@drzl/cli 4.36.0 → 4.38.0

package/dist/cli.js

@@ -16,6 +16,7 @@ import {
   fastCheckOutDir,
   fastifyOutDir,
   filterTables,
+  formsOutDir,
   graphqlOutDir,
   h3OutDir,
   hasNamedSchemas,
@@ -28,13 +29,15 @@ import {
   nearestKey,
   nestjsOutDir,
   nextOutDir,
+  openApiFetchOutDir,
+  pothosOutDir,
   seedOutDir,
   tableAliases,
   tableFilterWarnings,
   tanstackStartOutDir,
   trpcOutDir,
   tsRestOutDir
-} from "./chunk-S5JWTWWU.js";
+} from "./chunk-VG6SD2GP.js";
 
 // src/cli.ts
 import { qualifiedTableName as qualifiedTableName2, SchemaAnalyzer as SchemaAnalyzer2 } from "@drzl/analyzer";
@@ -414,20 +417,81 @@ function tsRestOptions(g, cfg) {
   };
 }
 
-// src/elysia-options.ts
+// src/openapi-fetch-options.ts
 var VALIDATOR_DEFAULT_DIRS3 = {
+  zod: "src/validators/zod",
+  valibot: "src/validators/valibot",
+  arktype: "src/validators/arktype"
+};
+function projectRelative3(p) {
+  return p.startsWith("./") ? p.slice(2) : p;
+}
+function openApiFetchOptions(g, cfg) {
+  const configured = g.validation?.library ?? "zod";
+  const library = configured === "typebox" ? "zod" : configured;
+  const siblings = cfg.generators.filter((s) => s.kind === library);
+  const derived = siblings.length === 1 ? projectRelative3(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS3[library]) : void 0;
+  return {
+    outputDir: openApiFetchOutDir(g, cfg),
+    clientName: g.clientName,
+    document: g.document,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension,
+    validation: {
+      ...g.validation,
+      library,
+      useShared: true,
+      importPath: g.validation?.importPath ?? derived
+    }
+  };
+}
+
+// src/forms-options.ts
+var VALIDATOR_DEFAULT_DIRS4 = {
+  zod: "src/validators/zod",
+  valibot: "src/validators/valibot",
+  arktype: "src/validators/arktype",
+  typebox: "src/validators/typebox",
+  effect: "src/validators/effect"
+};
+function projectRelative4(p) {
+  return p.startsWith("./") ? p.slice(2) : p;
+}
+function formsOptions(g, cfg) {
+  const library = g.validation?.library ?? "zod";
+  const siblings = cfg.generators.filter((s) => s.kind === library);
+  const derived = siblings.length === 1 ? projectRelative4(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS4[library]) : void 0;
+  return {
+    outputDir: formsOutDir(g, cfg),
+    target: g.target,
+    modes: g.modes,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension,
+    validation: {
+      ...g.validation,
+      library,
+      useShared: true,
+      importPath: g.validation?.importPath ?? derived
+    }
+  };
+}
+
+// src/elysia-options.ts
+var VALIDATOR_DEFAULT_DIRS5 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype",
   typebox: "src/validators/typebox"
 };
-function projectRelative3(p) {
+function projectRelative5(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function elysiaOptions(g, cfg) {
   const library = g.validation?.library ?? "zod";
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative3(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS3[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative5(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS5[library]) : void 0;
   return {
     outputDir: elysiaOutDir(g, cfg),
     appName: g.appName,
@@ -468,20 +532,31 @@ function fastCheckOptions(g, cfg) {
   };
 }
 
+// src/pothos-options.ts
+function pothosOptions(g, cfg) {
+  return {
+    outputDir: pothosOutDir(g, cfg),
+    naming: g.naming,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension
+  };
+}
+
 // src/h3-options.ts
-var VALIDATOR_DEFAULT_DIRS4 = {
+var VALIDATOR_DEFAULT_DIRS6 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype"
 };
-function projectRelative4(p) {
+function projectRelative6(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function h3Options(g, cfg) {
   const configured = g.validation?.library ?? "zod";
   const library = configured === "typebox" ? "zod" : configured;
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative4(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS4[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative6(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS6[library]) : void 0;
