# generate

Source: https://permdock.com/docs/cli/generate

Write the files each configured plugin emits from the policy, in one command.

`permdock generate` loads the policy, builds one model, and runs every plugin in `plugins`. A config with `plugins: []` is valid and writes no plugin files. `--check` writes nothing and exits 1 when a file would change. The diff is on stdout, one `+` or `~` row per file. The receipt is on stderr.

`rls generate`, `supabase hook generate`, `powersync generate`, `scim generate` and `openapi emit` are not commands. `permdock generate --only <plugin>` writes that plugin. `permdock codemod 0.26` rewrites `package.json` scripts.

## Usage [#usage]

```bash
permdock generate
permdock generate --only rls --only powersync
permdock generate --check
permdock generate --dry-run
```

| Flag | Meaning |
| --- | --- |
| `--only <plugin>` | Run this plugin. Repeat the flag to run more than one. |
| `--check` | Exit 1 when a file on disk differs; write nothing. The diff is stdout. |
| `--dry-run` | Report each change as `planned`; write nothing. |
| `--policy <module>` | The module exporting the policy. Default: `policy` in the config. |
| `--no-cache` | Emit and write even when a cache entry matches. |
| `--cache-dir <dir>` | Cache directory. Default `node_modules/.cache/permdock`, or `PERMDOCK_CACHE_DIR`. |
| `--concurrency <n>` | How many tasks run at once. `1` runs them one at a time. |
| `--watch` | Generate again when a policy, config or plugin input changes. Ctrl-C exits 130. |
| `--db-url-stdin` | Read the Postgres URL from stdin. RLS index suggestions and hook helper checks use it. |

`--json` puts `files` and `summary` in the result. Each file has `path`, `plugin` and `outcome`. `outcome` is `created`, `updated`, `unchanged` or, with `--dry-run`, `planned`. A cache hit leaves those files `unchanged` and counts them in `summary.skipped`. The stderr row is `Skipped (cache) N`. With `--watch`, each cycle is one JSON line on stdout and the process keeps running.

`--watch` loads the policy in a new worker on every cycle, because native ESM cannot drop a module it has already imported. A cycle writes nothing until the policy and the plugins have been read.

`pnpm generate:perf` records a cold run, a warm run, and a generate after a one-line policy edit on the CentraKit-size fixture. Peak RSS fails the gate at 10% above `scripts/generate-perf.json`. Wall time is printed and not enforced.

## Side effects [#side-effects]

What each command may change; [side effects](/docs/cli#side-effects) explains each one.

| Command | Side effects |
| --- | --- |
| `permdock generate` | `files` |

## Why [#why]

One command runs every plugin against the same model. Plugin order is the `plugins` array, then each plugin's `after` list.

## Related [#related]

- [rls](/docs/cli/rls)
- [config](/docs/cli/config)