@drzl/analyzer 1.21.5 → 1.22.0

package/dist/index.cjs

@@ -417,6 +417,18 @@ function getSymbolOf(target, key) {
 function isDrizzleView(val) {
   return !!val && typeof val === "object" && !!getSymbolOf(val, "drizzle:ViewBaseConfig");
 }
+function isPolicy(val) {
+  return /Policy$/.test(String(val?.constructor?.[/* @__PURE__ */ Symbol.for("drizzle:entityKind")] ?? ""));
+}
+function readRoleNames(to) {
+  const one = (v) => {
+    if (typeof v === "string") return v || void 0;
+    const name = v?.name;
+    return typeof name === "string" && name ? name : void 0;
+  };
+  const list = Array.isArray(to) ? to : to == null ? [] : [to];
+  return Array.from(new Set(list.map(one).filter((v) => !!v)));
+}
 function isReadOnlyRelation(val) {
   if (!val || typeof val !== "object") return false;
   return Object.getOwnPropertySymbols(val).some(
@@ -627,6 +639,30 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
       return "?";
     }).join("").trim();
   }
+  /**
+   * Normalise one `pgPolicy` into the reported shape.
+   *
+   * Everything is read off the instance directly. Measured 2026-08-12 against drizzle-orm 0.45.2, a
+   * `PgPolicy` carries `as`, `for`, `to`, `using`, `withCheck`, `_linkedTable` and `name` as own
+   * keys, and the ones the declaration omitted are present as `undefined`. So presence has to be
+   * tested by value: `'withCheck' in policy` is true for every policy ever declared and would report
+   * each of them as constraining its writes.
+   */
+  readPolicy(entry, toTs) {
+    const text = (v) => v == null ? void 0 : this.renderSql(v, toTs);
+    const str = (v) => typeof v === "string" && v ? v : void 0;
+    return {
+      name: String(entry?.name ?? ""),
+      ...str(entry?.as) ? { as: entry.as } : {},
+      ...str(entry?.for) ? { for: entry.for } : {},
+      ...(() => {
+        const to = readRoleNames(entry?.to);
+        return to.length ? { to } : {};
+      })(),
+      ...entry?.using != null ? { using: text(entry.using) } : {},
+      ...entry?.withCheck != null ? { withCheck: text(entry.withCheck) } : {}
+    };
+  }
   /** A value produced by Drizzle's `relations()` helper: a source table plus a callback. */
   isRelationsObject(val) {
     return !!val && typeof val === "object" && typeof val.config === "function" && !!this.getSymbol(val.table, "drizzle:Columns");
@@ -1033,6 +1069,7 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
     const unique = [];
     const indexes = [];
     const checks = [];
+    const policies = [];
     const foreignKeys = [];
     const pkCols = [];
     const uniqueGroups = /* @__PURE__ */ new Map();
@@ -1121,6 +1158,7 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
     }
     const name = this.getSymbol(tbl, "drizzle:Name") || tsName;
     const schema = this.getSymbol(tbl, "drizzle:Schema");
+    const rlsEnabled = this.getSymbol(tbl, "drizzle:EnableRLS");
     const toTs = this.dbToTsNames(columnsObj);
     try {
       const pkDef = this.getSymbol(tbl, "drizzle:PrimaryKey");
@@ -1153,6 +1191,10 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
         checks.push({ name: entry.name, expression: this.renderSql(entry.value, toTs) });
         continue;
       }
+      if (isPolicy(entry)) {
+        policies.push(this.readPolicy(entry, toTs));
+        continue;
+      }
       const cfg = entry?.config ?? entry ?? {};
       const cols = (cfg.columns ?? []).map((c) => toTs(c?.name)).filter(Boolean);
       if (!cols.length) continue;
@@ -1197,6 +1239,11 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
       indexes: [...pkCols.length ? [{ columns: pkCols }] : [], ...indexes],
       checks,
       foreignKeys,
+      // Only where the dialect has row-level security at all. `drizzle:EnableRLS` is absent on
+      // MySQL and SQLite tables rather than false, and reporting `rlsEnabled: false` for every
+      // SQLite table would answer a question that dialect cannot be asked. Both fields are decided
+      // by the same test so a table never carries one without the other.
