@drzl/cli 4.35.0 → 4.37.0

package/dist/cli.js

@@ -16,6 +16,7 @@ import {
   fastCheckOutDir,
   fastifyOutDir,
   filterTables,
+  formsOutDir,
   graphqlOutDir,
   h3OutDir,
   hasNamedSchemas,
@@ -28,13 +29,14 @@ import {
   nearestKey,
   nestjsOutDir,
   nextOutDir,
+  openApiFetchOutDir,
   seedOutDir,
   tableAliases,
   tableFilterWarnings,
   tanstackStartOutDir,
   trpcOutDir,
   tsRestOutDir
-} from "./chunk-S5JWTWWU.js";
+} from "./chunk-EQ4OSVMJ.js";
 
 // src/cli.ts
 import { qualifiedTableName as qualifiedTableName2, SchemaAnalyzer as SchemaAnalyzer2 } from "@drzl/analyzer";
@@ -414,20 +416,81 @@ function tsRestOptions(g, cfg) {
   };
 }
 
-// src/elysia-options.ts
+// src/openapi-fetch-options.ts
 var VALIDATOR_DEFAULT_DIRS3 = {
+  zod: "src/validators/zod",
+  valibot: "src/validators/valibot",
+  arktype: "src/validators/arktype"
+};
+function projectRelative3(p) {
+  return p.startsWith("./") ? p.slice(2) : p;
+}
+function openApiFetchOptions(g, cfg) {
+  const configured = g.validation?.library ?? "zod";
+  const library = configured === "typebox" ? "zod" : configured;
+  const siblings = cfg.generators.filter((s) => s.kind === library);
+  const derived = siblings.length === 1 ? projectRelative3(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS3[library]) : void 0;
+  return {
+    outputDir: openApiFetchOutDir(g, cfg),
+    clientName: g.clientName,
+    document: g.document,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension,
+    validation: {
+      ...g.validation,
+      library,
+      useShared: true,
+      importPath: g.validation?.importPath ?? derived
+    }
+  };
+}
+
+// src/forms-options.ts
+var VALIDATOR_DEFAULT_DIRS4 = {
+  zod: "src/validators/zod",
+  valibot: "src/validators/valibot",
+  arktype: "src/validators/arktype",
+  typebox: "src/validators/typebox",
+  effect: "src/validators/effect"
+};
+function projectRelative4(p) {
+  return p.startsWith("./") ? p.slice(2) : p;
+}
+function formsOptions(g, cfg) {
+  const library = g.validation?.library ?? "zod";
+  const siblings = cfg.generators.filter((s) => s.kind === library);
+  const derived = siblings.length === 1 ? projectRelative4(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS4[library]) : void 0;
+  return {
+    outputDir: formsOutDir(g, cfg),
+    target: g.target,
+    modes: g.modes,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension,
+    validation: {
+      ...g.validation,
+      library,
+      useShared: true,
+      importPath: g.validation?.importPath ?? derived
+    }
+  };
+}
+
+// src/elysia-options.ts
+var VALIDATOR_DEFAULT_DIRS5 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype",
   typebox: "src/validators/typebox"
 };
-function projectRelative3(p) {
+function projectRelative5(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function elysiaOptions(g, cfg) {
   const library = g.validation?.library ?? "zod";
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative3(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS3[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative5(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS5[library]) : void 0;
   return {
     outputDir: elysiaOutDir(g, cfg),
     appName: g.appName,
@@ -469,19 +532,19 @@ function fastCheckOptions(g, cfg) {
 }
 
 // src/h3-options.ts
-var VALIDATOR_DEFAULT_DIRS4 = {
+var VALIDATOR_DEFAULT_DIRS6 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype"
 };
-function projectRelative4(p) {
+function projectRelative6(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function h3Options(g, cfg) {
   const configured = g.validation?.library ?? "zod";
   const library = configured === "typebox" ? "zod" : configured;
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative4(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS4[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative6(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS6[library]) : void 0;
   return {
     outputDir: h3OutDir(g, cfg),
