@cerbos/orm-prisma 3.3.0 → 4.1.0

package/src/index.ts

@@ -1,7 +1,7 @@
-import {
+import { PlanKind } from "@cerbos/core";
+import type {
   PlanResourcesResponse,
   PlanExpressionOperand,
-  PlanKind,
   Value,
 } from "@cerbos/core";
 
@@ -16,16 +16,178 @@ const CERBOS_TO_PRISMA_OPERATOR: Record<string, string> = {
   ge: "gte",
 };
 
+// Directional operators mirror when their operands swap sides; symmetric operators are unchanged.
+const MIRRORED_OPERATOR: Record<string, string> = {
+  lt: "gt",
+  gt: "lt",
+  le: "ge",
+  ge: "le",
+};
+
+const RFC3339_MILLISECOND_TIMESTAMP =
+  /^((?!0000)\d{4})-(\d{2})-(\d{2})[Tt](?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.(\d{1,9}))?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+const MIN_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse(
+  "0001-01-01T00:00:00.000Z"
+);
+const MAX_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse(
+  "9999-12-31T23:59:59.999Z"
+);
+
+function normalizeRfc3339Milliseconds(value: string): string {
+  const match = RFC3339_MILLISECOND_TIMESTAMP.exec(value);
+  const yearText = match?.[1];
+  const monthText = match?.[2];
+  const dayText = match?.[3];
+  const fraction = match?.[4] ?? "";
+  if (!yearText || !monthText || !dayText) {
+    throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+  }
+  if ([...fraction.slice(3)].some((digit) => digit !== "0")) {
+    throw new Error(
+      `Timestamp value exceeds millisecond precision: ${value}`
+    );
+  }
+
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const calendarDate = new Date(0);
+  calendarDate.setUTCHours(0, 0, 0, 0);
+  calendarDate.setUTCFullYear(year, month - 1, day);
+  if (
+    calendarDate.getUTCFullYear() !== year ||
+    calendarDate.getUTCMonth() !== month - 1 ||
+    calendarDate.getUTCDate() !== day
+  ) {
+    throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+  }
+
+  const milliseconds = Date.parse(value);
+  if (Number.isNaN(milliseconds)) {
+    throw new Error(`Invalid RFC 3339 timestamp value: ${value}`);
+  }
+  if (
+    milliseconds < MIN_RFC3339_TIMESTAMP_MILLISECONDS ||
+    milliseconds > MAX_RFC3339_TIMESTAMP_MILLISECONDS
+  ) {
+    throw new Error(
+      `Timestamp value is outside CEL's supported instant range: ${value}`
+    );
+  }
+  return new Date(milliseconds).toISOString();
+}
+
+/**
+ * Normalize a binary comparison to field-side-first. The planner preserves policy source
+ * order, so a constant may precede the field it constrains (`1 < R.attr.x` arrives as
+ * `lt(value, variable)`) — swap the operands and mirror directional operators so downstream
+ * handlers can assume the field/expression side is first. Without this, value-first
+ * comparisons are silently inverted (#256).
+ */
+function normalizeBinaryOperands(
+  operator: string,
+  operands: PlanExpressionOperand[]
+): { operator: string; operands: PlanExpressionOperand[] } {
+  const first = operands[0];
+  const second = operands[1];
+  if (
+    operands.length === 2 &&
+    first !== undefined &&
+    second !== undefined &&
+    isValueOperand(first) &&
+    !isValueOperand(second)
+  ) {
+    return {
+      operator: MIRRORED_OPERATOR[operator] ?? operator,
+      operands: [second, first],
+    };
+  }
+  return { operator, operands };
+}
+
 // Type Definitions
 export type PrismaFilter = Record<string, any>;
 
 export type MapperConfig = {
   field?: string;
+  /**
+   * Declares the database value kind when the Cerbos expression wraps a field in a typed
+   * constructor. Date-time metadata is required for timestamp(field) so a string column is
+   * never silently treated as a temporal column merely because it happens to contain ISO text.
+   */
+  valueType?: "dateTime";
+  /**
+   * Marks the mapped column as nullable in the database. Cerbos treats a missing attribute as
+   * an evaluation error (deny), which matches SQL three-valued logic for simple predicates —
+   * but relation subqueries (some/every/none) collapse UNKNOWN to false at the EXISTS boundary,
+   * so collection macros over elements with NULL fields need an explicit guard to stay
+   * deny-aligned. Declaring nullability here enables those guards.
+   */
+  nullable?: boolean;
+  /**
+   * Declares that this column can be SQL NULL **and** how the caller represents that NULL in the
+   * attributes it sends to `check()`. Declaring it asserts both facts; leaving it undeclared means
+   * "treat this column as NOT NULL", which is the historical rendering.
+   *
+   * This is per attribute rather than per call because one policy suite can legitimately mix the
+   * two conventions — the same column can be mapped twice, sent as an explicit null under one
+   * attribute name and omitted under another. The call-level option cannot express that, which is
+   * what made cerbos/query-plan-adapters#308 unfixable with #302's option alone.
+   *
+   * - `"explicit"` — a NULL column is sent as an explicit `null` attribute, so CEL holds a null
+   *   VALUE. `null != "x"` is then TRUE and `null == "x"` is FALSE, both definite, while Prisma's
+   *   `{ not: "x" }` drops the row under both polarities. The equality family (`equals`, `not`,
+   *   `in`) is therefore rendered so it can never depend on SQL's UNKNOWN.
+   * - `"omitted"` — a NULL column sends no attribute, so CEL raises a missing-attribute error and
+   *   `check()` denies. Dropping the row is already right, so the rendering is unchanged; what the
+   *   declaration adds is the same null-operand rejection the call-level `"omitted"` performs,
+   *   scoped to this attribute.
+   *
+   * Only the equality family is affected. `lt`/`lte`/`gt`/`gte` and the string operators raise a
+   * no-overload error on a null receiver in CEL, which denies under both polarities exactly as a
+   * dropped row does, so they are left alone.
+   *
+   * Distinct from `nullable` above, which declares that a *relation element* column can be NULL so
+   * collection macros gain their three-valued guards. The two are independent: `nullable` is about
+   * what a subquery does with an UNKNOWN element, this is about what the caller sent to the PDP.
+   *
+   * See https://github.com/cerbos/query-plan-adapters/issues/308.
+   */
+  nullAttributeRepresentation?: NullAttributeRepresentation;
   relation?: {
     name: string;
     type: "one" | "many";
+    /**
+     * The Prisma model name of the related record (e.g. "Tag"). Required only for
+     * field-to-field comparisons between two columns of the related model, which compile to
+     * Prisma field references and need the model name as their container.
+     */
+    model?: string;
     field?: string;
     fields?: Record<string, MapperConfig>;
+    /**
+     * The predicate the application itself applies when it reads this relation — a soft-delete
+     * flag, a tenant column, a subtype discriminator, whatever narrows the rows that became the
+     * resource attributes.
+     *
+     * Prisma has no schema-level filtered relation. A `where` injected by a client extension or
+     * middleware rewrites the *top-level* query, never the nested `some`/`every`/`none` this
+     * adapter generates, so a narrowing the application applies to its own reads does not reach
+     * the subquery — and the subquery then matches records the application never serialised, a
+     * filter that returns rows the PDP denies. Declaring the predicate here restores the
+     * equality; the adapter cannot detect the omission, which is why the field is optional and
+     * silence is not a warning. See "Mapping hazards" in the README.
+     *
+     * It is a Prisma where-input over the RELATED model, ANDed into the nested filter, and it
+     * constrains every operator reached through this relation under both polarities. `every` is
+     * rewritten to the equivalent `none` so the restriction narrows the records examined rather
+     * than the records required to match.
+     *
+     * ```ts
+     * relation: { name: "tags", type: "many", subqueryFilter: { deletedAt: null } }
+     * ```
+     */
+    subqueryFilter?: PrismaFilter;
   };
 };
 
@@ -33,9 +195,36 @@ export type Mapper =
   | Record<string, MapperConfig>
   | ((key: string) => MapperConfig);
 
+/**
+ * How the caller represents a NULL column when building the attributes it sends to `check()`.
+ *
+ * The planner emits the same `eq(attr, null)` node either way, so the plan cannot reveal which
+ * convention is in use and the adapter has to be told.
+ *
+ * - `"explicit"` (default) — a NULL column is sent as an explicit `null` attribute. CEL compares
+ *   `null == null`, so `IS NULL` selects exactly the rows `check()` allows.
+ * - `"omitted"` — a NULL column sends no attribute at all. CEL then raises a missing-attribute
+ *   error, which Cerbos treats as a deny, so a filter that *selects* NULL rows returns rows the
+ *   PDP denies. Null comparison operands are rejected instead of translated.
+ *
+ * See https://github.com/cerbos/query-plan-adapters/issues/302.
+ */
+export type NullAttributeRepresentation = "explicit" | "omitted";
+
 export interface QueryPlanToPrismaArgs {
   queryPlan: PlanResourcesResponse;
   mapper?: Mapper;
+  /**
+   * The Prisma model name the generated filter targets (e.g. "Resource"). Required only for
+   * field-to-field comparisons between two root columns, which compile to Prisma field
+   * references and need the model name as their container.
+   */
+  model?: string;
+  /**
+   * Which NULL-column representation the caller uses when building `check()` attributes.
+   * Defaults to `"explicit"`, preserving the historical `IS NULL` translation.
+   */
+  nullAttributeRepresentation?: NullAttributeRepresentation;
 }
 
 export type QueryPlanToPrismaResult =
@@ -91,6 +280,203 @@ function assertDefined<T>(value: T | undefined, message: string): T {
   return value;
 }
 
+// Operators whose second operand is a lambda that binds an iteration variable.
+const LAMBDA_BINDING_OPERATORS = new Set([
+  "exists",
+  "exists_one",
+  "all",
+  "filter",
+  "map",
+  "except",
+]);
+
+/**
+ * Substitute a lambda iteration variable with a concrete collection element
+ * inside a lambda body. A bare reference to the variable becomes the element
+ * itself; a `variable.path.to.field` reference drills into the element. A
+ * nested collection macro whose lambda rebinds the same variable name shadows
+ * the outer variable, so substitution only descends into its collection
+ * operand.
+ */
+function substituteLambdaVariable(
+  operand: PlanExpressionOperand,
+  variableName: string,
+  element: Value
+): PlanExpressionOperand {
+  if (isNamedOperand(operand)) {
+    if (operand.name === variableName) {
+      return { value: element };
+    }
+    if (operand.name.startsWith(`${variableName}.`)) {
+      let current: Value = element;
+      for (const segment of operand.name
+        .slice(variableName.length + 1)
+        .split(".")) {
+        if (
+          current === null ||
+          typeof current !== "object" ||
+          Array.isArray(current) ||
+          !(segment in current) ||
+          current[segment] === undefined
+        ) {
+          throw new Error(
+            `Cannot resolve "${operand.name}": collection element has no field "${segment}"`
+          );
+        }
+        current = current[segment];
+      }
+      return { value: current };
+    }
+    return operand;
+  }
+
+  if (isOperatorOperand(operand)) {
+    if (
+      LAMBDA_BINDING_OPERATORS.has(operand.operator) &&
+      operand.operands.length === 2
+    ) {
+      const [nestedCollection, nestedLambda] = operand.operands;
+      if (
+        nestedCollection !== undefined &&
+        nestedLambda !== undefined &&
+        isOperatorOperand(nestedLambda) &&
+        nestedLambda.operator === "lambda"
+      ) {
+        const nestedVariable = nestedLambda.operands[1];
+        if (
+          nestedVariable !== undefined &&
+          isNamedOperand(nestedVariable) &&
+          nestedVariable.name === variableName
+        ) {
+          // The nested lambda shadows our variable: substitute only in the
+          // collection operand.
+          return {
+            operator: operand.operator,
+            operands: [
+              substituteLambdaVariable(nestedCollection, variableName, element),
+              nestedLambda,
+            ],
+          };
+        }
+      }
+    }
+    return {
+      operator: operand.operator,
+      operands: operand.operands.map((o) =>
+        substituteLambdaVariable(o, variableName, element)
+      ),
+    };
+  }
+
+  return operand;
+}
+
+/**
+ * Fold a collection macro whose collection operand is a literal value list.
+ *
+ * The planner emits this shape when a known-value collection (typically a
+ * folded principal attribute) has more than 10 elements — at 10 or fewer it
+ * unrolls `exists`/`all` into an or/and chain itself (cerbos/cerbos#2570,
+ * cerbos/cerbos#2817; `maxItems = 10` in the planner's struct matcher). Apply
+ * the same fold here so the translated filter does not depend on which side of
+ * that threshold the collection lands: substitute each element into the lambda
+ * body and combine the per-element filters with OR (`exists`) or AND (`all`).
+ *
+ * An empty list yields `{OR: []}` / `{AND: []}`, which Prisma evaluates to
+ * match-nothing / match-everything — exactly CEL's `exists`/`all` semantics
+ * over an empty collection.
+ */
+function handleKnownValueCollectionOperator(
+  operator: string,
+  collection: ValueOperand,
+  lambda: PlanExpressionOperand,
+  mapper: Mapper,
+  negated: boolean
+): PrismaFilter {
+  if (operator !== "exists" && operator !== "all") {
+    throw new Error(
+      `${operator} over a literal collection value is not supported. ` +
+        "Only exists() and all() can be folded into a flat filter."
+    );
+  }
+
+  const elements = collection.value;
+  if (!Array.isArray(elements)) {
+    throw new Error(
+      `${operator} over a literal collection requires a list value`
+    );
+  }
+
+  if (!isOperatorOperand(lambda) || lambda.operator !== "lambda") {
+    throw new Error(
+      `Second operand of ${operator} must be a lambda expression`
+    );
+  }
+  if (lambda.operands.length !== 2) {
+    throw new Error(
+      `${operator} over a literal collection supports single-variable lambdas only`
+    );
+  }
+
+  const body = assertDefined(
+    lambda.operands[0],
+    "Lambda expression must provide a condition"
+  );
+  const variable = assertDefined(
+    lambda.operands[1],
+    "Lambda variable must have a name"
+  );
+  if (!isNamedOperand(variable)) {
+    throw new Error("Lambda variable must have a name");
+  }
+
+  const filters = elements.map((element) => {
+    const substituted = substituteLambdaVariable(
+      body,
+      variable.name,
+      element
+    );
+    return negated
+      ? buildNegatedFilter(substituted, mapper)
+      : buildPrismaFilterFromCerbosExpression(substituted, mapper);
+  });
+
+  const combinesWithOr = operator === "exists" ? !negated : negated;
+  return combinesWithOr ? { OR: filters } : { AND: filters };
+}
+
+function tryHandleKnownValueCollectionOperator(
+  operator: string,
+  operands: PlanExpressionOperand[],
+  mapper: Mapper,
+  negated: boolean
+): PrismaFilter | undefined {
+  if (operands.length !== 2) {
+    return undefined;
+  }
+
+  const collection = operands[0];
+  const lambda = operands[1];
+  if (
+    collection === undefined ||
+    lambda === undefined ||
+    !isValueOperand(collection)
+  ) {
+    return undefined;
+  }
+
+  // A literal value list arrives when the planner could not unroll a macro
+  // over a known collection (more than 10 elements). Fold it before attempting
+  // relation resolution because there is no relation mapping for a literal.
+  return handleKnownValueCollectionOperator(
+    operator,
+    collection,
+    lambda,
+    mapper,
+    negated
+  );
+}
+
 function getLeafField(path: string[]): string {
   const fieldName = path[path.length - 1];
   if (!fieldName) {
@@ -111,15 +497,24 @@ function getFilterEntry(filter: Record<string, unknown>): [string, unknown] {
 type RelationConfig = {
   name: string;
   type: "one" | "many";
+  model?: string;
   field?: string;
   nestedMapper?: Record<string, MapperConfig>;
+  subqueryFilter?: PrismaFilter;
 };
 
