@cerbos/orm-prisma 3.3.0 → 4.0.0

package/lib/index.js

@@ -12,6 +12,71 @@ const CERBOS_TO_PRISMA_OPERATOR = {
     gt: "gt",
     ge: "gte",
 };
+// Directional operators mirror when their operands swap sides; symmetric operators are unchanged.
+const MIRRORED_OPERATOR = {
+    lt: "gt",
+    gt: "lt",
+    le: "ge",
+    ge: "le",
+};
+const RFC3339_MILLISECOND_TIMESTAMP = /^((?!0000)\d{4})-(\d{2})-(\d{2})[Tt](?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.(\d{1,9}))?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+const MIN_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse("0001-01-01T00:00:00.000Z");
+const MAX_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse("9999-12-31T23:59:59.999Z");
+function normalizeRfc3339Milliseconds(value) {
+    const match = RFC3339_MILLISECOND_TIMESTAMP.exec(value);
+    const yearText = match?.[1];
+    const monthText = match?.[2];
+    const dayText = match?.[3];
+    const fraction = match?.[4] ?? "";
+    if (!yearText || !monthText || !dayText) {
+        throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    if ([...fraction.slice(3)].some((digit) => digit !== "0")) {
+        throw new Error(`Timestamp value exceeds millisecond precision: ${value}`);
+    }
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const calendarDate = new Date(0);
+    calendarDate.setUTCHours(0, 0, 0, 0);
+    calendarDate.setUTCFullYear(year, month - 1, day);
+    if (calendarDate.getUTCFullYear() !== year ||
+        calendarDate.getUTCMonth() !== month - 1 ||
+        calendarDate.getUTCDate() !== day) {
+        throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    const milliseconds = Date.parse(value);
+    if (Number.isNaN(milliseconds)) {
+        throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    if (milliseconds < MIN_RFC3339_TIMESTAMP_MILLISECONDS ||
+        milliseconds > MAX_RFC3339_TIMESTAMP_MILLISECONDS) {
+        throw new Error(`Timestamp value is outside CEL's supported instant range: ${value}`);
+    }
+    return new Date(milliseconds).toISOString();
+}
+/**
+ * Normalize a binary comparison to field-side-first. The planner preserves policy source
+ * order, so a constant may precede the field it constrains (`1 < R.attr.x` arrives as
+ * `lt(value, variable)`) — swap the operands and mirror directional operators so downstream
+ * handlers can assume the field/expression side is first. Without this, value-first
+ * comparisons are silently inverted (#256).
+ */
+function normalizeBinaryOperands(operator, operands) {
+    const first = operands[0];
+    const second = operands[1];
+    if (operands.length === 2 &&
+        first !== undefined &&
+        second !== undefined &&
+        isValueOperand(first) &&
+        !isValueOperand(second)) {
+        return {
+            operator: MIRRORED_OPERATOR[operator] ?? operator,
+            operands: [second, first],
+        };
+    }
+    return { operator, operands };
+}
 function isNamedOperand(operand) {
     return "name" in operand && typeof operand.name === "string";
 }
@@ -30,6 +95,137 @@ function assertDefined(value, message) {
     }
     return value;
 }
+// Operators whose second operand is a lambda that binds an iteration variable.
+const LAMBDA_BINDING_OPERATORS = new Set([
+    "exists",
+    "exists_one",
+    "all",
+    "filter",
+    "map",
+    "except",
+]);
+/**
+ * Substitute a lambda iteration variable with a concrete collection element
+ * inside a lambda body. A bare reference to the variable becomes the element
+ * itself; a `variable.path.to.field` reference drills into the element. A
+ * nested collection macro whose lambda rebinds the same variable name shadows
+ * the outer variable, so substitution only descends into its collection
+ * operand.
+ */
+function substituteLambdaVariable(operand, variableName, element) {
+    if (isNamedOperand(operand)) {
+        if (operand.name === variableName) {
+            return { value: element };
+        }
+        if (operand.name.startsWith(`${variableName}.`)) {
+            let current = element;
+            for (const segment of operand.name
+                .slice(variableName.length + 1)
+                .split(".")) {
+                if (current === null ||
+                    typeof current !== "object" ||
+                    Array.isArray(current) ||
+                    !(segment in current) ||
+                    current[segment] === undefined) {
+                    throw new Error(`Cannot resolve "${operand.name}": collection element has no field "${segment}"`);
+                }
+                current = current[segment];
+            }
+            return { value: current };
+        }
+        return operand;
+    }
+    if (isOperatorOperand(operand)) {
+        if (LAMBDA_BINDING_OPERATORS.has(operand.operator) &&
+            operand.operands.length === 2) {
+            const [nestedCollection, nestedLambda] = operand.operands;
+            if (nestedCollection !== undefined &&
+                nestedLambda !== undefined &&
+                isOperatorOperand(nestedLambda) &&
+                nestedLambda.operator === "lambda") {
+                const nestedVariable = nestedLambda.operands[1];
+                if (nestedVariable !== undefined &&
+                    isNamedOperand(nestedVariable) &&
+                    nestedVariable.name === variableName) {
+                    // The nested lambda shadows our variable: substitute only in the
+                    // collection operand.
+                    return {
+                        operator: operand.operator,
+                        operands: [
+                            substituteLambdaVariable(nestedCollection, variableName, element),
+                            nestedLambda,
+                        ],
+                    };
+                }
+            }
+        }
+        return {
+            operator: operand.operator,
+            operands: operand.operands.map((o) => substituteLambdaVariable(o, variableName, element)),
+        };
+    }
+    return operand;
+}
+/**
+ * Fold a collection macro whose collection operand is a literal value list.
+ *
+ * The planner emits this shape when a known-value collection (typically a
+ * folded principal attribute) has more than 10 elements — at 10 or fewer it
+ * unrolls `exists`/`all` into an or/and chain itself (cerbos/cerbos#2570,
+ * cerbos/cerbos#2817; `maxItems = 10` in the planner's struct matcher). Apply
+ * the same fold here so the translated filter does not depend on which side of
+ * that threshold the collection lands: substitute each element into the lambda
+ * body and combine the per-element filters with OR (`exists`) or AND (`all`).
+ *
+ * An empty list yields `{OR: []}` / `{AND: []}`, which Prisma evaluates to
+ * match-nothing / match-everything — exactly CEL's `exists`/`all` semantics
+ * over an empty collection.
+ */
+function handleKnownValueCollectionOperator(operator, collection, lambda, mapper, negated) {
+    if (operator !== "exists" && operator !== "all") {
+        throw new Error(`${operator} over a literal collection value is not supported. ` +
+            "Only exists() and all() can be folded into a flat filter.");
+    }
+    const elements = collection.value;
+    if (!Array.isArray(elements)) {
+        throw new Error(`${operator} over a literal collection requires a list value`);
+    }
+    if (!isOperatorOperand(lambda) || lambda.operator !== "lambda") {
+        throw new Error(`Second operand of ${operator} must be a lambda expression`);
+    }
+    if (lambda.operands.length !== 2) {
+        throw new Error(`${operator} over a literal collection supports single-variable lambdas only`);
+    }
+    const body = assertDefined(lambda.operands[0], "Lambda expression must provide a condition");
+    const variable = assertDefined(lambda.operands[1], "Lambda variable must have a name");
+    if (!isNamedOperand(variable)) {
+        throw new Error("Lambda variable must have a name");
+    }
+    const filters = elements.map((element) => {
+        const substituted = substituteLambdaVariable(body, variable.name, element);
+        return negated
+            ? buildNegatedFilter(substituted, mapper)
+            : buildPrismaFilterFromCerbosExpression(substituted, mapper);
+    });
+    const combinesWithOr = operator === "exists" ? !negated : negated;
+    return combinesWithOr ? { OR: filters } : { AND: filters };
+}
+function tryHandleKnownValueCollectionOperator(operator, operands, mapper, negated) {
+    if (operands.length !== 2) {
+        return undefined;
+    }
+    const collection = operands[0];
+    const lambda = operands[1];
+    if (collection === undefined ||
+        lambda === undefined ||
+        !isValueOperand(collection)) {
+        return undefined;
+    }
+    // A literal value list arrives when the planner could not unroll a macro
+    // over a known collection (more than 10 elements). Fold it before attempting
+    // relation resolution because there is no relation mapping for a literal.
+    return handleKnownValueCollectionOperator(operator, collection, lambda, mapper, negated);
+}
 function getLeafField(path) {
     const fieldName = path[path.length - 1];
     if (!fieldName) {
@@ -93,24 +289,358 @@ function buildFieldDirectOrInFilter(fieldRef, values) {
         : { [fieldName]: { in: values } };
     return wrapRelations(fieldRef.relations, baseFilter);
 }
+function buildMembershipFilter(fieldRef, values) {
+    const nonNullValues = values.filter((value) => value !== null);
+    const filters = [];
+    if (nonNullValues.length > 0 || values.length === 0) {
+        filters.push(buildFieldDirectOrInFilter(fieldRef, nonNullValues));
+    }
+    if (nonNullValues.length !== values.length) {
+        filters.push(buildFieldDirectOrInFilter(fieldRef, [null]));
+    }
+    if (filters.length === 1) {
+        return assertDefined(filters[0], "Membership filter is missing");
+    }
+    return { OR: filters };
+}
+function buildAlwaysTrueFilter() {
+    return {};
+}
+let lambdaScopes = [];
+let rootModelName;
 /**
  * Converts a Cerbos query plan to a Prisma filter.