     h3: g.h3,
@@ -515,19 +578,19 @@ function mcpOptions(g, cfg) {
 }
 
 // src/next-options.ts
-var VALIDATOR_DEFAULT_DIRS5 = {
+var VALIDATOR_DEFAULT_DIRS7 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype"
 };
-function projectRelative5(p) {
+function projectRelative7(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function nextOptions(g, cfg) {
   const configured = g.validation?.library ?? "zod";
   const library = configured === "typebox" ? "zod" : configured;
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative5(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS5[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative7(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS7[library]) : void 0;
   return {
     outputDir: nextOutDir(g, cfg),
     naming: g.naming,
@@ -544,19 +607,19 @@ function nextOptions(g, cfg) {
 }
 
 // src/tanstack-start-options.ts
-var VALIDATOR_DEFAULT_DIRS6 = {
+var VALIDATOR_DEFAULT_DIRS8 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype"
 };
-function projectRelative6(p) {
+function projectRelative8(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function tanstackStartOptions(g, cfg) {
   const configured = g.validation?.library ?? "zod";
   const library = configured === "typebox" ? "zod" : configured;
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative6(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS6[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative8(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS8[library]) : void 0;
   return {
     outputDir: tanstackStartOutDir(g, cfg),
     naming: g.naming,
@@ -640,7 +703,7 @@ function trpcOptions(g, cfg, servicesDir) {
 }
 
 // src/generator-registry.ts
-var VALIDATOR_DEFAULT_DIRS7 = {
+var VALIDATOR_DEFAULT_DIRS9 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype",
@@ -673,10 +736,14 @@ var GENERATORS = [
     //
     // The side effect was invisible and lasted longer than the reason: tsup externalises
     // `dependencies` and `peerDependencies` and bundles everything else, so those eight travelled
-    // inside `dist` while the other six were resolved from `node_modules`. All fourteen are on the
-    // registry now and all fourteen are `dependencies`, which is what makes every one of them a
-    // package that can genuinely be absent, and `loadGenerator` tell absence apart from failure
-    // for every kind rather than for six of them.
+    // inside `dist` while the rest were resolved from `node_modules`. Every generator package is on
+    // the registry now and every one is a `dependencies` entry, which is what makes each of them a
+    // package that can genuinely be absent, and `loadGenerator` tell absence apart from failure for
+    // every kind rather than for some of them.
+    //
+    // Counted nowhere on purpose. This paragraph twice carried a number that the next batch of
+    // generators falsified, and `packages/cli/test/generator-registry.spec.ts` asserts the property
+    // against the manifest, which is where a quantity belongs.
     specifier: "@drzl/generator-trpc",
     load: () => import("@drzl/generator-trpc"),
     construct: (m, analysis) => new m.TRPCGenerator(analysis),
@@ -728,9 +795,10 @@ var GENERATORS = [
     // This one and the three below spent one release each in `optionalDependencies`, because a
     // package that has never existed cannot publish through npm's trusted-publisher OIDC flow and
     // naming it as a hard dependency in the release that introduces it breaks `npm i @drzl/cli`
-    // for everyone until the first publish lands. All four are on the registry now, so all four
-    // are ordinary dependencies. `scripts/verify/stages/33-registry-deps.sh` gates both halves of
-    // that rule and is what reported the promotion was due.
+    // for everyone until the first publish lands. The six generators added after them went the
+    // same way and were promoted the same way once their first versions were published by hand.
