@cerbos/orm-prisma 4.1.0 → 5.0.0

package/lib/collections.d.ts

@@ -0,0 +1,30 @@
+import type { PlanExpressionOperand } from "@cerbos/core";
+import type { PrismaFilter } from "./index";
+import type { TranslationContext } from "./mapping";
+/**
+ * Refuses a two-variable comprehension (`list.exists(i, v, ...)`, `map.exists(k, v, ...)`), whose
+ * lambda binds the element's index or key as well as the element. A Prisma relation filter tests
+ * related rows, which carry no position, and enumerates no map keys, so the first variable has
+ * nothing to bind to.
+ */
+export declare function assertSingleVariableLambda(operator: string, lambda: {
+    operator: string;
+    operands: PlanExpressionOperand[];
+}): void;
+/** A collection macro (exists, all, except, exists_one, filter) in positive position. */
+export declare function handleCollectionOperator(operator: string, operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+/** The same macro under `!`, which is not the plain `NOT` of the positive filter. */
+export declare function buildNegatedCollectionFilter(operator: string, operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+/**
+ * Helper function to handle "map" operator
+ */
+export declare function handleMapOperator(operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+/**
+ * Helper function to handle "hasIntersection" operator
+ */
+export declare function handleHasIntersectionOperator(operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+/**
+ * Helper function to handle "lambda" operator
+ */
+export declare function handleLambdaOperator(operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+//# sourceMappingURL=collections.d.ts.map

package/lib/collections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../src/collections.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAM1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAO5C,OAAO,KAAK,EAGV,kBAAkB,EACnB,MAAM,WAAW,CAAC;AAuBnB;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAA;CAAE,GAC9D,IAAI,CAQN;AAuZD,yFAAyF;AACzF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAEd;AAED,qFAAqF;AACrF,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAEd;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAyDd;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CA0Dd;AA6FD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmBd"}

package/lib/collections.js

@@ -0,0 +1,421 @@
+"use strict";
+// The collection macros (`exists`, `all`, `except`, and the refused `exists_one`/`filter`), in
+// both polarities, plus `map`, `hasIntersection` and a bare `lambda`.
+//
+// A macro over a relation lowers to Prisma's `some`/`every`/`none`. Those collapse SQL's UNKNOWN
+// to false at the EXISTS boundary, so every macro whose lambda body touches a nullable element
+// column carries an explicit guard to keep CEL's error semantics (a NULL element column is a
+// missing attribute, which Cerbos treats as deny).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertSingleVariableLambda = assertSingleVariableLambda;
+exports.handleCollectionOperator = handleCollectionOperator;
+exports.buildNegatedCollectionFilter = buildNegatedCollectionFilter;
+exports.handleMapOperator = handleMapOperator;
+exports.handleHasIntersectionOperator = handleHasIntersectionOperator;
+exports.handleLambdaOperator = handleLambdaOperator;
+const fields_1 = require("./fields");
+const mapping_1 = require("./mapping");
+const plan_1 = require("./plan");
+const relations_1 = require("./relations");
+const rewrite_1 = require("./rewrite");
+const translate_1 = require("./translate");
+const errors_1 = require("./errors");
+/**
+ * Refuses a two-variable comprehension (`list.exists(i, v, ...)`, `map.exists(k, v, ...)`), whose
+ * lambda binds the element's index or key as well as the element. A Prisma relation filter tests
+ * related rows, which carry no position, and enumerates no map keys, so the first variable has
+ * nothing to bind to.
+ */
+function assertSingleVariableLambda(operator, lambda) {
+    if (lambda.operator === "lambda" && lambda.operands.length > 2) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} with a two-variable lambda: the first variable binds the element's list ` +
+            "index or map key, and a Prisma relation filter tests related rows, which carry no " +
+            "position, and enumerates no map keys");
+    }
+}
+function newLambdaScope(variableName, relations) {
+    return {
+        variableName,
+        relationModel: relations[relations.length - 1]?.model,
+        nullableFields: new Set(),
+        unknownFilters: [],
+    };
+}
+/**
+ * Fold a collection macro whose collection operand is a literal value list.
+ *
+ * The planner emits this shape when a known-value collection (typically a
+ * folded principal attribute) has more than 10 elements — at 10 or fewer it
+ * unrolls `exists`/`all` into an or/and chain itself (cerbos/cerbos#2570,
+ * cerbos/cerbos#2817; `maxItems = 10` in the planner's struct matcher). Apply
+ * the same fold here so the translated filter does not depend on which side of
+ * that threshold the collection lands: substitute each element into the lambda
+ * body and combine the per-element filters with OR (`exists`) or AND (`all`).
+ *
+ * An empty list yields `{OR: []}` / `{AND: []}`, which Prisma evaluates to
+ * match-nothing / match-everything — exactly CEL's `exists`/`all` semantics
+ * over an empty collection.
