@cerebruminc/yates 3.7.2 → 3.8.1-beta.dangerous.0cfc5d9

package/dist/index.js

@@ -1,8 +1,4 @@
 "use strict";
-var __makeTemplateObject = (this && this.__makeTemplateObject) || function (cooked, raw) {
-    if (Object.defineProperty) { Object.defineProperty(cooked, "raw", { value: raw }); } else { cooked.raw = raw; }
-    return cooked;
-};
 var __assign = (this && this.__assign) || function () {
     __assign = Object.assign || function(t) {
         for (var s, i = 1, n = arguments.length; i < n; i++) {
@@ -14,29 +10,6 @@ var __assign = (this && this.__assign) || function () {
     };
     return __assign.apply(this, arguments);
 };
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -100,72 +73,16 @@ var __read = (this && this.__read) || function (o, n) {
     }
     return ar;
 };
-var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
-    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
-        if (ar || !(i in from)) {
-            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
-            ar[i] = from[i];
-        }
-    }
-    return to.concat(ar || Array.prototype.slice.call(from));
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setup = exports.createRoles = exports.createClient = exports.getBatchId = exports.createRoleName = exports.createAbilityName = exports.sanitizeSlug = void 0;
-var crypto = __importStar(require("crypto"));
+exports.setup = exports.__private = exports.Yates = exports.sanitizeSlug = void 0;
 var debug_1 = __importDefault(require("debug"));
 var cloneDeep_1 = __importDefault(require("lodash/cloneDeep"));
 var difference_1 = __importDefault(require("lodash/difference"));
-var flatMap_1 = __importDefault(require("lodash/flatMap"));
-var map_1 = __importDefault(require("lodash/map"));
-var toPairs_1 = __importDefault(require("lodash/toPairs"));
-var expressions_1 = require("./expressions");
 var VALID_OPERATIONS = ["SELECT", "UPDATE", "INSERT", "DELETE"];
 var debug = (0, debug_1.default)("yates");
-/**
- * This function is used to take a lock that is automatically released at the end of the current transaction.
- * This is very convenient for ensuring we don't hit concurrency issues when running setup code.
- */
-var takeLock = function (prisma) {
-    return prisma.$executeRawUnsafe("SELECT pg_advisory_xact_lock(2142616474639426746);");
-};
-/*
- * This function creates a table used to track the abilities that have been
- * defined in the system. We can use this to see if an ability needs to be updated.
- * We can't look up the pg policy table for this, as pg performs formatting on
- * the expression, making it very hard to check if the two expressions are equivalent.
- *
- * We also need to create a schema for this table, as we don't want to pollute the public schema.
- * If we use the public schema, we could potentially conflict with a user's table and we will
- * also cause issues for Prisma's migrate tooling, as it will detect a DB drift.
- */
-var setupAbilityTable = function (prisma) {
-    return prisma.$transaction([
-        takeLock(prisma),
-        prisma.$executeRawUnsafe("\n\t\tCREATE SCHEMA IF NOT EXISTS _yates;\n\t\t"),
-        prisma.$executeRawUnsafe("\n\t\tCREATE TABLE IF NOT EXISTS _yates._yates_abilities (\n\t\t\tid SERIAL PRIMARY KEY,\n\t\t\tability_model TEXT NOT NULL,\n\t\t\tability_name TEXT NOT NULL,\n\t\t\tability_policy_name TEXT NOT NULL UNIQUE,\n\t\t\tability_description TEXT NOT NULL,\n\t\t\tability_operation TEXT NOT NULL,\n\t\t\tability_expression TEXT NOT NULL,\n\t\t\tcreated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,\n\t\t\tupdated_at TIMESTAMP\n\t\t);\n\t"),
-    ]);
-};
-var upsertAbility = function (prisma, ability) {
-    var ability_model = ability.ability_model, ability_name = ability.ability_name, ability_policy_name = ability.ability_policy_name, ability_description = ability.ability_description, ability_operation = ability.ability_operation, ability_expression = ability.ability_expression;
-    return prisma.$queryRaw(templateObject_1 || (templateObject_1 = __makeTemplateObject(["\n\t\tINSERT INTO _yates._yates_abilities (ability_model, ability_name, ability_policy_name, ability_description, ability_operation, ability_expression)\n\t\tVALUES (", ", ", ", ", ", ", ", ", ", ", ")\n\t\tON CONFLICT (ability_policy_name) DO UPDATE\n\t\tSET ability_model = EXCLUDED.ability_model, ability_name = EXCLUDED.ability_name, ability_description = EXCLUDED.ability_description, ability_operation = EXCLUDED.ability_operation, ability_expression = EXCLUDED.ability_expression, updated_at = now();\n\t"], ["\n\t\tINSERT INTO _yates._yates_abilities (ability_model, ability_name, ability_policy_name, ability_description, ability_operation, ability_expression)\n\t\tVALUES (", ", ", ", ", ", ", ", ", ", ", ")\n\t\tON CONFLICT (ability_policy_name) DO UPDATE\n\t\tSET ability_model = EXCLUDED.ability_model, ability_name = EXCLUDED.ability_name, ability_description = EXCLUDED.ability_description, ability_operation = EXCLUDED.ability_operation, ability_expression = EXCLUDED.ability_expression, updated_at = now();\n\t"])), ability_model, ability_name, ability_policy_name, ability_description, ability_operation, ability_expression);
-};
-/**
- * In PostgreSQL, the maximum length for a role or policy name is 63 bytes.
- * This limitation is derived from the value of the NAMEDATALEN configuration parameter,
- * which is set to 64 bytes by default. One byte is reserved for the null-terminator,
- * leaving 63 bytes for the actual role name.
- * This function hashes the ability name to ensure it is within the 63 byte limit.
- */
-var hashWithPrefix = function (prefix, abilityName) {
-    var hash = crypto.createHash("sha256");
-    hash.update(abilityName);
-    var hashedAbilityName = hash.digest("hex");
-    var maxLength = 63 - prefix.length;
-    return prefix + hashedAbilityName.slice(0, maxLength);
-};
 // Sanitize a single string by ensuring the it has only lowercase alpha characters and underscores
 var sanitizeSlug = function (slug) {
     return slug
@@ -174,684 +91,1358 @@ var sanitizeSlug = function (slug) {
         .replace(/[^a-z0-9_]/gi, "");
 };
 exports.sanitizeSlug = sanitizeSlug;
-var createAbilityName = function (model, ability) {
-    return (0, exports.sanitizeSlug)(hashWithPrefix("yates_ability_", "".concat(model, "_").concat(ability)));
+var OPERATION_MAP = {
+    findUnique: "SELECT",
+    findUniqueOrThrow: "SELECT",
+    findFirst: "SELECT",
+    findFirstOrThrow: "SELECT",
+    findMany: "SELECT",
+    count: "SELECT",
+    aggregate: "SELECT",
+    groupBy: "SELECT",
+    create: "INSERT",
+    createMany: "INSERT",
+    update: "UPDATE",
+    updateMany: "UPDATE",
+    delete: "DELETE",
+    deleteMany: "DELETE",
+    upsert: "UPDATE",
+};
+var UNIQUE_OPERATIONS = new Set([
+    "findUnique",
+    "findUniqueOrThrow",
+    "update",
+    "delete",
+    "upsert",
+]);
+var SELECT_OPERATIONS = new Set([
+    "findUnique",
+    "findUniqueOrThrow",
+    "findFirst",
+    "findFirstOrThrow",
+    "findMany",
+    "count",
+    "aggregate",
+    "groupBy",
+]);
+var isPlainObject = function (value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+};
+var lowerModelName = function (model) {
+    return model.length ? "".concat(model[0].toLowerCase()).concat(model.slice(1)) : model;
+};
+var isFieldRef = function (value) {
+    return isPlainObject(value) &&
+        typeof value.modelName === "string" &&
+        typeof value.name === "string";
+};
+var isEmptyWhere = function (where) {
+    return !where || (isPlainObject(where) && Object.keys(where).length === 0);
+};
+var combineAbilityFilters = function (filters) {
+    if (filters.length === 0)
+        return null;
+    if (filters.some(function (filter) { return isEmptyWhere(filter); }))
+        return {};
+    if (filters.length === 1)
+        return filters[0];
+    return { OR: filters };
+};
+var mergeWhere = function (base, extra) {
+    var _a;
+    if (!extra || isEmptyWhere(extra))
+        return (_a = base !== null && base !== void 0 ? base : extra) !== null && _a !== void 0 ? _a : undefined;
+    if (!base || isEmptyWhere(base))
+        return extra;
+    return { AND: [base, extra] };
 };
-exports.createAbilityName = createAbilityName;
-var createRoleName = function (name) {
-    return (0, exports.sanitizeSlug)(hashWithPrefix("yates_role_", "".concat(name)));
+var getFluentSelectionField = function (runtimeDataModel, model, args) {
+    var selection = args.select;
+    if (!isPlainObject(selection))
+        return null;
+    var keys = Object.keys(selection);
+    if (keys.length !== 1)
+        return null;
+    var field = keys[0];
+    var modelData = runtimeDataModel.models[model];
+    var fieldData = modelData === null || modelData === void 0 ? void 0 : modelData.fields.find(function (f) { return f.name === field; });
+    if (!fieldData || fieldData.kind !== "object")
+        return null;
+    return field;
 };
-exports.createRoleName = createRoleName;
-var getDefaultAbilities = function (models) {
-    var e_1, _a;
-    var abilities = {};
+var getIdField = function (runtimeDataModel, model) {
+    var _a;
+    var modelData = runtimeDataModel.models[model];
+    if (!modelData)
+        return null;
+    var idField = modelData.fields.find(function (field) { return field.isId; });
+    return (_a = idField === null || idField === void 0 ? void 0 : idField.name) !== null && _a !== void 0 ? _a : null;
+};
+var denyWhere = function (runtimeDataModel, model) {
+    var _a;
+    var idField = getIdField(runtimeDataModel, model);
+    if (idField) {
+        return _a = {},
+            _a[idField] = {
+                in: [],
+            },
+            _a;
+    }
+    throw new Error("Model \"".concat(model, "\" has no @id field. Yates requires an ID to safely deny queries."));
+};
+var validateContext = function (context) {
+    var e_1, _a, e_2, _b;
+    if (!context)
+        return;
     try {
-        for (var models_1 = __values(models), models_1_1 = models_1.next(); !models_1_1.done; models_1_1 = models_1.next()) {
-            var model = models_1_1.value;
-            abilities[model] = {
-                create: {
-                    description: "Create ".concat(model),
-                    expression: "true",
-                    operation: "INSERT",
-                    model: model,
-                    slug: "create",
-                },
-                read: {
-                    description: "Read ".concat(model),
-                    expression: "true",
-                    operation: "SELECT",
-                    model: model,
-                    slug: "read",
-                },
-                update: {
-                    description: "Update ".concat(model),
-                    expression: "true",
-                    operation: "UPDATE",
-                    model: model,
-                    slug: "update",
-                },
-                delete: {
-                    description: "Delete ".concat(model),
-                    expression: "true",
-                    operation: "DELETE",
-                    model: model,
-                    slug: "delete",
-                },
-            };
+        for (var _c = __values(Object.keys(context)), _d = _c.next(); !_d.done; _d = _c.next()) {
+            var key = _d.value;
+            if (!key.match(/^[a-z_\.]+$/)) {
+                throw new Error("Context variable \"".concat(key, "\" contains invalid characters. Context variables must only contain lowercase letters, numbers, periods and underscores."));
+            }
+            var value = context[key];
+            if (typeof value !== "number" &&
+                typeof value !== "string" &&
+                !Array.isArray(value)) {
+                throw new Error("Context variable \"".concat(key, "\" must be a string, number or array. Got ").concat(typeof value));
+            }
+            if (Array.isArray(value)) {
+                try {
+                    for (var _e = (e_2 = void 0, __values(value)), _f = _e.next(); !_f.done; _f = _e.next()) {
+                        var entry = _f.value;
+                        if (typeof entry !== "string") {
+                            throw new Error("Context variable \"".concat(key, "\" must be an array of strings. Got ").concat(typeof entry));
+                        }
+                    }
+                }
+                catch (e_2_1) { e_2 = { error: e_2_1 }; }
+                finally {
+                    try {
+                        if (_f && !_f.done && (_b = _e.return)) _b.call(_e);
+                    }
+                    finally { if (e_2) throw e_2.error; }
+                }
+            }
         }
     }
     catch (e_1_1) { e_1 = { error: e_1_1 }; }
     finally {
         try {
-            if (models_1_1 && !models_1_1.done && (_a = models_1.return)) _a.call(models_1);
+            if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
         }
         finally { if (e_1) throw e_1.error; }
     }
-    return abilities;
 };
-// @ts-ignore
-function getBatchId(query) {
-    if (query.action !== "findUnique" && query.action !== "findUniqueOrThrow") {
-        return undefined;
+var permissionError = function (model, operation) {
+    return new Error("You do not have permission to perform this action: ".concat(model, ".").concat(operation, "(...)"));
+};
