generate
Write the files each configured plugin emits from the policy, in one command.
permdock generate loads the policy, builds one model, and runs every plugin in plugins. A config with plugins: [] is valid and writes no plugin files. --check writes nothing and exits 1 when a file would change. The diff is on stdout, one + or ~ row per file. The receipt is on stderr.
rls generate, supabase hook generate, powersync generate, scim generate and openapi emit are not commands. permdock generate --only <plugin> writes that plugin. permdock codemod 0.26 rewrites package.json scripts.
Usage
permdock generate
permdock generate --only rls --only powersync
permdock generate --check
permdock generate --dry-run| Flag | Meaning |
|---|---|
--only <plugin> | Run this plugin. Repeat the flag to run more than one. |
--check | Exit 1 when a file on disk differs; write nothing. The diff is stdout. |
--dry-run | Report each change as planned; write nothing. |
--policy <module> | The module exporting the policy. Default: policy in the config. |
--no-cache | Emit and write even when a cache entry matches. |
--cache-dir <dir> | Cache directory. Default node_modules/.cache/permdock, or PERMDOCK_CACHE_DIR. |
--concurrency <n> | How many tasks run at once. 1 runs them one at a time. |
--watch | Generate again when a policy, config or plugin input changes. Ctrl-C exits 130. |
--db-url-stdin | Read the Postgres URL from stdin. RLS index suggestions and hook helper checks use it. |
--json puts files and summary in the result. Each file has path, plugin and outcome. outcome is created, updated, unchanged or, with --dry-run, planned. A cache hit leaves those files unchanged and counts them in summary.skipped. The stderr row is Skipped (cache) N. With --watch, each cycle is one JSON line on stdout and the process keeps running.
--watch loads the policy in a new worker on every cycle, because native ESM cannot drop a module it has already imported. A cycle writes nothing until the policy and the plugins have been read.
pnpm generate:perf records a cold run, a warm run, and a generate after a one-line policy edit on the CentraKit-size fixture. Peak RSS fails the gate at 10% above scripts/generate-perf.json. Wall time is printed and not enforced.
Side effects
What each command may change; side effects explains each one.
| Command | Side effects |
|---|---|
permdock generate | files |
Why
One command runs every plugin against the same model. Plugin order is the plugins array, then each plugin's after list.
Related
Last updated on
usage
Report permissions that are defined but never used, used but never granted or granted by no role, conditions on undeclared fields, and client checks outside a snapshot include.
gen
Write typed constants, row validators, JSON Schema and test factories from the policy, so app code imports names instead of retyping them.