   return {
     outputDir: h3OutDir(g, cfg),
     h3: g.h3,
@@ -515,19 +590,19 @@ function mcpOptions(g, cfg) {
 }
 
 // src/next-options.ts
-var VALIDATOR_DEFAULT_DIRS5 = {
+var VALIDATOR_DEFAULT_DIRS7 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype"
 };
-function projectRelative5(p) {
+function projectRelative7(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function nextOptions(g, cfg) {
   const configured = g.validation?.library ?? "zod";
   const library = configured === "typebox" ? "zod" : configured;
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative5(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS5[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative7(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS7[library]) : void 0;
   return {
     outputDir: nextOutDir(g, cfg),
     naming: g.naming,
@@ -544,19 +619,19 @@ function nextOptions(g, cfg) {
 }
 
 // src/tanstack-start-options.ts
-var VALIDATOR_DEFAULT_DIRS6 = {
+var VALIDATOR_DEFAULT_DIRS8 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype"
 };
-function projectRelative6(p) {
+function projectRelative8(p) {
   return p.startsWith("./") ? p.slice(2) : p;
 }
 function tanstackStartOptions(g, cfg) {
   const configured = g.validation?.library ?? "zod";
   const library = configured === "typebox" ? "zod" : configured;
   const siblings = cfg.generators.filter((s) => s.kind === library);
-  const derived = siblings.length === 1 ? projectRelative6(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS6[library]) : void 0;
+  const derived = siblings.length === 1 ? projectRelative8(siblings[0].path ?? VALIDATOR_DEFAULT_DIRS8[library]) : void 0;
   return {
     outputDir: tanstackStartOutDir(g, cfg),
     naming: g.naming,
@@ -640,7 +715,7 @@ function trpcOptions(g, cfg, servicesDir) {
 }
 
 // src/generator-registry.ts
-var VALIDATOR_DEFAULT_DIRS7 = {
+var VALIDATOR_DEFAULT_DIRS9 = {
   zod: "src/validators/zod",
   valibot: "src/validators/valibot",
   arktype: "src/validators/arktype",
@@ -673,10 +748,14 @@ var GENERATORS = [
     //
     // The side effect was invisible and lasted longer than the reason: tsup externalises
     // `dependencies` and `peerDependencies` and bundles everything else, so those eight travelled
-    // inside `dist` while the other six were resolved from `node_modules`. All fourteen are on the
-    // registry now and all fourteen are `dependencies`, which is what makes every one of them a
-    // package that can genuinely be absent, and `loadGenerator` tell absence apart from failure
-    // for every kind rather than for six of them.
+    // inside `dist` while the rest were resolved from `node_modules`. Every generator package is on
+    // the registry now and every one is a `dependencies` entry, which is what makes each of them a
+    // package that can genuinely be absent, and `loadGenerator` tell absence apart from failure for
+    // every kind rather than for some of them.
+    //
+    // Counted nowhere on purpose. This paragraph twice carried a number that the next batch of
+    // generators falsified, and `packages/cli/test/generator-registry.spec.ts` asserts the property
+    // against the manifest, which is where a quantity belongs.
     specifier: "@drzl/generator-trpc",
     load: () => import("@drzl/generator-trpc"),
     construct: (m, analysis) => new m.TRPCGenerator(analysis),
@@ -728,9 +807,10 @@ var GENERATORS = [
     // This one and the three below spent one release each in `optionalDependencies`, because a
     // package that has never existed cannot publish through npm's trusted-publisher OIDC flow and
     // naming it as a hard dependency in the release that introduces it breaks `npm i @drzl/cli`
-    // for everyone until the first publish lands. All four are on the registry now, so all four
-    // are ordinary dependencies. `scripts/verify/stages/33-registry-deps.sh` gates both halves of
-    // that rule and is what reported the promotion was due.
