permdock 0.4.0 → 0.6.0

package/dist/{rls-BEktUaqg.js → rls-DTvYd-lI.js}

@@ -1,27 +1,32 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { d as scopeList, o as resolveScope } from "./scopes-tvpa34ep.js";
-import { c as listPermissions, u as renamedKeys } from "./permission-registry-BsblpB-z.js";
-import { o as flattenGrantee, v as listRoles } from "./grantee-CXY-0C87.js";
-import { p as scopeField } from "./tenancy-DshjqY0n.js";
-import { a as exitCodeOf, i as describeError, n as cliErrorKind, o as usageResult } from "./errors-CWfoNg9N.js";
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-Br4jSNVi.js";
+import { i as dateAt } from "./time-DkWjdL98.js";
+import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee, v as listRoles } from "./grantee-hxrUsbpM.js";
+import { p as scopeField } from "./tenancy-DN2QAx9z.js";
+import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-CWTY6uih.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { c as requirePolicy } from "./load-C3_oTHyO.js";
+import { c as requirePolicy } from "./load-DFS_ry0W.js";
 import "./budget-NbEtbJC_.js";
-import { l as sqlTextArray, n as escapeSqlIdent, r as qualifySqlTable } from "./sql-t8teWOfo.js";
-import { l as roleColumn } from "./sources-B1-b-R0t.js";
-import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-CiwAOZtO.js";
-import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { c as rbacScaffold, l as resolveAuthorize, o as supabaseHookSql, p as supabaseConfig, s as parseRbacAuthorize, t as grantsLabel } from "./supabase-hook-Cva3ikXz.js";
-import { C as parseMembershipsFlag, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent$1, O as tenantTypeOf, P as quoteLiteral, _ as subjectClaimJsonSql, a as customRolesOn, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-1uhI-e-b.js";
-import { a as parseSplit, c as seedsMigration, i as isSeedsDirectory, l as writeOutputFiles, n as driftOf, o as partPath, s as pgDeltaPath, t as dataMigrationFile } from "./output-files-CgIsvdSa.js";
+import { i as qualifySqlTable, r as escapeSqlIdent, u as sqlTextArray } from "./sql-B5T1IL83.js";
+import { l as roleColumn } from "./sources-vs5dGOsS.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-C2gMa2Dj.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-C6joDI3o.js";
+import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-C8swJ2GH.js";
+import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
+import { t as fetchProjectPolicy } from "./pull-jEwbf80J.js";
+import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
+import { c as approvalsSql, d as resolveAuthorize, h as schemasRefusal, l as parseRbacAuthorize, m as resolveSchemas, o as supabaseHookSql, p as isSupabaseSchemas, s as permissionHoldersSql, t as grantsLabel, u as rbacScaffold } from "./supabase-hook-BMoEhZir.js";
+import { C as parseMembershipsFlag, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent$1, O as tenantTypeOf, P as quoteLiteral, _ as subjectClaimJsonSql, a as customRolesOn, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-BAK8t4Uo.js";
 import { a as splitUndiffed } from "./deciding-columns-Sq12mEA6.js";
-import { B as memberIdsHelper, C as apiKeysPlan, D as roleNames, E as collectGrants, G as scopeSources, K as scopeTable, M as graphHelper, N as graphSqlName, T as breakGlassKey, U as permittedIdsHelper, X as connectPgPool, Y as checkSuspension, a as accessSql, o as helpersSql, r as permittedByPermissionHelper, s as seedSql, t as permissionHelpersSql, v as currentKeyExpr, w as breakGlassHolder } from "./permission-keys-B26jeyUv.js";
-import { n as ownershipSql, r as assignmentSql, t as ownershipRules } from "./ownership-BgnbOJFT.js";
-import { _ as indexTargets, a as fieldViewsSql, b as readTableIndexFacts, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as COLUMNS_SQL, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, r as columnRevokeSql, u as readOnlyActorKinds, v as indexesSql, y as pruneIndexTargets } from "./fields-fwfXN01n.js";
-import { a as graphSql, c as callsHelper, i as graphPlan, l as helperCallKeys, n as runRlsVerify, o as HELPER_TABLES, r as closureDepths } from "./verify-BztUB3GX.js";
+import { a as readOnlyActorKinds, c as branchClauses, d as connectPgPool, i as orSql, n as actorMayWriteSql, o as readOnlyActorPolicies, r as assemblePolicies, t as ACTOR_MAY_WRITE } from "./policies-DP2nqRoF.js";
+import { A as collectGrants, C as byKey, D as apiKeysPlan, G as memberIdsHelper, I as graphHelper, J as permittedIdsHelper, L as graphSqlName, O as breakGlassHolder, S as byCodeUnit, X as scopeSources, Z as scopeTable, b as currentKeyExpr, et as checkSuspension, f as permittedByPermissionHelper, g as seedSql, h as helpersSql, i as assignmentSql, j as roleNames, k as breakGlassKey, m as accessSql, n as ownershipSql, t as ownershipRules, u as permissionHelpersSql, x as rolesTableScope } from "./ownership-DqaJNJPn.js";
+import { _ as indexesSql, a as graphSql, c as callsHelper, g as indexTargets, h as COLUMNS_SQL, i as graphPlan, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as closureDepths, v as pruneIndexTargets, y as readTableIndexFacts } from "./verify-BaAKx7t6.js";
+import { a as fieldViewsSql, i as fieldViews, n as columnGrantSql, o as rowBranches, r as columnRevokeSql } from "./fields-OYG_JR78.js";
 import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
 import { basename, delimiter, join } from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 //#region src/cli/rls/advisors.ts
 /** The PermDock doctor check that reports the same problem in migrations. */
 const ADVISOR_CODES = {
@@ -32,19 +37,41 @@ const ADVISOR_CODES = {
 	anon_security_definer_function_executable: "PD049",
 	authenticated_security_definer_function_executable: "PD046"
 };
-const defaultExec = (command, args, options) => {
-	const result = spawnSync(command, [...args], {
+const defaultExec = (command, args, options) => new Promise((resolve) => {
+	const child = spawn(command, [...args], {
 		cwd: options.cwd,
 		env: options.env,
-		encoding: "utf8"
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		...options.signal === void 0 ? {} : { signal: options.signal }
 	});
-	return {
-		status: result.status,
-		stdout: result.stdout ?? "",
-		stderr: result.stderr ?? "",
-		...result.error === void 0 ? {} : { error: result.error }
-	};
-};
+	let stdout = "";
+	let stderr = "";
+	child.stdout.setEncoding("utf8").on("data", (chunk) => {
+		stdout += chunk;
+	});
+	child.stderr.setEncoding("utf8").on("data", (chunk) => {
+		stderr += chunk;
+	});
+	child.once("error", (error) => {
+		resolve({
+			status: null,
+			stdout,
+			stderr,
+			error
+		});
+	});
+	child.once("close", (status) => {
+		resolve({
+			status,
+			stdout,
+			stderr
+		});
+	});
+});
 function text(value, key) {
 	const field = typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
 	return typeof field === "string" ? field : "";
@@ -65,16 +92,19 @@ function findingsOf(value) {
 		return code === void 0 ? finding : Object.assign(finding, { code });
 	});
 }
-const INSTALL = "rls verify --advisors runs the Supabase CLI: install it with npm install --save-dev supabase (or brew install supabase/tap/supabase)";
+function installHint(agent) {
+	return `rls verify --advisors runs the Supabase CLI: install it with ${addLine(agent, ["supabase"], { dev: true })} (or brew install supabase/tap/supabase)`;
+}
 /**
-* `supabase db advisors --type security` against `--db` or the local stack.
-* Exit 1 on a WARN or ERROR row, 2 when the CLI is missing or fails.
+* `supabase db advisors --type security` against `--db-url` or the local stack,
+* from the project's `node_modules/.bin` first, then `PATH`. Exit 1 on a WARN
+* or ERROR row, 2 when the CLI is missing or fails.