+ */
+function foldKnownValueCollection(operator, collection, lambda, context, negated) {
+    if (operator !== "exists" && operator !== "all") {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} over a literal collection value is not supported. ` +
+            "Only exists() and all() can be folded into a flat filter.");
+    }
+    const elements = collection.value;
+    if (!Array.isArray(elements)) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} over a literal collection requires a list value`);
+    }
+    if (!(0, plan_1.isOperatorOperand)(lambda) || lambda.operator !== "lambda") {
+        throw new errors_1.UnsupportedQueryPlanError(`Second operand of ${operator} must be a lambda expression`);
+    }
+    if (lambda.operands.length !== 2) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} over a literal collection supports single-variable lambdas only`);
+    }
+    const body = (0, plan_1.assertDefined)(lambda.operands[0], "Lambda expression must provide a condition");
+    const variable = (0, plan_1.assertDefined)(lambda.operands[1], "Lambda variable must have a name");
+    if (!(0, plan_1.isNamedOperand)(variable)) {
+        throw new errors_1.UnsupportedQueryPlanError("Lambda variable must have a name");
+    }
+    const filters = elements.map((element) => {
+        const substituted = (0, rewrite_1.substituteLambdaVariable)(body, variable.name, element);
+        return negated
+            ? (0, translate_1.buildNegatedFilter)(substituted, context)
+            : (0, translate_1.buildPrismaFilterFromCerbosExpression)(substituted, context);
+    });
+    const combinesWithOr = operator === "exists" ? !negated : negated;
+    return combinesWithOr ? { OR: filters } : { AND: filters };
+}
+function buildCollectionLambdaParts(operator, operands, context) {
+    if (operands.length !== 2) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} requires exactly two operands`);
+    }
+    const collection = (0, plan_1.assertDefined)(operands[0], `${operator} requires a collection operand`);
+    const lambda = (0, plan_1.assertDefined)(operands[1], `${operator} requires a lambda operand`);
+    if (!(0, plan_1.isNamedOperand)(collection)) {
+        throw new errors_1.UnsupportedQueryPlanError(`First operand of ${operator} must be a collection reference`);
+    }
+    if (!(0, plan_1.isOperatorOperand)(lambda)) {
+        throw new errors_1.UnsupportedQueryPlanError(`Second operand of ${operator} must be a lambda expression`);
+    }
+    assertSingleVariableLambda(operator, lambda);
+    const variable = (0, plan_1.assertDefined)(lambda.operands[1], "Lambda variable must have a name");
+    if (!(0, plan_1.isNamedOperand)(variable)) {
+        throw new errors_1.UnsupportedQueryPlanError("Lambda variable must have a name");
+    }
+    const { relations } = (0, mapping_1.resolveFieldReference)(collection.name, context);
+    if (!relations || relations.length === 0) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} operator requires a relation mapping`);
+    }
+    if (relations[relations.length - 1].type === "one") {
+        // CEL reads a to-one relation as a map, and a macro over a map ranges over its KEYS — the
+        // attribute names present on the related row — which no Prisma relation filter enumerates.
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} over ${collection.name}: it is a to-one relation, which CEL reads as a map ` +
+            "whose keys (the attribute names present on the related row) the macro ranges over, " +
+            "and a Prisma relation filter tests rows, not attribute names");
+    }
+    const head = relations[0];
+    const restRelations = relations.slice(1);
+    const lambdaConditionOperand = (0, plan_1.assertDefined)(lambda.operands[0], "Lambda expression must provide a condition");
+    const scope = newLambdaScope(variable.name, relations);
+    const lambdaCondition = (0, translate_1.buildPrismaFilterFromCerbosExpression)(lambdaConditionOperand, (0, mapping_1.enterLambdaScope)(context, collection.name, scope));
+    return {
+        head,
+        restRelations,
+        // Chained collection reference (e.g. R.attr.a.b): the lambda's elements live at the END
+        // of the chain, so the element predicate must join through every intermediate hop.
+        filterValue: (0, relations_1.wrapInRelations)(restRelations, lambdaCondition),
+        elementFilter: lambdaCondition,
+        nullableFields: scope.nullableFields,
+        unknownFilters: scope.unknownFilters,
+    };
+}
+function buildUnknownElementFilter(parts) {
+    const filters = [...parts.unknownFilters];
+    if (parts.nullableFields.size > 0) {
+        filters.push((0, fields_1.buildNullWitnessFilter)(parts.nullableFields));
+    }
+    if (filters.length === 0) {
+        return undefined;
+    }
+    return filters.length === 1 ? filters[0] : { OR: filters };
+}
+/** Wraps an element-level filter through the full relation chain (head + rest). */
+function wrapCollectionElementFilter(parts, elementFilter) {
+    return (0, relations_1.relationFilter)(parts.head, "some", (0, relations_1.wrapInRelations)(parts.restRelations, elementFilter));
+}
+/**
+ * all() over a chain (`R.attr.a.b`): the elements are the flattened tail, so the predicate must
+ * hold at the end of every path (`every` through each to-many hop, `is` through a to-one one),
+ * and the hops must exist — an absent parent is a missing-path error, never a vacuous TRUE.
