@cerbos/orm-prisma 3.3.0 → 4.0.0

package/src/index.test.ts

@@ -176,6 +176,7 @@ const fixtureResources: Prisma.ResourceCreateInput[] = [
     aNumber: 1,
     aString: "string",
     aOptionalString: "optionalString",
+    aOptionalBool: true,
     createdBy: {
       connect: {
         id: "user1",
@@ -207,6 +208,7 @@ const fixtureResources: Prisma.ResourceCreateInput[] = [
     aBool: false,
     aNumber: 2,
     aString: "string2",
+    aOptionalBool: false,
     createdBy: {
       connect: {
         id: "user2",
@@ -450,6 +452,109 @@ describe("Field Operations", () => {
       );
     });
 
+    test("conditional - eq - bool false", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "equal-bool-false",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "eq",
+          operands: [{ name: "request.resource.attr.aBool" }, { value: false }],
+        }
+      );
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aBool": { field: "aBool" },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: { aBool: { equals: false } },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id)).toEqual(
+        fixtureResources.filter((a) => a.aBool === false).map((r) => r.id)
+      );
+    });
+
+    test("conditional - eq - field to field", async () => {
+      // TODO: field-to-field comparison support is a follow-up — Prisma adapter
+      // currently only handles field-to-value. This test pins the plan shape and
+      // asserts the adapter throws so behaviour is locked in.
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "equal-field-to-field",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "eq",
+          operands: [
+            { name: "request.resource.attr.aString" },
+            { name: "request.resource.attr.id" },
+          ],
+        }
+      );
+
+      // Without the model name there is no container for a Prisma field reference.
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan,
+          mapper: {
+            "request.resource.attr.aString": { field: "aString" },
+            "request.resource.attr.id": { field: "id" },
+          },
+        })
+      ).toThrow(
+        "Field-to-field comparison requires the `model` option (the Prisma model name) to build a field reference"
+      );
+
+      // With the model name, the comparison compiles to a Prisma field reference.
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aString": { field: "aString" },
+          "request.resource.attr.id": { field: "id" },
+        },
+        model: "Resource",
+      });
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          aString: { equals: { _ref: "id", _container: "Resource" } },
+        },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id).sort()).toEqual(
+        fixtureResources
+          .filter((r) => r.aString === r.id)
+          .map((r) => r.id)
+          .sort()
+      );
+    });
+
     test("conditional - ne", async () => {
       const queryPlan = await cerbos.planResources({
         principal: { id: "user1", roles: ["USER"] },
@@ -1363,6 +1468,51 @@ describe("Field Operations", () => {
         fixtureResources.filter((a) => a.aOptionalString).map((r) => r.id)
       );
     });
+
+    test("conditional - isNotSet", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "is-not-set",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "eq",
+          operands: [
+            { name: "request.resource.attr.aOptionalString" },
+            { value: null },
+          ],
+        }
+      );
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aOptionalString": { field: "aOptionalString" },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: { aOptionalString: { equals: null } },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id).sort()).toEqual(
+        fixtureResources
+          .filter((a) => a.aOptionalString == null)
+          .map((r) => r.id)
+          .sort()
+      );
+    });
   });
 });
 
@@ -1417,6 +1567,53 @@ describe("Collection Operations", () => {
       );
     });
 
+    test("conditional - in - number list", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "in-number",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "in",
+          operands: [
+            { name: "request.resource.attr.aNumber" },
+            { value: [1, 2, 3] },
+          ],
+        }
+      );
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aNumber": { field: "aNumber" },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          aNumber: { in: [1, 2, 3] },
+        },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id).sort()).toEqual(
+        fixtureResources
+          .filter((r) => [1, 2, 3].includes(r.aNumber as number))
+          .map((r) => r.id)
+          .sort()
+      );
+    });
+
     test("conditional - in - scalar value", async () => {
       const queryPlan = createConditionalPlan({
         operator: "in",
@@ -1999,62 +2196,24 @@ describe("Collection Operations", () => {
         }
       );
 
-      const result = queryPlanToPrisma({
-        queryPlan,
-        mapper: {
-          "request.resource.attr.tags": {
-            relation: {
-              name: "tags",
-              type: "many",
-            },
-          },
-        },
-      });
-
-      expect(result).toStrictEqual({
-        kind: PlanKind.CONDITIONAL,
-        filters: {
-          tags: {
-            some: {
-              name: { equals: "public" },
-            },
-          },
-          AND: [
-            {
-              tags: {
-                every: {
-                  OR: [
-                    { name: { equals: "public" } },
-                    { NOT: { name: { equals: "public" } } },
-                  ],
-                },
+      // exists_one means EXACTLY one matching element, which requires counting matches —
+      // inexpressible in Prisma's where shape. The previous translation silently degraded
+      // to a plain exists (its `every: OR[P, NOT P]` clause was a tautology), returning
+      // wrong rows whenever a resource had two or more matches; it now fails loudly.
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan,
+          mapper: {
+            "request.resource.attr.tags": {
+              relation: {
+                name: "tags",
+                type: "many",
               },
             },
-          ],
-        },
-      });
-
-      if (result.kind !== PlanKind.CONDITIONAL) {
-        throw new Error("Expected CONDITIONAL result");
-      }
-
-      const query = await prisma.resource.findMany({
-        where: { ...result.filters },
-      });
-
-      expect(query.map((r) => r.id)).toEqual(
-        fixtureResources
-          .filter(
-            (a) =>
-              Array.isArray(a.tags?.connect) &&
-              a.tags?.connect
-                .map((t) => {
-                  return fixtureTags.find((f) => f.id === t.id);
-                })
-                .filter((t) => t?.id === "tag1" && t?.name === "public")
-                .length > 0
-          )
-          .map((r) => r.id)
+          },
+        })
+      ).toThrow(
+        "exists_one requires counting matching elements, which Prisma where-filters cannot express"
       );
     });
 
@@ -2276,30 +2435,229 @@ describe("Collection Operations", () => {
           .map((r) => r.id)
       );
     });
-  });
-});
-
-// Relations
-describe("Relations", () => {
-  describe("Simple Relations", () => {
-    describe("One-to-One", () => {
-      test("conditional - relation is", async () => {
-        const queryPlan = await cerbos.planResources({
-          principal: { id: "user1", roles: ["USER"] },
-          resource: { kind: "resource" },
-          action: "relation-is",
-        });
 
-        expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
-
-        const conditions = (queryPlan as PlanResourcesConditionalResponse)
-          .condition;
+    test("conditional - all with multi-clause lambda body (all-nested)", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "all-nested",
+      });
 
-        expect(conditions).toEqual({
-          operator: "eq",
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "all",
           operands: [
-            { name: "request.resource.attr.createdBy" },
-            { value: "user1" },
+            { name: "request.resource.attr.tags" },
+            {
+              operator: "lambda",
+              operands: [
+                {
+                  operator: "and",
+                  operands: [
+                    {
+                      operator: "eq",
+                      operands: [
+                        { name: "tag.name" },
+                        { value: "public" },
+                      ],
+                    },
+                    {
+                      operator: "ne",
+                      operands: [
+                        { name: "tag.id" },
+                        { value: "tag1" },
+                      ],
+                    },
+                  ],
+                },
+                { name: "tag" },
+              ],
+            },
+          ],
+        }
+      );
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.tags": {
+            relation: {
+              name: "tags",
+              type: "many",
+            },
+          },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          tags: {
+            every: {
+              AND: [
+                { name: { equals: "public" } },
+                { id: { not: "tag1" } },
+              ],
+            },
+          },
+        },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+
+      expect(query.map((r) => r.id).sort()).toEqual(
+        fixtureResources
+          .filter((r) => {
+            const connected = Array.isArray(r.tags?.connect)
+              ? r.tags!.connect.map((c) =>
+                  fixtureTags.find((ft) => ft.id === c.id)
+                )
+              : [];
+            return connected.every(
+              (t) => t?.name === "public" && t?.id !== "tag1"
+            );
+          })
+          .map((r) => r.id)
+          .sort()
+      );
+    });
+
+    test("conditional - map() compared to literal list throws (map-compared)", async () => {
+      // prisma does not support comparing `map(...)` directly to a list
+      // literal — `hasIntersection(map(...), [...])` is the supported form.
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "map-compared",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "eq",
+          operands: [
+            {
+              operator: "map",
+              operands: [
+                { name: "request.resource.attr.tags" },
+                {
+                  operator: "lambda",
+                  operands: [{ name: "t.id" }, { name: "t" }],
+                },
+              ],
+            },
+            { value: ["tag1", "tag2"] },
+          ],
+        }
+      );
+
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan,
+          mapper: {
+            "request.resource.attr.tags": {
+              relation: {
+                name: "tags",
+                type: "many",
+                fields: {
+                  id: { field: "id" },
+                },
+              },
+            },
+          },
+        })
+      ).toThrow(/map\(\.\.\.\) to a value is not supported/);
+    });
+
+    test("conditional - size(filter(...)) > 0 throws (filter-count-gt)", async () => {
+      // TODO(#232): prisma adapter supports size(R.attr.collection) > N but
+      // does not yet unwrap size(filter(R.attr.collection, lambda)) > N.
+      // Locks in current behavior.
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "filter-count-gt",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "gt",
+          operands: [
+            {
+              operator: "size",
+              operands: [
+                {
+                  operator: "filter",
+                  operands: [
+                    { name: "request.resource.attr.tags" },
+                    {
+                      operator: "lambda",
+                      operands: [
+                        {
+                          operator: "eq",
+                          operands: [
+                            { name: "t.name" },
+                            { value: "public" },
+                          ],
+                        },
+                        { name: "t" },
+                      ],
+                    },
+                  ],
+                },
+              ],
+            },
+            { value: 0 },
+          ],
+        }
+      );
+
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan,
+          mapper: {
+            "request.resource.attr.tags": {
+              relation: {
+                name: "tags",
+                type: "many",
+              },
+            },
+          },
+        })
+      ).toThrow();
+    });
+  });
+});
+
+// Relations
+describe("Relations", () => {
+  describe("Simple Relations", () => {
+    describe("One-to-One", () => {
+      test("conditional - relation is", async () => {
+        const queryPlan = await cerbos.planResources({
+          principal: { id: "user1", roles: ["USER"] },
+          resource: { kind: "resource" },
+          action: "relation-is",
+        });
+
+        expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+
+        const conditions = (queryPlan as PlanResourcesConditionalResponse)
+          .condition;
+
+        expect(conditions).toEqual({
+          operator: "eq",
+          operands: [
+            { name: "request.resource.attr.createdBy" },
+            { value: "user1" },
           ],
         });
 
@@ -4100,6 +4458,95 @@ describe("Complex Operations", () => {
       );
     });
 
+    test("conditional - or - leaf and exists", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "or-leaf-exists",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "or",
+          operands: [
+            {
+              operator: "eq",
+              operands: [
+                { name: "request.resource.attr.aBool" },
+                { value: true },
+              ],
+            },
+            {
+              operator: "exists",
+              operands: [
+                { name: "request.resource.attr.tags" },
+                {
+                  operator: "lambda",
+                  operands: [
+                    {
+                      operator: "eq",
+                      operands: [
+                        { name: "t.name" },
+                        { value: "public" },
+                      ],
+                    },
+                    { name: "t" },
+                  ],
+                },
+              ],
+            },
+          ],
+        }
+      );
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aBool": { field: "aBool" },
+          "request.resource.attr.tags": {
+            relation: {
+              name: "tags",
+              type: "many",
+            },
+          },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          OR: [
+            { aBool: { equals: true } },
+            { tags: { some: { name: { equals: "public" } } } },
+          ],
+        },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id).sort()).toEqual(
+        fixtureResources
+          .filter((r) => {
+            if (r.aBool) return true;
+            const tagRefs = Array.isArray(r.tags?.connect)
+              ? r.tags.connect
+              : [];
+            return tagRefs.some((tagRef) => {
+              const tag = fixtureTags.find((t) => t.id === tagRef.id);
+              return tag?.name === "public";
+            });
+          })
+          .map((r) => r.id)
+          .sort()
+      );
+    });
+
     test("conditional - relation multiple all", async () => {
       const queryPlan = await cerbos.planResources({
         principal: { id: "user1", roles: ["USER"] },
@@ -4394,54 +4841,58 @@ describe("Complex Operations", () => {
     });
   });
 
