@cerbos/orm-prisma 3.3.0 → 4.1.0

package/lib/index.js

@@ -12,6 +12,71 @@ const CERBOS_TO_PRISMA_OPERATOR = {
     gt: "gt",
     ge: "gte",
 };
+// Directional operators mirror when their operands swap sides; symmetric operators are unchanged.
+const MIRRORED_OPERATOR = {
+    lt: "gt",
+    gt: "lt",
+    le: "ge",
+    ge: "le",
+};
+const RFC3339_MILLISECOND_TIMESTAMP = /^((?!0000)\d{4})-(\d{2})-(\d{2})[Tt](?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.(\d{1,9}))?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+const MIN_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse("0001-01-01T00:00:00.000Z");
+const MAX_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse("9999-12-31T23:59:59.999Z");
+function normalizeRfc3339Milliseconds(value) {
+    const match = RFC3339_MILLISECOND_TIMESTAMP.exec(value);
+    const yearText = match?.[1];
+    const monthText = match?.[2];
+    const dayText = match?.[3];
+    const fraction = match?.[4] ?? "";
+    if (!yearText || !monthText || !dayText) {
+        throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    if ([...fraction.slice(3)].some((digit) => digit !== "0")) {
+        throw new Error(`Timestamp value exceeds millisecond precision: ${value}`);
+    }
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const calendarDate = new Date(0);
+    calendarDate.setUTCHours(0, 0, 0, 0);
+    calendarDate.setUTCFullYear(year, month - 1, day);
+    if (calendarDate.getUTCFullYear() !== year ||
+        calendarDate.getUTCMonth() !== month - 1 ||
+        calendarDate.getUTCDate() !== day) {
+        throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    const milliseconds = Date.parse(value);
+    if (Number.isNaN(milliseconds)) {
+        throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    if (milliseconds < MIN_RFC3339_TIMESTAMP_MILLISECONDS ||
+        milliseconds > MAX_RFC3339_TIMESTAMP_MILLISECONDS) {
+        throw new Error(`Timestamp value is outside CEL's supported instant range: ${value}`);
+    }
+    return new Date(milliseconds).toISOString();
+}
+/**
+ * Normalize a binary comparison to field-side-first. The planner preserves policy source
+ * order, so a constant may precede the field it constrains (`1 < R.attr.x` arrives as
+ * `lt(value, variable)`) — swap the operands and mirror directional operators so downstream
+ * handlers can assume the field/expression side is first. Without this, value-first
+ * comparisons are silently inverted (#256).
+ */
+function normalizeBinaryOperands(operator, operands) {
+    const first = operands[0];
+    const second = operands[1];
+    if (operands.length === 2 &&
+        first !== undefined &&
+        second !== undefined &&
+        isValueOperand(first) &&
+        !isValueOperand(second)) {
+        return {
+            operator: MIRRORED_OPERATOR[operator] ?? operator,
+            operands: [second, first],
+        };
+    }
+    return { operator, operands };
+}
 function isNamedOperand(operand) {
     return "name" in operand && typeof operand.name === "string";
 }
@@ -30,6 +95,137 @@ function assertDefined(value, message) {
     }
     return value;
 }
+// Operators whose second operand is a lambda that binds an iteration variable.
+const LAMBDA_BINDING_OPERATORS = new Set([
+    "exists",
+    "exists_one",
+    "all",
+    "filter",
+    "map",
+    "except",
+]);
+/**
+ * Substitute a lambda iteration variable with a concrete collection element
+ * inside a lambda body. A bare reference to the variable becomes the element
+ * itself; a `variable.path.to.field` reference drills into the element. A
+ * nested collection macro whose lambda rebinds the same variable name shadows
+ * the outer variable, so substitution only descends into its collection
+ * operand.
+ */
+function substituteLambdaVariable(operand, variableName, element) {
+    if (isNamedOperand(operand)) {
+        if (operand.name === variableName) {
+            return { value: element };
+        }
+        if (operand.name.startsWith(`${variableName}.`)) {
+            let current = element;
+            for (const segment of operand.name
+                .slice(variableName.length + 1)
+                .split(".")) {
+                if (current === null ||
+                    typeof current !== "object" ||
+                    Array.isArray(current) ||
+                    !(segment in current) ||
+                    current[segment] === undefined) {
+                    throw new Error(`Cannot resolve "${operand.name}": collection element has no field "${segment}"`);
+                }
+                current = current[segment];
+            }
+            return { value: current };
+        }
+        return operand;
+    }
+    if (isOperatorOperand(operand)) {
+        if (LAMBDA_BINDING_OPERATORS.has(operand.operator) &&
+            operand.operands.length === 2) {
+            const [nestedCollection, nestedLambda] = operand.operands;
+            if (nestedCollection !== undefined &&
+                nestedLambda !== undefined &&
+                isOperatorOperand(nestedLambda) &&
+                nestedLambda.operator === "lambda") {
+                const nestedVariable = nestedLambda.operands[1];
+                if (nestedVariable !== undefined &&
+                    isNamedOperand(nestedVariable) &&
+                    nestedVariable.name === variableName) {
+                    // The nested lambda shadows our variable: substitute only in the
+                    // collection operand.
+                    return {
+                        operator: operand.operator,
+                        operands: [
+                            substituteLambdaVariable(nestedCollection, variableName, element),
+                            nestedLambda,
+                        ],
+                    };
+                }
+            }
+        }
+        return {
+            operator: operand.operator,
+            operands: operand.operands.map((o) => substituteLambdaVariable(o, variableName, element)),
+        };
+    }
+    return operand;
+}
+/**
+ * Fold a collection macro whose collection operand is a literal value list.
+ *
+ * The planner emits this shape when a known-value collection (typically a
+ * folded principal attribute) has more than 10 elements — at 10 or fewer it
+ * unrolls `exists`/`all` into an or/and chain itself (cerbos/cerbos#2570,
+ * cerbos/cerbos#2817; `maxItems = 10` in the planner's struct matcher). Apply
+ * the same fold here so the translated filter does not depend on which side of
+ * that threshold the collection lands: substitute each element into the lambda
+ * body and combine the per-element filters with OR (`exists`) or AND (`all`).
+ *
+ * An empty list yields `{OR: []}` / `{AND: []}`, which Prisma evaluates to
+ * match-nothing / match-everything — exactly CEL's `exists`/`all` semantics
+ * over an empty collection.
+ */
+function handleKnownValueCollectionOperator(operator, collection, lambda, mapper, negated) {
+    if (operator !== "exists" && operator !== "all") {
+        throw new Error(`${operator} over a literal collection value is not supported. ` +
+            "Only exists() and all() can be folded into a flat filter.");
+    }
+    const elements = collection.value;
+    if (!Array.isArray(elements)) {
+        throw new Error(`${operator} over a literal collection requires a list value`);
+    }
+    if (!isOperatorOperand(lambda) || lambda.operator !== "lambda") {
+        throw new Error(`Second operand of ${operator} must be a lambda expression`);
+    }
+    if (lambda.operands.length !== 2) {
+        throw new Error(`${operator} over a literal collection supports single-variable lambdas only`);
+    }
+    const body = assertDefined(lambda.operands[0], "Lambda expression must provide a condition");
+    const variable = assertDefined(lambda.operands[1], "Lambda variable must have a name");
+    if (!isNamedOperand(variable)) {
+        throw new Error("Lambda variable must have a name");
+    }
+    const filters = elements.map((element) => {
+        const substituted = substituteLambdaVariable(body, variable.name, element);
+        return negated
+            ? buildNegatedFilter(substituted, mapper)
+            : buildPrismaFilterFromCerbosExpression(substituted, mapper);
+    });
+    const combinesWithOr = operator === "exists" ? !negated : negated;
+    return combinesWithOr ? { OR: filters } : { AND: filters };
+}
+function tryHandleKnownValueCollectionOperator(operator, operands, mapper, negated) {
+    if (operands.length !== 2) {
+        return undefined;
+    }
+    const collection = operands[0];
+    const lambda = operands[1];
+    if (collection === undefined ||
+        lambda === undefined ||
+        !isValueOperand(collection)) {
+        return undefined;
+    }
+    // A literal value list arrives when the planner could not unroll a macro
+    // over a known collection (more than 10 elements). Fold it before attempting
+    // relation resolution because there is no relation mapping for a literal.
+    return handleKnownValueCollectionOperator(operator, collection, lambda, mapper, negated);
+}
 function getLeafField(path) {
     const fieldName = path[path.length - 1];
     if (!fieldName) {
@@ -44,32 +240,16 @@ function getFilterEntry(filter) {
     }
     return entry;
 }
+/** Whether this reference is one the caller sends as an explicit `null` when the column is NULL. */
+function isExplicitNullReference(fieldRef) {
+    return fieldRef.nullAttributeRepresentation === "explicit";
+}
 function isResolvedFieldReference(operand) {
     return "path" in operand;
 }
 function isResolvedValue(operand) {
     return "value" in operand;
 }
-function getNamedOperand(operands, message) {
-    const operand = operands.find(isNamedOperand);
-    if (!operand) {
-        throw new Error(message);
-    }
-    return operand;
-}
-function getValueOperand(operands, message) {
-    const operand = operands.find(isValueOperand);
-    if (!operand) {
-        throw new Error(message);
-    }
-    return operand;
-}
-function requireResolvedFieldReference(operand, message) {
-    if (!isResolvedFieldReference(operand)) {
-        throw new Error(message);
-    }
-    return operand;
-}
 function requireResolvedValue(operand, message) {
     if (!isResolvedValue(operand)) {
         throw new Error(message);
@@ -86,31 +266,427 @@ function buildFieldEqualsFilter(fieldRef, value) {
     const fieldName = getLeafField(fieldRef.path);
     return wrapRelations(fieldRef.relations, { [fieldName]: { equals: value } });
 }
-function buildFieldDirectOrInFilter(fieldRef, values) {
+function buildDirectOrInLeaf(fieldRef, values) {
     const fieldName = getLeafField(fieldRef.path);
-    const baseFilter = values.length === 1
+    return values.length === 1
         ? { [fieldName]: values[0] }
         : { [fieldName]: { in: values } };
-    return wrapRelations(fieldRef.relations, baseFilter);
+}
+function buildFieldDirectOrInFilter(fieldRef, values) {
+    return wrapRelations(fieldRef.relations, buildDirectOrInLeaf(fieldRef, values));
+}
+/**
+ * `field IS NOT NULL AND <leaf>`, so a NULL column makes the whole thing definitely FALSE rather
+ * than merely unmatched — which is what lets an enclosing `NOT` include the row.
+ *
+ * Prisma has no three-valued logic to expose: a record either matches a `where` or it does not.
+ * That is exactly why the guard has to be explicit — `{ NOT: { field: { equals: "x" } } }` leans on
+ * the generated SQL's UNKNOWN, which excludes the record under both polarities, and an
+ * explicit-null attribute needs the negation to include it.
+ *
+ * The guard is ANDed with the leaf BEFORE the relation wrapping, so both halves are evaluated
+ * against the same element rather than against two independently-matched ones.
+ */
+function guardedFieldFilter(fieldRef, leaf) {
+    const fieldName = getLeafField(fieldRef.path);
+    return wrapRelations(fieldRef.relations, {
+        AND: [{ [fieldName]: { not: null } }, leaf],
+    });
+}
+function buildMembershipFilter(fieldRef, values) {
+    const nonNullValues = values.filter((value) => value !== null);
+    const carriesNull = nonNullValues.length !== values.length;
+    if (carriesNull) {
+        assertNullOperandTranslatable("a null element in an `in` list", fieldRef.nullAttributeRepresentation);
+    }
+    const filters = [];
+    if (nonNullValues.length > 0 || values.length === 0) {
+        // Without a null element nothing has made the membership definite yet: a NULL column is
+        // dropped by `{ in: [...] }` under BOTH polarities, while CEL compares a null VALUE against
+        // each element and gets a definite false, so its negation is TRUE. With a null element the
+        // `[null]` disjunct below already settles it.