+    // for everyone until the first publish lands. The six generators added after them went the
+    // same way and were promoted the same way once their first versions were published by hand.
+    // Nothing here is optional any more. `scripts/verify/stages/33-registry-deps.sh` gates both
+    // halves of that rule and is what reported each promotion was due.
     specifier: "@drzl/generator-mcp",
     load: () => import("@drzl/generator-mcp"),
     construct: (m, analysis) => new m.MCPGenerator(analysis),
@@ -785,6 +865,22 @@ var GENERATORS = [
     outputDir: (g, cfg) => tsRestOutDir(g, cfg),
     options: (g, cfg) => tsRestOptions(g, cfg)
   },
+  {
+    kind: "openapi-fetch",
+    specifier: "@drzl/generator-openapi-fetch",
+    load: () => import("@drzl/generator-openapi-fetch"),
+    construct: (m, analysis) => new m.OpenApiFetchGenerator(analysis),
+    outputDir: (g, cfg) => openApiFetchOutDir(g, cfg),
+    options: (g, cfg) => openApiFetchOptions(g, cfg)
+  },
+  {
+    kind: "forms",
+    specifier: "@drzl/generator-forms",
+    load: () => import("@drzl/generator-forms"),
+    construct: (m, analysis) => new m.FormsGenerator(analysis),
+    outputDir: (g, cfg) => formsOutDir(g, cfg),
+    options: (g, cfg) => formsOptions(g, cfg)
+  },
   {
     kind: "elysia",
     specifier: "@drzl/generator-elysia",
@@ -809,6 +905,14 @@ var GENERATORS = [
     outputDir: (g, cfg) => fastCheckOutDir(g, cfg),
     options: (g, cfg) => fastCheckOptions(g, cfg)
   },
+  {
+    kind: "pothos",
+    specifier: "@drzl/generator-pothos",
+    load: () => import("@drzl/generator-pothos"),
+    construct: (m, analysis) => new m.PothosGenerator(analysis),
+    outputDir: (g, cfg) => pothosOutDir(g, cfg),
+    options: (g, cfg) => pothosOptions(g, cfg)
+  },
   {
     kind: "service",
     specifier: "@drzl/generator-service",
@@ -822,7 +926,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-zod",
     load: () => import("@drzl/generator-zod"),
     construct: (m, analysis) => new m.ZodGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.zod,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.zod,
     // `meta` is zod-only; see `GeneratorCapabilities.meta` for why it is not passed to the other
     // four rather than being passed and ignored.
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, {
@@ -836,7 +940,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-valibot",
     load: () => import("@drzl/generator-valibot"),
     construct: (m, analysis) => new m.ValibotGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.valibot,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.valibot,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: true, constraints: true })
   },
   {
@@ -844,7 +948,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-arktype",
     load: () => import("@drzl/generator-arktype"),
     construct: (m, analysis) => new m.ArkTypeGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.arktype,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.arktype,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: false })
   },
   {
@@ -852,7 +956,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-typebox",
     load: () => import("@drzl/generator-typebox"),
     construct: (m, analysis) => new m.TypeBoxGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.typebox,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.typebox,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: true, standardSchema: true })
   },
   {
@@ -860,7 +964,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-effect",
     load: () => import("@drzl/generator-effect"),
     construct: (m, analysis) => new m.EffectGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7.effect,
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9.effect,
     options: (g, cfg, ctx) => validationOptions(g, cfg, ctx.outDir, { schemaTypes: true })
   },
   {
@@ -868,7 +972,7 @@ var GENERATORS = [
     specifier: "@drzl/generator-json-schema",
     load: () => import("@drzl/generator-json-schema"),
     construct: (m, analysis) => new m.JsonSchemaGenerator(analysis),
-    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS7["json-schema"],
+    outputDir: (g) => g.path ?? VALIDATOR_DEFAULT_DIRS9["json-schema"],
     options: (g, cfg, ctx) => jsonSchemaOptions(g, cfg, ctx.outDir)
   }
 ];
@@ -1052,6 +1156,101 @@ import { parseCheck as parseCheck2 } from "@drzl/validation-core";
 
 // src/doctor.ts
 import { lengthMeasure, parseCheck } from "@drzl/validation-core";
+
+// src/auth-tables.ts
+var SIGNATURES = [
+  {
+    model: "account",
+    // `providerId` beside `accountId` is the distinctive pair: it is a link to an external identity
+    // provider, which an application table has no reason to model this way.