 type ResolvedFieldReference = {
   path: string[];
   relations?: RelationConfig[];
+  valueType?: "dateTime";
+  nullAttributeRepresentation?: NullAttributeRepresentation;
 };
 
+/** Whether this reference is one the caller sends as an explicit `null` when the column is NULL. */
+function isExplicitNullReference(fieldRef: ResolvedFieldReference): boolean {
+  return fieldRef.nullAttributeRepresentation === "explicit";
+}
+
 type ResolvedValue = {
   value: any;
 };
@@ -136,38 +531,6 @@ function isResolvedValue(operand: ResolvedOperand): operand is ResolvedValue {
   return "value" in operand;
 }
 
-function getNamedOperand(
-  operands: PlanExpressionOperand[],
-  message: string
-): NamedOperand {
-  const operand = operands.find(isNamedOperand);
-  if (!operand) {
-    throw new Error(message);
-  }
-  return operand;
-}
-
-function getValueOperand(
-  operands: PlanExpressionOperand[],
-  message: string
-): ValueOperand {
-  const operand = operands.find(isValueOperand);
-  if (!operand) {
-    throw new Error(message);
-  }
-  return operand;
-}
-
-function requireResolvedFieldReference(
-  operand: ResolvedOperand,
-  message: string
-): ResolvedFieldReference {
-  if (!isResolvedFieldReference(operand)) {
-    throw new Error(message);
-  }
-  return operand;
-}
-
 function requireResolvedValue(
   operand: ResolvedOperand,
   message: string
@@ -196,16 +559,130 @@ function buildFieldEqualsFilter(
   return wrapRelations(fieldRef.relations, { [fieldName]: { equals: value } });
 }
 
+function buildDirectOrInLeaf(
+  fieldRef: ResolvedFieldReference,
+  values: Value[]
+): PrismaFilter {
+  const fieldName = getLeafField(fieldRef.path);
+  return values.length === 1
+    ? { [fieldName]: values[0] }
+    : { [fieldName]: { in: values } };
+}
+
 function buildFieldDirectOrInFilter(
   fieldRef: ResolvedFieldReference,
   values: Value[]
+): PrismaFilter {
+  return wrapRelations(fieldRef.relations, buildDirectOrInLeaf(fieldRef, values));
+}
+
+/**
+ * `field IS NOT NULL AND <leaf>`, so a NULL column makes the whole thing definitely FALSE rather
+ * than merely unmatched — which is what lets an enclosing `NOT` include the row.
+ *
+ * Prisma has no three-valued logic to expose: a record either matches a `where` or it does not.
+ * That is exactly why the guard has to be explicit — `{ NOT: { field: { equals: "x" } } }` leans on
+ * the generated SQL's UNKNOWN, which excludes the record under both polarities, and an
+ * explicit-null attribute needs the negation to include it.
+ *
+ * The guard is ANDed with the leaf BEFORE the relation wrapping, so both halves are evaluated
+ * against the same element rather than against two independently-matched ones.
+ */
+function guardedFieldFilter(
+  fieldRef: ResolvedFieldReference,
+  leaf: PrismaFilter
 ): PrismaFilter {
   const fieldName = getLeafField(fieldRef.path);
-  const baseFilter =
-    values.length === 1
-      ? { [fieldName]: values[0] }
-      : { [fieldName]: { in: values } };
-  return wrapRelations(fieldRef.relations, baseFilter);
+  return wrapRelations(fieldRef.relations, {
+    AND: [{ [fieldName]: { not: null } }, leaf],
+  });
+}
+
+function buildMembershipFilter(
+  fieldRef: ResolvedFieldReference,
+  values: Value[]
+): PrismaFilter {
+  const nonNullValues = values.filter((value) => value !== null);
+  const carriesNull = nonNullValues.length !== values.length;
+  if (carriesNull) {
+    assertNullOperandTranslatable(
+      "a null element in an `in` list",
+      fieldRef.nullAttributeRepresentation
+    );
+  }
+  const filters: PrismaFilter[] = [];
+
+  if (nonNullValues.length > 0 || values.length === 0) {
+    // Without a null element nothing has made the membership definite yet: a NULL column is
+    // dropped by `{ in: [...] }` under BOTH polarities, while CEL compares a null VALUE against
+    // each element and gets a definite false, so its negation is TRUE. With a null element the
+    // `[null]` disjunct below already settles it.
+    filters.push(
+      carriesNull || !isExplicitNullReference(fieldRef)
+        ? buildFieldDirectOrInFilter(fieldRef, nonNullValues)
+        : guardedFieldFilter(
+            fieldRef,
+            buildDirectOrInLeaf(fieldRef, nonNullValues)
+          )
+    );
+  }
+  if (carriesNull) {
+    filters.push(buildFieldDirectOrInFilter(fieldRef, [null]));
+  }
+
+  if (filters.length === 1) {
+    return assertDefined(filters[0], "Membership filter is missing");
+  }
+  return { OR: filters };
+}
+
+function buildAlwaysTrueFilter(): PrismaFilter {
+  return {};
+}
+
+type TernaryBranchPredicate =
+  | { kind: "constant"; value: boolean }
+  | { kind: "filter"; filter: PrismaFilter };
+
+// Translation-scoped context. Set at queryPlanToPrisma entry; the lambda stack tracks which
+// collection variable (and related Prisma model) encloses the expression currently being built,
+// so leaf handlers can distinguish element columns from outer columns and collect nullable
+// element fields for three-valued-logic guards. Translation is synchronous, so module scope is
+// safe.
+type LambdaScope = {
+  variableName: string;
+  relationModel: string | undefined;
+  nullableFields: Set<string>;
+  unknownFilters: PrismaFilter[];
+};
+let lambdaScopes: LambdaScope[] = [];
+let rootModelName: string | undefined;
+let nullRepresentation: NullAttributeRepresentation = "explicit";
+
+/**
+ * Guards every site that would emit a NULL-selecting predicate out of a `null` comparison
+ * operand.
+ *
+ * Under the `"omitted"` representation a NULL column carries no attribute, so CEL raises a
+ * missing-attribute error and `check()` denies the row — `IS NULL` would return exactly the rows
+ * the PDP refuses. The rejection is deliberately wider than the over-granting shapes: `ne(x,
+ * null)` on its own is aligned, but Prisma applies negation by wrapping (`{ NOT: ... }`) rather
+ * than by pushing it into the leaf, so a leaf cannot tell whether an enclosing `not` will flip
+ * `IS NOT NULL` back into a NULL-selecting predicate. Rejecting every null operand is correct
+ * under any nesting; narrowing it requires negation-parity tracking.
+ */
+function assertNullOperandTranslatable(
+  context: string,
+  declared?: NullAttributeRepresentation
+): void {
+  if ((declared ?? nullRepresentation) === "omitted") {
+    throw new Error(
+      `Cannot translate ${context} under nullAttributeRepresentation "omitted": a NULL column ` +
+        "sends no attribute, so Cerbos evaluates the comparison as a missing-attribute error " +
+        "(deny) while a NULL-selecting filter would return those rows. Send NULL columns as " +
+        'explicit nulls and use "explicit", or keep this shape out of the policy.'
+    );
+  }
 }
 
 /**
@@ -214,25 +691,423 @@ function buildFieldDirectOrInFilter(
 export function queryPlanToPrisma({
   queryPlan,
   mapper = {},
+  model,
+  nullAttributeRepresentation = "explicit",
 }: QueryPlanToPrismaArgs): QueryPlanToPrismaResult {
+  nullRepresentation = nullAttributeRepresentation;
   switch (queryPlan.kind) {
     case PlanKind.ALWAYS_ALLOWED:
       return { kind: PlanKind.ALWAYS_ALLOWED };
     case PlanKind.ALWAYS_DENIED:
       return { kind: PlanKind.ALWAYS_DENIED };
-    case PlanKind.CONDITIONAL:
+    case PlanKind.CONDITIONAL: {
+      lambdaScopes = [];
+      rootModelName = model;
+      const condition = constantFoldExpression(
+        hoistOuterScopeReferences(queryPlan.condition, [])
+      );
+      if (isValueOperand(condition)) {
+        // Real PDP plans fold constant conditions to ALWAYS_ALLOWED/ALWAYS_DENIED before
+        // they reach the adapter; this can only surface with hand-crafted plans.
+        if (condition.value === true) {
+          return { kind: PlanKind.CONDITIONAL, filters: {} };
+        }
+        // Prisma has no model-agnostic always-false `where` shape: empty logical arrays
+        // are ignored.
+        throw new Error(
+          "A constant-false conditional predicate must be folded by the Cerbos planner"
+        );
+      }
+      // A `map()` at the ROOT of the condition returns a list, not a boolean. Translating it
+      // produces a projection filter that is not a valid Prisma `where` clause — the shape
+      // must be refused HERE rather than left for findMany to reject at query time, because
+      // a projection that happened to coerce would be a silently-wrong filter. (`filter()`
+      // as a condition is already rejected inside handleCollectionOperator with its own
+      // message; nested inside a comparison or size() both remain translatable.)
+      if (isOperatorOperand(condition) && condition.operator === "map") {
+        throw new Error(
+          "map() returns a list, not a boolean, so it cannot be a condition on its own; " +
+            "only comparisons or size() over its result have a boolean meaning"
+        );
+      }
       return {
         kind: PlanKind.CONDITIONAL,
-        filters: buildPrismaFilterFromCerbosExpression(
-          queryPlan.condition,
-          mapper
-        ),
+        filters: buildPrismaFilterFromCerbosExpression(condition, mapper),
       };
+    }
     default:
       throw Error(`Invalid query plan.`);
   }
 }
 