+      ...typeof rlsEnabled === "boolean" ? { policies, rlsEnabled } : {},
       // A materialized view refuses every write, so the generators skip its insert and update
       // schemas rather than describe an operation the database will always reject.
       ...isReadOnlyRelation(tbl) ? { readOnly: true } : {},
@@ -1295,12 +1342,15 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
     const enums = [];
     const columnEnums = [];
     const viewTables = [];
+    const linkedPolicies = [];
+    const tableSources = /* @__PURE__ */ new Map();
     for (const [name, val] of Object.entries(exportsObj)) {
       try {
         const cols = this.getSymbol(val, "drizzle:Columns");
         if (cols && typeof cols === "object") {
           const table = this.analyzeTable(name, val, issues);
           tables.push(table);
+          tableSources.set(val, table);
           if (isDrizzleView(val)) viewTables.push(table);
           for (const col of table.columns) {
             const enumVals = cols[col.name]?.enumValues;
@@ -1324,6 +1374,8 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
           if (opts.includeRelations) {
             relations.push(...readRelationsV2(val, issues));
           }
+        } else if (isPolicy(val)) {
+          linkedPolicies.push(val);
         } else {
           const ev = val?.enumValues;
           if (Array.isArray(ev) && ev.every((x) => typeof x === "string")) {
@@ -1352,6 +1404,22 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
       if (enums.some((e) => e.name === candidate.name)) continue;
       enums.push(candidate);
     }
+    for (const raw of linkedPolicies) {
+      const target = raw?._linkedTable;
+      const table = target ? tableSources.get(target) : void 0;
+      if (!table || !table.policies) {
+        issues.push({
+          code: "DRZL_ANL_POLICY_UNLINKED",
+          level: "warn",
+          message: `Policy "${String(raw?.name ?? "")}" is linked to a table this schema does not export.`,
+          path: String(raw?.name ?? ""),
+          hint: "Export the table it links to, so DRZL can report the policy against it."
+        });
+        continue;
+      }
+      const toTs = this.dbToTsNames(this.getSymbol(target, "drizzle:Columns") ?? {});
+      table.policies.push({ ...this.readPolicy(raw, toTs), linked: true });
+    }
     let dialect = "unknown";
     const marks = /* @__PURE__ */ new Set();
     for (const [_, val] of Object.entries(exportsObj)) {

package/dist/index.d.cts

@@ -380,6 +380,45 @@ interface ForeignKey {
     onDelete?: string;
     onUpdate?: string;
 }
+/**
+ * A row-level security policy, from Drizzle's `pgPolicy`.
+ *
+ * Postgres only. There is no MySQL or SQLite equivalent, and those tables do not carry the
+ * `drizzle:EnableRLS` symbol at all rather than carrying it as `false`, which is why
+ * `Table.rlsEnabled` is absent there instead of reading as "RLS is off".
+ */
+interface Policy {
+    name: string;
+    /**
+     * `permissive`, where policies OR together, or `restrictive`, where they AND. Absent where the
+     * declaration did not say, which Postgres reads as permissive.
+     */
+    as?: string;
+    /** The command it applies to: `all`, `select`, `insert`, `update` or `delete`. */
+    for?: string;
+    /**
+     * The roles it applies to, always as a list.
+     *
+     * `to` is polymorphic in Drizzle: a bare string, a `pgRole` object, or an array mixing the two.
+     * Measured 2026-08-12 against drizzle-orm 0.45.2. Normalised to role names here, so no reader has
+     * to ask which of the three it got and none of them stringifies to `[object Object]`.