 */
-function runRlsAdvisors(input) {
+async function runRlsAdvisors(input) {
 	const exec = input.exec ?? defaultExec;
 	const bin = join(input.cwd, "node_modules", ".bin");
 	const path = input.env["PATH"];
-	const result = exec("supabase", [
+	const result = await exec("supabase", [
 		"db",
 		"advisors",
 		...input.db === void 0 ? ["--local"] : ["--db-url", input.db],
@@ -87,11 +117,12 @@ function runRlsAdvisors(input) {
 		env: {
 			...input.env,
 			PATH: path === void 0 ? bin : `${bin}${delimiter}${path}`
-		}
+		},
+		...input.signal === void 0 ? {} : { signal: input.signal }
 	});
 	if (result.error !== void 0) return {
 		code: 2,
-		output: INSTALL
+		output: installHint(await packageManagerOf(input.cwd))
 	};
 	let parsed;
 	try {
@@ -129,6 +160,11 @@ function runRlsAdvisors(input) {
 }
 //#endregion
 //#region src/cli/rls/generate-context.ts
+/** The scopes an `rls.migrate` `role` helper names, so `rls generate` writes their role-filtered member helper. */
+function roleMemberScopesOf(migrate) {
+	const scopes = [...new Set(Object.values(migrate?.helpers ?? {}).flatMap((helper) => helper.form === "role" ? [helper.scope] : []))].toSorted();
+	return scopes.length === 0 ? {} : { roleMemberScopes: scopes };
+}
 /** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
 function writeRequirement(policy, requires) {
 	if (requires === void 0) return {};
@@ -161,7 +197,7 @@ function skippedOwnershipTriggers(triggers, scopes) {
 	if (triggers === false) return "all";
 	return Object.keys(triggers).map((key) => {
 		const name = resolveScope(scopes, key);
-		if (name === void 0) throw new Error(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
+		if (name === void 0) throw configError(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
 		return name;
 	});
 }
@@ -195,6 +231,8 @@ function buildContext(input, policy, options) {
 			dialect: input.dialect,
 			scopes,
 			tenantClaim: rls?.tenantClaim ?? "tenant_id",
+			...roleMemberScopesOf(rls?.migrate),
+			...rls?.roleValues === void 0 ? {} : { roleValues: rls.roleValues },
 			...rls?.tenants === "all" ? { tenants: "all" } : {},
 			gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
 			...rls?.actions === void 0 ? {} : { actions: rls.actions },
@@ -272,7 +310,30 @@ function moveUndiffed(sql, label, part) {
 		grants: `-- the privileges and view options supabase db diff drops from the ${part} part\n${moved.join("\n")}`
 	};
 }
-/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants. */
+/** Why `--split` cannot be written for `mode`, or `undefined`. */
+function splitRefusal(mode, plan) {
+	const seedsWithoutOut = plan.split.includes("seeds") && plan.seedsOut === void 0;
+	const helpersWithoutSeeds = plan.split.includes("helpers") && !plan.split.includes("seeds");
+	switch (mode) {
+		case "pg-delta":
+			if (plan.explicitOut && !plan.placeholder) return `rls generate --split needs {part} in --out, or no --out for pg-delta's per-schema layout (got ${plan.outRel})`;
+			if (plan.grantsOut !== void 0) return "rls generate --grants-out is for --schemas migra: pg-delta keeps the grants in each part, so drop --grants-out";
+			if (helpersWithoutSeeds) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
+			if (seedsWithoutOut) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
+			return;
+		case "migra":
+			if (!plan.placeholder) return `rls generate --split under migra needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
+			if (helpersWithoutSeeds) return "rls generate --split helpers under migra needs the seeds part with --seeds-out: supabase db diff does not carry the role_permissions rows from a schema file";
+			if (seedsWithoutOut) return "rls generate --split seeds under migra needs --seeds-out: supabase db diff does not carry the role_permissions rows, so they go in a migration";
+			return;
+		case "migrations":
+			if (!plan.placeholder) return `rls generate --split needs {part} in --out, for example supabase/migrations/20260101000000_permdock_{part}.sql (got ${plan.outRel})`;
+			if (plan.grantsOut !== void 0) return "rls generate --grants-out is for --schemas migra: a hand-written migration keeps its grants, so drop --grants-out";
+			return;
+		default: return mode;
+	}
+}
+/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants under migra. */
 function outputFiles(plan) {
 	const { input } = plan;
 	const split = parseSplit(input.split);
@@ -288,17 +349,25 @@ function outputFiles(plan) {
 		}];
 	}
 	if (input.target !== "sql") return "rls generate --split needs --target sql";
-	const pgDelta = input.out === void 0 && input.config.rls?.out === void 0 ? supabaseConfig(input.cwd).pgDelta : void 0;
-	if (pgDelta === void 0 && !plan.outRel.includes("{part}")) return `rls generate --split needs {part} in --out, for example supabase/schemas/identity/056_permdock_{part}.sql (got ${plan.outRel})`;
-	if (pgDelta !== void 0 && split.includes("helpers") && !split.includes("seeds")) return "rls generate --split helpers under pg-delta needs the seeds part with --seeds-out: pg-delta rejects the role_permissions rows in a declarative file";
-	if (pgDelta !== void 0 && split.includes("seeds") && input.seedsOut === void 0) return "rls generate --split seeds under pg-delta needs --seeds-out: pg-delta does not diff the role_permissions rows, so they go in a migration";
-	const at = (part, schema = plan.schema) => pgDelta === void 0 ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
+	const schemas = resolveSchemas(input.cwd, input.config, input.schemas);
+	const pgDelta = schemas.mode === "pg-delta" ? schemas : void 0;
+	const placeholder = plan.outRel.includes("{part}");
+	const refused = splitRefusal(schemas.mode, {
+		split,
+		placeholder,
+		explicitOut: input.out !== void 0,
+		outRel: plan.outRel,
+		grantsOut: input.grantsOut,
+		seedsOut: input.seedsOut
+	});
+	if (refused !== void 0) return refused;
+	const at = (part, schema = plan.schema) => pgDelta === void 0 || placeholder ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
 	if (input.grantsOut !== void 0 && !split.includes("hook") && !split.includes("helpers")) return "rls generate --grants-out needs the helpers or hook part in --split";
 	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
 	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
 	const sql = plan.sql();
 	const relocated = pgDelta === void 0 ? void 0 : sql.servicePolicies;
-	if (relocated !== void 0 && split.includes("policies") && !split.includes("seeds")) return "rls generate --split policies under pg-delta with rls.realtime or rls.storage needs the seeds part with --seeds-out: the shadow database has no realtime.messages or storage.objects, so their policies go in that migration";
+	if (relocated !== void 0 && split.includes("policies") && !split.includes("seeds")) return "rls generate --split policies under pg-delta with rls.realtime or rls.storage needs the seeds part with --seeds-out: the declarative sync shadow database has no realtime.messages or storage.objects, so their policies go in that migration";
 	const seeds = relocated === void 0 || !split.includes("policies") ? sql.seeds : `${sql.seeds}\n${relocated}`;
 	const files = [];
 	const label = grantsLabel(input.grantsOut);
@@ -326,7 +395,7 @@ function outputFiles(plan) {
 		case "seeds": {
 			const out = input.seedsOut;
 			if (out !== void 0 && isSeedsDirectory(input.cwd, out)) {
-				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? /* @__PURE__ */ new Date());
+				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? dateAt());
 				if (!planned.current || input.check) files.push({
 					part,
 					rel: planned.rel,
@@ -377,574 +446,6 @@ function outputFiles(plan) {
 	return files;
 }
 //#endregion
-//#region src/cli/approval-schema.ts
-/** An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no `format`. */
-const INSTANT = String.raw`^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$`;
-const STRINGS = {
-	type: "array",
-	items: { type: "string" }
-};
-/**
-* `schemas/approval-request-v1.json`: the `ApprovalRequest` an approval store
-* holds. Self-contained (`$defs`, no remote `$ref`) so `rls.jsonSchema` can
-* inline it into a pg_jsonschema check constraint.
-*/
-const APPROVAL_REQUEST_SCHEMA = {
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	$id: "https://permdock.com/schemas/approval-request-v1.json",
-	title: "PermDock approval request",
-	description: "An ApprovalRequest as an ApprovalStore holds it, wire format v1. Unknown properties are allowed so a v1 minor release can add one.",
-	type: "object",
-	required: [
-		"v",
-		"token",
-		"permission",
-		"scope",
-		"resource",
-		"subject",
-		"detail",
-		"createdAt",
-		"expiresAt",
-		"status"
-	],
-	properties: {
-		v: { const: 1 },
-		token: {
-			type: "string",
-			minLength: 1
-		},
-		permission: {
-			type: "string",
-			minLength: 1
-		},
-		scope: { type: "string" },
-		resource: {
-			type: "object",
-			required: ["type"],
-			properties: {
-				type: { type: "string" },
-				id: { type: "string" }
-			}
-		},
-		subject: { $ref: "#/$defs/subject" },
-		membership: {
-			type: "object",
-			required: ["roles"],
-			properties: { roles: STRINGS }
-		},
-		approvers: { type: "object" },
-		detail: { type: "string" },
-		adapter: { type: "string" },
-		createdAt: { $ref: "#/$defs/instant" },
-		expiresAt: { $ref: "#/$defs/instant" },
-		status: { enum: [
-			"pending",
-			"approved",
-			"rejected",
-			"expired"
-		] },
-		approvals: {
-			type: "array",
-			items: { $ref: "#/$defs/signature" }
-		},
-		resolvedAt: { $ref: "#/$defs/instant" },
-		resolvedBy: { type: "string" },
-		vouched: { type: "string" },
-		note: { type: "string" },
-		consumedAt: { $ref: "#/$defs/instant" }
-	},
-	$defs: {
-		instant: {
-			type: "string",
-			pattern: INSTANT
-		},
-		subject: {
-			type: "object",
-			required: ["principal"],
-			properties: {
-				principal: { anyOf: [{ type: "null" }, {
-					type: "object",
-					required: ["id", "roles"],
-					properties: {
-						id: { type: "string" },
-						roles: STRINGS,
-						tenant: { type: "string" }
-					}
-				}] },
-				actor: {
-					type: "object",
-					required: ["id", "kind"],
-					properties: {
-						id: { type: "string" },
-						kind: { type: "string" }
-					}
-				},
-				session: { type: "string" },
-				delegation: { type: "object" }
-			}
-		},
-		signature: {
-			type: "object",
-			required: ["by", "at"],
-			properties: {
-				by: { type: "string" },
-				at: { $ref: "#/$defs/instant" },
-				stage: {
-					type: "integer",
-					minimum: 0
-				},
-				vouched: { type: "string" }
-			}
-		}
-	}
-};
-//#endregion
-//#region src/cli/rls/approvals.ts
-/** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
-const APPROVAL_STORE = {
-	table: "approval_requests",
-	open: "permdock_approval_open",
-	get: "permdock_approval_get",
-	resolve: "permdock_approval_resolve",
-	consume: "permdock_approval_consume",
-	list: "permdock_approval_list",
-	expire: "permdock_approval_expire",
-	cancel: "permdock_approval_cancel"
-};
-/** `body` as the row's filter columns hold it. */
-const COLUMNS = `p_request ->> 'token',
-    p_request,
-    p_request ->> 'status',
-    p_request #>> '{subject,principal,tenant}',
-    p_request #>> '{subject,principal,id}',
-    p_request #>> '{subject,actor,id}',
-    p_request #>> '{subject,session}',
-    coalesce(jsonb_array_length(p_request -> 'approvals'), 0),
-    p_request ->> 'createdAt',
-    (p_request ->> 'expiresAt')::timestamptz,
-    (p_request ->> 'consumedAt')::timestamptz`;
-/** The `ApprovalListFilter` in `p_filter`, over the row aliased `a`. */
-const FILTER = `(p_filter ->> 'status' is null or a.status = p_filter ->> 'status')
-    and (p_filter ->> 'tenant' is null or a.tenant = p_filter ->> 'tenant')
-    and (p_filter ->> 'principalId' is null or a.principal_id = p_filter ->> 'principalId')
-    and (p_filter ->> 'actorId' is null or a.actor_id = p_filter ->> 'actorId')
-    and (p_filter ->> 'session' is null or a.session = p_filter ->> 'session')`;
-function serverOnly(fn, args) {
-	return `revoke execute on function ${fn}(${args}) from public, anon, authenticated;`;
-}
-const BODY_CHECK = `${APPROVAL_STORE.table}_body_schema`;
-/**
-* `rls.jsonSchema`: a pg_jsonschema check that `body` matches
-* `approval-request-v1.json`, added `not valid` and then validated. `auto`
-* adds it only where the extension is available.