-  describe("Collection Operations", () => {
-    test("conditional - exists on nested collection", async () => {
+  describe("Negation Operations (DeMorgan)", () => {
+    test("conditional - not-and", async () => {
       const queryPlan = await cerbos.planResources({
         principal: { id: "user1", roles: ["USER"] },
         resource: { kind: "resource" },
-        action: "exists-nested-collection",
+        action: "not-and",
       });
 
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "not",
+          operands: [
+            {
+              operator: "and",
+              operands: [
+                {
+                  operator: "eq",
+                  operands: [
+                    { name: "request.resource.attr.aBool" },
+                    { value: true },
+                  ],
+                },
+                {
+                  operator: "ne",
+                  operands: [
+                    { name: "request.resource.attr.aString" },
+                    { value: "string" },
+                  ],
+                },
+              ],
+            },
+          ],
+        }
+      );
+
       const result = queryPlanToPrisma({
         queryPlan,
         mapper: {
-          "request.resource.attr.categories": {
-            relation: {
-              name: "categories",
-              type: "many",
-              fields: {
-                name: { field: "name" },
-                subCategories: {
-                  relation: {
-                    name: "subCategories",
-                    type: "many",
-                    fields: {
-                      name: { field: "name" },
-                    },
-                  },
-                },
-              },
-            },
-          },
+          "request.resource.attr.aBool": { field: "aBool" },
+          "request.resource.attr.aString": { field: "aString" },
         },
       });
 
       expect(result).toStrictEqual({
         kind: PlanKind.CONDITIONAL,
         filters: {
-          categories: {
-            some: {
-              AND: [
-                { name: { equals: "business" } },
-                {
-                  subCategories: {
-                    some: {
-                      name: { equals: "finance" },
-                    },
-                  },
-                },
-              ],
-            },
+          NOT: {
+            AND: [
+              { aBool: { equals: true } },
+              { aString: { not: "string" } },
+            ],
           },
         },
       });
@@ -4453,181 +4904,296 @@ describe("Complex Operations", () => {
       const query = await prisma.resource.findMany({
         where: { ...result.filters },
       });
-
       expect(query.map((r) => r.id)).toEqual(
         fixtureResources
-          .filter((r) => {
-            const categoryConnections = r.categories
-              ?.connect as Prisma.CategoryWhereUniqueInput[];
-            return categoryConnections?.some((categoryConnection) => {
-              const category = fixtureCategories.find(
-                (fc) => fc.id === categoryConnection.id
-              );
-              return (
-                category?.name === "business" &&
-                (
-                  category?.subCategories
-                    ?.connect as Prisma.SubCategoryWhereUniqueInput[]
-                )?.some(
-                  (sc) =>
-                    fixtureSubCategories.find((fsc) => fsc.id === sc.id)
-                      ?.name === "finance"
-                )
-              );
-            });
-          })
+          .filter((r) => !(r.aBool && r.aString != "string"))
           .map((r) => r.id)
       );
     });
 
-    test("isSet with nested relation", async () => {
+    test("conditional - not-or", async () => {
       const queryPlan = await cerbos.planResources({
         principal: { id: "user1", roles: ["USER"] },
         resource: { kind: "resource" },
-        action: "is-set-nested",
+        action: "not-or",
       });
 
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "not",
+          operands: [
+            {
+              operator: "or",
+              operands: [
+                {
+                  operator: "eq",
+                  operands: [
+                    { name: "request.resource.attr.aBool" },
+                    { value: true },
+                  ],
+                },
+                {
+                  operator: "ne",
+                  operands: [
+                    { name: "request.resource.attr.aString" },
+                    { value: "string" },
+                  ],
+                },
+              ],
+            },
+          ],
+        }
+      );
+
       const result = queryPlanToPrisma({
         queryPlan,
         mapper: {
-          "request.resource.attr.nested.aOptionalString": {
-            relation: {
-              name: "nested",
-              type: "one",
-              fields: {
-                aOptionalString: { field: "aOptionalString" },
-              },
-            },
-          },
+          "request.resource.attr.aBool": { field: "aBool" },
+          "request.resource.attr.aString": { field: "aString" },
         },
       });
 
       expect(result).toStrictEqual({
         kind: PlanKind.CONDITIONAL,
         filters: {
-          nested: {
-            is: {
-              aOptionalString: { not: null },
-            },
+          NOT: {
+            OR: [
+              { aBool: { equals: true } },
+              { aString: { not: "string" } },
+            ],
           },
         },
       });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id)).toEqual(
+        fixtureResources
+          .filter((r) => !(r.aBool || r.aString != "string"))
+          .map((r) => r.id)
+      );
     });
 
-    test("hasIntersection with nested collection", async () => {
+    test("conditional - not-gt", async () => {
       const queryPlan = await cerbos.planResources({
         principal: { id: "user1", roles: ["USER"] },
         resource: { kind: "resource" },
-        action: "has-intersection-nested",
+        action: "not-gt",
       });
 
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "not",
+          operands: [
+            {
+              operator: "gt",
+              operands: [
+                { name: "request.resource.attr.aNumber" },
+                { value: 1 },
+              ],
+            },
+          ],
+        }
+      );
+
       const result = queryPlanToPrisma({
         queryPlan,
         mapper: {
-          "request.resource.attr.categories": {
-            relation: {
-              name: "categories",
-              type: "many",
-              fields: {
-                subCategories: {
-                  relation: {
-                    name: "subCategories",
-                    type: "many",
-                    fields: {
-                      name: { field: "name" },
-                    },
-                  },
-                },
-              },
-            },
-          },
+          "request.resource.attr.aNumber": { field: "aNumber" },
         },
       });
 
       expect(result).toStrictEqual({
         kind: PlanKind.CONDITIONAL,
         filters: {
-          categories: {
-            some: {
-              subCategories: {
-                some: {
-                  name: { in: ["finance", "tech"] },
-                },
-              },
-            },
-          },
+          NOT: { aNumber: { gt: 1 } },
         },
       });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id)).toEqual(
+        fixtureResources
+          .filter((r) => !(r.aNumber > 1))
+          .map((r) => r.id)
+      );
     });
-  });
 
-  describe("Deep Nesting", () => {
-    test("filter on deeply nested relation", async () => {
+    test("conditional - not-lt", async () => {
       const queryPlan = await cerbos.planResources({
         principal: { id: "user1", roles: ["USER"] },
         resource: { kind: "resource" },
-        action: "filter-deeply-nested",
+        action: "not-lt",
       });
 
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "not",
+          operands: [
+            {
+              operator: "lt",
+              operands: [
+                { name: "request.resource.attr.aNumber" },
+                { value: 2 },
+              ],
+            },
+          ],
+        }
+      );
+
       const result = queryPlanToPrisma({
         queryPlan,
         mapper: {
-          "request.resource.attr.categories": {
-            relation: {
-              name: "categories",
-              type: "many",
-              fields: {
-                subCategories: {
-                  relation: {
-                    name: "subCategories",
-                    type: "many",
-                    fields: {
-                      labels: {
-                        relation: {
-                          name: "labels",
-                          type: "many",
-                          fields: {
-                            name: { field: "name" },
-                          },
-                        },
-                      },
-                    },
-                  },
-                },
-              },
-            },
-          },
+          "request.resource.attr.aNumber": { field: "aNumber" },
         },
       });
 
       expect(result).toStrictEqual({
         kind: PlanKind.CONDITIONAL,
         filters: {
-          categories: {
-            some: {
-              subCategories: {
-                some: {
-                  labels: {
-                    some: {
-                      name: { equals: "important" },
-                    },
-                  },
-                },
-              },
-            },
-          },
+          NOT: { aNumber: { lt: 2 } },
         },
       });
-    });
 
-    test("map on deeply nested relation", async () => {
-      const queryPlan = await cerbos.planResources({
-        principal: { id: "user1", roles: ["USER"] },
-        resource: { kind: "resource" },
-        action: "map-deeply-nested",
-      });
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
 
-      const result = queryPlanToPrisma({
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id)).toEqual(
+        fixtureResources
+          .filter((r) => !(r.aNumber < 2))
+          .map((r) => r.id)
+      );
+    });
+
+    test("conditional - not-contains", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "not-contains",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "not",
+          operands: [
+            {
+              operator: "contains",
+              operands: [
+                { name: "request.resource.attr.aString" },
+                { value: "str" },
+              ],
+            },
+          ],
+        }
+      );
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aString": { field: "aString" },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          NOT: { aString: { contains: "str" } },
+        },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id)).toEqual(
+        fixtureResources
+          .filter((r) => !r.aString.includes("str"))
+          .map((r) => r.id)
+      );
+    });
+
+    test("conditional - not-starts-with", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "not-starts-with",
+      });
+
+      expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+      expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual(
+        {
+          operator: "not",
+          operands: [
+            {
+              operator: "startsWith",
+              operands: [
+                { name: "request.resource.attr.aString" },
+                { value: "str" },
+              ],
+            },
+          ],
+        }
+      );
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aString": { field: "aString" },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          NOT: { aString: { startsWith: "str" } },
+        },
+      });
+
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
+
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
+      expect(query.map((r) => r.id)).toEqual(
+        fixtureResources
+          .filter((r) => !r.aString.startsWith("str"))
+          .map((r) => r.id)
+      );
+    });
+  });
+
+  describe("Collection Operations", () => {
+    test("conditional - exists on nested collection", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "exists-nested-collection",
+      });
+
+      const result = queryPlanToPrisma({
         queryPlan,
         mapper: {
           "request.resource.attr.categories": {
@@ -4635,6 +5201,7 @@ describe("Complex Operations", () => {
               name: "categories",
               type: "many",
               fields: {
+                name: { field: "name" },
                 subCategories: {
                   relation: {
                     name: "subCategories",
@@ -4655,87 +5222,311 @@ describe("Complex Operations", () => {
         filters: {
           categories: {
             some: {
-              subCategories: {
-                some: {
-                  name: { in: ["finance", "tech"] },
+              AND: [
+                { name: { equals: "business" } },
+                {
+                  subCategories: {
+                    some: {
+                      name: { equals: "finance" },
+                    },
+                  },
                 },
-              },
+              ],
             },
           },
         },
       });
-    });
-  });
-});
-
-// Error Handling
-describe("Error Cases", () => {
-  test("throws error for invalid query plan", () => {
-    const invalidQueryPlan = {
-      kind: "INVALID_KIND" as PlanKind,
-    };
 
-    expect(() =>
-      queryPlanToPrisma({
-        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
-        mapper: {},
-      })
-    ).toThrow("Invalid query plan.");
-  });
+      if (result.kind !== PlanKind.CONDITIONAL) {
+        throw new Error("Expected CONDITIONAL result");
+      }
 
-  test("throws error for invalid expression structure", () => {
-    const invalidQueryPlan = {
-      kind: PlanKind.CONDITIONAL,
-      condition: {
-        // Missing operator and operands
-      },
-    };
+      const query = await prisma.resource.findMany({
+        where: { ...result.filters },
+      });
 
-    expect(() =>
-      queryPlanToPrisma({
-        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
-        mapper: {},
-      })
-    ).toThrow("Invalid Cerbos expression structure");
-  });
+      expect(query.map((r) => r.id)).toEqual(
+        fixtureResources
+          .filter((r) => {
+            const categoryConnections = r.categories
+              ?.connect as Prisma.CategoryWhereUniqueInput[];
+            return categoryConnections?.some((categoryConnection) => {
+              const category = fixtureCategories.find(
+                (fc) => fc.id === categoryConnection.id
+              );
+              return (
+                category?.name === "business" &&
+                (
+                  category?.subCategories
+                    ?.connect as Prisma.SubCategoryWhereUniqueInput[]
+                )?.some(
+                  (sc) =>
+                    fixtureSubCategories.find((fsc) => fsc.id === sc.id)
+                      ?.name === "finance"
+                )
+              );
+            });
+          })
+          .map((r) => r.id)
+      );
+    });
 