+    required: ["accountId", "providerId", "userId"],
+    supporting: ["accessToken", "refreshToken", "idToken", "password", "scope"],
+    conventionalName: "account",
+    secrets: ["accessToken", "refreshToken", "idToken", "password"]
+  },
+  {
+    model: "session",
+    required: ["token", "expiresAt", "userId"],
+    supporting: ["ipAddress", "userAgent"],
+    conventionalName: "session",
+    // A session token is a bearer credential: whoever reads it is that user until it expires.
+    secrets: ["token"]
+  },
+  {
+    model: "verification",
+    // `identifier` and `value` are deliberately generic names, which is why `expiresAt` is required
+    // too: the three together are a short-lived token store and little else.
+    required: ["identifier", "value", "expiresAt"],
+    supporting: [],
+    conventionalName: "verification",
+    secrets: ["value"]
+  },
+  {
+    model: "user",
+    required: ["email", "emailVerified"],
+    supporting: ["name", "image"],
+    conventionalName: "user",
+    secrets: []
+  }
+];
+function columnKeys(table) {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of table.columns) out.set(normalise(c.name), c);
+  return out;
+}
+function normalise(name) {
+  return name.replace(/[_-]/g, "").toLowerCase();
+}
+function has(keys, name) {
+  return keys.has(normalise(name));
+}
+function actualName(table, wanted) {
+  return table.columns.find((c) => normalise(c.name) === normalise(wanted))?.name;
+}
+function matchOne(table, sig) {
+  const keys = columnKeys(table);
+  const missing = sig.required.filter((r) => !has(keys, r));
+  if (missing.length) return void 0;
+  const supporting = sig.supporting.filter((s) => has(keys, s));
+  const nameMatches = normalise(table.name) === normalise(sig.conventionalName) || normalise(table.name) === `${normalise(sig.conventionalName)}s`;
+  const confidence = supporting.length > 0 || nameMatches ? "strong" : "likely";
+  const matched = [...sig.required, ...supporting].map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  const secrets = sig.secrets.map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  return { table: table.name, model: sig.model, confidence, matched, secrets };
+}
+function detectAuthTables(analysis) {
+  const found = [];
+  for (const table of analysis.tables) {
+    for (const sig of SIGNATURES) {
+      const m = matchOne(table, sig);
+      if (m) {
+        found.push(m);
+        break;
+      }
+    }
+  }
+  const hasNonUser = found.some((f) => f.model !== "user");
+  return hasNonUser ? found : found.filter((f) => f.model !== "user");
+}
+function authTablesWithSecrets(matches) {
+  return matches.filter((m) => m.secrets.length > 0);
+}
+function excludeSuggestion(matches) {
+  const names = [...new Set(matches.map((m) => m.table))].sort();
+  return `exclude: [${names.map((n) => `'${n}'`).join(", ")}]`;
+}
+function authTableWarnings(analysis) {
+  const risky = authTablesWithSecrets(detectAuthTables(analysis));
+  if (!risky.length) return [];
+  const lines = risky.map(
+    (m) => `"${m.table}" looks like an authentication library's ${m.model} table and holds ${m.secrets.map((c) => `"${c}"`).join(", ")}. Generating for it publishes ${m.secrets.length === 1 ? "that column" : "those columns"}.`
+  );
+  return [
+    `drzl generate: ${lines.join(" ")} Keep ${risky.length === 1 ? "it" : "them"} out with ${excludeSuggestion(risky)}, or leave it if the route is deliberate.`
+  ];
+}
+
+// src/doctor.ts
 import { Chalk as Chalk2 } from "chalk";
 var PLAIN = new Chalk2({ level: 0 });
 var HANDLED_CODES = /* @__PURE__ */ new Set(["DRZL_ANL_UNKNOWN_COLUMN"]);
@@ -1224,6 +1423,18 @@ function buildDoctorReport(analysis, schemaPath) {
       hint: i.hint
     });
   }
+  for (const match of detectAuthTables(analysis)) {