-*/
-function bodySchemaSql(table, mode, body = "body", check = BODY_CHECK) {
-	const statements = [
-		"create schema if not exists extensions;",
-		"create extension if not exists pg_jsonschema with schema extensions;",
-		`alter table ${table} drop constraint if exists "${check}";`,
-		`alter table ${table} add constraint "${check}" check (extensions.jsonb_matches_schema(${quoteLiteral(JSON.stringify(APPROVAL_REQUEST_SCHEMA))}::json, ${body})) not valid;`,
-		`alter table ${table} validate constraint "${check}";`
-	];
-	const comment = "-- approval store: body matches schemas/approval-request-v1.json through pg_jsonschema";
-	if (mode === true) return `\n${comment}\n${statements.join("\n")}\n`;
-	return `\n${comment}, where the extension is available
-do $permdock$
-begin
-  if exists (select 1 from pg_available_extensions where name = 'pg_jsonschema') then
-${statements.map((statement) => `    ${statement}`).join("\n")}
-  end if;
-end
-$permdock$;\n`;
-}
-/**
-* The approval store (`rls.approvals`): one table of `ApprovalRequest`
-* bodies with the columns a list filters on, and one `security definer`
-* function per `ApprovalStore` method, each one atomic statement. No client
-* role may read the table or execute the functions: approvals are opened and
-* resolved by the server, which grants its own role.
-*/
-function approvalStoreSql(ctx, jsonSchema = false) {
-	const table = qualified(ctx, APPROVAL_STORE.table);
-	const fn = (name) => qualified(ctx, name);
-	const index = (name) => `"${APPROVAL_STORE.table}_${name}"`;
-	return `-- approval store: ApprovalRequest bodies, opened, resolved and consumed through the functions below; supabaseApprovalStore calls them
-create table if not exists ${table} (
-  token text primary key,
-  body jsonb not null,
-  status text not null check (status in ('pending', 'approved', 'rejected', 'expired')),
-  tenant text,
-  principal_id text,
-  actor_id text,
-  session text,
-  approvals integer not null default 0,
-  created_at text not null,
-  expires_at timestamptz not null,
-  consumed_at timestamptz
-);
-create index if not exists ${index("page")} on ${table} (created_at collate "C", token collate "C");
-create index if not exists ${index("pending")} on ${table} (status, expires_at);
-alter table ${table} enable row level security;
-revoke all on table ${table} from anon, authenticated, public;
-${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema)}
--- open a request; a repeated ask keeps the open record and replaces only an expired one
-create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
-returns void
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  insert into ${table} as a (token, body, status, tenant, principal_id, actor_id, session, approvals, created_at, expires_at, consumed_at)
-  values (
-    ${COLUMNS}
-  )
-  on conflict (token) do update
-    set body = excluded.body, status = excluded.status, tenant = excluded.tenant,
-      principal_id = excluded.principal_id, actor_id = excluded.actor_id, session = excluded.session,
-      approvals = excluded.approvals, created_at = excluded.created_at,
-      expires_at = excluded.expires_at, consumed_at = excluded.consumed_at
-    where a.status = 'expired' or a.expires_at <= now()
-$$;
-${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
-
-create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
-returns jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.body from ${table} a where a.token = p_token
-$$;
-${serverOnly(fn(APPROVAL_STORE.get), "text")}
-
--- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
-create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set body = p_next,
-    status = p_next ->> 'status',
-    approvals = coalesce(jsonb_array_length(p_next -> 'approvals'), 0)
-  where a.token = p_token
-    and a.status = 'pending'
-    and a.expires_at > now()
-    and a.approvals = p_seen
-  returning a.body
-$$;
-${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
-
--- consume an approved, unexpired, unconsumed request once
-create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set consumed_at = p_now::timestamptz,
-    body = a.body || jsonb_build_object('consumedAt', p_now)
-  where a.token = p_token
-    and a.status = 'approved'
-    and a.consumed_at is null
-    and a.expires_at > p_now::timestamptz
-  returning a.body
-$$;
-${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
-
--- one page in (createdAt, token) order after the cursor position
-create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
-returns setof jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.body
-  from ${table} a
-  where ${FILTER}
-    and (p_after_created is null
-      or (a.created_at collate "C", a.token collate "C") > (p_after_created collate "C", p_after_token collate "C"))
-  order by a.created_at collate "C", a.token collate "C"
-  limit p_limit
-$$;
-${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
-
-create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with expired as (
-    update ${table} a
-    set status = 'expired', body = a.body || '{"status":"expired"}'::jsonb
-    where a.status = 'pending' and a.expires_at <= p_now::timestamptz
-    returning 1
-  )
-  select count(*)::integer from expired
-$$;
-${serverOnly(fn(APPROVAL_STORE.expire), "text")}
-
--- reject every pending request the filter matches, as system:<by>
-create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with cancelled as (
-    update ${table} a
-    set status = 'rejected',
-      body = (a.body - 'note') || jsonb_strip_nulls(jsonb_build_object(
-        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
-      ))
-    where a.status = 'pending'
-      and ${FILTER.replaceAll("\n    ", "\n      ")}
-    returning 1
-  )
-  select count(*)::integer from cancelled
-$$;
-${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
-`;
-}
-/** The request fields an adopted table may mirror into its own columns, as SQL over a body. */
-const MIRRORS = {
-	status: (body) => `${body} ->> 'status'`,
-	permission: (body) => `${body} ->> 'permission'`,
-	tenant: (body) => `${body} #>> '{subject,principal,tenant}'`,
-	principalId: (body) => `${body} #>> '{subject,principal,id}'`,
-	actorId: (body) => `${body} #>> '{subject,actor,id}'`,
-	session: (body) => `${body} #>> '{subject,session}'`,
-	approvals: (body) => `coalesce(jsonb_array_length(${body} -> 'approvals'), 0)`,
-	createdAt: (body) => `${body} ->> 'createdAt'`,
-	expiresAt: (body) => `${body} ->> 'expiresAt'`,
-	resolvedAt: (body) => `${body} ->> 'resolvedAt'`,
-	resolvedBy: (body) => `${body} ->> 'resolvedBy'`,
-	consumedAt: (body) => `${body} ->> 'consumedAt'`
-};
-function mirrorsOf(adopt) {
-	const out = [];
-	for (const [field, column] of Object.entries(adopt.mirror ?? {})) {
-		if (!Object.hasOwn(MIRRORS, field)) throw new Error(`PermDock CLI: rls.approvals.mirror.${field} is not a request field; use ${Object.keys(MIRRORS).join(", ")}`);
-		if (typeof column !== "string") throw new TypeError(`PermDock CLI: rls.approvals.mirror.${field} must be a column name`);
-		out.push([column, field]);
-	}
-	return out;
-}
-/** One row of `table` from `values` (column, SQL), each converted to the column's own type. */
-function populate(table, values) {
-	return `pg_catalog.jsonb_populate_record(null::${table}, pg_catalog.jsonb_build_object(${values.map(([column, sql]) => `${quoteLiteral(column)}, ${sql}`).join(", ")}))`;
-}
-/** The mirrored columns' values for the request `body`. */
-function mirrorRow(table, mirror, body) {
-	return populate(table, mirror.map(([column, field]) => [column, MIRRORS[field](body)]));
-}
-/** `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty without mirrors. */
-function mirrorSet(table, mirror, body) {
-	if (mirror.length === 0) return "";
-	const columns = mirror.map(([column]) => quoteIdent$1(column));
-	const picked = columns.map((column) => `r.${column}`).join(", ");
-	return `,\n    ${columns.length === 1 ? columns[0] ?? "" : `(${columns.join(", ")})`} = (select ${picked} from ${mirrorRow(table, mirror, body)} r)`;
-}
-/**
-* The approval store over a table the app already has (`rls.approvals:
-* { table, token?, body?, mirror? }`): the same `permdock_approval_*`
-* functions, reading every field from the request body in `body`, keyed by
-* the text column `token`, and copying the fields `mirror` names into the
-* app's own columns, converted to their types, on every write. The table's
-* grants and policies stay the app's.