+var updateNotFoundError = function () { return new Error("Record to update not found"); };
+var deleteNotFoundError = function () { return new Error("Record to delete does not exist"); };
+var matchesScalarFilter = function (value, filter, data) {
+    if (!isPlainObject(filter)) {
+        if (isFieldRef(filter)) {
+            return value === data[filter.name];
+        }
+        return value === filter;
     }
-    var parts = [];
-    if (query.modelName) {
-        parts.push(query.modelName);
+    if ("equals" in filter) {
+        var target = filter.equals;
+        if (isFieldRef(target)) {
+            return value === data[target.name];
+        }
+        return value === target;
     }
-    if (query.query.arguments) {
-        parts.push(buildKeysString(query.query.arguments));
+    if ("in" in filter) {
+        return Array.isArray(filter.in) && filter.in.includes(value);
     }
-    parts.push(buildKeysString(query.query.selection));
-    return parts.join("");
-}
-exports.getBatchId = getBatchId;
-function buildKeysString(obj) {
-    var keysArray = Object.keys(obj)
-        .sort()
-        .map(function (key) {
-        // @ts-ignore
-        var value = obj[key];
-        if (typeof value === "object" && value !== null) {
-            return "(".concat(key, " ").concat(buildKeysString(value), ")");
-        }
-        return key;
-    });
-    return "(".concat(keysArray.join(" "), ")");
-}
-// This uses client extensions to set the role and context for the current user so that RLS can be applied
-var createClient = function (prisma, getContext, options) {
-    if (options === void 0) { options = {}; }
-    // Set default options
-    var _a = options.txMaxWait, txMaxWait = _a === void 0 ? 30000 : _a, _b = options.txTimeout, txTimeout = _b === void 0 ? 30000 : _b;
-    // By default, Prisma will batch requests by the transaction ID if it is present.
-    // This behaviour prevents automatic batching from working when using Yates, since all queries are executed inside an interactive transaction.
-    // To get around this we by monkey patching the batching function to use the Yates ID as the batch ID.
-    // To get the batching to work we also need to ensure that all the requests we might want to batch together are generated inside the same tick.
-    // This means that all the requests per-tick that have the same role and context values will be batched together,
-    // allowing the in-built prisma batch optimizations to work for us.
-    // This is why we use process.nextTick and the tickActive flag to ensure we only tick once at a time.
-    // See:
-    // - https://github.com/prisma/prisma/blob/5.21.1/packages/client/src/runtime/RequestHandler.ts#L122
-    // - https://www.prisma.io/docs/orm/prisma-client/queries/query-optimization-performance
-    prisma._requestHandler.dataloader.options.batchBy = function (request) {
-        var _a;
-        var batchIdPQ = getBatchId(request.protocolQuery);
-        if ((_a = request.transaction) === null || _a === void 0 ? void 0 : _a.id) {
-            return "transaction-".concat(request.transaction.id).concat(batchIdPQ ? "-".concat(batchIdPQ) : "");
-        }
-        return getBatchId(request.protocolQuery);
-    };
-    var tickActive = false;
-    var batches = {};
-    // This function is called once per tick, and processes all the batches that have been created during that tick.
-    // Each batch represents a unique role + context combination, and contains all the requests that need to be executed with that role + context.
-    var dispatchBatches = function () {
-        var e_2, _a;
-        var _loop_1 = function (key, batch) {
-            delete batches[key];
-            // Because batch transactions inside a prisma client query extension can run out of order if used with async middleware,
-            // we need to run the logic inside an interactive transaction, however this brings a different set of problems in that the
-            // main query will no longer automatically run inside the transaction. We resolve this issue by manually executing the prisma request.
-            // See https://github.com/prisma/prisma/issues/18276
-            prisma
-                .$transaction(function (tx) { return __awaiter(void 0, void 0, void 0, function () {
-                var _a, _b, _c, key_1, value, e_3_1, txId, results;
-                var e_3, _d;
-                return __generator(this, function (_e) {
-                    switch (_e.label) {
-                        case 0: 
-                        // Switch to the user role, We can't use a prepared statement here, due to limitations in PG not allowing prepared statements to be used in SET LOCAL ROLE
-                        return [4 /*yield*/, tx.$queryRawUnsafe("SET LOCAL ROLE ".concat(batch.pgRole))];
-                        case 1:
-                            // Switch to the user role, We can't use a prepared statement here, due to limitations in PG not allowing prepared statements to be used in SET LOCAL ROLE
-                            _e.sent();
-                            _e.label = 2;
-                        case 2:
-                            _e.trys.push([2, 7, 8, 9]);
-                            _a = __values((0, toPairs_1.default)(batch.context)), _b = _a.next();
-                            _e.label = 3;
-                        case 3:
-                            if (!!_b.done) return [3 /*break*/, 6];
-                            _c = __read(_b.value, 2), key_1 = _c[0], value = _c[1];
-                            return [4 /*yield*/, tx.$queryRaw(templateObject_2 || (templateObject_2 = __makeTemplateObject(["SELECT set_config(", ", ", ", true);"], ["SELECT set_config(", ", ", ", true);"])), key_1, value.toString())];
-                        case 4:
-                            _e.sent();
-                            _e.label = 5;
-                        case 5:
-                            _b = _a.next();
-                            return [3 /*break*/, 3];
-                        case 6: return [3 /*break*/, 9];
-                        case 7:
-                            e_3_1 = _e.sent();
-                            e_3 = { error: e_3_1 };
-                            return [3 /*break*/, 9];
-                        case 8:
-                            try {
-                                if (_b && !_b.done && (_d = _a.return)) _d.call(_a);
-                            }
-                            finally { if (e_3) throw e_3.error; }
-                            return [7 /*endfinally*/];
-                        case 9:
-                            txId = tx[Symbol.for("prisma.client.transaction.id")];
-                            return [4 /*yield*/, Promise.all(batch.requests.map(function (request) {
-                                    return prisma._executeRequest(__assign(__assign({}, request.params), { transaction: {
-                                            kind: "itx",
-                                            id: txId,
-                                        } }));
-                                }))];
-                        case 10:
-                            results = _e.sent();
-                            return [2 /*return*/, results];
-                    }
-                });
-            }); }, {
-                maxWait: txMaxWait,
-                timeout: txTimeout,
-            })
-                .then(function (results) {
-                results.forEach(function (result, index) {
-                    batch.requests[index].resolve(result);
-                });
-            })
-                .catch(function (e) {
-                var e_4, _a;
-                try {
-                    for (var _b = (e_4 = void 0, __values(batch.requests)), _c = _b.next(); !_c.done; _c = _b.next()) {
-                        var request = _c.value;
-                        request.reject(e);
+    if ("notIn" in filter) {
+        return Array.isArray(filter.notIn) && !filter.notIn.includes(value);
+    }
+    if ("lt" in filter)
+        return value < filter.lt;
+    if ("lte" in filter)
+        return value <= filter.lte;
+    if ("gt" in filter)
+        return value > filter.gt;
+    if ("gte" in filter)
+        return value >= filter.gte;
+    if ("contains" in filter)
+        return typeof value === "string" && value.includes(filter.contains);
+    if ("startsWith" in filter)
+        return typeof value === "string" && value.startsWith(filter.startsWith);
+    if ("endsWith" in filter)
+        return typeof value === "string" && value.endsWith(filter.endsWith);
+    if ("not" in filter)
+        return !matchesScalarFilter(value, filter.not, data);
+    return value === filter;
+};
+var getRelationConstraints = function (data, fieldData) {
+    var e_3, _a;
+    var _b, _c;
+    var constraints = [];
+    var relationInput = data[fieldData.name];
+    if (isPlainObject(relationInput)) {
+        var connect = relationInput.connect;
+        if (connect) {
+            var items = Array.isArray(connect) ? connect : [connect];
+            try {
+                for (var items_1 = __values(items), items_1_1 = items_1.next(); !items_1_1.done; items_1_1 = items_1.next()) {
+                    var item = items_1_1.value;
+                    if (isPlainObject(item)) {
+                        constraints.push(item);
                     }
                 }
-                catch (e_4_1) { e_4 = { error: e_4_1 }; }
-                finally {
-                    try {
-                        if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
-                    }
-                    finally { if (e_4) throw e_4.error; }
+            }
+            catch (e_3_1) { e_3 = { error: e_3_1 }; }
+            finally {
+                try {
+                    if (items_1_1 && !items_1_1.done && (_a = items_1.return)) _a.call(items_1);
                 }
-                delete batches[key];
-            });
-        };
-        try {
-            for (var _b = __values(Object.entries(batches)), _c = _b.next(); !_c.done; _c = _b.next()) {
-                var _d = __read(_c.value, 2), key = _d[0], batch = _d[1];
-                _loop_1(key, batch);
+                finally { if (e_3) throw e_3.error; }
             }
         }
-        catch (e_2_1) { e_2 = { error: e_2_1 }; }
-        finally {
-            try {
-                if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
-            }
-            finally { if (e_2) throw e_2.error; }
+    }
+    var fromFields = (_b = fieldData.relationFromFields) !== null && _b !== void 0 ? _b : [];
+    var toFields = (_c = fieldData.relationToFields) !== null && _c !== void 0 ? _c : [];
+    if (fromFields.length > 0) {
+        var hasAll = fromFields.every(function (field) { return data[field] !== undefined && data[field] !== null; });
+        if (hasAll) {
+            var where_1 = {};
+            fromFields.forEach(function (fromField, index) {
+                var _a;
+                var toField = (_a = toFields[index]) !== null && _a !== void 0 ? _a : fromField;
+                where_1[toField] = data[fromField];
+            });
+            constraints.push(where_1);
         }
-    };
-    var client = prisma.$extends({
-        name: "Yates client",
-        query: {
-            $allModels: {
-                $allOperations: function (params) {
-                    return __awaiter(this, void 0, void 0, function () {
-                        var model, args, query, operation, ctx, role, context, pgRole, _a, _b, k, _c, _d, v, txId, hash, __internalParams;
-                        var e_5, _e, e_6, _f;
-                        return __generator(this, function (_g) {
-                            model = params.model, args = params.args, query = params.query, operation = params.operation;
-                            if (!model) {
-                                // If the model is not defined, we can't apply RLS
-                                // This can occur when you are making a call with Prisma's $queryRaw method
-                                return [2 /*return*/, query(args)];
-                            }
-                            ctx = getContext();
-                            // If ctx is null, the middleware is explicitly skipped
-                            if (ctx === null) {
-                                return [2 /*return*/, query(args)];
-                            }
-                            role = ctx.role, context = ctx.context;
-                            pgRole = (0, exports.createRoleName)(role);
-                            if (context) {
-                                try {
-                                    for (_a = __values(Object.keys(context)), _b = _a.next(); !_b.done; _b = _a.next()) {
-                                        k = _b.value;
-                                        if (!k.match(/^[a-z_\.]+$/)) {
-                                            throw new Error("Context variable \"".concat(k, "\" contains invalid characters. Context variables must only contain lowercase letters, numbers, periods and underscores."));
-                                        }
-                                        if (typeof context[k] !== "number" &&
-                                            typeof context[k] !== "string" &&
-                                            !Array.isArray(context[k])) {