+ */
+function positiveChainAllFilter(parts) {
+    let universal = parts.elementFilter;
+    for (const relation of [...parts.restRelations].reverse()) {
+        universal = (0, relations_1.relationFilter)(relation, relation.type === "one" ? "is" : "every", universal);
+    }
+    const filters = [
+        (0, relations_1.buildLeadingHopsExistFilter)(parts.head, parts.restRelations),
+        (0, relations_1.relationFilter)(parts.head, "every", universal),
+    ];
+    if (parts.nullableFields.size > 0) {
+        // As for a direct relation: an element whose referenced column is NULL errors in CEL.
+        filters.push({
+            NOT: wrapCollectionElementFilter(parts, (0, fields_1.buildNullWitnessFilter)(parts.nullableFields)),
+        });
+    }
+    return { AND: filters };
+}
+/** `relation: { none: <a nullable element column is NULL> }`, ANDed onto `base` when needed. */
+function excludeNullElements(base, parts) {
+    if (parts.nullableFields.size === 0) {
+        return base;
+    }
+    return {
+        AND: [
+            base,
+            (0, relations_1.relationFilter)(parts.head, "none", (0, fields_1.buildNullWitnessFilter)(parts.nullableFields)),
+        ],
+    };
+}
+function positiveCollectionFilter(operator, parts, context) {
+    const { head, filterValue } = parts;
+    switch (operator) {
+        case "exists": {
+            // A NULL element keeps the per-element predicate UNKNOWN, so it can never create a
+            // false positive here; a CEL error (deny) coincides with "no match" — no guard needed.
+            // An enclosing macro still needs to know when this one is UNKNOWN, so it is recorded.
+            const filter = (0, relations_1.relationFilter)(head, "some", filterValue);
+            const unknownElement = buildUnknownElementFilter(parts);
+            if (unknownElement !== undefined) {
+                (0, mapping_1.currentScope)(context)?.unknownFilters.push({
+                    AND: [
+                        { NOT: filter },
+                        wrapCollectionElementFilter(parts, unknownElement),
+                    ],
+                });
+            }
+            return filter;
+        }
+        case "except":
+            return (0, relations_1.relationFilter)(head, "some", (0, relations_1.negateFilter)(filterValue));
+        case "all":
+            if (parts.restRelations.length > 0) {
+                return positiveChainAllFilter(parts);
+            }
+            // CEL all() errors when any element evaluation errors without a false witness; SQL
+            // `every` would treat those elements as vacuously passing. Exclude rows holding any
+            // element whose referenced nullable column is NULL. (`every` already rejects rows
+            // with a definitive false witness, matching error absorption.)
+            return excludeNullElements((0, relations_1.relationFilter)(head, "every", filterValue), parts);
+        default:
+            throw new errors_1.UnsupportedQueryPlanError(`Unexpected operator: ${operator}`);
+    }
+}
+/**
+ * The filter for a NEGATED collection operator, encoding CEL's error semantics (see
+ * buildNegatedFilter).
+ */
+function negatedCollectionFilter(operator, parts) {
+    const { head, filterValue } = parts;
+    // An absent to-one parent must stay denied under negation rather than satisfying it
+    // vacuously (#309).
+    const leadingHopsExist = (0, relations_1.buildLeadingHopsExistFilter)(head, parts.restRelations);
+    const requireLeadingHops = (filter) => leadingHopsExist === undefined
+        ? filter
+        : { AND: [leadingHopsExist, filter] };
+    switch (operator) {
+        case "exists": {
+            const base = requireLeadingHops({
+                NOT: (0, relations_1.relationFilter)(head, "some", filterValue),
+            });
+            const unknownElement = buildUnknownElementFilter(parts);
+            if (unknownElement === undefined) {
+                return base;
+            }
+            // !exists is TRUE only when every element is definitively false: no P-match AND no
+            // element whose evaluation is UNKNOWN (NULL column = missing attribute = CEL error).
+            return {
+                AND: [base, { NOT: wrapCollectionElementFilter(parts, unknownElement) }],
+            };
+        }
+        case "all":
+            // !all is TRUE only with a definitive false witness, which also absorbs error
+            // elements — exactly `some(NOT P)` in SQL (NULL columns keep NOT P UNKNOWN). Over a chain
+            // the witness is an element at the END of it, so the negation sits inside every hop:
+            // negating the some-wrapped chain instead would admit a hop with no elements at all.
+            return wrapCollectionElementFilter(parts, (0, relations_1.negateFilter)(parts.elementFilter));
+        case "except":
+            // !except(c,P) = every element definitively matches P.