+    // Nothing here is optional any more. `scripts/verify/stages/33-registry-deps.sh` gates both
+    // halves of that rule and is what reported each promotion was due.
     specifier: "@drzl/generator-mcp",
     load: () => import("@drzl/generator-mcp"),
     construct: (m, analysis) => new m.MCPGenerator(analysis),
@@ -785,6 +853,22 @@ var GENERATORS = [
     outputDir: (g, cfg) => tsRestOutDir(g, cfg),
     options: (g, cfg) => tsRestOptions(g, cfg)
   },
+  {
+    kind: "openapi-fetch",
+    specifier: "@drzl/generator-openapi-fetch",
+    load: () => import("@drzl/generator-openapi-fetch"),
+    construct: (m, analysis) => new m.OpenApiFetchGenerator(analysis),
+    outputDir: (g, cfg) => openApiFetchOutDir(g, cfg),
+    options: (g, cfg) => openApiFetchOptions(g, cfg)
+  },
+  {
+    kind: "forms",
+    specifier: "@drzl/generator-forms",
+    load: () => import("@drzl/generator-forms"),
+    construct: (m, analysis) => new m.FormsGenerator(analysis),
+    outputDir: (g, cfg) => formsOutDir(g, cfg),
+    options: (g, cfg) => formsOptions(g, cfg)
+  },
   {
     kind: "elysia",
     specifier: "@drzl/generator-elysia",
@@ -822,7 +906,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-zod",
     load: () => import("@drzl/generator-zod"),
     construct: (m, analysis) => new m.ZodGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.zod,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.zod,
     // `meta` is zod-only; see `GeneratorCapabilities.meta` for why it is not passed to the other
     // four rather than being passed and ignored.
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, {
@@ -836,7 +920,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-valibot",
     load: () => import("@drzl/generator-valibot"),
     construct: (m, analysis) => new m.ValibotGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.valibot,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.valibot,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: true, constraints: true })
   },
   {
@@ -844,7 +928,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-arktype",
     load: () => import("@drzl/generator-arktype"),
     construct: (m, analysis) => new m.ArkTypeGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.arktype,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.arktype,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: false })
   },
   {
@@ -852,7 +936,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-typebox",
     load: () => import("@drzl/generator-typebox"),
     construct: (m, analysis) => new m.TypeBoxGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.typebox,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.typebox,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: true, standardSchema: true })
   },
   {
@@ -860,7 +944,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-effect",
     load: () => import("@drzl/generator-effect"),
     construct: (m, analysis) => new m.EffectGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.effect,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.effect,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: true })
   },
   {
@@ -868,7 +952,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-json-schema",
     load: () => import("@drzl/generator-json-schema"),
     construct: (m, analysis) => new m.JsonSchemaGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7["json-schema"],
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9["json-schema"],
     options: (g, cfg, ctx) => jsonSchemaOptions(g, cfg, ctx.outDir)
   }
 ];
@@ -2182,6 +2266,24 @@ function sqlLiterals(values) {
 function derivedName(table, column) {
   return `${table}_${column}_check`;
 }
+var ADD_CONSTRAINT_DIALECTS = /* @__PURE__ */ new Set([
+  "postgres",
+  "cockroach",
+  "gel",
+  "mysql",
+  "singlestore",
+  "mssql"
+]);
+function fixFor(dialect, table, column, values) {
+  if (!ADD_CONSTRAINT_DIALECTS.has(dialect)) return void 0;
+  return `ALTER TABLE ${table} ADD CONSTRAINT ${derivedName(table, column)} CHECK (${column} IN (${sqlLiterals(values)}));`;
+}
+function noFixReason(dialect) {
+  if (dialect === "sqlite") {
+    return "SQLite cannot add a CHECK to an existing column: ALTER TABLE ... ADD CONSTRAINT is a syntax error there. Closing this means rebuilding the table, which is the twelve-step procedure SQLite documents: create the new table with the constraint, copy the rows, drop the old one, rename.";
+  }
+  return `no statement is emitted for the "${dialect}" dialect, which this report cannot name a fix for`;
+}
 function buildConstraintDriftReport(analysis, schemaPath) {
   const entries = [];
   for (const table of analysis.tables) {
@@ -2217,7 +2319,10 @@ function buildConstraintDriftReport(analysis, schemaPath) {
         columns: [column.name],