  */
-function queryPlanToPrisma({ queryPlan, mapper = {}, }) {
+function queryPlanToPrisma({ queryPlan, mapper = {}, model, }) {
     switch (queryPlan.kind) {
         case core_1.PlanKind.ALWAYS_ALLOWED:
             return { kind: core_1.PlanKind.ALWAYS_ALLOWED };
         case core_1.PlanKind.ALWAYS_DENIED:
             return { kind: core_1.PlanKind.ALWAYS_DENIED };
-        case core_1.PlanKind.CONDITIONAL:
+        case core_1.PlanKind.CONDITIONAL: {
+            lambdaScopes = [];
+            rootModelName = model;
+            const condition = constantFoldExpression(hoistOuterScopeReferences(queryPlan.condition, []));
+            if (isValueOperand(condition)) {
+                // Real PDP plans fold constant conditions to ALWAYS_ALLOWED/ALWAYS_DENIED before
+                // they reach the adapter; this can only surface with hand-crafted plans.
+                if (condition.value === true) {
+                    return { kind: core_1.PlanKind.CONDITIONAL, filters: {} };
+                }
+                // Prisma has no model-agnostic always-false `where` shape: empty logical arrays
+                // are ignored.
+                throw new Error("A constant-false conditional predicate must be folded by the Cerbos planner");
+            }
             return {
                 kind: core_1.PlanKind.CONDITIONAL,
-                filters: buildPrismaFilterFromCerbosExpression(queryPlan.condition, mapper),
+                filters: buildPrismaFilterFromCerbosExpression(condition, mapper),
             };
+        }
         default:
             throw Error(`Invalid query plan.`);
     }
 }
+const COLLECTION_OPERATORS = new Set([
+    "exists",
+    "exists_one",
+    "all",
+    "except",
+    "filter",
+]);
+function mentionsVariable(expr, variableName) {
+    if (isNamedOperand(expr)) {
+        return (expr.name === variableName || expr.name.startsWith(variableName + "."));
+    }
+    if (isOperatorOperand(expr)) {
+        return expr.operands.some((operand) => mentionsVariable(operand, variableName));
+    }
+    return false;
+}
+function isOuterScopeName(name, enclosingVariables) {
+    return !enclosingVariables.some((variable) => name === variable || name.startsWith(variable + "."));
+}
+/** Replaces every occurrence of the bare named operand `name` with a boolean constant. */
+function substituteNamedOperand(expr, name, value) {
+    if (isNamedOperand(expr)) {
+        return expr.name === name ? { value } : expr;
+    }
+    if (isOperatorOperand(expr)) {
+        return {
+            operator: expr.operator,
+            operands: expr.operands.map((operand) => substituteNamedOperand(operand, name, value)),
+        };
+    }
+    return expr;
+}
+/**
+ * Finds a bare boolean reference to an OUTER column (root or enclosing lambda scope) in a
+ * boolean position of a lambda body: a direct operand of and/or/not, a ternary condition, or
+ * the body itself.
+ */
+function findOuterBooleanReference(expr, enclosingVariables) {
+    if (isNamedOperand(expr)) {
+        return isOuterScopeName(expr.name, enclosingVariables)
+            ? expr.name
+            : undefined;
+    }
+    if (!isOperatorOperand(expr)) {
+        return undefined;
+    }
+    const booleanPositions = [];
+    switch (expr.operator) {
+        case "and":
+        case "or":
+        case "not":
+            booleanPositions.push(...expr.operands);
+            break;
+        case "if":
+            booleanPositions.push(...expr.operands);
+            break;
+        default:
+            // Comparisons wrapping a ternary keep the outer reference in the ternary condition.
+            booleanPositions.push(...expr.operands.filter((operand) => isOperatorOperand(operand) &&
+                (operand.operator === "if" ||
+                    operand.operator === "and" ||
+                    operand.operator === "or" ||
+                    operand.operator === "not")));
+            break;
+    }
+    for (const operand of booleanPositions) {
+        const found = findOuterBooleanReference(operand, enclosingVariables);
+        if (found !== undefined) {
+            return found;
+        }
+    }
+    return undefined;
+}
+/**
+ * Rewrites lambda bodies that reference columns of an ENCLOSING scope (the root row, or an
+ * outer lambda's element) so that every filter lands on the model it belongs to. Without this,
+ * an outer column referenced inside `tags.exists(t, ...)` would be emitted as a field of the
+ * tag model. Two sound transforms, applied bottom-up:
+ *
+ * - Conjunct hoisting (exists only): `exists(c, P(c) && Q)` with row-constant Q becomes
+ *   `exists(c, P(c)) && Q`. Valid in three-valued logic (AND distributes over the per-element
+ *   OR), including the empty-collection case (both sides are FALSE).
+ * - Case split (any collection op): a bare outer boolean reference Q in a boolean position
+ *   becomes `(Q && op[Q:=true]) || (!Q && op[Q:=false]) || (Q && !Q)`. The contradiction arm
+ *   keeps the whole expression UNKNOWN (not FALSE) when Q is NULL-derived, mirroring the
+ *   guarded-ternary encoding.
+ */
+function hoistOuterScopeReferences(expr, enclosingVariables) {
+    if (!isOperatorOperand(expr)) {
+        return expr;
+    }
+    if (COLLECTION_OPERATORS.has(expr.operator) && expr.operands.length === 2) {
+        const [collection, lambda] = expr.operands;
+        if (collection !== undefined &&
+            lambda !== undefined &&
+            isOperatorOperand(lambda) &&
+            lambda.operator === "lambda" &&
+            lambda.operands.length === 2 &&
+            lambda.operands[1] !== undefined &&
+            isNamedOperand(lambda.operands[1])) {
+            const variable = lambda.operands[1];
+            const body = hoistOuterScopeReferences(assertDefined(lambda.operands[0], "Lambda requires a condition"), [...enclosingVariables, variable.name]);
+            const rebuild = (newBody) => ({
+                operator: expr.operator,
+                operands: [
+                    collection,
+                    { operator: "lambda", operands: [newBody, variable] },
+                ],
+            });
+            // Conjunct hoisting out of exists().
+            if (expr.operator === "exists" &&
+                isOperatorOperand(body) &&
+                body.operator === "and") {
+                const elementConjuncts = body.operands.filter((operand) => mentionsVariable(operand, variable.name));
+                const outerConjuncts = body.operands.filter((operand) => !mentionsVariable(operand, variable.name));
+                if (outerConjuncts.length > 0 && elementConjuncts.length > 0) {
+                    const innerBody = elementConjuncts.length === 1
+                        ? elementConjuncts[0]
+                        : { operator: "and", operands: elementConjuncts };
+                    return {
+                        operator: "and",
+                        operands: [rebuild(innerBody), ...outerConjuncts],
+                    };
+                }
+            }
+            // Case split on a bare outer boolean reference.
+            const outerRef = findOuterBooleanReference(body, [
+                ...enclosingVariables,
+                variable.name,
+            ]);
+            if (outerRef !== undefined) {
+                const q = { name: outerRef };
+                const notQ = { operator: "not", operands: [q] };
+                return {
+                    operator: "or",
+                    operands: [
+                        {
+                            operator: "and",
+                            operands: [
+                                q,
+                                rebuild(substituteNamedOperand(body, outerRef, true)),
+                            ],
+                        },
+                        {
+                            operator: "and",
+                            operands: [
+                                notQ,
+                                rebuild(substituteNamedOperand(body, outerRef, false)),
+                            ],
+                        },
+                        // Contradiction arm: UNKNOWN when the reference is NULL-derived, never TRUE.
+                        { operator: "and", operands: [q, notQ] },
+                    ],
+                };
+            }
+            return rebuild(body);
+        }
+    }
+    return {
+        operator: expr.operator,
+        operands: expr.operands.map((operand) => hoistOuterScopeReferences(operand, enclosingVariables)),
+    };
+}
+const FOLDABLE_COMPARISON_OPERATORS = new Set([
+    "eq",
+    "ne",
+    "lt",
+    "le",
+    "gt",
+    "ge",
+]);
+/**
+ * Bottom-up constant folding over the plan AST. Only shapes the case-split transform can
+ * produce need folding (constant ternary conditions, comparisons between two constants,
+ * logical operators with constant operands, collection macros with constant bodies); real
+ * planner output arrives pre-folded.