+            return excludeNullElements(requireLeadingHops((0, relations_1.relationFilter)(head, "none", (0, relations_1.negateFilter)(filterValue))), parts);
+        default:
+            throw new errors_1.UnsupportedQueryPlanError(`Unexpected operator: ${operator}`);
+    }
+}
+function translateCollectionMacro(operator, operands, context, negated) {
+    // A literal value list arrives when the planner could not unroll a macro over a known
+    // collection (more than 10 elements). Fold it before attempting relation resolution because
+    // there is no relation mapping for a literal.
+    const [collection, lambda] = operands;
+    if (operands.length === 2 &&
+        collection !== undefined &&
+        lambda !== undefined &&
+        (0, plan_1.isValueOperand)(collection)) {
+        return foldKnownValueCollection(operator, collection, lambda, context, negated);
+    }
+    if (operator === "exists_one") {
+        throw new errors_1.UnsupportedQueryPlanError("exists_one requires counting matching elements, which Prisma where-filters cannot express");
+    }
+    if (operator === "filter") {
+        throw new errors_1.UnsupportedQueryPlanError("The filter() collection operator returns a list, not a boolean. " +
+            "It cannot be used as a standalone condition. " +
+            "Use exists() or combine filter() with size() instead.");
+    }
+    const parts = buildCollectionLambdaParts(operator, operands, context);
+    return negated
+        ? negatedCollectionFilter(operator, parts)
+        : positiveCollectionFilter(operator, parts, context);
+}
+/** A collection macro (exists, all, except, exists_one, filter) in positive position. */
+function handleCollectionOperator(operator, operands, context) {
+    return translateCollectionMacro(operator, operands, context, false);
+}
+/** The same macro under `!`, which is not the plain `NOT` of the positive filter. */
+function buildNegatedCollectionFilter(operator, operands, context) {
+    return translateCollectionMacro(operator, operands, context, true);
+}
+/**
+ * Helper function to handle "map" operator
+ */
+function handleMapOperator(operands, context) {
+    if (operands.length !== 2) {
+        throw new errors_1.UnsupportedQueryPlanError("map requires exactly two operands");
+    }
+    const collection = (0, plan_1.assertDefined)(operands[0], "map requires a collection operand");
+    const lambda = (0, plan_1.assertDefined)(operands[1], "map requires a lambda operand");
+    if (!(0, plan_1.isNamedOperand)(collection)) {
+        throw new errors_1.UnsupportedQueryPlanError("First operand of map must be a collection reference");
+    }
+    if (!(0, plan_1.isOperatorOperand)(lambda) || lambda.operator !== "lambda") {
+        throw new errors_1.UnsupportedQueryPlanError("Second operand of map must be a lambda expression");
+    }
+    assertSingleVariableLambda("map", lambda);
+    const projection = (0, plan_1.assertDefined)(lambda.operands[0], "Map lambda expression must provide a projection");
+    const variable = (0, plan_1.assertDefined)(lambda.operands[1], "Map lambda expression must provide a variable");
+    if (!(0, plan_1.isNamedOperand)(projection) || !(0, plan_1.isNamedOperand)(variable)) {
+        throw new errors_1.UnsupportedQueryPlanError("Invalid map lambda expression structure");
+    }
+    const { relations } = (0, mapping_1.resolveFieldReference)(collection.name, context);
+    if (!relations || relations.length === 0) {
+        throw new errors_1.UnsupportedQueryPlanError("map operator requires a relation mapping");
+    }
+    const scopedContext = (0, mapping_1.enterLambdaScope)(context, collection.name, newLambdaScope(variable.name, relations));
+    const resolved = (0, mapping_1.resolveFieldReference)(projection.name, scopedContext);
+    const fieldName = (0, mapping_1.getLeafField)(resolved.path);
+    const lastRelation = relations[relations.length - 1];
+    return (0, relations_1.wrapInRelations)(relations, {
+        [(0, relations_1.relationOperator)(lastRelation)]: {
+            select: { [fieldName]: true },
+        },
+    });
+}
+/**
+ * Helper function to handle "hasIntersection" operator
+ */
+function handleHasIntersectionOperator(operands, context) {
+    if (operands.length !== 2) {
+        throw new errors_1.UnsupportedQueryPlanError("hasIntersection requires exactly two operands");
+    }
+    // Intersection is symmetric, and the planner preserves policy source order — e.g.
+    // `hasIntersection(["a"], R.attr.tags)` puts the constant list FIRST. Normalize to
+    // field/map-first (see #256).