-  test("throws error for unsupported operator", () => {
-    const invalidQueryPlan = {
-      kind: PlanKind.CONDITIONAL,
-      condition: {
-        operator: "unsupported",
-        operands: [],
-      },
-    };
+    test("isSet with nested relation", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "is-set-nested",
+      });
 
-    expect(() =>
-      queryPlanToPrisma({
-        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
-        mapper: {},
-      })
-    ).toThrow("Unsupported operator: unsupported");
-  });
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.nested.aOptionalString": {
+            relation: {
+              name: "nested",
+              type: "one",
+              fields: {
+                aOptionalString: { field: "aOptionalString" },
+              },
+            },
+          },
+        },
+      });
 
-  test("throws error for invalid operand structure", () => {
-    const invalidQueryPlan = {
-      kind: PlanKind.CONDITIONAL,
-      condition: {
-        operator: "eq",
-        operands: [
-          {}, // Invalid operand without name or value
-          { value: "test" },
-        ],
-      },
-    };
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          nested: {
+            is: {
+              aOptionalString: { not: null },
+            },
+          },
+        },
+      });
+    });
 
-    expect(() =>
-      queryPlanToPrisma({
-        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
-        mapper: {},
-      })
-    ).toThrow("No valid left operand found");
-  });
-});
+    test("hasIntersection with nested collection", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "has-intersection-nested",
+      });
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.categories": {
+            relation: {
+              name: "categories",
+              type: "many",
+              fields: {
+                subCategories: {
+                  relation: {
+                    name: "subCategories",
+                    type: "many",
+                    fields: {
+                      name: { field: "name" },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          categories: {
+            some: {
+              subCategories: {
+                some: {
+                  name: { in: ["finance", "tech"] },
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+  });
+
+  describe("Deep Nesting", () => {
+    test("filter on deeply nested relation", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "filter-deeply-nested",
+      });
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.categories": {
+            relation: {
+              name: "categories",
+              type: "many",
+              fields: {
+                subCategories: {
+                  relation: {
+                    name: "subCategories",
+                    type: "many",
+                    fields: {
+                      labels: {
+                        relation: {
+                          name: "labels",
+                          type: "many",
+                          fields: {
+                            name: { field: "name" },
+                          },
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          categories: {
+            some: {
+              subCategories: {
+                some: {
+                  labels: {
+                    some: {
+                      name: { equals: "important" },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+
+    test("map on deeply nested relation", async () => {
+      const queryPlan = await cerbos.planResources({
+        principal: { id: "user1", roles: ["USER"] },
+        resource: { kind: "resource" },
+        action: "map-deeply-nested",
+      });
+
+      const result = queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.categories": {
+            relation: {
+              name: "categories",
+              type: "many",
+              fields: {
+                subCategories: {
+                  relation: {
+                    name: "subCategories",
+                    type: "many",
+                    fields: {
+                      name: { field: "name" },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          categories: {
+            some: {
+              subCategories: {
+                some: {
+                  name: { in: ["finance", "tech"] },
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+  });
+});
+
+// Error Handling
+describe("Error Cases", () => {
+  test("throws error for invalid query plan", () => {
+    const invalidQueryPlan = {
+      kind: "INVALID_KIND" as PlanKind,
+    };
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
+        mapper: {},
+      })
+    ).toThrow("Invalid query plan.");
+  });
+
+  test("throws error for invalid expression structure", () => {
+    const invalidQueryPlan = {
+      kind: PlanKind.CONDITIONAL,
+      condition: {
+        // Missing operator and operands
+      },
+    };
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
+        mapper: {},
+      })
+    ).toThrow("Invalid Cerbos expression structure");
+  });
+
+  test("throws error for unsupported operator", () => {
+    const invalidQueryPlan = {
+      kind: PlanKind.CONDITIONAL,
+      condition: {
+        operator: "unsupported",
+        operands: [],
+      },
+    };
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
+        mapper: {},
+      })
+    ).toThrow("Unsupported operator: unsupported");
+  });
+
+  test("throws error for invalid operand structure", () => {
+    const invalidQueryPlan = {
+      kind: PlanKind.CONDITIONAL,
+      condition: {
+        operator: "eq",
+        operands: [
+          {}, // Invalid operand without name or value
+          { value: "test" },
+        ],
+      },
+    };
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: invalidQueryPlan as unknown as PlanResourcesResponse,
+        mapper: {},
+      })
+    ).toThrow("No valid left operand found");
+  });
+});
 
 // Utility Tests
 describe("Mapper Functions", () => {
@@ -5769,542 +6560,898 @@ describe("Add Operator", () => {
   });
 });
 
-// Issue #155: hierarchy overlaps operator
-// overlaps = one hierarchy is a prefix of the other (segment-wise comparison)
-describe("Hierarchy Overlaps", () => {
-  test("overlaps - equal length hierarchies, field must match", () => {
-    // #given hierarchy("projects:123", ":").overlaps(hierarchy(["projects", R.id]))
-    // Left segments: ["projects", "123"], Right segments: ["projects", R.id]
-    // Same length: prefix check both directions requires all segments match
-    // segments[0]: "projects" == "projects" ✓
-    // segments[1]: "123" == R.id → R.id == "123"
-    const plan = createConditionalPlan({
-      operator: "overlaps",
+// Coverage for additional CEL operators emitted by the planner. Linear arithmetic with a
+// constant side is solved to a plain column comparison (Prisma's where shape cannot express
+// computed columns); genuinely inexpressible shapes (mod, regex, list indexing, arithmetic
+// on both sides) throw the adapter's "Unsupported operator: <op>" error so callers can
+// detect them.
+describe("Arithmetic Operators", () => {
+  test("arith-add (gt with field+value add) solves for the column", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "arith-add",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "gt",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "projects:123" }, { value: ":" }],
-        },
-        {
-          operator: "hierarchy",
+          operator: "add",
           operands: [
-            {
-              operator: "list",
-              operands: [
-                { value: "projects" },
-                { name: "request.resource.id" },
-              ],
-            },
+            { name: "request.resource.attr.aNumber" },
+            { value: 1 },
           ],
         },
+        { value: 2 },
       ],
     });
 
-    // #when
+    // aNumber + 1 > 2  ⇔  aNumber > 1
     const result = queryPlanToPrisma({
-      queryPlan: plan,
+      queryPlan,
       mapper: {
-        "request.resource.id": { field: "id" },
+        "request.resource.attr.aNumber": { field: "aNumber" },
       },
     });
-
-    // #then
-    expect(result).toEqual({
+    expect(result).toStrictEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: { id: { equals: "123" } },
+      filters: { aNumber: { gt: 1 } },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
     });
+    expect(query.map((r) => r.id).sort()).toEqual(
+      fixtureResources
+        .filter((r) => r.aNumber + 1 > 2)
+        .map((r) => r.id)
+        .sort()
+    );
   });
 
-  test("overlaps - left shorter than right, left is always prefix", () => {
-    // #given hierarchy("admin", ":").overlaps(hierarchy(["admin", R.attr.scope]))
-    // Left segments: ["admin"] (length 1), Right segments: ["admin", R.attr.scope] (length 2)
-    // Left prefix of right: "admin" == "admin" ✓ → always true
-    const plan = createConditionalPlan({
-      operator: "overlaps",
+  test("arith-sub solves for the column", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "arith-sub",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "lt",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "admin" }, { value: ":" }],
-        },
-        {
-          operator: "hierarchy",
+          operator: "sub",
           operands: [
-            {
-              operator: "list",
-              operands: [
-                { value: "admin" },
-                { name: "request.resource.attr.scope" },
-              ],
-            },
+            { name: "request.resource.attr.aNumber" },
+            { value: 1 },
           ],
         },
+        { value: 2 },
       ],
     });
 
-    // #when
+    // aNumber - 1 < 2  ⇔  aNumber < 3
     const result = queryPlanToPrisma({
-      queryPlan: plan,
+      queryPlan,
       mapper: {
-        "request.resource.attr.scope": { field: "scope" },
+        "request.resource.attr.aNumber": { field: "aNumber" },
       },
     });
-
-    // #then always true
-    expect(result).toEqual({
+    expect(result).toStrictEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: {},
+      filters: { aNumber: { lt: 3 } },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
     });
+    expect(query.map((r) => r.id).sort()).toEqual(
+      fixtureResources
+        .filter((r) => r.aNumber - 1 < 2)
+        .map((r) => r.id)
+        .sort()
+    );
   });
 
-  test("overlaps - left longer, right is prefix when field matches", () => {
-    // #given hierarchy("dept:engineering:frontend", ":").overlaps(hierarchy(["dept", R.attr.department]))
-    // Left segments: ["dept", "engineering", "frontend"] (3)
-    // Right segments: ["dept", R.attr.department] (2)
-    // Left prefix of right: len 3 > len 2 → impossible
-    // Right prefix of left: "dept" == "dept" ✓, R.attr.department == "engineering"
-    const plan = createConditionalPlan({
-      operator: "overlaps",
+  test("arith-mult solves for the column", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "arith-mult",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "gt",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [
-            { value: "dept:engineering:frontend" },
-            { value: ":" },
-          ],
-        },
-        {
-          operator: "hierarchy",
+          operator: "mult",
           operands: [
-            {
-              operator: "list",
-              operands: [
-                { value: "dept" },
-                { name: "request.resource.attr.department" },
-              ],
-            },
+            { name: "request.resource.attr.aNumber" },
+            { value: 2 },
           ],
         },
+        { value: 2 },
       ],
     });
 
-    // #when
+    // aNumber * 2 > 2  ⇔  aNumber > 1
     const result = queryPlanToPrisma({
-      queryPlan: plan,
+      queryPlan,
       mapper: {
-        "request.resource.attr.department": { field: "department" },
+        "request.resource.attr.aNumber": { field: "aNumber" },
       },
     });
-
-    // #then
-    expect(result).toEqual({
+    expect(result).toStrictEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: { department: { equals: "engineering" } },
+      filters: { aNumber: { gt: 1 } },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
     });
+    expect(query.map((r) => r.id).sort()).toEqual(
+      fixtureResources
+        .filter((r) => r.aNumber * 2 > 2)
+        .map((r) => r.id)
+        .sort()
+    );
   });
 
-  test("overlaps - different roots, impossible", () => {
-    // #given hierarchy("org:acme:team1", ":").overlaps(hierarchy(["company", R.attr.team]))
-    // Left: ["org", "acme", "team1"], Right: ["company", R.attr.team]
-    // Both directions fail at segment[0]: "org" ≠ "company"
-    const plan = createConditionalPlan({
-      operator: "overlaps",
+  test("arith-div solves for the column", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "arith-div",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "gt",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "org:acme:team1" }, { value: ":" }],
-        },
-        {
-          operator: "hierarchy",
+          operator: "div",
           operands: [
-            {
-              operator: "list",
-              operands: [
-                { value: "company" },
-                { name: "request.resource.attr.team" },
-              ],
-            },
+            { name: "request.resource.attr.aNumber" },
+            { value: 2 },
           ],
         },
+        { value: 0 },
       ],
     });
 
-    // #when
+    // aNumber / 2 > 0  ⇔  aNumber > 0
     const result = queryPlanToPrisma({
-      queryPlan: plan,
+      queryPlan,
       mapper: {
-        "request.resource.attr.team": { field: "team" },
+        "request.resource.attr.aNumber": { field: "aNumber" },
       },
     });
-
-    // #then impossible
-    expect(result).toEqual({
+    expect(result).toStrictEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: {
-        team: { in: [] },
-      },
+      filters: { aNumber: { gt: 0 } },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
     });
+    expect(query.map((r) => r.id).sort()).toEqual(
+      fixtureResources
+        .filter((r) => r.aNumber / 2 > 0)
+        .map((r) => r.id)
+        .sort()
+    );
   });
 