+        filters.push(carriesNull || !isExplicitNullReference(fieldRef)
+            ? buildFieldDirectOrInFilter(fieldRef, nonNullValues)
+            : guardedFieldFilter(fieldRef, buildDirectOrInLeaf(fieldRef, nonNullValues)));
+    }
+    if (carriesNull) {
+        filters.push(buildFieldDirectOrInFilter(fieldRef, [null]));
+    }
+    if (filters.length === 1) {
+        return assertDefined(filters[0], "Membership filter is missing");
+    }
+    return { OR: filters };
+}
+function buildAlwaysTrueFilter() {
+    return {};
+}
+let lambdaScopes = [];
+let rootModelName;
+let nullRepresentation = "explicit";
+/**
+ * Guards every site that would emit a NULL-selecting predicate out of a `null` comparison
+ * operand.
+ *
+ * Under the `"omitted"` representation a NULL column carries no attribute, so CEL raises a
+ * missing-attribute error and `check()` denies the row — `IS NULL` would return exactly the rows
+ * the PDP refuses. The rejection is deliberately wider than the over-granting shapes: `ne(x,
+ * null)` on its own is aligned, but Prisma applies negation by wrapping (`{ NOT: ... }`) rather
+ * than by pushing it into the leaf, so a leaf cannot tell whether an enclosing `not` will flip
+ * `IS NOT NULL` back into a NULL-selecting predicate. Rejecting every null operand is correct
+ * under any nesting; narrowing it requires negation-parity tracking.
+ */
+function assertNullOperandTranslatable(context, declared) {
+    if ((declared ?? nullRepresentation) === "omitted") {
+        throw new Error(`Cannot translate ${context} under nullAttributeRepresentation "omitted": a NULL column ` +
+            "sends no attribute, so Cerbos evaluates the comparison as a missing-attribute error " +
+            "(deny) while a NULL-selecting filter would return those rows. Send NULL columns as " +
+            'explicit nulls and use "explicit", or keep this shape out of the policy.');
+    }
 }
 /**
  * Converts a Cerbos query plan to a Prisma filter.
  */
-function queryPlanToPrisma({ queryPlan, mapper = {}, }) {
+function queryPlanToPrisma({ queryPlan, mapper = {}, model, nullAttributeRepresentation = "explicit", }) {
+    nullRepresentation = nullAttributeRepresentation;
     switch (queryPlan.kind) {
         case core_1.PlanKind.ALWAYS_ALLOWED:
             return { kind: core_1.PlanKind.ALWAYS_ALLOWED };
         case core_1.PlanKind.ALWAYS_DENIED:
             return { kind: core_1.PlanKind.ALWAYS_DENIED };
-        case core_1.PlanKind.CONDITIONAL:
+        case core_1.PlanKind.CONDITIONAL: {
+            lambdaScopes = [];
+            rootModelName = model;
+            const condition = constantFoldExpression(hoistOuterScopeReferences(queryPlan.condition, []));
+            if (isValueOperand(condition)) {
+                // Real PDP plans fold constant conditions to ALWAYS_ALLOWED/ALWAYS_DENIED before
+                // they reach the adapter; this can only surface with hand-crafted plans.
+                if (condition.value === true) {
+                    return { kind: core_1.PlanKind.CONDITIONAL, filters: {} };
+                }
+                // Prisma has no model-agnostic always-false `where` shape: empty logical arrays
+                // are ignored.
+                throw new Error("A constant-false conditional predicate must be folded by the Cerbos planner");
+            }
+            // A `map()` at the ROOT of the condition returns a list, not a boolean. Translating it
+            // produces a projection filter that is not a valid Prisma `where` clause — the shape
+            // must be refused HERE rather than left for findMany to reject at query time, because
+            // a projection that happened to coerce would be a silently-wrong filter. (`filter()`
+            // as a condition is already rejected inside handleCollectionOperator with its own
+            // message; nested inside a comparison or size() both remain translatable.)
+            if (isOperatorOperand(condition) && condition.operator === "map") {
+                throw new Error("map() returns a list, not a boolean, so it cannot be a condition on its own; " +
+                    "only comparisons or size() over its result have a boolean meaning");
+            }
             return {
                 kind: core_1.PlanKind.CONDITIONAL,
-                filters: buildPrismaFilterFromCerbosExpression(queryPlan.condition, mapper),
+                filters: buildPrismaFilterFromCerbosExpression(condition, mapper),
             };
+        }
         default:
             throw Error(`Invalid query plan.`);
     }
 }
+const COLLECTION_OPERATORS = new Set([
+    "exists",
+    "exists_one",
+    "all",
+    "except",
+    "filter",
+]);
+function mentionsVariable(expr, variableName) {
+    if (isNamedOperand(expr)) {
+        return (expr.name === variableName || expr.name.startsWith(variableName + "."));
+    }
+    if (isOperatorOperand(expr)) {
+        return expr.operands.some((operand) => mentionsVariable(operand, variableName));
+    }
+    return false;
+}
+function isOuterScopeName(name, enclosingVariables) {
+    return !enclosingVariables.some((variable) => name === variable || name.startsWith(variable + "."));
+}
+/** Replaces every occurrence of the bare named operand `name` with a boolean constant. */
+function substituteNamedOperand(expr, name, value) {
+    if (isNamedOperand(expr)) {
+        return expr.name === name ? { value } : expr;
+    }
+    if (isOperatorOperand(expr)) {
+        return {
+            operator: expr.operator,
+            operands: expr.operands.map((operand) => substituteNamedOperand(operand, name, value)),
+        };
+    }
+    return expr;
+}
+/**
+ * Finds a bare boolean reference to an OUTER column (root or enclosing lambda scope) in a
+ * boolean position of a lambda body: a direct operand of and/or/not, a ternary condition, or
+ * the body itself.
+ */
+function findOuterBooleanReference(expr, enclosingVariables) {
+    if (isNamedOperand(expr)) {
+        return isOuterScopeName(expr.name, enclosingVariables)
+            ? expr.name
+            : undefined;
+    }
+    if (!isOperatorOperand(expr)) {
+        return undefined;
+    }
+    const booleanPositions = [];
+    switch (expr.operator) {
+        case "and":
+        case "or":
+        case "not":
+            booleanPositions.push(...expr.operands);
+            break;
+        case "if":
+            booleanPositions.push(...expr.operands);
+            break;
+        default:
+            // Comparisons wrapping a ternary keep the outer reference in the ternary condition.
+            booleanPositions.push(...expr.operands.filter((operand) => isOperatorOperand(operand) &&
+                (operand.operator === "if" ||
+                    operand.operator === "and" ||
+                    operand.operator === "or" ||
+                    operand.operator === "not")));
+            break;
+    }
+    for (const operand of booleanPositions) {
+        const found = findOuterBooleanReference(operand, enclosingVariables);
+        if (found !== undefined) {
+            return found;
+        }
+    }
+    return undefined;
+}
+/**
+ * Rewrites lambda bodies that reference columns of an ENCLOSING scope (the root row, or an
+ * outer lambda's element) so that every filter lands on the model it belongs to. Without this,
+ * an outer column referenced inside `tags.exists(t, ...)` would be emitted as a field of the
+ * tag model. Two sound transforms, applied bottom-up:
+ *
+ * - Conjunct hoisting (exists only): `exists(c, P(c) && Q)` with row-constant Q becomes
+ *   `exists(c, P(c)) && Q`. Valid in three-valued logic (AND distributes over the per-element
+ *   OR), including the empty-collection case (both sides are FALSE).
+ * - Case split (any collection op): a bare outer boolean reference Q in a boolean position
+ *   becomes `(Q && op[Q:=true]) || (!Q && op[Q:=false]) || (Q && !Q)`. The contradiction arm
+ *   keeps the whole expression UNKNOWN (not FALSE) when Q is NULL-derived, mirroring the
+ *   guarded-ternary encoding.
+ */
+function hoistOuterScopeReferences(expr, enclosingVariables) {
+    if (!isOperatorOperand(expr)) {
+        return expr;
+    }
+    if (COLLECTION_OPERATORS.has(expr.operator) && expr.operands.length === 2) {
+        const [collection, lambda] = expr.operands;
+        if (collection !== undefined &&
+            lambda !== undefined &&
+            isOperatorOperand(lambda) &&
+            lambda.operator === "lambda" &&
+            lambda.operands.length === 2 &&
+            lambda.operands[1] !== undefined &&
+            isNamedOperand(lambda.operands[1])) {
+            const variable = lambda.operands[1];
+            const body = hoistOuterScopeReferences(assertDefined(lambda.operands[0], "Lambda requires a condition"), [...enclosingVariables, variable.name]);
+            const rebuild = (newBody) => ({
+                operator: expr.operator,
+                operands: [
+                    collection,
+                    { operator: "lambda", operands: [newBody, variable] },
+                ],
+            });
+            // Conjunct hoisting out of exists().
+            if (expr.operator === "exists" &&
+                isOperatorOperand(body) &&
+                body.operator === "and") {
+                const elementConjuncts = body.operands.filter((operand) => mentionsVariable(operand, variable.name));
+                const outerConjuncts = body.operands.filter((operand) => !mentionsVariable(operand, variable.name));
+                if (outerConjuncts.length > 0 && elementConjuncts.length > 0) {
+                    const innerBody = elementConjuncts.length === 1
+                        ? elementConjuncts[0]
+                        : { operator: "and", operands: elementConjuncts };
+                    return {
+                        operator: "and",
+                        operands: [rebuild(innerBody), ...outerConjuncts],
+                    };
+                }
+            }
+            // Case split on a bare outer boolean reference.
+            const outerRef = findOuterBooleanReference(body, [
+                ...enclosingVariables,
+                variable.name,
+            ]);
+            if (outerRef !== undefined) {
+                const q = { name: outerRef };
+                const notQ = { operator: "not", operands: [q] };
+                return {
+                    operator: "or",
+                    operands: [
+                        {
+                            operator: "and",
+                            operands: [
+                                q,
+                                rebuild(substituteNamedOperand(body, outerRef, true)),
+                            ],
+                        },
+                        {
+                            operator: "and",
+                            operands: [
+                                notQ,
+                                rebuild(substituteNamedOperand(body, outerRef, false)),
+                            ],
+                        },
+                        // Contradiction arm: UNKNOWN when the reference is NULL-derived, never TRUE.
+                        { operator: "and", operands: [q, notQ] },
+                    ],
+                };
+            }
+            return rebuild(body);
+        }
+    }
+    return {
+        operator: expr.operator,
+        operands: expr.operands.map((operand) => hoistOuterScopeReferences(operand, enclosingVariables)),
+    };
+}
+const FOLDABLE_COMPARISON_OPERATORS = new Set([
+    "eq",
+    "ne",
+    "lt",
+    "le",
+    "gt",
+    "ge",
+]);
+/**
+ * Bottom-up constant folding over the plan AST. Only shapes the case-split transform can
+ * produce need folding (constant ternary conditions, comparisons between two constants,
+ * logical operators with constant operands, collection macros with constant bodies); real
+ * planner output arrives pre-folded.