         rule: `${column.name} IN (${sqlLiterals(values)})`,
         reason: `the column is declared ${column.sqlType}, which holds any text; the set exists only in the generated schemas`,
-        fix: `ALTER TABLE ${table.name} ADD CONSTRAINT ${derivedName(table.name, column.name)} CHECK (${column.name} IN (${sqlLiterals(values)}));`
+        ...(() => {
+          const fix = fixFor(analysis.dialect, table.name, column.name, values);
+          return fix ? { fix } : { noFix: noFixReason(analysis.dialect) };
+        })()
       });
     }
   }
@@ -2292,6 +2397,8 @@ function renderConstraintDriftReport(report, style = PLAIN3) {
       if (e.fix) {
         out.push(chalk.dim("      Close it with:"));
         out.push(`      ${e.fix}`);
+      } else if (e.noFix) {
+        out.push(chalk.dim(wrap3(e.noFix, "      ", "      Not one statement here: ")));
       }
       out.push("");
     }
@@ -2323,6 +2430,271 @@ function renderConstraintDriftReport(report, style = PLAIN3) {
   );
   return out.join("\n");
 }
+function renderConstraintDriftSql(report) {
+  const gaps = report.entries.filter((e) => e.side === "schema-only");
+  if (!gaps.length) return "";
+  const out = [];
+  const runnable = gaps.filter((g) => g.fix);
+  const unrunnable = gaps.filter((g) => !g.fix);
+  out.push(`-- Generated by drzl doctor --constraints --sql`);
+  out.push(`-- ${report.schema}, ${report.dialect}`);
+  out.push(
+    `-- ${runnable.length} constraint(s) your schemas enforce and the database does not.`
+  );
+  if (unrunnable.length) {
+    out.push(
+      `-- ${unrunnable.length} more cannot be closed by one statement on this dialect; see below.`
+    );
+  }
+  out.push("");
+  const byPlace = (a, b) => a.table.localeCompare(b.table) || a.columns.join().localeCompare(b.columns.join());
+  for (const g of [...runnable].sort(byPlace)) {
+    out.push(`-- ${g.table}.${g.columns.join(", ")}: ${g.reason}`);
+    out.push(g.fix);
+    out.push("");
+  }
+  if (unrunnable.length) {
+    out.push("-- The rest, which this dialect cannot do in one statement:");
+    for (const g of [...unrunnable].sort(byPlace)) {
+      out.push(`--`);
+      out.push(`--   ${g.table}.${g.columns.join(", ")}`);
+      out.push(`--   ${g.rule}`);
+      for (const line of (g.noFix ?? "").match(/.{1,88}(\s|$)/g) ?? []) {
+        out.push(`--   ${line.trim()}`);
+      }
+    }
+    out.push("");
+  }
+  return out.join("\n");
+}
+
+// src/policy-report.ts
+import { Chalk as Chalk5 } from "chalk";
+var PLAIN4 = new Chalk5({ level: 0 });
+var COMMANDS = ["select", "insert", "update", "delete"];
+var DENIAL = {
+  select: "every read returns zero rows",
+  insert: "every insert is refused",
+  update: "every update is refused",
+  delete: "every delete is refused"
+};
+function appliesTo(policy, command) {
+  const forCmd = (policy.for ?? "all").toLowerCase();
+  return forCmd === "all" || forCmd === command;
+}
+function grants(policy, command) {
+  if (!appliesTo(policy, command)) return false;
+  if ((policy.as ?? "permissive").toLowerCase() === "restrictive") return false;
+  const hasUsing = !!policy.using;
+  const hasCheck = !!policy.withCheck;
+  const forCmd = (policy.for ?? "all").toLowerCase();
+  if (forCmd === "all") return hasUsing || hasCheck;
+  switch (command) {
+    case "select":
+    case "delete":
+      return hasUsing;
+    case "insert":
+      return hasCheck;
+    case "update":
+      return hasCheck || hasUsing;
+  }
+}
+function hasAnyExpression(policy) {
+  return !!policy.using || !!policy.withCheck;
+}
+function readTable(table) {
+  if (typeof table.rlsEnabled !== "boolean") return void 0;
+  const policies = table.policies ?? [];
+  const declaredRls = table.rlsEnabled;
+  const effective = declaredRls || policies.length > 0;
+  if (!effective) return void 0;
+  const grantMap = {};
+  for (const c of COMMANDS) grantMap[c] = policies.some((p) => grants(p, c));
+  return { table: table.name, declaredRls, effective, policies, grants: grantMap };
+}
+function buildPolicyReport(analysis, schemaPath) {
+  const tables = [];
+  const findings = [];
+  for (const table of analysis.tables) {
+    const read = readTable(table);
+    if (!read) continue;
+    tables.push(read);
+    if (COMMANDS.every((c) => !read.grants[c])) {
+      findings.push({
+        kind: "denied",
+        table: read.table,
+        detail: "row-level security is on and no permissive policy grants anything, so every read returns zero rows and every write is refused, for every role but the table's owner and any role with BYPASSRLS",
+        // Deliberately not "give it a USING": a policy written `FOR INSERT` consults only its
+        // WITH CHECK, so that advice would be wrong for exactly the declaration this report exists
+        // to catch. The per-policy findings below name the right expression for each one.