-*/
-function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
-	const table = quoteQualified(adopt.table);
-	const base = adopt.table.split(".").at(-1) ?? adopt.table;
-	const token = quoteIdent$1(adopt.token ?? "token");
-	const body = quoteIdent$1(adopt.body ?? "body");
-	const mirror = mirrorsOf(adopt);
-	for (const [column] of mirror) if (column === (adopt.token ?? "token") || column === (adopt.body ?? "body")) throw new Error(`PermDock CLI: rls.approvals.mirror names the ${column} column, which already holds the token or the body`);
-	const open = adopt.open ?? "insert";
-	if (open !== "insert" && open !== "attach") throw new Error(`PermDock CLI: rls.approvals.open must be 'insert' or 'attach', got '${String(open)}'`);
-	const schema = adopt.schema;
-	if (schema !== void 0 && (typeof schema !== "string" || schema === "")) throw new Error("PermDock CLI: rls.approvals.schema must be a schema name");
-	const fn = (name) => schema === void 0 ? qualified(ctx, name) : `${quoteIdent$1(schema)}.${name}`;
-	const index = (name) => quoteIdent$1(`${base}_permdock_${name}`);
-	const status = `a.${body} ->> 'status'`;
-	const expires = `(a.${body} ->> 'expiresAt')::timestamptz`;
-	const created = `(a.${body} ->> 'createdAt')`;
-	const filter = `(p_filter ->> 'status' is null or ${status} = p_filter ->> 'status')
-    and (p_filter ->> 'tenant' is null or a.${body} #>> '{subject,principal,tenant}' = p_filter ->> 'tenant')
-    and (p_filter ->> 'principalId' is null or a.${body} #>> '{subject,principal,id}' = p_filter ->> 'principalId')
-    and (p_filter ->> 'actorId' is null or a.${body} #>> '{subject,actor,id}' = p_filter ->> 'actorId')
-    and (p_filter ->> 'session' is null or a.${body} #>> '{subject,session}' = p_filter ->> 'session')`;
-	const columns = [
-		token,
-		body,
-		...mirror.map(([column]) => quoteIdent$1(column))
-	];
-	const inserted = populate(table, [
-		[adopt.token ?? "token", "p_request ->> 'token'"],
-		[adopt.body ?? "body", "p_request"],
-		...mirror.map(([column, field]) => [column, MIRRORS[field]("p_request")])
-	]);
-	const insertSql = `-- open a request; a repeated ask keeps the open record and replaces only an expired one
-create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
-returns void
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  insert into ${table} as a (${columns.join(", ")})
-  select ${columns.map((column) => `r.${column}`).join(", ")}
-  from ${inserted} r
-  on conflict (${token}) do update
-    set ${columns.filter((column) => column !== token).map((column) => `${column} = excluded.${column}`).join(", ")}
-    where ${status} = 'expired' or ${expires} <= now()
-$$;`;
-	const attachSql = `create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
-returns void
-language plpgsql
-volatile
-security definer
-set search_path = ''
-as $$
-begin
-  update ${table} a
-  set ${body} = p_request${mirrorSet(table, mirror, "p_request")}
-  where a.${token} = p_request ->> 'token'
-    and (a.${body} is null or ${status} = 'expired' or ${expires} <= now());
-  if not found and not exists (select 1 from ${table} a where a.${token} = p_request ->> 'token') then
-    raise exception using
-      errcode = 'P0002',
-      message = 'permdock: no row of ${adopt.table.replaceAll("'", "''")} holds approval token ' || (p_request ->> 'token'),
-      hint = 'insert the application row with this token before opening the request';
-  end if;
-end;
-$$;`;
-	return `-- approval store adopted onto ${adopt.table}: ApprovalRequest bodies in ${adopt.body ?? "body"}, keyed by ${adopt.token ?? "token"}; supabaseApprovalStore calls the functions below
-alter table ${table} add column if not exists ${token} text;
-alter table ${table} add column if not exists ${body} jsonb;
-create unique index if not exists ${index("token")} on ${table} (${token});
-create index if not exists ${index("page")} on ${table} ((${body} ->> 'createdAt') collate "C", ${token} collate "C");
-create index if not exists ${index("status")} on ${table} ((${body} ->> 'status'));
-${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema, body, `${base}_permdock_body_schema`)}
-${open === "attach" ? attachSql : insertSql}
-${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
-
-create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
-returns jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.${body} from ${table} a where a.${token} = p_token
-$$;
-${serverOnly(fn(APPROVAL_STORE.get), "text")}
-
--- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
-create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set ${body} = p_next${mirrorSet(table, mirror, "p_next")}
-  where a.${token} = p_token
-    and ${status} = 'pending'
-    and ${expires} > now()
-    and coalesce(jsonb_array_length(a.${body} -> 'approvals'), 0) = p_seen
-  returning a.${body}
-$$;
-${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
-
--- consume an approved, unexpired, unconsumed request once
-create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
-returns jsonb
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  update ${table} a
-  set ${body} = a.${body} || jsonb_build_object('consumedAt', p_now)${mirrorSet(table, mirror, `(a.${body} || jsonb_build_object('consumedAt', p_now))`)}
-  where a.${token} = p_token
-    and ${status} = 'approved'
-    and a.${body} ->> 'consumedAt' is null
-    and ${expires} > p_now::timestamptz
-  returning a.${body}
-$$;
-${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
-
--- one page in (createdAt, token) order after the cursor position
-create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
-returns setof jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select a.${body}
-  from ${table} a
-  where a.${body} is not null
-    and ${filter}
-    and (p_after_created is null
-      or (${created} collate "C", a.${token} collate "C") > (p_after_created collate "C", p_after_token collate "C"))
-  order by ${created} collate "C", a.${token} collate "C"
-  limit p_limit
-$$;
-${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
-
-create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with expired as (
-    update ${table} a
-    set ${body} = a.${body} || '{"status":"expired"}'::jsonb${mirrorSet(table, mirror, `(a.${body} || '{"status":"expired"}'::jsonb)`)}
-    where ${status} = 'pending' and ${expires} <= p_now::timestamptz
-    returning 1
-  )
-  select count(*)::integer from expired
-$$;
-${serverOnly(fn(APPROVAL_STORE.expire), "text")}
-
--- reject every pending request the filter matches, as system:<by>
-create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
-returns integer
-language sql
-volatile
-security definer
-set search_path = ''
-as $$
-  with cancelled as (
-    update ${table} a
-    set ${body} = (a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object(
-        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
-      ))${mirrorSet(table, mirror, `((a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object('status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note)))`)}
-    where ${status} = 'pending'
-      and ${filter.replaceAll("\n    ", "\n      ")}
-    returning 1
-  )
-  select count(*)::integer from cancelled
-$$;
-${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
-`;
-}
-//#endregion
 //#region src/cli/rls/backfill.ts
 const PREFIX$1 = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -952,16 +453,16 @@ function col(name) {
 	return `r.${quoteIdent$1(name)}`;
 }
 function schemaOf(table) {
-	return table.includes(".") ? table.split(".")[0] ?? "public" : "public";
+	return table.includes(".") ? beforeFirst(table, ".") : "public";
 }
 /** The roles-table column a reference joins on, after checking it points at `roles`. */
 function roleRef(role, table, roles, label) {
 	const pairs = Object.entries(role.on);
 	const [pair] = pairs;
-	if (pair === void 0 || pairs.length !== 1) throw new Error(`${PREFIX$1}: ${label}.on must map exactly one column of ${table} to ${role.through}, for example { role_id: 'id' }`);
+	if (pair === void 0 || pairs.length !== 1) throw configError(`${PREFIX$1}: ${label}.on must map exactly one column of ${table} to ${role.through}, for example { role_id: 'id' }`);
 	const through = role.through.includes(".") ? role.through : `${schemaOf(table)}.${role.through}`;
-	if (qualifySqlTable(through) !== qualifySqlTable(roles.table)) throw new Error(`${PREFIX$1}: ${label}.through must be rls.customRoleWrites.roles.table (${roles.table}), got ${role.through}`);
-	if (role.column !== roles.key) throw new Error(`${PREFIX$1}: ${label}.column must be rls.customRoleWrites.roles.key (${roles.key}), got ${role.column}`);
+	if (qualifySqlTable(through) !== qualifySqlTable(roles.table)) throw configError(`${PREFIX$1}: ${label}.through must be rls.customRoleWrites.roles.table (${roles.table}), got ${role.through}`);