+ */
+function constantFoldExpression(expr) {
+    if (!isOperatorOperand(expr)) {
+        return expr;
+    }
+    const operands = expr.operands.map(constantFoldExpression);
+    const folded = { operator: expr.operator, operands };
+    switch (expr.operator) {
+        case "if": {
+            const [condition, thenBranch, elseBranch] = operands;
+            if (condition !== undefined && isValueOperand(condition)) {
+                if (typeof condition.value !== "boolean") {
+                    throw new Error("if (ternary) condition must be a boolean expression");
+                }
+                return assertDefined(condition.value ? thenBranch : elseBranch, "if (ternary) requires branch operands");
+            }
+            return folded;
+        }
+        case "and": {
+            if (operands.some((o) => isValueOperand(o) && o.value === false)) {
+                return { value: false };
+            }
+            const remaining = operands.filter((o) => !isValueOperand(o));
+            if (remaining.length === 0)
+                return { value: true };
+            if (remaining.length === 1)
+                return remaining[0];
+            return { operator: "and", operands: remaining };
+        }
+        case "or": {
+            if (operands.some((o) => isValueOperand(o) && o.value === true)) {
+                return { value: true };
+            }
+            const remaining = operands.filter((o) => !isValueOperand(o));
+            if (remaining.length === 0)
+                return { value: false };
+            if (remaining.length === 1)
+                return remaining[0];
+            return { operator: "or", operands: remaining };
+        }
+        case "not": {
+            const operand = operands[0];
+            if (operand !== undefined && isValueOperand(operand)) {
+                return { value: operand.value !== true };
+            }
+            return folded;
+        }
+        case "add":
+        case "sub":
+        case "mult":
+        case "div": {
+            const [left, right] = operands;
+            if (left !== undefined &&
+                right !== undefined &&
+                isValueOperand(left) &&
+                isValueOperand(right)) {
+                return {
+                    value: foldArithmetic(expr.operator, left.value, right.value),
+                };
+            }
+            return folded;
+        }
+        case "contains":
+        case "startsWith":
+        case "endsWith": {
+            const [receiver, needle] = operands;
+            if (receiver !== undefined &&
+                needle !== undefined &&
+                isValueOperand(receiver) &&
+                isValueOperand(needle) &&
+                typeof receiver.value === "string" &&
+                typeof needle.value === "string") {
+                const r = receiver.value;
+                const n = needle.value;
+                return {
+                    value: expr.operator === "contains"
+                        ? r.includes(n)
+                        : expr.operator === "startsWith"
+                            ? r.startsWith(n)
+                            : r.endsWith(n),
+                };
+            }
+            return folded;
+        }
+        case "exists":
+        case "all": {
+            const [collection, lambda] = operands;
+            if (collection !== undefined &&
+                lambda !== undefined &&
+                isOperatorOperand(lambda) &&
+                lambda.operator === "lambda" &&
+                lambda.operands[0] !== undefined &&
+                isValueOperand(lambda.operands[0])) {
+                const bodyValue = lambda.operands[0].value === true;
+                if (expr.operator === "exists" && !bodyValue)
+                    return { value: false };
+                if (expr.operator === "all" && bodyValue)
+                    return { value: true };
+                const sizeExpr = {
+                    operator: "size",
+                    operands: [collection],
+                };
+                // exists(c, true) is "collection is non-empty"; all(c, false) is "collection is empty".
+                return expr.operator === "exists"
+                    ? { operator: "gt", operands: [sizeExpr, { value: 0 }] }
+                    : { operator: "eq", operands: [sizeExpr, { value: 0 }] };
+            }
+            return folded;
+        }
+        default: {
+            if (FOLDABLE_COMPARISON_OPERATORS.has(expr.operator)) {
+                const [left, right] = operands;
+                if (left !== undefined &&
+                    right !== undefined &&
+                    isValueOperand(left) &&
+                    isValueOperand(right)) {
+                    return {
+                        value: evaluateConstantComparison(expr.operator, left.value, right.value),
+                    };
+                }
+            }
+            return folded;
+        }
+    }
+}
 /**
  * Resolves a field reference considering relations and nested fields.
  */
@@ -144,8 +720,10 @@ function resolveFieldReference(reference, mapper) {
             {
                 name,
                 type,
+                model: activeConfig.relation.model,
                 field: activeConfig.relation.field,
                 nestedMapper: fields,
+                subqueryFilter: activeConfig.relation.subqueryFilter,
             },
         ];
         // Process nested relations
@@ -165,8 +743,10 @@ function resolveFieldReference(reference, mapper) {
                     relations.push({
                         name: nextConfig.relation.name,
                         type: nextConfig.relation.type,
+                        model: nextConfig.relation.model,
                         field: nextConfig.relation.field,
                         nestedMapper: nextConfig.relation.fields,
+                        subqueryFilter: nextConfig.relation.subqueryFilter,
                     });
                     currentMapper = nextConfig.relation.fields || {};
                     currentParts = currentParts.slice(1);
@@ -181,10 +761,19 @@ function resolveFieldReference(reference, mapper) {
                 }
             }
         }
-        return { path: field ? [field] : remainingParts, relations };
+        return {
+            path: field ? [field] : remainingParts,
+            relations,
+            valueType: activeConfig.valueType,
+            nullAttributeRepresentation: activeConfig.nullAttributeRepresentation,
+        };
     }
     // Simple field mapping
-    return { path: [activeConfig?.field || reference] };
+    return {
+        path: [activeConfig?.field || reference],
+        valueType: activeConfig?.valueType,
+        nullAttributeRepresentation: activeConfig?.nullAttributeRepresentation,
+    };
 }
 /**
  * Determines the appropriate Prisma operator based on relation type.
@@ -192,9 +781,137 @@ function resolveFieldReference(reference, mapper) {
 function getPrismaRelationOperator(relation) {
     return relation.type === "one" ? "is" : "some";
 }
+/**
+ * One relation-scoped filter (`{ tags: { some: … } }`), narrowed by the store-side predicate the
+ * caller declared on the mapping.
+ *
+ * Every nested relation filter the adapter emits goes through here, so a declared
+ * `subqueryFilter` reaches the collection macros, the membership shapes, the emptiness checks and
+ * the hop-existence guard alike. Adding a new relation shape means routing it through here, or
+ * the declaration silently stops applying to it.
+ *
+ * `every` is the one operator that cannot simply absorb the predicate. `{ every: AND(W, P) }`
+ * would REQUIRE every record to satisfy W, which is the opposite of "ignore the records W hides",
+ * so it is rewritten to `{ none: AND(W, NOT P) }` — no visible record violates P. Both agree with
+ * `every` when nothing is declared, and both stay vacuously true over an empty relation.
+ */
+function relationFilter(relation, operator, inner) {
+    const declared = relation.subqueryFilter;
+    if (declared === undefined) {
+        return { [relation.name]: { [operator]: inner } };
+    }
+    const narrow = (filter) => Object.keys(filter).length === 0 ? declared : { AND: [declared, filter] };
+    if (operator === "every") {
+        return Object.keys(inner).length === 0
+            ? { [relation.name]: { every: inner } }
+            : { [relation.name]: { none: { AND: [declared, { NOT: inner }] } } };
+    }
+    return { [relation.name]: { [operator]: narrow(inner) } };
+}
 /**
  * Builds a nested relation filter for Prisma queries.
  */
+/**
+ * "Every intermediate hop of a dotted path exists", as a Prisma filter.
+ *
+ * CEL cannot dot through a list, so each intermediate segment of `a.b.c` is a to-ONE
+ * parent: absent, the caller sends no attribute and CEL raises a missing-path error, which
+ * denies. `NOT { categories: { some: { subCategories: { some: P } } } }` is TRUE for a row
+ * with no category at all, so the negation returns rows the PDP denies — the parent must be
+ * required separately (cerbos/query-plan-adapters#309).
+ *
+ * Returns undefined when the reference has no intermediate hop, so a direct relation keeps
+ * its empty-collection semantics (`!tags.exists(...)` over zero tags is still TRUE).
+ */
+function buildLeadingHopsExistFilter(head, restRelations) {
+    if (restRelations.length === 0) {
+        return undefined;
+    }
+    // The last entry is the collection being iterated; everything before it is a hop.
+    return buildHopsExistFilter([head, ...restRelations.slice(0, -1)]);
+}
+/**
+ * "Every one of these relations exists", as a nested Prisma filter with an empty innermost
+ * predicate — `{ parent: { is: { inner: { is: {} } } } }`.
+ */
+function buildHopsExistFilter(hops) {
+    if (hops.length === 0) {
+        return undefined;
+    }
+    let inner = {};
+    for (let i = hops.length - 1; i >= 0; i--) {
+        const relation = assertDefined(hops[i], "Relation mapping is missing");
+        inner = relationFilter(relation, getPrismaRelationOperator(relation), inner);
+    }
+    return inner;
+}
+/**
+ * "Every to-one hop this expression dots through exists", as a Prisma filter, or undefined
+ * when it dots through none.
+ *
+ * Prisma has no UNKNOWN: a chained relation filter is exact under the POSITIVE polarity —
+ * `categories: { some: { subCategories: { some: P } } }` cannot hold without the category —
+ * but `NOT` inverts the hop requirement along with the predicate, so every operator built on
+ * a chain readmits the parentless rows once negated. #309 fixed that inside the collection
+ * macros, which left the sibling operators reached through the same chain unguarded:
+ * membership and `hasIntersection` (cerbos/query-plan-adapters#315), and the negated count
+ * spelling `!(size(chain) > 0)` (#316), all of which the macros' guard never saw.
+ *
+ * Requiring the hops OUTSIDE the negation is what fixes all of them at once, and it is
+ * unconditionally faithful to CEL rather than a per-operator patch: a missing hop is a
+ * missing-path error, which denies under BOTH polarities, so the requirement never depends
+ * on which operator sits above the chain.
+ *
+ * Lambda bodies are deliberately not walked — their references resolve against a scoped
+ * mapper, and a negated macro carries its own guard through buildNegatedCollectionFilter.
+ */
+function buildExpressionHopsExistFilter(operand, mapper) {
+    const hops = [];
+    const seen = new Set();
+    const visit = (expr) => {
+        if (isNamedOperand(expr)) {
+            if (seen.has(expr.name)) {
+                return;
+            }
+            seen.add(expr.name);
+            const { relations } = resolveFieldReference(expr.name, mapper);
+            if (!relations || relations.length === 0) {
+                return;
+            }
+            // Every to-ONE relation on the path is a hop that must EXIST — including a TRAILING one,
+            // which is the case a chain of to-many relations never produces. `parent.aBool` resolves
+            // to a single to-one relation, and `NOT { parent: { is: { aBool: true } } }` is TRUE for
+            // a row with no parent at all, so the negation returns rows the PDP denies. A trailing
+            // to-MANY relation is the collection being iterated rather than a hop, and keeps its
+            // empty-collection semantics (`!tags.exists(...)` over zero tags is still TRUE).
+            const last = assertDefined(relations[relations.length - 1], "Relation mapping is missing");
+            const hopFilter = buildHopsExistFilter(last.type === "one" ? relations : relations.slice(0, -1));
+            if (hopFilter !== undefined) {
+                hops.push(hopFilter);
+            }
+            return;
+        }
+        if (!isOperatorOperand(expr) || expr.operator === "lambda") {
+            return;
+        }
+        expr.operands.forEach(visit);
+    };
+    visit(operand);
+    if (hops.length === 0) {
+        return undefined;
+    }
+    return hops.length === 1
+        ? assertDefined(hops[0], "Leading-hops filter is missing")
+        : { AND: hops };
+}
+/**
+ * `{ NOT: filter }`, with every to-one hop `operand` dots through required OUTSIDE the
+ * negation so an absent parent stays denied (see buildExpressionHopsExistFilter).