-                                            throw new Error("Context variable \"".concat(k, "\" must be a string, number or array. Got ").concat(typeof context[k]));
-                                        }
-                                        if (Array.isArray(context[k])) {
-                                            try {
-                                                for (_c = (e_6 = void 0, __values(context[k])), _d = _c.next(); !_d.done; _d = _c.next()) {
-                                                    v = _d.value;
-                                                    if (typeof v !== "string") {
-                                                        throw new Error("Context variable \"".concat(k, "\" must be an array of strings. Got ").concat(typeof v));
-                                                    }
-                                                }
-                                            }
-                                            catch (e_6_1) { e_6 = { error: e_6_1 }; }
-                                            finally {
-                                                try {
-                                                    if (_d && !_d.done && (_f = _c.return)) _f.call(_c);
-                                                }
-                                                finally { if (e_6) throw e_6.error; }
-                                            }
-                                            // Cast to a JSON string so that it can be used in RLS expressions
-                                            context[k] = JSON.stringify(context[k]);
-                                        }
-                                    }
-                                }
-                                catch (e_5_1) { e_5 = { error: e_5_1 }; }
-                                finally {
-                                    try {
-                                        if (_b && !_b.done && (_e = _a.return)) _e.call(_a);
-                                    }
-                                    finally { if (e_5) throw e_5.error; }
-                                }
-                            }
-                            txId = hashWithPrefix("yates_tx_", JSON.stringify(ctx));
-                            hash = txId;
-                            if (!batches[hash]) {
-                                // Create a new batch for this role + context combination
-                                batches[hash] = {
-                                    pgRole: pgRole,
-                                    context: context,
-                                    requests: [],
-                                };
-                                // make sure, that we only tick once at a time
-                                if (!tickActive) {
-                                    tickActive = true;
-                                    process.nextTick(function () {
-                                        dispatchBatches();
-                                        tickActive = false;
-                                    });
-                                }
-                            }
-                            __internalParams = params.__internalParams;
-                            // Add the request to the batch, and return a promise that will be resolved or rejected in dispatchBatches
-                            return [2 /*return*/, new Promise(function (resolve, reject) {
-                                    batches[hash].requests.push({
-                                        params: __internalParams,
-                                        query: query,
-                                        args: args,
-                                        resolve: resolve,
-                                        reject: reject,
-                                    });
-                                }).catch(function (e) {
-                                    var _a;
-                                    // Normalize RLS errors to make them a bit more readable.
-                                    if ((_a = e.message) === null || _a === void 0 ? void 0 : _a.includes("new row violates row-level security policy for table")) {
-                                        throw new Error("You do not have permission to perform this action: ".concat(model, ".").concat(operation, "(...)"));
-                                    }
-                                    throw e;
-                                })];
-                        });
-                    });
-                },
-            },
-        },
-    });
-    return client;
+    }
+    return constraints.length > 0 ? constraints : null;
 };
-exports.createClient = createClient;
-var setRLS = function (prisma, table, roleName, slug, ability) { return __awaiter(void 0, void 0, void 0, function () {
-    var operation, rawExpression, description;
-    return __generator(this, function (_a) {
-        switch (_a.label) {
+var matchesRelationFilter = function (prisma, runtimeDataModel, fieldData, data, condition) { return __awaiter(void 0, void 0, void 0, function () {
+    var relatedModel, constraints, relationInput, hasIs, hasIsNot, relationWhere_1, isNegated, constraintWhere_1, combinedWhere_1, delegate_1, record, hasSome, hasEvery, hasNone, operator, relationWhere, constraintWhere, combinedWhere, delegate, record, record, results;
+    var _a, _b, _c, _d;
+    var _e, _f, _g, _h, _j, _k, _l, _m;
+    return __generator(this, function (_o) {
+        switch (_o.label) {
             case 0:
-                operation = ability.operation, rawExpression = ability.expression, description = ability.description;
-                if (!rawExpression) {
-                    throw new Error("Expression must be defined for RLS abilities");
+                relatedModel = fieldData.type;
+                constraints = (_e = getRelationConstraints(data, fieldData)) !== null && _e !== void 0 ? _e : [];
+                relationInput = isPlainObject(condition) ? condition : {};
+                if (!!fieldData.isList) return [3 /*break*/, 2];
+                hasIs = isPlainObject(condition) && "is" in condition;
+                hasIsNot = isPlainObject(condition) && "isNot" in condition;
+                relationWhere_1 = hasIs
+                    ? relationInput.is
+                    : hasIsNot
+                        ? relationInput.isNot
+                        : condition;
+                isNegated = hasIsNot;
+                if (relationWhere_1 === null) {
+                    return [2 /*return*/, isNegated ? constraints.length > 0 : constraints.length === 0];
                 }
-                // Take a lock and run the RLS setup in a transaction to prevent conflicts
-                // in a multi-server environment
-                return [4 /*yield*/, prisma.$transaction(function (tx) { return __awaiter(void 0, void 0, void 0, function () {
-                        var policyName, existingAbilities, existingAbility, shouldUpdateAbilityTable, expression, expression;
-                        return __generator(this, function (_a) {
-                            switch (_a.label) {
-                                case 0: return [4 /*yield*/, takeLock(tx)];
-                                case 1:
-                                    _a.sent();
-                                    policyName = roleName;
-                                    return [4 /*yield*/, tx.$queryRaw(templateObject_3 || (templateObject_3 = __makeTemplateObject(["\n\t\t\tselect * from _yates._yates_abilities where ability_model = ", " and ability_policy_name = ", "\n\t\t"], ["\n\t\t\tselect * from _yates._yates_abilities where ability_model = ", " and ability_policy_name = ", "\n\t\t"])), table, policyName)];
-                                case 2:
-                                    existingAbilities = _a.sent();
-                                    existingAbility = existingAbilities[0];
-                                    shouldUpdateAbilityTable = false;
-                                    if (!!existingAbility) return [3 /*break*/, 8];
-                                    debug("Creating RLS policy for", roleName, "on", table, "for", operation);
-                                    return [4 /*yield*/, (0, expressions_1.expressionToSQL)(rawExpression, table)];
-                                case 3:
-                                    expression = _a.sent();
-                                    if (!(operation === "INSERT")) return [3 /*break*/, 5];
-                                    return [4 /*yield*/, tx.$queryRawUnsafe("\n\t\t\t\tCREATE POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" FOR ").concat(operation, " TO ").concat(roleName, " WITH CHECK (").concat(expression, ");\n\t\t\t"))];
-                                case 4:
-                                    _a.sent();
-                                    return [3 /*break*/, 7];
-                                case 5: return [4 /*yield*/, tx.$queryRawUnsafe("\n\t\t\t\tCREATE POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" FOR ").concat(operation, " TO ").concat(roleName, " USING (").concat(expression, ");\n\t\t\t"))];
-                                case 6:
-                                    _a.sent();
-                                    _a.label = 7;
-                                case 7:
-                                    shouldUpdateAbilityTable = true;
-                                    return [3 /*break*/, 14];
-                                case 8:
-                                    if (!(existingAbility.ability_expression !== rawExpression.toString())) return [3 /*break*/, 14];
-                                    debug("Updating RLS policy for", roleName, "on", table, "for", operation);
-                                    return [4 /*yield*/, (0, expressions_1.expressionToSQL)(rawExpression, table)];
-                                case 9:
-                                    expression = _a.sent();
-                                    if (!(operation === "INSERT")) return [3 /*break*/, 11];
-                                    return [4 /*yield*/, tx.$queryRawUnsafe("\n\t\t\t\tALTER POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" TO ").concat(roleName, " WITH CHECK (").concat(expression, ");\n\t\t\t"))];
-                                case 10:
-                                    _a.sent();
-                                    return [3 /*break*/, 13];
-                                case 11: return [4 /*yield*/, tx.$queryRawUnsafe("\n\t\t\t\tALTER POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" TO ").concat(roleName, " USING (").concat(expression, ");\n\t\t\t"))];
-                                case 12:
-                                    _a.sent();
-                                    _a.label = 13;
-                                case 13:
-                                    shouldUpdateAbilityTable = true;
-                                    _a.label = 14;
-                                case 14:
-                                    if (!shouldUpdateAbilityTable) return [3 /*break*/, 16];
-                                    return [4 /*yield*/, upsertAbility(tx, {
-                                            ability_model: table,
-                                            ability_name: slug,
-                                            ability_policy_name: policyName,
-                                            ability_description: description !== null && description !== void 0 ? description : "",
-                                            ability_operation: operation,
-                                            // We store the string representation of the expression so that
-                                            // we can compare it later without having to recompute the SQL
-                                            ability_expression: rawExpression.toString(),
-                                        })];
-                                case 15:
-                                    _a.sent();
-                                    _a.label = 16;
-                                case 16: return [2 /*return*/];
-                            }
-                        });
-                    }); })];
+                if (constraints.length === 0)
+                    return [2 /*return*/, false];
+                constraintWhere_1 = constraints.length === 1 ? constraints[0] : { OR: constraints };
+                combinedWhere_1 = (_f = mergeWhere(relationWhere_1 !== null && relationWhere_1 !== void 0 ? relationWhere_1 : {}, constraintWhere_1)) !== null && _f !== void 0 ? _f : constraintWhere_1;
+                delegate_1 = prisma[lowerModelName(relatedModel)];
+                return [4 /*yield*/, delegate_1.findFirst({
+                        where: combinedWhere_1,
+                        select: (_a = {}, _a[(_g = getIdField(runtimeDataModel, relatedModel)) !== null && _g !== void 0 ? _g : "id"] = true, _a),
+                    })];
             case 1:
-                // Take a lock and run the RLS setup in a transaction to prevent conflicts
-                // in a multi-server environment
-                _a.sent();
-                return [2 /*return*/];
+                record = _o.sent();
+                return [2 /*return*/, isNegated ? !record : !!record];