+    const secrets = match.secrets.length ? ` It holds ${match.secrets.map((c) => `\`${c}\``).join(", ")}, which a generated read route would return to whoever calls it.` : "";
+    findings.push({
+      kind: "auth-table",
+      // A warning rather than an error: this is a real leak and it is also a guess about someone
+      // else's schema, and a doctor that failed the build on a guess would be switched off.
+      level: "warn",
+      table: match.table,
+      message: `"${match.table}" matches the shape of an authentication library's ${match.model} table (${match.matched.join(", ")}).${secrets}`,
+      hint: `Keep it out of every generator with ${excludeSuggestion([match])}.`
+    });
+  }
   for (const i of analysis.issues) {
     if (i.code !== "DRZL_ANL_UNKNOWN_COLUMN") continue;
     findings.push({
@@ -1262,6 +1473,11 @@ var SECTIONS = [
     title: "Columns DRZL cannot type",
     why: "These get a validator that accepts any value."
   },
+  {
+    kinds: ["auth-table"],
+    title: "Tables that look like an authentication library's",
+    why: "Every generator loops over every table it finds, so these get routes too."
+  },
   {
     kinds: ["check-declined", "check-unknown-column", "check-not-scalar", "check-uncountable"],
     title: "CHECK constraints DRZL does not enforce",
@@ -2384,6 +2600,234 @@ function renderConstraintDriftSql(report) {
   return out.join("\n");
 }
 
+// src/policy-report.ts
+import { Chalk as Chalk5 } from "chalk";
+var PLAIN4 = new Chalk5({ level: 0 });
+var COMMANDS = ["select", "insert", "update", "delete"];
+var DENIAL = {
+  select: "every read returns zero rows",
+  insert: "every insert is refused",
+  update: "every update is refused",
+  delete: "every delete is refused"
+};
+function appliesTo(policy, command) {
+  const forCmd = (policy.for ?? "all").toLowerCase();
+  return forCmd === "all" || forCmd === command;
+}
+function grants(policy, command) {
+  if (!appliesTo(policy, command)) return false;
+  if ((policy.as ?? "permissive").toLowerCase() === "restrictive") return false;
+  const hasUsing = !!policy.using;
+  const hasCheck = !!policy.withCheck;
+  const forCmd = (policy.for ?? "all").toLowerCase();
+  if (forCmd === "all") return hasUsing || hasCheck;
+  switch (command) {
+    case "select":
+    case "delete":
+      return hasUsing;
+    case "insert":
+      return hasCheck;
+    case "update":
+      return hasCheck || hasUsing;
+  }
+}
+function hasAnyExpression(policy) {
+  return !!policy.using || !!policy.withCheck;
+}
+function readTable(table) {
+  if (typeof table.rlsEnabled !== "boolean") return void 0;
+  const policies = table.policies ?? [];
+  const declaredRls = table.rlsEnabled;
+  const effective = declaredRls || policies.length > 0;
+  if (!effective) return void 0;
+  const grantMap = {};
+  for (const c of COMMANDS) grantMap[c] = policies.some((p) => grants(p, c));
+  return { table: table.name, declaredRls, effective, policies, grants: grantMap };
+}
+function buildPolicyReport(analysis, schemaPath) {
+  const tables = [];
+  const findings = [];
+  for (const table of analysis.tables) {
+    const read = readTable(table);
+    if (!read) continue;
+    tables.push(read);
+    if (COMMANDS.every((c) => !read.grants[c])) {
+      findings.push({
+        kind: "denied",
+        table: read.table,
+        detail: "row-level security is on and no permissive policy grants anything, so every read returns zero rows and every write is refused, for every role but the table's owner and any role with BYPASSRLS",
+        // Deliberately not "give it a USING": a policy written `FOR INSERT` consults only its
+        // WITH CHECK, so that advice would be wrong for exactly the declaration this report exists
+        // to catch. The per-policy findings below name the right expression for each one.