+const COLLECTION_OPERATORS = new Set([
+  "exists",
+  "exists_one",
+  "all",
+  "except",
+  "filter",
+]);
+
+function mentionsVariable(
+  expr: PlanExpressionOperand,
+  variableName: string
+): boolean {
+  if (isNamedOperand(expr)) {
+    return (
+      expr.name === variableName || expr.name.startsWith(variableName + ".")
+    );
+  }
+  if (isOperatorOperand(expr)) {
+    return expr.operands.some((operand) =>
+      mentionsVariable(operand, variableName)
+    );
+  }
+  return false;
+}
+
+function isOuterScopeName(name: string, enclosingVariables: string[]): boolean {
+  return !enclosingVariables.some(
+    (variable) => name === variable || name.startsWith(variable + ".")
+  );
+}
+
+/** Replaces every occurrence of the bare named operand `name` with a boolean constant. */
+function substituteNamedOperand(
+  expr: PlanExpressionOperand,
+  name: string,
+  value: boolean
+): PlanExpressionOperand {
+  if (isNamedOperand(expr)) {
+    return expr.name === name ? { value } : expr;
+  }
+  if (isOperatorOperand(expr)) {
+    return {
+      operator: expr.operator,
+      operands: expr.operands.map((operand) =>
+        substituteNamedOperand(operand, name, value)
+      ),
+    };
+  }
+  return expr;
+}
+
+/**
+ * Finds a bare boolean reference to an OUTER column (root or enclosing lambda scope) in a
+ * boolean position of a lambda body: a direct operand of and/or/not, a ternary condition, or
+ * the body itself.
+ */
+function findOuterBooleanReference(
+  expr: PlanExpressionOperand,
+  enclosingVariables: string[]
+): string | undefined {
+  if (isNamedOperand(expr)) {
+    return isOuterScopeName(expr.name, enclosingVariables)
+      ? expr.name
+      : undefined;
+  }
+  if (!isOperatorOperand(expr)) {
+    return undefined;
+  }
+  const booleanPositions: PlanExpressionOperand[] = [];
+  switch (expr.operator) {
+    case "and":
+    case "or":
+    case "not":
+      booleanPositions.push(...expr.operands);
+      break;
+    case "if":
+      booleanPositions.push(...expr.operands);
+      break;
+    default:
+      // Comparisons wrapping a ternary keep the outer reference in the ternary condition.
+      booleanPositions.push(
+        ...expr.operands.filter(
+          (operand) =>
+            isOperatorOperand(operand) &&
+            (operand.operator === "if" ||
+              operand.operator === "and" ||
+              operand.operator === "or" ||
+              operand.operator === "not")
+        )
+      );
+      break;
+  }
+  for (const operand of booleanPositions) {
+    const found = findOuterBooleanReference(operand, enclosingVariables);
+    if (found !== undefined) {
+      return found;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Rewrites lambda bodies that reference columns of an ENCLOSING scope (the root row, or an
+ * outer lambda's element) so that every filter lands on the model it belongs to. Without this,
+ * an outer column referenced inside `tags.exists(t, ...)` would be emitted as a field of the
+ * tag model. Two sound transforms, applied bottom-up:
+ *
+ * - Conjunct hoisting (exists only): `exists(c, P(c) && Q)` with row-constant Q becomes
+ *   `exists(c, P(c)) && Q`. Valid in three-valued logic (AND distributes over the per-element
+ *   OR), including the empty-collection case (both sides are FALSE).
+ * - Case split (any collection op): a bare outer boolean reference Q in a boolean position
+ *   becomes `(Q && op[Q:=true]) || (!Q && op[Q:=false]) || (Q && !Q)`. The contradiction arm
+ *   keeps the whole expression UNKNOWN (not FALSE) when Q is NULL-derived, mirroring the
+ *   guarded-ternary encoding.
+ */
+function hoistOuterScopeReferences(
+  expr: PlanExpressionOperand,
+  enclosingVariables: string[]
+): PlanExpressionOperand {
+  if (!isOperatorOperand(expr)) {
+    return expr;
+  }
+
+  if (COLLECTION_OPERATORS.has(expr.operator) && expr.operands.length === 2) {
+    const [collection, lambda] = expr.operands;
+    if (
+      collection !== undefined &&
+      lambda !== undefined &&
+      isOperatorOperand(lambda) &&
+      lambda.operator === "lambda" &&
+      lambda.operands.length === 2 &&
+      lambda.operands[1] !== undefined &&
+      isNamedOperand(lambda.operands[1])
+    ) {
+      const variable = lambda.operands[1];
+      const body = hoistOuterScopeReferences(
+        assertDefined(lambda.operands[0], "Lambda requires a condition"),
+        [...enclosingVariables, variable.name]
+      );
+
+      const rebuild = (newBody: PlanExpressionOperand): OperatorOperand => ({
+        operator: expr.operator,
+        operands: [
+          collection,
+          { operator: "lambda", operands: [newBody, variable] },
+        ],
+      });
+
+      // Conjunct hoisting out of exists().
+      if (
+        expr.operator === "exists" &&
+        isOperatorOperand(body) &&
+        body.operator === "and"
+      ) {
+        const elementConjuncts = body.operands.filter((operand) =>
+          mentionsVariable(operand, variable.name)
+        );
+        const outerConjuncts = body.operands.filter(
+          (operand) => !mentionsVariable(operand, variable.name)
+        );
+        if (outerConjuncts.length > 0 && elementConjuncts.length > 0) {
+          const innerBody =
+            elementConjuncts.length === 1
+              ? elementConjuncts[0]!
+              : { operator: "and", operands: elementConjuncts };
+          return {
+            operator: "and",
+            operands: [rebuild(innerBody), ...outerConjuncts],
+          };
+        }
+      }
+
+      // Case split on a bare outer boolean reference.
+      const outerRef = findOuterBooleanReference(body, [
+        ...enclosingVariables,
+        variable.name,
+      ]);
+      if (outerRef !== undefined) {
+        const q: PlanExpressionOperand = { name: outerRef };
+        const notQ: PlanExpressionOperand = { operator: "not", operands: [q] };
+        return {
+          operator: "or",
+          operands: [
+            {
+              operator: "and",
+              operands: [
+                q,
+                rebuild(substituteNamedOperand(body, outerRef, true)),
+              ],
+            },
+            {
+              operator: "and",
+              operands: [
+                notQ,
+                rebuild(substituteNamedOperand(body, outerRef, false)),
+              ],
+            },
+            // Contradiction arm: UNKNOWN when the reference is NULL-derived, never TRUE.
+            { operator: "and", operands: [q, notQ] },
+          ],
+        };
+      }
+
+      return rebuild(body);
+    }
+  }
+
+  return {
+    operator: expr.operator,
+    operands: expr.operands.map((operand) =>
+      hoistOuterScopeReferences(operand, enclosingVariables)
+    ),
+  };
+}
+
+const FOLDABLE_COMPARISON_OPERATORS = new Set([
+  "eq",
+  "ne",
+  "lt",
+  "le",
+  "gt",
+  "ge",
+]);
+
+/**
+ * Bottom-up constant folding over the plan AST. Only shapes the case-split transform can
+ * produce need folding (constant ternary conditions, comparisons between two constants,
+ * logical operators with constant operands, collection macros with constant bodies); real
+ * planner output arrives pre-folded.
+ */
+function constantFoldExpression(
+  expr: PlanExpressionOperand
+): PlanExpressionOperand {
+  if (!isOperatorOperand(expr)) {
+    return expr;
+  }
+  const operands = expr.operands.map(constantFoldExpression);
+  const folded: OperatorOperand = { operator: expr.operator, operands };
+
+  switch (expr.operator) {
+    case "if": {
+      const [condition, thenBranch, elseBranch] = operands;
+      if (condition !== undefined && isValueOperand(condition)) {
+        if (typeof condition.value !== "boolean") {
+          throw new Error("if (ternary) condition must be a boolean expression");
+        }
+        return assertDefined(
+          condition.value ? thenBranch : elseBranch,
+          "if (ternary) requires branch operands"
+        );
+      }
+      return folded;
+    }
+    case "and": {
+      if (operands.some((o) => isValueOperand(o) && o.value === false)) {
+        return { value: false };
+      }
+      const remaining = operands.filter((o) => !isValueOperand(o));
+      if (remaining.length === 0) return { value: true };
+      if (remaining.length === 1) return remaining[0]!;
+      return { operator: "and", operands: remaining };
+    }
+    case "or": {
+      if (operands.some((o) => isValueOperand(o) && o.value === true)) {
+        return { value: true };
+      }
+      const remaining = operands.filter((o) => !isValueOperand(o));
+      if (remaining.length === 0) return { value: false };
+      if (remaining.length === 1) return remaining[0]!;
+      return { operator: "or", operands: remaining };
+    }
+    case "not": {
+      const operand = operands[0];
+      if (operand !== undefined && isValueOperand(operand)) {
+        return { value: operand.value !== true };
+      }
+      return folded;
+    }
+    case "add":
+    case "sub":
+    case "mult":
+    case "div": {
+      const [left, right] = operands;
+      if (
+        left !== undefined &&
+        right !== undefined &&
+        isValueOperand(left) &&
+        isValueOperand(right)
+      ) {
+        return {
+          value: foldArithmetic(expr.operator, left.value, right.value),
+        };
+      }
+      return folded;
+    }
+    case "contains":
+    case "startsWith":
+    case "endsWith": {
+      const [receiver, needle] = operands;
+      if (
+        receiver !== undefined &&
+        needle !== undefined &&
+        isValueOperand(receiver) &&
+        isValueOperand(needle) &&
+        typeof receiver.value === "string" &&
+        typeof needle.value === "string"
+      ) {
+        const r = receiver.value;
+        const n = needle.value;
+        return {
+          value:
+            expr.operator === "contains"
+              ? r.includes(n)
+              : expr.operator === "startsWith"
+                ? r.startsWith(n)
+                : r.endsWith(n),
+        };
+      }
+      return folded;
+    }
+    case "exists":
+    case "all": {
+      const [collection, lambda] = operands;
+      if (
+        collection !== undefined &&
+        lambda !== undefined &&
+        isOperatorOperand(lambda) &&
+        lambda.operator === "lambda" &&
+        lambda.operands[0] !== undefined &&
+        isValueOperand(lambda.operands[0])
+      ) {
+        const bodyValue = lambda.operands[0].value === true;
+        if (expr.operator === "exists" && !bodyValue) return { value: false };
+        if (expr.operator === "all" && bodyValue) return { value: true };
+        const sizeExpr: PlanExpressionOperand = {
+          operator: "size",
+          operands: [collection],
+        };
+        // exists(c, true) is "collection is non-empty"; all(c, false) is "collection is empty".
+        return expr.operator === "exists"
+          ? { operator: "gt", operands: [sizeExpr, { value: 0 }] }
+          : { operator: "eq", operands: [sizeExpr, { value: 0 }] };
+      }
+      return folded;
+    }
+    default: {
+      if (FOLDABLE_COMPARISON_OPERATORS.has(expr.operator)) {
+        const [left, right] = operands;
+        if (
+          left !== undefined &&
+          right !== undefined &&
+          isValueOperand(left) &&
+          isValueOperand(right)
+        ) {
+          return {
+            value: evaluateConstantComparison(
+              expr.operator,
+              left.value,
+              right.value
+            ),
+          };
+        }
+      }
+      return folded;
+    }
+  }
+}
+
 /**
  * Resolves a field reference considering relations and nested fields.
  */
@@ -277,8 +1152,10 @@ function resolveFieldReference(
       {
         name,
         type,
+        model: activeConfig.relation.model,
         field: activeConfig.relation.field,
         nestedMapper: fields,
+        subqueryFilter: activeConfig.relation.subqueryFilter,
       },
     ];
 
@@ -302,8 +1179,10 @@ function resolveFieldReference(
           relations.push({
             name: nextConfig.relation.name,
             type: nextConfig.relation.type,
+            model: nextConfig.relation.model,
             field: nextConfig.relation.field,
             nestedMapper: nextConfig.relation.fields,
+            subqueryFilter: nextConfig.relation.subqueryFilter,
           });
           currentMapper = nextConfig.relation.fields || {};
           currentParts = currentParts.slice(1);
@@ -318,11 +1197,20 @@ function resolveFieldReference(
       }
     }
 
-    return { path: field ? [field] : remainingParts, relations };
+    return {
+      path: field ? [field] : remainingParts,
+      relations,
+      valueType: activeConfig.valueType,
+      nullAttributeRepresentation: activeConfig.nullAttributeRepresentation,
+    };
   }
 
   // Simple field mapping
-  return { path: [activeConfig?.field || reference] };
+  return {
+    path: [activeConfig?.field || reference],
+    valueType: activeConfig?.valueType,
+    nullAttributeRepresentation: activeConfig?.nullAttributeRepresentation,
+  };
 }
 
 /**
@@ -336,9 +1224,167 @@ function getPrismaRelationOperator(relation: {
   return relation.type === "one" ? "is" : "some";
 }
 