+    ({ operands } = (0, plan_1.normalizeBinaryOperands)("hasIntersection", operands));
+    const leftOperand = (0, plan_1.assertDefined)(operands[0], "hasIntersection requires a left operand");
+    const rightOperand = (0, plan_1.assertDefined)(operands[1], "hasIntersection requires a right operand");
+    if ((0, plan_1.isOperatorOperand)(leftOperand) && leftOperand.operator === "map") {
+        return handleMapIntersection(leftOperand.operands, rightOperand, context);
+    }
+    if (!(0, plan_1.isNamedOperand)(leftOperand)) {
+        throw new errors_1.UnsupportedQueryPlanError("First operand of hasIntersection must be a field reference or map expression");
+    }
+    if (!(0, plan_1.isValueOperand)(rightOperand)) {
+        throw new errors_1.UnsupportedQueryPlanError("Second operand of hasIntersection must be a value");
+    }
+    const fieldRef = (0, mapping_1.resolveFieldReference)(leftOperand.name, context);
+    if (!Array.isArray(rightOperand.value)) {
+        throw new errors_1.UnsupportedQueryPlanError("hasIntersection requires an array value");
+    }
+    if (rightOperand.value.length === 0 && fieldRef.relations?.length === 1) {
+        return { OR: [] };
+    }
+    if (fieldRef.relations && fieldRef.relations.length > 0) {
+        // The whole reference, not just its path: the mapped valueType is what refuses a literal of
+        // another type (`hasIntersection(numberList, ["2", 3])`), which CEL's heterogeneous equality
+        // never matches and which a store would otherwise be handed to coerce.
+        return (0, fields_1.buildMembershipFilter)(context, fieldRef, rightOperand.value);
+    }
+    if (fieldRef.valueType !== undefined) {
+        throw new errors_1.UnsupportedQueryPlanError("hasIntersection over a scalar attribute is a CEL error, which a Prisma filter cannot express");
+    }
+    return { [(0, mapping_1.getLeafField)(fieldRef.path)]: { some: rightOperand.value } };
+}
+/** `hasIntersection(collection.map(x, x.field), [literals])`. */
+function handleMapIntersection(mapOperands, rightOperand, context) {
+    if (!(0, plan_1.isValueOperand)(rightOperand)) {
+        throw new errors_1.UnsupportedQueryPlanError("Second operand of hasIntersection must be a value");
+    }
+    const collection = (0, plan_1.assertDefined)(mapOperands[0], "Map expression must include a collection reference");
+    const lambda = (0, plan_1.assertDefined)(mapOperands[1], "Map expression must include a lambda expression");
+    if (!(0, plan_1.isNamedOperand)(collection)) {
+        throw new errors_1.UnsupportedQueryPlanError("First operand of map must be a collection reference");
+    }
+    if (!(0, plan_1.isOperatorOperand)(lambda)) {
+        throw new errors_1.UnsupportedQueryPlanError("Lambda expression must have operands");
+    }
+    assertSingleVariableLambda("map", lambda);
+    const variable = (0, plan_1.assertDefined)(lambda.operands[1], "Lambda variable must have a name");
+    if (!(0, plan_1.isNamedOperand)(variable)) {
+        throw new errors_1.UnsupportedQueryPlanError("Lambda variable must have a name");
+    }
+    const { relations } = (0, mapping_1.resolveFieldReference)(collection.name, context);
+    if (!relations || relations.length === 0) {
+        throw new errors_1.UnsupportedQueryPlanError("Map operation requires relations");
+    }
+    const projection = (0, plan_1.assertDefined)(lambda.operands[0], "Invalid map lambda expression structure");
+    if (!(0, plan_1.isNamedOperand)(projection)) {
+        throw new errors_1.UnsupportedQueryPlanError("Invalid map lambda expression structure");
+    }
+    // Resolve the projection through the scoped mapper, collecting nullable element columns.
+    const scope = newLambdaScope(variable.name, relations);
+    const resolved = (0, mapping_1.resolveFieldReference)(projection.name, (0, mapping_1.enterLambdaScope)(context, collection.name, scope));
+    const fieldName = (0, mapping_1.getLeafField)(resolved.path);
+    if (!Array.isArray(rightOperand.value))
+        throw new errors_1.UnsupportedQueryPlanError("hasIntersection requires a literal list");
+    const base = (0, relations_1.wrapInRelations)(relations, (0, fields_1.buildMembershipFilter)(context, { ...resolved, path: [fieldName], relations: [] }, rightOperand.value));
+    if (scope.nullableFields.size === 0) {
+        return base;
+    }
+    // CEL map() errors if ANY element is missing the projected attribute — even alongside a
+    // matching element — and Cerbos treats that error as deny. Exclude rows holding an
+    // element whose projected (nullable) column is NULL.