+ */
+function negateRequiringHops(operand, filter, mapper) {
+    const hops = buildExpressionHopsExistFilter(operand, mapper);
+    return hops === undefined ? { NOT: filter } : { AND: [hops, { NOT: filter }] };
+}
 function buildNestedRelationFilter(relations, fieldFilter) {
     if (relations.length === 0)
         return fieldFilter;
@@ -216,7 +933,7 @@ function buildNestedRelationFilter(relations, fieldFilter) {
                 currentFilter = { [relation.field]: filterValue };
             }
         }
-        currentFilter = { [relation.name]: { [relationOperator]: currentFilter } };
+        currentFilter = relationFilter(relation, relationOperator, currentFilter);
     }
     return currentFilter;
 }
@@ -231,6 +948,9 @@ function resolveOperand(operand, mapper) {
         return { value: operand.value };
     }
     else if (isOperatorOperand(operand)) {
+        if (operand.operator === "timestamp") {
+            return resolveTimestampOperand(operand, mapper);
+        }
         const folded = tryFoldValueExpression(operand, mapper);
         if (folded !== null)
             return { value: folded };
@@ -239,8 +959,25 @@ function resolveOperand(operand, mapper) {
     }
     throw new Error("Operand must have name, value, or be an expression");
 }
+function resolveTimestampOperand(expression, mapper) {
+    if (expression.operands.length !== 1) {
+        throw new Error("timestamp() requires exactly one operand");
+    }
+    const operand = assertDefined(expression.operands[0], "timestamp() requires an operand");
+    if (isNamedOperand(operand)) {
+        const fieldRef = resolveFieldReference(operand.name, mapper);
+        if (fieldRef.valueType !== "dateTime") {
+            throw new Error(`timestamp() field ${operand.name} must be mapped with valueType: \"dateTime\"`);
+        }
+        return fieldRef;
+    }
+    if (!isValueOperand(operand) || typeof operand.value !== "string") {
+        throw new Error("timestamp() requires a field reference or RFC 3339 string");
+    }
+    return { value: normalizeRfc3339Milliseconds(operand.value) };
+}
 function tryFoldValueExpression(expr, mapper) {
-    if (expr.operator !== "add")
+    if (!ARITHMETIC_OPERATORS.has(expr.operator))
         return null;
     const leftOp = expr.operands[0];
     const rightOp = expr.operands[1];
@@ -253,12 +990,23 @@ function tryFoldValueExpression(expr, mapper) {
     if (!isResolvedValue(right))
         return null;
     try {
-        return foldAdd(left.value, right.value);
+        return foldArithmetic(expr.operator, left.value, right.value);
     }
     catch {
         return null;
     }
 }
+/**
+ * Records that the lambda body being built touches a nullable element column, so the
+ * enclosing collection operator can add its three-valued-logic guard.
+ */
+function recordNullableElementField(config, defaultField) {
+    if (!config.nullable) {
+        return;
+    }
+    const scope = lambdaScopes[lambdaScopes.length - 1];
+    scope?.nullableFields.add(config.field || defaultField);
+}
 /**
  * Creates a scoped mapper for collection operations
  */
@@ -299,7 +1047,9 @@ function createScopedMapper(collectionPath, variableName, fullMapper) {
                     field = strippedKey;
                 }
                 // Return the field config if it exists, otherwise create a default one
-                return currentConfig[field] || { field };
+                const fieldConfig = currentConfig[field] || { field };
+                recordNullableElementField(fieldConfig, field);
+                return fieldConfig;
             }
             return { field: strippedKey };
         }
@@ -338,15 +1088,10 @@ function buildPrismaFilterFromCerbosExpression(expression, mapper) {
             if (!operand) {
                 throw new Error("not operator requires an operand");
             }
-            if (isNamedOperand(operand)) {
-                const { relations, ...fieldRef } = resolveFieldReference(operand.name, mapper);
-                if (!relations || relations.length === 0) {
-                    return buildFieldEqualsFilter(fieldRef, false);
-                }
-            }
-            return {
-                NOT: buildPrismaFilterFromCerbosExpression(operand, mapper),
-            };
+            return buildNegatedFilter(operand, mapper);
+        }
+        case "if": {
+            return handleBooleanTernaryOperator(operands, mapper);
         }
         case "eq":
         case "ne":
@@ -364,9 +1109,6 @@ function buildPrismaFilterFromCerbosExpression(expression, mapper) {
         case "endsWith": {
             return handleStringOperator(operator, operands, mapper);
         }
-        case "isSet": {
-            return handleIsSetOperator(operands, mapper);
-        }
         case "hasIntersection": {
             return handleHasIntersectionOperator(operands, mapper);
         }
@@ -396,6 +1138,321 @@ function buildPrismaFilterFromCerbosExpression(expression, mapper) {
             throw new Error(`Unsupported operator: ${operator}`);
     }
 }
+function containsCollectionOperator(expr) {
+    if (!isOperatorOperand(expr)) {
+        return false;
+    }
+    if (COLLECTION_OPERATORS.has(expr.operator)) {
+        return true;
+    }
+    return expr.operands.some(containsCollectionOperator);
+}
+/**
+ * Whether `expr` dots through at least one intermediate to-one hop, so negating it needs the
+ * hop requirement of buildExpressionHopsExistFilter.
+ */
+function referencesChainedRelation(expr, mapper) {
+    if (isNamedOperand(expr)) {
+        const { relations } = resolveFieldReference(expr.name, mapper);
+        return relations !== undefined && relations.length > 1;
+    }
+    if (!isOperatorOperand(expr) || expr.operator === "lambda") {
+        return false;
+    }
+    return expr.operands.some((operand) => referencesChainedRelation(operand, mapper));
+}
+/**
+ * Builds the filter for `!expr`. Plain field predicates negate correctly with Prisma's NOT
+ * (SQL three-valued logic keeps NULL rows excluded under both polarities), but relation
+ * subqueries collapse UNKNOWN to false at the EXISTS boundary, so `NOT(some(P))` would
+ * wrongly include rows whose elements make P UNKNOWN (a NULL element column is a missing
+ * attribute — a CEL error — on the check side, which Cerbos treats as deny). Negation is
+ * therefore pushed down to the collection operators, which encode CEL's exact error
+ * semantics:
+ *
+ * - exists(c,P) is TRUE with a true witness, FALSE if every element is definitively false,
+ *   and an ERROR otherwise — so `!exists` admits only rows with no P-match AND no
+ *   UNKNOWN-element (the nullable-field guard).
+ * - all(c,P) is FALSE only with a definitive false witness (a false witness absorbs error
+ *   elements) — so `!all` is `some(NOT P)`, which SQL already evaluates definitively.
+ */
+function buildNegatedFilter(operand, mapper) {
+    if (isNamedOperand(operand)) {
+        const { relations, ...fieldRef } = resolveFieldReference(operand.name, mapper);
+        if (!relations || relations.length === 0) {
+            return buildFieldEqualsFilter(fieldRef, false);
+        }
+        return negateRequiringHops(operand, buildPrismaFilterFromCerbosExpression(operand, mapper), mapper);
+    }
+    // `and`/`or` must be pushed through with De Morgan whenever a branch can be UNKNOWN, so
+    // CEL's error absorption survives: `!(A && B)` with A erroring and B false is TRUE in CEL,
+    // and `OR[!A, !B]` reproduces that where a single outer NOT over the conjunction — with the
+    // hop requirement ANDed outside it — would deny. A chained relation is the second source of
+    // UNKNOWN besides the collection macros, so it opens the same push-down.
+    if (isOperatorOperand(operand) &&
+        (containsCollectionOperator(operand) ||
+            referencesChainedRelation(operand, mapper))) {
+        switch (operand.operator) {
+            case "and":
+                return {
+                    OR: operand.operands.map((o) => buildNegatedFilter(o, mapper)),
+                };
+            case "or":
+                return {
+                    AND: operand.operands.map((o) => buildNegatedFilter(o, mapper)),
+                };
+            case "not":
+                return buildPrismaFilterFromCerbosExpression(assertDefined(operand.operands[0], "not operator requires an operand"), mapper);
+            case "exists":
+            case "all":
+            case "except":
+            case "exists_one":
+            case "filter":
+                return buildNegatedCollectionFilter(operand.operator, operand.operands, mapper);
+        }
+    }
+    return negateRequiringHops(operand, buildPrismaFilterFromCerbosExpression(operand, mapper), mapper);
+}
+function getTernaryOperands(operands) {
+    if (operands.length !== 3) {
+        throw new Error(`if (ternary) requires exactly 3 operands (condition, then, else), got ${operands.length}`);
+    }
+    return {
+        condition: assertDefined(operands[0], "if (ternary) requires a condition operand"),
+        thenBranch: assertDefined(operands[1], "if (ternary) requires a then operand"),
+        elseBranch: assertDefined(operands[2], "if (ternary) requires an else operand"),
+    };
+}
+function getConstantBooleanCondition(condition) {
+    if (!isValueOperand(condition)) {
+        return undefined;
+    }
+    if (typeof condition.value !== "boolean") {
+        throw new Error("if (ternary) condition must be a boolean expression");
+    }
+    return condition.value;
+}
+function buildBooleanBranchFilter(branch, mapper) {
+    if (!isValueOperand(branch)) {
+        return {
+            kind: "filter",
+            filter: buildPrismaFilterFromCerbosExpression(branch, mapper),
+        };
+    }
+    if (typeof branch.value !== "boolean") {
+        throw new Error("if (ternary) branch in boolean position must be a boolean");
+    }
+    return { kind: "constant", value: branch.value };
+}
+/**
+ * "The ternary's condition is definitively FALSE", which is exactly buildNegatedFilter's
+ * contract — three-valued, so a condition that is UNKNOWN (a NULL column, an erroring lambda
+ * body, an absent to-one parent) selects NEITHER branch.
+ *
+ * It delegates rather than spelling a second negation. A private copy is how the ternary
+ * missed the hop requirement #315/#316 added: a bare `NOT` over a chain filter is TRUE when
+ * the to-one parent is absent, so the else-branch was selected for rows CEL denies outright —
+ * the missing path is an evaluation error, not a false condition
+ * (cerbos/query-plan-adapters#334). Delegating also gives the ternary the De Morgan push-down,
+ * which a chained `and`/`or` condition needs for CEL's error absorption to survive.
+ */
+function buildFalseConditionFilter(condition, mapper) {
+    if (isValueOperand(condition)) {
+        throw new Error("Constant ternary conditions must be folded before use");
+    }
+    return buildNegatedFilter(condition, mapper);
+}
+function buildGuardedTernaryFilter({ condition, thenFilter, elseFilter, mapper, }) {
+    const conditionTrue = buildPrismaFilterFromCerbosExpression(condition, mapper);
+    const conditionFalse = buildFalseConditionFilter(condition, mapper);
+    const guardedBranches = [];
+    if (thenFilter.kind === "filter") {
+        guardedBranches.push({ AND: [conditionTrue, thenFilter.filter] });
+    }
+    else if (thenFilter.value) {
+        guardedBranches.push(conditionTrue);
+    }
+    if (elseFilter.kind === "filter") {
+        guardedBranches.push({ AND: [conditionFalse, elseFilter.filter] });
+    }
+    else if (elseFilter.value) {
+        guardedBranches.push(conditionFalse);
+    }
+    // For a known condition this contradiction is false. If the condition is
+    // NULL/error-derived, both sides are SQL UNKNOWN, which keeps the whole
+    // ternary UNKNOWN under an outer NOT instead of authorizing the row.
+    guardedBranches.push({ AND: [conditionTrue, conditionFalse] });
+    return {
+        OR: guardedBranches,
+    };
+}
+function finalizeTernaryBranchPredicate(predicate) {
+    if (predicate.kind === "filter") {
+        return predicate.filter;
+    }
+    if (predicate.value) {
+        return buildAlwaysTrueFilter();
+    }
+    // Prisma has no model-agnostic always-false `where` shape: empty logical
+    // arrays are ignored. Real PDP plans fold this case to ALWAYS_DENIED.