+        fix: read.policies.length ? `no policy here grants a command: ${read.policies.map((p) => `"${p.name}"`).join(", ")} ${read.policies.length === 1 ? "needs" : "need"} a USING expression, or a WITH CHECK where the command is INSERT` : "declare a policy, or drop the row-level security on this table"
+      });
+    } else {
+      for (const command of COMMANDS) {
+        if (read.grants[command]) continue;
+        const named = read.policies.filter((p) => appliesTo(p, command));
+        findings.push({
+          kind: "denied",
+          table: read.table,
+          command,
+          detail: `row-level security is on and no permissive policy grants ${command.toUpperCase()}, so ${DENIAL[command]} for every role but the table's owner and any role with BYPASSRLS`,
+          fix: named.length ? `${named.length === 1 ? "the policy" : "the policies"} ${named.map((p) => `"${p.name}"`).join(", ")} name${named.length === 1 ? "s" : ""} ${command.toUpperCase()} but grant${named.length === 1 ? "s" : ""} nothing; give ${command === "insert" ? "it a WITH CHECK" : "it a USING"} expression` : `declare a policy for ${command.toUpperCase()}, or drop the row-level security on this table`
+        });
+      }
+    }
+    for (const policy of read.policies) {
+      if (hasAnyExpression(policy)) continue;
+      findings.push({
+        kind: "grants-nothing",
+        table: read.table,
+        policy: policy.name,
+        detail: "the policy carries neither a USING nor a WITH CHECK expression, so it permits nothing and only the policies beside it decide what this table allows",
+        fix: (policy.for ?? "all").toLowerCase() === "insert" ? "give it a WITH CHECK expression, which is the only one INSERT consults" : "give it a USING expression, and a WITH CHECK too where writes need a different rule"
+      });
+    }
+  }
+  const policies = tables.reduce((n, t) => n + t.policies.length, 0);
+  return {
+    schema: schemaPath,
+    dialect: analysis.dialect,
+    ok: findings.length === 0,
+    counts: {
+      tables: analysis.tables.length,
+      withRls: tables.length,
+      policies,
+      findings: findings.length
+    },
+    tables,
+    findings,
+    ignoredByGeneratedCode: tables.map((t) => t.table)
+  };
+}
+function wrap4(text, indent, first = indent, width = 96) {
+  const words = text.split(/\s+/).filter(Boolean);
+  const lines = [];
+  let line = first;
+  let started = false;
+  for (const w of words) {
+    if (started && line.length + 1 + w.length > width) {
+      lines.push(line);
+      line = indent + w;
+    } else {
+      line = started ? `${line} ${w}` : line + w;
+      started = true;
+    }
+  }
+  if (started) lines.push(line);
+  return lines.join("\n");
+}
+function policyLine(policy) {
+  const bits = [(policy.for ?? "all").toUpperCase()];
+  if ((policy.as ?? "").toLowerCase() === "restrictive") bits.push("restrictive");
+  bits.push(policy.to?.length ? `to ${policy.to.join(", ")}` : "to public");
+  const carries = [policy.using ? "USING" : void 0, policy.withCheck ? "WITH CHECK" : void 0].filter(Boolean).join(" + ");
+  bits.push(carries || "no expression");
+  if (policy.linked) bits.push("linked");
+  return bits.join(", ");
+}
+function renderPolicyReport(report, style = PLAIN4) {
+  const chalk = style;
+  const out = [];
+  const plural = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
+  out.push(chalk.bold(`DRZL row-level security  ${report.schema}`));
+  out.push(