+ */
+function constantFoldExpression(expr) {
+    if (!isOperatorOperand(expr)) {
+        return expr;
+    }
+    const operands = expr.operands.map(constantFoldExpression);
+    const folded = { operator: expr.operator, operands };
+    switch (expr.operator) {
+        case "if": {
+            const [condition, thenBranch, elseBranch] = operands;
+            if (condition !== undefined && isValueOperand(condition)) {
+                if (typeof condition.value !== "boolean") {
+                    throw new Error("if (ternary) condition must be a boolean expression");
+                }
+                return assertDefined(condition.value ? thenBranch : elseBranch, "if (ternary) requires branch operands");
+            }
+            return folded;
+        }
+        case "and": {
+            if (operands.some((o) => isValueOperand(o) && o.value === false)) {
+                return { value: false };
+            }
+            const remaining = operands.filter((o) => !isValueOperand(o));
+            if (remaining.length === 0)
+                return { value: true };
+            if (remaining.length === 1)
+                return remaining[0];
+            return { operator: "and", operands: remaining };
+        }
+        case "or": {
+            if (operands.some((o) => isValueOperand(o) && o.value === true)) {
+                return { value: true };
+            }
+            const remaining = operands.filter((o) => !isValueOperand(o));
+            if (remaining.length === 0)
+                return { value: false };
+            if (remaining.length === 1)
+                return remaining[0];
+            return { operator: "or", operands: remaining };
+        }
+        case "not": {
+            const operand = operands[0];
+            if (operand !== undefined && isValueOperand(operand)) {
+                return { value: operand.value !== true };
+            }
+            return folded;
+        }
+        case "add":
+        case "sub":
+        case "mult":
+        case "div": {
+            const [left, right] = operands;
+            if (left !== undefined &&
+                right !== undefined &&
+                isValueOperand(left) &&
+                isValueOperand(right)) {
+                return {
+                    value: foldArithmetic(expr.operator, left.value, right.value),
+                };
+            }
+            return folded;
+        }
+        case "contains":
+        case "startsWith":
+        case "endsWith": {
+            const [receiver, needle] = operands;
+            if (receiver !== undefined &&
+                needle !== undefined &&
+                isValueOperand(receiver) &&
+                isValueOperand(needle) &&
+                typeof receiver.value === "string" &&
+                typeof needle.value === "string") {
+                const r = receiver.value;
+                const n = needle.value;
+                return {
+                    value: expr.operator === "contains"
+                        ? r.includes(n)
+                        : expr.operator === "startsWith"
+                            ? r.startsWith(n)
+                            : r.endsWith(n),
+                };
+            }
+            return folded;
+        }
+        case "exists":
+        case "all": {
+            const [collection, lambda] = operands;
+            if (collection !== undefined &&
+                lambda !== undefined &&
+                isOperatorOperand(lambda) &&
+                lambda.operator === "lambda" &&
+                lambda.operands[0] !== undefined &&
+                isValueOperand(lambda.operands[0])) {
+                const bodyValue = lambda.operands[0].value === true;
+                if (expr.operator === "exists" && !bodyValue)
+                    return { value: false };
+                if (expr.operator === "all" && bodyValue)
+                    return { value: true };
+                const sizeExpr = {
+                    operator: "size",
+                    operands: [collection],
+                };
+                // exists(c, true) is "collection is non-empty"; all(c, false) is "collection is empty".
+                return expr.operator === "exists"
+                    ? { operator: "gt", operands: [sizeExpr, { value: 0 }] }
+                    : { operator: "eq", operands: [sizeExpr, { value: 0 }] };
+            }
+            return folded;
+        }
+        default: {
+            if (FOLDABLE_COMPARISON_OPERATORS.has(expr.operator)) {
+                const [left, right] = operands;
+                if (left !== undefined &&
+                    right !== undefined &&
+                    isValueOperand(left) &&
+                    isValueOperand(right)) {
+                    return {
+                        value: evaluateConstantComparison(expr.operator, left.value, right.value),
+                    };
+                }
+            }
+            return folded;
+        }
+    }
+}
 /**
  * Resolves a field reference considering relations and nested fields.
  */
@@ -144,6 +674,7 @@ function resolveFieldReference(reference, mapper) {
             {
                 name,
                 type,
+                model: activeConfig.relation.model,
                 field: activeConfig.relation.field,
                 nestedMapper: fields,
             },
@@ -165,6 +696,7 @@ function resolveFieldReference(reference, mapper) {
                     relations.push({
                         name: nextConfig.relation.name,
                         type: nextConfig.relation.type,
+                        model: nextConfig.relation.model,
                         field: nextConfig.relation.field,
                         nestedMapper: nextConfig.relation.fields,
                     });
@@ -181,10 +713,17 @@ function resolveFieldReference(reference, mapper) {
                 }
             }
         }
-        return { path: field ? [field] : remainingParts, relations };
+        return {
+            path: field ? [field] : remainingParts,
+            relations,
+            valueType: activeConfig.valueType,
+        };
     }
     // Simple field mapping
-    return { path: [activeConfig?.field || reference] };
+    return {
+        path: [activeConfig?.field || reference],
+        valueType: activeConfig?.valueType,
+    };
 }
 /**
  * Determines the appropriate Prisma operator based on relation type.
@@ -231,6 +770,9 @@ function resolveOperand(operand, mapper) {
         return { value: operand.value };
     }
     else if (isOperatorOperand(operand)) {
+        if (operand.operator === "timestamp") {
+            return resolveTimestampOperand(operand, mapper);
+        }
         const folded = tryFoldValueExpression(operand, mapper);
         if (folded !== null)
             return { value: folded };
@@ -239,8 +781,25 @@ function resolveOperand(operand, mapper) {
     }
     throw new Error("Operand must have name, value, or be an expression");
 }
+function resolveTimestampOperand(expression, mapper) {
+    if (expression.operands.length !== 1) {
+        throw new Error("timestamp() requires exactly one operand");
+    }
+    const operand = assertDefined(expression.operands[0], "timestamp() requires an operand");
+    if (isNamedOperand(operand)) {
+        const fieldRef = resolveFieldReference(operand.name, mapper);
+        if (fieldRef.valueType !== "dateTime") {
+            throw new Error(`timestamp() field ${operand.name} must be mapped with valueType: \"dateTime\"`);
+        }
+        return fieldRef;
+    }
+    if (!isValueOperand(operand) || typeof operand.value !== "string") {
+        throw new Error("timestamp() requires a field reference or RFC 3339 string");
+    }
+    return { value: normalizeRfc3339Milliseconds(operand.value) };
+}
 function tryFoldValueExpression(expr, mapper) {
-    if (expr.operator !== "add")
+    if (!ARITHMETIC_OPERATORS.has(expr.operator))
         return null;
     const leftOp = expr.operands[0];
     const rightOp = expr.operands[1];
@@ -253,12 +812,23 @@ function tryFoldValueExpression(expr, mapper) {
     if (!isResolvedValue(right))
         return null;
     try {
-        return foldAdd(left.value, right.value);
+        return foldArithmetic(expr.operator, left.value, right.value);
     }
     catch {
         return null;
     }
 }
+/**
+ * Records that the lambda body being built touches a nullable element column, so the
+ * enclosing collection operator can add its three-valued-logic guard.
+ */
+function recordNullableElementField(config, defaultField) {
+    if (!config.nullable) {
+        return;
+    }
+    const scope = lambdaScopes[lambdaScopes.length - 1];
+    scope?.nullableFields.add(config.field || defaultField);
+}
 /**
  * Creates a scoped mapper for collection operations
  */
@@ -299,7 +869,9 @@ function createScopedMapper(collectionPath, variableName, fullMapper) {
                     field = strippedKey;
                 }
                 // Return the field config if it exists, otherwise create a default one
-                return currentConfig[field] || { field };
+                const fieldConfig = currentConfig[field] || { field };
+                recordNullableElementField(fieldConfig, field);
+                return fieldConfig;
             }
             return { field: strippedKey };
         }
@@ -338,15 +910,10 @@ function buildPrismaFilterFromCerbosExpression(expression, mapper) {
             if (!operand) {
                 throw new Error("not operator requires an operand");
             }
-            if (isNamedOperand(operand)) {
-                const { relations, ...fieldRef } = resolveFieldReference(operand.name, mapper);
-                if (!relations || relations.length === 0) {
-                    return buildFieldEqualsFilter(fieldRef, false);
-                }
-            }
-            return {
-                NOT: buildPrismaFilterFromCerbosExpression(operand, mapper),
-            };
+            return buildNegatedFilter(operand, mapper);
+        }
+        case "if": {
+            return handleBooleanTernaryOperator(operands, mapper);
         }
         case "eq":
         case "ne":
@@ -396,6 +963,306 @@ function buildPrismaFilterFromCerbosExpression(expression, mapper) {
             throw new Error(`Unsupported operator: ${operator}`);
     }
 }
+function containsCollectionOperator(expr) {
+    if (!isOperatorOperand(expr)) {
+        return false;
+    }
+    if (COLLECTION_OPERATORS.has(expr.operator)) {
+        return true;
+    }
+    return expr.operands.some(containsCollectionOperator);
+}
+/**
+ * Builds the filter for `!expr`. Plain field predicates negate correctly with Prisma's NOT
+ * (SQL three-valued logic keeps NULL rows excluded under both polarities), but relation
+ * subqueries collapse UNKNOWN to false at the EXISTS boundary, so `NOT(some(P))` would
+ * wrongly include rows whose elements make P UNKNOWN (a NULL element column is a missing
+ * attribute — a CEL error — on the check side, which Cerbos treats as deny). Negation is
+ * therefore pushed down to the collection operators, which encode CEL's exact error
+ * semantics:
+ *
+ * - exists(c,P) is TRUE with a true witness, FALSE if every element is definitively false,
+ *   and an ERROR otherwise — so `!exists` admits only rows with no P-match AND no
+ *   UNKNOWN-element (the nullable-field guard).
+ * - all(c,P) is FALSE only with a definitive false witness (a false witness absorbs error
+ *   elements) — so `!all` is `some(NOT P)`, which SQL already evaluates definitively.