+    throw new Error("A constant-false conditional predicate must be folded by the Cerbos planner");
+}
+function handleBooleanTernaryOperator(operands, mapper) {
+    const { condition, thenBranch, elseBranch } = getTernaryOperands(operands);
+    const constantCondition = getConstantBooleanCondition(condition);
+    if (constantCondition !== undefined) {
+        return finalizeTernaryBranchPredicate(buildBooleanBranchFilter(constantCondition ? thenBranch : elseBranch, mapper));
+    }
+    return buildGuardedTernaryFilter({
+        condition,
+        thenFilter: buildBooleanBranchFilter(thenBranch, mapper),
+        elseFilter: buildBooleanBranchFilter(elseBranch, mapper),
+        mapper,
+    });
+}
+function buildTernaryComparisonBranch({ operator, operands, ternaryIndex, branch, mapper, }) {
+    const substitutedOperands = operands.map((operand, index) => index === ternaryIndex ? branch : operand);
+    assertDefined(substitutedOperands[0], `${operator} requires a left operand`);
+    assertDefined(substitutedOperands[1], `${operator} requires a right operand`);
+    const normalized = normalizeBinaryOperands(operator, substitutedOperands);
+    const normalizedFirst = normalized.operands[0];
+    const normalizedSecond = normalized.operands[1];
+    if (normalized.operands.length === 2 &&
+        normalizedFirst !== undefined &&
+        normalizedSecond !== undefined &&
+        isValueOperand(normalizedFirst) &&
+        isValueOperand(normalizedSecond)) {
+        return {
+            kind: "constant",
+            value: evaluateConstantComparison(normalized.operator, normalizedFirst.value, normalizedSecond.value),
+        };
+    }
+    return {
+        kind: "filter",
+        filter: buildPrismaFilterFromCerbosExpression(normalized, mapper),
+    };
+}
+function tryHandleTernaryComparison(operator, operands, mapper) {
+    if (CERBOS_TO_PRISMA_OPERATOR[operator] === undefined) {
+        return null;
+    }
+    const ternaryIndex = operands.findIndex((operand) => isOperatorOperand(operand) && operand.operator === "if");
+    if (ternaryIndex === -1) {
+        return null;
+    }
+    if (operands.length !== 2) {
+        throw new Error(`${operator} with a ternary requires exactly 2 operands, got ${operands.length}`);
+    }
+    const ternary = assertDefined(operands[ternaryIndex], "Ternary comparison operand is missing");
+    if (!isOperatorOperand(ternary)) {
+        throw new Error("Ternary comparison operand must be an expression");
+    }
+    const { condition, thenBranch, elseBranch } = getTernaryOperands(ternary.operands);
+    const constantCondition = getConstantBooleanCondition(condition);
+    if (constantCondition !== undefined) {
+        return finalizeTernaryBranchPredicate(buildTernaryComparisonBranch({
+            operator,
+            operands,
+            ternaryIndex,
+            branch: constantCondition ? thenBranch : elseBranch,
+            mapper,
+        }));
+    }
+    return buildGuardedTernaryFilter({
+        condition,
+        thenFilter: buildTernaryComparisonBranch({
+            operator,
+            operands,
+            ternaryIndex,
+            branch: thenBranch,
+            mapper,
+        }),
+        elseFilter: buildTernaryComparisonBranch({
+            operator,
+            operands,
+            ternaryIndex,
+            branch: elseBranch,
+            mapper,
+        }),
+        mapper,
+    });
+}
+function evaluateConstantComparison(operator, left, right) {
+    switch (operator) {
+        case "eq":
+            return areValuesEqual(left, right);
+        case "ne":
+            return !areValuesEqual(left, right);
+        case "lt":
+        case "le":
+        case "gt":
+        case "ge": {
+            if (typeof left === "number" &&
+                typeof right === "number" &&
+                (Number.isNaN(left) || Number.isNaN(right))) {
+                return false;
+            }
+            if (!((typeof left === "number" && typeof right === "number") ||
+                (typeof left === "string" && typeof right === "string"))) {
+                throw new Error(`${operator} constant comparison requires two numbers or two strings`);
+            }
+            switch (operator) {
+                case "lt":
+                    return compareConstantValues(left, right) < 0;
+                case "le":
+                    return compareConstantValues(left, right) <= 0;
+                case "gt":
+                    return compareConstantValues(left, right) > 0;
+                case "ge":
+                    return compareConstantValues(left, right) >= 0;
+            }
+        }
+    }
+    throw new Error(`Unsupported constant comparison operator: ${operator}`);
+}
+function compareConstantValues(left, right) {
+    if (typeof left === "number" && typeof right === "number") {
+        return left === right ? 0 : left < right ? -1 : 1;
+    }
+    if (typeof left !== "string" || typeof right !== "string") {
+        throw new Error("Cannot order constant values of different types");
+    }
+    const leftCodePoints = Array.from(left, (character) => character.codePointAt(0));
+    const rightCodePoints = Array.from(right, (character) => character.codePointAt(0));
+    const sharedLength = Math.min(leftCodePoints.length, rightCodePoints.length);
+    for (let index = 0; index < sharedLength; index++) {
+        const leftCodePoint = leftCodePoints[index];
+        const rightCodePoint = rightCodePoints[index];
+        if (leftCodePoint !== rightCodePoint) {
+            return leftCodePoint < rightCodePoint ? -1 : 1;
+        }
+    }
+    return leftCodePoints.length === rightCodePoints.length
+        ? 0
+        : leftCodePoints.length < rightCodePoints.length
+            ? -1
+            : 1;
+}
+function areValuesEqual(left, right) {
+    if (Array.isArray(left)) {
+        return (Array.isArray(right) &&
+            left.length === right.length &&
+            left.every((value, index) => areValuesEqual(value, right[index])));
+    }
+    if (Array.isArray(right)) {
+        return false;
+    }
+    if (typeof left === "object" && left !== null) {
+        if (typeof right !== "object" || right === null) {
+            return false;
+        }
+        const leftKeys = Object.keys(left);
+        const rightKeys = Object.keys(right);
+        return (leftKeys.length === rightKeys.length &&
+            leftKeys.every((key) => key in right && areValuesEqual(left[key], right[key])));
+    }
+    return left === right;
+}
 function handleSizeComparison(operator, sizeOperand, valueOperand, mapper) {
     const collectionOperand = sizeOperand.operands[0];
     if (!collectionOperand || !isNamedOperand(collectionOperand)) {
@@ -424,7 +1481,7 @@ function handleSizeComparison(operator, sizeOperand, valueOperand, mapper) {
         throw new Error("size operator requires a relation mapping");
     }
     const prismaOp = isNonEmpty ? "some" : "none";
-    const leafFilter = { [deepest.name]: { [prismaOp]: {} } };
+    const leafFilter = relationFilter(deepest, prismaOp, {});
     if (relations.length === 1) {
         return leafFilter;
     }
@@ -434,6 +1491,11 @@ function handleSizeComparison(operator, sizeOperand, valueOperand, mapper) {
  * Helper function to process relational operators (eq, ne, lt, etc.)
  */
 function handleRelationalOperator(operator, operands, mapper) {
+    const ternaryFilter = tryHandleTernaryComparison(operator, operands, mapper);
+    if (ternaryFilter) {
+        return ternaryFilter;
+    }
+    ({ operator, operands } = normalizeBinaryOperands(operator, operands));
     const prismaOperator = CERBOS_TO_PRISMA_OPERATOR[operator];
     if (!prismaOperator) {
         throw new Error(`Unsupported operator: ${operator}`);
@@ -447,57 +1509,304 @@ function handleRelationalOperator(operator, operands, mapper) {
     if (isOperatorOperand(leftOperand) && leftOperand.operator === "size") {
         return handleSizeComparison(operator, leftOperand, rightOperand, mapper);
     }
-    const addOperand = [leftOperand, rightOperand].find((o) => isOperatorOperand(o) && o.operator === "add");
-    if (addOperand) {
-        const otherOperand = addOperand === leftOperand ? rightOperand : leftOperand;
-        return handleAddComparison(operator, addOperand, otherOperand, mapper);
+    const arithOperand = [leftOperand, rightOperand].find((o) => isOperatorOperand(o) && ARITHMETIC_OPERATORS.has(o.operator));
+    if (arithOperand) {
+        const otherOperand = arithOperand === leftOperand ? rightOperand : leftOperand;
+        return handleArithmeticComparison(operator, arithOperand, otherOperand, arithOperand === leftOperand, mapper);
+    }
+    const mapOperand = [leftOperand, rightOperand].find((o) => isOperatorOperand(o) && o.operator === "map");
+    if (mapOperand) {
+        throw new Error(`Direct comparison of map(...) to a value is not supported (operator: ${operator}). ` +
+            `Wrap the map() expression in hasIntersection(map(...), [...]) instead.`);
     }
     const left = resolveOperand(leftOperand, mapper);
-    const right = requireResolvedValue(resolveOperand(rightOperand, mapper), "Right operand must be a value");
+    const right = resolveOperand(rightOperand, mapper);
+    if (isResolvedFieldReference(left) && isResolvedFieldReference(right)) {
+        return buildFieldToFieldFilter(operator, leftOperand, left, rightOperand, right);
+    }
+    if (isResolvedValue(left) && isResolvedFieldReference(right)) {
+        return buildComparisonFilter(right, MIRRORED_OPERATOR[operator] ?? operator, left.value);
+    }
+    if (isResolvedValue(left) && isResolvedValue(right)) {
+        const matches = evaluateConstantComparison(operator, left.value, right.value);
+        if (matches) {
+            return buildAlwaysTrueFilter();
+        }
+        throw new Error("A constant-false conditional predicate must be folded by the Cerbos planner");
+    }
+    const rightValue = requireResolvedValue(right, "Right operand must be a value");
     if (isResolvedFieldReference(left)) {
-        return buildFieldFilter(left, prismaOperator, right.value);
+        return buildComparisonFilter(left, operator, rightValue.value);
     }
-    return { [prismaOperator]: right.value };
+    return { [prismaOperator]: rightValue.value };
 }
 /**
- * Helper function to handle "in" operator
+ * Builds a field-vs-constant comparison. Fractional constants against ordering (and
+ * equality) operators are emitted as a two-clause bracket because Prisma coerces filter
+ * values to the column's type: on an Int column, `gte: 1.5` is silently bound as `gte: 1`,
+ * inverting rows like aNumber == 1. Each bracket pairs the exact constant with its integer
+ * neighbor so the combination is correct BOTH for Float columns (the extra clause is
+ * redundant) and Int columns (whichever way Prisma truncates or floors the fraction).
  */
-function handleInOperator(operands, mapper) {
-    const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-    const valueOperand = getValueOperand(operands, "Value operand is undefined");
-    const fieldRef = requireResolvedFieldReference(resolveOperand(nameOperand, mapper), "Name operand must resolve to a field reference");
-    const { value } = requireResolvedValue(resolveOperand(valueOperand, mapper), "Value operand must resolve to a value");
-    const values = Array.isArray(value) ? value : [value];
-    return buildFieldDirectOrInFilter(fieldRef, values);
+function buildComparisonFilter(fieldRef, operator, value) {
+    const prismaOperator = assertDefined(CERBOS_TO_PRISMA_OPERATOR[operator], `Unsupported operator: ${operator}`);
+    if (value === null) {
+        assertNullOperandTranslatable(`\`${operator}\` against a null operand`, fieldRef.nullAttributeRepresentation);
+    }
+    // An attribute the caller sends as an explicit null holds a null VALUE in CEL, so equality
+    // against a non-null operand is a definite FALSE and inequality a definite TRUE. Prisma leans
+    // on SQL's UNKNOWN for both, which drops the row under either polarity, so the presence of the
+    // column has to become part of the predicate. Confined to the equality family: an ordering
+    // comparison against a null receiver is a no-overload error in CEL, which denies exactly as the
+    // dropped row does.
+    if (value !== null && isExplicitNullReference(fieldRef)) {
+        const fieldName = getLeafField(fieldRef.path);
+        if (operator === "eq") {
+            return guardedFieldFilter(fieldRef, { [fieldName]: { equals: value } });
+        }
+        if (operator === "ne") {
+            return {
+                NOT: guardedFieldFilter(fieldRef, { [fieldName]: { equals: value } }),
+            };
+        }
+    }
+    if (typeof value === "number" && !Number.isInteger(value)) {
+        const fieldName = getLeafField(fieldRef.path);
+        const lower = Math.floor(value);
+        const upper = Math.ceil(value);
+        const equalsBracket = {
+            AND: [
+                { [fieldName]: { equals: value } },
+                { [fieldName]: { gt: lower } },
+                { [fieldName]: { lt: upper } },
+            ],
+        };
+        let bracket;
+        switch (operator) {
+            case "gt":
+                bracket = {
+                    OR: [{ [fieldName]: { gt: value } }, { [fieldName]: { gte: upper } }],
+                };
+                break;
+            case "ge":
+                bracket = {
+                    AND: [{ [fieldName]: { gte: value } }, { [fieldName]: { gt: lower } }],
+                };
+                break;
+            case "lt":
+                bracket = {
+                    OR: [{ [fieldName]: { lt: value } }, { [fieldName]: { lte: lower } }],
+                };
+                break;
+            case "le":
+                bracket = {
+                    AND: [{ [fieldName]: { lte: value } }, { [fieldName]: { lt: upper } }],
+                };
+                break;
+            case "eq":
+                bracket = equalsBracket;
+                break;
+            case "ne":
+                bracket = { NOT: equalsBracket };
+                break;
+        }
+        if (bracket) {
+            return wrapRelations(fieldRef.relations, bracket);
+        }
+    }
+    return buildFieldFilter(fieldRef, prismaOperator, value);
 }
 /**
- * Helper function to handle string operators (contains, startsWith, endsWith)
+ * Builds a column-vs-column comparison as a Prisma field reference. Prisma only supports
+ * references between fields of the SAME model, so the container is the root model for
+ * root-level comparisons and the relation's model inside a lambda; mixed-scope comparisons
+ * (an element column against an outer column) are cross-model and must fail loudly.