+	if (role.column !== roles.key) throw configError(`${PREFIX$1}: ${label}.column must be rls.customRoleWrites.roles.key (${roles.key}), got ${role.column}`);
 	const [ref, id] = pair;
 	return {
 		ref,
@@ -976,10 +477,10 @@ function roleRef(role, table, roles, label) {
 function legacyKeySql(expr, migrate, renamed) {
 	const exact = new Map(Object.entries(renamed));
 	for (const [from, to] of Object.entries(migrate?.keys ?? {})) exact.set(from, to);
-	const prefixes = Object.entries(migrate?.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length || (a < b ? -1 : a > b ? 1 : 0));
+	const prefixes = Object.entries(migrate?.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length || byCodeUnit(a, b));
 	const prefixed = prefixes.length === 0 ? expr : `(case ${prefixes.map(([from, to]) => `when left(${expr}, ${String(from.length)}) = ${quoteLiteral(from)} then ${quoteLiteral(to)} || substr(${expr}, ${String(from.length + 1)})`).join(" ")} else ${expr} end)`;
-	const mapped = exact.size === 0 ? prefixed : `(case ${expr} ${[...exact.entries()].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else ${prefixed} end)`;
-	const renames = Object.entries(renamed).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const mapped = exact.size === 0 ? prefixed : `(case ${expr} ${[...exact.entries()].toSorted(byKey).map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else ${prefixed} end)`;
+	const renames = Object.entries(renamed).toSorted(byKey);
 	return currentKeyExpr(renames, mapped);
 }
 function sourceSql(source, table, label) {
@@ -999,20 +500,20 @@ function sourceSql(source, table, label) {
 function backfillSql(ctx, from, migrate) {
 	const custom = ctx.customRoles;
 	const root = ctx.scopes[0]?.name;
-	if (custom === void 0 || root === void 0) throw new Error(`${PREFIX$1}: rls.customRoles.from needs custom roles on`);
-	if (ctx.authorize !== "database") throw new Error(`${PREFIX$1}: rls.customRoles.from needs database mode; in jwt mode custom roles ride the token, so build the grants claim with customRoleClaim`);
+	if (custom === void 0 || root === void 0) throw configError(`${PREFIX$1}: rls.customRoles.from needs custom roles on`);
+	if (ctx.authorize !== "database") throw configError(`${PREFIX$1}: rls.customRoles.from needs database mode; in jwt mode custom roles ride the token, so build the grants claim with customRoleClaim`);
 	const roles = custom.table;
-	if (roles === void 0) throw new Error(`${PREFIX$1}: rls.customRoles.from needs rls.customRoleWrites.roles, the roles table each row belongs to`);
+	if (roles === void 0) throw configError(`${PREFIX$1}: rls.customRoles.from needs rls.customRoleWrites.roles, the roles table each row belongs to`);
 	const leveled = custom.levels === true;
-	if (from.permissions.level !== void 0 && !leveled) throw new Error(`${PREFIX$1}: rls.customRoles.from.permissions.level is set, but no resource declares levels`);
+	if (from.permissions.level !== void 0 && !leveled) throw configError(`${PREFIX$1}: rls.customRoles.from.permissions.level is set, but no resource declares levels`);
 	const tenantType = tenantTypeOf(ctx);
 	const rolesTable = quoteQualified(roles.table);
 	const tenant = roles.tenant === void 0 ? `null::${tenantType}` : `${col(roles.tenant)}::${tenantType}`;
-	const scope = roles.scope === void 0 ? `case when ${tenant} is null then 'global' else ${quoteLiteral(root)} end` : `case when ${tenant} is null then 'global' else ${col(roles.scope)}::text end`;
+	const scope = rolesTableScope(roles, tenant, root, col);
 	const scopeId = roles.id === void 0 ? "null::text" : `${col(roles.id)}::text`;
 	const skipped = roles.skip === void 0 ? "false" : `coalesce(${col(roles.skip)}, false)`;
 	const renamed = custom.renamed ?? {};
-	const renames = Object.entries(renamed).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const renames = Object.entries(renamed).toSorted(byKey);
 	const current = (expr) => currentKeyExpr(renames, expr);
 	const known = sqlTextArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
 	const declared = sqlTextArray(custom.declared);
@@ -1195,7 +696,7 @@ function rowsFilter(ctx, entry) {
 	return arms.length === 0 ? "false" : [...new Set(arms)].join("\n    or ");
 }
 function functionName$1(resource) {
-	if (!IDENT$1.test(resource)) throw new Error(`PermDock CLI: unsafe break-glass resource '${resource}'`);
+	if (!IDENT$1.test(resource)) throw configError(`PermDock CLI: unsafe break-glass resource '${resource}'`);
 	return `permdock_break_glass_${resource}`;
 }
 function auditSql$1(ctx) {
@@ -1234,8 +735,8 @@ begin
     or session ->> 'v' <> '1'
     or session ->> 'permission' <> p_permission
     or coalesce(session ->> 'reason', '') = ''
-    or jsonb_typeof(session -> 'expiresAt') <> 'number'
-    or (session ->> 'expiresAt')::numeric <= extract(epoch from now())
+    or jsonb_typeof(session -> 'expires_at') <> 'number'
+    or (session ->> 'expires_at')::numeric <= extract(epoch from now())
   then
     raise exception 'PermDock: no valid break-glass session for %', p_permission
       using errcode = '42501';
@@ -1367,7 +868,7 @@ function pascalCase(name) {
 }
 const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
 function identifier(name, what) {
-	if (!IDENTIFIER.test(name)) throw new Error(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
+	if (!IDENTIFIER.test(name)) throw configError(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
 	return name;
 }
 function quoted(text) {
@@ -1431,7 +932,7 @@ function emitPrisma(policies, options = {}) {
 		""
 	];
 	for (const item of policies) {
-		if (item.effect === "deny") throw new Error(`PermDock CLI: Prisma policy blocks are permissive only, so ${item.name} (a deny) needs --target sql`);
+		if (item.effect === "deny") throw configError(`PermDock CLI: Prisma policy blocks are permissive only, so ${item.name} (a deny) needs --target sql`);
 		lines.push(`policy_${item.command} ${identifier(item.name, "policy name")} {`, `  target = ${modelOf(item.table)}`, `  roles  = [${item.roles.join(", ")}]`);
 		if (item.using !== void 0) lines.push(`  using  = ${JSON.stringify(item.using)}`);
 		if (item.check !== void 0) lines.push(`  withCheck = ${JSON.stringify(item.check)}`);
@@ -1461,18 +962,18 @@ const LITERAL_SEGMENT = /^[^{}:\s]+$/u;
 const TOPIC = "(select realtime.topic())";
 function policyName(prefix, name, command) {
 	const full = `permdock_${prefix}_${name.replaceAll(/[^A-Za-z0-9]+/gu, "_").replaceAll(/^_|_$/gu, "")}_${command}`;
-	if (new TextEncoder().encode(full).length > 63) throw new Error(`PermDock CLI: the ${prefix} policy name ${full} is longer than Postgres's 63 bytes; shorten '${name}'`);
+	if (new TextEncoder().encode(full).length > 63) throw configError(`PermDock CLI: the ${prefix} policy name ${full} is longer than Postgres's 63 bytes; shorten '${name}'`);
 	return full;
 }
 function grantKey(facts, ref, where, warnings) {
 	if (ref === void 0) return;
 	const key = typeof ref === "object" && ref !== null ? Reflect.get(ref, "key") : ref;
-	if (typeof key !== "string" || !facts.keys.has(key)) throw new Error(`PermDock CLI: ${where} must be a permission reference from the definitions (got ${JSON.stringify(key)})`);
+	if (typeof key !== "string" || !facts.keys.has(key)) throw configError(`PermDock CLI: ${where} must be a permission reference from the definitions (got ${JSON.stringify(key)})`);
 	if (facts.rowConditions.has(key)) warnings.push(`${where} is ${key}, whose grants carry row conditions (a relation, a where or another condition): the policy admits only the instances its role allows without a condition reach, through permitted_<scope>_ids_by_permission`);
 	return key;
 }
 function declaredScope(facts, scope, where) {
-	if (!facts.scopes.has(scope)) throw new Error(`PermDock CLI: ${where} names the scope '${scope}', which definePolicy({ scopes }) does not declare`);
+	if (!facts.scopes.has(scope)) throw configError(`PermDock CLI: ${where} names the scope '${scope}', which definePolicy({ scopes }) does not declare`);
 	return scope;
 }
 /**
@@ -1498,7 +999,7 @@ function realtimePolicies(ctx, facts, realtime, warnings) {
 			}];
 		});
 		const [placeholder] = placeholders;
-		if (placeholder === void 0 || placeholders.length > 1 || segments.some((segment, index) => index !== placeholder.index && !LITERAL_SEGMENT.test(segment))) throw new Error(`PermDock CLI: ${where} must be ':'-separated segments with exactly one '{<scope>}' segment, such as 'org:{organization}:chat'`);
+		if (placeholder === void 0 || placeholders.length > 1 || segments.some((segment, index) => index !== placeholder.index && !LITERAL_SEGMENT.test(segment))) throw configError(`PermDock CLI: ${where} must be ':'-separated segments with exactly one '{<scope>}' segment, such as 'org:{organization}:chat'`);