+        fix: read.policies.length ? `no policy here grants a command: ${read.policies.map((p) => `"${p.name}"`).join(", ")} ${read.policies.length === 1 ? "needs" : "need"} a USING expression, or a WITH CHECK where the command is INSERT` : "declare a policy, or drop the row-level security on this table"
+      });
+    } else {
+      for (const command of COMMANDS) {
+        if (read.grants[command]) continue;
+        const named = read.policies.filter((p) => appliesTo(p, command));
+        findings.push({
+          kind: "denied",
+          table: read.table,
+          command,
+          detail: `row-level security is on and no permissive policy grants ${command.toUpperCase()}, so ${DENIAL[command]} for every role but the table's owner and any role with BYPASSRLS`,
+          fix: named.length ? `${named.length === 1 ? "the policy" : "the policies"} ${named.map((p) => `"${p.name}"`).join(", ")} name${named.length === 1 ? "s" : ""} ${command.toUpperCase()} but grant${named.length === 1 ? "s" : ""} nothing; give ${command === "insert" ? "it a WITH CHECK" : "it a USING"} expression` : `declare a policy for ${command.toUpperCase()}, or drop the row-level security on this table`
+        });
+      }
+    }
+    for (const policy of read.policies) {
+      if (hasAnyExpression(policy)) continue;
+      findings.push({
+        kind: "grants-nothing",
+        table: read.table,
+        policy: policy.name,
+        detail: "the policy carries neither a USING nor a WITH CHECK expression, so it permits nothing and only the policies beside it decide what this table allows",
+        fix: (policy.for ?? "all").toLowerCase() === "insert" ? "give it a WITH CHECK expression, which is the only one INSERT consults" : "give it a USING expression, and a WITH CHECK too where writes need a different rule"
+      });
+    }
+  }
+  const policies = tables.reduce((n, t) => n + t.policies.length, 0);
+  return {
+    schema: schemaPath,
+    dialect: analysis.dialect,
+    ok: findings.length === 0,
+    counts: {
+      tables: analysis.tables.length,
+      withRls: tables.length,
+      policies,
+      findings: findings.length
+    },
+    tables,
+    findings,
+    ignoredByGeneratedCode: tables.map((t) => t.table)
+  };
+}
+function wrap4(text, indent, first = indent, width = 96) {
+  const words = text.split(/\s+/).filter(Boolean);
+  const lines = [];
+  let line = first;
+  let started = false;
+  for (const w of words) {
+    if (started && line.length + 1 + w.length > width) {
+      lines.push(line);
+      line = indent + w;
+    } else {
+      line = started ? `${line} ${w}` : line + w;
+      started = true;
+    }
+  }
+  if (started) lines.push(line);
+  return lines.join("\n");
+}
+function policyLine(policy) {
+  const bits = [(policy.for ?? "all").toUpperCase()];
+  if ((policy.as ?? "").toLowerCase() === "restrictive") bits.push("restrictive");
+  bits.push(policy.to?.length ? `to ${policy.to.join(", ")}` : "to public");
+  const carries = [policy.using ? "USING" : void 0, policy.withCheck ? "WITH CHECK" : void 0].filter(Boolean).join(" + ");
+  bits.push(carries || "no expression");
+  if (policy.linked) bits.push("linked");
+  return bits.join(", ");
+}
+function renderPolicyReport(report, style = PLAIN4) {
+  const chalk = style;
+  const out = [];
+  const plural = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
+  out.push(chalk.bold(`DRZL row-level security  ${report.schema}`));
+  out.push(
+    chalk.dim(