  */
-function handleStringOperator(operator, operands, mapper) {
-    const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-    const valueOperand = getValueOperand(operands, "Value operand is undefined");
-    const fieldRef = requireResolvedFieldReference(resolveOperand(nameOperand, mapper), "Name operand must resolve to a field reference");
-    const { value } = requireResolvedValue(resolveOperand(valueOperand, mapper), "Value operand must resolve to a value");
-    if (typeof value !== "string") {
-        throw new Error(`${operator} operator requires string value`);
+function buildFieldToFieldFilter(operator, leftOperand, left, rightOperand, right) {
+    const prismaOperator = assertDefined(CERBOS_TO_PRISMA_OPERATOR[operator], `Unsupported operator: ${operator}`);
+    if (!isNamedOperand(leftOperand) || !isNamedOperand(rightOperand)) {
+        throw new Error("Field-to-field comparison requires two named operands");
+    }
+    const scope = lambdaScopes[lambdaScopes.length - 1];
+    let container;
+    if (scope) {
+        const prefix = scope.variableName + ".";
+        const leftInScope = leftOperand.name.startsWith(prefix);
+        const rightInScope = rightOperand.name.startsWith(prefix);
+        if (leftInScope !== rightInScope) {
+            throw new Error(`Cannot compare a collection element column with an outer column (${leftOperand.name} vs ${rightOperand.name}): ` +
+                "Prisma field references only work between fields of the same model");
+        }
+        if (leftInScope) {
+            container = scope.relationModel;
+            if (!container) {
+                throw new Error("Field-to-field comparison inside a collection requires `relation.model` in the mapper");
+            }
+        }
     }
-    const fieldName = getLeafField(fieldRef.path);
-    return wrapRelations(fieldRef.relations, {
-        [fieldName]: { [operator]: value },
-    });
+    if (container === undefined) {
+        if ((left.relations && left.relations.length > 0) ||
+            (right.relations && right.relations.length > 0)) {
+            throw new Error("Cannot compare columns across relations: Prisma field references only work between fields of the same model");
+        }
+        container = rootModelName;
+        if (!container) {
+            throw new Error("Field-to-field comparison requires the `model` option (the Prisma model name) to build a field reference");
+        }
+    }
+    const leftField = getLeafField(left.path);
+    const rightField = getLeafField(right.path);
+    const fieldReference = { _ref: rightField, _container: container };
+    // Two explicit nulls are EQUAL in CEL, and a null against a value is definitely NOT equal.
+    // A bare field reference gives UNKNOWN for both, which drops the row under either polarity.
+    const leftExplicit = isExplicitNullReference(left);
+    const rightExplicit = isExplicitNullReference(right);
+    // Mixing the two conventions across one comparison has no faithful rendering. The declared side
+    // needs a definite answer for its NULL (CEL holds a null VALUE); the undeclared side needs
+    // UNKNOWN for its NULL (a missing attribute, which CEL denies under both polarities). A definite
+    // predicate returns rows the PDP refuses; a plain one drops rows the PDP allows. Refuse it
+    // rather than pick a direction — declare both attributes, or neither.
+    if (leftExplicit !== rightExplicit && (operator === "eq" || operator === "ne")) {
+        throw new Error(`Cannot translate \`${operator}\` between two columns under mixed null conventions: ` +
+            "cannot compare an attribute declared explicit-null with one on the omitted convention: the omitted side is UNKNOWN for a NULL column while the declared side is definite, and no single predicate is both. Declare nullAttributeRepresentation on both mapper entries, or on neither.");
+    }
+    if (leftExplicit && rightExplicit && (operator === "eq" || operator === "ne")) {
+        const present = [];
+        if (leftExplicit) {
+            present.push({ [leftField]: { not: null } });
+        }
+        if (rightExplicit) {
+            present.push({ [rightField]: { not: null } });
+        }
+        const equality = leftExplicit && rightExplicit
+            ? {
+                OR: [
+                    { AND: [{ [leftField]: null }, { [rightField]: null }] },
+                    { AND: [...present, { [leftField]: { equals: fieldReference } }] },
+                ],
+            }
+            : { AND: [...present, { [leftField]: { equals: fieldReference } }] };
+        return operator === "eq" ? equality : { NOT: equality };
+    }
+    // `ne` is the one operator whose Prisma spelling cannot carry a field reference: `not` nests a
+    // NestedStringFilter, which has no `_ref` form, so `{ col: { not: { _ref } } }` is rejected by
+    // the client rather than executed. Hoisting the negation to the top-level `NOT` combinator says
+    // the same thing with a shape that does accept one — the same rewrite the explicit-null branch
+    // above already performs. Three-valued logic is unchanged by the hoist: a NULL on either side
+    // makes the inner equality UNKNOWN, and `NOT UNKNOWN` is still UNKNOWN, so the row stays out
+    // under both polarities, which is what a missing attribute does on the check side.
+    if (operator === "ne") {
+        return { NOT: { [leftField]: { equals: fieldReference } } };
+    }
+    return { [leftField]: { [prismaOperator]: fieldReference } };
 }
 /**
- * Helper function to handle "isSet" operator
+ * Helper function to handle "in" operator
  */
-function handleIsSetOperator(operands, mapper) {
-    const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-    const valueOperand = getValueOperand(operands, "Value operand is undefined");
-    const fieldRef = requireResolvedFieldReference(resolveOperand(nameOperand, mapper), "Name operand must resolve to a field reference");
-    const resolvedValue = requireResolvedValue(resolveOperand(valueOperand, mapper), "Value operand must resolve to a value");
-    const fieldName = getLeafField(fieldRef.path);
-    return wrapRelations(fieldRef.relations, {
-        [fieldName]: resolvedValue.value ? { not: null } : { equals: null },
-    });
+function handleInOperator(operands, mapper) {
+    if (operands.length !== 2) {
+        throw new Error("in requires exactly two operands");
+    }
+    const member = assertDefined(operands[0], "in requires a member operand");
+    const collection = assertDefined(operands[1], "in requires a collection operand");
+    if (isNamedOperand(member) && isValueOperand(collection)) {
+        const fieldRef = resolveFieldReference(member.name, mapper);
+        const values = Array.isArray(collection.value)
+            ? collection.value
+            : [collection.value];
+        return buildMembershipFilter(fieldRef, values);
+    }
+    if (isValueOperand(member) && isNamedOperand(collection)) {
+        return buildMembershipFilter(resolveFieldReference(collection.name, mapper), [member.value]);
+    }
+    if (isNamedOperand(member) && isNamedOperand(collection)) {
+        throw new Error("Membership between two database attributes is not supported: Prisma cannot compare a related element column with an outer scalar column");
+    }
+    throw new Error("in requires a field member and literal list, or a literal member and field collection");
+}
+// Upper bound on the IN-list produced when enumerating a constant receiver's substrings.
+const MAX_ENUMERATED_NEEDLES = 1000;
+/**
+ * Helper function to handle string operators (contains, startsWith, endsWith).
+ *
+ * These operators are receiver-sensitive and the planner preserves policy source order:
+ * operand 0 is the receiver (haystack), operand 1 the needle. Swapping them silently
+ * inverts the match direction, so unlike symmetric comparisons they are never normalized.
+ */
+function handleStringOperator(operator, operands, mapper) {
+    if (operands.length !== 2) {
+        throw new Error(`${operator} requires exactly two operands`);
+    }
+    const receiver = resolveOperand(assertDefined(operands[0], `${operator} requires a receiver operand`), mapper);
+    const needle = resolveOperand(assertDefined(operands[1], `${operator} requires a needle operand`), mapper);
+    // Column receiver, constant needle: Prisma's LIKE-based filter.
+    if (isResolvedFieldReference(receiver) && isResolvedValue(needle)) {
+        const { value } = needle;
+        if (typeof value !== "string") {
+            throw new Error(`${operator} operator requires string value`);
+        }
+        // Prisma emits LIKE without an ESCAPE clause and does not escape wildcard characters,
+        // so a needle containing % or _ would match as a pattern instead of literally (e.g.
+        // startsWith("100%") wrongly matches "100xdone"). Fail loudly rather than filter wrong.
+        //
+        // A backslash is the same hazard reached from the other direction, and only an executed
+        // PostgreSQL leg surfaces it (cerbos/query-plan-adapters#320): SQLite's LIKE has no escape
+        // character at all, so `\` is literal there, while PostgreSQL and MySQL treat it as the
+        // DEFAULT escape character even with no ESCAPE clause. `endsWith("\\")` is then a pattern
+        // ending in an escape character — a hard error on PostgreSQL — and a `\x` anywhere inside
+        // silently drops the backslash, so `contains("a\\b")` matches "ab", a row the PDP denies.
+        if (/[%_\\]/.test(value)) {
+            throw new Error(`Cannot translate ${operator} with a needle containing LIKE metacharacters (%, _ or \\): ` +
+                "Prisma does not escape wildcards in string filters, and \\ is the default LIKE " +
+                "escape character on PostgreSQL and MySQL");
+        }
+        const fieldName = getLeafField(receiver.path);
+        return wrapRelations(receiver.relations, {
+            [fieldName]: { [operator]: value },
+        });
+    }
+    // Constant receiver, column needle (e.g. `"a-b-c".contains(R.attr.x)`): enumerate every
+    // candidate needle the constant admits — prefixes for startsWith, suffixes for endsWith,
+    // substrings for contains — into an exact IN filter. No LIKE, so no escaping hazards; a
+    // NULL needle column stays excluded (CEL missing-attribute deny).
+    if (isResolvedValue(receiver) && isResolvedFieldReference(needle)) {
+        if (typeof receiver.value !== "string") {
+            throw new Error(`${operator} operator requires a string receiver`);
+        }
+        const haystack = receiver.value;
+        const candidates = new Set([""]);
+        if (operator === "startsWith") {
+            for (let i = 1; i <= haystack.length; i++) {
+                candidates.add(haystack.slice(0, i));
+            }
+        }
+        else if (operator === "endsWith") {
+            for (let i = 0; i < haystack.length; i++) {
+                candidates.add(haystack.slice(i));
+            }
+        }
+        else {
+            for (let start = 0; start < haystack.length; start++) {
+                for (let end = start + 1; end <= haystack.length; end++) {
+                    candidates.add(haystack.slice(start, end));
+                }
+            }
+        }
+        if (candidates.size > MAX_ENUMERATED_NEEDLES) {
+            throw new Error(`Cannot translate ${operator} with a constant receiver of this length: ` +
+                `enumerating its ${candidates.size} candidate needles exceeds the ${MAX_ENUMERATED_NEEDLES}-entry limit`);
+        }
+        const fieldName = getLeafField(needle.path);
+        return wrapRelations(needle.relations, {
+            [fieldName]: { in: [...candidates] },
+        });
+    }
+    if (isResolvedFieldReference(receiver) && isResolvedFieldReference(needle)) {
+        // A column-valued needle would need its LIKE metacharacters escaped per row, which
+        // Prisma's filters cannot do (and Prisma leaks wildcards from field references).