 		const scope = declaredScope(facts, placeholder.scope, where);
 		const regex = `^${segments.map((segment, index) => index === placeholder.index ? "[^:]+" : escapeRegex(segment)).join(":")}$`;
 		const id = `split_part(${TOPIC}, ':', ${String(placeholder.index + 1)})`;
@@ -1507,7 +1008,7 @@ function realtimePolicies(ctx, facts, realtime, warnings) {
     and ${permitted(ctx, id, scope, key)}`;
 		const read = grantKey(facts, topic.read, `${where}.read`, warnings);
 		const write = grantKey(facts, topic.write, `${where}.write`, warnings);
-		if (read === void 0) throw new Error(`PermDock CLI: ${where}.read is required`);
+		if (read === void 0) throw configError(`PermDock CLI: ${where}.read is required`);
 		const policies = [{
 			name: policyName("realtime", pattern, "select"),
 			table: "realtime.messages",
@@ -1529,7 +1030,7 @@ function realtimePolicies(ctx, facts, realtime, warnings) {
 }
 function folderOf(bucket, where) {
 	const folder = bucket.folder ?? 1;
-	if (!Number.isInteger(folder) || folder < 1) throw new Error(`PermDock CLI: ${where}.folder must be a positive integer (got ${String(folder)})`);
+	if (!Number.isInteger(folder) || folder < 1) throw configError(`PermDock CLI: ${where}.folder must be a positive integer (got ${String(folder)})`);
 	return folder;
 }
 function storagePolicies(ctx, facts, storage, warnings) {
@@ -1574,7 +1075,7 @@ function storagePolicies(ctx, facts, storage, warnings) {
 				...command === "select" || command === "delete" ? {} : { check: expression }
 			}];
 		});
-		if (policies.length === 0) throw new Error(`PermDock CLI: ${where} needs read, write or delete`);
+		if (policies.length === 0) throw configError(`PermDock CLI: ${where} needs read, write or delete`);
 		return policies;
 	});
 }
@@ -1588,11 +1089,11 @@ function storagePolicies(ctx, facts, storage, warnings) {
 */
 function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 	if (config.realtime === void 0 && config.storage === void 0) return [];
-	if (ctx.dialect !== "supabase") throw new Error(`PermDock CLI: rls.realtime and rls.storage need --dialect supabase (got ${ctx.dialect})`);
+	if (ctx.dialect !== "supabase") throw configError(`PermDock CLI: rls.realtime and rls.storage need --dialect supabase (got ${ctx.dialect})`);
 	const policies = [...config.realtime === void 0 ? [] : realtimePolicies(ctx, facts, config.realtime, warnings), ...config.storage === void 0 ? [] : storagePolicies(ctx, facts, config.storage, warnings)];
 	const seen = /* @__PURE__ */ new Set();
 	for (const { name } of policies) {
-		if (seen.has(name)) throw new Error(`PermDock CLI: two rls.realtime or rls.storage entries both name the policy ${name}; rename one`);
+		if (seen.has(name)) throw configError(`PermDock CLI: two rls.realtime or rls.storage entries both name the policy ${name}; rename one`);
 		seen.add(name);
 	}
 	return policies;
@@ -1603,7 +1104,7 @@ function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 function rowsHelper(resource) {
 	const name = graphSqlName(resource);
 	const helper = `permitted_${name ?? resource}_rows`;
-	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw new Error(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
+	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
 	return helper;
 }
 /** The branches a row check of a permission reads: its allows and denies on rows that exist, for signed-in callers. */
@@ -1750,7 +1251,7 @@ function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
 	const chunks = called.map((name) => stubSql(ctx, name));
 	for (const name of names) {
 		const node = policy.resources.get(name);
-		if (node === void 0) throw new Error(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
+		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
 		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), tables));
 	}
 	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
@@ -1807,7 +1308,7 @@ function generatePolicies(input, policy, options, built, warnings) {
 		...policyName === void 0 ? {} : { name: policyName }
 	});
 	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
-	if (actorKinds !== void 0 && helpersOnly) warnings.push("rls.readOnlyActors adds policies, and --helpers-only writes none: add the restrictive read-only policies to the hand-written ones");
+	if (actorKinds !== void 0 && helpersOnly) warnings.push(`rls.readOnlyActors with --helpers-only writes no policies: add \`and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())\` to each hand-written insert, update and delete policy, or a restrictive policy that calls it`);
 	const withActors = (items) => actorKinds === void 0 ? items : [...items, ...readOnlyActorPolicies(items, subjectClaimJsonSql(ctx, "act"), actorKinds)];
 	let tablePolicies;
 	try {
@@ -1856,7 +1357,7 @@ function mappedKey(config, renamed) {
 	return `coalesce(${quoteLiteral(JSON.stringify(exact))}::jsonb ->> p_key, ${fallback})`;
 }
 function scopeOf(ctx, scope) {
-	if (!ctx.scopes.some((item) => item.name === scope)) throw new Error(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
+	if (!ctx.scopes.some((item) => item.name === scope)) throw configError(`PermDock CLI: rls.migrate helper scope '${scope}' is not a declared scope`);
 	return scope;
 }
 function addKey(list, key) {
@@ -1953,6 +1454,13 @@ function shim(ctx, config, keys, fn, helper) {
 			const type = scopeTypeOf(ctx, scope);
 			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified(ctx, memberIdsHelper(scope))}()), false)`);
 		}
+		case "role": {
+			const scope = scopeOf(ctx, helper.scope);
+			const type = scopeTypeOf(ctx, scope);
+			const values = Object.entries(ctx.roleValues ?? {});
+			const role = values.length === 0 ? "p_role" : `case p_role ${values.map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else p_role end`;
+			return shimFunction(fn, `p_id ${type}, p_role text`, `${type}, text`, "boolean", `  select coalesce(p_id in (select ${qualified(ctx, memberIdsHelper(scope))}(array[${role}])), false)`);
+		}
 		case "global": return shimFunction(fn, "p_key text", "text", "boolean", `  select ${hasSql(ctx, keys)}`);
 		case "scoped": {
 			const literals = /* @__PURE__ */ new Map();
@@ -1980,8 +1488,8 @@ function shimsSql(ctx, config, shims, renamed, grants) {
 		map: (scope) => `${quoteLiteral(shimMap(grants, scope))}::jsonb`
 	};
 	const chunks = [`-- permdock shims: legacy helper names over the permdock helpers; drop each once doctor reports no caller (PD056)`];
-	for (const [name, helper] of Object.entries(config.helpers).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
-		if (!NAME.test(name)) throw new Error(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
+	for (const [name, helper] of Object.entries(config.helpers).toSorted(byKey)) {
+		if (!NAME.test(name)) throw configError(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
 		chunks.push(shim(ctx, config, keys, `${quoteIdent$1(schema)}.${name}`, helper));
 	}
 	return `${chunks.join("\n\n")}\n`;
@@ -2013,20 +1521,20 @@ function generatedTables(sql, schema) {
 	return [...found].toSorted();
 }
 function functionName(name, label) {
-	if (typeof name !== "string" || name.split(".").length !== 2) throw new Error(`${PREFIX}: ${label} must be a schema-qualified function such as audit.log_change, got ${JSON.stringify(name)}`);
+	if (typeof name !== "string" || name.split(".").length !== 2) throw configError(`${PREFIX}: ${label} must be a schema-qualified function such as audit.log_change, got ${JSON.stringify(name)}`);
 	return quoteTable(name);
 }
 function knownTable(table, tables, label) {
-	if (!tables.includes(table)) throw new Error(`${PREFIX}: ${label} names ${table}, which rls generate does not create with this config; it creates ${tables.join(", ")}`);
+	if (!tables.includes(table)) throw configError(`${PREFIX}: ${label} names ${table}, which rls generate does not create with this config; it creates ${tables.join(", ")}`);
 }
 function triggerSql(table, trigger, label) {
-	if (typeof trigger.name !== "string" || trigger.name === "" || trigger.name.toLowerCase().startsWith("permdock_")) throw new Error(`${PREFIX}: ${label}.name must be a name outside permdock_, which generated triggers use, got ${JSON.stringify(trigger.name)}`);
-	if (trigger.when !== "before" && trigger.when !== "after") throw new Error(`${PREFIX}: ${label}.when must be before or after`);
+	if (typeof trigger.name !== "string" || trigger.name === "" || trigger.name.toLowerCase().startsWith("permdock_")) throw configError(`${PREFIX}: ${label}.name must be a name outside permdock_, which generated triggers use, got ${JSON.stringify(trigger.name)}`);
+	if (trigger.when !== "before" && trigger.when !== "after") throw configError(`${PREFIX}: ${label}.when must be before or after`);