+     */
+    to?: string[];
+    /** The `USING` expression, which decides the rows a read can see. Rendered as text. */
+    using?: string;
+    /** The `WITH CHECK` expression, which decides the rows a write may produce. Rendered as text. */
+    withCheck?: string;
+    /**
+     * Set when the policy reached this table through `pgPolicy(...).link(table)` rather than through
+     * the table's own third argument.
+     *
+     * A linked policy is not reachable from the table object: measured, the table it links to gains
+     * no extra-config entry and carries no reference to it. It is found as a module export instead,
+     * which means one linked from a module the schema never exports is invisible to DRZL. That is the
+     * one gap in this list, and it is why the flag is reported rather than dropped.
+     */
+    linked?: boolean;
+}
 interface Table {
     name: string;
     tsName: string;
@@ -409,6 +448,24 @@ interface Table {
     indexes: Index[];
     checks?: Check[];
     foreignKeys?: ForeignKey[];
+    /**
+     * The row-level security policies declared on the table, in declaration order.
+     *
+     * Absent where the dialect has none to declare. Present and empty is a different fact from
+     * absent: it says this is a Postgres table that declares no policy, which is what
+     * `rlsEnabled: true` beside it turns into a defect.
+     */
+    policies?: Policy[];
+    /**
+     * Whether the table calls `.enableRLS()`, from `drizzle:EnableRLS`.
+     *
+     * Absent on every dialect but Postgres, which does not carry the symbol at all. Present and
+     * `false` therefore means "a Postgres table that did not call it", which is **not** the same as
+     * "row-level security is off in the database": measured 2026-08-12, declaring any policy makes
+     * drizzle-kit emit `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` regardless of this flag. Nothing
+     * should report a table as unprotected on the strength of this alone.
+     */
+    rlsEnabled?: boolean;
     /**
      * Set when the relation refuses writes, which today means a materialized view. Insert and
      * update schemas are not emitted for one, because the database will always refuse the
@@ -577,6 +634,16 @@ declare class SchemaAnalyzer {
      * Anything unrecognised becomes `?`, which is honest about the gap without inventing SQL.
      */
     private renderSql;
+    /**
+     * Normalise one `pgPolicy` into the reported shape.
+     *
+     * Everything is read off the instance directly. Measured 2026-08-12 against drizzle-orm 0.45.2, a
+     * `PgPolicy` carries `as`, `for`, `to`, `using`, `withCheck`, `_linkedTable` and `name` as own
+     * keys, and the ones the declaration omitted are present as `undefined`. So presence has to be
+     * tested by value: `'withCheck' in policy` is true for every policy ever declared and would report
+     * each of them as constraining its writes.
+     */
+    private readPolicy;
     /** A value produced by Drizzle's `relations()` helper: a source table plus a callback. */
     private isRelationsObject;
     /**
@@ -730,4 +797,4 @@ declare class SchemaAnalyzer {
     analyze(opts?: AnalyzeOptions): Promise<Analysis>;
 }
 
-export { type Analysis, type AnalyzeOptions, type Check, type Column, type ColumnRef, type ColumnShape, type Dialect, type Enum, type ForeignKey, type Index, type Issue, type Key, type Relation, SchemaAnalyzer, type Table, type UnnameableReason, SchemaAnalyzer as default, describeV1Column, isDrizzleView, isReadOnlyRelation, isRelationsV2, qualifiedForeignTable, qualifiedTableName, readRelationsV2 };
+export { type Analysis, type AnalyzeOptions, type Check, type Column, type ColumnRef, type ColumnShape, type Dialect, type Enum, type ForeignKey, type Index, type Issue, type Key, type Policy, type Relation, SchemaAnalyzer, type Table, type UnnameableReason, SchemaAnalyzer as default, describeV1Column, isDrizzleView, isReadOnlyRelation, isRelationsV2, qualifiedForeignTable, qualifiedTableName, readRelationsV2 };

package/dist/index.d.ts

@@ -380,6 +380,45 @@ interface ForeignKey {
     onDelete?: string;
     onUpdate?: string;
 }
+/**
+ * A row-level security policy, from Drizzle's `pgPolicy`.