+        throw new Error(`Cannot translate ${operator} between two columns: Prisma cannot escape LIKE wildcards held in a column`);
+    }
+    throw new Error(`${operator} between two constants must be folded by the Cerbos planner`);
 }
 /**
  * Helper function to handle "hasIntersection" operator
@@ -506,6 +1815,10 @@ function handleHasIntersectionOperator(operands, mapper) {
     if (operands.length !== 2) {
         throw new Error("hasIntersection requires exactly two operands");
     }
+    // Intersection is symmetric, and the planner preserves policy source order — e.g.
+    // `hasIntersection(["a"], R.attr.tags)` puts the constant list FIRST. Normalize to
+    // field/map-first (see #256).
+    ({ operands } = normalizeBinaryOperands("hasIntersection", operands));
     const leftOperand = assertDefined(operands[0], "hasIntersection requires a left operand");
     const rightOperand = assertDefined(operands[1], "hasIntersection requires a right operand");
     // Check if left operand is a map operation
@@ -536,12 +1849,39 @@ function handleHasIntersectionOperator(operands, mapper) {
         if (!isNamedOperand(projection)) {
             throw new Error("Invalid map lambda expression structure");
         }
-        // Use scoped mapper for resolving the projection
-        const resolved = resolveFieldReference(projection.name, scopedMapper);
+        // Use scoped mapper for resolving the projection, collecting nullable element columns.
+        const scope = {
+            variableName: variable.name,
+            relationModel: relations[relations.length - 1]?.model,
+            nullableFields: new Set(),
+            unknownFilters: [],
+        };
+        lambdaScopes.push(scope);
+        let resolved;
+        try {
+            resolved = resolveFieldReference(projection.name, scopedMapper);
+        }
+        finally {
+            lambdaScopes.pop();
+        }
         const fieldName = getLeafField(resolved.path);
-        return buildNestedRelationFilter(relations, {
+        const base = buildNestedRelationFilter(relations, {
             [fieldName]: { in: rightOperand.value },
         });
+        if (scope.nullableFields.size === 0) {
+            return base;
+        }
+        // CEL map() errors if ANY element is missing the projected attribute — even alongside a
+        // matching element — and Cerbos treats that error as deny. Exclude rows holding an
+        // element whose projected (nullable) column is NULL.
+        return {
+            AND: [
+                base,
+                {
+                    NOT: buildNestedRelationFilter(relations, buildNullWitnessFilter(scope.nullableFields)),
+                },
+            ],
+        };
     }
     // Handle regular field reference
     if (!isNamedOperand(leftOperand)) {
@@ -555,11 +1895,7 @@ function handleHasIntersectionOperator(operands, mapper) {
         throw new Error("hasIntersection requires an array value");
     }
     if (relations && relations.length > 0) {
-        const fieldName = getLeafField(path);
-        const fieldFilter = {
-            [fieldName]: { in: rightOperand.value },
-        };
-        return buildNestedRelationFilter(relations, fieldFilter);
+        return buildMembershipFilter({ path, relations }, rightOperand.value);
     }
     const fieldName = getLeafField(path);
     return { [fieldName]: { some: rightOperand.value } };
@@ -577,10 +1913,7 @@ function handleLambdaOperator(operands) {
         field: key.replace(`${variable.name}.`, ""),
     }));
 }
-/**
- * Helper function to handle collection operators (exists, all, except, filter)
- */
-function handleCollectionOperator(operator, operands, mapper) {
+function buildCollectionLambdaParts(operator, operands, mapper) {
     if (operands.length !== 2) {
         throw new Error(`${operator} requires exactly two operands`);
     }
@@ -603,13 +1936,33 @@ function handleCollectionOperator(operator, operands, mapper) {
     if (!relations || relations.length === 0) {
         throw new Error(`${operator} operator requires a relation mapping`);
     }
+    const head = assertDefined(relations[0], `${operator} operator requires a relation mapping`);
+    const restRelations = relations.slice(1);
+    const deepest = assertDefined(relations[relations.length - 1], `${operator} operator requires a relation mapping`);
     const lambdaConditionOperand = assertDefined(lambda.operands[0], "Lambda expression must provide a condition");
-    const lambdaCondition = buildPrismaFilterFromCerbosExpression(lambdaConditionOperand, // Use the condition part of the lambda
-    scopedMapper);
-    const relation = assertDefined(relations[0], `${operator} operator requires a relation mapping`);
+    const scope = {
+        variableName: variable.name,
+        relationModel: deepest.model,
+        nullableFields: new Set(),
+        unknownFilters: [],
+    };
+    lambdaScopes.push(scope);
+    let lambdaCondition;
+    try {
+        lambdaCondition = buildPrismaFilterFromCerbosExpression(lambdaConditionOperand, // Use the condition part of the lambda
+        scopedMapper);
+    }
+    finally {
+        lambdaScopes.pop();
+    }
     let filterValue = lambdaCondition;
-    // If the lambda condition already has a relation structure, merge it
-    if (lambdaCondition["AND"] || lambdaCondition["OR"]) {
+    if (restRelations.length > 0) {
+        // Chained collection reference (e.g. R.attr.a.b): the lambda's elements live at the END
+        // of the chain, so the element predicate must join through every intermediate hop.
+        filterValue = buildNestedRelationFilter(restRelations, lambdaCondition);
+    }
+    else if (lambdaCondition["AND"] || lambdaCondition["OR"]) {
+        // If the lambda condition already has a logical structure, use it as-is
         filterValue = lambdaCondition;
     }
     else {
@@ -622,37 +1975,170 @@ function handleCollectionOperator(operator, operands, mapper) {
         if (lambdaFieldValue === undefined) {
             throw new Error("Lambda condition field value cannot be undefined");
         }
-        const filterField = relation.field || defaultKey;
+        const filterField = head.field || defaultKey;
         filterValue = {
             [filterField]: lambdaFieldValue,
         };
     }
+    return {
+        head,
+        restRelations,
+        filterValue,
+        nullableFields: scope.nullableFields,
+        unknownFilters: scope.unknownFilters,
+    };
+}
+/** OR of `field IS NULL` checks for every nullable element column the lambda touched. */
+function buildNullWitnessFilter(nullableFields) {
+    const checks = [...nullableFields].map((field) => ({ [field]: null }));
+    if (checks.length === 1) {
+        return checks[0];
+    }
+    return { OR: checks };
+}
+function buildUnknownElementFilter(parts) {
+    const filters = [...parts.unknownFilters];
+    if (parts.nullableFields.size > 0) {
+        filters.push(buildNullWitnessFilter(parts.nullableFields));
+    }
+    if (filters.length === 0) {
+        return undefined;
+    }
+    if (filters.length === 1) {
+        return filters[0];
+    }
+    return { OR: filters };
+}
+function recordNestedCollectionUnknownFilter(filter) {
+    const enclosingScope = lambdaScopes[lambdaScopes.length - 1];
+    enclosingScope?.unknownFilters.push(filter);
+}
+/** Wraps an element-level filter through the full relation chain (head + rest). */
+function wrapCollectionElementFilter(parts, elementFilter) {
+    const inner = parts.restRelations.length > 0
+        ? buildNestedRelationFilter(parts.restRelations, elementFilter)
+        : elementFilter;
+    return relationFilter(parts.head, "some", inner);
+}
+function throwUnsupportedCollectionOperator(operator) {
+    if (operator === "exists_one") {
+        throw new Error("exists_one requires counting matching elements, which Prisma where-filters cannot express");
+    }
+    throw new Error("The filter() collection operator returns a list, not a boolean. " +
+        "It cannot be used as a standalone condition. " +
+        "Use exists() or combine filter() with size() instead.");
+}
+/**
+ * Helper function to handle collection operators (exists, all, except, filter)
+ */
+function handleCollectionOperator(operator, operands, mapper) {
+    const knownValueFilter = tryHandleKnownValueCollectionOperator(operator, operands, mapper, false);
+    if (knownValueFilter !== undefined) {
+        return knownValueFilter;
+    }
+    if (operator === "exists_one" || operator === "filter") {
+        throwUnsupportedCollectionOperator(operator);
+    }
+    const parts = buildCollectionLambdaParts(operator, operands, mapper);
+    const { head, filterValue, nullableFields } = parts;
     switch (operator) {
-        case "exists":
-            return { [relation.name]: { some: filterValue } };
-        case "filter":
-            throw new Error("The filter() collection operator returns a list, not a boolean. " +
-                "It cannot be used as a standalone condition. " +
-                "Use exists() or combine filter() with size() instead.");
+        case "exists": {
+            // A NULL element keeps the per-element predicate UNKNOWN, so it can never create a
+            // false positive here; a CEL error (deny) coincides with "no match" — no guard needed.
+            const filter = relationFilter(head, "some", filterValue);
+            const unknownElement = buildUnknownElementFilter(parts);
+            if (unknownElement !== undefined) {
+                recordNestedCollectionUnknownFilter({
+                    AND: [
+                        { NOT: filter },
+                        wrapCollectionElementFilter(parts, unknownElement),
+                    ],
+                });
+            }
+            return filter;
+        }
         case "except":
-            return { [relation.name]: { some: { NOT: filterValue } } };
-        case "exists_one":
+            return relationFilter(head, "some", { NOT: filterValue });
+        case "all": {
+            if (parts.restRelations.length > 0) {
+                throw new Error("all() over a multi-hop relation chain is not supported");
+            }
+            const base = relationFilter(head, "every", filterValue);
+            if (nullableFields.size === 0) {
+                return base;
+            }
+            // CEL all() errors when any element evaluation errors without a false witness; SQL
+            // `every` would treat those elements as vacuously passing. Exclude rows holding any
+            // element whose referenced nullable column is NULL. (`every` already rejects rows
+            // with a definitive false witness, matching error absorption.)
             return {
-                [relation.name]: {
-                    some: filterValue,
-                },
                 AND: [
+                    base,
+                    relationFilter(head, "none", buildNullWitnessFilter(nullableFields)),
+                ],
+            };
+        }
+        default:
+            throw new Error(`Unexpected operator: ${operator}`);
+    }
+}
+/**
+ * Builds the filter for a NEGATED collection operator, encoding CEL's error semantics (see
+ * buildNegatedFilter).
+ */
+function buildNegatedCollectionFilter(operator, operands, mapper) {
+    const knownValueFilter = tryHandleKnownValueCollectionOperator(operator, operands, mapper, true);
+    if (knownValueFilter !== undefined) {
+        return knownValueFilter;
+    }
+    if (operator === "exists_one" || operator === "filter") {
+        throwUnsupportedCollectionOperator(operator);
+    }
+    const parts = buildCollectionLambdaParts(operator, operands, mapper);
+    const { head, filterValue, nullableFields } = parts;
+    // An absent to-one parent must stay denied under negation rather than satisfying it
+    // vacuously (#309).
+    const leadingHopsExist = buildLeadingHopsExistFilter(head, parts.restRelations);
+    const requireLeadingHops = (filter) => leadingHopsExist === undefined
+        ? filter
+        : { AND: [leadingHopsExist, filter] };
+    switch (operator) {
+        case "exists": {
+            const base = requireLeadingHops({
+                NOT: relationFilter(head, "some", filterValue),
+            });
+            const unknownElement = buildUnknownElementFilter(parts);
+            if (unknownElement === undefined) {
+                return base;
+            }
+            // !exists is TRUE only when every element is definitively false: no P-match AND no
+            // element whose evaluation is UNKNOWN (NULL column = missing attribute = CEL error).
+            return {
+                AND: [
+                    base,
                     {
-                        [relation.name]: {
-                            every: {
-                                OR: [filterValue, { NOT: filterValue }],
-                            },
-                        },
+                        NOT: wrapCollectionElementFilter(parts, unknownElement),
                     },
                 ],
             };
+        }
         case "all":
-            return { [relation.name]: { every: filterValue } };
+            // !all is TRUE only with a definitive false witness, which also absorbs error
+            // elements — exactly `some(NOT P)` in SQL (NULL columns keep NOT P UNKNOWN).