+    chalk.dim(
+      `${report.dialect}, ${plural(report.counts.withRls, "table")} under RLS, ${plural(report.counts.policies, "policy").replace("policys", "policies")}`
+    )
+  );
+  out.push("");
+  if (!report.counts.withRls) {
+    out.push(chalk.green("No table in this schema uses row-level security."));
+    if (report.dialect !== "postgres" && report.dialect !== "cockroach") {
+      out.push(chalk.dim(`  ${report.dialect} has no row-level security to declare.`));
+    } else {
+      out.push(chalk.dim("  No table calls .enableRLS() and none declares a pgPolicy."));
+    }
+    return out.join("\n");
+  }
+  const denied = report.findings.filter((f) => f.kind === "denied");
+  if (denied.length) {
+    out.push(chalk.red("These tables refuse the operation your generated code performs"));
+    out.push(
+      chalk.dim(
+        wrap4(
+          "A table under row-level security permits only what a policy grants. The generated service still compiles and its return type still promises rows.",
+          "  "
+        )
+      )
+    );
+    out.push("");
+    for (const f of denied) {
+      out.push(`  ${chalk.dim("-")} ${chalk.bold(f.table)} ${chalk.dim(f.command ?? "everything")}`);
+      out.push(wrap4(f.detail, "      "));
+      if (f.fix) out.push(chalk.dim(wrap4(f.fix, "      ", "      Close it: ")));
+      out.push("");
+    }
+  }
+  const dead = report.findings.filter((f) => f.kind === "grants-nothing");
+  if (dead.length) {
+    out.push(chalk.yellow("These policies grant nothing"));
+    out.push(
+      chalk.dim(
+        wrap4(
+          "A policy with neither expression is not a permissive default. Measured against Postgres 18.3: a lone FOR INSERT policy carrying no WITH CHECK refused every insert.",
+          "  "
+        )
+      )
+    );
+    out.push("");
+    for (const f of dead) {
+      out.push(`  ${chalk.dim("-")} ${chalk.bold(f.table)}.${f.policy}`);
+      out.push(wrap4(f.detail, "      "));
+      if (f.fix) out.push(chalk.dim(wrap4(f.fix, "      ", "      Close it: ")));
+      out.push("");
+    }
+  }
+  out.push(chalk.cyan("The policies each table carries"));
+  out.push(
+    chalk.dim(
+      wrap4(
+        "Whether these apply to the role your application connects as is the one question this report cannot answer for you.",
+        "  "
+      )
+    )
+  );
+  out.push("");
+  for (const t of report.tables) {
+    const flag = t.declaredRls ? "enableRLS()" : "RLS on, implied by its policies";
+    out.push(`  ${chalk.dim("-")} ${chalk.bold(t.table)} ${chalk.dim(`(${flag})`)}`);
+    if (!t.policies.length) {
+      out.push(chalk.dim("      no policies"));
+    }
+    for (const p of t.policies) {
+      out.push(`      ${p.name}: ${chalk.dim(policyLine(p))}`);
+    }
+    const permitted = COMMANDS.filter((c) => t.grants[c]);
+    out.push(
+      chalk.dim(`      permits: ${permitted.length ? permitted.join(", ") : "nothing"}`)
+    );
+    out.push("");
+  }
+  out.push(chalk.yellow("What DRZL generates does not know about any of this"));
+  out.push(
+    chalk.dim(
+      wrap4(
+        `No generator emits policy awareness, so a generated read path describes rows the caller may not be allowed to see, and a reader of the emitted types will believe otherwise. That is true of ${plural(report.ignoredByGeneratedCode.length, "table")} here, and it is a fact about DRZL rather than a defect in your schema.`,
+        "  "
+      )
+    )
+  );
+  out.push("");
+  out.push(
