permdock 0.6.0 → 0.8.0

package/dist/{rls-DTvYd-lI.js → rls-CNEH2_BG.js}

@@ -1,30 +1,33 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { c as listPermissions, u as renamedKeys } from "./permission-registry-Br4jSNVi.js";
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee, v as listRoles } from "./grantee-hxrUsbpM.js";
-import { p as scopeField } from "./tenancy-DN2QAx9z.js";
-import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-CWTY6uih.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { c as requirePolicy } from "./load-DFS_ry0W.js";
-import "./budget-NbEtbJC_.js";
-import { i as qualifySqlTable, r as escapeSqlIdent, u as sqlTextArray } from "./sql-B5T1IL83.js";
-import { l as roleColumn } from "./sources-vs5dGOsS.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-C2gMa2Dj.js";
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { p as scopeField } from "./tenancy-5d1zVBvK.js";
+import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
+import { o as sqlFiles } from "./files-BSjrtIHw.js";
+import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
+import "./sources-CMAM-2A3.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-CJgOm6aq.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-C6joDI3o.js";
-import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-C8swJ2GH.js";
-import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
-import { t as fetchProjectPolicy } from "./pull-jEwbf80J.js";
-import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
-import { c as approvalsSql, d as resolveAuthorize, h as schemasRefusal, l as parseRbacAuthorize, m as resolveSchemas, o as supabaseHookSql, p as isSupabaseSchemas, s as permissionHoldersSql, t as grantsLabel, u as rbacScaffold } from "./supabase-hook-BMoEhZir.js";
-import { C as parseMembershipsFlag, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent$1, O as tenantTypeOf, P as quoteLiteral, _ as subjectClaimJsonSql, a as customRolesOn, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-BAK8t4Uo.js";
-import { a as splitUndiffed } from "./deciding-columns-Sq12mEA6.js";
-import { a as readOnlyActorKinds, c as branchClauses, d as connectPgPool, i as orSql, n as actorMayWriteSql, o as readOnlyActorPolicies, r as assemblePolicies, t as ACTOR_MAY_WRITE } from "./policies-DP2nqRoF.js";
-import { A as collectGrants, C as byKey, D as apiKeysPlan, G as memberIdsHelper, I as graphHelper, J as permittedIdsHelper, L as graphSqlName, O as breakGlassHolder, S as byCodeUnit, X as scopeSources, Z as scopeTable, b as currentKeyExpr, et as checkSuspension, f as permittedByPermissionHelper, g as seedSql, h as helpersSql, i as assignmentSql, j as roleNames, k as breakGlassKey, m as accessSql, n as ownershipSql, t as ownershipRules, u as permissionHelpersSql, x as rolesTableScope } from "./ownership-DqaJNJPn.js";
-import { _ as indexesSql, a as graphSql, c as callsHelper, g as indexTargets, h as COLUMNS_SQL, i as graphPlan, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as closureDepths, v as pruneIndexTargets, y as readTableIndexFacts } from "./verify-BaAKx7t6.js";
-import { a as fieldViewsSql, i as fieldViews, n as columnGrantSql, o as rowBranches, r as columnRevokeSql } from "./fields-OYG_JR78.js";
-import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
+import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
+import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
+import { t as fetchProjectPolicy } from "./pull-CwpGaQSi.js";
+import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
+import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
+import { d as schemasRefusal, f as declarativeSql, l as isSupabaseSchemas, o as supabaseHookSql, s as approvalsSql, t as grantsLabel, u as resolveSchemas, v as parseRbacAuthorize, y as rbacScaffold } from "./supabase-hook-B-yXnzUl.js";
+import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-Afctg7B0.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DeMNEy6V.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-B4L59T9u.js";
+import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
+import { t as connectPgPool } from "./pg-DQTqRrou.js";
+import { n as permissionHoldersSql } from "./resolve-names-CF7xXLSG.js";
+import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-D0vUI6dq.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DZeqoWu5.js";
+import { a as generateOptions, c as buildContext, i as rowHelpersSql, l as DROPPED_LIST, n as inheritTargets, o as isRefusal, r as levelKeys, s as splitsPart, t as supautilsRejections, u as rebuildPlan } from "./supautils-BU-pAEpf.js";
+import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
 //#region src/cli/rls/advisors.ts
@@ -136,7 +139,7 @@ async function runRlsAdvisors(input) {
 		const message = [text(error, "message"), text(error, "suggestion")].filter((part) => part !== "").join(" ");
 		return {
 			code: 2,
-			output: `supabase db advisors failed: ${message === "" ? result.stderr.trim() || `exit ${String(result.status)}` : message}`
+			output: `supabase db advisors failed: ${message === "" ? nonEmptyOr(result.stderr.trim(), `exit ${String(result.status)}`) : message}`
 		};
 	}
 	const failing = findings.filter((finding) => finding.level === "WARN" || finding.level === "ERROR");
@@ -159,142 +162,164 @@ async function runRlsAdvisors(input) {
 	};
 }
 //#endregion
-//#region src/cli/rls/generate-context.ts
-/** The scopes an `rls.migrate` `role` helper names, so `rls generate` writes their role-filtered member helper. */
-function roleMemberScopesOf(migrate) {
-	const scopes = [...new Set(Object.values(migrate?.helpers ?? {}).flatMap((helper) => helper.form === "role" ? [helper.scope] : []))].toSorted();
-	return scopes.length === 0 ? {} : { roleMemberScopes: scopes };
-}
-/** `rls.customRoleWrites.requires` as permission keys, or why it names none. */
-function writeRequirement(policy, requires) {
-	if (requires === void 0) return {};
-	const leaves = listPermissions(policy.permissions);
-	const keys = requires === "manageRoles" ? leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key) : [...requires];
-	if (keys.length === 0) return { error: requires === "manageRoles" ? "rls.customRoleWrites.requires is 'manageRoles', but no permission declares meta.manageRoles" : "rls.customRoleWrites.requires names no permission" };
-	const known = new Set(leaves.map((leaf) => leaf.key));
-	const unknown = keys.filter((key) => !known.has(key));
-	if (unknown.length > 0) return { error: `rls.customRoleWrites.requires names undeclared permissions: ${unknown.join(", ")}` };
-	return { keys: [...new Set(keys)].toSorted() };
-}
-/** Declared role names, and those a tenant admin may compose into custom roles. */
-function customRoleNames(policy, requires) {
-	const declared = [...roleNames(policy)].toSorted();
-	const assignable = declared.filter((name) => policy.rolesByName.get(name)?.assignable ?? listRoles(policy.vocabulary.roles).some((leaf) => leaf.key === name && leaf.assignable));
-	const renamed = renamedKeys(policy.vocabulary.permissions);
-	const leaves = listPermissions(policy.permissions);
-	const manage = leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key);
-	return {
-		declared,
-		assignable,
-		...renamed.size === 0 ? {} : { renamed: Object.fromEntries(renamed) },
-		permissions: leaves.map((leaf) => leaf.key).toSorted(),
-		...manage.length === 0 ? {} : { manage: manage.toSorted() },
-		...requires === void 0 ? {} : { requires },
-		...policy.levels === void 0 ? {} : { levels: true }
-	};
+//#region src/cli/rls/bindings.ts
+/**
+* The table each resource with row policies binds to. With `helpersOnly`, a
+* resource `rls.tables` does not name has no table and no binding.
+*/
+function tableBindings(resources, tables, helpersOnly) {
+	const out = [];
+	for (const resource of [...new Set(resources)].toSorted()) {
+		const named = tables !== void 0 && Object.hasOwn(tables, resource);
+		if (helpersOnly && !named) continue;
+		out.push({
+			resource,
+			table: qualifySqlTable(tableFor(resource, tables)),
+			inferred: !named
+		});
+	}
+	return out;
 }
-function skippedOwnershipTriggers(triggers, scopes) {
-	if (triggers === false) return "all";
-	return Object.keys(triggers).map((key) => {
-		const name = resolveScope(scopes, key);
-		if (name === void 0) throw configError(`PermDock CLI: rls.ownershipTriggers.${key} names a scope the policy does not declare`);
-		return name;
-	});
+/**
+* The generate notes for `bindings`: the inferred ones, and where to see them
+* all.
+*/
+function bindingNotes(bindings, withDatabase) {
+	const inferred = bindings.filter((binding) => binding.inferred);
+	if (inferred.length === 0) return [];
+	return [`table bindings (no rls.tables entry, so the table is named after the resource): ${inferred.map((binding) => `${binding.resource} -> ${binding.table}`).join(", ")}${withDatabase ? "" : "; run permdock rls explain, or generate with --db-url-stdin, to check each table exists"}`];
 }
-/** The SQL context every emitter reads, from the flags, `rls` config and the policy. */
-function buildContext(input, policy, options) {
-	const rls = input.config.rls;
-	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
-	if (input.rbac && input.dialect !== "supabase") return { refusal: `rls generate --rbac supabase needs --dialect supabase (got ${input.dialect})` };
-	const schema = input.rbacSchema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock";
-	const authorize = resolveAuthorize(input.config, {
-		authorize: input.authorize,
-		rbac: input.rbac,
-		memberships
-	});
-	const memberSources = rls?.membershipSources ?? input.config.supabase?.hook?.memberships;
-	const sources = authorize === "database" ? memberSources : void 0;
-	const scopes = scopeList(policy.scopes);
-	const suspension = checkSuspension(rls?.suspension, scopes);
-	const hookRoles = input.config.supabase?.hook?.roles;
-	const roles = rls?.roles ?? (hookRoles === false ? void 0 : hookRoles);
-	if (roles !== void 0 && input.rbac) return { refusal: "rls generate --rbac supabase creates its own user_roles (user_id, role app_role); drop rls.roles (or supabase.hook.roles) or the --rbac flag" };
-	const requires = writeRequirement(policy, rls?.customRoleWrites?.requires);
-	if (requires.error !== void 0) return { refusal: requires.error };
-	const readers = rls?.trustedReaders;
-	if (readers !== void 0 && (!Array.isArray(readers) || !readers.every((name) => typeof name === "string" && name !== ""))) return { refusal: "rls.trustedReaders must list Postgres role names, such as ['service_role']" };
-	const ownership = ownershipRules(policy, scopes);
-	const graph = graphPlan(policy);
-	const apiKeys = apiKeysPlan(rls?.apiKeys, new Set(roleNames(policy)), Object.fromEntries(renamedKeys(policy.vocabulary.permissions)));
-	return {
-		ctx: {
-			dialect: input.dialect,
-			scopes,
-			tenantClaim: rls?.tenantClaim ?? "tenant_id",
-			...roleMemberScopesOf(rls?.migrate),
-			...rls?.roleValues === void 0 ? {} : { roleValues: rls.roleValues },
-			...rls?.tenants === "all" ? { tenants: "all" } : {},
-			gucPrefix: input.gucPrefix ?? rls?.gucPrefix ?? "app",
-			...rls?.actions === void 0 ? {} : { actions: rls.actions },
-			inlineFunctions: input.inlineFunctions || rls?.inlineFunctions === true,
-			schema,
-			authorize,
-			roleClaim: rls?.roleClaim ?? "user_role",
-			tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
-			...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
-			...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
-			...memberships === void 0 ? {} : { memberships },
-			...sources === void 0 || sources.length === 0 ? {} : { sources },
-			...memberSources === void 0 || memberSources.length === 0 ? {} : { memberSources },
-			...suspension === void 0 ? {} : { suspension },
-			...roles === void 0 ? {} : { roles },
-			...input.customRoles === true || customRolesOn(rls) ? { customRoles: {
-				...customRoleNames(policy, requires.keys),
-				...rls?.customRoleWrites?.roles === void 0 ? {} : { table: rls.customRoleWrites.roles }
-			} } : {},
-			...input.capabilities === true || rls?.capabilities === true ? { capabilities: true } : {},
-			...apiKeys === void 0 ? {} : { apiKeys },
-			...rls?.anonymousSignIns === "deny" ? { anonymousSignIns: "deny" } : {},
-			...ownership === void 0 ? {} : { ownership },
-			...rls?.ownershipTriggers === void 0 ? {} : { skipOwnershipTriggers: skippedOwnershipTriggers(rls.ownershipTriggers, scopes) },
-			...rls?.assignments === void 0 ? {} : { assignments: rls.assignments === true ? { tables: [] } : {
-				tables: rls.assignments.tables ?? [],
-				...rls.assignments.ownRole === void 0 ? {} : { ownRole: rls.assignments.ownRole }
-			} },
-			...options.fieldsMode === void 0 ? {} : { fields: options.fieldsMode },
-			...graph.size === 0 ? {} : { graph: {
-				closures: closureDepths(graph),
-				resources: policy.resources,
-				...rls?.tables === void 0 ? {} : { tables: rls.tables }
-			} }
-		},
-		graph,
-		ownership,
-		schema,
-		authorize
-	};
+/**
+* The generate notes for the bindings whose table no project SQL file creates.
+* A project with no `create table` in those files gets none: its schema lives
+* elsewhere (an ORM, another repository).