+/**
+ * One relation-scoped filter (`{ tags: { some: … } }`), narrowed by the store-side predicate the
+ * caller declared on the mapping.
+ *
+ * Every nested relation filter the adapter emits goes through here, so a declared
+ * `subqueryFilter` reaches the collection macros, the membership shapes, the emptiness checks and
+ * the hop-existence guard alike. Adding a new relation shape means routing it through here, or
+ * the declaration silently stops applying to it.
+ *
+ * `every` is the one operator that cannot simply absorb the predicate. `{ every: AND(W, P) }`
+ * would REQUIRE every record to satisfy W, which is the opposite of "ignore the records W hides",
+ * so it is rewritten to `{ none: AND(W, NOT P) }` — no visible record violates P. Both agree with
+ * `every` when nothing is declared, and both stay vacuously true over an empty relation.
+ */
+function relationFilter(
+  relation: RelationConfig,
+  operator: string,
+  inner: PrismaFilter
+): PrismaFilter {
+  const declared = relation.subqueryFilter;
+  if (declared === undefined) {
+    return { [relation.name]: { [operator]: inner } };
+  }
+  const narrow = (filter: PrismaFilter): PrismaFilter =>
+    Object.keys(filter).length === 0 ? declared : { AND: [declared, filter] };
+  if (operator === "every") {
+    return Object.keys(inner).length === 0
+      ? { [relation.name]: { every: inner } }
+      : { [relation.name]: { none: { AND: [declared, { NOT: inner }] } } };
+  }
+  return { [relation.name]: { [operator]: narrow(inner) } };
+}
+
 /**
  * Builds a nested relation filter for Prisma queries.
  */
+/**
+ * "Every intermediate hop of a dotted path exists", as a Prisma filter.
+ *
+ * CEL cannot dot through a list, so each intermediate segment of `a.b.c` is a to-ONE
+ * parent: absent, the caller sends no attribute and CEL raises a missing-path error, which
+ * denies. `NOT { categories: { some: { subCategories: { some: P } } } }` is TRUE for a row
+ * with no category at all, so the negation returns rows the PDP denies — the parent must be
+ * required separately (cerbos/query-plan-adapters#309).
+ *
+ * Returns undefined when the reference has no intermediate hop, so a direct relation keeps
+ * its empty-collection semantics (`!tags.exists(...)` over zero tags is still TRUE).
+ */
+function buildLeadingHopsExistFilter(
+  head: RelationConfig,
+  restRelations: RelationConfig[]
+): PrismaFilter | undefined {
+  if (restRelations.length === 0) {
+    return undefined;
+  }
+  // The last entry is the collection being iterated; everything before it is a hop.
+  return buildHopsExistFilter([head, ...restRelations.slice(0, -1)]);
+}
+
+/**
+ * "Every one of these relations exists", as a nested Prisma filter with an empty innermost
+ * predicate — `{ parent: { is: { inner: { is: {} } } } }`.
+ */
+function buildHopsExistFilter(
+  hops: RelationConfig[]
+): PrismaFilter | undefined {
+  if (hops.length === 0) {
+    return undefined;
+  }
+  let inner: PrismaFilter = {};
+  for (let i = hops.length - 1; i >= 0; i--) {
+    const relation = assertDefined(hops[i], "Relation mapping is missing");
+    inner = relationFilter(relation, getPrismaRelationOperator(relation), inner);
+  }
+  return inner;
+}
+
+/**
+ * "Every to-one hop this expression dots through exists", as a Prisma filter, or undefined
+ * when it dots through none.
+ *
+ * Prisma has no UNKNOWN: a chained relation filter is exact under the POSITIVE polarity —
+ * `categories: { some: { subCategories: { some: P } } }` cannot hold without the category —
+ * but `NOT` inverts the hop requirement along with the predicate, so every operator built on
+ * a chain readmits the parentless rows once negated. #309 fixed that inside the collection
+ * macros, which left the sibling operators reached through the same chain unguarded:
+ * membership and `hasIntersection` (cerbos/query-plan-adapters#315), and the negated count
+ * spelling `!(size(chain) > 0)` (#316), all of which the macros' guard never saw.
+ *
+ * Requiring the hops OUTSIDE the negation is what fixes all of them at once, and it is
+ * unconditionally faithful to CEL rather than a per-operator patch: a missing hop is a
+ * missing-path error, which denies under BOTH polarities, so the requirement never depends
+ * on which operator sits above the chain.
+ *
+ * Lambda bodies are deliberately not walked — their references resolve against a scoped
+ * mapper, and a negated macro carries its own guard through buildNegatedCollectionFilter.
+ */
+function buildExpressionHopsExistFilter(
+  operand: PlanExpressionOperand,
+  mapper: Mapper
+): PrismaFilter | undefined {
+  const hops: PrismaFilter[] = [];
+  const seen = new Set<string>();
+
+  const visit = (expr: PlanExpressionOperand): void => {
+    if (isNamedOperand(expr)) {
+      if (seen.has(expr.name)) {
+        return;
+      }
+      seen.add(expr.name);
+      const { relations } = resolveFieldReference(expr.name, mapper);
+      if (!relations || relations.length === 0) {
+        return;
+      }
+      // Every to-ONE relation on the path is a hop that must EXIST — including a TRAILING one,
+      // which is the case a chain of to-many relations never produces. `parent.aBool` resolves
+      // to a single to-one relation, and `NOT { parent: { is: { aBool: true } } }` is TRUE for
+      // a row with no parent at all, so the negation returns rows the PDP denies. A trailing
+      // to-MANY relation is the collection being iterated rather than a hop, and keeps its
+      // empty-collection semantics (`!tags.exists(...)` over zero tags is still TRUE).
+      const last = assertDefined(
+        relations[relations.length - 1],
+        "Relation mapping is missing"
+      );
+      const hopFilter = buildHopsExistFilter(
+        last.type === "one" ? relations : relations.slice(0, -1)
+      );
+      if (hopFilter !== undefined) {
+        hops.push(hopFilter);
+      }
+      return;
+    }
+    if (!isOperatorOperand(expr) || expr.operator === "lambda") {
+      return;
+    }
+    expr.operands.forEach(visit);
+  };
+
+  visit(operand);
+
+  if (hops.length === 0) {
+    return undefined;
+  }
+  return hops.length === 1
+    ? assertDefined(hops[0], "Leading-hops filter is missing")
+    : { AND: hops };
+}
+
+/**
+ * `{ NOT: filter }`, with every to-one hop `operand` dots through required OUTSIDE the
+ * negation so an absent parent stays denied (see buildExpressionHopsExistFilter).
+ */
+function negateRequiringHops(
+  operand: PlanExpressionOperand,
+  filter: PrismaFilter,
+  mapper: Mapper
+): PrismaFilter {
+  const hops = buildExpressionHopsExistFilter(operand, mapper);
+  return hops === undefined ? { NOT: filter } : { AND: [hops, { NOT: filter }] };
+}
+
 function buildNestedRelationFilter(
   relations: RelationConfig[],
   fieldFilter: any
@@ -365,7 +1411,7 @@ function buildNestedRelationFilter(
       }
     }
 
-    currentFilter = { [relation.name]: { [relationOperator]: currentFilter } };
+    currentFilter = relationFilter(relation, relationOperator, currentFilter);
   }
 
   return currentFilter;
@@ -383,6 +1429,9 @@ function resolveOperand(
   } else if (isValueOperand(operand)) {
     return { value: operand.value };
   } else if (isOperatorOperand(operand)) {
+    if (operand.operator === "timestamp") {
+      return resolveTimestampOperand(operand, mapper);
+    }
     const folded = tryFoldValueExpression(operand, mapper);
     if (folded !== null) return { value: folded };
     const nestedResult = buildPrismaFilterFromCerbosExpression(operand, mapper);
@@ -391,11 +1440,39 @@ function resolveOperand(
   throw new Error("Operand must have name, value, or be an expression");
 }
 
+function resolveTimestampOperand(
+  expression: OperatorOperand,
+  mapper: Mapper
+): ResolvedOperand {
+  if (expression.operands.length !== 1) {
+    throw new Error("timestamp() requires exactly one operand");
+  }
+
+  const operand = assertDefined(
+    expression.operands[0],
+    "timestamp() requires an operand"
+  );
+  if (isNamedOperand(operand)) {
+    const fieldRef = resolveFieldReference(operand.name, mapper);
+    if (fieldRef.valueType !== "dateTime") {
+      throw new Error(
+        `timestamp() field ${operand.name} must be mapped with valueType: \"dateTime\"`
+      );
+    }
+    return fieldRef;
+  }
+
+  if (!isValueOperand(operand) || typeof operand.value !== "string") {
+    throw new Error("timestamp() requires a field reference or RFC 3339 string");
+  }
+  return { value: normalizeRfc3339Milliseconds(operand.value) };
+}
+
 function tryFoldValueExpression(
   expr: OperatorOperand,
   mapper: Mapper
 ): Value | null {
-  if (expr.operator !== "add") return null;
+  if (!ARITHMETIC_OPERATORS.has(expr.operator)) return null;
   const leftOp = expr.operands[0];
   const rightOp = expr.operands[1];
   if (!leftOp || !rightOp) return null;
@@ -406,12 +1483,27 @@ function tryFoldValueExpression(
   if (!isResolvedValue(right)) return null;
 
   try {
-    return foldAdd(left.value, right.value);
+    return foldArithmetic(expr.operator, left.value, right.value);
   } catch {
     return null;
   }
 }
 
+/**
+ * Records that the lambda body being built touches a nullable element column, so the
+ * enclosing collection operator can add its three-valued-logic guard.
+ */
+function recordNullableElementField(
+  config: MapperConfig,
+  defaultField: string
+): void {
+  if (!config.nullable) {
+    return;
+  }
+  const scope = lambdaScopes[lambdaScopes.length - 1];
+  scope?.nullableFields.add(config.field || defaultField);
+}
+
 /**
  * Creates a scoped mapper for collection operations
  */
@@ -463,7 +1555,9 @@ function createScopedMapper(
         }
 
         // Return the field config if it exists, otherwise create a default one
-        return currentConfig[field] || { field };
+        const fieldConfig = currentConfig[field] || { field };
+        recordNullableElementField(fieldConfig, field);
+        return fieldConfig;
       }
       return { field: strippedKey };
     }
@@ -516,18 +1610,11 @@ function buildPrismaFilterFromCerbosExpression(
       if (!operand) {
         throw new Error("not operator requires an operand");
       }
-      if (isNamedOperand(operand)) {
-        const { relations, ...fieldRef } = resolveFieldReference(
-          operand.name,
-          mapper
-        );
-        if (!relations || relations.length === 0) {
-          return buildFieldEqualsFilter(fieldRef, false);
-        }
-      }
-      return {
-        NOT: buildPrismaFilterFromCerbosExpression(operand, mapper),
-      };
+      return buildNegatedFilter(operand, mapper);
+    }
+
+    case "if": {
+      return handleBooleanTernaryOperator(operands, mapper);
     }
 
     case "eq":
@@ -549,10 +1636,6 @@ function buildPrismaFilterFromCerbosExpression(
       return handleStringOperator(operator, operands, mapper);
     }
 
-    case "isSet": {
-      return handleIsSetOperator(operands, mapper);
-    }
-
     case "hasIntersection": {
       return handleHasIntersectionOperator(operands, mapper);
     }
@@ -590,6 +1673,493 @@ function buildPrismaFilterFromCerbosExpression(
   }
 }
 