+ *
+ * Postgres only. There is no MySQL or SQLite equivalent, and those tables do not carry the
+ * `drizzle:EnableRLS` symbol at all rather than carrying it as `false`, which is why
+ * `Table.rlsEnabled` is absent there instead of reading as "RLS is off".
+ */
+interface Policy {
+    name: string;
+    /**
+     * `permissive`, where policies OR together, or `restrictive`, where they AND. Absent where the
+     * declaration did not say, which Postgres reads as permissive.
+     */
+    as?: string;
+    /** The command it applies to: `all`, `select`, `insert`, `update` or `delete`. */
+    for?: string;
+    /**
+     * The roles it applies to, always as a list.
+     *
+     * `to` is polymorphic in Drizzle: a bare string, a `pgRole` object, or an array mixing the two.
+     * Measured 2026-08-12 against drizzle-orm 0.45.2. Normalised to role names here, so no reader has
+     * to ask which of the three it got and none of them stringifies to `[object Object]`.
+     */
+    to?: string[];
+    /** The `USING` expression, which decides the rows a read can see. Rendered as text. */
+    using?: string;
+    /** The `WITH CHECK` expression, which decides the rows a write may produce. Rendered as text. */
+    withCheck?: string;
+    /**
+     * Set when the policy reached this table through `pgPolicy(...).link(table)` rather than through
+     * the table's own third argument.
+     *
+     * A linked policy is not reachable from the table object: measured, the table it links to gains
+     * no extra-config entry and carries no reference to it. It is found as a module export instead,
+     * which means one linked from a module the schema never exports is invisible to DRZL. That is the
+     * one gap in this list, and it is why the flag is reported rather than dropped.
+     */
+    linked?: boolean;
+}
 interface Table {
     name: string;
     tsName: string;
@@ -409,6 +448,24 @@ interface Table {
     indexes: Index[];
     checks?: Check[];
     foreignKeys?: ForeignKey[];
+    /**
+     * The row-level security policies declared on the table, in declaration order.
+     *
+     * Absent where the dialect has none to declare. Present and empty is a different fact from
+     * absent: it says this is a Postgres table that declares no policy, which is what
+     * `rlsEnabled: true` beside it turns into a defect.
+     */
+    policies?: Policy[];
+    /**
+     * Whether the table calls `.enableRLS()`, from `drizzle:EnableRLS`.
+     *
+     * Absent on every dialect but Postgres, which does not carry the symbol at all. Present and
+     * `false` therefore means "a Postgres table that did not call it", which is **not** the same as
+     * "row-level security is off in the database": measured 2026-08-12, declaring any policy makes
+     * drizzle-kit emit `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` regardless of this flag. Nothing
+     * should report a table as unprotected on the strength of this alone.
+     */
+    rlsEnabled?: boolean;
     /**
      * Set when the relation refuses writes, which today means a materialized view. Insert and
      * update schemas are not emitted for one, because the database will always refuse the
@@ -577,6 +634,16 @@ declare class SchemaAnalyzer {
      * Anything unrecognised becomes `?`, which is honest about the gap without inventing SQL.
      */
     private renderSql;
+    /**
+     * Normalise one `pgPolicy` into the reported shape.
+     *
+     * Everything is read off the instance directly. Measured 2026-08-12 against drizzle-orm 0.45.2, a
+     * `PgPolicy` carries `as`, `for`, `to`, `using`, `withCheck`, `_linkedTable` and `name` as own
+     * keys, and the ones the declaration omitted are present as `undefined`. So presence has to be
+     * tested by value: `'withCheck' in policy` is true for every policy ever declared and would report
+     * each of them as constraining its writes.