+            case 2:
+                hasSome = isPlainObject(condition) && "some" in condition;
+                hasEvery = isPlainObject(condition) && "every" in condition;
+                hasNone = isPlainObject(condition) && "none" in condition;
+                operator = hasEvery ? "every" : hasNone ? "none" : "some";
+                relationWhere = (_h = relationInput[operator]) !== null && _h !== void 0 ? _h : condition;
+                if (constraints.length === 0) {
+                    if (operator === "none")
+                        return [2 /*return*/, true];
+                    if (operator === "every")
+                        return [2 /*return*/, true];
+                    return [2 /*return*/, false];
+                }
+                constraintWhere = constraints.length === 1 ? constraints[0] : { OR: constraints };
+                combinedWhere = (_j = mergeWhere(relationWhere !== null && relationWhere !== void 0 ? relationWhere : {}, constraintWhere)) !== null && _j !== void 0 ? _j : constraintWhere;
+                delegate = prisma[lowerModelName(relatedModel)];
+                if (!(operator === "some")) return [3 /*break*/, 4];
+                return [4 /*yield*/, delegate.findFirst({
+                        where: combinedWhere,
+                        select: (_b = {}, _b[(_k = getIdField(runtimeDataModel, relatedModel)) !== null && _k !== void 0 ? _k : "id"] = true, _b),
+                    })];
+            case 3:
+                record = _o.sent();
+                return [2 /*return*/, !!record];
+            case 4:
+                if (!(operator === "none")) return [3 /*break*/, 6];
+                return [4 /*yield*/, delegate.findFirst({
+                        where: combinedWhere,
+                        select: (_c = {}, _c[(_l = getIdField(runtimeDataModel, relatedModel)) !== null && _l !== void 0 ? _l : "id"] = true, _c),
+                    })];
+            case 5:
+                record = _o.sent();
+                return [2 /*return*/, !record];
+            case 6: return [4 /*yield*/, delegate.findMany({
+                    where: combinedWhere,
+                    select: (_d = {}, _d[(_m = getIdField(runtimeDataModel, relatedModel)) !== null && _m !== void 0 ? _m : "id"] = true, _d),
+                })];
+            case 7:
+                results = _o.sent();
+                return [2 /*return*/, results.length === constraints.length];
         }
     });
 }); };
-var createRoles = function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {
-    var runtimeDataModel, models, diff, defaultAbilities, abilities, models_2, models_2_1, model, ability, operation, roles, pgRoles, existingAbilities, pgPolicies, migratedAbilities, _c, _d, _e, _i, model, table, _loop_2, _f, _g, _h, _j, slug, _loop_3, _k, _l, _m, _o, key;
-    var e_7, _p;
-    var _q;
-    var prisma = _b.prisma, customAbilities = _b.customAbilities, getRoles = _b.getRoles;
-    return __generator(this, function (_r) {
-        switch (_r.label) {
+var matchesCreateWhere = function (prisma, runtimeDataModel, model, data, where) { return __awaiter(void 0, void 0, void 0, function () {
+    var clauses, checks, clauses, checks, clauses, checks, _loop_1, _a, _b, _c, field, condition, state_1, e_4_1;
+    var e_4, _d;
+    return __generator(this, function (_e) {
+        switch (_e.label) {
             case 0:
-                runtimeDataModel = prisma
-                    ._runtimeDataModel;
-                models = Object.keys(runtimeDataModel.models).map(function (m) { return runtimeDataModel.models[m].dbName || m; });
-                if (customAbilities) {
-                    diff = (0, difference_1.default)(Object.keys(customAbilities), models);
-                    if (diff.length) {
-                        throw new Error("Invalid models in custom abilities: ".concat(diff.join(", ")));
-                    }
-                }
-                defaultAbilities = getDefaultAbilities(models);
-                abilities = (0, cloneDeep_1.default)(defaultAbilities);
-                try {
-                    for (models_2 = __values(models), models_2_1 = models_2.next(); !models_2_1.done; models_2_1 = models_2.next()) {
-                        model = models_2_1.value;
-                        if (customAbilities === null || customAbilities === void 0 ? void 0 : customAbilities[model]) {
-                            for (ability in customAbilities[model]) {
-                                operation = 
-                                // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                                (_q = customAbilities[model][ability]) === null || _q === void 0 ? void 0 : _q.operation;
-                                if (!operation)
-                                    continue;
-                                // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                                abilities[model][ability] = __assign(__assign({}, customAbilities[model][ability]), { operation: operation, model: model, slug: ability });
-                            }
-                        }
-                    }
-                }
-                catch (e_7_1) { e_7 = { error: e_7_1 }; }
-                finally {
-                    try {
-                        if (models_2_1 && !models_2_1.done && (_p = models_2.return)) _p.call(models_2);
-                    }
-                    finally { if (e_7) throw e_7.error; }
-                }
-                debug("Setting up ability table");
-                return [4 /*yield*/, setupAbilityTable(prisma)];
+                if (!where.AND) return [3 /*break*/, 2];
+                clauses = Array.isArray(where.AND) ? where.AND : [where.AND];
+                return [4 /*yield*/, Promise.all(clauses.map(function (clause) {
+                        return matchesCreateWhere(prisma, runtimeDataModel, model, data, clause);
+                    }))];
             case 1:
-                _r.sent();
-                roles = getRoles(abilities);
-                return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\tselect * from pg_catalog.pg_roles where rolname like 'yates%'\n\t")];
+                checks = _e.sent();
+                if (!checks.every(Boolean))
+                    return [2 /*return*/, false];
+                _e.label = 2;
             case 2:
-                pgRoles = _r.sent();
-                return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\tselect * from _yates._yates_abilities;\n\t")];
+                if (!where.OR) return [3 /*break*/, 4];
+                clauses = Array.isArray(where.OR) ? where.OR : [where.OR];
+                return [4 /*yield*/, Promise.all(clauses.map(function (clause) {
+                        return matchesCreateWhere(prisma, runtimeDataModel, model, data, clause);
+                    }))];
             case 3:
-                existingAbilities = _r.sent();
-                if (!(existingAbilities.length === 0)) return [3 /*break*/, 6];
-                debug('No existing abilities found, importing from "pg_policies" table');
-                return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\tselect * from pg_catalog.pg_policies where policyname like 'yates%'\n\t\t")];
+                checks = _e.sent();
+                if (!checks.some(Boolean))
+                    return [2 /*return*/, false];
+                _e.label = 4;
             case 4:
-                pgPolicies = _r.sent();
-                if (!pgPolicies.length) return [3 /*break*/, 6];
-                migratedAbilities = pgPolicies.map(function (policy) {
-                    var _a, _b;
-                    return ({
-                        ability_model: policy.tablename,
-                        ability_name: policy.policyname,
-                        ability_policy_name: policy.policyname,
-                        ability_description: "",
-                        ability_operation: policy.cmd,
-                        ability_expression: (_b = (_a = policy.qual) !== null && _a !== void 0 ? _a : policy.with_check) !== null && _b !== void 0 ? _b : "",
-                    });
-                });
-                return [4 /*yield*/, prisma.$transaction(__spreadArray([
-                        takeLock(prisma)
-                    ], __read(migratedAbilities.map(function (ma) { return upsertAbility(prisma, ma); })), false))];
+                if (!where.NOT) return [3 /*break*/, 6];
+                clauses = Array.isArray(where.NOT) ? where.NOT : [where.NOT];
+                return [4 /*yield*/, Promise.all(clauses.map(function (clause) {
+                        return matchesCreateWhere(prisma, runtimeDataModel, model, data, clause);
+                    }))];
             case 5:
-                _r.sent();
-                existingAbilities.push.apply(existingAbilities, __spreadArray([], __read(migratedAbilities), false));
-                _r.label = 6;
+                checks = _e.sent();
+                if (checks.some(Boolean))
+                    return [2 /*return*/, false];
+                _e.label = 6;
             case 6:
-                _c = abilities;
-                _d = [];
-                for (_e in _c)
-                    _d.push(_e);
-                _i = 0;
-                _r.label = 7;
+                _loop_1 = function (field, condition) {
+                    var modelData, fieldData, ok, value;
+                    return __generator(this, function (_f) {
+                        switch (_f.label) {
+                            case 0:
+                                if (field === "AND" || field === "OR" || field === "NOT")
+                                    return [2 /*return*/, "continue"];
+                                modelData = runtimeDataModel.models[model];
+                                fieldData = modelData === null || modelData === void 0 ? void 0 : modelData.fields.find(function (f) { return f.name === field; });
+                                if (!fieldData)
+                                    return [2 /*return*/, "continue"];
+                                if (!(fieldData.kind === "object")) return [3 /*break*/, 2];
+                                return [4 /*yield*/, matchesRelationFilter(prisma, runtimeDataModel, fieldData, data, condition)];
+                            case 1:
+                                ok = _f.sent();
+                                if (!ok)
+                                    return [2 /*return*/, { value: false }];
+                                return [2 /*return*/, "continue"];
+                            case 2:
+                                value = data[field];
+                                if (!matchesScalarFilter(value, condition, data))
+                                    return [2 /*return*/, { value: false }];
+                                return [2 /*return*/];
+                        }
+                    });
+                };
+                _e.label = 7;
             case 7:
-                if (!(_i < _d.length)) return [3 /*break*/, 13];
-                _e = _d[_i];
-                if (!(_e in _c)) return [3 /*break*/, 12];
-                model = _e;
-                table = model;
-                return [4 /*yield*/, prisma.$transaction([
-                        takeLock(prisma),
-                        prisma.$queryRawUnsafe("ALTER table \"".concat(table, "\" enable row level security;")),
-                    ])];
+                _e.trys.push([7, 12, 13, 14]);
+                _a = __values(Object.entries(where)), _b = _a.next();
+                _e.label = 8;
             case 8:
-                _r.sent();
-                _loop_2 = function (slug) {
-                    var ability, roleName;
-                    return __generator(this, function (_s) {
-                        switch (_s.label) {
+                if (!!_b.done) return [3 /*break*/, 11];
+                _c = __read(_b.value, 2), field = _c[0], condition = _c[1];
+                return [5 /*yield**/, _loop_1(field, condition)];
+            case 9:
+                state_1 = _e.sent();
+                if (typeof state_1 === "object")
+                    return [2 /*return*/, state_1.value];
+                _e.label = 10;
+            case 10:
+                _b = _a.next();
+                return [3 /*break*/, 8];
+            case 11: return [3 /*break*/, 14];
+            case 12:
+                e_4_1 = _e.sent();
+                e_4 = { error: e_4_1 };
+                return [3 /*break*/, 14];
+            case 13:
+                try {
+                    if (_b && !_b.done && (_d = _a.return)) _d.call(_a);
+                }
+                finally { if (e_4) throw e_4.error; }
+                return [7 /*endfinally*/];
+            case 14: return [2 /*return*/, true];
+        }
+    });
+}); };
+var extractModelFields = function (runtimeDataModel, model) {
+    var _a;
+    var modelData = runtimeDataModel.models[model];
+    return (_a = modelData === null || modelData === void 0 ? void 0 : modelData.fields) !== null && _a !== void 0 ? _a : [];
+};
+var buildRowHelper = function (prisma, runtimeDataModel, model) {
+    return (function (col) {
+        var _a;
+        var modelData = runtimeDataModel.models[model];
+        if (!modelData) {
+            throw new Error("Could not retrieve model data for '".concat(model, "'"));