+      `${report.dialect}, ${plural(report.counts.withRls, "table")} under RLS, ${plural(report.counts.policies, "policy").replace("policys", "policies")}`
+    )
+  );
+  out.push("");
+  if (!report.counts.withRls) {
+    out.push(chalk.green("No table in this schema uses row-level security."));
+    if (report.dialect !== "postgres" && report.dialect !== "cockroach") {
+      out.push(chalk.dim(`  ${report.dialect} has no row-level security to declare.`));
+    } else {
+      out.push(chalk.dim("  No table calls .enableRLS() and none declares a pgPolicy."));
+    }
+    return out.join("\n");
+  }
+  const denied = report.findings.filter((f) => f.kind === "denied");
+  if (denied.length) {
+    out.push(chalk.red("These tables refuse the operation your generated code performs"));
+    out.push(
+      chalk.dim(
+        wrap4(
+          "A table under row-level security permits only what a policy grants. The generated service still compiles and its return type still promises rows.",
+          "  "
+        )
+      )
+    );
+    out.push("");
+    for (const f of denied) {
+      out.push(`  ${chalk.dim("-")} ${chalk.bold(f.table)} ${chalk.dim(f.command ?? "everything")}`);
+      out.push(wrap4(f.detail, "      "));
+      if (f.fix) out.push(chalk.dim(wrap4(f.fix, "      ", "      Close it: ")));
+      out.push("");
+    }
+  }
+  const dead = report.findings.filter((f) => f.kind === "grants-nothing");
+  if (dead.length) {
+    out.push(chalk.yellow("These policies grant nothing"));
+    out.push(
+      chalk.dim(
+        wrap4(
+          "A policy with neither expression is not a permissive default. Measured against Postgres 18.3: a lone FOR INSERT policy carrying no WITH CHECK refused every insert.",
+          "  "
+        )
+      )
+    );
+    out.push("");
+    for (const f of dead) {
+      out.push(`  ${chalk.dim("-")} ${chalk.bold(f.table)}.${f.policy}`);
+      out.push(wrap4(f.detail, "      "));
+      if (f.fix) out.push(chalk.dim(wrap4(f.fix, "      ", "      Close it: ")));
+      out.push("");
+    }
+  }
+  out.push(chalk.cyan("The policies each table carries"));
+  out.push(
+    chalk.dim(
+      wrap4(
+        "Whether these apply to the role your application connects as is the one question this report cannot answer for you.",
+        "  "
+      )
+    )
+  );
+  out.push("");
+  for (const t of report.tables) {
+    const flag = t.declaredRls ? "enableRLS()" : "RLS on, implied by its policies";
+    out.push(`  ${chalk.dim("-")} ${chalk.bold(t.table)} ${chalk.dim(`(${flag})`)}`);
+    if (!t.policies.length) {
+      out.push(chalk.dim("      no policies"));
+    }
+    for (const p of t.policies) {
+      out.push(`      ${p.name}: ${chalk.dim(policyLine(p))}`);
+    }
+    const permitted = COMMANDS.filter((c) => t.grants[c]);
+    out.push(
+      chalk.dim(`      permits: ${permitted.length ? permitted.join(", ") : "nothing"}`)
+    );
+    out.push("");
+  }
+  out.push(chalk.yellow("What DRZL generates does not know about any of this"));
+  out.push(
+    chalk.dim(
+      wrap4(
+        `No generator emits policy awareness, so a generated read path describes rows the caller may not be allowed to see, and a reader of the emitted types will believe otherwise. That is true of ${plural(report.ignoredByGeneratedCode.length, "table")} here, and it is a fact about DRZL rather than a defect in your schema.`,
+        "  "
+      )
+    )
+  );
+  out.push("");
+  out.push(
+    chalk.dim(
+      `${plural(report.counts.findings, "finding")} across ${plural(report.counts.withRls, "table")} under row-level security.`