+    return {
+        AND: [
+            base,
+            { NOT: (0, relations_1.wrapInRelations)(relations, (0, fields_1.buildNullWitnessFilter)(scope.nullableFields)) },
+        ],
+    };
+}
+/**
+ * Helper function to handle "lambda" operator
+ */
+function handleLambdaOperator(operands, context) {
+    const condition = (0, plan_1.assertDefined)(operands[0], "Lambda requires a condition operand");
+    const variable = (0, plan_1.assertDefined)(operands[1], "Lambda requires a variable operand");
+    if (!(0, plan_1.isNamedOperand)(variable)) {
+        throw new errors_1.UnsupportedQueryPlanError("Lambda variable must have a name");
+    }
+    return (0, translate_1.buildPrismaFilterFromCerbosExpression)(condition, {
+        ...context,
+        mapper: (key) => ({ field: key.replace(`${variable.name}.`, "") }),
+    });
+}
+//# sourceMappingURL=collections.js.map

package/lib/collections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections.js","sourceRoot":"","sources":["../src/collections.ts"],"names":[],"mappings":";AAAA,+FAA+F;AAC/F,sEAAsE;AACtE,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,6FAA6F;AAC7F,mDAAmD;;AAgDnD,gEAWC;AAwZD,4DAMC;AAGD,oEAMC;AAKD,8CA4DC;AAKD,sEA6DC;AAgGD,oDAsBC;AAvtBD,qCAGkB;AAElB,uCAKmB;AAMnB,iCAMgB;AAEhB,2CAMqB;AACrB,uCAAqD;AACrD,2CAGqB;AACrB,qCAAqD;AAErD;;;;;GAKG;AACH,SAAgB,0BAA0B,CACxC,QAAgB,EAChB,MAA+D;IAE/D,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,2EAA2E;YACpF,oFAAoF;YACpF,sCAAsC,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,YAAoB,EACpB,SAA2B;IAE3B,OAAO;QACL,YAAY;QACZ,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK;QACrD,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,cAAc,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,UAAwB,EACxB,MAA6B,EAC7B,OAA2B,EAC3B,OAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,qDAAqD;YAC9D,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAElC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,kDAAkD,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAA,wBAAiB,EAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,kCAAyB,CACjC,qBAAqB,QAAQ,8BAA8B,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,kEAAkE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,oBAAa,EACxB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,4CAA4C,CAC7C,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,kCAAkC,CACnC,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kCAAyB,CAAC,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACvC,MAAM,WAAW,GAAG,IAAA,kCAAwB,EAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO,OAAO;YACZ,CAAC,CAAC,IAAA,8BAAkB,EAAC,WAAW,EAAE,OAAO,CAAC;YAC1C,CAAC,CAAC,IAAA,iDAAqC,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAElE,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAeD,SAAS,0BAA0B,CACjC,QAAgB,EAChB,QAAiC,EACjC,OAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAyB,CAAC,GAAG,QAAQ,gCAAgC,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,oBAAa,EAC9B,QAAQ,CAAC,CAAC,CAAC,EACX,GAAG,QAAQ,gCAAgC,CAC5C,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,oBAAa,EAC1B,QAAQ,CAAC,CAAC,CAAC,EACX,GAAG,QAAQ,4BAA4B,CACxC,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kCAAyB,CACjC,oBAAoB,QAAQ,iCAAiC,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAA,wBAAiB,EAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,kCAAyB,CACjC,qBAAqB,QAAQ,8BAA8B,CAC5D,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,kCAAkC,CACnC,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kCAAyB,CAAC,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,+BAAqB,EAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,kCAAyB,CAAC,GAAG,QAAQ,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACpD,0FAA0F;QAC1F,2FAA2F;QAC3F,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,SAAS,UAAU,CAAC,IAAI,sDAAsD;YACvF,qFAAqF;YACrF,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;IAC3B,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzC,MAAM,sBAAsB,GAAG,IAAA,oBAAa,EAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,4CAA4C,CAC7C,CAAC;IAEF,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEvD,MAAM,eAAe,GAAG,IAAA,iDAAqC,EAC3D,sBAAsB,EACtB,IAAA,0BAAgB,EAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAClD,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,aAAa;QACb,wFAAwF;QACxF,mFAAmF;QACnF,WAAW,EAAE,IAAA,2BAAe,EAAC,aAAa,EAAE,eAAe,CAAC;QAC5D,aAAa,EAAE,eAAe;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAA4B;IAE5B,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAE1C,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,IAAA,+BAAsB,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,mFAAmF;AACnF,SAAS,2BAA2B,CAClC,KAA4B,EAC5B,aAA2B;IAE3B,OAAO,IAAA,0BAAc,EACnB,KAAK,CAAC,IAAI,EACV,MAAM,EACN,IAAA,2BAAe,EAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAA4B;IAC1D,IAAI,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC;IAEpC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,SAAS,GAAG,IAAA,0BAAc,EACxB,QAAQ,EACR,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EACxC,SAAS,CACV,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG;QACd,IAAA,uCAA2B,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAE;QAC7D,IAAA,0BAAc,EAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;KAC/C,CAAC;IAEF,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAClC,sFAAsF;QACtF,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,2BAA2B,CAAC,KAAK,EAAE,IAAA,+BAAsB,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAChG,SAAS,mBAAmB,CAC1B,IAAkB,EAClB,KAA4B;IAE5B,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE;YACH,IAAI;YACJ,IAAA,0BAAc,EAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAA,+BAAsB,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC;SACjF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,KAA4B,EAC5B,OAA2B;IAE3B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,mFAAmF;YACnF,uFAAuF;YACvF,sFAAsF;YACtF,MAAM,MAAM,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,cAAc,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAExD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAA,sBAAY,EAAC,OAAO,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC;oBACzC,GAAG,EAAE;wBACH,EAAE,GAAG,EAAE,MAAM,EAAE;wBACf,2BAA2B,CAAC,KAAK,EAAE,cAAc,CAAC;qBACnD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,QAAQ;YACX,OAAO,IAAA,0BAAc,EAAC,IAAI,EAAE,MAAM,EAAE,IAAA,wBAAY,EAAC,WAAW,CAAC,CAAC,CAAC;QACjE,KAAK,KAAK;YACR,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAED,mFAAmF;YACnF,oFAAoF;YACpF,kFAAkF;YAClF,+DAA+D;YAC/D,OAAO,mBAAmB,CAAC,IAAA,0BAAc,EAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QAChF;YACE,MAAM,IAAI,kCAAyB,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAgB,EAChB,KAA4B;IAE5B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpC,oFAAoF;IACpF,oBAAoB;IACpB,MAAM,gBAAgB,GAAG,IAAA,uCAA2B,EAClD,IAAI,EACJ,KAAK,CAAC,aAAa,CACpB,CAAC;IAEF,MAAM,kBAAkB,GAAG,CAAC,MAAoB,EAAgB,EAAE,CAChE,gBAAgB,KAAK,SAAS;QAC5B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC;IAE1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,kBAAkB,CAAC;gBAC9B,GAAG,EAAE,IAAA,0BAAc,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC;aAC/C,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAExD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mFAAmF;YACnF,qFAAqF;YACrF,OAAO;gBACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,2BAA2B,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;QAED,KAAK,KAAK;YACR,8EAA8E;YAC9E,0FAA0F;YAC1F,qFAAqF;YACrF,qFAAqF;YACrF,OAAO,2BAA2B,CAAC,KAAK,EAAE,IAAA,wBAAY,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/E,KAAK,QAAQ;YACX,uDAAuD;YACvD,OAAO,mBAAmB,CACxB,kBAAkB,CAAC,IAAA,0BAAc,EAAC,IAAI,EAAE,MAAM,EAAE,IAAA,wBAAY,EAAC,WAAW,CAAC,CAAC,CAAC,EAC3E,KAAK,CACN,CAAC;QACJ;YACE,MAAM,IAAI,kCAAyB,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,QAAiC,EACjC,OAA2B,EAC3B,OAAgB;IAEhB,sFAAsF;IACtF,4FAA4F;IAC5F,8CAA8C;IAC9C,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC;IAEtC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,UAAU,KAAK,SAAS;QACxB,MAAM,KAAK,SAAS;QACpB,IAAA,qBAAc,EAAC,UAAU,CAAC,EAC1B,CAAC;QACD,OAAO,wBAAwB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,kCAAyB,CACjC,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAyB,CACjC,kEAAkE;YAChE,+CAA+C;YAC/C,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEtE,OAAO,OAAO;QACZ,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC1C,CAAC,CAAC,wBAAwB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,yFAAyF;AACzF,SAAgB,wBAAwB,CACtC,QAAgB,EAChB,QAAiC,EACjC,OAA2B;IAE3B,OAAO,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,qFAAqF;AACrF,SAAgB,4BAA4B,CAC1C,QAAgB,EAChB,QAAiC,EACjC,OAA2B;IAE3B,OAAO,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,QAAiC,EACjC,OAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,oBAAa,EAC9B,QAAQ,CAAC,CAAC,CAAC,EACX,mCAAmC,CACpC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,oBAAa,EAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;IAE3E,IAAI,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kCAAyB,CAAC,qDAAqD,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,IAAA,wBAAiB,EAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,kCAAyB,CAAC,mDAAmD,CAAC,CAAC;IAC3F,CAAC;IAED,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,IAAA,oBAAa,EAC9B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,iDAAiD,CAClD,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,+CAA+C,CAChD,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,IAAI,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,kCAAyB,CAAC,yCAAyC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,+BAAqB,EAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,kCAAyB,CAAC,0CAA0C,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,0BAAgB,EACpC,OAAO,EACP,UAAU,CAAC,IAAI,EACf,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CACzC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAA,+BAAqB,EAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAEtD,OAAO,IAAA,2BAAe,EAAC,SAAS,EAAE;QAChC,CAAC,IAAA,4BAAgB,EAAC,YAAY,CAAC,CAAC,EAAE;YAChC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE;SAC9B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,6BAA6B,CAC3C,QAAiC,EACjC,OAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAyB,CAAC,+CAA+C,CAAC,CAAC;IACvF,CAAC;IAED,kFAAkF;IAClF,mFAAmF;IACnF,8BAA8B;IAC9B,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAA,8BAAuB,EAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEtE,MAAM,WAAW,GAAG,IAAA,oBAAa,EAC/B,QAAQ,CAAC,CAAC,CAAC,EACX,yCAAyC,CAC1C,CAAC;IAEF,MAAM,YAAY,GAAG,IAAA,oBAAa,EAChC,QAAQ,CAAC,CAAC,CAAC,EACX,0CAA0C,CAC3C,CAAC;IAEF,IAAI,IAAA,wBAAiB,