+ */
+function buildNegatedFilter(operand, mapper) {
+    if (isNamedOperand(operand)) {
+        const { relations, ...fieldRef } = resolveFieldReference(operand.name, mapper);
+        if (!relations || relations.length === 0) {
+            return buildFieldEqualsFilter(fieldRef, false);
+        }
+        return {
+            NOT: buildPrismaFilterFromCerbosExpression(operand, mapper),
+        };
+    }
+    if (isOperatorOperand(operand) && containsCollectionOperator(operand)) {
+        switch (operand.operator) {
+            case "and":
+                return {
+                    OR: operand.operands.map((o) => buildNegatedFilter(o, mapper)),
+                };
+            case "or":
+                return {
+                    AND: operand.operands.map((o) => buildNegatedFilter(o, mapper)),
+                };
+            case "not":
+                return buildPrismaFilterFromCerbosExpression(assertDefined(operand.operands[0], "not operator requires an operand"), mapper);
+            case "exists":
+            case "all":
+            case "except":
+            case "exists_one":
+            case "filter":
+                return buildNegatedCollectionFilter(operand.operator, operand.operands, mapper);
+        }
+    }
+    return {
+        NOT: buildPrismaFilterFromCerbosExpression(operand, mapper),
+    };
+}
+function getTernaryOperands(operands) {
+    if (operands.length !== 3) {
+        throw new Error(`if (ternary) requires exactly 3 operands (condition, then, else), got ${operands.length}`);
+    }
+    return {
+        condition: assertDefined(operands[0], "if (ternary) requires a condition operand"),
+        thenBranch: assertDefined(operands[1], "if (ternary) requires a then operand"),
+        elseBranch: assertDefined(operands[2], "if (ternary) requires an else operand"),
+    };
+}
+function getConstantBooleanCondition(condition) {
+    if (!isValueOperand(condition)) {
+        return undefined;
+    }
+    if (typeof condition.value !== "boolean") {
+        throw new Error("if (ternary) condition must be a boolean expression");
+    }
+    return condition.value;
+}
+function buildBooleanBranchFilter(branch, mapper) {
+    if (!isValueOperand(branch)) {
+        return {
+            kind: "filter",
+            filter: buildPrismaFilterFromCerbosExpression(branch, mapper),
+        };
+    }
+    if (typeof branch.value !== "boolean") {
+        throw new Error("if (ternary) branch in boolean position must be a boolean");
+    }
+    return { kind: "constant", value: branch.value };
+}
+function buildFalseConditionFilter(condition, mapper) {
+    if (isValueOperand(condition)) {
+        throw new Error("Constant ternary conditions must be folded before use");
+    }
+    if (isNamedOperand(condition)) {
+        const fieldRef = resolveFieldReference(condition.name, mapper);
+        if (!fieldRef.relations || fieldRef.relations.length === 0) {
+            return buildFieldEqualsFilter(fieldRef, false);
+        }
+        return {
+            NOT: buildFieldEqualsFilter(fieldRef, true),
+        };
+    }
+    if (isOperatorOperand(condition) && condition.operator === "not") {
+        return buildPrismaFilterFromCerbosExpression(assertDefined(condition.operands[0], "not operator requires an operand"), mapper);
+    }
+    return {
+        NOT: buildPrismaFilterFromCerbosExpression(condition, mapper),
+    };
+}
+function buildGuardedTernaryFilter({ condition, thenFilter, elseFilter, mapper, }) {
+    const conditionTrue = buildPrismaFilterFromCerbosExpression(condition, mapper);
+    const conditionFalse = buildFalseConditionFilter(condition, mapper);
+    const guardedBranches = [];
+    if (thenFilter.kind === "filter") {
+        guardedBranches.push({ AND: [conditionTrue, thenFilter.filter] });
+    }
+    else if (thenFilter.value) {
+        guardedBranches.push(conditionTrue);
+    }
+    if (elseFilter.kind === "filter") {
+        guardedBranches.push({ AND: [conditionFalse, elseFilter.filter] });
+    }
+    else if (elseFilter.value) {
+        guardedBranches.push(conditionFalse);
+    }
+    // For a known condition this contradiction is false. If the condition is
+    // NULL/error-derived, both sides are SQL UNKNOWN, which keeps the whole
+    // ternary UNKNOWN under an outer NOT instead of authorizing the row.
+    guardedBranches.push({ AND: [conditionTrue, conditionFalse] });
+    return {
+        OR: guardedBranches,
+    };
+}
+function finalizeTernaryBranchPredicate(predicate) {
+    if (predicate.kind === "filter") {
+        return predicate.filter;
+    }
+    if (predicate.value) {
+        return buildAlwaysTrueFilter();
+    }
+    // Prisma has no model-agnostic always-false `where` shape: empty logical
+    // arrays are ignored. Real PDP plans fold this case to ALWAYS_DENIED.
+    throw new Error("A constant-false conditional predicate must be folded by the Cerbos planner");
+}
+function handleBooleanTernaryOperator(operands, mapper) {
+    const { condition, thenBranch, elseBranch } = getTernaryOperands(operands);
+    const constantCondition = getConstantBooleanCondition(condition);
+    if (constantCondition !== undefined) {
+        return finalizeTernaryBranchPredicate(buildBooleanBranchFilter(constantCondition ? thenBranch : elseBranch, mapper));
+    }
+    return buildGuardedTernaryFilter({
+        condition,
+        thenFilter: buildBooleanBranchFilter(thenBranch, mapper),
+        elseFilter: buildBooleanBranchFilter(elseBranch, mapper),
+        mapper,
+    });
+}
+function buildTernaryComparisonBranch({ operator, operands, ternaryIndex, branch, mapper, }) {
+    const substitutedOperands = operands.map((operand, index) => index === ternaryIndex ? branch : operand);
+    assertDefined(substitutedOperands[0], `${operator} requires a left operand`);
+    assertDefined(substitutedOperands[1], `${operator} requires a right operand`);
+    const normalized = normalizeBinaryOperands(operator, substitutedOperands);
+    const normalizedFirst = normalized.operands[0];
+    const normalizedSecond = normalized.operands[1];
+    if (normalized.operands.length === 2 &&
+        normalizedFirst !== undefined &&
+        normalizedSecond !== undefined &&
+        isValueOperand(normalizedFirst) &&
+        isValueOperand(normalizedSecond)) {
+        return {
+            kind: "constant",
+            value: evaluateConstantComparison(normalized.operator, normalizedFirst.value, normalizedSecond.value),
+        };
+    }
+    return {
+        kind: "filter",
+        filter: buildPrismaFilterFromCerbosExpression(normalized, mapper),
+    };
+}
+function tryHandleTernaryComparison(operator, operands, mapper) {
+    if (CERBOS_TO_PRISMA_OPERATOR[operator] === undefined) {
+        return null;
+    }
+    const ternaryIndex = operands.findIndex((operand) => isOperatorOperand(operand) && operand.operator === "if");
+    if (ternaryIndex === -1) {
+        return null;
+    }
+    if (operands.length !== 2) {
+        throw new Error(`${operator} with a ternary requires exactly 2 operands, got ${operands.length}`);
+    }
+    const ternary = assertDefined(operands[ternaryIndex], "Ternary comparison operand is missing");
+    if (!isOperatorOperand(ternary)) {
+        throw new Error("Ternary comparison operand must be an expression");
+    }
+    const { condition, thenBranch, elseBranch } = getTernaryOperands(ternary.operands);
+    const constantCondition = getConstantBooleanCondition(condition);
+    if (constantCondition !== undefined) {
+        return finalizeTernaryBranchPredicate(buildTernaryComparisonBranch({
+            operator,
+            operands,
+            ternaryIndex,
+            branch: constantCondition ? thenBranch : elseBranch,
+            mapper,
+        }));
+    }
+    return buildGuardedTernaryFilter({
+        condition,
+        thenFilter: buildTernaryComparisonBranch({
+            operator,
+            operands,
+            ternaryIndex,
+            branch: thenBranch,
+            mapper,
+        }),
+        elseFilter: buildTernaryComparisonBranch({
+            operator,
+            operands,
+            ternaryIndex,
+            branch: elseBranch,
+            mapper,
+        }),
+        mapper,
+    });
+}
+function evaluateConstantComparison(operator, left, right) {
+    switch (operator) {
+        case "eq":
+            return areValuesEqual(left, right);
+        case "ne":
+            return !areValuesEqual(left, right);
+        case "lt":
+        case "le":
+        case "gt":
+        case "ge": {
+            if (typeof left === "number" &&
+                typeof right === "number" &&
+                (Number.isNaN(left) || Number.isNaN(right))) {
+                return false;
+            }
+            if (!((typeof left === "number" && typeof right === "number") ||
+                (typeof left === "string" && typeof right === "string"))) {
+                throw new Error(`${operator} constant comparison requires two numbers or two strings`);
+            }
+            switch (operator) {
+                case "lt":
+                    return compareConstantValues(left, right) < 0;
+                case "le":
+                    return compareConstantValues(left, right) <= 0;
+                case "gt":
+                    return compareConstantValues(left, right) > 0;
+                case "ge":
+                    return compareConstantValues(left, right) >= 0;
+            }
+        }
+    }
+    throw new Error(`Unsupported constant comparison operator: ${operator}`);
+}
+function compareConstantValues(left, right) {
+    if (typeof left === "number" && typeof right === "number") {
+        return left === right ? 0 : left < right ? -1 : 1;
+    }
+    if (typeof left !== "string" || typeof right !== "string") {
+        throw new Error("Cannot order constant values of different types");
+    }
+    const leftCodePoints = Array.from(left, (character) => character.codePointAt(0));
+    const rightCodePoints = Array.from(right, (character) => character.codePointAt(0));
+    const sharedLength = Math.min(leftCodePoints.length, rightCodePoints.length);
+    for (let index = 0; index < sharedLength; index++) {
+        const leftCodePoint = leftCodePoints[index];
+        const rightCodePoint = rightCodePoints[index];
+        if (leftCodePoint !== rightCodePoint) {
+            return leftCodePoint < rightCodePoint ? -1 : 1;
+        }
+    }
+    return leftCodePoints.length === rightCodePoints.length
+        ? 0
+        : leftCodePoints.length < rightCodePoints.length
+            ? -1
+            : 1;
+}
+function areValuesEqual(left, right) {
+    if (Array.isArray(left)) {
+        return (Array.isArray(right) &&
+            left.length === right.length &&
+            left.every((value, index) => areValuesEqual(value, right[index])));
+    }
+    if (Array.isArray(right)) {
+        return false;
+    }
+    if (typeof left === "object" && left !== null) {
+        if (typeof right !== "object" || right === null) {
+            return false;
+        }
+        const leftKeys = Object.keys(left);
+        const rightKeys = Object.keys(right);
+        return (leftKeys.length === rightKeys.length &&
+            leftKeys.every((key) => key in right && areValuesEqual(left[key], right[key])));
+    }
+    return left === right;
+}
 function handleSizeComparison(operator, sizeOperand, valueOperand, mapper) {
     const collectionOperand = sizeOperand.operands[0];
     if (!collectionOperand || !isNamedOperand(collectionOperand)) {
@@ -434,6 +1301,11 @@ function handleSizeComparison(operator, sizeOperand, valueOperand, mapper) {
  * Helper function to process relational operators (eq, ne, lt, etc.)