+    )
+  );
+  return out.join("\n");
+}
 
 // src/drift.ts
 import { promises as fs2 } from "fs";
@@ -3249,6 +3621,9 @@ withOutputFlags(
   program.command("doctor").description("Report what DRZL cannot type or enforce in your schema, and why").argument("[schema]", "path to drizzle schema (TS); defaults to the schema in drzl.config").option("-c, --config <path>", "path to drzl.config, read when no schema argument is given").option("--strict", "exit 2 when anything is reported", false).option(
     "--constraints",
     "report what each side enforces that the other does not, instead of the usual findings"
+  ).option("--sql", "with --constraints, emit the statements alone, for redirecting to a migration").option(
+    "--policies",
+    "report the row-level security policies each table carries, and what they refuse"
   )
 ).action(async (schema, opts) => {
   const out = outputFor(opts);
@@ -3272,7 +3647,21 @@ withOutputFlags(
         validateConstraints: true
       });
       const schemaLabel = Array.isArray(target) ? target.join(", ") : target;
-      if (opts.constraints) {
+      if (opts.sql && !opts.constraints) {
+        const msg = "--sql reports the constraint drift as statements, so it needs --constraints.";
+        if (opts.json) out.jsonData(jsonFailure("doctor", "DRZL_CLI_DOCTOR", msg));
+        else out.error("Doctor failed (DRZL_CLI_DOCTOR):", msg);
+        process.exit(EXIT_FAILED);
+        return;
+      }
+      if (opts.constraints && opts.policies) {
+        const msg = "--constraints and --policies are separate reports. Run one, then the other.";
+        if (opts.json) out.jsonData(jsonFailure("doctor", "DRZL_CLI_DOCTOR", msg));
+        else out.error("Doctor failed (DRZL_CLI_DOCTOR):", msg);
+        process.exit(EXIT_FAILED);
+        return;
+      }
+      if (opts.constraints || opts.policies) {
         const preflight = buildDoctorReport(analysis, schemaLabel);
         const fatal = preflight.findings.filter((f) => f.level === "error");
         if (fatal.length) {
@@ -3288,8 +3677,15 @@ withOutputFlags(
           process.exit(EXIT_FAILED);
           return;
         }
+      }
+      if (opts.constraints) {
         const drift = buildConstraintDriftReport(analysis, schemaLabel);
         const driftCode = opts.strict && drift.counts.schemaOnly ? EXIT_FINDINGS : EXIT_OK;
+        if (opts.sql) {
+          out.data(renderConstraintDriftSql(drift));
+          process.exit(driftCode);
+          return;
+        }
         if (opts.json)
           out.data(
             JSON.stringify({ command: "doctor", exitCode: driftCode, ...drift }, null, 2)
@@ -3298,6 +3694,17 @@ withOutputFlags(
         process.exit(driftCode);
         return;
       }
+      if (opts.policies) {
+        const policies = buildPolicyReport(analysis, schemaLabel);
+        const policyCode = opts.strict && policies.counts.findings ? EXIT_FINDINGS : EXIT_OK;
+        if (opts.json)
+          out.data(
+            JSON.stringify({ command: "doctor", exitCode: policyCode, ...policies }, null, 2)
+          );
+        else out.data(renderPolicyReport(policies, out.outStyle));
+        process.exit(policyCode);
+        return;
+      }
       const report = buildDoctorReport(analysis, schemaLabel);
       const unreadable = report.findings.some((f) => f.level === "error");
       const code = unreadable ? EXIT_FAILED : opts.strict && report.findings.length ? EXIT_FINDINGS : EXIT_OK;