+function containsCollectionOperator(expr: PlanExpressionOperand): boolean {
+  if (!isOperatorOperand(expr)) {
+    return false;
+  }
+  if (COLLECTION_OPERATORS.has(expr.operator)) {
+    return true;
+  }
+  return expr.operands.some(containsCollectionOperator);
+}
+
+/**
+ * Whether `expr` dots through at least one intermediate to-one hop, so negating it needs the
+ * hop requirement of buildExpressionHopsExistFilter.
+ */
+function referencesChainedRelation(
+  expr: PlanExpressionOperand,
+  mapper: Mapper
+): boolean {
+  if (isNamedOperand(expr)) {
+    const { relations } = resolveFieldReference(expr.name, mapper);
+    return relations !== undefined && relations.length > 1;
+  }
+  if (!isOperatorOperand(expr) || expr.operator === "lambda") {
+    return false;
+  }
+  return expr.operands.some((operand) =>
+    referencesChainedRelation(operand, mapper)
+  );
+}
+
+/**
+ * Builds the filter for `!expr`. Plain field predicates negate correctly with Prisma's NOT
+ * (SQL three-valued logic keeps NULL rows excluded under both polarities), but relation
+ * subqueries collapse UNKNOWN to false at the EXISTS boundary, so `NOT(some(P))` would
+ * wrongly include rows whose elements make P UNKNOWN (a NULL element column is a missing
+ * attribute — a CEL error — on the check side, which Cerbos treats as deny). Negation is
+ * therefore pushed down to the collection operators, which encode CEL's exact error
+ * semantics:
+ *
+ * - exists(c,P) is TRUE with a true witness, FALSE if every element is definitively false,
+ *   and an ERROR otherwise — so `!exists` admits only rows with no P-match AND no
+ *   UNKNOWN-element (the nullable-field guard).
+ * - all(c,P) is FALSE only with a definitive false witness (a false witness absorbs error
+ *   elements) — so `!all` is `some(NOT P)`, which SQL already evaluates definitively.
+ */
+function buildNegatedFilter(
+  operand: PlanExpressionOperand,
+  mapper: Mapper
+): PrismaFilter {
+  if (isNamedOperand(operand)) {
+    const { relations, ...fieldRef } = resolveFieldReference(
+      operand.name,
+      mapper
+    );
+    if (!relations || relations.length === 0) {
+      return buildFieldEqualsFilter(fieldRef, false);
+    }
+    return negateRequiringHops(
+      operand,
+      buildPrismaFilterFromCerbosExpression(operand, mapper),
+      mapper
+    );
+  }
+
+  // `and`/`or` must be pushed through with De Morgan whenever a branch can be UNKNOWN, so
+  // CEL's error absorption survives: `!(A && B)` with A erroring and B false is TRUE in CEL,
+  // and `OR[!A, !B]` reproduces that where a single outer NOT over the conjunction — with the
+  // hop requirement ANDed outside it — would deny. A chained relation is the second source of
+  // UNKNOWN besides the collection macros, so it opens the same push-down.
+  if (
+    isOperatorOperand(operand) &&
+    (containsCollectionOperator(operand) ||
+      referencesChainedRelation(operand, mapper))
+  ) {
+    switch (operand.operator) {
+      case "and":
+        return {
+          OR: operand.operands.map((o) => buildNegatedFilter(o, mapper)),
+        };
+      case "or":
+        return {
+          AND: operand.operands.map((o) => buildNegatedFilter(o, mapper)),
+        };
+      case "not":
+        return buildPrismaFilterFromCerbosExpression(
+          assertDefined(
+            operand.operands[0],
+            "not operator requires an operand"
+          ),
+          mapper
+        );
+      case "exists":
+      case "all":
+      case "except":
+      case "exists_one":
+      case "filter":
+        return buildNegatedCollectionFilter(
+          operand.operator,
+          operand.operands,
+          mapper
+        );
+    }
+  }
+
+  return negateRequiringHops(
+    operand,
+    buildPrismaFilterFromCerbosExpression(operand, mapper),
+    mapper
+  );
+}
+
+function getTernaryOperands(operands: PlanExpressionOperand[]): {
+  condition: PlanExpressionOperand;
+  thenBranch: PlanExpressionOperand;
+  elseBranch: PlanExpressionOperand;
+} {
+  if (operands.length !== 3) {
+    throw new Error(
+      `if (ternary) requires exactly 3 operands (condition, then, else), got ${operands.length}`
+    );
+  }
+
+  return {
+    condition: assertDefined(
+      operands[0],
+      "if (ternary) requires a condition operand"
+    ),
+    thenBranch: assertDefined(
+      operands[1],
+      "if (ternary) requires a then operand"
+    ),
+    elseBranch: assertDefined(
+      operands[2],
+      "if (ternary) requires an else operand"
+    ),
+  };
+}
+
+function getConstantBooleanCondition(
+  condition: PlanExpressionOperand
+): boolean | undefined {
+  if (!isValueOperand(condition)) {
+    return undefined;
+  }
+  if (typeof condition.value !== "boolean") {
+    throw new Error("if (ternary) condition must be a boolean expression");
+  }
+  return condition.value;
+}
+
+function buildBooleanBranchFilter(
+  branch: PlanExpressionOperand,
+  mapper: Mapper
+): TernaryBranchPredicate {
+  if (!isValueOperand(branch)) {
+    return {
+      kind: "filter",
+      filter: buildPrismaFilterFromCerbosExpression(branch, mapper),
+    };
+  }
+  if (typeof branch.value !== "boolean") {
+    throw new Error(
+      "if (ternary) branch in boolean position must be a boolean"
+    );
+  }
+  return { kind: "constant", value: branch.value };
+}
+
+/**
+ * "The ternary's condition is definitively FALSE", which is exactly buildNegatedFilter's
+ * contract — three-valued, so a condition that is UNKNOWN (a NULL column, an erroring lambda
+ * body, an absent to-one parent) selects NEITHER branch.
+ *
+ * It delegates rather than spelling a second negation. A private copy is how the ternary
+ * missed the hop requirement #315/#316 added: a bare `NOT` over a chain filter is TRUE when
+ * the to-one parent is absent, so the else-branch was selected for rows CEL denies outright —
+ * the missing path is an evaluation error, not a false condition
+ * (cerbos/query-plan-adapters#334). Delegating also gives the ternary the De Morgan push-down,
+ * which a chained `and`/`or` condition needs for CEL's error absorption to survive.
+ */
+function buildFalseConditionFilter(
+  condition: PlanExpressionOperand,
+  mapper: Mapper
+): PrismaFilter {
+  if (isValueOperand(condition)) {
+    throw new Error("Constant ternary conditions must be folded before use");
+  }
+
+  return buildNegatedFilter(condition, mapper);
+}
+
+function buildGuardedTernaryFilter({
+  condition,
+  thenFilter,
+  elseFilter,
+  mapper,
+}: {
+  condition: PlanExpressionOperand;
+  thenFilter: TernaryBranchPredicate;
+  elseFilter: TernaryBranchPredicate;
+  mapper: Mapper;
+}): PrismaFilter {
+  const conditionTrue = buildPrismaFilterFromCerbosExpression(
+    condition,
+    mapper
+  );
+  const conditionFalse = buildFalseConditionFilter(condition, mapper);
+  const guardedBranches: PrismaFilter[] = [];
+
+  if (thenFilter.kind === "filter") {
+    guardedBranches.push({ AND: [conditionTrue, thenFilter.filter] });
+  } else if (thenFilter.value) {
+    guardedBranches.push(conditionTrue);
+  }
+
+  if (elseFilter.kind === "filter") {
+    guardedBranches.push({ AND: [conditionFalse, elseFilter.filter] });
+  } else if (elseFilter.value) {
+    guardedBranches.push(conditionFalse);
+  }
+
+  // For a known condition this contradiction is false. If the condition is
+  // NULL/error-derived, both sides are SQL UNKNOWN, which keeps the whole
+  // ternary UNKNOWN under an outer NOT instead of authorizing the row.
+  guardedBranches.push({ AND: [conditionTrue, conditionFalse] });
+
+  return {
+    OR: guardedBranches,
+  };
+}
+
+function finalizeTernaryBranchPredicate(
+  predicate: TernaryBranchPredicate
+): PrismaFilter {
+  if (predicate.kind === "filter") {
+    return predicate.filter;
+  }
+  if (predicate.value) {
+    return buildAlwaysTrueFilter();
+  }
+  // Prisma has no model-agnostic always-false `where` shape: empty logical
+  // arrays are ignored. Real PDP plans fold this case to ALWAYS_DENIED.
+  throw new Error(
+    "A constant-false conditional predicate must be folded by the Cerbos planner"
+  );
+}
+
+function handleBooleanTernaryOperator(
+  operands: PlanExpressionOperand[],
+  mapper: Mapper
+): PrismaFilter {
+  const { condition, thenBranch, elseBranch } = getTernaryOperands(operands);
+  const constantCondition = getConstantBooleanCondition(condition);
+  if (constantCondition !== undefined) {
+    return finalizeTernaryBranchPredicate(
+      buildBooleanBranchFilter(
+        constantCondition ? thenBranch : elseBranch,
+        mapper
+      )
+    );
+  }
+
+  return buildGuardedTernaryFilter({
+    condition,
+    thenFilter: buildBooleanBranchFilter(thenBranch, mapper),
+    elseFilter: buildBooleanBranchFilter(elseBranch, mapper),
+    mapper,
+  });
+}
+
+function buildTernaryComparisonBranch({
+  operator,
+  operands,
+  ternaryIndex,
+  branch,
+  mapper,
+}: {
+  operator: string;
+  operands: PlanExpressionOperand[];
+  ternaryIndex: number;
+  branch: PlanExpressionOperand;
+  mapper: Mapper;
+}): TernaryBranchPredicate {
+  const substitutedOperands = operands.map((operand, index) =>
+    index === ternaryIndex ? branch : operand
+  );
+  assertDefined(substitutedOperands[0], `${operator} requires a left operand`);
+  assertDefined(substitutedOperands[1], `${operator} requires a right operand`);
+
+  const normalized = normalizeBinaryOperands(operator, substitutedOperands);
+
+  const normalizedFirst = normalized.operands[0];
+  const normalizedSecond = normalized.operands[1];
+  if (
+    normalized.operands.length === 2 &&
+    normalizedFirst !== undefined &&
+    normalizedSecond !== undefined &&
+    isValueOperand(normalizedFirst) &&
+    isValueOperand(normalizedSecond)
+  ) {
+    return {
+      kind: "constant",
+      value: evaluateConstantComparison(
+        normalized.operator,
+        normalizedFirst.value,
+        normalizedSecond.value
+      ),
+    };
+  }
+
+  return {
+    kind: "filter",
+    filter: buildPrismaFilterFromCerbosExpression(normalized, mapper),
+  };
+}
+
+function tryHandleTernaryComparison(
+  operator: string,
+  operands: PlanExpressionOperand[],
+  mapper: Mapper
+): PrismaFilter | null {
+  if (CERBOS_TO_PRISMA_OPERATOR[operator] === undefined) {
+    return null;
+  }
+
+  const ternaryIndex = operands.findIndex(
+    (operand) => isOperatorOperand(operand) && operand.operator === "if"
+  );
+  if (ternaryIndex === -1) {
+    return null;
+  }
+  if (operands.length !== 2) {
+    throw new Error(
+      `${operator} with a ternary requires exactly 2 operands, got ${operands.length}`
+    );
+  }
+
+  const ternary = assertDefined(
+    operands[ternaryIndex],
+    "Ternary comparison operand is missing"
+  );
+  if (!isOperatorOperand(ternary)) {
+    throw new Error("Ternary comparison operand must be an expression");
+  }
+
+  const { condition, thenBranch, elseBranch } = getTernaryOperands(
+    ternary.operands
+  );
+  const constantCondition = getConstantBooleanCondition(condition);
+  if (constantCondition !== undefined) {
+    return finalizeTernaryBranchPredicate(
+      buildTernaryComparisonBranch({
+        operator,
+        operands,
+        ternaryIndex,
+        branch: constantCondition ? thenBranch : elseBranch,
+        mapper,
+      })
+    );
+  }
+
+  return buildGuardedTernaryFilter({
+    condition,
+    thenFilter: buildTernaryComparisonBranch({
+      operator,
+      operands,
+      ternaryIndex,
+      branch: thenBranch,
+      mapper,
+    }),
+    elseFilter: buildTernaryComparisonBranch({
+      operator,
+      operands,
+      ternaryIndex,
+      branch: elseBranch,
+      mapper,
+    }),
+    mapper,
+  });
+}
+
+function evaluateConstantComparison(
+  operator: string,
+  left: Value,
+  right: Value
+): boolean {
+  switch (operator) {
+    case "eq":
+      return areValuesEqual(left, right);
+    case "ne":
+      return !areValuesEqual(left, right);
+    case "lt":
+    case "le":
+    case "gt":
+    case "ge": {
+      if (
+        typeof left === "number" &&
+        typeof right === "number" &&
+        (Number.isNaN(left) || Number.isNaN(right))
+      ) {
+        return false;
+      }
+      if (
+        !(
+          (typeof left === "number" && typeof right === "number") ||
+          (typeof left === "string" && typeof right === "string")
+        )
+      ) {
+        throw new Error(
+          `${operator} constant comparison requires two numbers or two strings`
+        );
+      }
+      switch (operator) {
+        case "lt":
+          return compareConstantValues(left, right) < 0;
+        case "le":
+          return compareConstantValues(left, right) <= 0;
+        case "gt":
+          return compareConstantValues(left, right) > 0;
+        case "ge":
+          return compareConstantValues(left, right) >= 0;
+      }
+    }
+  }
+
+  throw new Error(`Unsupported constant comparison operator: ${operator}`);
+}
+
+function compareConstantValues(left: number | string, right: number | string) {
+  if (typeof left === "number" && typeof right === "number") {
+    return left === right ? 0 : left < right ? -1 : 1;
+  }
+  if (typeof left !== "string" || typeof right !== "string") {
+    throw new Error("Cannot order constant values of different types");
+  }
+
+  const leftCodePoints = Array.from(left, (character) =>
+    character.codePointAt(0)
+  );
+  const rightCodePoints = Array.from(right, (character) =>
+    character.codePointAt(0)
+  );
+  const sharedLength = Math.min(leftCodePoints.length, rightCodePoints.length);
+  for (let index = 0; index < sharedLength; index++) {
+    const leftCodePoint = leftCodePoints[index]!;
+    const rightCodePoint = rightCodePoints[index]!;
+    if (leftCodePoint !== rightCodePoint) {
+      return leftCodePoint < rightCodePoint ? -1 : 1;
+    }
+  }
+  return leftCodePoints.length === rightCodePoints.length
+    ? 0
+    : leftCodePoints.length < rightCodePoints.length
+      ? -1
+      : 1;
+}
+
+function areValuesEqual(left: Value, right: Value): boolean {
+  if (Array.isArray(left)) {
+    return (
+      Array.isArray(right) &&
+      left.length === right.length &&
+      left.every((value, index) => areValuesEqual(value, right[index]!))
+    );
+  }
+
+  if (Array.isArray(right)) {
+    return false;
+  }
+
+  if (typeof left === "object" && left !== null) {
+    if (typeof right !== "object" || right === null) {
+      return false;
+    }
+    const leftKeys = Object.keys(left);
+    const rightKeys = Object.keys(right);
+    return (
+      leftKeys.length === rightKeys.length &&
+      leftKeys.every(
+        (key) => key in right && areValuesEqual(left[key]!, right[key]!)
+      )
+    );
+  }
+
+  return left === right;
+}
+
 function handleSizeComparison(
   operator: string,
   sizeOperand: OperatorOperand,
@@ -635,7 +2205,7 @@ function handleSizeComparison(
   }
 
   const prismaOp = isNonEmpty ? "some" : "none";
-  const leafFilter = { [deepest.name]: { [prismaOp]: {} } };
+  const leafFilter = relationFilter(deepest, prismaOp, {});
 
   if (relations.length === 1) {
     return leafFilter;
@@ -652,6 +2222,16 @@ function handleRelationalOperator(
   operands: PlanExpressionOperand[],
   mapper: Mapper
 ): PrismaFilter {
+  const ternaryFilter = tryHandleTernaryComparison(
+    operator,
+    operands,
+    mapper
+  );
+  if (ternaryFilter) {
+    return ternaryFilter;
+  }
+
+  ({ operator, operands } = normalizeBinaryOperands(operator, operands));
   const prismaOperator = CERBOS_TO_PRISMA_OPERATOR[operator];
 