  */
 function handleRelationalOperator(operator, operands, mapper) {
+    const ternaryFilter = tryHandleTernaryComparison(operator, operands, mapper);
+    if (ternaryFilter) {
+        return ternaryFilter;
+    }
+    ({ operator, operands } = normalizeBinaryOperands(operator, operands));
     const prismaOperator = CERBOS_TO_PRISMA_OPERATOR[operator];
     if (!prismaOperator) {
         throw new Error(`Unsupported operator: ${operator}`);
@@ -447,44 +1319,238 @@ function handleRelationalOperator(operator, operands, mapper) {
     if (isOperatorOperand(leftOperand) && leftOperand.operator === "size") {
         return handleSizeComparison(operator, leftOperand, rightOperand, mapper);
     }
-    const addOperand = [leftOperand, rightOperand].find((o) => isOperatorOperand(o) && o.operator === "add");
-    if (addOperand) {
-        const otherOperand = addOperand === leftOperand ? rightOperand : leftOperand;
-        return handleAddComparison(operator, addOperand, otherOperand, mapper);
+    const arithOperand = [leftOperand, rightOperand].find((o) => isOperatorOperand(o) && ARITHMETIC_OPERATORS.has(o.operator));
+    if (arithOperand) {
+        const otherOperand = arithOperand === leftOperand ? rightOperand : leftOperand;
+        return handleArithmeticComparison(operator, arithOperand, otherOperand, arithOperand === leftOperand, mapper);
+    }
+    const mapOperand = [leftOperand, rightOperand].find((o) => isOperatorOperand(o) && o.operator === "map");
+    if (mapOperand) {
+        throw new Error(`Direct comparison of map(...) to a value is not supported (operator: ${operator}). ` +
+            `Wrap the map() expression in hasIntersection(map(...), [...]) instead.`);
     }
     const left = resolveOperand(leftOperand, mapper);
-    const right = requireResolvedValue(resolveOperand(rightOperand, mapper), "Right operand must be a value");
+    const right = resolveOperand(rightOperand, mapper);
+    if (isResolvedFieldReference(left) && isResolvedFieldReference(right)) {
+        return buildFieldToFieldFilter(operator, leftOperand, left, rightOperand, right);
+    }
+    if (isResolvedValue(left) && isResolvedFieldReference(right)) {
+        return buildComparisonFilter(right, MIRRORED_OPERATOR[operator] ?? operator, left.value);
+    }
+    if (isResolvedValue(left) && isResolvedValue(right)) {
+        const matches = evaluateConstantComparison(operator, left.value, right.value);
+        if (matches) {
+            return buildAlwaysTrueFilter();
+        }
+        throw new Error("A constant-false conditional predicate must be folded by the Cerbos planner");
+    }
+    const rightValue = requireResolvedValue(right, "Right operand must be a value");
     if (isResolvedFieldReference(left)) {
-        return buildFieldFilter(left, prismaOperator, right.value);
+        return buildComparisonFilter(left, operator, rightValue.value);
+    }
+    return { [prismaOperator]: rightValue.value };
+}
+/**
+ * Builds a field-vs-constant comparison. Fractional constants against ordering (and
+ * equality) operators are emitted as a two-clause bracket because Prisma coerces filter
+ * values to the column's type: on an Int column, `gte: 1.5` is silently bound as `gte: 1`,
+ * inverting rows like aNumber == 1. Each bracket pairs the exact constant with its integer
+ * neighbor so the combination is correct BOTH for Float columns (the extra clause is
+ * redundant) and Int columns (whichever way Prisma truncates or floors the fraction).
+ */
+function buildComparisonFilter(fieldRef, operator, value) {
+    const prismaOperator = assertDefined(CERBOS_TO_PRISMA_OPERATOR[operator], `Unsupported operator: ${operator}`);
+    if (typeof value === "number" && !Number.isInteger(value)) {
+        const fieldName = getLeafField(fieldRef.path);
+        const lower = Math.floor(value);
+        const upper = Math.ceil(value);
+        const equalsBracket = {
+            AND: [
+                { [fieldName]: { equals: value } },
+                { [fieldName]: { gt: lower } },
+                { [fieldName]: { lt: upper } },
+            ],
+        };
+        let bracket;
+        switch (operator) {
+            case "gt":
+                bracket = {
+                    OR: [{ [fieldName]: { gt: value } }, { [fieldName]: { gte: upper } }],
+                };
+                break;
+            case "ge":
+                bracket = {
+                    AND: [{ [fieldName]: { gte: value } }, { [fieldName]: { gt: lower } }],
+                };
+                break;
+            case "lt":
+                bracket = {
+                    OR: [{ [fieldName]: { lt: value } }, { [fieldName]: { lte: lower } }],
+                };
+                break;
+            case "le":
+                bracket = {
+                    AND: [{ [fieldName]: { lte: value } }, { [fieldName]: { lt: upper } }],
+                };
+                break;
+            case "eq":
+                bracket = equalsBracket;
+                break;
+            case "ne":
+                bracket = { NOT: equalsBracket };
+                break;
+        }
+        if (bracket) {
+            return wrapRelations(fieldRef.relations, bracket);
+        }
+    }
+    return buildFieldFilter(fieldRef, prismaOperator, value);
+}
+/**
+ * Builds a column-vs-column comparison as a Prisma field reference. Prisma only supports
+ * references between fields of the SAME model, so the container is the root model for
+ * root-level comparisons and the relation's model inside a lambda; mixed-scope comparisons
+ * (an element column against an outer column) are cross-model and must fail loudly.
+ */
+function buildFieldToFieldFilter(operator, leftOperand, left, rightOperand, right) {
+    const prismaOperator = assertDefined(CERBOS_TO_PRISMA_OPERATOR[operator], `Unsupported operator: ${operator}`);
+    if (!isNamedOperand(leftOperand) || !isNamedOperand(rightOperand)) {
+        throw new Error("Field-to-field comparison requires two named operands");
+    }
+    const scope = lambdaScopes[lambdaScopes.length - 1];
+    let container;
+    if (scope) {
+        const prefix = scope.variableName + ".";
+        const leftInScope = leftOperand.name.startsWith(prefix);
+        const rightInScope = rightOperand.name.startsWith(prefix);
+        if (leftInScope !== rightInScope) {
+            throw new Error(`Cannot compare a collection element column with an outer column (${leftOperand.name} vs ${rightOperand.name}): ` +
+                "Prisma field references only work between fields of the same model");
+        }
+        if (leftInScope) {
+            container = scope.relationModel;
+            if (!container) {
+                throw new Error("Field-to-field comparison inside a collection requires `relation.model` in the mapper");
+            }
+        }
     }
-    return { [prismaOperator]: right.value };
+    if (container === undefined) {
+        if ((left.relations && left.relations.length > 0) ||
+            (right.relations && right.relations.length > 0)) {
+            throw new Error("Cannot compare columns across relations: Prisma field references only work between fields of the same model");
+        }
+        container = rootModelName;
+        if (!container) {
+            throw new Error("Field-to-field comparison requires the `model` option (the Prisma model name) to build a field reference");
+        }
+    }
+    const leftField = getLeafField(left.path);
+    const rightField = getLeafField(right.path);
+    return {
+        [leftField]: {
+            [prismaOperator]: { _ref: rightField, _container: container },
+        },
+    };
 }
 /**
  * Helper function to handle "in" operator
  */
 function handleInOperator(operands, mapper) {
-    const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-    const valueOperand = getValueOperand(operands, "Value operand is undefined");
-    const fieldRef = requireResolvedFieldReference(resolveOperand(nameOperand, mapper), "Name operand must resolve to a field reference");
-    const { value } = requireResolvedValue(resolveOperand(valueOperand, mapper), "Value operand must resolve to a value");
-    const values = Array.isArray(value) ? value : [value];
-    return buildFieldDirectOrInFilter(fieldRef, values);
+    if (operands.length !== 2) {
+        throw new Error("in requires exactly two operands");
+    }
+    const member = assertDefined(operands[0], "in requires a member operand");
+    const collection = assertDefined(operands[1], "in requires a collection operand");
+    if (isNamedOperand(member) && isValueOperand(collection)) {
+        const fieldRef = resolveFieldReference(member.name, mapper);
+        const values = Array.isArray(collection.value)
+            ? collection.value
+            : [collection.value];
+        return buildMembershipFilter(fieldRef, values);
+    }
+    if (isValueOperand(member) && isNamedOperand(collection)) {
+        return buildMembershipFilter(resolveFieldReference(collection.name, mapper), [member.value]);
+    }
+    if (isNamedOperand(member) && isNamedOperand(collection)) {
+        throw new Error("Membership between two database attributes is not supported: Prisma cannot compare a related element column with an outer scalar column");
+    }
+    throw new Error("in requires a field member and literal list, or a literal member and field collection");
 }
+// Upper bound on the IN-list produced when enumerating a constant receiver's substrings.