+*/
+function unknownTableNotes(bindings, created) {
+	if (created.size === 0) return [];
+	return bindings.filter((binding) => !created.has(binding.table) && !created.has(binding.table.toLowerCase())).map((binding) => `resource ${binding.resource} is bound to ${binding.table}, which no SQL file in the migration or schema folders creates; name its table in rls.tables, or set rls.tables.${binding.resource}: false when it has none`);
+}
+/** The inferred bindings whose table `facts` shows missing. */
+function missingBindings(bindings, columns) {
+	return bindings.filter((binding) => binding.inferred && columns[binding.table] === void 0);
 }
 //#endregion
-//#region src/cli/rls/generate-options.ts
-function isRefusal(value) {
-	return "refusal" in value;
+//#region src/cli/rls/trigger-notes.ts
+const CREATE = /^create trigger\s+("[^"]+"|[\w$]+)[^;]*?\bon\s+("[^"]+"(?:\."[^"]+")?|[\w$.]+)/gmu;
+function unquote(name) {
+	return name.replaceAll("\"", "");
+}
+function reasonOf(name) {
+	if (name === "permdock_custom_role_name_guard") return "customRoleWrites.roles: a tenant role cannot take a declared or shared role's name";
+	if (name === "permdock_custom_role_cascade") return "customRoleWrites.roles: a rename or delete of a role carries its grants";
+	if (name.startsWith("permdock_sync_custom_role_guard")) return "customRoles.from.sync: a signed-in caller writes only entries they may hand out";
+	if (name.startsWith("permdock_sync_custom_role")) return "customRoles.from.sync: each write to the legacy table rebuilds the role's grants";
+	if (name.startsWith("permdock_holders") || name.startsWith("permdock_transfer_only")) return "ownershipTriggers; set rls.ownershipTriggers.<scope>: false to skip";
+	if (name === "permdock_assignment") return "assignments: a role assignment is checked against the caller's own roles";
+	if (name.startsWith("permdock_closure")) return "the relationship closure table follows its source table";
+	return "generated by rls generate";
+}
+/** The triggers `sql` creates, in order, each with the option behind it. */
+function generatedTriggers(sql) {
+	const found = [];
+	for (const match of sql.matchAll(CREATE)) {
+		const name = unquote(match.slice(1, 2).join(""));
+		const table = unquote(match.slice(2, 3).join(""));
+		found.push({
+			name,
+			table,
+			reason: reasonOf(name)
+		});
+	}
+	return found;
 }
-/** The checks that need no policy: `--fields` and `--revoke-columns`. */
-function generateOptions(input) {
-	const rls = input.config.rls;
-	const fieldsMode = input.fields ?? rls?.fields;
-	if (fieldsMode !== void 0 && fieldsMode !== "views") return { refusal: `rls generate --fields must be views (got ${fieldsMode})` };
-	const revokeColumns = input.revokeColumns === true || rls?.revokeColumns === true;
-	if (revokeColumns && fieldsMode === void 0) return { refusal: "rls generate --revoke-columns needs --fields views" };
+/** One generate note per trigger. */
+function triggerNotes(sql) {
+	return generatedTriggers(sql).map((trigger) => `generated trigger ${trigger.name} on ${trigger.table} (${trigger.reason})`);
+}
+//#endregion
+//#region src/cli/rls/explain.ts
+function holds(table) {
+	if (table.tenant === void 0) return ["global"];
+	return [
+		"tenant",
+		...table.shared === void 0 ? [] : ["shared"],
+		"global"
+	];
+}
+function explainRls(input) {
+	const { config, ctx, generated } = input;
+	const rls = config.rls;
+	const bindings = tableBindings(generated.compiled.rowColumns.map((item) => item.resource), tableNames(rls?.tables), generated.helpersOnly);
+	const sources = ctx.memberSources ?? ctx.sources ?? [];
+	const roles = rls?.customRoleWrites?.roles;
+	const wanted = rls?.rowHelpers;
+	const resources = wanted === void 0 ? [] : wanted === true ? [...new Set(generated.compiled.branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(wanted)];
 	return {
-		fieldsMode,
-		revokeColumns
+		schema: input.schema,
+		authorize: input.authorize,
+		scopes: ctx.scopes.map((scope) => scope.within === void 0 ? {
+			name: scope.name,
+			key: scope.key ?? scope.name
+		} : {
+			name: scope.name,
+			key: scope.key ?? scope.name,
+			within: scope.within
+		}),
+		bindings: bindings.map((binding) => {
+			const via = ctx.vias?.[binding.resource];
+			return via === void 0 ? binding : Object.assign({}, binding, { via: `${via.helper} over ${via.table}.${via.column} (${binding.table}.${via.key})` });
+		}),
+		membershipSources: sources.map((source) => ({
+			table: source.sql.table,
+			select: source.sql.select("$1")
+		})),
+		...roles === void 0 ? {} : { customRoles: {
+			table: roles.table,
+			key: roles.key,
+			...roles.tenant === void 0 ? {} : { tenant: roles.tenant },
+			...roles.shared === void 0 ? {} : { shared: roles.shared },
+			...roles.skip === void 0 ? {} : { skip: roles.skip },
+			holds: holds(roles)
+		} },
+		rowHelpers: resources.map((resource) => ({
+			resource,
+			permissions: [...new Set(generated.compiled.branches.flatMap((branch) => branch.resource === resource && branch.coverage !== true ? [branch.permissionKey] : []))].toSorted()
+		})),
+		triggers: generatedTriggers(input.text)
 	};
 }
-/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
-function splitsPart(raw, part) {
-	const split = parseSplit(raw);
-	return typeof split !== "string" && split?.includes(part) === true;
+/** The text report of `explain`. */
+function describeExplain(explain) {
+	const lines = [
+		`schema ${explain.schema}, authorize ${explain.authorize}`,
+		`scopes: ${explain.scopes.map((scope) => `${scope.name} (${scope.key}${scope.within === void 0 ? "" : `, within ${scope.within}`})`).join(", ")}`,
+		"",
+		"table bindings:",
+		...explain.bindings.map((binding) => `  ${binding.resource} -> ${binding.table}${binding.inferred ? " (named after the resource; set rls.tables to change)" : ""}${binding.via === void 0 ? "" : ` via ${binding.via}`}${binding.exists === false ? " MISSING" : ""}`)
+	];
+	if (explain.membershipSources.length > 0) {
+		lines.push("", "membership sources:");
+		for (const source of explain.membershipSources) lines.push(`  ${source.table}`, `    ${source.select.replaceAll("\n", "\n    ")}`);
+	}
+	if (explain.customRoles !== void 0) {
+		const roles = explain.customRoles;
+		const columns = [
+			`key ${roles.key}`,
+			...roles.tenant === void 0 ? [] : [`tenant ${roles.tenant}`],
+			...roles.shared === void 0 ? [] : [`shared ${roles.shared}`],
+			...roles.skip === void 0 ? [] : [`skip ${roles.skip}`]
+		];
+		lines.push("", `custom roles: ${roles.table} (${columns.join(", ")}); holds ${roles.holds.join(", ")} roles`);
+	}
+	if (explain.rowHelpers.length > 0) {
+		lines.push("", "row helpers:");
+		for (const helper of explain.rowHelpers) lines.push(`  ${helper.resource}: ${helper.permissions.join(", ")}`);
+	}
+	if (explain.triggers.length > 0) {
+		lines.push("", "generated triggers:");
+		for (const trigger of explain.triggers) lines.push(`  ${trigger.name} on ${trigger.table} (${trigger.reason})`);
+	}
+	return lines.join("\n");
 }
 //#endregion
 //#region src/cli/rls/generate-output.ts
@@ -312,8 +337,8 @@ function moveUndiffed(sql, label, part) {
 }
 /** Why `--split` cannot be written for `mode`, or `undefined`. */
 function splitRefusal(mode, plan) {
-	const seedsWithoutOut = plan.split.includes("seeds") && plan.seedsOut === void 0;
-	const helpersWithoutSeeds = plan.split.includes("helpers") && !plan.split.includes("seeds");
+	const seedsWithoutOut = plan.split.includes("seeds") && plan.seedsOut === void 0 && !plan.noSeeds && !plan.seedView;
+	const helpersWithoutSeeds = plan.split.includes("helpers") && !plan.noSeeds && !plan.split.includes("seeds") && !plan.seedFunction && !plan.seedView;
 	switch (mode) {
 		case "pg-delta":
 			if (plan.explicitOut && !plan.placeholder) return `rls generate --split needs {part} in --out, or no --out for pg-delta's per-schema layout (got ${plan.outRel})`;
@@ -333,7 +358,10 @@ function splitRefusal(mode, plan) {
 		default: return mode;
 	}
 }
-/** The files `generate` writes: one, or one per `--split` part, plus the hook's grants under migra. */
+/**
+* The files `generate` writes: one, or one per `--split` part, plus the hook's
+* grants under migra.
+*/
 function outputFiles(plan) {
 	const { input } = plan;
 	const split = parseSplit(input.split);
@@ -342,6 +370,7 @@ function outputFiles(plan) {
 	if (split === void 0) {
 		if (input.grantsOut !== void 0) return "rls generate --grants-out needs --split with the helpers or hook part";
 		if (input.seedsOut !== void 0) return "rls generate --seeds-out needs --split with the seeds part";
+		if (input.noSeeds === true) return "rls generate --no-seeds needs --split: without it the seeds are part of the one file";
 		return [{
 			part: "rls",
 			rel: plan.outRel,
@@ -358,11 +387,15 @@ function outputFiles(plan) {
 		explicitOut: input.out !== void 0,
 		outRel: plan.outRel,
 		grantsOut: input.grantsOut,
-		seedsOut: input.seedsOut
+		seedsOut: input.seedsOut,
+		noSeeds: input.noSeeds === true,
+		seedFunction: input.config.rls?.seeds === "function",
+		seedView: input.config.rls?.seeds === "view"
 	});
 	if (refused !== void 0) return refused;
 	const at = (part, schema = plan.schema) => pgDelta === void 0 || placeholder ? partPath(plan.outRel, part) : pgDeltaPath(pgDelta.schemaDir, part, schema);
 	if (input.grantsOut !== void 0 && !split.includes("hook") && !split.includes("helpers")) return "rls generate --grants-out needs the helpers or hook part in --split";
+	if (input.noSeeds === true && input.seedsOut !== void 0) return "rls generate --no-seeds and --seeds-out exclude each other: drop one";
 	if (input.seedsOut !== void 0 && !split.includes("seeds")) return "rls generate --seeds-out needs the seeds part in --split";
 	if (split.includes("hook") && input.config.supabase?.hook === void 0) return "rls generate --split hook needs supabase.hook in permdock.config.ts";
 	const sql = plan.sql();
@@ -393,6 +426,10 @@ function outputFiles(plan) {
 			break;
 		}
 		case "seeds": {
+			if (input.noSeeds === true) {
+				if (relocated !== void 0 && split.includes("policies")) return "rls generate --no-seeds cannot drop the seeds part under pg-delta with rls.realtime or rls.storage: their policies live in it";
+				break;
+			}
 			const out = input.seedsOut;
 			if (out !== void 0 && isSeedsDirectory(input.cwd, out)) {
 				const planned = seedsMigration(input.cwd, out, SEEDS_MARKER, seeds, input.io.now?.() ?? dateAt());
@@ -438,6 +475,12 @@ function outputFiles(plan) {
 		}
 		default: return part;
 	}
+	if (pgDelta !== void 0 && !placeholder) {
+		for (const [index, file] of files.entries()) if (file.part !== "seeds" || input.seedsOut === void 0) files[index] = {
+			...file,
+			text: declarativeSql(file.text)
+		};
+	}
 	if (input.grantsOut !== void 0) files.push({
 		part: "grants",
 		rel: input.grantsOut,
@@ -447,124 +490,18 @@ function outputFiles(plan) {
 }
 //#endregion
 //#region src/cli/rls/backfill.ts
-const PREFIX$1 = "PermDock CLI";
-/** A column of the roles-table row `r`. */
-function col(name) {
-	return `r.${quoteIdent$1(name)}`;
-}
-function schemaOf(table) {
-	return table.includes(".") ? beforeFirst(table, ".") : "public";
-}
-/** The roles-table column a reference joins on, after checking it points at `roles`. */
-function roleRef(role, table, roles, label) {
-	const pairs = Object.entries(role.on);
-	const [pair] = pairs;
-	if (pair === void 0 || pairs.length !== 1) throw configError(`${PREFIX$1}: ${label}.on must map exactly one column of ${table} to ${role.through}, for example { role_id: 'id' }`);
-	const through = role.through.includes(".") ? role.through : `${schemaOf(table)}.${role.through}`;
-	if (qualifySqlTable(through) !== qualifySqlTable(roles.table)) throw configError(`${PREFIX$1}: ${label}.through must be rls.customRoleWrites.roles.table (${roles.table}), got ${role.through}`);
-	if (role.column !== roles.key) throw configError(`${PREFIX$1}: ${label}.column must be rls.customRoleWrites.roles.key (${roles.key}), got ${role.column}`);
-	const [ref, id] = pair;
-	return {
-		ref,
-		id
-	};
-}
 /**
-* A legacy key as SQL the way `mapKey` maps it: `rls.migrate.keys`, then
-* `renamed`, then the longest `rls.migrate.prefixes` match, and a former key
-* read as its current key.
-*/
-function legacyKeySql(expr, migrate, renamed) {
-	const exact = new Map(Object.entries(renamed));
-	for (const [from, to] of Object.entries(migrate?.keys ?? {})) exact.set(from, to);
-	const prefixes = Object.entries(migrate?.prefixes ?? {}).toSorted(([a], [b]) => b.length - a.length || byCodeUnit(a, b));
-	const prefixed = prefixes.length === 0 ? expr : `(case ${prefixes.map(([from, to]) => `when left(${expr}, ${String(from.length)}) = ${quoteLiteral(from)} then ${quoteLiteral(to)} || substr(${expr}, ${String(from.length + 1)})`).join(" ")} else ${expr} end)`;
-	const mapped = exact.size === 0 ? prefixed : `(case ${expr} ${[...exact.entries()].toSorted(byKey).map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else ${prefixed} end)`;
-	const renames = Object.entries(renamed).toSorted(byKey);
-	return currentKeyExpr(renames, mapped);
-}
-function sourceSql(source, table, label) {
-	return roleColumn(source, table, "x", {
-		label,
-		prefix: PREFIX$1
-	}).lookup;
-}
-/**
-* The `--backfill-out` migration: every custom role in the application's
-* roles table that has no rows in `custom_role_permissions` or
-* `custom_role_includes` yet is saved through
-* `permdock_trusted_replace_custom_role_grants`, with the entries PermDock
-* cannot hold left out and listed in one warning. Running it again copies
-* nothing, so a role edited after the copy keeps its edits.