-  test("overlaps - equal length with field in middle, field must match", () => {
-    // #given hierarchy("region:us:west", ":").overlaps(hierarchy(["region", "us", R.attr.zone]))
-    // Left: ["region", "us", "west"], Right: ["region", "us", R.attr.zone]
-    // Same length, prefix check: "region"=="region" ✓, "us"=="us" ✓, "west"==R.attr.zone
-    const plan = createConditionalPlan({
-      operator: "overlaps",
+  test("arith-mod is unsupported", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "arith-mod",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "eq",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "region:us:west" }, { value: ":" }],
-        },
-        {
-          operator: "hierarchy",
+          operator: "mod",
           operands: [
             {
-              operator: "list",
-              operands: [
-                { value: "region" },
-                { value: "us" },
-                { name: "request.resource.attr.zone" },
-              ],
+              operator: "int",
+              operands: [{ name: "request.resource.attr.aNumber" }],
             },
+            { value: 2 },
           ],
         },
+        { value: 0 },
       ],
     });
 
-    // #when
-    const result = queryPlanToPrisma({
-      queryPlan: plan,
-      mapper: {
-        "request.resource.attr.zone": { field: "zone" },
-      },
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aNumber": { field: "aNumber" },
+        },
+      })
+    ).toThrow("Unsupported operator: mod");
+  });
+});
+
+describe("Regex Operator", () => {
+  test("matches-regex is unsupported", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "matches-regex",
     });
 
-    // #then
-    expect(result).toEqual({
-      kind: PlanKind.CONDITIONAL,
-      filters: { zone: { equals: "west" } },
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "matches",
+      operands: [
+        { name: "request.resource.attr.aString" },
+        { value: "^str.*" },
+      ],
     });
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aString": { field: "aString" },
+        },
+      })
+    ).toThrow("Unsupported operator: matches");
   });
+});
 
-  test("overlaps - single-field right hierarchy as prefix of left", () => {
-    // #given hierarchy("team:alpha", ":").overlaps(hierarchy([R.attr.group]))
-    // Left: ["team", "alpha"] (2), Right: [R.attr.group] (1)
-    // Left prefix of right: len 2 > len 1 → impossible
-    // Right prefix of left: R.attr.group == "team" (first segment)
-    const plan = createConditionalPlan({
-      operator: "overlaps",
+describe("List Index Operator", () => {
+  test("index-list is unsupported", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "index-list",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "eq",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "team:alpha" }, { value: ":" }],
-        },
-        {
-          operator: "hierarchy",
+          operator: "index",
           operands: [
-            {
-              operator: "list",
-              operands: [{ name: "request.resource.attr.group" }],
-            },
+            { name: "request.resource.attr.ownedBy" },
+            { value: 0 },
           ],
         },
+        { value: "user1" },
       ],
     });
 
-    // #when
-    const result = queryPlanToPrisma({
-      queryPlan: plan,
-      mapper: {
-        "request.resource.attr.group": { field: "group" },
-      },
-    });
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.ownedBy": {
+            relation: { name: "ownedBy", type: "many", field: "id" },
+          },
+        },
+      })
+    ).toThrow("Unsupported operator: index");
+  });
+});
 
-    // #then
-    expect(result).toEqual({
-      kind: PlanKind.CONDITIONAL,
-      filters: { group: { equals: "team" } },
+describe("Type Conversion Operators", () => {
+  test("convert-string is unsupported", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "convert-string",
     });
-  });
 
-  test("overlaps - hierarchy(dotted string) without delimiter", () => {
-    // #given hierarchy("a.b.c").overlaps(hierarchy(["a", "b", R.attr.zone]))
-    // hierarchy("a.b.c") uses default "." delimiter → ["a", "b", "c"]
-    const plan = createConditionalPlan({
-      operator: "overlaps",
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "eq",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "a.b.c" }],
-        },
-        {
-          operator: "hierarchy",
-          operands: [
-            {
-              operator: "list",
-              operands: [
-                { value: "a" },
-                { value: "b" },
-                { name: "request.resource.attr.zone" },
-              ],
-            },
-          ],
+          operator: "string",
+          operands: [{ name: "request.resource.attr.aNumber" }],
         },
+        { value: "1" },
       ],
     });
 
-    // #when
-    const result = queryPlanToPrisma({
-      queryPlan: plan,
-      mapper: { "request.resource.attr.zone": { field: "zone" } },
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aNumber": { field: "aNumber" },
+        },
+      })
+    ).toThrow("Unsupported operator: string");
+  });
+
+  test("convert-double is unsupported", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "convert-double",
     });
 
-    // #then
-    expect(result).toEqual({
-      kind: PlanKind.CONDITIONAL,
-      filters: { zone: { equals: "c" } },
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "gt",
+      operands: [
+        {
+          operator: "double",
+          operands: [{ name: "request.resource.attr.aNumber" }],
+        },
+        { value: 1.5 },
+      ],
     });
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aNumber": { field: "aNumber" },
+        },
+      })
+    ).toThrow("Unsupported operator: double");
   });
 
-  test("overlaps via cerbos integration", async () => {
+  test("convert-int is unsupported", async () => {
     const queryPlan = await cerbos.planResources({
-      principal: {
-        id: "user1",
-        roles: ["USER"],
-        attr: { context: "projects:123" },
-      },
+      principal: { id: "user1", roles: ["USER"] },
       resource: { kind: "resource" },
-      action: "hierarchy-overlaps",
+      action: "convert-int",
     });
 
-    expect(queryPlan.kind).toBe(PlanKind.CONDITIONAL);
-
-    const result = queryPlanToPrisma({
-      queryPlan,
-      mapper: {
-        "request.resource.id": { field: "id" },
-      },
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "gt",
+      operands: [
+        {
+          operator: "int",
+          operands: [{ name: "request.resource.attr.aString" }],
+        },
+        { value: 0 },
+      ],
     });
 
-    // hierarchy("projects:123", ":") segments = ["projects", "123"]
-    // hierarchy(["projects", R.id]) segments = ["projects", R.id]
-    // Same length, segments[1]: "123" == R.id → R.id == "123"
-    expect(result).toEqual({
-      kind: PlanKind.CONDITIONAL,
-      filters: { id: { equals: "123" } },
-    });
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aString": { field: "aString" },
+        },
+      })
+    ).toThrow("Unsupported operator: int");
   });
 });
 
-const hierarchyMapper = {
-  "request.resource.attr.scope": { field: "scope" },
-  "request.resource.attr.path": { field: "path" },
-};
+describe("Ternary Operator", () => {
+  const mapper = {
+    "request.resource.attr.aBool": { field: "aBool" },
+    "request.resource.attr.aNumber": { field: "aNumber" },
+    "request.resource.attr.aString": { field: "aString" },
+    "request.resource.attr.aOptionalString": { field: "aOptionalString" },
+    "request.resource.attr.aOptionalBool": { field: "aOptionalBool" },
+  };
 
-// ancestorOf = first hierarchy is a strict prefix of second
-// hierarchy("a.b").ancestorOf(hierarchy("a.b.c.d")) == true
-describe("Hierarchy ancestorOf", () => {
-  test("ancestorOf - constant is ancestor, field is descendant", () => {
-    // #given hierarchy("a.b.c").ancestorOf(hierarchy(R.attr.scope))
-    const plan = createConditionalPlan({
-      operator: "ancestorOf",
+  async function matchingResourceIds(
+    queryPlan: PlanResourcesResponse
+  ): Promise<string[]> {
+    const result = queryPlanToPrisma({ queryPlan, mapper });
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+    const resources = await prisma.resource.findMany({
+      where: { ...result.filters },
+    });
+    return resources.map((resource) => resource.id).sort();
+  }
+
+  test("rewrites a comparison-wrapped ternary from the PDP", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "ternary",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "gt",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "a.b.c" }],
-        },
-        {
-          operator: "hierarchy",
-          operands: [{ name: "request.resource.attr.scope" }],
+          operator: "if",
+          operands: [
+            { name: "request.resource.attr.aBool" },
+            { name: "request.resource.attr.aNumber" },
+            { value: 0 },
+          ],
         },
+        { value: 0 },
       ],
     });
 
-    // #when
-    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
-
-    // #then - R.attr.scope must start with "a.b.c." (ancestor means strict prefix)
-    expect(result).toEqual({
+    expect(queryPlanToPrisma({ queryPlan, mapper })).toStrictEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: { scope: { startsWith: "a.b.c." } },
+      filters: {
+        OR: [
+          {
+            AND: [
+              { aBool: { equals: true } },
+              { aNumber: { gt: 0 } },
+            ],
+          },
+          {
+            AND: [
+              { aBool: { equals: true } },
+              { aBool: { equals: false } },
+            ],
+          },
+        ],
+      },
     });
+    expect(await matchingResourceIds(queryPlan)).toEqual(["resource1"]);
   });
 
-  test("ancestorOf - field is ancestor of constant", () => {
-    // #given hierarchy(R.attr.scope).ancestorOf(hierarchy("a.b.c.d"))
-    // R.attr.scope must be a prefix of "a.b.c.d"
-    // Possible prefixes: "a", "a.b", "a.b.c"
-    const plan = createConditionalPlan({
-      operator: "ancestorOf",
+  test("rewrites a ternary used directly as a boolean predicate", async () => {
+    const queryPlan = createConditionalPlan({
+      operator: "if",
       operands: [
+        { name: "request.resource.attr.aBool" },
         {
-          operator: "hierarchy",
-          operands: [{ name: "request.resource.attr.scope" }],
+          operator: "gt",
+          operands: [
+            { name: "request.resource.attr.aNumber" },
+            { value: 0 },
+          ],
         },
         {
-          operator: "hierarchy",
-          operands: [{ value: "a.b.c.d" }],
+          operator: "eq",
+          operands: [
+            { name: "request.resource.attr.aString" },
+            { value: "string3" },
+          ],
         },
       ],
     });
 
-    // #when
-    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
-
-    // #then - scope must be one of the strict prefixes of "a.b.c.d"
-    expect(result).toEqual({
-      kind: PlanKind.CONDITIONAL,
-      filters: { scope: { in: ["a", "a.b", "a.b.c"] } },
-    });
+    expect(await matchingResourceIds(queryPlan)).toEqual([
+      "resource1",
+      "resource3",
+    ]);
   });
 
-  test("ancestorOf - single segment constant ancestor", () => {
-    // #given hierarchy("root").ancestorOf(hierarchy(R.attr.scope))
-    const plan = createConditionalPlan({
-      operator: "ancestorOf",
+  test("recursively rewrites nested ternary branches", async () => {
+    const queryPlan = createConditionalPlan({
+      operator: "gt",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "root" }],
+          operator: "if",
+          operands: [
+            { name: "request.resource.attr.aBool" },
+            {
+              operator: "if",
+              operands: [
+                {
+                  operator: "eq",
+                  operands: [
+                    { name: "request.resource.attr.aString" },
+                    { value: "string" },
+                  ],
+                },
+                { name: "request.resource.attr.aNumber" },
+                { value: 0 },
+              ],
+            },
+            { value: 0 },
+          ],
         },
+        { value: 0 },
+      ],
+    });
+
+    expect(await matchingResourceIds(queryPlan)).toEqual(["resource1"]);
+  });
+
+  test("mirrors a value-first comparison around a ternary", async () => {
+    const queryPlan = createConditionalPlan({
+      operator: "lt",
+      operands: [
+        { value: 0 },
         {
-          operator: "hierarchy",
-          operands: [{ name: "request.resource.attr.scope" }],
+          operator: "if",
+          operands: [
+            { name: "request.resource.attr.aBool" },
+            { name: "request.resource.attr.aNumber" },
+            { value: -1 },
+          ],
         },
       ],
     });
 