 	const events = trigger.events;
-	if (events.length === 0 || !events.every((event) => EVENTS.has(event))) throw new Error(`${PREFIX}: ${label}.events must list insert, update, delete or truncate`);
+	if (events.length === 0 || !events.every((event) => EVENTS.has(event))) throw configError(`${PREFIX}: ${label}.events must list insert, update, delete or truncate`);
 	const level = trigger.level ?? "row";
-	if (level !== "row" && level !== "statement") throw new Error(`${PREFIX}: ${label}.level must be row or statement`);
-	if (level === "row" && events.includes("truncate")) throw new Error(`${PREFIX}: ${label} fires on truncate, which Postgres allows only with level: 'statement'`);
+	if (level !== "row" && level !== "statement") throw configError(`${PREFIX}: ${label}.level must be row or statement`);
+	if (level === "row" && events.includes("truncate")) throw configError(`${PREFIX}: ${label} fires on truncate, which Postgres allows only with level: 'statement'`);
 	const fn = functionName(trigger.function, `${label}.function`);
 	const args = (trigger.args ?? []).map((arg) => quoteLiteral(arg));
 	const name = quoteIdent$1(trigger.name);
@@ -2043,7 +1551,7 @@ create trigger ${name}
 function triggersSql(triggers, schema, tables) {
 	if (triggers === void 0) return "";
 	const chunks = [];
-	for (const [table, list] of Object.entries(triggers).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+	for (const [table, list] of Object.entries(triggers).toSorted(byKey)) {
 		knownTable(table, tables, `rls.triggers.${table}`);
 		const target = `${quoteIdent$1(schema)}.${quoteIdent$1(table)}`;
 		for (const [index, trigger] of list.entries()) chunks.push(triggerSql(target, trigger, `rls.triggers.${table}[${String(index)}]`));
@@ -2062,7 +1570,7 @@ function auditSql(audit, schema, tables) {
 	if (listed !== void 0) for (const table of listed) knownTable(table, tables, "rls.audit.tables");
 	const targets = listed ?? AUDITED.filter((table) => tables.includes(table));
 	const args = Object.entries(audit.args ?? {}).map(([name, value]) => {
-		if (!IDENT.test(name)) throw new Error(`${PREFIX}: rls.audit.args names ${JSON.stringify(name)}, which is not a lower-case parameter name`);
+		if (!IDENT.test(name)) throw configError(`${PREFIX}: rls.audit.args names ${JSON.stringify(name)}, which is not a lower-case parameter name`);
 		return `, ${quoteIdent$1(name)} => ${quoteLiteral(value)}`;
 	});
 	if (targets.length === 0) return "";
@@ -2121,7 +1629,7 @@ function sectionsSql(input, policy, options, built, generated, jsonSchema, warni
 	if (ctx.assignments !== void 0 && (ownership === void 0 || ownership.assigns.length === 0)) warnings.push("rls.assignments needs a role that declares assigns: no assignment trigger is written");
 	let approvals;
 	try {
-		approvals = rls?.approvals === true ? approvalStoreSql(ctx, jsonSchema ?? false) : typeof rls?.approvals === "object" ? adoptedApprovalStoreSql(ctx, rls.approvals, jsonSchema ?? false) : void 0;
+		approvals = approvalsSql(ctx, rls?.approvals, jsonSchema ?? false);
 	} catch (cause) {
 		return { refusal: describeError(cause) };
 	}
@@ -2163,6 +1671,7 @@ function preambleSql(input, policy, options, built, generated, jsonSchema, warni
 	const renamed = Object.fromEntries(renamedKeys(policy.vocabulary.permissions));
 	const grants = shimGrants(compiled.rolePermissions, compiled.conditionedKeys, renamed);
 	const anonExecute = anonExecutes(input, generated);
+	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
 	const usesLiveSession = compiled.branches.some((branch) => [
 		branch.access,
 		branch.using,
@@ -2180,6 +1689,8 @@ function preambleSql(input, policy, options, built, generated, jsonSchema, warni
 			...rls?.trustedReaders === void 0 ? {} : { trustedReaders: rls.trustedReaders }
 		}),
 		permissionHelpersSql(ctx, grants, renamed, anonExecute),
+		permissionHoldersSql(ctx) || void 0,
+		actorKinds === void 0 ? void 0 : actorMayWriteSql(ctx, actorKinds),
 		usesLiveSession ? sessionLiveHelperSql(ctx) : void 0,
 		...sections,
 		shims,
@@ -2263,7 +1774,7 @@ function emitTarget(input, built, generated, preamble) {
 		outRel
 	};
 }
-/** The generated SQL for one run, before `--db` prunes the index targets. */
+/** The generated SQL for one run, before `--db-url-stdin` prunes the index targets. */
 function generateSql(input, policy, options, built, warnings) {
 	const rls = input.config.rls;
 	const { ctx } = built;
@@ -2299,7 +1810,53 @@ function generateSql(input, policy, options, built, warnings) {
 //#region src/cli/rls/generate.ts
 function loadPolicy(cwd, config, from) {
 	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
-	return requirePolicy(cwd, policyPath, "rls generate needs policy in permdock.config.ts or --from");
+	return requirePolicy(cwd, policyPath, "rls generate needs policy in permdock.config.ts or --policy");
+}
+const PROJECT_COMMAND = "permdock rls generate";
+/**
+* The policy `policyFromCatalog` rebuilds from the project's pushed catalog
+* and policy; a project with no pushed policy fails with `policy-not-published`.
+*/
+async function projectPolicyOf(input, project) {
+	const fetched = await fetchProjectPolicy({
+		command: PROJECT_COMMAND,
+		url: input.url,
+		project,
+		json: input.json === true,
+		env: input.io.env ?? process.env,
+		io: input.io
+	});
+	if (!fetched.ok) return {
+		...fetched.result,
+		text: ""
+	};
+	const { catalog, policy } = fetched.value;
+	if (policy === void 0) {
+		const detail = `project ${project} has a pushed catalog but no policy; push from a project whose permdock.config.ts names one`;
+		return {
+			code: 1,
+			output: input.json === true ? JSON.stringify({
+				type: POLICY_NOT_PUBLISHED,
+				title: "Policy not published",
+				detail,
+				command: PROJECT_COMMAND,
+				exitCode: 1
+			}, null, 2) : `${PROJECT_COMMAND}: ${detail}`,
+			text: ""
+		};
+	}
+	try {
+		return policyFromCatalog(catalog, policy);
+	} catch (cause) {
+		return {
+			code: 1,
+			output: `${PROJECT_COMMAND}: the pushed policy does not rebuild: ${describeError(cause)}`,
+			text: ""
+		};
+	}
+}
+function isOutcome(value) {
+	return "text" in value && "code" in value;
 }
 function refused(output) {
 	return {
@@ -2311,7 +1868,14 @@ function refused(output) {
 async function runRlsGenerate(input) {
 	const options = generateOptions(input);
 	if (isRefusal(options)) return refused(options.refusal);
-	const policy = await loadPolicy(input.cwd, input.config, input.from);
+	if (input.project !== void 0 && input.from !== void 0 && input.from !== "drizzle") return refused("rls generate takes the policy from --project or from a --policy module, not both");
+	let policy;
+	if (input.project === void 0) policy = await loadPolicy(input.cwd, input.config, input.from);
+	else {
+		const loaded = await projectPolicyOf(input, input.project);
+		if (isOutcome(loaded)) return loaded;
+		policy = loaded;
+	}
 	const built = buildContext(input, policy, options);
 	if (isRefusal(built)) return refused(built.refusal);
 	const warnings = [];
@@ -2326,7 +1890,7 @@ async function runRlsGenerate(input) {
 		warnings.push(...pruned.warnings);
 	} catch (cause) {
 		return {
-			code: exitCodeOf(cliErrorKind(cause)),
+			code: exitCodeOfError(cause),
 			output: describeError(cause),
 			text: ""
 		};
@@ -2377,8 +1941,9 @@ async function runRlsGenerate(input) {
 			part: "backfill",
 			marker: BACKFILL_MARKER,
 			text: generated.backfill,
-			now: input.io.now?.() ?? /* @__PURE__ */ new Date(),
-			check: input.check
+			now: input.io.now?.() ?? dateAt(),
+			check: input.check,
+			reserved: files.map((other) => other.rel)
 		});
 		if (file !== void 0) files.push(file);
 	}
@@ -2397,10 +1962,11 @@ async function runRlsGenerate(input) {
 		};
 	}
 	const written = writeOutputFiles(input.cwd, files);
-	const extra = warnings.length === 0 ? "" : `\n${warnings.join("\n")}`;
+	const notes = [...written.wrote.length === 0 ? [] : [`wrote ${written.wrote.join(", ")}`], ...warnings];
+	if (written.printed !== "") for (const note of notes) input.io.stderr(note);
 	return {
 		code: 0,
-		output: `wrote ${written.wrote.join(", ")}${written.printed === "" ? "" : `\n${written.printed}`}${extra}`,
+		output: written.printed === "" ? notes.join("\n") : written.printed,
 		text,
 		...extras
 	};
@@ -2591,6 +2157,29 @@ async function introspectRls(db, expected, connect = connectIntrospect) {
 		await client.end();
 	}
 }
+const WRITES = [
+	"insert",
+	"update",
+	"delete"
+];
+/**
+* Each table and write command whose permissive policies reach
+* `authenticated` (or `public`) without the read-only actor check: no
+* restrictive policy for the command calls `permdock_actor_may_write()`, and
+* some permissive one does not.