+* The `--backfill-out` migration: every custom role in the application's roles
+* table that has no rows in `custom_role_permissions` or `custom_role_includes`
+* yet is saved through `permdock_trusted_replace_custom_role_grants`, with the
+* entries PermDock cannot hold left out and listed in one warning. Running it
+* again copies nothing, so a role edited after the copy keeps its edits.
 */
 function backfillSql(ctx, from, migrate) {
-	const custom = ctx.customRoles;
-	const root = ctx.scopes[0]?.name;
-	if (custom === void 0 || root === void 0) throw configError(`${PREFIX$1}: rls.customRoles.from needs custom roles on`);
-	if (ctx.authorize !== "database") throw configError(`${PREFIX$1}: rls.customRoles.from needs database mode; in jwt mode custom roles ride the token, so build the grants claim with customRoleClaim`);
-	const roles = custom.table;
-	if (roles === void 0) throw configError(`${PREFIX$1}: rls.customRoles.from needs rls.customRoleWrites.roles, the roles table each row belongs to`);
-	const leveled = custom.levels === true;
-	if (from.permissions.level !== void 0 && !leveled) throw configError(`${PREFIX$1}: rls.customRoles.from.permissions.level is set, but no resource declares levels`);
-	const tenantType = tenantTypeOf(ctx);
-	const rolesTable = quoteQualified(roles.table);
-	const tenant = roles.tenant === void 0 ? `null::${tenantType}` : `${col(roles.tenant)}::${tenantType}`;
-	const scope = rolesTableScope(roles, tenant, root, col);
-	const scopeId = roles.id === void 0 ? "null::text" : `${col(roles.id)}::text`;
-	const skipped = roles.skip === void 0 ? "false" : `coalesce(${col(roles.skip)}, false)`;
-	const renamed = custom.renamed ?? {};
-	const renames = Object.entries(renamed).toSorted(byKey);
-	const current = (expr) => currentKeyExpr(renames, expr);
-	const known = sqlTextArray([...custom.permissions ?? [], ...renames.map(([former]) => former)]);
-	const declared = sqlTextArray(custom.declared);
-	const scopes = sqlTextArray(ctx.scopes.map((item) => item.name));
-	const ceiling = qualified(ctx, CUSTOM_ROLES.ceiling);
-	const rp = qualified(ctx, "role_permissions");
-	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
-	const includes = qualified(ctx, CUSTOM_ROLES.includes);
-	const replace = qualified(ctx, CUSTOM_ROLES.trustedReplace);
-	const p = from.permissions;
-	const pTable = qualifySqlTable(p.table);
-	const pRef = roleRef(p.role, p.table, roles, "rls.customRoles.from.permissions.role");
-	const legacy = sourceSql(p.permission, pTable, "rls.customRoles.from.permissions.permission");
-	const effect = p.effect === void 0 ? "'allow'" : `coalesce(lower(x.${quoteIdent$1(p.effect)}::text), 'allow')`;
-	const level = p.level === void 0 ? "null::text" : `nullif(x.${quoteIdent$1(p.level)}::text, '')`;
-	const inCeiling = (key) => `exists (select 1 from ${ceiling} c where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = ${key})`;
-	const levelCheck = leveled ? `
-          when m.effect = 'allow' and m.level is not null and not exists (
-            select 1 from ${ceiling} c
-            where c.scope = v.scope and c.effect = 'allow' and ${current("c.permission")} = m.key
-              and split_part(c.grant_key, '@', 2) = m.level
-          ) then 'level ' || m.level || ' is not declared'` : "";
-	const allowEntry = leveled ? "j.key || coalesce('@' || j.level, '')" : "j.key";
-	const i = from.includes;
-	const iTable = i === void 0 ? void 0 : qualifySqlTable(i.table);
-	const iRef = i === void 0 || iTable === void 0 ? void 0 : roleRef(i.role, i.table, roles, "rls.customRoles.from.includes.role");
-	const included = i === void 0 || iTable === void 0 ? void 0 : sourceSql(i.include, iTable, "rls.customRoles.from.includes.include");
-	const refs = [`${col(pRef.id)} as permissions_ref`, ...iRef === void 0 ? [] : [`${col(iRef.id)} as includes_ref`]].join(", ");
-	const includeBlock = i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 ? "    v_include := null;" : `    with raw as (
-      select ${included} as role
-      from ${quoteTable(iTable)} x
-      where x.${quoteIdent$1(iRef.ref)} = v.includes_ref
-    ),
-    judged as (
-      select n.role, case
-          when n.role is null or not (n.role = any(${declared})) then 'not a declared role'
-          when exists (
-            select 1 from ${rp} rp
-            where rp.role = n.role and rp.effect = 'allow'
-              and not ${inCeiling(current("rp.permission"))}
-          ) then 'allows permissions outside the ceiling of ' || v.scope
-        end as dropped
-      from raw n
-    )
-    select array_agg(distinct j.role) filter (where j.dropped is null),
-      array_agg(v.role || ': includes ' || coalesce(j.role, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
-    into v_include, v_lost
-    from judged j;
-    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
+	const plan = rebuildPlan(ctx, from, migrate);
+	const { rolesTable, perms, includes, replace, scopes } = plan;
 	return `${BACKFILL_MARKER} schema=${ctx.schema ?? "permdock"}
--- custom roles copied from ${qualifySqlTable(roles.table)} (rls.customRoles.from) through ${replace}
+-- custom roles copied from ${qualifySqlTable(plan.roles.table)} (rls.customRoles.from) through ${replace}
 -- a role that already has rows is left as it is; entries PermDock cannot hold are dropped and listed in one warning
 do $permdock$
 declare
@@ -578,9 +515,9 @@ declare
   v_present integer := 0;
 begin
   for v in
-    select ${tenant} as tenant_id, ${scope} as scope, ${scopeId} as scope_id, ${col(roles.key)}::text as role, ${refs}
+    ${plan.identity}
     from ${rolesTable} r
-    where not ${skipped} and not (${col(roles.key)}::text = any(${declared}))
+    where ${plan.eligible}
     order by 4, 2, 1, 3
   loop
     if v.role is null or not (v.scope = 'global' or v.scope = any(${scopes})) then
@@ -597,30 +534,7 @@ begin
       v_present := v_present + 1;
       continue;
     end if;
-    with raw as (
-      select ${legacy} as legacy, ${effect} as effect, ${level} as level
-      from ${quoteTable(pTable)} x
-      where x.${quoteIdent$1(pRef.ref)} = v.permissions_ref
-    ),
-    mapped as (
-      select n.legacy, ${legacyKeySql("n.legacy", migrate, renamed)} as key, n.effect, n.level
-      from raw n
-    ),
-    judged as (
-      select m.*, case
-          when m.effect not in ('allow', 'deny') then 'effect ' || m.effect || ' is not allow or deny'
-          when m.key is null or not (m.key = any(${known})) then 'not a declared permission'
-          when m.effect = 'allow' and not ${inCeiling("m.key")} then 'outside the ceiling of ' || v.scope${levelCheck}
-        end as dropped
-      from mapped m
-    )
-    select array_agg(distinct ${allowEntry}) filter (where j.dropped is null and j.effect = 'allow'),
-      array_agg(distinct j.key) filter (where j.dropped is null and j.effect = 'deny'),
-      array_agg(v.role || ': ' || coalesce(j.legacy, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
-    into v_allow, v_deny, v_lost
-    from judged j;
-    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);
-${includeBlock}
+${plan.collect}
     if v_allow is null and v_deny is null and v_include is null then
       continue;
     end if;
@@ -629,7 +543,7 @@ ${includeBlock}
   end loop;
   raise notice 'permdock backfill: copied % custom role(s), % already present', v_copied, v_present;
   if cardinality(v_dropped) > 0 then
-    raise warning 'permdock backfill: dropped % entr(ies) PermDock cannot hold: %', cardinality(v_dropped), array_to_string(v_dropped[1:50], '; ');
+    raise warning 'permdock backfill: dropped % entr(ies) PermDock cannot hold: %', cardinality(v_dropped), ${DROPPED_LIST};
   end if;
 end
 $permdock$;
@@ -637,9 +551,12 @@ $permdock$;
 }
 //#endregion
 //#region src/cli/rls/break-glass.ts
-/** The audit table every generated break-glass read writes to. Part of the SQL contract. */
+/**
+* The audit table every generated break-glass read writes to. Part of the SQL
+* contract.
+*/
 const BREAK_GLASS_AUDIT = "permdock_break_glass_audit";
-const IDENT$1 = /^[a-z][a-z0-9_]*$/u;
+const IDENT$2 = /^[a-z][a-z0-9_]*$/u;
 /**
 * The resources a `breakGlass` grant targets, with the table each reads. A
 * break-glass grant is non-portable, so `compileGrants` never turns it into a
@@ -678,17 +595,17 @@ function breakGlassEntries(policy, tables) {
 	}));
 }
 /**
-* Rows the subject's roles reach for `p_permission`: a break-glass grant
-* lifts denies, never the tenant boundary. A grant to no role reads the rows
-* of the root scopes the subject is a member of, or every row when the
-* policy declares no scopes.
+* Rows the subject's roles reach for `p_permission`: a break-glass grant lifts
+* denies, never the tenant boundary. A grant to no role reads the rows of the
+* root scopes the subject is a member of, or every row when the policy declares
+* no scopes.
 */
 function rowsFilter(ctx, entry) {
 	const arms = entry.grants.flatMap((grant) => {
 		const asked = `p_permission = ${quoteLiteral(grant.permission)}`;
 		if (grant.scope === "anyone") {
 			if (grant.root === void 0) return [`(${asked})`];
-			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified(ctx, memberIdsHelper(grant.root))}()))`];
+			return grant.column === void 0 ? [] : [`(${asked} and ${quoteIdent$1(grant.column)} in (select ${qualified$1(ctx, memberIdsHelper(grant.root))}()))`];
 		}
 		if (grant.scope !== "global" && grant.column === void 0) return [];
 		return [`(${asked} and ${accessSql(ctx, grant.scope, breakGlassKey(grant.permission), grant.column)})`];
@@ -696,11 +613,11 @@ function rowsFilter(ctx, entry) {
 	return arms.length === 0 ? "false" : [...new Set(arms)].join("\n    or ");
 }
 function functionName$1(resource) {
-	if (!IDENT$1.test(resource)) throw configError(`PermDock CLI: unsafe break-glass resource '${resource}'`);
+	if (!IDENT$2.test(resource)) throw configError(`PermDock CLI: unsafe break-glass resource '${resource}'`);
 	return `permdock_break_glass_${resource}`;
 }
 function auditSql$1(ctx) {
-	const audit = qualified(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
 	return `-- break-glass audit: one row per session that read restricted data
 -- RLS never compiles a break-glass override, so restricted rows stay denied to a direct read
 create table if not exists ${audit} (
@@ -715,8 +632,8 @@ alter table ${audit} enable row level security;
 revoke all on table ${audit} from anon, authenticated, public;`;
 }
 function readFunctionSql(ctx, entry) {
-	const fn = qualified(ctx, functionName$1(entry.resource));
-	const audit = qualified(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
+	const fn = qualified$1(ctx, functionName$1(entry.resource));
+	const audit = qualified$1(ctx, quoteIdent$1(BREAK_GLASS_AUDIT));
 	const table = quoteQualified(entry.table);
 	const session = subjectClaimJsonSql(ctx, "break_glass");
 	const subject = subjectIdSql(ctx);
@@ -756,12 +673,12 @@ revoke execute on function ${fn}(text) from public, anon;
 grant execute on function ${fn}(text) to authenticated;`;
 }
 /**
-* The `security definer` read path for every `breakGlass` grant: an audit
-* table and one `permdock_break_glass_<resource>(permission)` per resource
-* that checks a signed break-glass session, writes an audit row and returns
-* the rows in the scope instances where the subject holds a role with the
-* break-glass grant (bypassing the table's policies as the definer). Empty
-* when the policy has no break-glass grant.
+* The `security definer` read path for every `breakGlass` grant: an audit table
+* and one `permdock_break_glass_<resource>(permission)` per resource that
+* checks a signed break-glass session, writes an audit row and returns the rows
+* in the scope instances where the subject holds a role with the break-glass
+* grant (bypassing the table's policies as the definer). Empty when the policy
+* has no break-glass grant.
 */
 function breakGlassSql(ctx, entries) {
 	if (entries.length === 0) return "";
@@ -770,9 +687,9 @@ function breakGlassSql(ctx, entries) {
 //#endregion
 //#region src/cli/rls/emit.ts
 const HEADER = "-- generated by permdock rls generate\n-- fail-closed: never target a bypass role\n";
-const TRUSTED_READER_GRANT = /^grant execute on function [^\n]+\.permdock_trusted_role_permissions\([^)\n]*\) to [^\n;]+;$/gmu;
+const TRUSTED_READER_GRANT = /^grant usage on schema "[^"\n]+" to [^\n;]+;\ngrant execute on function [^\n]+\.permdock_trusted_role_permissions(?:_by_id)?\([^)\n]*\) to [^\n;]+;$/gmu;
 function assertNoServiceRole(text) {
-	if (/\bservice_role\b/iu.test(text.replace(TRUSTED_READER_GRANT, ""))) throw new Error("PermDock CLI: generated RLS must never emit service_role");
+	if (/\bservice_role\b/iu.test(text.replaceAll(TRUSTED_READER_GRANT, ""))) throw new Error("PermDock CLI: generated RLS must never emit service_role");
 }
 function assertSupautilsSafe(text) {
 	const [first] = supautilsRejections(text);
@@ -780,8 +697,8 @@ function assertSupautilsSafe(text) {
 }
 /**
 * Neon's Data API and `pg_session_jwt` name the anonymous role `anonymous`;
-* Supabase, PostgREST and the GUC pattern use `anon`. Role lists end a line
-* or a statement after `to` or `from`, so only those are renamed.