   if (!prismaOperator) {
@@ -661,36 +2241,293 @@ function handleRelationalOperator(
   const leftOperand = operands.find(
     (o) => isNamedOperand(o) || isOperatorOperand(o)
   );
-  if (!leftOperand) throw new Error("No valid left operand found");
+  if (!leftOperand) throw new Error("No valid left operand found");
+
+  const rightOperand = operands.find((o) => o !== leftOperand);
+  if (!rightOperand) throw new Error("No valid right operand found");
+
+  if (isOperatorOperand(leftOperand) && leftOperand.operator === "size") {
+    return handleSizeComparison(operator, leftOperand, rightOperand, mapper);
+  }
+
+  const arithOperand = [leftOperand, rightOperand].find(
+    (o): o is OperatorOperand =>
+      isOperatorOperand(o) && ARITHMETIC_OPERATORS.has(o.operator)
+  );
+  if (arithOperand) {
+    const otherOperand =
+      arithOperand === leftOperand ? rightOperand : leftOperand;
+    return handleArithmeticComparison(
+      operator,
+      arithOperand,
+      otherOperand,
+      arithOperand === leftOperand,
+      mapper
+    );
+  }
+
+  const mapOperand = [leftOperand, rightOperand].find(
+    (o): o is OperatorOperand =>
+      isOperatorOperand(o) && o.operator === "map"
+  );
+  if (mapOperand) {
+    throw new Error(
+      `Direct comparison of map(...) to a value is not supported (operator: ${operator}). ` +
+        `Wrap the map() expression in hasIntersection(map(...), [...]) instead.`
+    );
+  }
+
+  const left = resolveOperand(leftOperand, mapper);
+  const right = resolveOperand(rightOperand, mapper);
+
+  if (isResolvedFieldReference(left) && isResolvedFieldReference(right)) {
+    return buildFieldToFieldFilter(
+      operator,
+      leftOperand,
+      left,
+      rightOperand,
+      right
+    );
+  }
+
+  if (isResolvedValue(left) && isResolvedFieldReference(right)) {
+    return buildComparisonFilter(
+      right,
+      MIRRORED_OPERATOR[operator] ?? operator,
+      left.value
+    );
+  }
+
+  if (isResolvedValue(left) && isResolvedValue(right)) {
+    const matches = evaluateConstantComparison(
+      operator,
+      left.value,
+      right.value
+    );
+    if (matches) {
+      return buildAlwaysTrueFilter();
+    }
+    throw new Error(
+      "A constant-false conditional predicate must be folded by the Cerbos planner"
+    );
+  }
+
+  const rightValue = requireResolvedValue(
+    right,
+    "Right operand must be a value"
+  );
+
+  if (isResolvedFieldReference(left)) {
+    return buildComparisonFilter(left, operator, rightValue.value);
+  }
+
+  return { [prismaOperator]: rightValue.value };
+}
+
+/**
+ * Builds a field-vs-constant comparison. Fractional constants against ordering (and
+ * equality) operators are emitted as a two-clause bracket because Prisma coerces filter
+ * values to the column's type: on an Int column, `gte: 1.5` is silently bound as `gte: 1`,
+ * inverting rows like aNumber == 1. Each bracket pairs the exact constant with its integer
+ * neighbor so the combination is correct BOTH for Float columns (the extra clause is
+ * redundant) and Int columns (whichever way Prisma truncates or floors the fraction).
+ */
+function buildComparisonFilter(
+  fieldRef: ResolvedFieldReference,
+  operator: string,
+  value: Value
+): PrismaFilter {
+  const prismaOperator = assertDefined(
+    CERBOS_TO_PRISMA_OPERATOR[operator],
+    `Unsupported operator: ${operator}`
+  );
+
+  if (value === null) {
+    assertNullOperandTranslatable(
+      `\`${operator}\` against a null operand`,
+      fieldRef.nullAttributeRepresentation
+    );
+  }
+
+  // An attribute the caller sends as an explicit null holds a null VALUE in CEL, so equality
+  // against a non-null operand is a definite FALSE and inequality a definite TRUE. Prisma leans
+  // on SQL's UNKNOWN for both, which drops the row under either polarity, so the presence of the
+  // column has to become part of the predicate. Confined to the equality family: an ordering
+  // comparison against a null receiver is a no-overload error in CEL, which denies exactly as the
+  // dropped row does.
+  if (value !== null && isExplicitNullReference(fieldRef)) {
+    const fieldName = getLeafField(fieldRef.path);
+    if (operator === "eq") {
+      return guardedFieldFilter(fieldRef, { [fieldName]: { equals: value } });
+    }
+    if (operator === "ne") {
+      return {
+        NOT: guardedFieldFilter(fieldRef, { [fieldName]: { equals: value } }),
+      };
+    }
+  }
+
+  if (typeof value === "number" && !Number.isInteger(value)) {
+    const fieldName = getLeafField(fieldRef.path);
+    const lower = Math.floor(value);
+    const upper = Math.ceil(value);
+    const equalsBracket = {
+      AND: [
+        { [fieldName]: { equals: value } },
+        { [fieldName]: { gt: lower } },
+        { [fieldName]: { lt: upper } },
+      ],
+    };
+    let bracket: PrismaFilter | undefined;
+    switch (operator) {
+      case "gt":
+        bracket = {
+          OR: [{ [fieldName]: { gt: value } }, { [fieldName]: { gte: upper } }],
+        };
+        break;
+      case "ge":
+        bracket = {
+          AND: [{ [fieldName]: { gte: value } }, { [fieldName]: { gt: lower } }],
+        };
+        break;
+      case "lt":
+        bracket = {
+          OR: [{ [fieldName]: { lt: value } }, { [fieldName]: { lte: lower } }],
+        };
+        break;
+      case "le":
+        bracket = {
+          AND: [{ [fieldName]: { lte: value } }, { [fieldName]: { lt: upper } }],
+        };
+        break;
+      case "eq":
+        bracket = equalsBracket;
+        break;
+      case "ne":
+        bracket = { NOT: equalsBracket };
+        break;
+    }
+    if (bracket) {
+      return wrapRelations(fieldRef.relations, bracket);
+    }
+  }
+
+  return buildFieldFilter(fieldRef, prismaOperator, value);
+}
+
+/**
+ * Builds a column-vs-column comparison as a Prisma field reference. Prisma only supports
+ * references between fields of the SAME model, so the container is the root model for
+ * root-level comparisons and the relation's model inside a lambda; mixed-scope comparisons
+ * (an element column against an outer column) are cross-model and must fail loudly.
+ */
+function buildFieldToFieldFilter(
+  operator: string,
+  leftOperand: PlanExpressionOperand,
+  left: ResolvedFieldReference,
+  rightOperand: PlanExpressionOperand,
+  right: ResolvedFieldReference
+): PrismaFilter {
+  const prismaOperator = assertDefined(
+    CERBOS_TO_PRISMA_OPERATOR[operator],
+    `Unsupported operator: ${operator}`
+  );
 
-  const rightOperand = operands.find((o) => o !== leftOperand);
-  if (!rightOperand) throw new Error("No valid right operand found");
+  if (!isNamedOperand(leftOperand) || !isNamedOperand(rightOperand)) {
+    throw new Error("Field-to-field comparison requires two named operands");
+  }
 
-  if (isOperatorOperand(leftOperand) && leftOperand.operator === "size") {
-    return handleSizeComparison(operator, leftOperand, rightOperand, mapper);
+  const scope = lambdaScopes[lambdaScopes.length - 1];
+  let container: string | undefined;
+
+  if (scope) {
+    const prefix = scope.variableName + ".";
+    const leftInScope = leftOperand.name.startsWith(prefix);
+    const rightInScope = rightOperand.name.startsWith(prefix);
+    if (leftInScope !== rightInScope) {
+      throw new Error(
+        `Cannot compare a collection element column with an outer column (${leftOperand.name} vs ${rightOperand.name}): ` +
+          "Prisma field references only work between fields of the same model"
+      );
+    }
+    if (leftInScope) {
+      container = scope.relationModel;
+      if (!container) {
+        throw new Error(
+          "Field-to-field comparison inside a collection requires `relation.model` in the mapper"
+        );
+      }
+    }
   }
 
-  const addOperand = [leftOperand, rightOperand].find(
-    (o): o is OperatorOperand =>
-      isOperatorOperand(o) && o.operator === "add"
-  );
-  if (addOperand) {
-    const otherOperand =
-      addOperand === leftOperand ? rightOperand : leftOperand;
-    return handleAddComparison(operator, addOperand, otherOperand, mapper);
+  if (container === undefined) {
+    if (
+      (left.relations && left.relations.length > 0) ||
+      (right.relations && right.relations.length > 0)
+    ) {
+      throw new Error(
+        "Cannot compare columns across relations: Prisma field references only work between fields of the same model"
+      );
+    }
+    container = rootModelName;
+    if (!container) {
+      throw new Error(
+        "Field-to-field comparison requires the `model` option (the Prisma model name) to build a field reference"
+      );
+    }
   }
 
-  const left = resolveOperand(leftOperand, mapper);
-  const right = requireResolvedValue(
-    resolveOperand(rightOperand, mapper),
-    "Right operand must be a value"
-  );
+  const leftField = getLeafField(left.path);
+  const rightField = getLeafField(right.path);
+  const fieldReference = { _ref: rightField, _container: container };
+
+  // Two explicit nulls are EQUAL in CEL, and a null against a value is definitely NOT equal.
+  // A bare field reference gives UNKNOWN for both, which drops the row under either polarity.
+  const leftExplicit = isExplicitNullReference(left);
+  const rightExplicit = isExplicitNullReference(right);
+  // Mixing the two conventions across one comparison has no faithful rendering. The declared side
+  // needs a definite answer for its NULL (CEL holds a null VALUE); the undeclared side needs
+  // UNKNOWN for its NULL (a missing attribute, which CEL denies under both polarities). A definite
+  // predicate returns rows the PDP refuses; a plain one drops rows the PDP allows. Refuse it
+  // rather than pick a direction — declare both attributes, or neither.
+  if (leftExplicit !== rightExplicit && (operator === "eq" || operator === "ne")) {
+    throw new Error(
+      `Cannot translate \`${operator}\` between two columns under mixed null conventions: ` +
+        "cannot compare an attribute declared explicit-null with one on the omitted convention: the omitted side is UNKNOWN for a NULL column while the declared side is definite, and no single predicate is both. Declare nullAttributeRepresentation on both mapper entries, or on neither."
+    );
+  }
+  if (leftExplicit && rightExplicit && (operator === "eq" || operator === "ne")) {
+    const present: PrismaFilter[] = [];
+    if (leftExplicit) {
+      present.push({ [leftField]: { not: null } });
+    }
+    if (rightExplicit) {
+      present.push({ [rightField]: { not: null } });
+    }
+    const equality: PrismaFilter =
+      leftExplicit && rightExplicit
+        ? {
+            OR: [
+              { AND: [{ [leftField]: null }, { [rightField]: null }] },
+              { AND: [...present, { [leftField]: { equals: fieldReference } }] },
+            ],
+          }
+        : { AND: [...present, { [leftField]: { equals: fieldReference } }] };
+    return operator === "eq" ? equality : { NOT: equality };
+  }
 
-  if (isResolvedFieldReference(left)) {
-    return buildFieldFilter(left, prismaOperator, right.value);
+  // `ne` is the one operator whose Prisma spelling cannot carry a field reference: `not` nests a
+  // NestedStringFilter, which has no `_ref` form, so `{ col: { not: { _ref } } }` is rejected by
+  // the client rather than executed. Hoisting the negation to the top-level `NOT` combinator says
+  // the same thing with a shape that does accept one — the same rewrite the explicit-null branch
+  // above already performs. Three-valued logic is unchanged by the hoist: a NULL on either side
+  // makes the inner equality UNKNOWN, and `NOT UNKNOWN` is still UNKNOWN, so the row stays out
+  // under both polarities, which is what a missing attribute does on the check side.
+  if (operator === "ne") {
+    return { NOT: { [leftField]: { equals: fieldReference } } };
   }
 
-  return { [prismaOperator]: right.value };
+  return { [leftField]: { [prismaOperator]: fieldReference } };
 }
 
 /**
@@ -700,70 +2537,145 @@ function handleInOperator(
   operands: PlanExpressionOperand[],
   mapper: Mapper
 ): PrismaFilter {
-  const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-  const valueOperand = getValueOperand(operands, "Value operand is undefined");
-  const fieldRef = requireResolvedFieldReference(
-    resolveOperand(nameOperand, mapper),
-    "Name operand must resolve to a field reference"
+  if (operands.length !== 2) {
+    throw new Error("in requires exactly two operands");
+  }
+  const member = assertDefined(operands[0], "in requires a member operand");
+  const collection = assertDefined(
+    operands[1],
+    "in requires a collection operand"
   );
-  const { value } = requireResolvedValue(
-    resolveOperand(valueOperand, mapper),
-    "Value operand must resolve to a value"
+
+  if (isNamedOperand(member) && isValueOperand(collection)) {
+    const fieldRef = resolveFieldReference(member.name, mapper);
+    const values = Array.isArray(collection.value)
+      ? collection.value
+      : [collection.value];
+    return buildMembershipFilter(fieldRef, values);
+  }
+
+  if (isValueOperand(member) && isNamedOperand(collection)) {
+    return buildMembershipFilter(
+      resolveFieldReference(collection.name, mapper),
+      [member.value]
+    );
+  }
+
+  if (isNamedOperand(member) && isNamedOperand(collection)) {
+    throw new Error(
+      "Membership between two database attributes is not supported: Prisma cannot compare a related element column with an outer scalar column"
+    );
+  }
+
+  throw new Error(
+    "in requires a field member and literal list, or a literal member and field collection"
   );
-  const values = Array.isArray(value) ? value : [value];
-  return buildFieldDirectOrInFilter(fieldRef, values);
 }
 
+// Upper bound on the IN-list produced when enumerating a constant receiver's substrings.
+const MAX_ENUMERATED_NEEDLES = 1000;
+
 /**
- * Helper function to handle string operators (contains, startsWith, endsWith)
+ * Helper function to handle string operators (contains, startsWith, endsWith).
+ *
+ * These operators are receiver-sensitive and the planner preserves policy source order:
+ * operand 0 is the receiver (haystack), operand 1 the needle. Swapping them silently
+ * inverts the match direction, so unlike symmetric comparisons they are never normalized.
  */
 function handleStringOperator(
   operator: string,
   operands: PlanExpressionOperand[],
   mapper: Mapper
 ): PrismaFilter {
-  const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-  const valueOperand = getValueOperand(operands, "Value operand is undefined");
-  const fieldRef = requireResolvedFieldReference(
-    resolveOperand(nameOperand, mapper),
-    "Name operand must resolve to a field reference"
+  if (operands.length !== 2) {
+    throw new Error(`${operator} requires exactly two operands`);
+  }
+  const receiver = resolveOperand(
+    assertDefined(operands[0], `${operator} requires a receiver operand`),
+    mapper
   );
-  const { value } = requireResolvedValue(
-    resolveOperand(valueOperand, mapper),
-    "Value operand must resolve to a value"
+  const needle = resolveOperand(
+    assertDefined(operands[1], `${operator} requires a needle operand`),
+    mapper
   );
-  if (typeof value !== "string") {
-    throw new Error(`${operator} operator requires string value`);
+
+  // Column receiver, constant needle: Prisma's LIKE-based filter.
+  if (isResolvedFieldReference(receiver) && isResolvedValue(needle)) {
+    const { value } = needle;
+    if (typeof value !== "string") {
+      throw new Error(`${operator} operator requires string value`);
+    }
+    // Prisma emits LIKE without an ESCAPE clause and does not escape wildcard characters,
+    // so a needle containing % or _ would match as a pattern instead of literally (e.g.
+    // startsWith("100%") wrongly matches "100xdone"). Fail loudly rather than filter wrong.
+    //
+    // A backslash is the same hazard reached from the other direction, and only an executed
+    // PostgreSQL leg surfaces it (cerbos/query-plan-adapters#320): SQLite's LIKE has no escape
+    // character at all, so `\` is literal there, while PostgreSQL and MySQL treat it as the
+    // DEFAULT escape character even with no ESCAPE clause. `endsWith("\\")` is then a pattern
+    // ending in an escape character — a hard error on PostgreSQL — and a `\x` anywhere inside
+    // silently drops the backslash, so `contains("a\\b")` matches "ab", a row the PDP denies.
+    if (/[%_\\]/.test(value)) {
+      throw new Error(
+        `Cannot translate ${operator} with a needle containing LIKE metacharacters (%, _ or \\): ` +
+          "Prisma does not escape wildcards in string filters, and \\ is the default LIKE " +
+          "escape character on PostgreSQL and MySQL"
+      );
+    }
+    const fieldName = getLeafField(receiver.path);
+    return wrapRelations(receiver.relations, {
+      [fieldName]: { [operator]: value },
+    });
   }
 