+        }
+        var fieldData = modelData.fields.find(function (field) { return field.name === col; });
+        if (!fieldData) {
+            throw new Error("Could not retrieve field data from Prisma Client for field '".concat(model, ".").concat(col, "'"));
+        }
+        var delegate = prisma[lowerModelName(model)];
+        var fieldRef = (_a = delegate === null || delegate === void 0 ? void 0 : delegate.fields) === null || _a === void 0 ? void 0 : _a[col];
+        if (!fieldRef) {
+            throw new Error("Could not resolve field reference for '".concat(model, ".").concat(col, "'"));
+        }
+        return fieldRef;
+    });
+};
+var buildContextHelper = function (context) {
+    return (function (key) {
+        return context ? context[key] : undefined;
+    });
+};
+var resolveExpression = function (prisma, runtimeDataModel, model, expression, context) { return __awaiter(void 0, void 0, void 0, function () {
+    var row, ctx;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                if (!expression)
+                    return [2 /*return*/, {}];
+                if (typeof expression !== "function")
+                    return [2 /*return*/, expression];
+                row = buildRowHelper(prisma, runtimeDataModel, model);
+                ctx = buildContextHelper(context);
+                return [4 /*yield*/, expression(prisma, row, ctx)];
+            case 1: return [2 /*return*/, (_a.sent())];
+        }
+    });
+}); };
+var dedupeAbilityList = function (abilityList) {
+    var seen = new Set();
+    return abilityList.filter(function (ability) {
+        if (seen.has(ability)) {
+            return false;
+        }
+        seen.add(ability);
+        return true;
+    });
+};
+var buildRoleAbilities = function (roles, allAbilities) {
+    var e_5, _a;
+    var roleAbilities = {};
+    try {
+        for (var _b = __values(Object.entries(roles)), _c = _b.next(); !_c.done; _c = _b.next()) {
+            var _d = __read(_c.value, 2), role = _d[0], abilities = _d[1];
+            var abilityList = abilities === "*"
+                ? allAbilities
+                : abilities;
+            roleAbilities[role] = dedupeAbilityList(abilityList);
+        }
+    }
+    catch (e_5_1) { e_5 = { error: e_5_1 }; }
+    finally {
+        try {
+            if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+        }
+        finally { if (e_5) throw e_5.error; }
+    }
+    return roleAbilities;
+};
+var getAbilityFilters = function (prisma, runtimeDataModel, roleAbilities, role, model, operation, context) { return __awaiter(void 0, void 0, void 0, function () {
+    var abilities, relevant;
+    return __generator(this, function (_a) {
+        abilities = roleAbilities[role] || [];
+        relevant = abilities.filter(function (ability) { return ability.model === model && ability.operation === operation; });
+        if (relevant.length === 0) {
+            return [2 /*return*/, []];
+        }
+        return [2 /*return*/, Promise.all(relevant.map(function (ability) {
+                return resolveExpression(prisma, runtimeDataModel, model, ability.expression, context);
+            }))];
+    });
+}); };
+var applyReadSelections = function (prisma, runtimeDataModel, roleAbilities, role, model, args, context) { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b, key, selection, _loop_2, _c, _d, _e, field, value, e_6_1, e_7_1;
+    var e_7, _f, e_6, _g;
+    var _h;
+    return __generator(this, function (_j) {
+        switch (_j.label) {
+            case 0:
+                _j.trys.push([0, 11, 12, 13]);
+                _a = __values(["include", "select"]), _b = _a.next();
+                _j.label = 1;
+            case 1:
+                if (!!_b.done) return [3 /*break*/, 10];
+                key = _b.value;
+                selection = args[key];
+                if (!selection || !isPlainObject(selection))
+                    return [3 /*break*/, 9];
+                _loop_2 = function (field, value) {
+                    var fields, fieldMeta, relatedModel, abilityFilters, abilityWhere, nextArgs;
+                    return __generator(this, function (_k) {
+                        switch (_k.label) {
                             case 0:
-                                ability = 
-                                // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                                abilities[model][slug];
-                                if (!VALID_OPERATIONS.includes(ability.operation)) {
-                                    throw new Error("Invalid operation: ".concat(ability.operation));
+                                fields = extractModelFields(runtimeDataModel, model);
+                                fieldMeta = fields.find(function (f) { return f.name === field; });
+                                if (!fieldMeta || fieldMeta.kind !== "object")
+                                    return [2 /*return*/, "continue"];
+                                relatedModel = fieldMeta.type;
+                                return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "SELECT", context)];
+                            case 1:
+                                abilityFilters = _k.sent();
+                                if (!abilityFilters || abilityFilters.length === 0) {
+                                    selection[field] = false;
+                                    return [2 /*return*/, "continue"];
+                                }
+                                abilityWhere = combineAbilityFilters(abilityFilters);
+                                nextArgs = value === true ? {} : __assign({}, value);
+                                if (fieldMeta.isList) {
+                                    nextArgs.where =
+                                        (_h = mergeWhere(nextArgs.where, abilityWhere)) !== null && _h !== void 0 ? _h : nextArgs.where;
                                 }
-                                roleName = (0, exports.createAbilityName)(model, slug);
-                                if (!pgRoles.find(function (role) { return role.rolname === roleName; })) return [3 /*break*/, 1];
-                                debug("Role already exists", roleName, model, slug);
-                                return [3 /*break*/, 3];
-                            case 1: return [4 /*yield*/, prisma.$transaction([
-                                    takeLock(prisma),
-                                    prisma.$queryRawUnsafe("\n\t\t\t\t\tdo\n\t\t\t\t\t$$\n\t\t\t\t\tbegin\n\t\t\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(roleName, "') then \n\t\t\t\t\t\tcreate role ").concat(roleName, ";\n\t\t\t\t\tend if;\n\t\t\t\t\tend\n\t\t\t\t\t$$\n\t\t\t\t\t;\n\t\t\t\t")),
-                                    prisma.$queryRawUnsafe("\n\t\t\t\t\tGRANT ".concat(ability.operation, " ON \"").concat(table, "\" TO ").concat(roleName, ";\n\t\t\t\t")),
-                                ])];
+                                return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, relatedModel, nextArgs, context)];
                             case 2:
-                                _s.sent();
-                                _s.label = 3;
-                            case 3:
-                                if (!ability.expression) return [3 /*break*/, 5];
-                                return [4 /*yield*/, setRLS(prisma, table, roleName, slug, ability)];
-                            case 4:
-                                _s.sent();
-                                _s.label = 5;
-                            case 5: return [2 /*return*/];
+                                _k.sent();
+                                selection[field] = nextArgs;
+                                return [2 /*return*/];
                         }
                     });
                 };
-                _f = abilities[model];
-                _g = [];
-                for (_h in _f)
-                    _g.push(_h);
-                _j = 0;
-                _r.label = 9;
+                _j.label = 2;
+            case 2:
+                _j.trys.push([2, 7, 8, 9]);
+                _c = (e_6 = void 0, __values(Object.entries(selection))), _d = _c.next();
+                _j.label = 3;
+            case 3:
+                if (!!_d.done) return [3 /*break*/, 6];
+                _e = __read(_d.value, 2), field = _e[0], value = _e[1];
+                return [5 /*yield**/, _loop_2(field, value)];
+            case 4:
+                _j.sent();
+                _j.label = 5;
+            case 5:
+                _d = _c.next();
+                return [3 /*break*/, 3];
+            case 6: return [3 /*break*/, 9];
+            case 7:
+                e_6_1 = _j.sent();
+                e_6 = { error: e_6_1 };
+                return [3 /*break*/, 9];
+            case 8:
+                try {
+                    if (_d && !_d.done && (_g = _c.return)) _g.call(_c);
+                }
+                finally { if (e_6) throw e_6.error; }
+                return [7 /*endfinally*/];
             case 9:
-                if (!(_j < _g.length)) return [3 /*break*/, 12];
-                _h = _g[_j];
-                if (!(_h in _f)) return [3 /*break*/, 11];
-                slug = _h;
-                return [5 /*yield**/, _loop_2(slug)];
-            case 10:
-                _r.sent();
-                _r.label = 11;
+                _b = _a.next();
+                return [3 /*break*/, 1];
+            case 10: return [3 /*break*/, 13];
             case 11:
-                _j++;
-                return [3 /*break*/, 9];
+                e_7_1 = _j.sent();
+                e_7 = { error: e_7_1 };
+                return [3 /*break*/, 13];
             case 12:
-                _i++;
-                return [3 /*break*/, 7];
-            case 13:
-                _loop_3 = function (key) {
-                    var role, wildCardAbilities, roleAbilities, rlsRoles, userRoles, oldRoles, policies;
-                    return __generator(this, function (_t) {
-                        switch (_t.label) {
+                try {
+                    if (_b && !_b.done && (_f = _a.return)) _f.call(_a);
+                }
+                finally { if (e_7) throw e_7.error; }
+                return [7 /*endfinally*/];
+            case 13: return [2 /*return*/];
+        }
+    });
+}); };
+var assertCreateAllowed = function (prisma, runtimeDataModel, roleAbilities, role, model, data, context) { return __awaiter(void 0, void 0, void 0, function () {
+    var abilityFilters, abilityWhere;
+    var _a;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0: return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "INSERT", context)];
+            case 1:
+                abilityFilters = (_a = (_b.sent())) !== null && _a !== void 0 ? _a : [];
+                abilityWhere = combineAbilityFilters(abilityFilters);
+                if (!abilityWhere) {
+                    throw permissionError(model, "create");
+                }
+                if (isEmptyWhere(abilityWhere))
+                    return [2 /*return*/];
+                return [4 /*yield*/, matchesCreateWhere(prisma, runtimeDataModel, model, data, abilityWhere)];
+            case 2:
+                if (!(_b.sent())) {
+                    throw permissionError(model, "create");
+                }
+                return [2 /*return*/];
+        }
+    });
+}); };
+var assertRecordAllowed = function (prisma, runtimeDataModel, roleAbilities, role, model, operation, where, context) { return __awaiter(void 0, void 0, void 0, function () {
+    var abilityFilters, abilityWhere, combinedWhere, delegate, record;
+    var _a;
+    var _b, _c, _d;
+    return __generator(this, function (_e) {
+        switch (_e.label) {
+            case 0: return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, operation, context)];
+            case 1:
+                abilityFilters = (_b = (_e.sent())) !== null && _b !== void 0 ? _b : [];
+                abilityWhere = combineAbilityFilters(abilityFilters);
+                if (!abilityWhere) {
+                    return [2 /*return*/, false];
+                }
+                combinedWhere = (_c = mergeWhere(where, abilityWhere)) !== null && _c !== void 0 ? _c : where;
+                delegate = prisma[lowerModelName(model)];
+                return [4 /*yield*/, delegate.findFirst({
+                        where: combinedWhere,
+                        select: (_a = {}, _a[(_d = getIdField(runtimeDataModel, model)) !== null && _d !== void 0 ? _d : "id"] = true, _a),
+                    })];
+            case 2:
+                record = _e.sent();
+                return [2 /*return*/, !!record];
+        }
+    });
+}); };
+var applyNestedWrites = function (prisma, runtimeDataModel, roleAbilities, role, model, data, context) { return __awaiter(void 0, void 0, void 0, function () {
+    var fields, _loop_3, _a, _b, _c, field, value, e_8_1;
+    var e_8, _d;
+    var _e, _f, _g, _h, _j, _k;
+    return __generator(this, function (_l) {
+        switch (_l.label) {
+            case 0:
+                if (!isPlainObject(data))
+                    return [2 /*return*/];
+                fields = extractModelFields(runtimeDataModel, model);
+                _loop_3 = function (field, value) {