+            return relationFilter(head, "some", { NOT: filterValue });
+        case "except": {
+            // !except(c,P) = every element definitively matches P.
+            const base = requireLeadingHops(relationFilter(head, "none", { NOT: filterValue }));
+            if (nullableFields.size === 0) {
+                return base;
+            }
+            return {
+                AND: [
+                    base,
+                    relationFilter(head, "none", buildNullWitnessFilter(nullableFields)),
+                ],
+            };
+        }
         default:
             throw new Error(`Unexpected operator: ${operator}`);
     }
@@ -697,60 +2183,152 @@ function handleMapOperator(operands, mapper) {
 function buildImpossibleFilter(fieldRef) {
     return buildFieldFilter(fieldRef, "in", []);
 }
-function handleAddComparison(operator, addExpr, otherOperand, mapper) {
-    const addLeftOp = assertDefined(addExpr.operands[0], "add operator requires a left operand");
-    const addRightOp = assertDefined(addExpr.operands[1], "add operator requires a right operand");
-    const addLeft = resolveOperand(addLeftOp, mapper);
-    const addRight = resolveOperand(addRightOp, mapper);
+const ARITHMETIC_OPERATORS = new Set(["add", "sub", "mult", "div"]);
+/**
+ * Translates `column ⊕ constant  CMP  value` (and its mirrored forms) by solving for the
+ * column: Prisma where-filters cannot express column arithmetic, but linear arithmetic with
+ * one constant side always rewrites to a plain comparison. Multiplying/dividing by a
+ * negative constant mirrors directional operators. The rewrite happens in IEEE double space,
+ * matching CEL: Cerbos attribute numbers are doubles, so this preserves check-time semantics
+ * (e.g. `n * 0.1 == 0.3` solves to an unrepresentable fraction and matches no integer row,
+ * exactly as CEL evaluates it).
+ */
+function handleArithmeticComparison(operator, arithExpr, otherOperand, arithIsLeft, mapper) {
+    const arithOp = arithExpr.operator;
+    const arithLeftOp = assertDefined(arithExpr.operands[0], `${arithOp} operator requires a left operand`);
+    const arithRightOp = assertDefined(arithExpr.operands[1], `${arithOp} operator requires a right operand`);
+    if (isOperatorOperand(otherOperand) &&
+        ARITHMETIC_OPERATORS.has(otherOperand.operator) &&
+        tryFoldValueExpression(otherOperand, mapper) === null) {
+        throw new Error("Arithmetic on both sides of a comparison is not supported: the expression cannot be solved to a plain column filter");
+    }
+    const arithLeft = resolveOperand(arithLeftOp, mapper);
+    const arithRight = resolveOperand(arithRightOp, mapper);
     const other = resolveOperand(otherOperand, mapper);
-    if (isResolvedValue(addLeft) && isResolvedValue(addRight)) {
-        const folded = foldAdd(addLeft.value, addRight.value);
-        const prismaOp = CERBOS_TO_PRISMA_OPERATOR[operator];
-        if (!prismaOp)
-            throw new Error(`Unsupported operator: ${operator}`);
-        if (isResolvedFieldReference(other)) {
-            return buildFieldFilter(other, prismaOp, folded);
+    // Fully constant arithmetic: fold and compare the other side against the result. The
+    // arithmetic side keeps its source position, so when the folded constant was written
+    // FIRST (`1 + 2 < f`), directional operators mirror to keep the field on the left.
+    if (isResolvedValue(arithLeft) && isResolvedValue(arithRight)) {
+        const folded = foldArithmetic(arithOp, arithLeft.value, arithRight.value);
+        if (!isResolvedFieldReference(other)) {
+            throw new Error(`${arithOp} with two values requires a field reference on the other side`);
         }
-        throw new Error("add with two values requires a field reference on the other side");
+        const effectiveOperator = arithIsLeft
+            ? (MIRRORED_OPERATOR[operator] ?? operator)
+            : operator;
+        return buildComparisonFilter(other, effectiveOperator, folded);
     }
     if (!isResolvedValue(other)) {
-        throw new Error("add operator with field references requires a value on the other side of the comparison");
+        throw new Error(`${arithOp} operator with field references requires a value on the other side of the comparison`);
     }
     let fieldRef;
-    let addValue;
+    let constant;
     let fieldIsLeft;
-    if (isResolvedFieldReference(addLeft) && isResolvedValue(addRight)) {
-        fieldRef = addLeft;
-        addValue = addRight.value;
+    if (isResolvedFieldReference(arithLeft) && isResolvedValue(arithRight)) {
+        fieldRef = arithLeft;
+        constant = arithRight.value;
         fieldIsLeft = true;
     }
-    else if (isResolvedValue(addLeft) && isResolvedFieldReference(addRight)) {
-        fieldRef = addRight;
-        addValue = addLeft.value;
+    else if (isResolvedValue(arithLeft) &&
+        isResolvedFieldReference(arithRight)) {
+        fieldRef = arithRight;
+        constant = arithLeft.value;
         fieldIsLeft = false;
     }
     else {
-        throw new Error("add operator requires exactly one field reference and one value, or two values");
-    }
-    if (operator !== "eq" && operator !== "ne") {
-        throw new Error(`Operator ${operator} is not supported with add and field references`);
-    }
-    const solvedValue = solveAdd(other.value, addValue, fieldIsLeft);
-    if (solvedValue === null) {
-        if (operator === "eq")
-            return buildImpossibleFilter(fieldRef);
-        return {};
+        throw new Error(`${arithOp} operator requires exactly one field reference and one value, or two values`);
+    }
+    // The comparison operator was normalized arithmetic-side-first by the caller; if the
+    // arithmetic was written on the RIGHT of the comparison, direction was already mirrored.
+    let effectiveOperator = arithIsLeft
+        ? operator
+        : (MIRRORED_OPERATOR[operator] ?? operator);
+    // String concatenation solving (eq/ne only).
+    if (arithOp === "add" && typeof constant === "string") {
+        if (effectiveOperator !== "eq" && effectiveOperator !== "ne") {
+            throw new Error(`Operator ${effectiveOperator} is not supported with string concatenation`);
+        }
+        const solvedValue = solveAdd(other.value, constant, fieldIsLeft);
+        if (solvedValue === null) {
+            if (effectiveOperator === "eq")
+                return buildImpossibleFilter(fieldRef);
+            return {};
+        }
+        return buildComparisonFilter(fieldRef, effectiveOperator, solvedValue);
+    }
+    if (typeof constant !== "number" || typeof other.value !== "number") {
+        throw new Error(`${arithOp} comparison requires numeric operands`);
+    }
+    if (arithOp === "add" &&
+        (effectiveOperator === "eq" || effectiveOperator === "ne") &&
+        (!Number.isInteger(constant) || !Number.isInteger(other.value))) {
+        throw new Error("Fractional addition equality cannot be translated safely: solving IEEE-754 addition into a plain Prisma column comparison is not reversible");
+    }
+    let solved;
+    switch (arithOp) {
+        case "add":
+            solved = other.value - constant;
+            break;
+        case "sub":
+            if (fieldIsLeft) {
+                // f - c CMP v  ⇔  f CMP v + c
+                solved = other.value + constant;
+            }
+            else {
+                // c - f CMP v  ⇔  -f CMP v - c  ⇔  f mirror(CMP) c - v
+                solved = constant - other.value;
+                effectiveOperator =
+                    MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+            }
+            break;
+        case "mult":
+            if (constant === 0) {
+                throw new Error("Multiplication by a constant zero must be folded by the Cerbos planner");
+            }
+            solved = other.value / constant;
+            if (constant < 0) {
+                effectiveOperator =
+                    MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+            }
+            break;
+        case "div":
+            if (!fieldIsLeft) {
+                throw new Error("Division by a column is not supported: the comparison cannot be solved to a plain column filter");
+            }
+            if (constant === 0) {
+                throw new Error("Division by a constant zero is not supported");
+            }
+            solved = other.value * constant;
+            if (constant < 0) {
+                effectiveOperator =
+                    MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+            }
+            break;
+        default:
+            throw new Error(`Unsupported operator: ${arithOp}`);
     }
-    return buildFieldFilter(fieldRef, CERBOS_TO_PRISMA_OPERATOR[operator], solvedValue);
+    return buildComparisonFilter(fieldRef, effectiveOperator, solved);
 }
-function foldAdd(left, right) {
-    if (typeof left === "string" || typeof right === "string") {
+function foldArithmetic(operator, left, right) {
+    if (operator === "add" &&
+        (typeof left === "string" || typeof right === "string")) {
         return String(left) + String(right);
     }
-    if (typeof left === "number" && typeof right === "number") {
-        return left + right;
+    if (typeof left !== "number" || typeof right !== "number") {
+        throw new Error(`${operator} operator requires string or number operands`);
+    }
+    switch (operator) {
+        case "add":
+            return left + right;
+        case "sub":
+            return left - right;
+        case "mult":
+            return left * right;
+        case "div":
+            return left / right;
+        default:
+            throw new Error(`Unsupported operator: ${operator}`);
     }
-    throw new Error("add operator requires string or number operands");
 }
 function solveAdd(comparisonValue, addConstant, fieldIsLeft) {
     if (typeof comparisonValue === "string" && typeof addConstant === "string") {
@@ -891,6 +2469,24 @@ function handleOverlapsOperator(operands, mapper) {
     // identical conditions since the same segment pairs are compared in both.
     return validConditions[0];
 }
+/**
+ * Guards every hierarchy prefix that is about to become a Prisma `startsWith`.
+ *
+ * `startsWith` compiles to `LIKE` with no `ESCAPE` clause, so `%` and `_` in the prefix
+ * match as wildcards instead of literally and widen the filter past what the PDP allows.
+ * `\` is unsafe because PostgreSQL and MySQL treat it as the DEFAULT escape character with no
+ * `ESCAPE` clause present, where SQLite has none at all — so the same prefix means different
+ * things per provider. `[` is unsafe for a third reason: SQL Server opens a character class on
+ * `[` even when an `ESCAPE` clause is declared, so it cannot be made literal at all. Fail loudly
+ * rather than emit a filter that admits denied rows.
+ */
+function assertLikeSafePrefix(prefix) {
+    if (/[%_\[\\]/.test(prefix)) {
+        throw new Error("Cannot translate hierarchy prefix matching with LIKE metacharacters (%, _, \\ or [): " +
+            "Prisma emits LIKE without an ESCAPE clause, \\ is the default escape character on " +
+            "PostgreSQL and MySQL, and [ opens a character class on SQL Server even with one");
+    }
+}
 function handleFieldOverlaps(left, right) {
     if (left.type === "field" && right.type === "field") {
         throw new Error("overlaps: cannot compare two field-reference hierarchies");
@@ -908,7 +2504,9 @@ function handleFieldOverlaps(left, right) {
         conditions.push(buildFieldFilter(field.fieldRef, "in", strictPrefixes));
     }
     conditions.push(buildFieldFilter(field.fieldRef, "equals", otherRaw));
-    conditions.push(buildFieldFilter(field.fieldRef, "startsWith", otherRaw + delimiter));
+    const prefix = otherRaw + delimiter;
+    assertLikeSafePrefix(prefix);
+    conditions.push(buildFieldFilter(field.fieldRef, "startsWith", prefix));
     if (conditions.length === 1)
         return conditions[0];
     return { OR: conditions };
@@ -949,6 +2547,7 @@ function handleAncestorDescendantOperator(operands, mapper, direction) {
     const descendant = direction === "ancestor" ? right : left;
     if (ancestor.type === "constant" && descendant.type === "field") {
         const prefix = ancestor.segments.join(descendant.delimiter) + descendant.delimiter;
+        assertLikeSafePrefix(prefix);
         return buildFieldFilter(descendant.fieldRef, "startsWith", prefix);
     }
     if (ancestor.type === "field" && descendant.type === "constant") {