-  const fieldName = getLeafField(fieldRef.path);
-  return wrapRelations(fieldRef.relations, {
-    [fieldName]: { [operator]: value },
-  });
-}
+  // Constant receiver, column needle (e.g. `"a-b-c".contains(R.attr.x)`): enumerate every
+  // candidate needle the constant admits — prefixes for startsWith, suffixes for endsWith,
+  // substrings for contains — into an exact IN filter. No LIKE, so no escaping hazards; a
+  // NULL needle column stays excluded (CEL missing-attribute deny).
+  if (isResolvedValue(receiver) && isResolvedFieldReference(needle)) {
+    if (typeof receiver.value !== "string") {
+      throw new Error(`${operator} operator requires a string receiver`);
+    }
+    const haystack = receiver.value;
+    const candidates = new Set<string>([""]);
+    if (operator === "startsWith") {
+      for (let i = 1; i <= haystack.length; i++) {
+        candidates.add(haystack.slice(0, i));
+      }
+    } else if (operator === "endsWith") {
+      for (let i = 0; i < haystack.length; i++) {
+        candidates.add(haystack.slice(i));
+      }
+    } else {
+      for (let start = 0; start < haystack.length; start++) {
+        for (let end = start + 1; end <= haystack.length; end++) {
+          candidates.add(haystack.slice(start, end));
+        }
+      }
+    }
+    if (candidates.size > MAX_ENUMERATED_NEEDLES) {
+      throw new Error(
+        `Cannot translate ${operator} with a constant receiver of this length: ` +
+          `enumerating its ${candidates.size} candidate needles exceeds the ${MAX_ENUMERATED_NEEDLES}-entry limit`
+      );
+    }
+    const fieldName = getLeafField(needle.path);
+    return wrapRelations(needle.relations, {
+      [fieldName]: { in: [...candidates] },
+    });
+  }
 
-/**
- * Helper function to handle "isSet" operator
- */
-function handleIsSetOperator(
-  operands: PlanExpressionOperand[],
-  mapper: Mapper
-): PrismaFilter {
-  const nameOperand = getNamedOperand(operands, "Name operand is undefined");
-  const valueOperand = getValueOperand(operands, "Value operand is undefined");
-  const fieldRef = requireResolvedFieldReference(
-    resolveOperand(nameOperand, mapper),
-    "Name operand must resolve to a field reference"
-  );
-  const resolvedValue = requireResolvedValue(
-    resolveOperand(valueOperand, mapper),
-    "Value operand must resolve to a value"
-  );
+  if (isResolvedFieldReference(receiver) && isResolvedFieldReference(needle)) {
+    // A column-valued needle would need its LIKE metacharacters escaped per row, which
+    // Prisma's filters cannot do (and Prisma leaks wildcards from field references).
+    throw new Error(
+      `Cannot translate ${operator} between two columns: Prisma cannot escape LIKE wildcards held in a column`
+    );
+  }
 
-  const fieldName = getLeafField(fieldRef.path);
-  return wrapRelations(fieldRef.relations, {
-    [fieldName]: resolvedValue.value ? { not: null } : { equals: null },
-  });
+  throw new Error(
+    `${operator} between two constants must be folded by the Cerbos planner`
+  );
 }
 
 /**
@@ -777,6 +2689,11 @@ function handleHasIntersectionOperator(
     throw new Error("hasIntersection requires exactly two operands");
   }
 
+  // Intersection is symmetric, and the planner preserves policy source order — e.g.
+  // `hasIntersection(["a"], R.attr.tags)` puts the constant list FIRST. Normalize to
+  // field/map-first (see #256).
+  ({ operands } = normalizeBinaryOperands("hasIntersection", operands));
+
   const leftOperand = assertDefined(
     operands[0],
     "hasIntersection requires a left operand"
@@ -838,13 +2755,42 @@ function handleHasIntersectionOperator(
       throw new Error("Invalid map lambda expression structure");
     }
 
-    // Use scoped mapper for resolving the projection
-    const resolved = resolveFieldReference(projection.name, scopedMapper);
+    // Use scoped mapper for resolving the projection, collecting nullable element columns.
+    const scope: LambdaScope = {
+      variableName: variable.name,
+      relationModel: relations[relations.length - 1]?.model,
+      nullableFields: new Set(),
+      unknownFilters: [],
+    };
+    lambdaScopes.push(scope);
+    let resolved: ResolvedFieldReference;
+    try {
+      resolved = resolveFieldReference(projection.name, scopedMapper);
+    } finally {
+      lambdaScopes.pop();
+    }
     const fieldName = getLeafField(resolved.path);
 
-    return buildNestedRelationFilter(relations, {
+    const base = buildNestedRelationFilter(relations, {
       [fieldName]: { in: rightOperand.value },
     });
+    if (scope.nullableFields.size === 0) {
+      return base;
+    }
+    // CEL map() errors if ANY element is missing the projected attribute — even alongside a
+    // matching element — and Cerbos treats that error as deny. Exclude rows holding an
+    // element whose projected (nullable) column is NULL.
+    return {
+      AND: [
+        base,
+        {
+          NOT: buildNestedRelationFilter(
+            relations,
+            buildNullWitnessFilter(scope.nullableFields)
+          ),
+        },
+      ],
+    };
   }
 
   // Handle regular field reference
@@ -865,11 +2811,7 @@ function handleHasIntersectionOperator(
   }
 
   if (relations && relations.length > 0) {
-    const fieldName = getLeafField(path);
-    const fieldFilter = {
-      [fieldName]: { in: rightOperand.value },
-    };
-    return buildNestedRelationFilter(relations, fieldFilter);
+    return buildMembershipFilter({ path, relations }, rightOperand.value);
   }
 
   const fieldName = getLeafField(path);
@@ -898,14 +2840,22 @@ function handleLambdaOperator(operands: PlanExpressionOperand[]): PrismaFilter {
   }));
 }
 
-/**
- * Helper function to handle collection operators (exists, all, except, filter)
- */
-function handleCollectionOperator(
+type CollectionLambdaParts = {
+  head: RelationConfig;
+  restRelations: RelationConfig[];
+  /** Element predicate, already wrapped through any relations beyond the first. */
+  filterValue: PrismaFilter;
+  /** Nullable element columns referenced by the lambda body (for 3VL guards). */
+  nullableFields: Set<string>;
+  /** Element-level predicates under which a nested collection expression is UNKNOWN. */
+  unknownFilters: PrismaFilter[];
+};
+
+function buildCollectionLambdaParts(
   operator: string,
   operands: PlanExpressionOperand[],
   mapper: Mapper
-): PrismaFilter {
+): CollectionLambdaParts {
   if (operands.length !== 2) {
     throw new Error(`${operator} requires exactly two operands`);
   }
@@ -952,23 +2902,46 @@ function handleCollectionOperator(
     throw new Error(`${operator} operator requires a relation mapping`);
   }
 
+  const head = assertDefined(
+    relations[0],
+    `${operator} operator requires a relation mapping`
+  );
+  const restRelations = relations.slice(1);
+  const deepest = assertDefined(
+    relations[relations.length - 1],
+    `${operator} operator requires a relation mapping`
+  );
+
   const lambdaConditionOperand = assertDefined(
     lambda.operands[0],
     "Lambda expression must provide a condition"
   );
-  const lambdaCondition = buildPrismaFilterFromCerbosExpression(
-    lambdaConditionOperand, // Use the condition part of the lambda
-    scopedMapper
-  );
 
-  const relation = assertDefined(
-    relations[0],
-    `${operator} operator requires a relation mapping`
-  );
+  const scope: LambdaScope = {
+    variableName: variable.name,
+    relationModel: deepest.model,
+    nullableFields: new Set(),
+    unknownFilters: [],
+  };
+  lambdaScopes.push(scope);
+  let lambdaCondition: PrismaFilter;
+  try {
+    lambdaCondition = buildPrismaFilterFromCerbosExpression(
+      lambdaConditionOperand, // Use the condition part of the lambda
+      scopedMapper
+    );
+  } finally {
+    lambdaScopes.pop();
+  }
+
   let filterValue = lambdaCondition;
 
-  // If the lambda condition already has a relation structure, merge it
-  if (lambdaCondition["AND"] || lambdaCondition["OR"]) {
+  if (restRelations.length > 0) {
+    // Chained collection reference (e.g. R.attr.a.b): the lambda's elements live at the END
+    // of the chain, so the element predicate must join through every intermediate hop.
+    filterValue = buildNestedRelationFilter(restRelations, lambdaCondition);
+  } else if (lambdaCondition["AND"] || lambdaCondition["OR"]) {
+    // If the lambda condition already has a logical structure, use it as-is
     filterValue = lambdaCondition;
   } else {
     const lambdaKeys = Object.keys(lambdaCondition);
@@ -980,40 +2953,223 @@ function handleCollectionOperator(
     if (lambdaFieldValue === undefined) {
       throw new Error("Lambda condition field value cannot be undefined");
     }
-    const filterField = relation.field || defaultKey;
+    const filterField = head.field || defaultKey;
     filterValue = {
       [filterField]: lambdaFieldValue,
     };
   }
 
+  return {
+    head,
+    restRelations,
+    filterValue,
+    nullableFields: scope.nullableFields,
+    unknownFilters: scope.unknownFilters,
+  };
+}
+
+/** OR of `field IS NULL` checks for every nullable element column the lambda touched. */
+function buildNullWitnessFilter(nullableFields: Set<string>): PrismaFilter {
+  const checks = [...nullableFields].map((field) => ({ [field]: null }));
+  if (checks.length === 1) {
+    return checks[0]!;
+  }
+  return { OR: checks };
+}
+
+function buildUnknownElementFilter(
+  parts: CollectionLambdaParts
+): PrismaFilter | undefined {
+  const filters = [...parts.unknownFilters];
+  if (parts.nullableFields.size > 0) {
+    filters.push(buildNullWitnessFilter(parts.nullableFields));
+  }
+  if (filters.length === 0) {
+    return undefined;
+  }
+  if (filters.length === 1) {
+    return filters[0];
+  }
+  return { OR: filters };
+}
+
+function recordNestedCollectionUnknownFilter(filter: PrismaFilter): void {
+  const enclosingScope = lambdaScopes[lambdaScopes.length - 1];
+  enclosingScope?.unknownFilters.push(filter);
+}
+
+/** Wraps an element-level filter through the full relation chain (head + rest). */
+function wrapCollectionElementFilter(
+  parts: CollectionLambdaParts,
+  elementFilter: PrismaFilter
+): PrismaFilter {
+  const inner =
+    parts.restRelations.length > 0
+      ? buildNestedRelationFilter(parts.restRelations, elementFilter)
+      : elementFilter;
+  return relationFilter(parts.head, "some", inner);
+}
+
+function throwUnsupportedCollectionOperator(operator: string): never {
+  if (operator === "exists_one") {
+    throw new Error(
+      "exists_one requires counting matching elements, which Prisma where-filters cannot express"
+    );
+  }
+  throw new Error(
+    "The filter() collection operator returns a list, not a boolean. " +
+      "It cannot be used as a standalone condition. " +
+      "Use exists() or combine filter() with size() instead."
+  );
+}
+
+/**
+ * Helper function to handle collection operators (exists, all, except, filter)
+ */
+function handleCollectionOperator(
+  operator: string,
+  operands: PlanExpressionOperand[],
+  mapper: Mapper
+): PrismaFilter {
+  const knownValueFilter = tryHandleKnownValueCollectionOperator(
+    operator,
+    operands,
+    mapper,
+    false
+  );
+  if (knownValueFilter !== undefined) {
+    return knownValueFilter;
+  }
+
+  if (operator === "exists_one" || operator === "filter") {
+    throwUnsupportedCollectionOperator(operator);
+  }
+
+  const parts = buildCollectionLambdaParts(operator, operands, mapper);
+  const { head, filterValue, nullableFields } = parts;
+
   switch (operator) {
-    case "exists":
-      return { [relation.name]: { some: filterValue } };
-    case "filter":
-      throw new Error(
-        "The filter() collection operator returns a list, not a boolean. " +
-          "It cannot be used as a standalone condition. " +
-          "Use exists() or combine filter() with size() instead."
-      );
+    case "exists": {
+      // A NULL element keeps the per-element predicate UNKNOWN, so it can never create a
+      // false positive here; a CEL error (deny) coincides with "no match" — no guard needed.
+      const filter = relationFilter(head, "some", filterValue);
+      const unknownElement = buildUnknownElementFilter(parts);
+      if (unknownElement !== undefined) {
+        recordNestedCollectionUnknownFilter({
+          AND: [
+            { NOT: filter },
+            wrapCollectionElementFilter(parts, unknownElement),
+          ],
+        });
+      }
+      return filter;
+    }
     case "except":
-      return { [relation.name]: { some: { NOT: filterValue } } };
-    case "exists_one":
+      return relationFilter(head, "some", { NOT: filterValue });
+    case "all": {
+      if (parts.restRelations.length > 0) {
+        throw new Error(
+          "all() over a multi-hop relation chain is not supported"
+        );
+      }
+      const base = relationFilter(head, "every", filterValue);
+      if (nullableFields.size === 0) {
+        return base;
+      }
+      // CEL all() errors when any element evaluation errors without a false witness; SQL
+      // `every` would treat those elements as vacuously passing. Exclude rows holding any
+      // element whose referenced nullable column is NULL. (`every` already rejects rows
+      // with a definitive false witness, matching error absorption.)
+      return {
+        AND: [
+          base,
+          relationFilter(head, "none", buildNullWitnessFilter(nullableFields)),
+        ],
+      };
+    }
+    default:
+      throw new Error(`Unexpected operator: ${operator}`);
+  }
+}
+
+/**
+ * Builds the filter for a NEGATED collection operator, encoding CEL's error semantics (see
+ * buildNegatedFilter).
+ */
+function buildNegatedCollectionFilter(
+  operator: string,
+  operands: PlanExpressionOperand[],
+  mapper: Mapper
+): PrismaFilter {
+  const knownValueFilter = tryHandleKnownValueCollectionOperator(
+    operator,
+    operands,
+    mapper,
+    true
+  );
+  if (knownValueFilter !== undefined) {
+    return knownValueFilter;
+  }
+
+  if (operator === "exists_one" || operator === "filter") {
+    throwUnsupportedCollectionOperator(operator);
+  }
+
+  const parts = buildCollectionLambdaParts(operator, operands, mapper);
+  const { head, filterValue, nullableFields } = parts;
+  // An absent to-one parent must stay denied under negation rather than satisfying it
+  // vacuously (#309).
+  const leadingHopsExist = buildLeadingHopsExistFilter(
+    head,
+    parts.restRelations
+  );
+  const requireLeadingHops = (filter: PrismaFilter): PrismaFilter =>
+    leadingHopsExist === undefined
+      ? filter
+      : { AND: [leadingHopsExist, filter] };
+
+  switch (operator) {
+    case "exists": {
+      const base = requireLeadingHops({
+        NOT: relationFilter(head, "some", filterValue),
+      });
+      const unknownElement = buildUnknownElementFilter(parts);
+      if (unknownElement === undefined) {
+        return base;
+      }
+      // !exists is TRUE only when every element is definitively false: no P-match AND no
+      // element whose evaluation is UNKNOWN (NULL column = missing attribute = CEL error).
       return {
-        [relation.name]: {
-          some: filterValue,
-        },
         AND: [
+          base,
           {
-            [relation.name]: {
-              every: {
-                OR: [filterValue, { NOT: filterValue }],
-              },
-            },
+            NOT: wrapCollectionElementFilter(
+              parts,
+              unknownElement
+            ),
           },
         ],
       };
+    }
     case "all":
-      return { [relation.name]: { every: filterValue } };
+      // !all is TRUE only with a definitive false witness, which also absorbs error
+      // elements — exactly `some(NOT P)` in SQL (NULL columns keep NOT P UNKNOWN).
+      return relationFilter(head, "some", { NOT: filterValue });
+    case "except": {
+      // !except(c,P) = every element definitively matches P.
+      const base = requireLeadingHops(
+        relationFilter(head, "none", { NOT: filterValue })
+      );
+      if (nullableFields.size === 0) {
+        return base;
+      }
+      return {
+        AND: [
+          base,
+          relationFilter(head, "none", buildNullWitnessFilter(nullableFields)),
+        ],
+      };
+    }
     default:
       throw new Error(`Unexpected operator: ${operator}`);
   }
@@ -1091,83 +3247,198 @@ function buildImpossibleFilter(fieldRef: ResolvedFieldReference): PrismaFilter {
   return buildFieldFilter(fieldRef, "in", []);
 }
 