+const MAX_ENUMERATED_NEEDLES = 1000;
 /**
- * Helper function to handle string operators (contains, startsWith, endsWith)
+ * Helper function to handle string operators (contains, startsWith, endsWith).
+ *
+ * These operators are receiver-sensitive and the planner preserves policy source order:
+ * operand 0 is the receiver (haystack), operand 1 the needle. Swapping them silently
+ * inverts the match direction, so unlike symmetric comparisons they are never normalized.
  */
 function handleStringOperator(operator, operands, mapper) {
-    const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-    const valueOperand = getValueOperand(operands, "Value operand is undefined");
-    const fieldRef = requireResolvedFieldReference(resolveOperand(nameOperand, mapper), "Name operand must resolve to a field reference");
-    const { value } = requireResolvedValue(resolveOperand(valueOperand, mapper), "Value operand must resolve to a value");
-    if (typeof value !== "string") {
-        throw new Error(`${operator} operator requires string value`);
+    if (operands.length !== 2) {
+        throw new Error(`${operator} requires exactly two operands`);
     }
-    const fieldName = getLeafField(fieldRef.path);
-    return wrapRelations(fieldRef.relations, {
-        [fieldName]: { [operator]: value },
-    });
+    const receiver = resolveOperand(assertDefined(operands[0], `${operator} requires a receiver operand`), mapper);
+    const needle = resolveOperand(assertDefined(operands[1], `${operator} requires a needle operand`), mapper);
+    // Column receiver, constant needle: Prisma's LIKE-based filter.
+    if (isResolvedFieldReference(receiver) && isResolvedValue(needle)) {
+        const { value } = needle;
+        if (typeof value !== "string") {
+            throw new Error(`${operator} operator requires string value`);
+        }
+        // Prisma emits LIKE without an ESCAPE clause and does not escape wildcard characters,
+        // so a needle containing % or _ would match as a pattern instead of literally (e.g.
+        // startsWith("100%") wrongly matches "100xdone"). Fail loudly rather than filter wrong.
+        if (/[%_]/.test(value)) {
+            throw new Error(`Cannot translate ${operator} with a needle containing LIKE metacharacters (% or _): ` +
+                "Prisma does not escape wildcards in string filters");
+        }
+        const fieldName = getLeafField(receiver.path);
+        return wrapRelations(receiver.relations, {
+            [fieldName]: { [operator]: value },
+        });
+    }
+    // Constant receiver, column needle (e.g. `"a-b-c".contains(R.attr.x)`): enumerate every
+    // candidate needle the constant admits — prefixes for startsWith, suffixes for endsWith,
+    // substrings for contains — into an exact IN filter. No LIKE, so no escaping hazards; a
+    // NULL needle column stays excluded (CEL missing-attribute deny).
+    if (isResolvedValue(receiver) && isResolvedFieldReference(needle)) {
+        if (typeof receiver.value !== "string") {
+            throw new Error(`${operator} operator requires a string receiver`);
+        }
+        const haystack = receiver.value;
+        const candidates = new Set([""]);
+        if (operator === "startsWith") {
+            for (let i = 1; i <= haystack.length; i++) {
+                candidates.add(haystack.slice(0, i));
+            }
+        }
+        else if (operator === "endsWith") {
+            for (let i = 0; i < haystack.length; i++) {
+                candidates.add(haystack.slice(i));
+            }
+        }
+        else {
+            for (let start = 0; start < haystack.length; start++) {
+                for (let end = start + 1; end <= haystack.length; end++) {
+                    candidates.add(haystack.slice(start, end));
+                }
+            }
+        }
+        if (candidates.size > MAX_ENUMERATED_NEEDLES) {
+            throw new Error(`Cannot translate ${operator} with a constant receiver of this length: ` +
+                `enumerating its ${candidates.size} candidate needles exceeds the ${MAX_ENUMERATED_NEEDLES}-entry limit`);
+        }
+        const fieldName = getLeafField(needle.path);
+        return wrapRelations(needle.relations, {
+            [fieldName]: { in: [...candidates] },
+        });
+    }
+    if (isResolvedFieldReference(receiver) && isResolvedFieldReference(needle)) {
+        // A column-valued needle would need its LIKE metacharacters escaped per row, which
+        // Prisma's filters cannot do (and Prisma leaks wildcards from field references).
+        throw new Error(`Cannot translate ${operator} between two columns: Prisma cannot escape LIKE wildcards held in a column`);
+    }
+    throw new Error(`${operator} between two constants must be folded by the Cerbos planner`);
 }
 /**
  * Helper function to handle "isSet" operator
@@ -506,6 +1572,10 @@ function handleHasIntersectionOperator(operands, mapper) {
     if (operands.length !== 2) {
         throw new Error("hasIntersection requires exactly two operands");
     }
+    // Intersection is symmetric, and the planner preserves policy source order — e.g.
+    // `hasIntersection(["a"], R.attr.tags)` puts the constant list FIRST. Normalize to
+    // field/map-first (see #256).
+    ({ operands } = normalizeBinaryOperands("hasIntersection", operands));
     const leftOperand = assertDefined(operands[0], "hasIntersection requires a left operand");
     const rightOperand = assertDefined(operands[1], "hasIntersection requires a right operand");
     // Check if left operand is a map operation
@@ -536,12 +1606,39 @@ function handleHasIntersectionOperator(operands, mapper) {
         if (!isNamedOperand(projection)) {
             throw new Error("Invalid map lambda expression structure");
         }
-        // Use scoped mapper for resolving the projection
-        const resolved = resolveFieldReference(projection.name, scopedMapper);
+        // Use scoped mapper for resolving the projection, collecting nullable element columns.
+        const scope = {
+            variableName: variable.name,
+            relationModel: relations[relations.length - 1]?.model,
+            nullableFields: new Set(),
+            unknownFilters: [],
+        };
+        lambdaScopes.push(scope);
+        let resolved;
+        try {
+            resolved = resolveFieldReference(projection.name, scopedMapper);
+        }
+        finally {
+            lambdaScopes.pop();
+        }
         const fieldName = getLeafField(resolved.path);
-        return buildNestedRelationFilter(relations, {
+        const base = buildNestedRelationFilter(relations, {
             [fieldName]: { in: rightOperand.value },
         });
+        if (scope.nullableFields.size === 0) {
+            return base;
+        }
+        // CEL map() errors if ANY element is missing the projected attribute — even alongside a
+        // matching element — and Cerbos treats that error as deny. Exclude rows holding an
+        // element whose projected (nullable) column is NULL.
+        return {
+            AND: [
+                base,
+                {
+                    NOT: buildNestedRelationFilter(relations, buildNullWitnessFilter(scope.nullableFields)),
+                },
+            ],
+        };
     }
     // Handle regular field reference
     if (!isNamedOperand(leftOperand)) {
@@ -555,11 +1652,7 @@ function handleHasIntersectionOperator(operands, mapper) {
         throw new Error("hasIntersection requires an array value");
     }
     if (relations && relations.length > 0) {
-        const fieldName = getLeafField(path);
-        const fieldFilter = {
-            [fieldName]: { in: rightOperand.value },
-        };
-        return buildNestedRelationFilter(relations, fieldFilter);
+        return buildMembershipFilter({ path, relations }, rightOperand.value);
     }
     const fieldName = getLeafField(path);
     return { [fieldName]: { some: rightOperand.value } };
@@ -577,10 +1670,7 @@ function handleLambdaOperator(operands) {
         field: key.replace(`${variable.name}.`, ""),
     }));
 }
-/**
- * Helper function to handle collection operators (exists, all, except, filter)
- */
-function handleCollectionOperator(operator, operands, mapper) {
+function buildCollectionLambdaParts(operator, operands, mapper) {
     if (operands.length !== 2) {
         throw new Error(`${operator} requires exactly two operands`);
     }
@@ -603,13 +1693,33 @@ function handleCollectionOperator(operator, operands, mapper) {
     if (!relations || relations.length === 0) {
         throw new Error(`${operator} operator requires a relation mapping`);
     }
+    const head = assertDefined(relations[0], `${operator} operator requires a relation mapping`);
+    const restRelations = relations.slice(1);
+    const deepest = assertDefined(relations[relations.length - 1], `${operator} operator requires a relation mapping`);
     const lambdaConditionOperand = assertDefined(lambda.operands[0], "Lambda expression must provide a condition");
-    const lambdaCondition = buildPrismaFilterFromCerbosExpression(lambdaConditionOperand, // Use the condition part of the lambda
-    scopedMapper);
-    const relation = assertDefined(relations[0], `${operator} operator requires a relation mapping`);
+    const scope = {
+        variableName: variable.name,
+        relationModel: deepest.model,
+        nullableFields: new Set(),
+        unknownFilters: [],
+    };
+    lambdaScopes.push(scope);
+    let lambdaCondition;
+    try {
+        lambdaCondition = buildPrismaFilterFromCerbosExpression(lambdaConditionOperand, // Use the condition part of the lambda
+        scopedMapper);
+    }
+    finally {
+        lambdaScopes.pop();
+    }
     let filterValue = lambdaCondition;
-    // If the lambda condition already has a relation structure, merge it
-    if (lambdaCondition["AND"] || lambdaCondition["OR"]) {
+    if (restRelations.length > 0) {
+        // Chained collection reference (e.g. R.attr.a.b): the lambda's elements live at the END
+        // of the chain, so the element predicate must join through every intermediate hop.