-    // #when
-    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
-
-    // #then
-    expect(result).toEqual({
+    const result = queryPlanToPrisma({ queryPlan, mapper });
+    expect(result).toStrictEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: { scope: { startsWith: "root." } },
+      filters: {
+        OR: [
+          {
+            AND: [
+              { aBool: { equals: true } },
+              { aNumber: { gt: 0 } },
+            ],
+          },
+          {
+            AND: [
+              { aBool: { equals: true } },
+              { aBool: { equals: false } },
+            ],
+          },
+        ],
+      },
     });
+    expect(await matchingResourceIds(queryPlan)).toEqual(["resource1"]);
   });
 
-  test("ancestorOf - with custom delimiter", () => {
-    // #given hierarchy(P.attr.scope, ":").ancestorOf(hierarchy(R.attr.path, ":"))
-    // P.attr.scope is resolved at plan time → constant "org:team"
-    const plan = createConditionalPlan({
-      operator: "ancestorOf",
+  test("keeps a nullable condition unknown under outer negation", async () => {
+    const queryPlan = createConditionalPlan({
+      operator: "not",
       operands: [
         {
-          operator: "hierarchy",
-          operands: [{ value: "org:team" }, { value: ":" }],
-        },
-        {
-          operator: "hierarchy",
-          operands: [{ name: "request.resource.attr.path" }, { value: ":" }],
+          operator: "if",
+          operands: [
+            { name: "request.resource.attr.aOptionalBool" },
+            { value: false },
+            { value: false },
+          ],
         },
       ],
     });
 
-    // #when
-    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
-
-    // #then - R.attr.path must start with "org:team:" (using the ":" delimiter)
-    expect(result).toEqual({
-      kind: PlanKind.CONDITIONAL,
-      filters: { path: { startsWith: "org:team:" } },
-    });
+    expect(await matchingResourceIds(queryPlan)).toEqual([
+      "resource1",
+      "resource2",
+    ]);
   });
 
-  test("ancestorOf via cerbos integration", async () => {
-    const plan = await cerbos.planResources({
-      principal: {
-        id: "user1",
-        roles: ["USER"],
-        attr: { scope: "a.b.c" },
+  test("negates a relation-backed boolean condition as a whole", () => {
+    const queryPlan = createConditionalPlan({
+      operator: "if",
+      operands: [
+        { name: "request.resource.attr.ownedBy.aBool" },
+        { value: false },
+        { value: true },
+      ],
+    });
+
+    expect(
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.ownedBy": {
+            relation: {
+              name: "ownedBy",
+              type: "many",
+              fields: { aBool: { field: "aBool" } },
+            },
+          },
+        },
+      })
+    ).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        OR: [
+          {
+            NOT: {
+              ownedBy: {
+                some: { aBool: { equals: true } },
+              },
+            },
+          },
+          {
+            AND: [
+              {
+                ownedBy: {
+                  some: { aBool: { equals: true } },
+                },
+              },
+              {
+                NOT: {
+                  ownedBy: {
+                    some: { aBool: { equals: true } },
+                  },
+                },
+              },
+            ],
+          },
+        ],
       },
+    });
+  });
+
+  test("rejects malformed and non-boolean ternary conditions", () => {
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: createConditionalPlan({
+          operator: "if",
+          operands: [
+            { name: "request.resource.attr.aBool" },
+            { value: true },
+          ],
+        }),
+        mapper,
+      })
+    ).toThrow(
+      "if (ternary) requires exactly 3 operands (condition, then, else), got 2"
+    );
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: createConditionalPlan({
+          operator: "if",
+          operands: [{ value: null }, { value: true }, { value: false }],
+        }),
+        mapper,
+      })
+    ).toThrow("if (ternary) condition must be a boolean expression");
+
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: createConditionalPlan({
+          operator: "eq",
+          operands: [
+            {
+              operator: "if",
+              operands: [
+                { name: "request.resource.attr.aBool" },
+                { value: true },
+                { value: false },
+              ],
+            },
+            { value: true },
+            { value: false },
+          ],
+        }),
+        mapper,
+      })
+    ).toThrow("eq with a ternary requires exactly 2 operands, got 3");
+  });
+
+  test("handles planner-normalized constant conditions", async () => {
+    const bareTrue = createConditionalPlan({
+      operator: "if",
+      operands: [{ value: true }, { value: true }, { value: false }],
+    });
+    const bareFalse = createConditionalPlan({
+      operator: "if",
+      operands: [{ value: true }, { value: false }, { value: true }],
+    });
+    const comparisonFalse = createConditionalPlan({
+      operator: "gt",
+      operands: [
+        {
+          operator: "if",
+          operands: [{ value: true }, { value: 0 }, { value: 1 }],
+        },
+        { value: 0 },
+      ],
+    });
+
+    expect(await matchingResourceIds(bareTrue)).toEqual([
+      "resource1",
+      "resource2",
+      "resource3",
+    ]);
+    expect(() => queryPlanToPrisma({ queryPlan: bareFalse, mapper })).toThrow(
+      "A constant-false conditional predicate must be folded by the Cerbos planner"
+    );
+    expect(() =>
+      queryPlanToPrisma({ queryPlan: comparisonFalse, mapper })
+    ).toThrow(
+      "A constant-false conditional predicate must be folded by the Cerbos planner"
+    );
+  });
+
+  test("orders folded strings by Unicode code point", async () => {
+    const queryPlan = createConditionalPlan({
+      operator: "lt",
+      operands: [
+        {
+          operator: "if",
+          operands: [
+            { name: "request.resource.attr.aBool" },
+            { value: "\u{10000}" },
+            { value: "\u{10000}" },
+          ],
+        },
+        { value: "\uE000" },
+      ],
+    });
+
+    expect(await matchingResourceIds(queryPlan)).toEqual([]);
+  });
+});
+
+describe("Size on String", () => {
+  test("string-size is unsupported (size() on a scalar string has no relation mapping)", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
       resource: { kind: "resource" },
-      action: "hierarchy-ancestor-of",
+      action: "string-size",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "gt",
+      operands: [
+        {
+          operator: "size",
+          operands: [{ name: "request.resource.attr.aString" }],
+        },
+        { value: 0 },
+      ],
+    });
+
+    // size(scalar_string) cannot be expressed in Prisma's where shape and the
+    // adapter's size handler requires a relation mapping. A scalar string
+    // field is not a relation, so this throws.
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan,
+        mapper: {
+          "request.resource.attr.aString": { field: "aString" },
+        },
+      })
+    ).toThrow("size operator requires a relation mapping");
+  });
+});
+
+describe("Empty Collection", () => {
+  test("empty-collection (size(relation) == 0) maps to relation.none filter", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "empty-collection",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "eq",
+      operands: [
+        {
+          operator: "size",
+          operands: [{ name: "request.resource.attr.tags" }],
+        },
+        { value: 0 },
+      ],
     });
 
     const result = queryPlanToPrisma({
-      queryPlan: plan,
+      queryPlan,
       mapper: {
-        "request.resource.attr.scope": { field: "scope" },
+        "request.resource.attr.tags": {
+          relation: { name: "tags", type: "many" },
+        },
       },
     });
 
-    // hierarchy("a.b.c").ancestorOf(hierarchy(R.attr.scope))
-    // "a.b.c" is ancestor of R.attr.scope → R.attr.scope starts with "a.b.c."
-    expect(result).toEqual({
+    expect(result).toStrictEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: { scope: { startsWith: "a.b.c." } },
+      filters: { tags: { none: {} } },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
     });
+
+    expect(query.map((r) => r.id)).toEqual(
+      fixtureResources
+        .filter((r) => {
+          if (!r.tags?.connect) return true;
+          return (r.tags.connect as { id: string }[]).length === 0;
+        })
+        .map((r) => r.id)
+    );
   });
 });
 
-// descendentOf = mirror of ancestorOf
-// hierarchy("a.b.c.d").descendentOf(hierarchy("a.b")) == true
-describe("Hierarchy descendentOf", () => {
-  test("descendentOf - field is descendant of constant", () => {
-    // #given hierarchy(R.attr.scope).descendentOf(hierarchy("a.b"))
-    // R.attr.scope must be a descendant of "a.b" → "a.b" is a prefix of R.attr.scope
+// Issue #155: hierarchy overlaps operator
+// overlaps = one hierarchy is a prefix of the other (segment-wise comparison)
+describe("Hierarchy Overlaps", () => {
+  test("overlaps - equal length hierarchies, field must match", () => {
+    // #given hierarchy("projects:123", ":").overlaps(hierarchy(["projects", R.id]))
+    // Left segments: ["projects", "123"], Right segments: ["projects", R.id]
+    // Same length: prefix check both directions requires all segments match
+    // segments[0]: "projects" == "projects" ✓
+    // segments[1]: "123" == R.id → R.id == "123"
     const plan = createConditionalPlan({
-      operator: "descendentOf",
+      operator: "overlaps",
       operands: [
         {
           operator: "hierarchy",
-          operands: [{ name: "request.resource.attr.scope" }],
+          operands: [{ value: "projects:123" }, { value: ":" }],
         },
         {
           operator: "hierarchy",
-          operands: [{ value: "a.b" }],
+          operands: [
+            {
+              operator: "list",
+              operands: [
+                { value: "projects" },
+                { name: "request.resource.id" },
+              ],
+            },
+          ],
         },
       ],
     });
 
     // #when
-    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: {
+        "request.resource.id": { field: "id" },
+      },
+    });
 
-    // #then - scope must start with "a.b." (descendant = strict, must be longer)
+    // #then
     expect(result).toEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: { scope: { startsWith: "a.b." } },
+      filters: { id: { equals: "123" } },
     });
   });
 
-  test("descendentOf - constant is descendant of field", () => {
-    // #given hierarchy("a.b.c.d").descendentOf(hierarchy(R.attr.scope))
-    // "a.b.c.d" descends from R.attr.scope → R.attr.scope is a prefix of "a.b.c.d"
+  test("overlaps - left shorter than right, left is always prefix", () => {
+    // #given hierarchy("admin", ":").overlaps(hierarchy(["admin", R.attr.scope]))
+    // Left segments: ["admin"] (length 1), Right segments: ["admin", R.attr.scope] (length 2)
+    // Left prefix of right: "admin" == "admin" ✓ → always true
     const plan = createConditionalPlan({
-      operator: "descendentOf",
+      operator: "overlaps",
       operands: [
         {
           operator: "hierarchy",
-          operands: [{ value: "a.b.c.d" }],
+          operands: [{ value: "admin" }, { value: ":" }],
         },
         {
           operator: "hierarchy",
-          operands: [{ name: "request.resource.attr.scope" }],
+          operands: [
+            {
+              operator: "list",
+              operands: [
+                { value: "admin" },
+                { name: "request.resource.attr.scope" },
+              ],
+            },
+          ],
         },
       ],
     });
 
     // #when
-    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
-
-    // #then - scope must be one of the strict prefixes of "a.b.c.d"
-    expect(result).toEqual({
-      kind: PlanKind.CONDITIONAL,
-      filters: { scope: { in: ["a", "a.b", "a.b.c"] } },
-    });
-  });
-
-  test("descendentOf via cerbos integration", async () => {
-    const plan = await cerbos.planResources({
-      principal: {
-        id: "user1",
-        roles: ["USER"],
-        attr: { scope: "a.b.c" },
-      },
-      resource: { kind: "resource" },
-      action: "hierarchy-descendent-of",
-    });
-
     const result = queryPlanToPrisma({
       queryPlan: plan,
       mapper: {
@@ -6312,11 +7459,1427 @@ describe("Hierarchy descendentOf", () => {
       },
     });
 