+* Supabase, PostgREST and the GUC pattern use `anon`. Role lists end a line or
+* a statement after `to` or `from`, so only those are renamed.
 */
 function dialectRoles(text, dialect) {
 	if (dialect !== "neon") return text;
@@ -790,7 +707,10 @@ function dialectRoles(text, dialect) {
 function tablesOf(policies) {
 	return [...new Set(policies.map((item) => item.table))];
 }
-/** Enable (and force) row level security, then the table grants for the commands a policy allows. */
+/**
+* Enable (and force) row level security, then the table grants for the commands
+* a policy allows.
+*/
 function tableSql(table, policies, force, views) {
 	const closed = views.find((view) => view.table === table && view.companion !== void 0);
 	const target = quoteQualified(table);
@@ -811,7 +731,10 @@ function tableSql(table, policies, force, views) {
 	if (closed !== void 0) lines.push(columnRevokeSql(closed));
 	return lines.join("\n");
 }
-/** `drop policy if exists` and `create policy` for one policy, without the table's grants. */
+/**
+* `drop policy if exists` and `create policy` for one policy, without the
+* table's grants.
+*/
 function policySql(item) {
 	const target = quoteQualified(item.table);
 	const lines = [
@@ -838,8 +761,9 @@ function emitSql(policies, preamble, force = false, views = []) {
 	return text;
 }
 /**
-* The SQL a Drizzle or Prisma schema cannot declare: helpers, grants, `force` and field views.
-* `rls generate` writes it next to `out` for a custom migration.
+* The SQL a Drizzle or Prisma schema cannot declare: helpers, grants, `force`
+* and field views. `rls generate` writes it next to `out` for a custom
+* migration.
 */
 function migrationSql(policies, preamble, force, views) {
 	const parts = [
@@ -857,7 +781,7 @@ function helpersNote(helpers, how) {
 	return helpers === void 0 ? [] : [`// run ${helpers} ${how}`];
 }
 function camelCase(name) {
-	return name.replace(/[_-]+([a-z0-9])/gi, (_, char) => char.toUpperCase());
+	return name.replaceAll(/[_-]+([a-z0-9])/giu, (_, char) => char.toUpperCase());
 }
 function tableName(table) {
 	return table.slice(table.lastIndexOf(".") + 1);
@@ -866,16 +790,16 @@ function pascalCase(name) {
 	const camel = camelCase(name);
 	return camel.charAt(0).toUpperCase() + camel.slice(1);
 }
-const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/u;
 function identifier(name, what) {
 	if (!IDENTIFIER.test(name)) throw configError(`PermDock CLI: ${what} ${JSON.stringify(name)} is not an identifier`);
 	return name;
 }
 function quoted(text) {
-	return `'${text.replace(/[\\']/g, (match) => `\\${match}`)}'`;
+	return `'${text.replaceAll(/[\\']/gu, (match) => `\\${match}`)}'`;
 }
 function templateText(text) {
-	return text.replace(/[\\`]|\$\{/g, (match) => `\\${match}`);
+	return text.replaceAll(/[\\`]|\$\{/gu, (match) => `\\${match}`);
 }
 const AUTH_UID = "(select auth.uid())";
 function drizzleRoles(list) {
@@ -920,7 +844,10 @@ function emitDrizzle(policies, options) {
 	assertNoServiceRole(text);
 	return text;
 }
-/** Prisma 8 `policy_<command>` blocks; each target model declares `@@rls` itself. */
+/**
+* Prisma 8 `policy_<command>` blocks; each target model declares `@@rls`
+* itself.
+*/
 function emitPrisma(policies, options = {}) {
 	const modelOf = (table) => identifier(options.models?.[table] ?? pascalCase(tableName(table)), "model");
 	const models = [...new Set(policies.map((item) => modelOf(item.table)))];
@@ -977,12 +904,12 @@ function declaredScope(facts, scope, where) {
 	return scope;
 }
 /**
-* The ids of `scope` where the subject holds `key` through an allow without
-* a row condition, minus a deny of it, as text: `<value> in (…)`. A
-* relationship or a `where` on the same permission never widens it.
+* The ids of `scope` where the subject holds `key` through an allow without a
+* row condition, minus a deny of it, as text: `<value> in (…)`. A relationship
+* or a `where` on the same permission never widens it.
 */
 function permitted(ctx, value, scope, key) {
-	return `${value} in (select x::text from ${qualified(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
+	return `${value} in (select x::text from ${qualified$1(ctx, permittedByPermissionHelper(scope))}(${quoteLiteral(key)}) x)`;
 }
 function escapeRegex(text) {
 	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
@@ -1083,9 +1010,9 @@ function storagePolicies(ctx, facts, storage, warnings) {
 * The `realtime.messages` and `storage.objects` policies `rls.realtime` and
 * `rls.storage` describe. Each one admits a row only where the subject holds
 * the permission in the scope instance its topic segment or folder names,
-* through an allow without a row condition, so the helpers' API-key ceiling
-* and suspension rules apply and a relationship grant on the same permission
-* never reaches a topic or a folder.
+* through an allow without a row condition, so the helpers' API-key ceiling and
+* suspension rules apply and a relationship grant on the same permission never
+* reaches a topic or a folder.
 */
 function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 	if (config.realtime === void 0 && config.storage === void 0) return [];
@@ -1099,172 +1026,12 @@ function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 	return policies;
 }
 //#endregion
-//#region src/cli/rls/rows.ts
-/** `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject may act on with one permission. */
-function rowsHelper(resource) {
-	const name = graphSqlName(resource);
-	const helper = `permitted_${name ?? resource}_rows`;
-	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
-	return helper;
-}
-/** The branches a row check of a permission reads: its allows and denies on rows that exist, for signed-in callers. */
-function rowBranchesOf(branches, resource) {
-	const out = /* @__PURE__ */ new Map();
-	for (const branch of branches) {
-		if (branch.resource !== resource || branch.command === "insert" || branch.coverage === true || !branch.roles.includes("authenticated")) continue;
-		out.set(branch.permissionKey, [...out.get(branch.permissionKey) ?? [], branch]);
-	}
-	return out;
-}
-function usingOf(branches) {
-	const parts = branches.map((branch) => branchClauses(branch).using ?? "true");
-	return parts.length === 0 ? void 0 : orSql(parts);
-}
-function permissionCase(key, branches) {
-	const allow = usingOf(branches.filter((branch) => branch.effect === "allow"));
-	if (allow === void 0) return;
-	const deny = usingOf(branches.filter((branch) => branch.effect === "deny"));
-	const granted = `coalesce((${allow}), false)`;
-	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
-}
-function forUserSql(ctx, fn, helper) {
-	const user = ctx.dialect === "supabase" ? "uuid" : "text";
-	const signature = `${user}, text, jsonb`;
-	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
-returns setof text
-language plpgsql
-volatile
-security definer
-set search_path = ''
-as $$`;
-	const tail = `revoke execute on function ${fn}(${signature}) from public, anon, authenticated;`;
-	if (ctx.dialect === "supabase") return `${head}
-declare
-  v_claims text := pg_catalog.current_setting('request.jwt.claims', true);
-begin
-  perform pg_catalog.set_config(
-    'request.jwt.claims',
-    (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
-    true
-  );
-  return query select r.id from ${helper}(p_permission) r(id);
-  perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
-end
-$$;
-${tail}`;
-	const prefix = ctx.gucPrefix;
-	return `${head}
-declare
-  v_saved jsonb := '{}'::jsonb;
-  v_key text;
-  v_value text;
-begin
-  for v_key, v_value in
-    select 'user_id', p_user
-    union all
-    select c.key, c.value from pg_catalog.jsonb_each_text(coalesce(p_claims, '{}'::jsonb)) c where c.key <> 'user_id'
-  loop
-    v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
-    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
-  end loop;
-  return query select r.id from ${helper}(p_permission) r(id);
-  for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
-    perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
-  end loop;
-end
-$$;
-${tail}`;
-}
-function inheritTargets(policy) {
-	const out = /* @__PURE__ */ new Set();
-	for (const grant of policy.grants) for (const item of flattenGrantee(grant.to)) if (item.kind === "inherit") out.add(item.resource);
-	return [...out].toSorted();
-}
-function stubSql(ctx, resource) {
-	return `create or replace function ${qualified(ctx, rowsHelper(resource))}(p_permission text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select null::text where false
-$$;`;
-}
-function rowSql(ctx, rows, table, where) {
-	const fn = qualified(ctx, rows.replace(/_rows$/u, "_row"));
-	return `create or replace function ${fn}(p_row ${table}, p_permission text)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select exists (select 1 from (select (p_row).*) r where ${where})
-$$;
-revoke execute on function ${fn}(${table}, text) from public, anon;
-grant execute on function ${fn}(${table}, text) to authenticated;`;
-}
-function resourceSql(ctx, node, branches, tables) {
-	const name = rowsHelper(node.name);
-	const fn = qualified(ctx, name);
-	const table = quoteQualified(tableFor(node.name, tables));
-	const cases = [...branches.keys()].toSorted().flatMap((key) => {
-		const sql = permissionCase(key, branches.get(key) ?? []);
-		return sql === void 0 ? [] : [sql];
-	});
-	const where = cases.length === 0 ? "false" : `case p_permission\n${cases.join("\n")}\n    else false\n  end`;
-	const rows = `-- ${node.name}: ids of the rows the caller may act on with p_permission, as the table's policies decide it
-create or replace function ${fn}(p_permission text)
-returns setof text
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select ${quoteIdent$1(node.id)}::text from ${table}
-  where ${where}
-$$;
-revoke execute on function ${fn}(text) from public, anon;
-grant execute on function ${fn}(text) to authenticated;
-${rowSql(ctx, name, table, where)}`;
-	if (ctx.dialect === "neon") return rows;
-	return `${rows}
--- the same rows for a user the caller names, with claims it supplies; no client role may execute it
-${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
-}
-/**
-* `permitted_<resource>_rows(p_permission)` for each resource `select`
-* names (or every resource a grant reaches with `true`): the ids of its rows
-* the caller may read, update or delete with that permission, from the same
-* compiled allows and denies the table policies use, so closure walks, link
-* hops, the restricted stop, `includes`, groups and `requires` all apply. A
-* `security definer` helper, so hand-written policies and functions call it
-* without restating the graph. Outside the `neon` dialect a
-* `permitted_<resource>_rows_for(p_user, p_permission, p_claims)` form runs it
-* as the named user, with the claims the caller supplies, for trusted SQL.
-*/
-function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
-	const names = select === true ? [...new Set(branches.flatMap((branch) => branch.resource === void 0 ? [] : [branch.resource]))].toSorted() : [...new Set(select)];
-	const called = inheritTargets(policy);
-	for (const name of called) if (!names.includes(name)) names.push(name);
-	const chunks = called.map((name) => stubSql(ctx, name));
-	for (const name of names) {
-		const node = policy.resources.get(name);
-		if (node === void 0) throw configError(`PermDock CLI: rls.rowHelpers names '${name}', which the policy does not declare`);
-		chunks.push(resourceSql(ctx, node, rowBranchesOf(branches, name), tables));
-	}
-	if (chunks.length > 0 && ctx.dialect === "neon") warnings.push("rls.rowHelpers: the neon dialect reads the subject from auth.session(), which SQL cannot set, so no permitted_<resource>_rows_for is written");
-	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
-}
-//#endregion
 //#region src/cli/rls/generate-policies.ts
 const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
 /**
-* A `realtime.messages` or `storage.objects` policy that applies only where
-* the table exists. The Realtime and Storage services create those tables, so
-* a local stack with the service off, and pg-delta's shadow database, have
-* none.
+* A `realtime.messages` or `storage.objects` policy that applies only where the
+* table exists. The Realtime and Storage services create those tables, so a
+* local stack with the service off, and pg-delta's shadow database, have none.
 */
 function guardedPolicySql(item) {
 	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
@@ -1277,7 +1044,10 @@ end
 $permdock$;
 `;
 }
-/** Appends the `realtime.messages` and `storage.objects` policies, which never get `tableSql`. */
+/**
+* Appends the `realtime.messages` and `storage.objects` policies, which never
+* get `tableSql`.
+*/
 function withHelperTables(sql, helperTables) {
 	if (helperTables === void 0) return sql;
 	const tables = `${helperTables.trimEnd()}\n`;
@@ -1287,18 +1057,22 @@ function databaseModeWarnings(policy, { ctx }, warnings) {
 	if (ctx.authorize !== "database") return;
 	for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
 }
-/** The grants compiled into table policies, and the Realtime and Storage policies beside them. */
+/**
+* The grants compiled into table policies, and the Realtime and Storage
+* policies beside them.