+                    var fieldMeta, relatedModel, handleCreate, handleUpdate, handleDelete, items, items_2, items_2_1, item, filters, abilityWhere, e_9_1, items, items_3, items_3_1, item, where, canUpdate, e_10_1, items, items_4, items_4_1, item, filters, abilityWhere, _m, _o, key, merged, _p, _q, key, e_11_1;
+                    var e_9, _r, e_10, _s, e_11, _t, e_12, _u, e_13, _v;
+                    return __generator(this, function (_w) {
+                        switch (_w.label) {
                             case 0:
-                                role = (0, exports.createRoleName)(key);
-                                return [4 /*yield*/, prisma.$executeRawUnsafe("\n\t\t\tdo\n\t\t\t$$\n\t\t\tbegin\n\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(role, "') then \n\t\t\t\tcreate role ").concat(role, ";\n\t\t\tend if;\n\t\t\tend\n\t\t\t$$\n\t\t\t;\n\t\t"))];
-                            case 1:
-                                _t.sent();
-                                wildCardAbilities = (0, flatMap_1.default)(defaultAbilities, function (model, modelName) {
-                                    return (0, map_1.default)(model, function (_params, slug) {
-                                        return (0, exports.createAbilityName)(modelName, slug);
+                                fieldMeta = fields.find(function (f) { return f.name === field; });
+                                if (!fieldMeta || fieldMeta.kind !== "object")
+                                    return [2 /*return*/, "continue"];
+                                relatedModel = fieldMeta.type;
+                                if (!isPlainObject(value))
+                                    return [2 /*return*/, "continue"];
+                                handleCreate = function (createValue) { return __awaiter(void 0, void 0, void 0, function () {
+                                    var items, items_5, items_5_1, item, e_14_1;
+                                    var e_14, _a;
+                                    return __generator(this, function (_b) {
+                                        switch (_b.label) {
+                                            case 0:
+                                                items = Array.isArray(createValue) ? createValue : [createValue];
+                                                _b.label = 1;
+                                            case 1:
+                                                _b.trys.push([1, 7, 8, 9]);
+                                                items_5 = __values(items), items_5_1 = items_5.next();
+                                                _b.label = 2;
+                                            case 2:
+                                                if (!!items_5_1.done) return [3 /*break*/, 6];
+                                                item = items_5_1.value;
+                                                if (!isPlainObject(item)) return [3 /*break*/, 5];
+                                                return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item, context)];
+                                            case 3:
+                                                _b.sent();
+                                                return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item, context)];
+                                            case 4:
+                                                _b.sent();
+                                                _b.label = 5;
+                                            case 5:
+                                                items_5_1 = items_5.next();
+                                                return [3 /*break*/, 2];
+                                            case 6: return [3 /*break*/, 9];
+                                            case 7:
+                                                e_14_1 = _b.sent();
+                                                e_14 = { error: e_14_1 };
+                                                return [3 /*break*/, 9];
+                                            case 8:
+                                                try {
+                                                    if (items_5_1 && !items_5_1.done && (_a = items_5.return)) _a.call(items_5);
+                                                }
+                                                finally { if (e_14) throw e_14.error; }
+                                                return [7 /*endfinally*/];
+                                            case 9: return [2 /*return*/];
+                                        }
                                     });
-                                });
-                                roleAbilities = roles[key];
-                                rlsRoles = roleAbilities === "*"
-                                    ? wildCardAbilities
-                                    : roleAbilities.map(function (ability) {
-                                        // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                                        return (0, exports.createAbilityName)(ability.model, ability.slug);
+                                }); };
+                                handleUpdate = function (updateValue) { return __awaiter(void 0, void 0, void 0, function () {
+                                    var items, items_6, items_6_1, item, where, allowed, e_15_1;
+                                    var e_15, _a;
+                                    var _b;
+                                    return __generator(this, function (_c) {
+                                        switch (_c.label) {
+                                            case 0:
+                                                items = Array.isArray(updateValue) ? updateValue : [updateValue];
+                                                _c.label = 1;
+                                            case 1:
+                                                _c.trys.push([1, 7, 8, 9]);
+                                                items_6 = __values(items), items_6_1 = items_6.next();
+                                                _c.label = 2;
+                                            case 2:
+                                                if (!!items_6_1.done) return [3 /*break*/, 6];
+                                                item = items_6_1.value;
+                                                if (!isPlainObject(item))
+                                                    return [3 /*break*/, 5];
+                                                where = (_b = item.where) !== null && _b !== void 0 ? _b : {};
+                                                return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "UPDATE", where, context)];
+                                            case 3:
+                                                allowed = _c.sent();
+                                                if (!allowed) {
+                                                    throw updateNotFoundError();
+                                                }
+                                                if (!item.data) return [3 /*break*/, 5];
+                                                return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.data, context)];
+                                            case 4:
+                                                _c.sent();
+                                                _c.label = 5;
+                                            case 5:
+                                                items_6_1 = items_6.next();
+                                                return [3 /*break*/, 2];
+                                            case 6: return [3 /*break*/, 9];
+                                            case 7:
+                                                e_15_1 = _c.sent();
+                                                e_15 = { error: e_15_1 };
+                                                return [3 /*break*/, 9];
+                                            case 8:
+                                                try {
+                                                    if (items_6_1 && !items_6_1.done && (_a = items_6.return)) _a.call(items_6);
+                                                }
+                                                finally { if (e_15) throw e_15.error; }
+                                                return [7 /*endfinally*/];
+                                            case 9: return [2 /*return*/];
+                                        }
+                                    });
+                                }); };
+                                handleDelete = function (deleteValue) { return __awaiter(void 0, void 0, void 0, function () {
+                                    var items, items_7, items_7_1, item, where, allowed, e_16_1;
+                                    var e_16, _a;
+                                    return __generator(this, function (_b) {
+                                        switch (_b.label) {
+                                            case 0:
+                                                items = Array.isArray(deleteValue) ? deleteValue : [deleteValue];
+                                                _b.label = 1;
+                                            case 1:
+                                                _b.trys.push([1, 6, 7, 8]);
+                                                items_7 = __values(items), items_7_1 = items_7.next();
+                                                _b.label = 2;
+                                            case 2:
+                                                if (!!items_7_1.done) return [3 /*break*/, 5];
+                                                item = items_7_1.value;
+                                                where = isPlainObject(item) ? item : {};
+                                                return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "DELETE", where, context)];
+                                            case 3:
+                                                allowed = _b.sent();
+                                                if (!allowed) {
+                                                    throw deleteNotFoundError();
+                                                }
+                                                _b.label = 4;
+                                            case 4:
+                                                items_7_1 = items_7.next();
+                                                return [3 /*break*/, 2];
+                                            case 5: return [3 /*break*/, 8];
+                                            case 6:
+                                                e_16_1 = _b.sent();
+                                                e_16 = { error: e_16_1 };
+                                                return [3 /*break*/, 8];
+                                            case 7:
+                                                try {
+                                                    if (items_7_1 && !items_7_1.done && (_a = items_7.return)) _a.call(items_7);
+                                                }
+                                                finally { if (e_16) throw e_16.error; }
+                                                return [7 /*endfinally*/];
+                                            case 8: return [2 /*return*/];
+                                        }
                                     });
-                                debug("Setting up role", key, role, "with abilities", rlsRoles.join(", "));
-                                // Note: We need to GRANT all on schema public so that we can resolve relation queries with prisma, as they will sometimes use a join table.
-                                // This is not ideal, but because we are using RLS, it's not a security risk. Any table with RLS also needs a corresponding policy for the role to have access.
-                                return [4 /*yield*/, prisma.$transaction([
-                                        takeLock(prisma),
-                                        prisma.$executeRawUnsafe("GRANT ALL ON ALL TABLES IN SCHEMA public TO ".concat(role, ";")),
-                                        prisma.$executeRawUnsafe("\n\t\t\t\tGRANT ALL ON ALL SEQUENCES IN SCHEMA public TO ".concat(role, ";\n\t\t\t")),
-                                        prisma.$executeRawUnsafe("\n\t\t\t\tGRANT ALL ON SCHEMA public TO ".concat(role, ";\n\t\t\t")),
-                                        prisma.$queryRawUnsafe("GRANT ".concat(rlsRoles.join(", "), " TO ").concat(role)),
-                                    ])];
+                                }); };
+                                if (!value.create) return [3 /*break*/, 2];
+                                return [4 /*yield*/, handleCreate(value.create)];
+                            case 1:
+                                _w.sent();
+                                _w.label = 2;
                             case 2:
-                                // Note: We need to GRANT all on schema public so that we can resolve relation queries with prisma, as they will sometimes use a join table.