+*/
+function unguardedWrites(policies, fn) {
+	const out = [];
+	const tables = [...new Set(policies.map((policy) => policy.table))];
+	for (const table of tables) for (const command of WRITES) {
+		const applying = policies.filter((policy) => policy.table === table && (policy.command === command || policy.command === "all"));
+		const permissive = applying.filter((policy) => policy.restrictive !== true && (policy.roles ?? []).some((role) => role === "authenticated" || role === "public"));
+		if (permissive.length === 0) continue;
+		const calls = (expression) => expression.includes(fn);
+		if (!(applying.some((policy) => policy.restrictive === true && calls(policy.expression)) || permissive.every((policy) => calls(policy.expression)))) out.push(`${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`);
+	}
+	return out;
+}
 const SYSTEM_SCHEMAS = [
 	"pg_catalog",
 	"information_schema",
@@ -2610,7 +2199,7 @@ const SYSTEM_SCHEMAS = [
 	"supabase_migrations"
 ];
 function inScope(table) {
-	const schema = table.split(".")[0] ?? "";
+	const schema = beforeFirst(table, ".");
 	return HELPER_TABLES.some((item) => item === table) || !(SYSTEM_SCHEMAS.some((item) => item === schema) || schema.startsWith("pg_"));
 }
 function seedLine(row) {
@@ -2632,13 +2221,16 @@ function diffMixed(expected, actual) {
 		for (const key of helperCallKeys(policy.expression)) if (!permissions.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, which the policy does not declare, so it always denies`);
 		else if (conditioned.has(key) && blind.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`);
 	}
+	if (expected.readOnlyActors === true) drift.push(...unguardedWrites(actual.policies, ACTOR_MAY_WRITE));
 	return {
 		drift,
 		info: actual.rlsTables.filter((table) => !covered.has(table)).map((table) => `${table}: no policy calls a PermDock helper`)
 	};
 }
 const ALL_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname,
-  coalesce(qual, '') || ' ' || coalesce(with_check, '') as expression
+  coalesce(qual, '') || ' ' || coalesce(with_check, '') as expression,
+  lower(cmd) as command, permissive = 'RESTRICTIVE' as restrictive,
+  array_to_string(roles, ',') as roles
 from pg_policies`;
 const RLS_TABLES_SQL = `select n.nspname || '.' || c.relname as target
 from pg_class c
@@ -2665,7 +2257,10 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 			policies: policies.rows.map((row) => ({
 				table: String(row["target"]),
 				name: String(row["policyname"]),
-				expression: String(row["expression"])
+				expression: String(row["expression"]),
+				command: String(row["command"]),
+				restrictive: row["restrictive"] === true,
+				roles: String(row["roles"] ?? "").split(",").filter((role) => role !== "")
 			})).filter((row) => inScope(row.table)),
 			rlsTables: tables.rows.map((row) => String(row["target"])).filter(inScope).toSorted()
 		};
@@ -2677,24 +2272,12 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 //#region src/cli/rls/rls.ts
 const RLS_HELP = `permdock rls generate | import | verify | migrate
 
-  generate --target drizzle|sql|prisma --dialect supabase|neon|guc
-           [--rbac supabase] [--rbac-schema public] [--authorize database|jwt]
-           [--memberships <table>:tenant,user,role]
-           [--policy-per-role] [--policy-name '{table}_{op}'] [--tenant-type uuid] [--custom-roles]
-           [--capabilities] [--fields views [--revoke-columns]]
-           [--out <path>] [--check] [--skip-closures] [--inline-functions] [--force] [--guc-prefix app]
-           [--split helpers,seeds,policies,hook --out <dir>/056_permdock_{part}.sql]
-           [--grants-out <file>|-] [--seeds-out <file>|-] [--backfill-out <file>|<dir>/|-]
-           [--helpers-only] [--shims] [--db $DATABASE_URL]
-  import   --sql schema.sql | --db $DATABASE_URL --out src/permissions.generated.ts
-           [--schema zod|valibot|arktype] [--memberships <table>:tenant,user,role]
-  verify   [--db $DATABASE_URL] [--fixtures rls.fixtures.ts] [--format pgtap|node] [--tree]
-           [--introspect --db $DATABASE_URL, with the generate flags]
-           [--advisors [--db $DATABASE_URL] [--json]]: supabase db advisors, security lints
-  migrate  --sql <dir> [--write] [--json] [--retire-out <file>|<dir>/|-], with the generate flags
-           rewrites the rls.migrate helpers' calls in policies onto the generated helpers;
-           --retire-out drops each rls.migrate.tables table and its refresh triggers once unread
+  generate  Compile the policy into RLS policies and helpers
+  import    Turn existing policies (--sql or --db-url-stdin) into a permissions module
+  verify    Run the fixtures, or compare a live database with --introspect
+  migrate   Rewrite the rls.migrate helpers' calls onto the generated helpers
 
+Run permdock rls <command> --help for its flags.
 Never emits service_role, except in the execute grant rls.trustedReaders asks for. memberOf compiles through the dialect memberships mapping.
 `;
 function asTarget(value) {
@@ -2719,6 +2302,9 @@ function generateInput(input, target, dialect) {
 		io: input.io,
 		...input.out === void 0 ? {} : { out: input.out },
 		...input.from === void 0 ? {} : { from: input.from },
+		...input.project === void 0 ? {} : { project: input.project },
+		...input.url === void 0 ? {} : { url: input.url },
+		json: input.json,
 		...input.memberships === void 0 ? {} : { memberships: input.memberships },
 		...input.gucPrefix === void 0 ? {} : { gucPrefix: input.gucPrefix },
 		policyPerRole: input.policyPerRole,
@@ -2729,6 +2315,7 @@ function generateInput(input, target, dialect) {
 		...input.fields === void 0 ? {} : { fields: input.fields },
 		revokeColumns: input.revokeColumns,
 		...input.split === void 0 ? {} : { split: input.split },
+		...isSupabaseSchemas(input.schemas) ? { schemas: input.schemas } : {},
 		...input.grantsOut === void 0 ? {} : { grantsOut: input.grantsOut },
 		...input.seedsOut === void 0 ? {} : { seedsOut: input.seedsOut },
 		...input.backfillOut === void 0 ? {} : { backfillOut: input.backfillOut },
@@ -2761,20 +2348,24 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-BwlB5-Wk.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-CIq4-E9F.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
 		config,
-		target: migrateTarget(generated),
+		target: {
+			...migrateTarget(generated),
+			...input.config.rls?.roleValues === void 0 ? {} : { roleValues: input.config.rls.roleValues }
+		},
 		write: input.write,
+		force: input.forceRewrite === true,
 		json: input.json,
 		retireOut: input.retireOut,
 		...input.io.now === void 0 ? {} : { now: input.io.now() }
 	});
 }
 /** `verify --introspect` with `--helpers-only`: helpers and seeds exactly, hand-written policies by their keys. */
-async function introspectHelpersOnly(db, expected, generated, connect) {
+async function introspectHelpersOnly(db, expected, generated, connect, readOnlyActors) {
 	const schema = generated.schema ?? "permdock";
 	try {
 		const actual = await introspectRls(db, expected, connect);
@@ -2784,7 +2375,8 @@ async function introspectHelpersOnly(db, expected, generated, connect) {
 			schema,
 			seeds: generated.seeds ?? [],
 			permissions: generated.keys?.permissions ?? [],
-			rowConditions: generated.keys?.rowConditions ?? []
+			rowConditions: generated.keys?.rowConditions ?? [],
+			readOnlyActors
 		}, await introspectMixed(db, schema, connect));
 		const drift = [...helpers, ...mixed.drift];
 		const info = mixed.info.map((line) => `info: ${line}`);
@@ -2811,7 +2403,7 @@ async function introspectHelpersOnly(db, expected, generated, connect) {
 async function introspect(input) {
 	if (input.db === void 0) return {
 		code: 2,
-		output: "PermDock CLI: rls verify --introspect needs --db"
+		output: "PermDock CLI: rls verify --introspect needs a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 	};
 	const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
 	if (dialect === void 0) return {
@@ -2828,7 +2420,7 @@ async function introspect(input) {
 		output: generated.output
 	};
 	const expected = expectedRls(generated.policies, generated.text, generated.indexes);
-	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect);
+	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect, readOnlyActorKinds(input.config.rls?.readOnlyActors) !== void 0);
 	try {
 		const actual = await introspectRls(input.db, expected, input.connect);
 		const drift = diffRls(expected, actual, { columnGrants: (input.fields ?? input.config.rls?.fields) === "views" });
@@ -2851,6 +2443,11 @@ async function runRls(input) {
 		code: 2,
 		output: RLS_HELP
 	};
+	const badSchemas = schemasRefusal(`rls ${action}`, input.schemas);
+	if (badSchemas !== void 0) return {
+		code: 2,
+		output: badSchemas
+	};
 	switch (action) {
 		case "generate": {
 			const target = asTarget(input.target);
@@ -2871,7 +2468,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./import-BFIlhetD.js");
+			const { runRlsImport } = await import("./import-wyqXUyjm.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,
@@ -2889,6 +2486,7 @@ async function runRls(input) {
 				cwd: input.cwd,
 				json: input.json,
 				env: input.io.env ?? process.env,
+				...input.io.signal === void 0 ? {} : { signal: input.io.signal },
 				...input.db === void 0 ? {} : { db: input.db },
 				...input.exec === void 0 ? {} : { exec: input.exec }
 			});