+    chalk.dim(
+      `${plural(report.counts.findings, "finding")} across ${plural(report.counts.withRls, "table")} under row-level security.`
+    )
+  );
+  return out.join("\n");
+}
+
 // src/drift.ts
 import { promises as fs2 } from "fs";
 import path2 from "path";
@@ -3309,7 +3753,10 @@ withOutputFlags(
   program.command("doctor").description("Report what DRZL cannot type or enforce in your schema, and why").argument("[schema]", "path to drizzle schema (TS); defaults to the schema in drzl.config").option("-c, --config <path>", "path to drzl.config, read when no schema argument is given").option("--strict", "exit 2 when anything is reported", false).option(
     "--constraints",
     "report what each side enforces that the other does not, instead of the usual findings"
-  ).option("--sql", "with --constraints, emit the statements alone, for redirecting to a migration")
+  ).option("--sql", "with --constraints, emit the statements alone, for redirecting to a migration").option(
+    "--policies",
+    "report the row-level security policies each table carries, and what they refuse"
+  )
 ).action(async (schema, opts) => {
   const out = outputFor(opts);
   {
@@ -3339,7 +3786,14 @@ withOutputFlags(
         process.exit(EXIT_FAILED);
         return;
       }
-      if (opts.constraints) {
+      if (opts.constraints && opts.policies) {
+        const msg = "--constraints and --policies are separate reports. Run one, then the other.";
+        if (opts.json) out.jsonData(jsonFailure("doctor", "DRZL_CLI_DOCTOR", msg));
+        else out.error("Doctor failed (DRZL_CLI_DOCTOR):", msg);
+        process.exit(EXIT_FAILED);
+        return;
+      }
+      if (opts.constraints || opts.policies) {
         const preflight = buildDoctorReport(analysis, schemaLabel);
         const fatal = preflight.findings.filter((f) => f.level === "error");
         if (fatal.length) {
@@ -3355,6 +3809,8 @@ withOutputFlags(
           process.exit(EXIT_FAILED);
           return;
         }
+      }
+      if (opts.constraints) {
         const drift = buildConstraintDriftReport(analysis, schemaLabel);
         const driftCode = opts.strict && drift.counts.schemaOnly ? EXIT_FINDINGS : EXIT_OK;
         if (opts.sql) {
@@ -3370,6 +3826,17 @@ withOutputFlags(
         process.exit(driftCode);
         return;
       }
+      if (opts.policies) {
+        const policies = buildPolicyReport(analysis, schemaLabel);
+        const policyCode = opts.strict && policies.counts.findings ? EXIT_FINDINGS : EXIT_OK;
+        if (opts.json)
+          out.data(
+            JSON.stringify({ command: "doctor", exitCode: policyCode, ...policies }, null, 2)
+          );
+        else out.data(renderPolicyReport(policies, out.outStyle));
+        process.exit(policyCode);
+        return;
+      }
       const report = buildDoctorReport(analysis, schemaLabel);
       const unreadable = report.findings.some((f) => f.level === "error");
       const code = unreadable ? EXIT_FAILED : opts.strict && report.findings.length ? EXIT_FINDINGS : EXIT_OK;
@@ -3590,6 +4057,7 @@ withOutputFlags(
       analysis.tables = filterTables(narrowed.tables, cfg);
       for (const w of [...narrowed.warnings, ...filterWarnings]) warn(w);
       for (const w of wideColumnWarning(analysis.issues)) warn(w);
+      for (const w of authTableWarnings(analysis)) warn(w);
       const empty = nothingToGenerate({
         schema: source.schema,
         analyzed: narrowed.tables,