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACrE,OAAO,qBAAqB,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,IAAA,qBAAc,EAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,kCAAyB,CACjC,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAA,qBAAc,EAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kCAAyB,CAAC,mDAAmD,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,+BAAqB,EAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAElE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,kCAAyB,CAAC,yCAAyC,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,4FAA4F;QAC5F,6FAA6F;QAC7F,uEAAuE;QACvE,OAAO,IAAA,8BAAqB,EAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,kCAAyB,CACjC,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC,IAAA,sBAAY,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,iEAAiE;AACjE,SAAS,qBAAqB,CAC5B,WAAoC,EACpC,YAAmC,EACnC,OAA2B;IAE3B,IAAI,CAAC,IAAA,qBAAc,EAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kCAAyB,CAAC,mDAAmD,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,oBAAa,EAC9B,WAAW,CAAC,CAAC,CAAC,EACd,oDAAoD,CACrD,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,oBAAa,EAC1B,WAAW,CAAC,CAAC,CAAC,EACd,iDAAiD,CAClD,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kCAAyB,CAAC,qDAAqD,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,IAAA,wBAAiB,EAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,kCAAyB,CAAC,sCAAsC,CAAC,CAAC;IAC9E,CAAC;IAED,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,kCAAkC,CACnC,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kCAAyB,CAAC,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,+BAAqB,EAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,kCAAyB,CAAC,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,oBAAa,EAC9B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,yCAAyC,CAC1C,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kCAAyB,CAAC,yCAAyC,CAAC,CAAC;IACjF,CAAC;IAED,yFAAyF;IACzF,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAA,+BAAqB,EACpC,UAAU,CAAC,IAAI,EACf,IAAA,0BAAgB,EAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAClD,CAAC;IAEF,MAAM,SAAS,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACpC,MAAM,IAAI,kCAAyB,CAAC,yCAAyC,CAAC,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAA,2BAAe,EAC1B,SAAS,EACT,IAAA,8BAAqB,EACnB,OAAO,EACP,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EACjD,YAAY,CAAC,KAAK,CACnB,CACF,CAAC;IAEF,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wFAAwF;IACxF,mFAAmF;IACnF,qDAAqD;IACrD,OAAO;QACL,GAAG,EAAE;YACH,IAAI;YACJ,EAAE,GAAG,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,IAAA,+BAAsB,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE;SAClF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,QAAiC,EACjC,OAA2B;IAE3B,MAAM,SAAS,GAAG,IAAA,oBAAa,EAC7B,QAAQ,CAAC,CAAC,CAAC,EACX,qCAAqC,CACtC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAC5B,QAAQ,CAAC,CAAC,CAAC,EACX,oCAAoC,CACrC,CAAC;IAEF,IAAI,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kCAAyB,CAAC,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,IAAA,iDAAqC,EAAC,SAAS,EAAE;QACtD,GAAG,OAAO;QACV,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC"}

package/lib/comparison.d.ts

@@ -0,0 +1,24 @@
+import type { PlanExpressionOperand } from "@cerbos/core";
+import type { PrismaFilter } from "./index";
+import type { TranslationContext } from "./mapping";
+/**
+ * Helper function to process relational operators (eq, ne, lt, etc.)
+ */
+export declare function handleRelationalOperator(operator: string, operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+/** Whether a map-literal lookup appears anywhere in `operand`. */
+export declare function containsMapLiteralLookup(operand: PlanExpressionOperand): boolean;
+/**
+ * `{"k1": v1, "k2": v2}[x] == v` (and `!=`, either side first), with `x` a string column: the keys
+ * whose value equals `v` are exactly the values of `x` that make it true, and every other key the
+ * values that make it false. Any `x` that is not a key is an error, true under neither polarity,
+ * so the comparison and its negation are two membership tests, never one test and its NOT:
+ * `negated` asks for the negation's filter, and buildNegatedFilter pushes every `not` above a
+ * lookup down to it. Inside a lambda body a macro negates its body with a plain NOT, so the
+ * lookup is refused there.
+ */
+export declare function tryHandleMapLiteralLookup(operator: string, operands: PlanExpressionOperand[], context: TranslationContext, negated?: boolean): PrismaFilter | null;
+/**
+ * Helper function to handle "in" operator
+ */
+export declare function handleInOperator(operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+//# sourceMappingURL=comparison.d.ts.map

package/lib/comparison.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comparison.d.ts","sourceRoot":"","sources":["../src/comparison.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAS,MAAM,cAAc,CAAC;AAWjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAW5C,OAAO,KAAK,EAGV,kBAAkB,EACnB,MAAM,WAAW,CAAC;AA0BnB;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmHd;AAaD,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAIhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,UAAQ,GACd,YAAY,GAAG,IAAI,CAkDrB;AAuvBD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CA8Dd"}