+     */
+    private readPolicy;
     /** A value produced by Drizzle's `relations()` helper: a source table plus a callback. */
     private isRelationsObject;
     /**
@@ -730,4 +797,4 @@ declare class SchemaAnalyzer {
     analyze(opts?: AnalyzeOptions): Promise<Analysis>;
 }
 
-export { type Analysis, type AnalyzeOptions, type Check, type Column, type ColumnRef, type ColumnShape, type Dialect, type Enum, type ForeignKey, type Index, type Issue, type Key, type Relation, SchemaAnalyzer, type Table, type UnnameableReason, SchemaAnalyzer as default, describeV1Column, isDrizzleView, isReadOnlyRelation, isRelationsV2, qualifiedForeignTable, qualifiedTableName, readRelationsV2 };
+export { type Analysis, type AnalyzeOptions, type Check, type Column, type ColumnRef, type ColumnShape, type Dialect, type Enum, type ForeignKey, type Index, type Issue, type Key, type Policy, type Relation, SchemaAnalyzer, type Table, type UnnameableReason, SchemaAnalyzer as default, describeV1Column, isDrizzleView, isReadOnlyRelation, isRelationsV2, qualifiedForeignTable, qualifiedTableName, readRelationsV2 };

package/dist/index.js

@@ -374,6 +374,18 @@ function getSymbolOf(target, key) {
 function isDrizzleView(val) {
   return !!val && typeof val === "object" && !!getSymbolOf(val, "drizzle:ViewBaseConfig");
 }
+function isPolicy(val) {
+  return /Policy$/.test(String(val?.constructor?.[/* @__PURE__ */ Symbol.for("drizzle:entityKind")] ?? ""));
+}
+function readRoleNames(to) {
+  const one = (v) => {
+    if (typeof v === "string") return v || void 0;
+    const name = v?.name;
+    return typeof name === "string" && name ? name : void 0;
+  };
+  const list = Array.isArray(to) ? to : to == null ? [] : [to];
+  return Array.from(new Set(list.map(one).filter((v) => !!v)));
+}
 function isReadOnlyRelation(val) {
   if (!val || typeof val !== "object") return false;
   return Object.getOwnPropertySymbols(val).some(
@@ -584,6 +596,30 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
       return "?";
     }).join("").trim();
   }
+  /**
+   * Normalise one `pgPolicy` into the reported shape.
+   *
+   * Everything is read off the instance directly. Measured 2026-08-12 against drizzle-orm 0.45.2, a
+   * `PgPolicy` carries `as`, `for`, `to`, `using`, `withCheck`, `_linkedTable` and `name` as own
+   * keys, and the ones the declaration omitted are present as `undefined`. So presence has to be
+   * tested by value: `'withCheck' in policy` is true for every policy ever declared and would report
+   * each of them as constraining its writes.
