisors [--db $DATABASE_URL] [--json]]: supabase db advisors, security lints
-  migrate  --sql <dir> [--write] [--json], with the generate flags
-           rewrites the rls.migrate helpers' calls in policies onto the generated helpers
+  generate  Compile the policy into RLS policies and helpers
+  import    Turn existing policies (--sql or --db-url-stdin) into a permissions module
+  verify    Run the fixtures, or compare a live database with --introspect
+  migrate   Rewrite the rls.migrate helpers' calls onto the generated helpers
 
+Run permdock rls <command> --help for its flags.
 Never emits service_role, except in the execute grant rls.trustedReaders asks for. memberOf compiles through the dialect memberships mapping.
 `;
 function asTarget(value) {
@@ -2322,6 +2302,9 @@ function generateInput(input, target, dialect) {
 		io: input.io,
 		...input.out === void 0 ? {} : { out: input.out },
 		...input.from === void 0 ? {} : { from: input.from },
+		...input.project === void 0 ? {} : { project: input.project },
+		...input.url === void 0 ? {} : { url: input.url },
+		json: input.json,
 		...input.memberships === void 0 ? {} : { memberships: input.memberships },
 		...input.gucPrefix === void 0 ? {} : { gucPrefix: input.gucPrefix },
 		policyPerRole: input.policyPerRole,
@@ -2332,8 +2315,10 @@ function generateInput(input, target, dialect) {
 		...input.fields === void 0 ? {} : { fields: input.fields },
 		revokeColumns: input.revokeColumns,
 		...input.split === void 0 ? {} : { split: input.split },
+		...isSupabaseSchemas(input.schemas) ? { schemas: input.schemas } : {},
 		...input.grantsOut === void 0 ? {} : { grantsOut: input.grantsOut },
 		...input.seedsOut === void 0 ? {} : { seedsOut: input.seedsOut },
+		...input.backfillOut === void 0 ? {} : { backfillOut: input.backfillOut },
 		helpersOnly: input.helpersOnly,
 		shims: input.shims === true
 	};
@@ -2363,18 +2348,24 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-CN4TlJTO.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-BShP7Vf4.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
 		config,
-		target: migrateTarget(generated),
+		target: {
+			...migrateTarget(generated),
+			...input.config.rls?.roleValues === void 0 ? {} : { roleValues: input.config.rls.roleValues }
+		},
 		write: input.write,
-		json: input.json
+		force: input.forceRewrite === true,
+		json: input.json,
+		retireOut: input.retireOut,
+		...input.io.now === void 0 ? {} : { now: input.io.now() }
 	});
 }
 /** `verify --introspect` with `--helpers-only`: helpers and seeds exactly, hand-written policies by their keys. */
-async function introspectHelpersOnly(db, expected, generated, connect) {
+async function introspectHelpersOnly(db, expected, generated, connect, readOnlyActors) {
 	const schema = generated.schema ?? "permdock";
 	try {
 		const actual = await introspectRls(db, expected, connect);
@@ -2384,7 +2375,8 @@ async function introspectHelpersOnly(db, expected, generated, connect) {
 			schema,
 			seeds: generated.seeds ?? [],
 			permissions: generated.keys?.permissions ?? [],
-			rowConditions: generated.keys?.rowConditions ?? []
+			rowConditions: generated.keys?.rowConditions ?? [],
+			readOnlyActors
 		}, await introspectMixed(db, schema, connect));
 		const drift = [...helpers, ...mixed.drift];
 		const info = mixed.info.map((line) => `info: ${line}`);
@@ -2411,7 +2403,7 @@ async function introspectHelpersOnly(db, expected, generated, connect) {
 async function introspect(input) {
 	if (input.db === void 0) return {
 		code: 2,
-		output: "PermDock CLI: rls verify --introspect needs --db"
+		output: "PermDock CLI: rls verify --introspect needs a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 	};
 	const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
 	if (dialect === void 0) return {
@@ -2428,7 +2420,7 @@ async function introspect(input) {
 		output: generated.output
 	};
 	const expected = expectedRls(generated.policies, generated.text, generated.indexes);
-	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect);
+	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect, readOnlyActorKinds(input.config.rls?.readOnlyActors) !== void 0);
 	try {
 		const actual = await introspectRls(input.db, expected, input.connect);
 		const drift = diffRls(expected, actual, { columnGrants: (input.fields ?? input.config.rls?.fields) === "views" });
@@ -2451,6 +2443,11 @@ async function runRls(input) {
 		code: 2,
 		output: RLS_HELP
 	};
+	const badSchemas = schemasRefusal(`rls ${action}`, input.schemas);
+	if (badSchemas !== void 0) return {
+		code: 2,
+		output: badSchemas
+	};
 	switch (action) {
 		case "generate": {
 			const target = asTarget(input.target);
@@ -2471,7 +2468,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./rls-import-4lLW_pbb.js");
+			const { runRlsImport } = await import("./import-DMmOG27O.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,
@@ -2489,6 +2486,7 @@ async function runRls(input) {
 				cwd: input.cwd,
 				json: input.json,
 				env: input.io.env ?? process.env,
+				...input.io.signal === void 0 ? {} : { signal: input.io.signal },
 				...input.db === void 0 ? {} : { db: input.db },
 				...input.exec === void 0 ? {} : { exec: input.exec }
 			});