+*/
 function generatePolicies(input, policy, options, built, warnings) {
 	const rls = input.config.rls;
 	const { ctx } = built;
 	const { fieldsMode, revokeColumns } = options;
 	databaseModeWarnings(policy, built, warnings);
-	const compiled = compileGrants(policy, ctx, rls?.tables, warnings, input.skipClosures, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0);
+	const compiled = compileGrants(policy, ctx, tableNames(rls?.tables), warnings, input.skipClosures, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0);
 	const helpersOnly = input.helpersOnly === true || rls?.helpersOnly === true;
 	if (helpersOnly && (input.target !== "sql" || revokeColumns)) return { refusal: "rls generate --helpers-only needs --target sql and no --revoke-columns: the table grants are hand-written, so revoke the restricted columns there" };
 	const views = fieldsMode === void 0 ? [] : fieldViews(policy, ctx, compiled.branches, {
 		revokeColumns,
-		helpersOnly
+		helpersOnly,
+		mask: fieldsMode === "mask"
 	}, warnings);
 	const force = input.force === true || rls?.force === true;
 	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
@@ -1308,7 +1082,7 @@ function generatePolicies(input, policy, options, built, warnings) {
 		...policyName === void 0 ? {} : { name: policyName }
 	});
 	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
-	if (actorKinds !== void 0 && helpersOnly) warnings.push(`rls.readOnlyActors with --helpers-only writes no policies: add \`and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())\` to each hand-written insert, update and delete policy, or a restrictive policy that calls it`);
+	if (actorKinds !== void 0 && helpersOnly) warnings.push(`rls.readOnlyActors with --helpers-only writes no policies: add \`and (select ${qualified$1(ctx, ACTOR_MAY_WRITE)}())\` to each hand-written insert, update and delete policy, or a restrictive policy that calls it`);
 	const withActors = (items) => actorKinds === void 0 ? items : [...items, ...readOnlyActorPolicies(items, subjectClaimJsonSql(ctx, "act"), actorKinds)];
 	let tablePolicies;
 	try {
@@ -1341,10 +1115,10 @@ function generatePolicies(input, policy, options, built, warnings) {
 }
 //#endregion
 //#region src/cli/rls/shims.ts
-const NAME = /^[a-z_][a-z0-9_]*$/u;
+const NAME$1 = /^[a-z_][a-z0-9_]*$/u;
 /**
-* The key a legacy caller passes, mapped the way `rls migrate` maps it:
-* `keys` and `renamed` exactly, then the longest `prefixes` entry.
+* The key a legacy caller passes, mapped the way `rls migrate` maps it: `keys`
+* and `renamed` exactly, then the longest `prefixes` entry.
 */
 function mappedKey(config, renamed) {
 	const exact = {
@@ -1365,10 +1139,10 @@ function addKey(list, key) {
 }
 /**
 * The grant keys behind each permission, per scope: the keys of its
-* unconditional allows, and every deny key. A shim cannot apply a row
-* condition or a validity window, so a conditional allow answers nothing and
-* a conditional deny always subtracts; the conditioned keys are listed apart.
-* A break-glass key answers only the break-glass read, so it is left out too.
+* unconditional allows, and every deny key. A shim cannot apply a row condition
+* or a validity window, so a conditional allow answers nothing and a
+* conditional deny always subtracts; the conditioned keys are listed apart. A
+* break-glass key answers only the break-glass read, so it is left out too.
 * Rows seeded under a former key are left out; the shim maps a former key to
 * the current one first.
 */
@@ -1422,9 +1196,12 @@ grant execute on function ${name}(${argTypes}) to authenticated;`;
 function grantKeys(keys, scope, effect) {
 	return `pg_catalog.jsonb_array_elements_text(coalesce(${keys.map(scope)} -> (${keys.key}) -> ${quoteLiteral(effect)}, '[]'::jsonb)) g(grant_key)`;
 }
-/** The instances of `scope` the caller holds an unconditional allow of the key in, minus those it holds a deny in. */
+/**
+* The instances of `scope` the caller holds an unconditional allow of the key
+* in, minus those it holds a deny in.
+*/
 function idsSql(ctx, keys, scope) {
-	const helper = qualified(ctx, permittedIdsHelper(scope));
+	const helper = qualified$1(ctx, permittedIdsHelper(scope));
 	return `  select a.id
   from ${grantKeys(keys, scope, "allow")}
   cross join lateral ${helper}(g.grant_key) a(id)
@@ -1434,7 +1211,7 @@ function idsSql(ctx, keys, scope) {
   cross join lateral ${helper}(g.grant_key) d(id)`;
 }
 function hasSql(ctx, keys) {
-	const has = qualified(ctx, HELPERS.has);
+	const has = qualified$1(ctx, HELPERS.has);
 	return `exists (select 1 from ${grantKeys(keys, "global", "allow")} where ${has}(g.grant_key))
     and not exists (select 1 from ${grantKeys(keys, "global", "deny")} where ${has}(g.grant_key))`;
 }
@@ -1452,14 +1229,14 @@ function shim(ctx, config, keys, fn, helper) {
 		case "membership": {
 			const scope = scopeOf(ctx, helper.scope);
 			const type = scopeTypeOf(ctx, scope);
-			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified(ctx, memberIdsHelper(scope))}()), false)`);
+			return shimFunction(fn, `p_id ${type}`, type, "boolean", `  select coalesce(p_id in (select ${qualified$1(ctx, memberIdsHelper(scope))}()), false)`);
 		}
 		case "role": {
 			const scope = scopeOf(ctx, helper.scope);
 			const type = scopeTypeOf(ctx, scope);
 			const values = Object.entries(ctx.roleValues ?? {});
 			const role = values.length === 0 ? "p_role" : `case p_role ${values.map(([from, to]) => `when ${quoteLiteral(from)} then ${quoteLiteral(to)}`).join(" ")} else p_role end`;
-			return shimFunction(fn, `p_id ${type}, p_role text`, `${type}, text`, "boolean", `  select coalesce(p_id in (select ${qualified(ctx, memberIdsHelper(scope))}(array[${role}])), false)`);
+			return shimFunction(fn, `p_id ${type}, p_role text`, `${type}, text`, "boolean", `  select coalesce(p_id in (select ${qualified$1(ctx, memberIdsHelper(scope))}(array[${role}])), false)`);
 		}
 		case "global": return shimFunction(fn, "p_key text", "text", "boolean", `  select ${hasSql(ctx, keys)}`);
 		case "scoped": {
@@ -1476,10 +1253,10 @@ function shim(ctx, config, keys, fn, helper) {
 * One wrapper per `rls.migrate.helpers` entry under its legacy name, so SQL
 * that `rls migrate` has not rewritten yet (function bodies, views, triggers)
 * answers from the PermDock helpers. A wrapper maps the legacy key to the
-* permission key, then to the grant keys `grants` lists for the helper's
-* scope, so a permission whose grants are split by condition still answers.
-* Each is `security definer` with an empty `search_path`, so a caller needs
-* `execute` on the wrapper only, not usage on the helper schema.
+* permission key, then to the grant keys `grants` lists for the helper's scope,
+* so a permission whose grants are split by condition still answers. Each is
+* `security definer` with an empty `search_path`, so a caller needs `execute`
+* on the wrapper only, not usage on the helper schema.
 */
 function shimsSql(ctx, config, shims, renamed, grants) {
 	const schema = shims.schema ?? "public";
@@ -1489,7 +1266,7 @@ function shimsSql(ctx, config, shims, renamed, grants) {
 	};
 	const chunks = [`-- permdock shims: legacy helper names over the permdock helpers; drop each once doctor reports no caller (PD056)`];
 	for (const [name, helper] of Object.entries(config.helpers).toSorted(byKey)) {
-		if (!NAME.test(name)) throw configError(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
+		if (!NAME$1.test(name)) throw configError(`PermDock CLI: unsafe rls.migrate helper name '${name}'`);
 		chunks.push(shim(ctx, config, keys, `${quoteIdent$1(schema)}.${name}`, helper));
 	}
 	return `${chunks.join("\n\n")}\n`;
@@ -1508,7 +1285,7 @@ const AUDITED = [
 	CUSTOM_ROLES.includes,
 	"user_roles"
 ];
-const IDENT = /^[a-z_][a-z0-9_$]*$/u;
+const IDENT$1 = /^[a-z_][a-z0-9_$]*$/u;
 /** The tables `sql` creates in `schema`, by name without the schema. */
 function generatedTables(sql, schema) {
 	const prefix = `create table if not exists ${quoteIdent$1(schema)}.`;
@@ -1560,8 +1337,8 @@ function triggersSql(triggers, schema, tables) {
 }
 /**
 * `rls.audit`: one call of the audit function per generated table, which
-* registers the table with the application's audit module. Statements that
-* run code, so they travel with the seeds.
+* registers the table with the application's audit module. Statements that run
+* code, so they travel with the seeds.
 */
 function auditSql(audit, schema, tables) {
 	if (audit === void 0) return "";
@@ -1570,7 +1347,7 @@ function auditSql(audit, schema, tables) {
 	if (listed !== void 0) for (const table of listed) knownTable(table, tables, "rls.audit.tables");
 	const targets = listed ?? AUDITED.filter((table) => tables.includes(table));
 	const args = Object.entries(audit.args ?? {}).map(([name, value]) => {
-		if (!IDENT.test(name)) throw configError(`${PREFIX}: rls.audit.args names ${JSON.stringify(name)}, which is not a lower-case parameter name`);
+		if (!IDENT$1.test(name)) throw configError(`${PREFIX}: rls.audit.args names ${JSON.stringify(name)}, which is not a lower-case parameter name`);
 		return `, ${quoteIdent$1(name)} => ${quoteLiteral(value)}`;
 	});
 	if (targets.length === 0) return "";
@@ -1580,7 +1357,10 @@ ${targets.map((table) => `select ${fn}(${quoteLiteral(`${quoteIdent$1(schema)}.$
 }
 //#endregion
 //#region src/cli/rls/generate-sql.ts
-/** The checks that need the SQL context: `--backfill-out`, `rls.anonymousSignIns`, `rls.jsonSchema`. */
+/**
+* The checks that need the SQL context: `--backfill-out`,
+* `rls.anonymousSignIns`, `rls.jsonSchema`.
+*/
 function preflight(input, { ctx }) {
 	const rls = input.config.rls;
 	const from = typeof rls?.customRoles === "object" ? rls.customRoles.from : void 0;
@@ -1633,14 +1413,15 @@ function sectionsSql(input, policy, options, built, generated, jsonSchema, warni
 	} catch (cause) {
 		return { refusal: describeError(cause) };
 	}
-	const graphed = graphSql(ctx, graph, rls?.tables);
+	if (typeof rls?.approvals === "object" && rls.approvals.delegations === true && ctx.authorize !== "database") warnings.push("rls.approvals.delegations with --authorize jwt: permdock_is_approver cannot read a delegator's permissions from the caller's token, so in SQL a cover never satisfies a holder() approver; approvalsHandler still does");
+	const graphed = graphSql(ctx, graph, tableNames(rls?.tables));
 	let rowHelpers = "";
 	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) try {
-		rowHelpers = rowHelpersSql(ctx, policy, [...options.fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], rls?.tables, warnings);
+		rowHelpers = rowHelpersSql(ctx, policy, [...options.fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], tableNames(rls?.tables), warnings);
 	} catch (cause) {
 		return { refusal: describeError(cause) };
 	}
-	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, rls?.tables));
+	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, tableNames(rls?.tables)));
 	return [
 		approvals,
 		owned === "" ? void 0 : owned,
@@ -1649,7 +1430,10 @@ function sectionsSql(input, policy, options, built, generated, jsonSchema, warni
 		rowHelpers === "" ? void 0 : rowHelpers
 	];
 }
-/** Whether `anon` calls a helper: `rls.anonExecute`, an anon field view or an anon branch reading the user id. */
+/**
+* Whether `anon` calls a helper: `rls.anonExecute`, an anon field view or an
+* anon branch reading the user id.
+*/
 function anonExecutes(input, { compiled, views }) {
 	return input.config.rls?.anonExecute === true || views.some((view) => view.roles.includes("anon")) || compiled.branches.some((branch) => branch.roles.includes("anon") && [
 		branch.access,
@@ -1657,7 +1441,10 @@ function anonExecutes(input, { compiled, views }) {
 		branch.check
 	].some((sql) => sql?.includes("permdock_user_id") === true));
 }
-/** Everything before the table policies: helpers, sections, shims, scaffold and triggers. */
+/**
+* Everything before the table policies: helpers, sections, shims, scaffold and
+* triggers.
+*/
 function preambleSql(input, policy, options, built, generated, jsonSchema, warnings) {
 	const rls = input.config.rls;
 	const { ctx } = built;
@@ -1689,7 +1476,7 @@ function preambleSql(input, policy, options, built, generated, jsonSchema, warni
 			...rls?.trustedReaders === void 0 ? {} : { trustedReaders: rls.trustedReaders }
 		}),
 		permissionHelpersSql(ctx, grants, renamed, anonExecute),
-		permissionHoldersSql(ctx) || void 0,
+		nonEmptyOr(permissionHoldersSql(ctx), void 0),
 		actorKinds === void 0 ? void 0 : actorMayWriteSql(ctx, actorKinds),
 		usesLiveSession ? sessionLiveHelperSql(ctx) : void 0,
 		...sections,
@@ -1715,6 +1502,14 @@ function preambleSql(input, policy, options, built, generated, jsonSchema, warni
 		audit
 	};
 }
+function seedsBody(ctx, schema, rows) {
+	switch (ctx.seeds) {
+		case "function": return `select ${quoteQualified(`${schema}.seed`)}();`;
+		case "view": return "-- rls.seeds: 'view': the role_permissions rows are in the helpers part";
+		case void 0: return seedSql(ctx, rows);
+		default: return ctx.seeds;
+	}
+}
 function forceWarnings({ graph }, warnings) {
 	for (const entry of graph.values()) {
 		const own = [...entry.relations].filter((name) => !("edge" in (entry.node.relations[name] ?? {})));
@@ -1722,9 +1517,9 @@ function forceWarnings({ graph }, warnings) {
 	}
 }
 /**
-* The row columns that belong to a table. With `rls.tables` set, a resource
-* it does not name is a table only when generated policies are written for
-* it; with `--helpers-only` it has none, so it gets no index.