-                                // This is not ideal, but because we are using RLS, it's not a security risk. Any table with RLS also needs a corresponding policy for the role to have access.
-                                _t.sent();
-                                return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\tWITH RECURSIVE cte AS (\n\t\t\t\tSELECT oid FROM pg_roles where rolname = '".concat(role, "'\n\t\t\t\tUNION ALL\n\t\t\t\tSELECT m.roleid\n\t\t\t\tFROM   cte\n\t\t\t\tJOIN   pg_auth_members m ON m.member = cte.oid\n\t\t\t\t)\n\t\t\tSELECT oid, oid::regrole::text AS rolename FROM cte where oid::regrole::text != '").concat(role, "'; \n\t "))];
+                                if (!((_e = value.createMany) === null || _e === void 0 ? void 0 : _e.data)) return [3 /*break*/, 4];
+                                return [4 /*yield*/, handleCreate(value.createMany.data)];
                             case 3:
-                                userRoles = _t.sent();
-                                oldRoles = userRoles
-                                    .filter(function (_a) {
-                                    var rolename = _a.rolename;
-                                    return !rlsRoles.includes(rolename);
-                                })
-                                    .map(function (_a) {
-                                    var rolename = _a.rolename;
-                                    return rolename;
-                                });
-                                if (!oldRoles.length) return [3 /*break*/, 8];
-                                // Now revoke old roles from the user role
-                                debug("Revoking old roles", key, role, oldRoles.join(", "));
-                                return [4 /*yield*/, prisma.$executeRawUnsafe("REVOKE ".concat(oldRoles.join(", "), " FROM ").concat(role))];
+                                _w.sent();
+                                _w.label = 4;
                             case 4:
-                                _t.sent();
-                                return [4 /*yield*/, prisma.$queryRawUnsafe("SELECT * FROM pg_catalog.pg_policies WHERE policyname IN (".concat(oldRoles
-                                        .map(function (or) { return "'".concat(or, "'"); })
-                                        .join(", "), ")"))];
+                                if (!value.update) return [3 /*break*/, 6];
+                                return [4 /*yield*/, handleUpdate(value.update)];
                             case 5:
-                                policies = _t.sent();
-                                return [4 /*yield*/, prisma.$transaction(__spreadArray([
-                                        takeLock(prisma)
-                                    ], __read(policies.map(function (oldPolicy) {
-                                        return prisma.$executeRawUnsafe("DROP POLICY ".concat(oldPolicy.policyname, " ON \"").concat(oldPolicy.tablename, "\""));
-                                    })), false))];
+                                _w.sent();
+                                _w.label = 6;
                             case 6:
-                                _t.sent();
-                                debug("Revoked old rows from ability table", oldRoles.join(", "));
-                                return [4 /*yield*/, prisma.$executeRawUnsafe("DELETE FROM _yates._yates_abilities WHERE ability_policy_name IN (".concat(oldRoles
-                                        .map(function (or) { return "'".concat(or, "'"); })
-                                        .join(", "), ")"))];
+                                if (!value.updateMany) return [3 /*break*/, 15];
+                                items = Array.isArray(value.updateMany)
+                                    ? value.updateMany
+                                    : [value.updateMany];
+                                _w.label = 7;
                             case 7:
-                                _t.sent();
-                                _t.label = 8;
-                            case 8: return [2 /*return*/];
+                                _w.trys.push([7, 13, 14, 15]);
+                                items_2 = (e_9 = void 0, __values(items)), items_2_1 = items_2.next();
+                                _w.label = 8;
+                            case 8:
+                                if (!!items_2_1.done) return [3 /*break*/, 12];
+                                item = items_2_1.value;
+                                if (!isPlainObject(item))
+                                    return [3 /*break*/, 11];
+                                return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "UPDATE", context)];
+                            case 9:
+                                filters = (_f = (_w.sent())) !== null && _f !== void 0 ? _f : [];
+                                abilityWhere = combineAbilityFilters(filters);
+                                if (!abilityWhere) {
+                                    item.where = denyWhere(runtimeDataModel, relatedModel);
+                                }
+                                else {
+                                    item.where = (_h = mergeWhere((_g = item.where) !== null && _g !== void 0 ? _g : {}, abilityWhere)) !== null && _h !== void 0 ? _h : item.where;
+                                }
+                                if (!item.data) return [3 /*break*/, 11];
+                                return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.data, context)];
+                            case 10:
+                                _w.sent();
+                                _w.label = 11;
+                            case 11:
+                                items_2_1 = items_2.next();
+                                return [3 /*break*/, 8];
+                            case 12: return [3 /*break*/, 15];
+                            case 13:
+                                e_9_1 = _w.sent();
+                                e_9 = { error: e_9_1 };
+                                return [3 /*break*/, 15];
+                            case 14:
+                                try {
+                                    if (items_2_1 && !items_2_1.done && (_r = items_2.return)) _r.call(items_2);
+                                }
+                                finally { if (e_9) throw e_9.error; }
+                                return [7 /*endfinally*/];
+                            case 15:
+                                if (!value.upsert) return [3 /*break*/, 29];
+                                items = Array.isArray(value.upsert) ? value.upsert : [value.upsert];
+                                _w.label = 16;
+                            case 16:
+                                _w.trys.push([16, 27, 28, 29]);
+                                items_3 = (e_10 = void 0, __values(items)), items_3_1 = items_3.next();
+                                _w.label = 17;
+                            case 17:
+                                if (!!items_3_1.done) return [3 /*break*/, 26];
+                                item = items_3_1.value;
+                                if (!isPlainObject(item))
+                                    return [3 /*break*/, 25];
+                                where = (_j = item.where) !== null && _j !== void 0 ? _j : {};
+                                return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "UPDATE", where, context)];
+                            case 18:
+                                canUpdate = _w.sent();
+                                if (!canUpdate) return [3 /*break*/, 21];
+                                if (!item.update) return [3 /*break*/, 20];
+                                return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.update, context)];
+                            case 19:
+                                _w.sent();
+                                _w.label = 20;
+                            case 20: return [3 /*break*/, 25];
+                            case 21:
+                                if (!item.create) return [3 /*break*/, 24];
+                                return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.create, context)];
+                            case 22:
+                                _w.sent();
+                                return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.create, context)];
+                            case 23:
+                                _w.sent();
+                                return [3 /*break*/, 25];
+                            case 24: throw updateNotFoundError();
+                            case 25:
+                                items_3_1 = items_3.next();
+                                return [3 /*break*/, 17];
+                            case 26: return [3 /*break*/, 29];
+                            case 27:
+                                e_10_1 = _w.sent();
+                                e_10 = { error: e_10_1 };
+                                return [3 /*break*/, 29];
+                            case 28:
+                                try {
+                                    if (items_3_1 && !items_3_1.done && (_s = items_3.return)) _s.call(items_3);
+                                }
+                                finally { if (e_10) throw e_10.error; }
+                                return [7 /*endfinally*/];
+                            case 29:
+                                if (!value.delete) return [3 /*break*/, 31];
+                                return [4 /*yield*/, handleDelete(value.delete)];
+                            case 30:
+                                _w.sent();
+                                _w.label = 31;
+                            case 31:
+                                if (!value.deleteMany) return [3 /*break*/, 39];
+                                items = Array.isArray(value.deleteMany)
+                                    ? value.deleteMany
+                                    : [value.deleteMany];
+                                _w.label = 32;
+                            case 32:
+                                _w.trys.push([32, 37, 38, 39]);
+                                items_4 = (e_11 = void 0, __values(items)), items_4_1 = items_4.next();
+                                _w.label = 33;
+                            case 33:
+                                if (!!items_4_1.done) return [3 /*break*/, 36];
+                                item = items_4_1.value;
+                                if (!isPlainObject(item))
+                                    return [3 /*break*/, 35];
+                                return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "DELETE", context)];
+                            case 34:
+                                filters = (_k = (_w.sent())) !== null && _k !== void 0 ? _k : [];
+                                abilityWhere = combineAbilityFilters(filters);
+                                if (!abilityWhere) {
+                                    try {
+                                        for (_m = (e_12 = void 0, __values(Object.keys(item))), _o = _m.next(); !_o.done; _o = _m.next()) {
+                                            key = _o.value;
+                                            delete item[key];
+                                        }
+                                    }
+                                    catch (e_12_1) { e_12 = { error: e_12_1 }; }
+                                    finally {
+                                        try {
+                                            if (_o && !_o.done && (_u = _m.return)) _u.call(_m);
+                                        }
+                                        finally { if (e_12) throw e_12.error; }
+                                    }
+                                    Object.assign(item, denyWhere(runtimeDataModel, relatedModel));
+                                }
+                                else {
+                                    merged = mergeWhere((0, cloneDeep_1.default)(item), abilityWhere);
+                                    if (merged && merged !== item) {
+                                        try {
+                                            for (_p = (e_13 = void 0, __values(Object.keys(item))), _q = _p.next(); !_q.done; _q = _p.next()) {
+                                                key = _q.value;
+                                                delete item[key];
+                                            }
+                                        }
+                                        catch (e_13_1) { e_13 = { error: e_13_1 }; }
+                                        finally {
+                                            try {
+                                                if (_q && !_q.done && (_v = _p.return)) _v.call(_p);
+                                            }
+                                            finally { if (e_13) throw e_13.error; }
+                                        }
+                                        Object.assign(item, merged);
+                                    }
+                                }
+                                _w.label = 35;
+                            case 35:
+                                items_4_1 = items_4.next();
+                                return [3 /*break*/, 33];
+                            case 36: return [3 /*break*/, 39];
+                            case 37:
+                                e_11_1 = _w.sent();
+                                e_11 = { error: e_11_1 };
+                                return [3 /*break*/, 39];
+                            case 38:
+                                try {
+                                    if (items_4_1 && !items_4_1.done && (_t = items_4.return)) _t.call(items_4);
+                                }
+                                finally { if (e_11) throw e_11.error; }
+                                return [7 /*endfinally*/];
+                            case 39: return [2 /*return*/];
                         }
                     });
                 };
-                _k = roles;
-                _l = [];
-                for (_m in _k)
-                    _l.push(_m);
-                _o = 0;
-                _r.label = 14;
-            case 14:
-                if (!(_o < _l.length)) return [3 /*break*/, 17];
-                _m = _l[_o];
-                if (!(_m in _k)) return [3 /*break*/, 16];
-                key = _m;
-                return [5 /*yield**/, _loop_3(key)];
-            case 15:
-                _r.sent();
-                _r.label = 16;
-            case 16:
-                _o++;
-                return [3 /*break*/, 14];
-            case 17: return [2 /*return*/];
+                _l.label = 1;
+            case 1:
+                _l.trys.push([1, 6, 7, 8]);
+                _a = __values(Object.entries(data)), _b = _a.next();
+                _l.label = 2;
+            case 2:
+                if (!!_b.done) return [3 /*break*/, 5];
+                _c = __read(_b.value, 2), field = _c[0], value = _c[1];
+                return [5 /*yield**/, _loop_3(field, value)];
+            case 3:
+                _l.sent();
+                _l.label = 4;
+            case 4:
+                _b = _a.next();
+                return [3 /*break*/, 2];
+            case 5: return [3 /*break*/, 8];
+            case 6:
+                e_8_1 = _l.sent();
+                e_8 = { error: e_8_1 };
+                return [3 /*break*/, 8];
+            case 7:
+                try {
+                    if (_b && !_b.done && (_d = _a.return)) _d.call(_a);
+                }
+                finally { if (e_8) throw e_8.error; }
+                return [7 /*endfinally*/];
+            case 8: return [2 /*return*/];
         }
     });
 }); };
-exports.createRoles = createRoles;
+var Yates = /** @class */ (function () {
+    function Yates(prisma) {
+        var _this = this;
+        this.prisma = prisma;
+        this.inspectRunTimeDataModel = function () {
+            var runtimeDataModel = _this.prisma
+                ._runtimeDataModel;
+            return runtimeDataModel;
+        };
+        this.getDefaultAbilities = function (models) {
+            var e_17, _a;
+            var abilities = {};
+            try {
+                for (var models_1 = __values(models), models_1_1 = models_1.next(); !models_1_1.done; models_1_1 = models_1.next()) {
+                    var model = models_1_1.value;
+                    abilities[model] = {
+                        create: {
+                            description: "Create ".concat(model),
+                            expression: {},
+                            operation: "INSERT",
+                            model: model,
+                            slug: "create",
+                        },
+                        read: {
+                            description: "Read ".concat(model),
+                            expression: {},
+                            operation: "SELECT",
+                            model: model,
+                            slug: "read",
+                        },
+                        update: {
+                            description: "Update ".concat(model),
+                            expression: {},
+                            operation: "UPDATE",
+                            model: model,
+                            slug: "update",
+                        },
+                        delete: {
+                            description: "Delete ".concat(model),
+                            expression: {},
+                            operation: "DELETE",
+                            model: model,
+                            slug: "delete",
+                        },
+                    };
+                }
+            }
+            catch (e_17_1) { e_17 = { error: e_17_1 }; }
+            finally {
+                try {
+                    if (models_1_1 && !models_1_1.done && (_a = models_1.return)) _a.call(models_1);
+                }
+                finally { if (e_17) throw e_17.error; }
+            }
+            return abilities;
+        };
+    }
+    return Yates;
+}());
+exports.Yates = Yates;
 /**
- * Creates an extended client that sets contextual parameters and user role on every query
+ * Creates an extended client that applies role abilities to Prisma queries.