+   */
+  readPolicy(entry, toTs) {
+    const text = (v) => v == null ? void 0 : this.renderSql(v, toTs);
+    const str = (v) => typeof v === "string" && v ? v : void 0;
+    return {
+      name: String(entry?.name ?? ""),
+      ...str(entry?.as) ? { as: entry.as } : {},
+      ...str(entry?.for) ? { for: entry.for } : {},
+      ...(() => {
+        const to = readRoleNames(entry?.to);
+        return to.length ? { to } : {};
+      })(),
+      ...entry?.using != null ? { using: text(entry.using) } : {},
+      ...entry?.withCheck != null ? { withCheck: text(entry.withCheck) } : {}
+    };
+  }
   /** A value produced by Drizzle's `relations()` helper: a source table plus a callback. */
   isRelationsObject(val) {
     return !!val && typeof val === "object" && typeof val.config === "function" && !!this.getSymbol(val.table, "drizzle:Columns");
@@ -990,6 +1026,7 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
     const unique = [];
     const indexes = [];
     const checks = [];
+    const policies = [];
     const foreignKeys = [];
     const pkCols = [];
     const uniqueGroups = /* @__PURE__ */ new Map();
@@ -1078,6 +1115,7 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
     }
     const name = this.getSymbol(tbl, "drizzle:Name") || tsName;
     const schema = this.getSymbol(tbl, "drizzle:Schema");
+    const rlsEnabled = this.getSymbol(tbl, "drizzle:EnableRLS");
     const toTs = this.dbToTsNames(columnsObj);
     try {
       const pkDef = this.getSymbol(tbl, "drizzle:PrimaryKey");
@@ -1110,6 +1148,10 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
         checks.push({ name: entry.name, expression: this.renderSql(entry.value, toTs) });
         continue;
       }
+      if (isPolicy(entry)) {
+        policies.push(this.readPolicy(entry, toTs));
+        continue;
+      }
       const cfg = entry?.config ?? entry ?? {};
       const cols = (cfg.columns ?? []).map((c) => toTs(c?.name)).filter(Boolean);
       if (!cols.length) continue;
@@ -1154,6 +1196,11 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
       indexes: [...pkCols.length ? [{ columns: pkCols }] : [], ...indexes],
       checks,
       foreignKeys,
+      // Only where the dialect has row-level security at all. `drizzle:EnableRLS` is absent on
+      // MySQL and SQLite tables rather than false, and reporting `rlsEnabled: false` for every
+      // SQLite table would answer a question that dialect cannot be asked. Both fields are decided
+      // by the same test so a table never carries one without the other.
+      ...typeof rlsEnabled === "boolean" ? { policies, rlsEnabled } : {},
       // A materialized view refuses every write, so the generators skip its insert and update
       // schemas rather than describe an operation the database will always reject.
       ...isReadOnlyRelation(tbl) ? { readOnly: true } : {},
@@ -1252,12 +1299,15 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
     const enums = [];
     const columnEnums = [];
     const viewTables = [];
+    const linkedPolicies = [];
+    const tableSources = /* @__PURE__ */ new Map();
     for (const [name, val] of Object.entries(exportsObj)) {
       try {
         const cols = this.getSymbol(val, "drizzle:Columns");
         if (cols && typeof cols === "object") {
           const table = this.analyzeTable(name, val, issues);
           tables.push(table);
+          tableSources.set(val, table);
           if (isDrizzleView(val)) viewTables.push(table);
           for (const col of table.columns) {
             const enumVals = cols[col.name]?.enumValues;
@@ -1281,6 +1331,8 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
           if (opts.includeRelations) {
             relations.push(...readRelationsV2(val, issues));
           }
+        } else if (isPolicy(val)) {
+          linkedPolicies.push(val);
         } else {
           const ev = val?.enumValues;
           if (Array.isArray(ev) && ev.every((x) => typeof x === "string")) {
@@ -1309,6 +1361,22 @@ var _SchemaAnalyzer = class _SchemaAnalyzer {
       if (enums.some((e) => e.name === candidate.name)) continue;
       enums.push(candidate);
     }
+    for (const raw of linkedPolicies) {
+      const target = raw?._linkedTable;
+      const table = target ? tableSources.get(target) : void 0;
+      if (!table || !table.policies) {
+        issues.push({
+          code: "DRZL_ANL_POLICY_UNLINKED",
+          level: "warn",
+          message: `Policy "${String(raw?.name ?? "")}" is linked to a table this schema does not export.`,
+          path: String(raw?.name ?? ""),
+          hint: "Export the table it links to, so DRZL can report the policy against it."
+        });
+        continue;
+      }
+      const toTs = this.dbToTsNames(this.getSymbol(target, "drizzle:Columns") ?? {});
+      table.policies.push({ ...this.readPolicy(raw, toTs), linked: true });
+    }
     let dialect = "unknown";
     const marks = /* @__PURE__ */ new Set();
     for (const [_, val] of Object.entries(exportsObj)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drzl/analyzer",
-  "version": "1.21.5",
+  "version": "1.22.0",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",