+* The row columns that belong to a table. With `rls.tables` set, a resource it
+* does not name is a table only when generated policies are written for it;
+* with `--helpers-only` it has none, so it gets no index.
 */
 function tableColumns(rowColumns, tables, helpersOnly, warnings) {
 	if (tables === void 0) return rowColumns;
@@ -1774,7 +1569,10 @@ function emitTarget(input, built, generated, preamble) {
 		outRel
 	};
 }
-/** The generated SQL for one run, before `--db-url-stdin` prunes the index targets. */
+/**
+* The generated SQL for one run, before `--db-url-stdin` prunes the index
+* targets.
+*/
 function generateSql(input, policy, options, built, warnings) {
 	const rls = input.config.rls;
 	const { ctx } = built;
@@ -1795,18 +1593,163 @@ function generateSql(input, policy, options, built, warnings) {
 		...generated,
 		...emitted,
 		backfill: checked.backfill,
-		indexes: indexTargets(ctx, tableColumns(generated.compiled.rowColumns, rls?.tables, helpersOnly, warnings)),
+		indexes: indexTargets(ctx, tableColumns(generated.compiled.rowColumns, tableNames(rls?.tables), helpersOnly, warnings)),
 		parts: (indexes) => ({
 			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
 			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
 			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
 			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
-			seeds: `${SEEDS_MARKER} schema=${built.schema}\n${seedSql(ctx, generated.compiled.rolePermissions)}\n${seedsSplit ? audit : ""}`,
+			seeds: `${SEEDS_MARKER} schema=${built.schema}\n${seedsBody(ctx, built.schema, generated.compiled.rolePermissions)}\n${seedsSplit ? audit : ""}`,
 			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
 		})
 	};
 }
 //#endregion
+//#region src/cli/rls/index-scan.ts
+/**
+* An index PermDock generated (`permdock_<table>_<columns>_idx`), in the
+* indexes part or in a migration derived from it: it never counts as serving
+* its own target.
+*/
+const GENERATED_INDEX = /\bcreate\s+index\s+(?:if\s+not\s+exists\s+)?"?permdock_\w*_idx"?[^;]*;/giu;
+const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
+const NAME = String.raw`${IDENT}(?:\s*\.\s*${IDENT})?`;
+const CREATE_INDEX = new RegExp(String.raw`\bcreate\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${IDENT}\s+)?on\s+(?:only\s+)?(${NAME})\s*(?:using\s+\w+\s*)?\(`, "giu");
+const ADD_KEY = new RegExp(String.raw`\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(${NAME})\s+add\s+(?:constraint\s+${IDENT}\s+)?(?:unique|primary\s+key)\s*(?:nulls\s+not\s+distinct\s*)?\(`, "giu");
+const CREATE_TABLE = new RegExp(String.raw`\bcreate\s+(?:unlogged\s+|temp(?:orary)?\s+)?table\s+(?:if\s+not\s+exists\s+)?(${NAME})\s*\(`, "giu");
+const TABLE_NAME = new RegExp(String.raw`\bcreate\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(${NAME})`, "giu");
+const TABLE_KEY = new RegExp(String.raw`^(?:constraint\s+${IDENT}\s+)?(?:unique|primary\s+key)\s*(?:nulls\s+not\s+distinct\s*)?\(`, "iu");
+const COLUMN_KEY = new RegExp(String.raw`^(${IDENT})\s+[^,]*?\b(?:primary\s+key|unique)\b`, "iu");
+const NOT_A_COLUMN = /^(?:constraint|check|foreign|exclude|like)\b/iu;
+function bare(part) {
+	const trimmed = part.trim();
+	return trimmed.startsWith("\"") ? trimmed.slice(1, -1).replaceAll("\"\"", "\"") : trimmed.toLowerCase();
+}
+/** `schema.table`, with `public` for an unqualified name. */
+function qualified(raw) {
+	const parts = raw.split(".").map(bare);
+	return parts.length === 1 ? `public.${parts.join("")}` : parts.join(".");
+}
+function stripComments(sql) {
+	return sql.replaceAll(/\/\*[\s\S]*?\*\//gu, " ").replaceAll(/--[^\n]*/gu, " ");
+}
+/**
+* The text between the `(` that ends `match` and its closing `)`, and the index
+* after it.
+*/
+function group(text, open) {
+	let depth = 1;
+	for (let index = open; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "'" || char === "\"") {
+			const close = text.indexOf(char, index + 1);
+			if (close === -1) return;
+			index = close;
+		} else if (char === "(") depth += 1;
+		else if (char === ")") {
+			depth -= 1;
+			if (depth === 0) return {
+				body: text.slice(open, index),
+				end: index + 1
+			};
+		}
+	}
+}
+function splitTop(body) {
+	const items = [];
+	let depth = 0;
+	let from = 0;
+	for (let index = 0; index < body.length; index += 1) {
+		const char = body[index];
+		if (char === "'" || char === "\"") index = Math.max(body.indexOf(char, index + 1), index);
+		else if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (char === "," && depth === 0) {
+			items.push(body.slice(from, index));
+			from = index + 1;
+		}
+	}
+	items.push(body.slice(from));
+	return items.map((item) => item.trim());
+}
+/** The first capture group of a match; every pattern here captures it. */
+function captured(match) {
+	return match.slice(1, 2).join("");
+}
+/** The index just past a match. */
+function endOf(match) {
+	return match.index + match[0].length;
+}
+/** The plain key columns of an index column list, cut at the first expression. */
+function keyColumns(body) {
+	const columns = [];
+	for (const item of splitTop(body)) {
+		const match = new RegExp(`^(${IDENT})(?:\\s|$)`, "u").exec(item);
+		if (match === null || item.startsWith("(")) break;
+		columns.push(bare(captured(match)));
+	}
+	return columns;
+}
+/**
+* Key columns of each index, unique constraint and primary key the SQL creates,
+* per `schema.table`.
+*/
+function indexKeysFromSql(sql) {
+	const text = stripComments(sql);
+	const keys = {};
+	const add = (table, columns) => {
+		if (columns.length > 0) (keys[qualified(table)] ??= []).push(columns);
+	};
+	for (const pattern of [CREATE_INDEX, ADD_KEY]) for (const match of text.matchAll(pattern)) {
+		const found = group(text, endOf(match));
+		if (found !== void 0) add(captured(match), keyColumns(found.body));
+	}
+	for (const match of text.matchAll(CREATE_TABLE)) {
+		const found = group(text, endOf(match));
+		if (found === void 0) continue;
+		for (const item of splitTop(found.body)) if (TABLE_KEY.test(item)) {
+			const inner = group(item, item.indexOf("(") + 1);
+			if (inner !== void 0) add(captured(match), keyColumns(inner.body));
+		} else if (!NOT_A_COLUMN.test(item)) {
+			const column = COLUMN_KEY.exec(item)?.[1];
+			if (column !== void 0) add(captured(match), [bare(column)]);
+		}
+	}
+	return keys;
+}
+/**
+* The index keys of the SQL files under the migration and schema folders of
+* `cwd`.
+*/
+function indexKeysFromProject(cwd) {
+	const all = {};
+	for (const file of sqlFiles(cwd, [...MIGRATION_DIRS])) {
+		const keys = indexKeysFromSql(readFileSync(file, "utf8").replaceAll(GENERATED_INDEX, ""));
+		for (const [table, list] of Object.entries(keys)) (all[table] ??= []).push(...list);
+	}
+	return all;
+}
+/** Every `schema.table` the SQL creates, temporary tables left out. */
+function tablesFromSql(sql) {
+	return new Set([...stripComments(sql).matchAll(TABLE_NAME)].map((match) => qualified(captured(match))));
+}
+/**
+* Every `schema.table` the SQL files under the migration and schema folders of
+* `cwd` create.
+*/
+function tablesFromProject(cwd) {
+	const all = /* @__PURE__ */ new Set();
+	for (const file of sqlFiles(cwd, [...MIGRATION_DIRS])) for (const table of tablesFromSql(readFileSync(file, "utf8"))) all.add(table);
+	return all;
+}
+/**
+* The targets no index in `keys` leads with: its key columns start with the
+* target's, as `pruneIndexTargets` reads a database.
+*/
+function withoutServedTargets(targets, keys) {
+	return targets.filter((target) => !(keys[target.table] ?? []).some((key) => target.columns.every((column, at) => key[at] === column)));
+}
+//#endregion
 //#region src/cli/rls/generate.ts
 function loadPolicy(cwd, config, from) {
 	const policyPath = from === "drizzle" ? config.policy : from ?? config.policy;
@@ -1814,8 +1757,8 @@ function loadPolicy(cwd, config, from) {
 }
 const PROJECT_COMMAND = "permdock rls generate";
 /**
-* The policy `policyFromCatalog` rebuilds from the project's pushed catalog
-* and policy; a project with no pushed policy fails with `policy-not-published`.
+* The policy `policyFromCatalog` rebuilds from the project's pushed catalog and
+* policy; a project with no pushed policy fails with `policy-not-published`.
 */
 async function projectPolicyOf(input, project) {
 	const fetched = await fetchProjectPolicy({
@@ -1884,8 +1827,19 @@ async function runRlsGenerate(input) {
 	const { ctx } = built;
 	const { text, migration, migrationRel, helpersOnly } = generated;
 	let indexes = generated.indexes;
+	const bindings = tableBindings(generated.compiled.rowColumns.map((item) => item.resource), tableNames(input.config.rls?.tables), helpersOnly);
+	if (input.config.rls?.tables === void 0) warnings.push(...bindingNotes(bindings, input.db !== void 0));
+	warnings.push(...triggerNotes(text));
+	if (ctx.seeds === "function") warnings.push(`run select ${built.schema}.seed(); after each deploy`);
+	if (input.db === void 0) {
+		indexes = withoutServedTargets(indexes, indexKeysFromProject(input.cwd));
+		warnings.push(...unknownTableNotes(bindings, tablesFromProject(input.cwd)));
+	}
 	if (input.db !== void 0) try {
-		const pruned = pruneIndexTargets(indexes, await readTableIndexFacts(input.db, [...new Set(indexes.map((target) => target.table))], input.connect));
+		const facts = await readTableIndexFacts(input.db, [.../* @__PURE__ */ new Set([...indexes.map((target) => target.table), ...bindings.map((binding) => binding.table)])], input.connect);
+		const missing = missingBindings(bindings, facts.columns);
+		if (missing.length > 0) return refused(`rls generate: ${missing.map((binding) => `resource ${binding.resource} is bound to ${binding.table}, which the database does not have`).join("; ")}; name the table in rls.tables, or set rls.tables.<resource>: false for a resource with no table`);
+		const pruned = pruneIndexTargets(indexes, facts);
 		indexes = pruned.targets;
 		warnings.push(...pruned.warnings);
 	} catch (cause) {
@@ -1907,10 +1861,19 @@ async function runRlsGenerate(input) {
 		keys: {
 			permissions: listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.key),
 			rowConditions: [...policyRowConditionKeys(policy)],
+			levels: levelKeys(policy),
 			renamed: Object.fromEntries(renamedKeys(policy.vocabulary.permissions))
 		},
 		schema: built.schema,
 		helpersOnly,
+		explain: explainRls({
+			config: input.config,
+			ctx,
+			schema: built.schema,
+			authorize: built.authorize,
+			generated,
+			text
+		}),
 		...extras
 	};
 	const planned = outputFiles({
@@ -1974,7 +1937,10 @@ async function runRlsGenerate(input) {
 //#endregion
 //#region src/cli/rls/introspect.ts
 const ROLES = ["anon", "authenticated"];
-/** Neon's `anonymous` is the role `rls generate` writes as `anon` for the other dialects. */
+/**
+* Neon's `anonymous` is the role `rls generate` writes as `anon` for the other
+* dialects.
+*/
 function liveRole(role) {
 	return role === "anonymous" ? "anon" : role;
 }
@@ -1990,14 +1956,107 @@ function normalizeTableName(table) {
 	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
 }
 const FUNCTION_HEADER = /create or replace function ("?)([A-Za-z_][\w$]*)\1\.("?)([A-Za-z_][\w$]*)\3\s*\(([\s\S]*?)\nas \$/gu;
+const TYPE_ALIASES = {
+	int: "integer",
+	int4: "integer",
+	int2: "smallint",
+	int8: "bigint",
+	bool: "boolean",
+	varchar: "character varying",
+	char: "character",
+	float4: "real",
+	float8: "double precision",
+	timestamp: "timestamp without time zone",
+	timestamptz: "timestamp with time zone",
+	time: "time without time zone",
+	timetz: "time with time zone"
+};
+/**
+* A parameter type as `oidvectortypes` prints it: lower case, no quotes, no
+* schema, no type modifier, aliases spelled out. A `%type` reference is `*`,
+* which matches any type.
+*/
+function normalizeParameterType(type) {
+	const text = type.trim().toLowerCase().replaceAll("\"", "");
+	if (text.endsWith("%type")) return "*";
+	const array = /(?:\[\d*\])+$/u.exec(text)?.[0] ?? "";
+	const base = text.slice(0, text.length - array.length).replaceAll(/\([^)]*\)/gu, "").replaceAll(/\s+/gu, " ").trim();
+	const unqualified = /^[\w$]+(?:\.[\w$]+)+$/u.test(base) ? base.split(".").at(-1) ?? base : base;
+	return `${TYPE_ALIASES[unqualified] ?? unqualified}${"[]".repeat(array.split("[").length - 1)}`;
+}
+function splitTopLevel(text) {
+	const parts = [];
+	let depth = 0;
+	let quoted = false;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "'") quoted = !quoted;
+		else if (!quoted && char === "(") depth += 1;
+		else if (!quoted && char === ")") depth -= 1;
+		else if (!quoted && depth === 0 && char === ",") {
+			parts.push(text.slice(start, index));
+			start = index + 1;
+		}
+	}
+	parts.push(text.slice(start));
+	return parts.map((part) => part.trim()).filter((part) => part !== "");
+}
+/**
+* The input parameter types of a function header that starts after its opening
+* parenthesis. Every generated parameter is named, so the first word of a
+* parameter with more than one is its name.