+        filterValue = buildNestedRelationFilter(restRelations, lambdaCondition);
+    }
+    else if (lambdaCondition["AND"] || lambdaCondition["OR"]) {
+        // If the lambda condition already has a logical structure, use it as-is
         filterValue = lambdaCondition;
     }
     else {
@@ -622,37 +1732,162 @@ function handleCollectionOperator(operator, operands, mapper) {
         if (lambdaFieldValue === undefined) {
             throw new Error("Lambda condition field value cannot be undefined");
         }
-        const filterField = relation.field || defaultKey;
+        const filterField = head.field || defaultKey;
         filterValue = {
             [filterField]: lambdaFieldValue,
         };
     }
+    return {
+        head,
+        restRelations,
+        filterValue,
+        nullableFields: scope.nullableFields,
+        unknownFilters: scope.unknownFilters,
+    };
+}
+/** OR of `field IS NULL` checks for every nullable element column the lambda touched. */
+function buildNullWitnessFilter(nullableFields) {
+    const checks = [...nullableFields].map((field) => ({ [field]: null }));
+    if (checks.length === 1) {
+        return checks[0];
+    }
+    return { OR: checks };
+}
+function buildUnknownElementFilter(parts) {
+    const filters = [...parts.unknownFilters];
+    if (parts.nullableFields.size > 0) {
+        filters.push(buildNullWitnessFilter(parts.nullableFields));
+    }
+    if (filters.length === 0) {
+        return undefined;
+    }
+    if (filters.length === 1) {
+        return filters[0];
+    }
+    return { OR: filters };
+}
+function recordNestedCollectionUnknownFilter(filter) {
+    const enclosingScope = lambdaScopes[lambdaScopes.length - 1];
+    enclosingScope?.unknownFilters.push(filter);
+}
+/** Wraps an element-level filter through the full relation chain (head + rest). */
+function wrapCollectionElementFilter(parts, elementFilter) {
+    const inner = parts.restRelations.length > 0
+        ? buildNestedRelationFilter(parts.restRelations, elementFilter)
+        : elementFilter;
+    return { [parts.head.name]: { some: inner } };
+}
+function throwUnsupportedCollectionOperator(operator) {
+    if (operator === "exists_one") {
+        throw new Error("exists_one requires counting matching elements, which Prisma where-filters cannot express");
+    }
+    throw new Error("The filter() collection operator returns a list, not a boolean. " +
+        "It cannot be used as a standalone condition. " +
+        "Use exists() or combine filter() with size() instead.");
+}
+/**
+ * Helper function to handle collection operators (exists, all, except, filter)
+ */
+function handleCollectionOperator(operator, operands, mapper) {
+    const knownValueFilter = tryHandleKnownValueCollectionOperator(operator, operands, mapper, false);
+    if (knownValueFilter !== undefined) {
+        return knownValueFilter;
+    }
+    if (operator === "exists_one" || operator === "filter") {
+        throwUnsupportedCollectionOperator(operator);
+    }
+    const parts = buildCollectionLambdaParts(operator, operands, mapper);
+    const { head, filterValue, nullableFields } = parts;
     switch (operator) {
-        case "exists":
-            return { [relation.name]: { some: filterValue } };
-        case "filter":
-            throw new Error("The filter() collection operator returns a list, not a boolean. " +
-                "It cannot be used as a standalone condition. " +
-                "Use exists() or combine filter() with size() instead.");
+        case "exists": {
+            // A NULL element keeps the per-element predicate UNKNOWN, so it can never create a
+            // false positive here; a CEL error (deny) coincides with "no match" — no guard needed.
+            const filter = { [head.name]: { some: filterValue } };
+            const unknownElement = buildUnknownElementFilter(parts);
+            if (unknownElement !== undefined) {
+                recordNestedCollectionUnknownFilter({
+                    AND: [
+                        { NOT: filter },
+                        wrapCollectionElementFilter(parts, unknownElement),
+                    ],
+                });
+            }
+            return filter;
+        }
         case "except":
-            return { [relation.name]: { some: { NOT: filterValue } } };
-        case "exists_one":
+            return { [head.name]: { some: { NOT: filterValue } } };
+        case "all": {
+            if (parts.restRelations.length > 0) {
+                throw new Error("all() over a multi-hop relation chain is not supported");
+            }
+            const base = { [head.name]: { every: filterValue } };
+            if (nullableFields.size === 0) {
+                return base;
+            }
+            // CEL all() errors when any element evaluation errors without a false witness; SQL
+            // `every` would treat those elements as vacuously passing. Exclude rows holding any
+            // element whose referenced nullable column is NULL. (`every` already rejects rows
+            // with a definitive false witness, matching error absorption.)
+            return {
+                AND: [
+                    base,
+                    { [head.name]: { none: buildNullWitnessFilter(nullableFields) } },
+                ],
+            };
+        }
+        default:
+            throw new Error(`Unexpected operator: ${operator}`);
+    }
+}
+/**
+ * Builds the filter for a NEGATED collection operator, encoding CEL's error semantics (see
+ * buildNegatedFilter).
+ */
+function buildNegatedCollectionFilter(operator, operands, mapper) {
+    const knownValueFilter = tryHandleKnownValueCollectionOperator(operator, operands, mapper, true);
+    if (knownValueFilter !== undefined) {
+        return knownValueFilter;
+    }
+    if (operator === "exists_one" || operator === "filter") {
+        throwUnsupportedCollectionOperator(operator);
+    }
+    const parts = buildCollectionLambdaParts(operator, operands, mapper);
+    const { head, filterValue, nullableFields } = parts;
+    switch (operator) {
+        case "exists": {
+            const base = { NOT: { [head.name]: { some: filterValue } } };
+            const unknownElement = buildUnknownElementFilter(parts);
+            if (unknownElement === undefined) {
+                return base;
+            }
+            // !exists is TRUE only when every element is definitively false: no P-match AND no
+            // element whose evaluation is UNKNOWN (NULL column = missing attribute = CEL error).
             return {
-                [relation.name]: {
-                    some: filterValue,
-                },
                 AND: [
+                    base,
                     {
-                        [relation.name]: {
-                            every: {
-                                OR: [filterValue, { NOT: filterValue }],
-                            },
-                        },
+                        NOT: wrapCollectionElementFilter(parts, unknownElement),
                     },
                 ],
             };
+        }
         case "all":
-            return { [relation.name]: { every: filterValue } };
+            // !all is TRUE only with a definitive false witness, which also absorbs error
+            // elements — exactly `some(NOT P)` in SQL (NULL columns keep NOT P UNKNOWN).
+            return { [head.name]: { some: { NOT: filterValue } } };
+        case "except": {
+            // !except(c,P) = every element definitively matches P.
+            const base = { [head.name]: { none: { NOT: filterValue } } };
+            if (nullableFields.size === 0) {
+                return base;
+            }
+            return {
+                AND: [
+                    base,
+                    { [head.name]: { none: buildNullWitnessFilter(nullableFields) } },
+                ],
+            };
+        }
         default:
             throw new Error(`Unexpected operator: ${operator}`);
     }
@@ -697,60 +1932,152 @@ function handleMapOperator(operands, mapper) {
 function buildImpossibleFilter(fieldRef) {
     return buildFieldFilter(fieldRef, "in", []);
 }
-function handleAddComparison(operator, addExpr, otherOperand, mapper) {
-    const addLeftOp = assertDefined(addExpr.operands[0], "add operator requires a left operand");
-    const addRightOp = assertDefined(addExpr.operands[1], "add operator requires a right operand");
-    const addLeft = resolveOperand(addLeftOp, mapper);
-    const addRight = resolveOperand(addRightOp, mapper);
+const ARITHMETIC_OPERATORS = new Set(["add", "sub", "mult", "div"]);
+/**
+ * Translates `column ⊕ constant  CMP  value` (and its mirrored forms) by solving for the
+ * column: Prisma where-filters cannot express column arithmetic, but linear arithmetic with
+ * one constant side always rewrites to a plain comparison. Multiplying/dividing by a
+ * negative constant mirrors directional operators. The rewrite happens in IEEE double space,
+ * matching CEL: Cerbos attribute numbers are doubles, so this preserves check-time semantics
+ * (e.g. `n * 0.1 == 0.3` solves to an unrepresentable fraction and matches no integer row,
+ * exactly as CEL evaluates it).