-    // hierarchy(R.attr.scope).descendentOf(hierarchy("a.b.c"))
-    // R.attr.scope descends from "a.b.c" → R.attr.scope starts with "a.b.c."
+    // #then always true
     expect(result).toEqual({
       kind: PlanKind.CONDITIONAL,
-      filters: { scope: { startsWith: "a.b.c." } },
+      filters: {},
     });
   });
+
+  test("overlaps - left longer, right is prefix when field matches", () => {
+    // #given hierarchy("dept:engineering:frontend", ":").overlaps(hierarchy(["dept", R.attr.department]))
+    // Left segments: ["dept", "engineering", "frontend"] (3)
+    // Right segments: ["dept", R.attr.department] (2)
+    // Left prefix of right: len 3 > len 2 → impossible
+    // Right prefix of left: "dept" == "dept" ✓, R.attr.department == "engineering"
+    const plan = createConditionalPlan({
+      operator: "overlaps",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [
+            { value: "dept:engineering:frontend" },
+            { value: ":" },
+          ],
+        },
+        {
+          operator: "hierarchy",
+          operands: [
+            {
+              operator: "list",
+              operands: [
+                { value: "dept" },
+                { name: "request.resource.attr.department" },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: {
+        "request.resource.attr.department": { field: "department" },
+      },
+    });
+
+    // #then
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { department: { equals: "engineering" } },
+    });
+  });
+
+  test("overlaps - different roots, impossible", () => {
+    // #given hierarchy("org:acme:team1", ":").overlaps(hierarchy(["company", R.attr.team]))
+    // Left: ["org", "acme", "team1"], Right: ["company", R.attr.team]
+    // Both directions fail at segment[0]: "org" ≠ "company"
+    const plan = createConditionalPlan({
+      operator: "overlaps",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "org:acme:team1" }, { value: ":" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [
+            {
+              operator: "list",
+              operands: [
+                { value: "company" },
+                { name: "request.resource.attr.team" },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: {
+        "request.resource.attr.team": { field: "team" },
+      },
+    });
+
+    // #then impossible
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        team: { in: [] },
+      },
+    });
+  });
+
+  test("overlaps - equal length with field in middle, field must match", () => {
+    // #given hierarchy("region:us:west", ":").overlaps(hierarchy(["region", "us", R.attr.zone]))
+    // Left: ["region", "us", "west"], Right: ["region", "us", R.attr.zone]
+    // Same length, prefix check: "region"=="region" ✓, "us"=="us" ✓, "west"==R.attr.zone
+    const plan = createConditionalPlan({
+      operator: "overlaps",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "region:us:west" }, { value: ":" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [
+            {
+              operator: "list",
+              operands: [
+                { value: "region" },
+                { value: "us" },
+                { name: "request.resource.attr.zone" },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: {
+        "request.resource.attr.zone": { field: "zone" },
+      },
+    });
+
+    // #then
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { zone: { equals: "west" } },
+    });
+  });
+
+  test("overlaps - single-field right hierarchy as prefix of left", () => {
+    // #given hierarchy("team:alpha", ":").overlaps(hierarchy([R.attr.group]))
+    // Left: ["team", "alpha"] (2), Right: [R.attr.group] (1)
+    // Left prefix of right: len 2 > len 1 → impossible
+    // Right prefix of left: R.attr.group == "team" (first segment)
+    const plan = createConditionalPlan({
+      operator: "overlaps",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "team:alpha" }, { value: ":" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [
+            {
+              operator: "list",
+              operands: [{ name: "request.resource.attr.group" }],
+            },
+          ],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: {
+        "request.resource.attr.group": { field: "group" },
+      },
+    });
+
+    // #then
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { group: { equals: "team" } },
+    });
+  });
+
+  test("overlaps - hierarchy(dotted string) without delimiter", () => {
+    // #given hierarchy("a.b.c").overlaps(hierarchy(["a", "b", R.attr.zone]))
+    // hierarchy("a.b.c") uses default "." delimiter → ["a", "b", "c"]
+    const plan = createConditionalPlan({
+      operator: "overlaps",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "a.b.c" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [
+            {
+              operator: "list",
+              operands: [
+                { value: "a" },
+                { value: "b" },
+                { name: "request.resource.attr.zone" },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: { "request.resource.attr.zone": { field: "zone" } },
+    });
+
+    // #then
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { zone: { equals: "c" } },
+    });
+  });
+
+  test("overlaps via cerbos integration", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: {
+        id: "user1",
+        roles: ["USER"],
+        attr: { context: "projects:123" },
+      },
+      resource: { kind: "resource" },
+      action: "hierarchy-overlaps",
+    });
+
+    expect(queryPlan.kind).toBe(PlanKind.CONDITIONAL);
+
+    const result = queryPlanToPrisma({
+      queryPlan,
+      mapper: {
+        "request.resource.id": { field: "id" },
+      },
+    });
+
+    // hierarchy("projects:123", ":") segments = ["projects", "123"]
+    // hierarchy(["projects", R.id]) segments = ["projects", R.id]
+    // Same length, segments[1]: "123" == R.id → R.id == "123"
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { id: { equals: "123" } },
+    });
+  });
+});
+
+const hierarchyMapper = {
+  "request.resource.attr.scope": { field: "scope" },
+  "request.resource.attr.path": { field: "path" },
+};
+
+// ancestorOf = first hierarchy is a strict prefix of second
+// hierarchy("a.b").ancestorOf(hierarchy("a.b.c.d")) == true
+describe("Hierarchy ancestorOf", () => {
+  test("ancestorOf - constant is ancestor, field is descendant", () => {
+    // #given hierarchy("a.b.c").ancestorOf(hierarchy(R.attr.scope))
+    const plan = createConditionalPlan({
+      operator: "ancestorOf",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "a.b.c" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [{ name: "request.resource.attr.scope" }],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
+
+    // #then - R.attr.scope must start with "a.b.c." (ancestor means strict prefix)
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { scope: { startsWith: "a.b.c." } },
+    });
+  });
+
+  test("ancestorOf - field is ancestor of constant", () => {
+    // #given hierarchy(R.attr.scope).ancestorOf(hierarchy("a.b.c.d"))
+    // R.attr.scope must be a prefix of "a.b.c.d"
+    // Possible prefixes: "a", "a.b", "a.b.c"
+    const plan = createConditionalPlan({
+      operator: "ancestorOf",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ name: "request.resource.attr.scope" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [{ value: "a.b.c.d" }],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
+
+    // #then - scope must be one of the strict prefixes of "a.b.c.d"
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { scope: { in: ["a", "a.b", "a.b.c"] } },
+    });
+  });
+
+  test("ancestorOf - single segment constant ancestor", () => {
+    // #given hierarchy("root").ancestorOf(hierarchy(R.attr.scope))
+    const plan = createConditionalPlan({
+      operator: "ancestorOf",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "root" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [{ name: "request.resource.attr.scope" }],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
+
+    // #then
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { scope: { startsWith: "root." } },
+    });
+  });
+
+  test("ancestorOf - with custom delimiter", () => {
+    // #given hierarchy(P.attr.scope, ":").ancestorOf(hierarchy(R.attr.path, ":"))
+    // P.attr.scope is resolved at plan time → constant "org:team"
+    const plan = createConditionalPlan({
+      operator: "ancestorOf",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "org:team" }, { value: ":" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [{ name: "request.resource.attr.path" }, { value: ":" }],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
+
+    // #then - R.attr.path must start with "org:team:" (using the ":" delimiter)
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { path: { startsWith: "org:team:" } },
+    });
+  });
+
+  test("ancestorOf via cerbos integration", async () => {
+    const plan = await cerbos.planResources({
+      principal: {
+        id: "user1",
+        roles: ["USER"],
+        attr: { scope: "a.b.c" },
+      },
+      resource: { kind: "resource" },
+      action: "hierarchy-ancestor-of",
+    });
+
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: {
+        "request.resource.attr.scope": { field: "scope" },
+      },
+    });
+
+    // hierarchy("a.b.c").ancestorOf(hierarchy(R.attr.scope))
+    // "a.b.c" is ancestor of R.attr.scope → R.attr.scope starts with "a.b.c."
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { scope: { startsWith: "a.b.c." } },
+    });
+  });
+});
+
+// descendentOf = mirror of ancestorOf
+// hierarchy("a.b.c.d").descendentOf(hierarchy("a.b")) == true
+describe("Hierarchy descendentOf", () => {
+  test("descendentOf - field is descendant of constant", () => {
+    // #given hierarchy(R.attr.scope).descendentOf(hierarchy("a.b"))
+    // R.attr.scope must be a descendant of "a.b" → "a.b" is a prefix of R.attr.scope
+    const plan = createConditionalPlan({
+      operator: "descendentOf",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ name: "request.resource.attr.scope" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [{ value: "a.b" }],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
+
+    // #then - scope must start with "a.b." (descendant = strict, must be longer)
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { scope: { startsWith: "a.b." } },
+    });
+  });
+
+  test("descendentOf - constant is descendant of field", () => {
+    // #given hierarchy("a.b.c.d").descendentOf(hierarchy(R.attr.scope))
+    // "a.b.c.d" descends from R.attr.scope → R.attr.scope is a prefix of "a.b.c.d"
+    const plan = createConditionalPlan({
+      operator: "descendentOf",
+      operands: [
+        {
+          operator: "hierarchy",
+          operands: [{ value: "a.b.c.d" }],
+        },
+        {
+          operator: "hierarchy",
+          operands: [{ name: "request.resource.attr.scope" }],
+        },
+      ],
+    });
+
+    // #when
+    const result = queryPlanToPrisma({ queryPlan: plan, mapper: hierarchyMapper });
+
+    // #then - scope must be one of the strict prefixes of "a.b.c.d"
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { scope: { in: ["a", "a.b", "a.b.c"] } },
+    });
+  });
+
+  test("descendentOf via cerbos integration", async () => {
+    const plan = await cerbos.planResources({
+      principal: {
+        id: "user1",
+        roles: ["USER"],
+        attr: { scope: "a.b.c" },
+      },
+      resource: { kind: "resource" },
+      action: "hierarchy-descendent-of",
+    });
+
+    const result = queryPlanToPrisma({
+      queryPlan: plan,
+      mapper: {
+        "request.resource.attr.scope": { field: "scope" },
+      },
+    });
+
+    // hierarchy(R.attr.scope).descendentOf(hierarchy("a.b.c"))
+    // R.attr.scope descends from "a.b.c" → R.attr.scope starts with "a.b.c."
+    expect(result).toEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { scope: { startsWith: "a.b.c." } },
+    });
+  });
+});
+
+// Every hierarchy relationship that narrows a column with a prefix emits a Prisma
+// `startsWith`, which compiles to `LIKE` with no `ESCAPE` clause: `%` and `_` in the
+// constant hierarchy would match as wildcards and admit rows the PDP denies. `[` is unsafe
+// even where an `ESCAPE` clause exists, because SQL Server opens a character class on it.
+// Both prefix-emitting paths (ancestorOf/descendentOf and overlaps) must throw.
+describe("Hierarchy prefix LIKE metacharacters", () => {
+  const likeMetacharacterError =
+    "Cannot translate hierarchy prefix matching with LIKE metacharacters (%, _ or [): " +
+    "Prisma emits LIKE without an ESCAPE clause, and [ opens a character class on SQL Server even with one";
+
+  const metacharacterHierarchies: [string, string][] = [
+    ["percent", "50%:a"],
+    ["underscore", "50_:a"],
+    ["bracket", "[env]:prod"],
+  ];
+
+  function hierarchyOf(
+    operand: PlanExpressionOperand,
+    delimiter?: string
+  ): PlanExpressionOperand {
+    return {
+      operator: "hierarchy",
+      operands: delimiter === undefined ? [operand] : [operand, { value: delimiter }],
+    };
+  }
+
+  const scopeHierarchy = (delimiter?: string): PlanExpressionOperand =>
+    hierarchyOf({ name: "request.resource.attr.scope" }, delimiter);
+  const constantHierarchy = (
+    raw: string,
+    delimiter?: string
+  ): PlanExpressionOperand => hierarchyOf({ value: raw }, delimiter);
+
+  const translate = (condition: PlanExpressionOperand): QueryPlanToPrismaResult =>