+*/
+function parameterTypes(header) {
+	let depth = 0;
+	let end = header.length;
+	for (let index = 0; index < header.length; index += 1) {
+		const char = header[index];
+		if (char === "(") depth += 1;
+		else if (char === ")") {
+			if (depth === 0) {
+				end = index;
+				break;
+			}
+			depth -= 1;
+		}
+	}
+	return splitTopLevel(header.slice(0, end)).flatMap((parameter) => {
+		const words = parameter.replace(/\s+(?:default\b|=)[\s\S]*$/iu, "").split(/\s+/u);
+		const mode = words[0]?.toLowerCase();
+		if (mode === "out") return [];
+		const rest = mode === "in" || mode === "inout" || mode === "variadic" ? words.slice(1) : words;
+		return [normalizeParameterType((rest.length > 1 ? rest.slice(1) : rest).join(" "))];
+	});
+}
+/** `schema.name(type, type)`, the key a helper is checked by. */
+function signatureOf(name, types) {
+	return `${name}(${types.join(", ")})`;
+}
 function helpersOf(sql) {
 	const found = /* @__PURE__ */ new Set();
 	for (const match of sql.matchAll(FUNCTION_HEADER)) {
-		const [header = "", , schema = "", , name = ""] = match;
-		if (/\bsecurity definer\b/u.test(header)) found.add(`${schema}.${name}`);
+		const [header = "", , schema = "", , name = "", rest = ""] = match;
+		if (/\bsecurity definer\b/u.test(header)) found.add(signatureOf(`${schema}.${name}`, parameterTypes(rest)));
 	}
 	return [...found];
 }
+function nameOfSignature(signature) {
+	return signature.slice(0, signature.indexOf("("));
+}
+function typesOfSignature(signature) {
+	return splitTopLevel(signature.slice(signature.indexOf("(") + 1, signature.lastIndexOf(")"))).map(normalizeParameterType);
+}
+/** The actual overload `expected` names; `*` matches any parameter type. */
+function matchHelper(expected, actual) {
+	if (Object.hasOwn(actual, expected)) return actual[expected];
+	const name = nameOfSignature(expected);
+	const want = typesOfSignature(expected);
+	for (const [signature, helper] of Object.entries(actual)) {
+		const have = typesOfSignature(signature);
+		if (nameOfSignature(signature) === name && have.length === want.length && want.every((type, index) => type === "*" || type === have[index])) return helper;
+	}
+}
 function expectedRls(policies, sql, indexes = []) {
 	const tables = [...new Set(policies.map((item) => normalizeTableName(item.table)))];
 	const grants = {};
@@ -2027,14 +2086,14 @@ function expectedRls(policies, sql, indexes = []) {
 	};
 }
 /**
-* One warning per index target no index starts with. A missing index slows
-* the policy down but grants nothing, so these do not fail `verify`.
+* One warning per index target no index starts with. A missing index slows the
+* policy down but grants nothing, so these do not fail `verify`.
 */
 function missingIndexes(expected, actual) {
 	return expected.indexes.flatMap((target) => {
 		const column = target.columns[0];
 		const columns = actual.columns?.[target.table];
-		return column === void 0 || columns !== void 0 && !columns.includes(column) || actual.leadingColumns[target.table]?.includes(column) === true ? [] : [`warning: ${target.table}: no index starts with ${column}, which the policies or helpers filter on; add it, or write it with rls generate --split ...,indexes`];
+		return column === void 0 || columns !== void 0 && !columns.includes(column) || actual.leadingColumns[target.table]?.includes(column) === true ? [] : [rlsFinding("index-missing", target.table, column, `${target.table}: no index starts with ${column}, which the policies or helpers filter on; add it, or write it with rls generate --split ...,indexes`, "warning")];
 	});
 }
 function sameList(left, right) {
@@ -2042,42 +2101,45 @@ function sameList(left, right) {
 	const b = right.toSorted();
 	return a.length === b.length && a.every((item, index) => item === b[index]);
 }
-/** One line per difference; policy expressions are not compared, since Postgres rewrites their text. */
+/**
+* One finding per difference; policy expressions are not compared, since
+* Postgres rewrites their text.
+*/
 function diffRls(expected, actual, options = {}) {
 	const out = [];
 	const found = new Map(actual.policies.map((item) => [`${item.table}\u0000${item.name}`, item]));
 	for (const want of expected.policies) {
 		const have = found.get(`${want.table}\u0000${want.name}`);
 		if (have === void 0) {
-			out.push(`${want.table}: policy ${want.name} is missing`);
+			out.push(rlsFinding("policy-missing", want.table, want.name, `${want.table}: policy ${want.name} is missing`));
 			continue;
 		}
-		if (have.command !== want.command) out.push(`${want.table}: policy ${want.name} is for ${have.command}, expected ${want.command}`);
-		if (have.permissive !== want.permissive) out.push(`${want.table}: policy ${want.name} is ${have.permissive ? "permissive" : "restrictive"}, expected ${want.permissive ? "permissive" : "restrictive"}`);
-		if (!sameList(have.roles, want.roles)) out.push(`${want.table}: policy ${want.name} applies to ${have.roles.join(", ")}, expected ${want.roles.join(", ")}`);
+		if (have.command !== want.command) out.push(rlsFinding("policy-command", want.table, want.name, `${want.table}: policy ${want.name} is for ${have.command}, expected ${want.command}`));
+		if (have.permissive !== want.permissive) out.push(rlsFinding("policy-mode", want.table, want.name, `${want.table}: policy ${want.name} is ${have.permissive ? "permissive" : "restrictive"}, expected ${want.permissive ? "permissive" : "restrictive"}`));
+		if (!sameList(have.roles, want.roles)) out.push(rlsFinding("policy-roles", want.table, want.name, `${want.table}: policy ${want.name} applies to ${have.roles.join(", ")}, expected ${want.roles.join(", ")}`));
 	}
 	const wanted = new Set(expected.policies.map((item) => `${item.table}\u0000${item.name}`));
-	for (const have of actual.policies) if (expected.tables.includes(have.table) && !wanted.has(`${have.table}\u0000${have.name}`)) out.push(`${have.table}: policy ${have.name} is not generated (${have.permissive ? "permissive" : "restrictive"} ${have.command}); a permissive one widens access`);
+	for (const have of actual.policies) if (expected.tables.includes(have.table) && !wanted.has(`${have.table}\u0000${have.name}`)) out.push(rlsFinding("policy-extra", have.table, have.name, `${have.table}: policy ${have.name} is not generated (${have.permissive ? "permissive" : "restrictive"} ${have.command}); a permissive one widens access`));
 	for (const table of expected.tables) {
 		if (actual.rlsEnabled[table] !== true) {
-			out.push(actual.rlsEnabled[table] === void 0 ? `${table}: table is missing` : `${table}: row level security is disabled`);
+			out.push(actual.rlsEnabled[table] === void 0 ? rlsFinding("table-missing", table, "table", `${table}: table is missing`) : rlsFinding("rls-disabled", table, "table", `${table}: row level security is disabled`));
 			continue;
 		}
 		for (const role of ROLES) {
 			const want = expected.grants[table]?.[role] ?? [];
 			const have = actual.grants[table]?.[role] ?? [];
-			for (const privilege of want) if (!have.includes(privilege) && !(privilege === "select" && options.columnGrants === true)) out.push(`${table}: ${role} lacks ${privilege}, so the policy answers 42501 instead of filtering`);
-			for (const privilege of have) if (!want.includes(privilege)) out.push(`${table}: ${role} holds ${privilege}, which no generated policy allows`);
+			for (const privilege of want) if (!have.includes(privilege) && !(privilege === "select" && options.columnGrants === true)) out.push(rlsFinding("grant-missing", table, `${role}.${privilege}`, `${table}: ${role} lacks ${privilege}, so the policy answers 42501 instead of filtering`));
+			for (const privilege of have) if (!want.includes(privilege)) out.push(rlsFinding("grant-extra", table, `${role}.${privilege}`, `${table}: ${role} holds ${privilege}, which no generated policy allows`));
 		}
 	}
 	for (const helper of expected.helpers) {
-		const have = actual.helpers[helper];
+		const have = matchHelper(helper, actual.helpers);
 		if (have === void 0) {
-			out.push(`${helper}: helper is missing`);
+			out.push(rlsFinding("helper-missing", helper, "helper", `${helper}: helper is missing`));
 			continue;
 		}
-		if (!have.securityDefiner) out.push(`${helper}: helper is not security definer`);
-		if (!have.emptySearchPath) out.push(`${helper}: helper does not set search_path = ''`);
+		if (!have.securityDefiner) out.push(rlsFinding("helper-definer", helper, "helper", `${helper}: helper is not security definer`));
+		if (!have.emptySearchPath) out.push(rlsFinding("helper-search-path", helper, "helper", `${helper}: helper does not set search_path = ''`));
 	}
 	return out;
 }
@@ -2093,25 +2155,22 @@ from information_schema.role_table_grants
 where grantee in ('anon', 'anonymous', 'authenticated')
   and lower(privilege_type) in ('select', 'insert', 'update', 'delete')
   and table_schema || '.' || table_name = any($1::text[])`;
-const HELPERS_SQL = `select n.nspname || '.' || p.proname as target, p.prosecdef as definer,
+const HELPERS_SQL = `select n.nspname || '.' || p.proname || '(' || oidvectortypes(p.proargtypes) || ')' as target, p.prosecdef as definer,
   coalesce(array_to_string(p.proconfig, ','), '') as config
 from pg_proc p
 join pg_namespace n on n.oid = p.pronamespace
 where n.nspname || '.' || p.proname = any($1::text[])`;
-const INDEXES_SQL = `select n.nspname || '.' || c.relname as target, a.attname as leading
-from pg_index i
-join pg_class c on c.oid = i.indrelid
-join pg_namespace n on n.oid = c.relnamespace
-join pg_attribute a on a.attrelid = i.indrelid and a.attnum = i.indkey[0]
-where i.indpred is null and n.nspname || '.' || c.relname = any($1::text[])`;
 function commandOf(cmd) {
-	const text = String(cmd ?? "").toLowerCase();
+	const text = typeof cmd === "string" ? cmd.toLowerCase() : "";
 	return text === "*" ? "all" : text;
 }
 function connectIntrospect(db) {
 	return connectPgPool(db, "permdock rls verify --introspect");
 }
-/** Reads the catalogs for the tables and helpers `expected` names (postgres-meta's queries, trimmed). */
+/**
+* Reads the catalogs for the tables and helpers `expected` names
+* (postgres-meta's queries, trimmed).
+*/
 async function introspectRls(db, expected, connect = connectIntrospect) {
 	const client = await connect(db);
 	try {
@@ -2121,14 +2180,17 @@ async function introspectRls(db, expected, connect = connectIntrospect) {
 			client.query(POLICIES_SQL, [tables]),
 			client.query(TABLES_SQL, [tables]),
 			client.query(GRANTS_SQL, [tables]),
-			client.query(HELPERS_SQL, [[...expected.helpers]]),
-			client.query(INDEXES_SQL, [indexed]),
+			client.query(HELPERS_SQL, [[...new Set(expected.helpers.map(nameOfSignature))]]),
+			client.query(INDEX_COLUMNS_SQL, [indexed]),
 			client.query(COLUMNS_SQL, [indexed])
 		]);
 		const columnsOf = {};
 		for (const row of columns.rows) (columnsOf[String(row["target"])] ??= []).push(String(row["name"]));
 		const leadingColumns = {};
-		for (const row of indexes.rows) (leadingColumns[String(row["target"])] ??= []).push(String(row["leading"]));
+		for (const row of indexes.rows) {
+			const lead = (Array.isArray(row["columns"]) ? row["columns"] : []).at(0);
+			if (typeof lead === "string") (leadingColumns[String(row["target"])] ??= []).push(lead);
+		}
 		const byTable = {};
 		for (const row of grants.rows) {
 			const table = String(row["target"]);
@@ -2146,7 +2208,7 @@ async function introspectRls(db, expected, connect = connectIntrospect) {
 			})),
 			rlsEnabled: Object.fromEntries(enabled.rows.map((row) => [String(row["target"]), row["enabled"] === true])),
 			grants: byTable,
-			helpers: Object.fromEntries(helpers.rows.map((row) => [String(row["target"]), {
+			helpers: Object.fromEntries(helpers.rows.map((row) => [signatureOf(nameOfSignature(String(row["target"])), typesOfSignature(String(row["target"]))), {
 				securityDefiner: row["definer"] === true,
 				emptySearchPath: String(row["config"]).split(",").some((item) => item === "search_path=\"\"" || item === "search_path=''")
 			}])),
@@ -2163,10 +2225,10 @@ const WRITES = [
 	"delete"
 ];
 /**
-* Each table and write command whose permissive policies reach
-* `authenticated` (or `public`) without the read-only actor check: no
-* restrictive policy for the command calls `permdock_actor_may_write()`, and
-* some permissive one does not.
+* Each table and write command whose permissive policies reach `authenticated`
+* (or `public`) without the read-only actor check: no restrictive policy for
+* the command calls `permdock_actor_may_write()`, and some permissive one does
+* not.