-function handleAddComparison(
+const ARITHMETIC_OPERATORS = new Set(["add", "sub", "mult", "div"]);
+
+/**
+ * Translates `column ⊕ constant  CMP  value` (and its mirrored forms) by solving for the
+ * column: Prisma where-filters cannot express column arithmetic, but linear arithmetic with
+ * one constant side always rewrites to a plain comparison. Multiplying/dividing by a
+ * negative constant mirrors directional operators. The rewrite happens in IEEE double space,
+ * matching CEL: Cerbos attribute numbers are doubles, so this preserves check-time semantics
+ * (e.g. `n * 0.1 == 0.3` solves to an unrepresentable fraction and matches no integer row,
+ * exactly as CEL evaluates it).
+ */
+function handleArithmeticComparison(
   operator: string,
-  addExpr: OperatorOperand,
+  arithExpr: OperatorOperand,
   otherOperand: PlanExpressionOperand,
+  arithIsLeft: boolean,
   mapper: Mapper
 ): PrismaFilter {
-  const addLeftOp = assertDefined(
-    addExpr.operands[0],
-    "add operator requires a left operand"
+  const arithOp = arithExpr.operator;
+  const arithLeftOp = assertDefined(
+    arithExpr.operands[0],
+    `${arithOp} operator requires a left operand`
   );
-  const addRightOp = assertDefined(
-    addExpr.operands[1],
-    "add operator requires a right operand"
+  const arithRightOp = assertDefined(
+    arithExpr.operands[1],
+    `${arithOp} operator requires a right operand`
   );
 
-  const addLeft = resolveOperand(addLeftOp, mapper);
-  const addRight = resolveOperand(addRightOp, mapper);
-  const other = resolveOperand(otherOperand, mapper);
+  if (
+    isOperatorOperand(otherOperand) &&
+    ARITHMETIC_OPERATORS.has(otherOperand.operator) &&
+    tryFoldValueExpression(otherOperand, mapper) === null
+  ) {
+    throw new Error(
+      "Arithmetic on both sides of a comparison is not supported: the expression cannot be solved to a plain column filter"
+    );
+  }
 
-  if (isResolvedValue(addLeft) && isResolvedValue(addRight)) {
-    const folded = foldAdd(addLeft.value, addRight.value);
-    const prismaOp = CERBOS_TO_PRISMA_OPERATOR[operator];
-    if (!prismaOp) throw new Error(`Unsupported operator: ${operator}`);
+  const arithLeft = resolveOperand(arithLeftOp, mapper);
+  const arithRight = resolveOperand(arithRightOp, mapper);
+  const other = resolveOperand(otherOperand, mapper);
 
-    if (isResolvedFieldReference(other)) {
-      return buildFieldFilter(other, prismaOp, folded);
+  // Fully constant arithmetic: fold and compare the other side against the result. The
+  // arithmetic side keeps its source position, so when the folded constant was written
+  // FIRST (`1 + 2 < f`), directional operators mirror to keep the field on the left.
+  if (isResolvedValue(arithLeft) && isResolvedValue(arithRight)) {
+    const folded = foldArithmetic(arithOp, arithLeft.value, arithRight.value);
+    if (!isResolvedFieldReference(other)) {
+      throw new Error(
+        `${arithOp} with two values requires a field reference on the other side`
+      );
     }
-    throw new Error("add with two values requires a field reference on the other side");
+    const effectiveOperator = arithIsLeft
+      ? (MIRRORED_OPERATOR[operator] ?? operator)
+      : operator;
+    return buildComparisonFilter(other, effectiveOperator, folded);
   }
 
   if (!isResolvedValue(other)) {
     throw new Error(
-      "add operator with field references requires a value on the other side of the comparison"
+      `${arithOp} operator with field references requires a value on the other side of the comparison`
     );
   }
 
   let fieldRef: ResolvedFieldReference;
-  let addValue: Value;
+  let constant: Value;
   let fieldIsLeft: boolean;
 
-  if (isResolvedFieldReference(addLeft) && isResolvedValue(addRight)) {
-    fieldRef = addLeft;
-    addValue = addRight.value;
+  if (isResolvedFieldReference(arithLeft) && isResolvedValue(arithRight)) {
+    fieldRef = arithLeft;
+    constant = arithRight.value;
     fieldIsLeft = true;
-  } else if (isResolvedValue(addLeft) && isResolvedFieldReference(addRight)) {
-    fieldRef = addRight;
-    addValue = addLeft.value;
+  } else if (
+    isResolvedValue(arithLeft) &&
+    isResolvedFieldReference(arithRight)
+  ) {
+    fieldRef = arithRight;
+    constant = arithLeft.value;
     fieldIsLeft = false;
   } else {
     throw new Error(
-      "add operator requires exactly one field reference and one value, or two values"
+      `${arithOp} operator requires exactly one field reference and one value, or two values`
     );
   }
 
-  if (operator !== "eq" && operator !== "ne") {
+  // The comparison operator was normalized arithmetic-side-first by the caller; if the
+  // arithmetic was written on the RIGHT of the comparison, direction was already mirrored.
+  let effectiveOperator = arithIsLeft
+    ? operator
+    : (MIRRORED_OPERATOR[operator] ?? operator);
+
+  // String concatenation solving (eq/ne only).
+  if (arithOp === "add" && typeof constant === "string") {
+    if (effectiveOperator !== "eq" && effectiveOperator !== "ne") {
+      throw new Error(
+        `Operator ${effectiveOperator} is not supported with string concatenation`
+      );
+    }
+    const solvedValue = solveAdd(other.value, constant, fieldIsLeft);
+    if (solvedValue === null) {
+      if (effectiveOperator === "eq") return buildImpossibleFilter(fieldRef);
+      return {};
+    }
+    return buildComparisonFilter(fieldRef, effectiveOperator, solvedValue);
+  }
+
+  if (typeof constant !== "number" || typeof other.value !== "number") {
+    throw new Error(`${arithOp} comparison requires numeric operands`);
+  }
+
+  if (
+    arithOp === "add" &&
+    (effectiveOperator === "eq" || effectiveOperator === "ne") &&
+    (!Number.isInteger(constant) || !Number.isInteger(other.value))
+  ) {
     throw new Error(
-      `Operator ${operator} is not supported with add and field references`
+      "Fractional addition equality cannot be translated safely: solving IEEE-754 addition into a plain Prisma column comparison is not reversible"
     );
   }
 
-  const solvedValue = solveAdd(other.value, addValue, fieldIsLeft);
-  if (solvedValue === null) {
-    if (operator === "eq") return buildImpossibleFilter(fieldRef);
-    return {};
+  let solved: number;
+  switch (arithOp) {
+    case "add":
+      solved = other.value - constant;
+      break;
+    case "sub":
+      if (fieldIsLeft) {
+        // f - c CMP v  ⇔  f CMP v + c
+        solved = other.value + constant;
+      } else {
+        // c - f CMP v  ⇔  -f CMP v - c  ⇔  f mirror(CMP) c - v
+        solved = constant - other.value;
+        effectiveOperator =
+          MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+      }
+      break;
+    case "mult":
+      if (constant === 0) {
+        throw new Error(
+          "Multiplication by a constant zero must be folded by the Cerbos planner"
+        );
+      }
+      solved = other.value / constant;
+      if (constant < 0) {
+        effectiveOperator =
+          MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+      }
+      break;
+    case "div":
+      if (!fieldIsLeft) {
+        throw new Error(
+          "Division by a column is not supported: the comparison cannot be solved to a plain column filter"
+        );
+      }
+      if (constant === 0) {
+        throw new Error("Division by a constant zero is not supported");
+      }
+      solved = other.value * constant;
+      if (constant < 0) {
+        effectiveOperator =
+          MIRRORED_OPERATOR[effectiveOperator] ?? effectiveOperator;
+      }
+      break;
+    default:
+      throw new Error(`Unsupported operator: ${arithOp}`);
   }
 
-  return buildFieldFilter(fieldRef, CERBOS_TO_PRISMA_OPERATOR[operator]!, solvedValue);
+  return buildComparisonFilter(fieldRef, effectiveOperator, solved);
 }
 
-function foldAdd(left: Value, right: Value): Value {
-  if (typeof left === "string" || typeof right === "string") {
+function foldArithmetic(operator: string, left: Value, right: Value): Value {
+  if (
+    operator === "add" &&
+    (typeof left === "string" || typeof right === "string")
+  ) {
     return String(left) + String(right);
   }
-  if (typeof left === "number" && typeof right === "number") {
-    return left + right;
+  if (typeof left !== "number" || typeof right !== "number") {
+    throw new Error(`${operator} operator requires string or number operands`);
+  }
+  switch (operator) {
+    case "add":
+      return left + right;
+    case "sub":
+      return left - right;
+    case "mult":
+      return left * right;
+    case "div":
+      return left / right;
+    default:
+      throw new Error(`Unsupported operator: ${operator}`);
   }
-  throw new Error("add operator requires string or number operands");
 }
 
 function solveAdd(
@@ -1377,6 +3648,27 @@ function handleOverlapsOperator(
   return validConditions[0]!;
 }
 
+/**
+ * Guards every hierarchy prefix that is about to become a Prisma `startsWith`.
+ *
+ * `startsWith` compiles to `LIKE` with no `ESCAPE` clause, so `%` and `_` in the prefix
+ * match as wildcards instead of literally and widen the filter past what the PDP allows.
+ * `\` is unsafe because PostgreSQL and MySQL treat it as the DEFAULT escape character with no
+ * `ESCAPE` clause present, where SQLite has none at all — so the same prefix means different
+ * things per provider. `[` is unsafe for a third reason: SQL Server opens a character class on
+ * `[` even when an `ESCAPE` clause is declared, so it cannot be made literal at all. Fail loudly
+ * rather than emit a filter that admits denied rows.
+ */
+function assertLikeSafePrefix(prefix: string): void {
+  if (/[%_\[\\]/.test(prefix)) {
+    throw new Error(
+      "Cannot translate hierarchy prefix matching with LIKE metacharacters (%, _, \\ or [): " +
+        "Prisma emits LIKE without an ESCAPE clause, \\ is the default escape character on " +
+        "PostgreSQL and MySQL, and [ opens a character class on SQL Server even with one"
+    );
+  }
+}
+
 function handleFieldOverlaps(
   left: ResolvedHierarchy,
   right: ResolvedHierarchy
@@ -1401,7 +3693,9 @@ function handleFieldOverlaps(
     conditions.push(buildFieldFilter(field.fieldRef, "in", strictPrefixes));
   }
   conditions.push(buildFieldFilter(field.fieldRef, "equals", otherRaw));
-  conditions.push(buildFieldFilter(field.fieldRef, "startsWith", otherRaw + delimiter));
+  const prefix = otherRaw + delimiter;
+  assertLikeSafePrefix(prefix);
+  conditions.push(buildFieldFilter(field.fieldRef, "startsWith", prefix));
 
   if (conditions.length === 1) return conditions[0]!;
   return { OR: conditions };
@@ -1457,7 +3751,9 @@ function handleAncestorDescendantOperator(
   const descendant = direction === "ancestor" ? right : left;
 
   if (ancestor.type === "constant" && descendant.type === "field") {
-    const prefix = ancestor.segments.join(descendant.delimiter) + descendant.delimiter;
+    const prefix =
+      ancestor.segments.join(descendant.delimiter) + descendant.delimiter;
+    assertLikeSafePrefix(prefix);
     return buildFieldFilter(descendant.fieldRef, "startsWith", prefix);
   }