+    queryPlanToPrisma({
+      queryPlan: createConditionalPlan(condition),
+      mapper: hierarchyMapper,
+    });
+
+  describe.each(metacharacterHierarchies)(
+    "constant hierarchy containing a %s",
+    (_name, raw) => {
+      test("overlaps - field-first throws", () => {
+        expect(() =>
+          translate({
+            operator: "overlaps",
+            operands: [scopeHierarchy(":"), constantHierarchy(raw, ":")],
+          })
+        ).toThrow(likeMetacharacterError);
+      });
+
+      test("overlaps - constant-first throws", () => {
+        expect(() =>
+          translate({
+            operator: "overlaps",
+            operands: [constantHierarchy(raw, ":"), scopeHierarchy(":")],
+          })
+        ).toThrow(likeMetacharacterError);
+      });
+
+      test("ancestorOf - constant ancestor of field descendant throws", () => {
+        expect(() =>
+          translate({
+            operator: "ancestorOf",
+            operands: [constantHierarchy(raw, ":"), scopeHierarchy(":")],
+          })
+        ).toThrow(likeMetacharacterError);
+      });
+
+      test("descendentOf - field descendant of constant ancestor throws", () => {
+        expect(() =>
+          translate({
+            operator: "descendentOf",
+            operands: [scopeHierarchy(":"), constantHierarchy(raw, ":")],
+          })
+        ).toThrow(likeMetacharacterError);
+      });
+    }
+  );
+
+  // The guard must not widen into a blanket rejection of hierarchy prefixes: pin the exact
+  // filter emitted for a metacharacter-free hierarchy.
+  describe("metacharacter-free hierarchy still translates", () => {
+    const overlapsFilter = {
+      OR: [
+        { scope: { in: ["dept"] } },
+        { scope: { equals: "dept.eng" } },
+        { scope: { startsWith: "dept.eng." } },
+      ],
+    };
+
+    test("overlaps - field-first", () => {
+      expect(
+        translate({
+          operator: "overlaps",
+          operands: [scopeHierarchy(), constantHierarchy("dept.eng")],
+        })
+      ).toEqual({ kind: PlanKind.CONDITIONAL, filters: overlapsFilter });
+    });
+
+    test("overlaps - constant-first", () => {
+      expect(
+        translate({
+          operator: "overlaps",
+          operands: [constantHierarchy("dept.eng"), scopeHierarchy()],
+        })
+      ).toEqual({ kind: PlanKind.CONDITIONAL, filters: overlapsFilter });
+    });
+
+    test("ancestorOf - constant ancestor of field descendant", () => {
+      expect(
+        translate({
+          operator: "ancestorOf",
+          operands: [constantHierarchy("dept.eng"), scopeHierarchy()],
+        })
+      ).toEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: { scope: { startsWith: "dept.eng." } },
+      });
+    });
+
+    test("descendentOf - field descendant of constant ancestor", () => {
+      expect(
+        translate({
+          operator: "descendentOf",
+          operands: [scopeHierarchy(), constantHierarchy("dept.eng")],
+        })
+      ).toEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: { scope: { startsWith: "dept.eng." } },
+      });
+    });
+  });
+});
+
+// The planner preserves policy source order, so a constant can be the FIRST operand of a
+// comparison (`1 < R.attr.aNumber`). Directional operators must be mirrored when the value
+// precedes the field, or the filter is silently inverted. See #256.
+describe("Value-First Operand Order", () => {
+  test("conditional - lt with value first (1 < aNumber means aNumber > 1)", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "value-first-lt",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "lt",
+      operands: [{ value: 1 }, { name: "request.resource.attr.aNumber" }],
+    });
+
+    const result = queryPlanToPrisma({
+      queryPlan,
+      mapper: {
+        "request.resource.attr.aNumber": { field: "aNumber" },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { aNumber: { gt: 1 } },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
+    });
+    expect(query.map((r) => r.id).sort()).toEqual(
+      fixtureResources
+        .filter((r) => r.aNumber > 1)
+        .map((r) => r.id)
+        .sort()
+    );
+  });
+
+  test("conditional - size with value first (0 < size(ownedBy) means non-empty)", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "value-first-size",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+
+    const result = queryPlanToPrisma({
+      queryPlan,
+      mapper: {
+        "request.resource.attr.ownedBy": {
+          relation: { name: "ownedBy", type: "many", field: "id" },
+        },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { ownedBy: { some: {} } },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
+    });
+    expect(query.map((r) => r.id).sort()).toEqual(
+      fixtureResources
+        .filter(
+          (r) =>
+            Array.isArray(r.ownedBy?.connect) &&
+            (r.ownedBy.connect as { id: string }[]).length > 0
+        )
+        .map((r) => r.id)
+        .sort()
+    );
+  });
+
+  test("conditional - hasIntersection with value first (constant list is operand 0)", async () => {
+    const queryPlan = await cerbos.planResources({
+      principal: { id: "user1", roles: ["USER"] },
+      resource: { kind: "resource" },
+      action: "value-first-intersect",
+    });
+
+    expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+    expect((queryPlan as PlanResourcesConditionalResponse).condition).toEqual({
+      operator: "hasIntersection",
+      operands: [
+        { value: ["user1", "userX"] },
+        { name: "request.resource.attr.ownedBy" },
+      ],
+    });
+
+    const result = queryPlanToPrisma({
+      queryPlan,
+      mapper: {
+        "request.resource.attr.ownedBy": {
+          relation: { name: "ownedBy", type: "many", field: "id" },
+        },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        ownedBy: { some: { id: { in: ["user1", "userX"] } } },
+      },
+    });
+
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+
+    const query = await prisma.resource.findMany({
+      where: { ...result.filters },
+    });
+    expect(query.map((r) => r.id).sort()).toEqual(
+      fixtureResources
+        .filter(
+          (r) =>
+            Array.isArray(r.ownedBy?.connect) &&
+            (r.ownedBy.connect as { id: string }[]).some((o) =>
+              ["user1", "userX"].includes(o.id)
+            )
+        )
+        .map((r) => r.id)
+        .sort()
+    );
+  });
+});
+
+describe("Known-Value Collections (planner unroll cliff)", () => {
+  // The planner unrolls exists/all over a known collection (e.g. a folded
+  // principal attribute) into an or/and chain at <= 10 elements
+  // (cerbos/cerbos#2570, #2817) and emits the lambda with a literal value-list
+  // collection above that. These tests straddle the 10-item cliff so both wire
+  // shapes stay exercised regardless of the PDP version behind the sidecar.
+  describe("live plans across the 10-item threshold", () => {
+    const buildTeams = (size: number): string[] => {
+      const teams = ["string", "string3"];
+      while (teams.length < size) {
+        teams.push(`filler-${teams.length}`);
+      }
+      return teams;
+    };
+
+    // Supported PDPs are >= 0.54, where both macros unroll at <= 10 elements and
+    // ship the value-list lambda above that. Pin the wire shape so each leg
+    // provably exercises its side of the cliff — if a future planner moves the
+    // threshold, this fails loudly instead of silently testing one shape only.
+    const expectShape = (
+      queryPlan: PlanResourcesResponse,
+      size: number,
+      unrolledOperator: string,
+      macroOperator: string
+    ): void => {
+      const condition = (queryPlan as PlanResourcesConditionalResponse)
+        .condition;
+      expect((condition as PlanExpression).operator).toEqual(
+        size <= 10 ? unrolledOperator : macroOperator
+      );
+    };
+
+    describe.each([9, 10, 11])("with %i-element principal collection", (size) => {
+      test("conditional - principal-exists", async () => {
+        const teams = buildTeams(size);
+        const queryPlan = await cerbos.planResources({
+          principal: { id: "user1", roles: ["USER"], attr: { teams } },
+          resource: { kind: "resource" },
+          action: "principal-exists",
+        });
+
+        expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+        expectShape(queryPlan, size, "or", "exists");
+
+        const result = queryPlanToPrisma({
+          queryPlan,
+          mapper: {
+            "request.resource.attr.aString": { field: "aString" },
+          },
+        });
+
+        if (result.kind !== PlanKind.CONDITIONAL) {
+          throw new Error("Expected CONDITIONAL result");
+        }
+
+        const query = await prisma.resource.findMany({
+          where: { ...result.filters },
+        });
+        expect(query.map((r) => r.id).sort()).toEqual(
+          fixtureResources
+            .filter((r) => teams.includes(r.aString))
+            .map((r) => r.id)
+            .sort()
+        );
+      });
+
+      test("conditional - principal-all", async () => {
+        const teams = buildTeams(size);
+        const queryPlan = await cerbos.planResources({
+          principal: { id: "user1", roles: ["USER"], attr: { teams } },
+          resource: { kind: "resource" },
+          action: "principal-all",
+        });
+
+        expect(queryPlan.kind).toEqual(PlanKind.CONDITIONAL);
+        expectShape(queryPlan, size, "and", "all");
+
+        const result = queryPlanToPrisma({
+          queryPlan,
+          mapper: {
+            "request.resource.attr.aString": { field: "aString" },
+          },
+        });
+
+        if (result.kind !== PlanKind.CONDITIONAL) {
+          throw new Error("Expected CONDITIONAL result");
+        }
+
+        const query = await prisma.resource.findMany({
+          where: { ...result.filters },
+        });
+        expect(query.map((r) => r.id).sort()).toEqual(
+          fixtureResources
+            .filter((r) => !teams.includes(r.aString))
+            .map((r) => r.id)
+            .sort()
+        );
+      });
+    });
+  });
+
+  describe("value-list lambda fold", () => {
+    const valueListPlan = (
+      operator: string,
+      elements: unknown[],
+      body: PlanExpressionOperand,
+      variable = "t"
+    ): PlanResourcesConditionalResponse =>
+      createConditionalPlan({
+        operator,
+        operands: [
+          { value: elements },
+          { operator: "lambda", operands: [body, { name: variable }] },
+        ],
+      } as PlanExpressionOperand);
+
+    test("exists over a value list folds to OR of the substituted body", () => {
+      const result = queryPlanToPrisma({
+        queryPlan: valueListPlan("exists", ["a", "b", "c"], {
+          operator: "eq",
+          operands: [{ name: "request.resource.attr.aString" }, { name: "t" }],
+        }),
+        mapper: { "request.resource.attr.aString": { field: "aString" } },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          OR: [
+            { aString: { equals: "a" } },
+            { aString: { equals: "b" } },
+            { aString: { equals: "c" } },
+          ],
+        },
+      });
+    });
+
+    test("all over a value list folds to AND of the substituted body", () => {
+      const result = queryPlanToPrisma({
+        queryPlan: valueListPlan("all", ["a", "b"], {
+          operator: "ne",
+          operands: [{ name: "request.resource.attr.aString" }, { name: "t" }],
+        }),
+        mapper: { "request.resource.attr.aString": { field: "aString" } },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          AND: [{ aString: { not: "a" } }, { aString: { not: "b" } }],
+        },
+      });
+    });
+
+    test("substitutes variable path references into element fields", () => {
+      const result = queryPlanToPrisma({
+        queryPlan: valueListPlan(
+          "exists",
+          [{ name: "alpha", meta: { rank: 1 } }, { name: "beta", meta: { rank: 2 } }],
+          {
+            operator: "eq",
+            operands: [{ name: "request.resource.attr.aString" }, { name: "t.name" }],
+          }
+        ),
+        mapper: { "request.resource.attr.aString": { field: "aString" } },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          OR: [{ aString: { equals: "alpha" } }, { aString: { equals: "beta" } }],
+        },
+      });
+    });
+
+    test("empty value list yields CEL identity semantics", () => {
+      const body: PlanExpressionOperand = {
+        operator: "eq",
+        operands: [{ name: "request.resource.attr.aString" }, { name: "t" }],
+      };
+      const mapper = { "request.resource.attr.aString": { field: "aString" } };
+
+      // exists over [] is false — Prisma matches nothing for OR: []
+      expect(
+        queryPlanToPrisma({ queryPlan: valueListPlan("exists", [], body), mapper })
+      ).toStrictEqual({ kind: PlanKind.CONDITIONAL, filters: { OR: [] } });
+
+      // all over [] is true — Prisma matches everything for AND: []
+      expect(
+        queryPlanToPrisma({ queryPlan: valueListPlan("all", [], body), mapper })
+      ).toStrictEqual({ kind: PlanKind.CONDITIONAL, filters: { AND: [] } });
+    });
+
+    test("nested lambda rebinding the variable shadows the outer substitution", () => {
+      // Outer t is substituted; the inner exists rebinds t over a relation, so
+      // its body must keep referencing the inner variable untouched.
+      const result = queryPlanToPrisma({