+ */
+function handleArithmeticComparison(operator, arithExpr, otherOperand, arithIsLeft, mapper) {
+    const arithOp = arithExpr.operator;
+    const arithLeftOp = assertDefined(arithExpr.operands[0], `${arithOp} operator requires a left operand`);
+    const arithRightOp = assertDefined(arithExpr.operands[1], `${arithOp} operator requires a right operand`);
+    if (isOperatorOperand(otherOperand) &&
+        ARITHMETIC_OPERATORS.has(otherOperand.operator) &&
+        tryFoldValueExpression(otherOperand, mapper) === null) {
+        throw new Error("Arithmetic on both sides of a comparison is not supported: the expression cannot be solved to a plain column filter");
+    }
+    const arithLeft = resolveOperand(arithLeftOp, mapper);
+    const arithRight = resolveOperand(arithRightOp, mapper);
     const other = resolveOperand(otherOperand, mapper);
-    if (isResolvedValue(addLeft) && isResolvedValue(addRight)) {
-        const folded = foldAdd(addLeft.value, addRight.value);
-        const prismaOp = CERBOS_TO_PRISMA_OPERATOR[operator];
-        if (!prismaOp)
-            throw new Error(`Unsupported operator: ${operator}`);
-        if (isResolvedFieldReference(other)) {
-            return buildFieldFilter(other, prismaOp, folded);
+    // Fully constant arithmetic: fold and compare the other side against the result. The
+    // arithmetic side keeps its source position, so when the folded constant was written
+    // FIRST (`1 + 2 < f`), directional operators mirror to keep the field on the left.
+    if (isResolvedValue(arithLeft) && isResolvedValue(arithRight)) {
+        const folded = foldArithmetic(arithOp, arithLeft.value, arithRight.value);
+        if (!isResolvedFieldReference(other)) {
+            throw new Error(`${arithOp} with two values requires a field reference on the other side`);
         }
-        throw new Error("add with two values requires a field reference on the other side");
+        const effectiveOperator = arithIsLeft
+            ? (MIRRORED_OPERATOR[operator] ?? operator)
+            : operator;
+        return buildComparisonFilter(other, effectiveOperator, folded);
     }
     if (!isResolvedValue(other)) {
-        throw new Error("add operator with field references requires a value on the other side of the comparison");
+        throw new Error(`${arithOp} operator with field references requires a value on the other side of the comparison`);
     }
     let fieldRef;
-    let addValue;
+    let constant;
     let fieldIsLeft;
-    if (isResolvedFieldReference(addLeft) && isResolvedValue(addRight)) {
-        fieldRef = addLeft;
-        addValue = addRight.value;
+    if (isResolvedFieldReference(arithLeft) && isResolvedValue(arithRight)) {
+        fieldRef = arithLeft;
+        constant = arithRight.value;
         fieldIsLeft = true;
     }
-    else if (isResolvedValue(addLeft) && isResolvedFieldReference(addRight)) {
-        fieldRef = addRight;
-        addValue = addLeft.value;
+    else if (isResolvedValue(arithLeft) &&
+        isResolvedFieldReference(arithRight)) {
+        fieldRef = arithRight;
+        constant = arithLeft.value;
         fieldIsLeft = false;
     }
     else {
-        throw new Error("add operator requires exactly one field reference and one value, or two values");
-    }
-    if (operator !== "eq" && operator !== "ne") {
-        throw new Error(`Operator ${operator} is not supported with add and field references`);
-    }
-    const solvedValue = solveAdd(other.value, addValue, fieldIsLeft);
-    if (solvedValue === null) {
-        if (operator === "eq")
-            return buildImpossibleFilter(fieldRef);
-        return {};
+        throw new Error(`${arithOp} operator requires exactly one field reference and one value, or two values`);
+    }
+    // The comparison operator was normalized arithmetic-side-first by the caller; if the
+    // arithmetic was written on the RIGHT of the comparison, direction was already mirrored.
+    let effectiveOperator = arithIsLeft
+        ? operator
+        : (MIRRORED_OPERATOR[operator] ?? operator);
+    // String concatenation solving (eq/ne only).
+    if (arithOp === "add" && typeof constant === "string") {
+        if (effectiveOperator !== "eq" && effectiveOperator !== "ne") {
+            throw new Error(`Operator ${effectiveOperator} is not supported with string concatenation`);
+        }
+        const solvedValue = solveAdd(other.value, constant, fieldIsLeft);
+        if (solvedValue === null) {
+            if (effectiveOperator === "eq")
+                return buildImpossibleFilter(fieldRef);
+            return {};
+        }
+        return buildComparisonFilter(fieldRef, effectiveOperator, solvedValue);
+    }
+    if (typeof constant !== "number" || typeof other.value !== "number") {
+        throw new Error(`${arithOp} comparison requires numeric operands`);
+    }
+    if (arithOp === "add" &&
+        (effectiveOperator === "eq" || effectiveOperator === "ne") &&
+        (!Number.isInteger(constant) || !Number.isInteger(other.value))) {
+        throw new Error("Fractional addition equality cannot be translated safely: solving IEEE-754 addition into a plain Prisma column comparison is not reversible");
+    }
+    let solved;
+    switch (arithOp) {
+        case "add":
+            solved = other.value - constant;
+            break;
+        case "sub":
+            if (fieldIsLeft) {
+                // f - c CMP v  ⇔  f CMP v + c
+                solved = other.value + constant;
+            }
+            else {
+                // c - f CMP v  ⇔  -f CMP v - c  ⇔  f mirror(CMP) c - v
+                solved = constant - other.value;
+                effectiveOperator =
+                    MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+            }
+            break;
+        case "mult":
+            if (constant === 0) {
+                throw new Error("Multiplication by a constant zero must be folded by the Cerbos planner");
+            }
+            solved = other.value / constant;
+            if (constant < 0) {
+                effectiveOperator =
+                    MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+            }
+            break;
+        case "div":
+            if (!fieldIsLeft) {
+                throw new Error("Division by a column is not supported: the comparison cannot be solved to a plain column filter");
+            }
+            if (constant === 0) {
+                throw new Error("Division by a constant zero is not supported");
+            }
+            solved = other.value * constant;
+            if (constant < 0) {
+                effectiveOperator =
+                    MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+            }
+            break;
+        default:
+            throw new Error(`Unsupported operator: ${arithOp}`);
     }
-    return buildFieldFilter(fieldRef, CERBOS_TO_PRISMA_OPERATOR[operator], solvedValue);
+    return buildComparisonFilter(fieldRef, effectiveOperator, solved);
 }
-function foldAdd(left, right) {
-    if (typeof left === "string" || typeof right === "string") {
+function foldArithmetic(operator, left, right) {
+    if (operator === "add" &&
+        (typeof left === "string" || typeof right === "string")) {
         return String(left) + String(right);
     }
-    if (typeof left === "number" && typeof right === "number") {
-        return left + right;
+    if (typeof left !== "number" || typeof right !== "number") {
+        throw new Error(`${operator} operator requires string or number operands`);
+    }
+    switch (operator) {
+        case "add":
+            return left + right;
+        case "sub":
+            return left - right;
+        case "mult":
+            return left * right;
+        case "div":
+            return left / right;
+        default:
+            throw new Error(`Unsupported operator: ${operator}`);
     }
-    throw new Error("add operator requires string or number operands");
 }
 function solveAdd(comparisonValue, addConstant, fieldIsLeft) {
     if (typeof comparisonValue === "string" && typeof addConstant === "string") {
@@ -891,6 +2218,21 @@ function handleOverlapsOperator(operands, mapper) {
     // identical conditions since the same segment pairs are compared in both.
     return validConditions[0];
 }
+/**
+ * Guards every hierarchy prefix that is about to become a Prisma `startsWith`.
+ *
+ * `startsWith` compiles to `LIKE` with no `ESCAPE` clause, so `%` and `_` in the prefix
+ * match as wildcards instead of literally and widen the filter past what the PDP allows.
+ * `[` is unsafe for a separate reason: SQL Server opens a character class on `[` even when
+ * an `ESCAPE` clause is declared, so it cannot be made literal at all. Fail loudly rather
+ * than emit a filter that admits denied rows.
+ */
+function assertLikeSafePrefix(prefix) {
+    if (/[%_\[]/.test(prefix)) {
+        throw new Error("Cannot translate hierarchy prefix matching with LIKE metacharacters (%, _ or [): " +
+            "Prisma emits LIKE without an ESCAPE clause, and [ opens a character class on SQL Server even with one");
+    }
+}
 function handleFieldOverlaps(left, right) {
     if (left.type === "field" && right.type === "field") {
         throw new Error("overlaps: cannot compare two field-reference hierarchies");
@@ -908,7 +2250,9 @@ function handleFieldOverlaps(left, right) {
         conditions.push(buildFieldFilter(field.fieldRef, "in", strictPrefixes));
     }
     conditions.push(buildFieldFilter(field.fieldRef, "equals", otherRaw));
-    conditions.push(buildFieldFilter(field.fieldRef, "startsWith", otherRaw + delimiter));
+    const prefix = otherRaw + delimiter;
+    assertLikeSafePrefix(prefix);
+    conditions.push(buildFieldFilter(field.fieldRef, "startsWith", prefix));
     if (conditions.length === 1)
         return conditions[0];
     return { OR: conditions };
@@ -949,6 +2293,7 @@ function handleAncestorDescendantOperator(operands, mapper, direction) {
     const descendant = direction === "ancestor" ? right : left;
     if (ancestor.type === "constant" && descendant.type === "field") {
         const prefix = ancestor.segments.join(descendant.delimiter) + descendant.delimiter;
+        assertLikeSafePrefix(prefix);
         return buildFieldFilter(descendant.fieldRef, "startsWith", prefix);
     }
     if (ancestor.type === "field" && descendant.type === "constant") {