 */
 function unguardedWrites(policies, fn) {
 	const out = [];
@@ -2176,7 +2238,7 @@ function unguardedWrites(policies, fn) {
 		const permissive = applying.filter((policy) => policy.restrictive !== true && (policy.roles ?? []).some((role) => role === "authenticated" || role === "public"));
 		if (permissive.length === 0) continue;
 		const calls = (expression) => expression.includes(fn);
-		if (!(applying.some((policy) => policy.restrictive === true && calls(policy.expression)) || permissive.every((policy) => calls(policy.expression)))) out.push(`${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`);
+		if (!(applying.some((policy) => policy.restrictive === true && calls(policy.expression)) || permissive.every((policy) => calls(policy.expression)))) out.push(rlsFinding("write-unguarded", table, command, `${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`));
 	}
 	return out;
 }
@@ -2205,26 +2267,40 @@ function inScope(table) {
 function seedLine(row) {
 	return `${row.role} ${row.effect} ${row.grantKey} on ${row.scope}`;
 }
-/** Drift is an error; `info` names RLS tables whose policies call no PermDock helper. */
+function seedKey(line) {
+	return line.replace(" on ", " ").replaceAll(" ", "/");
+}
+/**
+* Drift is an error; `info` names RLS tables whose policies call no PermDock
+* helper.
+*/
 function diffMixed(expected, actual) {
 	const drift = [];
+	const seeds = `${expected.schema}.role_permissions`;
 	const want = new Set(expected.seeds.map(seedLine));
 	const have = new Set(actual.seeds.map(seedLine));
-	for (const line of want) if (!have.has(line)) drift.push(`${expected.schema}.role_permissions: missing ${line}`);
-	for (const line of have) if (!want.has(line)) drift.push(`${expected.schema}.role_permissions: unexpected ${line}`);
+	for (const line of want) if (!have.has(line)) drift.push(rlsFinding("seed-missing", seeds, seedKey(line), `${seeds}: missing ${line}`));
+	for (const line of have) if (!want.has(line)) drift.push(rlsFinding("seed-extra", seeds, seedKey(line), `${seeds}: unexpected ${line}`));
 	const permissions = new Set(expected.permissions);
 	const conditioned = new Set(expected.rowConditions);
+	const levels = new Map((expected.levels ?? []).map((level) => [level.key, level]));
+	const notes = [];
 	const covered = /* @__PURE__ */ new Set();
 	for (const policy of actual.policies) {
 		if (callsHelper(policy.expression)) covered.add(policy.table);
 		const blind = new Set(helperCallKeys(policy.expression, true));
-		for (const key of helperCallKeys(policy.expression)) if (!permissions.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, which the policy does not declare, so it always denies`);
-		else if (conditioned.has(key) && blind.has(key)) drift.push(`${policy.table}: policy ${policy.name} passes ${key}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`);
+		for (const key of helperCallKeys(policy.expression)) {
+			const level = levels.get(key);
+			if (level !== void 0) {
+				if (level.conditioned) notes.push(rlsFinding("level-unconditioned", policy.table, `${policy.name}/${key}`, `${policy.table}: policy ${policy.name} passes ${key}, which skips the level's row condition, so holders of it are denied there; use ${level.rowHelper}(${policy.table.slice(policy.table.lastIndexOf(".") + 1)}, '${level.permission}')`, "info"));
+			} else if (!permissions.has(key)) drift.push(rlsFinding("undeclared-key", policy.table, `${policy.name}/${key}`, `${policy.table}: policy ${policy.name} passes ${key}, which the policy does not declare, so it always denies`));
+			else if (conditioned.has(key) && blind.has(key)) drift.push(rlsFinding("condition-blind", policy.table, `${policy.name}/${key}`, `${policy.table}: policy ${policy.name} passes ${key}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`));
+		}
 	}
 	if (expected.readOnlyActors === true) drift.push(...unguardedWrites(actual.policies, ACTOR_MAY_WRITE));
 	return {
 		drift,
-		info: actual.rlsTables.filter((table) => !covered.has(table)).map((table) => `${table}: no policy calls a PermDock helper`)
+		info: [...notes, ...actual.rlsTables.filter((table) => !covered.has(table)).map((table) => rlsFinding("helper-uncalled", table, "table", `${table}: no policy calls a PermDock helper`, "info"))]
 	};
 }
 const ALL_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname,
@@ -2237,7 +2313,10 @@ from pg_class c
 join pg_namespace n on n.oid = c.relnamespace
 where c.relkind in ('r', 'p') and c.relrowsecurity`;
 const quoteIdent = escapeSqlIdent;
-/** Reads `role_permissions`, `pg_policies` and the RLS-enabled tables for {@link diffMixed}. */
+/**
+* Reads `role_permissions`, `pg_policies` and the RLS-enabled tables for
+* {@link diffMixed}.
+*/
 async function introspectMixed(db, schema, connect = connectIntrospect) {
 	const client = await connect(db);
 	try {
@@ -2260,7 +2339,7 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 				expression: String(row["expression"]),
 				command: String(row["command"]),
 				restrictive: row["restrictive"] === true,
-				roles: String(row["roles"] ?? "").split(",").filter((role) => role !== "")
+				roles: (typeof row["roles"] === "string" ? row["roles"] : "").split(",").filter((role) => role !== "")
 			})).filter((row) => inScope(row.table)),
 			rlsTables: tables.rows.map((row) => String(row["target"])).filter(inScope).toSorted()
 		};
@@ -2270,12 +2349,15 @@ async function introspectMixed(db, schema, connect = connectIntrospect) {
 }
 //#endregion
 //#region src/cli/rls/rls.ts
-const RLS_HELP = `permdock rls generate | import | verify | migrate
+/** `rls migrate` and `rls import` read the pgsql-parser 18 AST. */
+const PGSQL_PARSER_MAJOR = 18;
+const RLS_HELP = `permdock rls generate | import | verify | migrate | explain
 
   generate  Compile the policy into RLS policies and helpers
   import    Turn existing policies (--sql or --db-url-stdin) into a permissions module
   verify    Run the fixtures, or compare a live database with --introspect
   migrate   Rewrite the rls.migrate helpers' calls onto the generated helpers
+  explain   Show the tables, membership sources, custom roles and triggers the SQL binds to
 
 Run permdock rls <command> --help for its flags.
 Never emits service_role, except in the execute grant rls.trustedReaders asks for. memberOf compiles through the dialect memberships mapping.
@@ -2318,11 +2400,48 @@ function generateInput(input, target, dialect) {
 		...isSupabaseSchemas(input.schemas) ? { schemas: input.schemas } : {},
 		...input.grantsOut === void 0 ? {} : { grantsOut: input.grantsOut },
 		...input.seedsOut === void 0 ? {} : { seedsOut: input.seedsOut },
+		...input.noSeeds === true ? { noSeeds: true } : {},
 		...input.backfillOut === void 0 ? {} : { backfillOut: input.backfillOut },
 		helpersOnly: input.helpersOnly,
 		shims: input.shims === true
 	};
 }
+async function explain(input) {
+	const dialect = asDialect(input.dialect ?? input.config.rls?.dialect);
+	if (dialect === void 0) return {
+		code: 2,
+		output: "rls explain --dialect (or rls.dialect) must be supabase, neon or guc"
+	};
+	const generated = await runRlsGenerate({
+		...generateInput(input, "sql", dialect),
+		check: false,
+		write: false
+	});
+	if (generated.explain === void 0) return {
+		code: generated.code,
+		output: generated.output
+	};
+	let report = generated.explain;
+	if (input.db !== void 0) try {
+		const facts = await readTableIndexFacts(input.db, report.bindings.map((binding) => binding.table), input.connect);
+		report = {
+			...report,
+			bindings: report.bindings.map((binding) => ({
+				...binding,
+				exists: facts.columns[binding.table] !== void 0
+			}))
+		};
+	} catch (cause) {
+		return {
+			code: exitCodeOfError(cause),
+			output: describeError(cause)
+		};
+	}
+	return {
+		code: 0,
+		output: input.json ? JSON.stringify(report, null, 2) : describeExplain(report)
+	};
+}
 async function migrate(input) {
 	const config = input.config.rls?.migrate;
 	if (config === void 0) return {
@@ -2347,8 +2466,8 @@ async function migrate(input) {
 		code: 2,
 		output: generated.output
 	};
-	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-CIq4-E9F.js");
+	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd, PGSQL_PARSER_MAJOR);
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-B7oP_sQU.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2364,8 +2483,11 @@ async function migrate(input) {
 		...input.io.now === void 0 ? {} : { now: input.io.now() }
 	});
 }
-/** `verify --introspect` with `--helpers-only`: helpers and seeds exactly, hand-written policies by their keys. */
-async function introspectHelpersOnly(db, expected, generated, connect, readOnlyActors) {
+/**
+* `verify --introspect` with `--helpers-only`: helpers and seeds exactly,
+* hand-written policies by their keys.
+*/
+async function introspectHelpersOnly(db, expected, generated, connect, readOnlyActors, ignore) {
 	const schema = generated.schema ?? "permdock";
 	try {
 		const actual = await introspectRls(db, expected, connect);
@@ -2376,31 +2498,28 @@ async function introspectHelpersOnly(db, expected, generated, connect, readOnlyA
 			seeds: generated.seeds ?? [],
 			permissions: generated.keys?.permissions ?? [],
 			rowConditions: generated.keys?.rowConditions ?? [],
+			levels: generated.keys?.levels ?? [],
 			readOnlyActors
 		}, await introspectMixed(db, schema, connect));
-		const drift = [...helpers, ...mixed.drift];
-		const info = mixed.info.map((line) => `info: ${line}`);
-		return drift.length > 0 ? {
-			code: 1,
-			output: [
-				...drift,
-				...warnings,
-				...info
-			].join("\n")
-		} : {
-			code: 0,
-			output: [
+		return verifyResult({
+			findings: [
+				...helpers,
+				...mixed.drift,
 				...warnings,
-				...info,
-				`introspected ${String(expected.helpers.length)} helper(s) and ${String(generated.seeds?.length ?? 0)} seeded row(s), helpers only: no drift`
-			].join("\n")
-		};
+				...mixed.info
+			],
+			ignore,
+			summary: `introspected ${String(expected.helpers.length)} helper(s) and ${String(generated.seeds?.length ?? 0)} seeded row(s), helpers only: no drift`
+		});
 	} catch (cause) {
 		return usageResult(cause);
 	}
 }
-/** `verify --introspect`: the catalogs against what `generate` would write with the same flags. */
-async function introspect(input) {
+/**
+* `verify --introspect`: the catalogs against what `generate` would write with
+* the same flags.
+*/
+async function introspect(input, ignore) {
 	if (input.db === void 0) return {
 		code: 2,
 		output: "PermDock CLI: rls verify --introspect needs a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
@@ -2420,19 +2539,15 @@ async function introspect(input) {
 		output: generated.output
 	};
 	const expected = expectedRls(generated.policies, generated.text, generated.indexes);
-	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect, readOnlyActorKinds(input.config.rls?.readOnlyActors) !== void 0);
+	if (generated.helpersOnly === true) return introspectHelpersOnly(input.db, expected, generated, input.connect, readOnlyActorKinds(input.config.rls?.readOnlyActors) !== void 0, ignore);
 	try {
 		const actual = await introspectRls(input.db, expected, input.connect);
-		const drift = diffRls(expected, actual, { columnGrants: (input.fields ?? input.config.rls?.fields) === "views" });
-		const warnings = missingIndexes(expected, actual);
-		if (drift.length > 0) return {
-			code: 1,
-			output: [...drift, ...warnings].join("\n")
-		};
-		return {
-			code: 0,
-			output: `${warnings.map((line) => `${line}\n`).join("")}introspected ${String(expected.policies.length)} policies on ${String(expected.tables.length)} table(s) and ${String(expected.helpers.length)} helper(s): no drift`
-		};
+		const drift = diffRls(expected, actual, { columnGrants: (input.fields ?? input.config.rls?.fields) !== void 0 });
+		return verifyResult({
+			findings: [...drift, ...missingIndexes(expected, actual)],
+			ignore,
+			summary: `introspected ${String(expected.policies.length)} policies on ${String(expected.tables.length)} table(s) and ${String(expected.helpers.length)} helper(s): no drift`
+		});
 	} catch (cause) {
 		return usageResult(cause);
 	}
@@ -2467,8 +2582,8 @@ async function runRls(input) {
 			});
 		}
 		case "import": {
-			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./import-wyqXUyjm.js");
+			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd, PGSQL_PARSER_MAJOR);
+			const { runRlsImport } = await import("./import-CST57XLp.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,
@@ -2490,7 +2605,8 @@ async function runRls(input) {
 				...input.db === void 0 ? {} : { db: input.db },
 				...input.exec === void 0 ? {} : { exec: input.exec }
 			});
-			if (input.introspect) return introspect(input);
+			const ignore = verifyIgnores(input.config, input.ignore);
+			if (input.introspect) return introspect(input, ignore);
 			const format = input.format ?? "node";
 			if (format !== "node" && format !== "pgtap") return {
 				code: 2,
@@ -2502,13 +2618,16 @@ async function runRls(input) {
 				format,
 				tree: input.tree,
 				io: input.io,
+				...input.out === void 0 ? {} : { out: input.out },
 				...input.fixtures === void 0 ? {} : { fixtures: input.fixtures },
 				...input.db === void 0 ? {} : { db: input.db },
 				...input.from === void 0 ? {} : { from: input.from },
-				...input.connect === void 0 ? {} : { connect: input.connect }
+				...input.connect === void 0 ? {} : { connect: input.connect },
+				ignore
 			});
 		}
 		case "migrate": return migrate(input);
+		case "explain": return explain(input);
 		default: return {
 			code: 2,
 			output: RLS_HELP