+        queryPlan: valueListPlan("exists", ["public", "private"], {
+          operator: "exists",
+          operands: [
+            { name: "request.resource.attr.tags" },
+            {
+              operator: "lambda",
+              operands: [
+                {
+                  operator: "eq",
+                  operands: [{ name: "t.name" }, { value: "fixed" }],
+                },
+                { name: "t" },
+              ],
+            },
+          ],
+        }),
+        mapper: {
+          "request.resource.attr.tags": {
+            relation: { name: "tags", type: "many" },
+          },
+        },
+      });
+
+      expect(result).toStrictEqual({
+        kind: PlanKind.CONDITIONAL,
+        filters: {
+          OR: [
+            { tags: { some: { name: { equals: "fixed" } } } },
+            { tags: { some: { name: { equals: "fixed" } } } },
+          ],
+        },
+      });
+    });
+
+    test("throws when a variable path is missing on an element", () => {
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan: valueListPlan("exists", [{ name: "alpha" }], {
+            operator: "eq",
+            operands: [
+              { name: "request.resource.attr.aString" },
+              { name: "t.missing" },
+            ],
+          }),
+          mapper: { "request.resource.attr.aString": { field: "aString" } },
+        })
+      ).toThrow('Cannot resolve "t.missing"');
+    });
+
+    test("throws for exists_one over a value list", () => {
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan: valueListPlan("exists_one", ["a"], {
+            operator: "eq",
+            operands: [{ name: "request.resource.attr.aString" }, { name: "t" }],
+          }),
+          mapper: { "request.resource.attr.aString": { field: "aString" } },
+        })
+      ).toThrow("exists_one over a literal collection value is not supported");
+    });
+
+    test("throws for a non-list collection value", () => {
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan: valueListPlan("exists", ["ignored"], {
+            operator: "eq",
+            operands: [{ name: "request.resource.attr.aString" }, { name: "t" }],
+          }),
+          mapper: { "request.resource.attr.aString": { field: "aString" } },
+        })
+      ).not.toThrow();
+
+      const plan = createConditionalPlan({
+        operator: "exists",
+        operands: [
+          { value: { not: "a list" } },
+          {
+            operator: "lambda",
+            operands: [
+              {
+                operator: "eq",
+                operands: [
+                  { name: "request.resource.attr.aString" },
+                  { name: "t" },
+                ],
+              },
+              { name: "t" },
+            ],
+          },
+        ],
+      } as PlanExpressionOperand);
+      expect(() =>
+        queryPlanToPrisma({
+          queryPlan: plan,
+          mapper: { "request.resource.attr.aString": { field: "aString" } },
+        })
+      ).toThrow("exists over a literal collection requires a list value");
+    });
+  });
+});
+
+describe("Promoted adversarial planner shapes", () => {
+  const valueListMacro = (
+    operator: "exists" | "all",
+    elements: string[]
+  ): PlanExpressionOperand => ({
+    operator,
+    operands: [
+      { value: elements },
+      {
+        operator: "lambda",
+        operands: [
+          {
+            operator: "eq",
+            operands: [
+              { name: "request.resource.attr.aString" },
+              { name: "team" },
+            ],
+          },
+          { name: "team" },
+        ],
+      },
+    ],
+  });
+
+  test("negated exists over a literal collection folds to AND of negated bodies (#294)", () => {
+    const result = queryPlanToPrisma({
+      queryPlan: createConditionalPlan({
+        operator: "not",
+        operands: [valueListMacro("exists", ["a", "b"])],
+      }),
+      mapper: {
+        "request.resource.attr.aString": { field: "aString" },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        AND: [
+          { NOT: { aString: { equals: "a" } } },
+          { NOT: { aString: { equals: "b" } } },
+        ],
+      },
+    });
+  });
+
+  test("negated all over a literal collection folds to OR of negated bodies (#294)", () => {
+    const result = queryPlanToPrisma({
+      queryPlan: createConditionalPlan({
+        operator: "not",
+        operands: [valueListMacro("all", ["a", "b"])],
+      }),
+      mapper: {
+        "request.resource.attr.aString": { field: "aString" },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        OR: [
+          { NOT: { aString: { equals: "a" } } },
+          { NOT: { aString: { equals: "b" } } },
+        ],
+      },
+    });
+  });
+
+  test("constant NaN ordering in a ternary branch is always false", () => {
+    const result = queryPlanToPrisma({
+      queryPlan: createConditionalPlan({
+        operator: "gt",
+        operands: [
+          {
+            operator: "if",
+            operands: [
+              { name: "request.resource.attr.aBool" },
+              { value: 1 },
+              {
+                operator: "div",
+                operands: [{ value: 0 }, { value: 0 }],
+              },
+            ],
+          },
+          { value: 0.5 },
+        ],
+      }),
+      mapper: { "request.resource.attr.aBool": { field: "aBool" } },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        OR: [
+          { aBool: { equals: true } },
+          {
+            AND: [
+              { aBool: { equals: true } },
+              { aBool: { equals: false } },
+            ],
+          },
+        ],
+      },
+    });
+  });
+
+  test("value-first timestamp comparison mirrors and normalizes the instant", () => {
+    const result = queryPlanToPrisma({
+      queryPlan: createConditionalPlan({
+        operator: "gt",
+        operands: [
+          {
+            operator: "timestamp",
+            operands: [{ value: "2024-06-01T02:00:00+02:00" }],
+          },
+          {
+            operator: "timestamp",
+            operands: [{ name: "request.resource.attr.createdAt" }],
+          },
+        ],
+      }),
+      mapper: {
+        "request.resource.attr.createdAt": {
+          field: "createdAt",
+          valueType: "dateTime",
+        },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        createdAt: { lt: "2024-06-01T00:00:00.000Z" },
+      },
+    });
+  });
+
+  test("timestamp over an untyped string mapping fails closed", () => {
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: createConditionalPlan({
+          operator: "lt",
+          operands: [
+            {
+              operator: "timestamp",
+              operands: [{ name: "request.resource.attr.createdBy" }],
+            },
+            {
+              operator: "timestamp",
+              operands: [{ value: "2025-01-01T00:00:00Z" }],
+            },
+          ],
+        }),
+        mapper: {
+          "request.resource.attr.createdBy": { field: "createdBy" },
+        },
+      })
+    ).toThrow('must be mapped with valueType: "dateTime"');
+  });
+
+  test.each([
+    "2024-01-01",
+    "0000-01-01T00:00:00Z",
+    "2024-02-30T00:00:00Z",
+    "2024-01-01T00:00:00.1234Z",
+    "9999-12-31T23:00:00-02:00",
+  ])("timestamp literal %s fails closed", (value) => {
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: createConditionalPlan({
+          operator: "eq",
+          operands: [
+            {
+              operator: "timestamp",
+              operands: [{ name: "request.resource.attr.createdAt" }],
+            },
+            { operator: "timestamp", operands: [{ value }] },
+          ],
+        }),
+        mapper: {
+          "request.resource.attr.createdAt": {
+            field: "createdAt",
+            valueType: "dateTime",
+          },
+        },
+      })
+    ).toThrow(/RFC 3339|millisecond|instant range/);
+  });
+
+  test("timestamp accepts excess fractional digits only when they are zero", () => {
+    const result = queryPlanToPrisma({
+      queryPlan: createConditionalPlan({
+        operator: "eq",
+        operands: [
+          {
+            operator: "timestamp",
+            operands: [{ name: "request.resource.attr.createdAt" }],
+          },
+          {
+            operator: "timestamp",
+            operands: [{ value: "2024-01-01T00:00:00.123000Z" }],
+          },
+        ],
+      }),
+      mapper: {
+        "request.resource.attr.createdAt": {
+          field: "createdAt",
+          valueType: "dateTime",
+        },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: { createdAt: { equals: "2024-01-01T00:00:00.123Z" } },
+    });
+  });
+
+  test("membership list containing null becomes an explicit null disjunct", () => {
+    const result = queryPlanToPrisma({
+      queryPlan: createConditionalPlan({
+        operator: "in",
+        operands: [
+          { name: "request.resource.attr.owner" },
+          { value: ["x", "one_two", null] },
+        ],
+      }),
+      mapper: {
+        "request.resource.attr.owner": { field: "aOptionalString" },
+      },
+    });
+
+    expect(result).toStrictEqual({
+      kind: PlanKind.CONDITIONAL,
+      filters: {
+        OR: [
+          { aOptionalString: { in: ["x", "one_two"] } },
+          { aOptionalString: null },
+        ],
+      },
+    });
+  });
+
+  test("fractional addition equality fails closed instead of algebraically solving", () => {
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: createConditionalPlan({
+          operator: "eq",
+          operands: [
+            {
+              operator: "add",
+              operands: [
+                { name: "request.resource.attr.aDouble" },
+                { value: 0.7 },
+              ],
+            },
+            { value: 0.1 },
+          ],
+        }),
+        mapper: {
+          "request.resource.attr.aDouble": { field: "aDouble" },
+        },
+      })
+    ).toThrow(
+      "solving IEEE-754 addition into a plain Prisma column comparison is not reversible"
+    );
+  });
+
+  test("hierarchy prefix containing LIKE metacharacters fails closed", () => {
+    expect(() =>
+      queryPlanToPrisma({
+        queryPlan: createConditionalPlan({
+          operator: "descendentOf",
+          operands: [
+            {
+              operator: "hierarchy",
+              operands: [
+                { name: "request.resource.attr.scope" },
+                { value: ":" },
+              ],
+            },
+            {
+              operator: "hierarchy",
+              operands: [{ value: "50%:a_b" }, { value: ":" }],
+            },
+          ],
+        }),
+        mapper: { "request.resource.attr.scope": { field: "scope" } },
+      })
+    ).toThrow("Prisma emits LIKE without an ESCAPE clause");
+  });
+
+  test("nested nullable collection errors propagate through negated exists", () => {
+    const result = queryPlanToPrisma({
+      queryPlan: createConditionalPlan({
+        operator: "not",
+        operands: [
+          {
+            operator: "exists",
+            operands: [
+              { name: "request.resource.attr.categories" },
+              {
+                operator: "lambda",
+                operands: [
+                  {
+                    operator: "exists",
+                    operands: [
+                      { name: "category.subCategories" },
+                      {
+                        operator: "lambda",
+                        operands: [
+                          {
+                            operator: "exists",
+                            operands: [
+                              { name: "subCategory.labels" },
+                              {
+                                operator: "lambda",
+                                operands: [
+                                  {
+                                    operator: "eq",
+                                    operands: [
+                                      { name: "label.name" },
+                                      { value: "gold" },
+                                    ],
+                                  },
+                                  { name: "label" },
+                                ],
+                              },
+                            ],
+                          },
+                          { name: "subCategory" },
+                        ],
+                      },
+                    ],
+                  },
+                  { name: "category" },
+                ],
+              },
+            ],
+          },
+        ],
+      }),
+      mapper: {
+        "request.resource.attr.categories": {
+          relation: {
+            name: "categories",
+            type: "many",
+            fields: {
+              subCategories: {
+                relation: {
+                  name: "subCategories",
+                  type: "many",
+                  fields: {
+                    labels: {
+                      relation: {
+                        name: "labels",
+                        type: "many",
+                        fields: {
+                          name: { field: "name", nullable: true },
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    expect(result.kind).toBe(PlanKind.CONDITIONAL);
+    if (result.kind !== PlanKind.CONDITIONAL) {
+      throw new Error("Expected CONDITIONAL result");
+    }
+    expect(JSON.stringify(result.filters)).toContain('"name":null');
+    expect(JSON.stringify(result.filters)).toContain('"NOT":{"categories"');
+  });
 });