  **/
+exports.__private = {
+    denyWhere: denyWhere,
+    getIdField: getIdField,
+    matchesScalarFilter: matchesScalarFilter,
+    validateContext: validateContext,
+};
 var setup = function (params) { return __awaiter(void 0, void 0, void 0, function () {
-    var start, prisma, customAbilities, getRoles, getContext, client;
-    return __generator(this, function (_a) {
-        switch (_a.label) {
-            case 0:
-                start = performance.now();
-                prisma = params.prisma, customAbilities = params.customAbilities, getRoles = params.getRoles, getContext = params.getContext;
-                return [4 /*yield*/, (0, exports.createRoles)({
-                        prisma: prisma,
-                        customAbilities: customAbilities,
-                        getRoles: getRoles,
-                    })];
-            case 1:
-                _a.sent();
-                client = (0, exports.createClient)(prisma, getContext, params.options);
-                debug("Setup completed in", performance.now() - start, "ms");
-                return [2 /*return*/, client];
+    var start, prisma, customAbilities, getRoles, getContext, yates, runtimeDataModel, models, diff, defaultAbilities, abilities, models_2, models_2_1, model, modelCustomAbilities, modelAbilities, ability, operation, roles, allAbilities, roleAbilities, client;
+    var e_18, _a;
+    var _b;
+    return __generator(this, function (_c) {
+        start = performance.now();
+        prisma = params.prisma, customAbilities = params.customAbilities, getRoles = params.getRoles, getContext = params.getContext;
+        yates = new Yates(prisma);
+        runtimeDataModel = yates.inspectRunTimeDataModel();
+        models = Object.keys(runtimeDataModel.models).map(function (m) { return runtimeDataModel.models[m].dbName || m; });
+        if (customAbilities) {
+            diff = (0, difference_1.default)(Object.keys(customAbilities), models);
+            if (diff.length) {
+                throw new Error("Invalid models in custom abilities: ".concat(diff.join(", ")));
+            }
         }
+        defaultAbilities = yates.getDefaultAbilities(models);
+        abilities = (0, cloneDeep_1.default)(defaultAbilities);
+        try {
+            for (models_2 = __values(models), models_2_1 = models_2.next(); !models_2_1.done; models_2_1 = models_2.next()) {
+                model = models_2_1.value;
+                modelCustomAbilities = customAbilities === null || customAbilities === void 0 ? void 0 : customAbilities[model];
+                if (modelCustomAbilities) {
+                    if (!abilities[model]) {
+                        abilities[model] = {};
+                    }
+                    modelAbilities = abilities[model];
+                    for (ability in modelCustomAbilities) {
+                        operation = (_b = modelCustomAbilities === null || modelCustomAbilities === void 0 ? void 0 : modelCustomAbilities[ability]) === null || _b === void 0 ? void 0 : _b.operation;
+                        if (!operation)
+                            continue;
+                        if (!VALID_OPERATIONS.includes(operation)) {
+                            throw new Error("Invalid operation: ".concat(operation));
+                        }
+                        modelAbilities[ability] = __assign(__assign({}, modelCustomAbilities[ability]), { operation: operation, model: model, slug: ability });
+                    }
+                }
+            }
+        }
+        catch (e_18_1) { e_18 = { error: e_18_1 }; }
+        finally {
+            try {
+                if (models_2_1 && !models_2_1.done && (_a = models_2.return)) _a.call(models_2);
+            }
+            finally { if (e_18) throw e_18.error; }
+        }
+        roles = getRoles(abilities);
+        allAbilities = Object.values(abilities).flatMap(function (modelAbilities) {
+            return modelAbilities ? Object.values(modelAbilities) : [];
+        });
+        roleAbilities = buildRoleAbilities(roles, allAbilities);
+        client = prisma.$extends({
+            name: "Yates client",
+            query: {
+                $allModels: {
+                    $allOperations: function (params) {
+                        return __awaiter(this, void 0, void 0, function () {
+                            var model, args, query, operation, queryArgs, ctx, op, context, role, filters, abilityWhere, combinedWhere, deniedWhere, fluentField, delegate, result, _a, fluentField, delegate, result, _b, items, items_8, items_8_1, item, e_19_1, allowed, filters, abilityWhere, canUpdate, allowed, filters, abilityWhere;
+                            var e_19, _c;
+                            var _d, _e, _f, _g, _h, _j, _k, _l, _m;
+                            return __generator(this, function (_o) {
+                                switch (_o.label) {
+                                    case 0:
+                                        model = params.model, args = params.args, query = params.query, operation = params.operation;
+                                        queryArgs = args;
+                                        if (!model) {
+                                            return [2 /*return*/, query(args)];
+                                        }
+                                        ctx = getContext();
+                                        if (ctx === null) {
+                                            return [2 /*return*/, query(args)];
+                                        }
+                                        validateContext(ctx === null || ctx === void 0 ? void 0 : ctx.context);
+                                        op = OPERATION_MAP[operation];
+                                        if (!op) {
+                                            return [2 /*return*/, query(args)];
+                                        }
+                                        context = ctx === null || ctx === void 0 ? void 0 : ctx.context;
+                                        role = ctx === null || ctx === void 0 ? void 0 : ctx.role;
+                                        if (!SELECT_OPERATIONS.has(operation)) return [3 /*break*/, 17];
+                                        return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "SELECT", context)];
+                                    case 1:
+                                        filters = (_d = (_o.sent())) !== null && _d !== void 0 ? _d : [];
+                                        abilityWhere = combineAbilityFilters(filters);
+                                        combinedWhere = mergeWhere(queryArgs.where, abilityWhere);
+                                        if (!!abilityWhere) return [3 /*break*/, 9];
+                                        deniedWhere = denyWhere(runtimeDataModel, model);
+                                        if (!(operation === "findUnique" ||
+                                            operation === "findUniqueOrThrow")) return [3 /*break*/, 7];
+                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
+                                    case 2:
+                                        _o.sent();
+                                        fluentField = getFluentSelectionField(runtimeDataModel, model, queryArgs);
+                                        delegate = prisma[lowerModelName(model)];
+                                        if (!(operation === "findUnique")) return [3 /*break*/, 4];
+                                        return [4 /*yield*/, delegate.findFirst(__assign(__assign({}, queryArgs), { where: deniedWhere }))];
+                                    case 3:
+                                        _a = _o.sent();
+                                        return [3 /*break*/, 6];
+                                    case 4: return [4 /*yield*/, delegate.findFirstOrThrow(__assign(__assign({}, queryArgs), { where: deniedWhere }))];
+                                    case 5:
+                                        _a = _o.sent();
+                                        _o.label = 6;
+                                    case 6:
+                                        result = _a;
+                                        if (fluentField && result) {
+                                            return [2 /*return*/, result[fluentField]];
+                                        }
+                                        return [2 /*return*/, result];
+                                    case 7:
+                                        queryArgs.where =
+                                            (_f = mergeWhere((_e = queryArgs.where) !== null && _e !== void 0 ? _e : {}, deniedWhere)) !== null && _f !== void 0 ? _f : queryArgs.where;
+                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
+                                    case 8:
+                                        _o.sent();
+                                        return [2 /*return*/, query(args)];
+                                    case 9:
+                                        if (!(operation === "findUnique" ||
+                                            operation === "findUniqueOrThrow")) return [3 /*break*/, 15];
+                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
+                                    case 10:
+                                        _o.sent();
+                                        fluentField = getFluentSelectionField(runtimeDataModel, model, queryArgs);
+                                        delegate = prisma[lowerModelName(model)];
+                                        if (!(operation === "findUnique")) return [3 /*break*/, 12];
+                                        return [4 /*yield*/, delegate.findFirst(__assign(__assign({}, queryArgs), { where: combinedWhere }))];
+                                    case 11:
+                                        _b = _o.sent();
+                                        return [3 /*break*/, 14];
+                                    case 12: return [4 /*yield*/, delegate.findFirstOrThrow(__assign(__assign({}, queryArgs), { where: combinedWhere }))];
+                                    case 13:
+                                        _b = _o.sent();
+                                        _o.label = 14;
+                                    case 14:
+                                        result = _b;
+                                        if (fluentField && result) {
+                                            return [2 /*return*/, result[fluentField]];
+                                        }
+                                        return [2 /*return*/, result];
+                                    case 15:
+                                        queryArgs.where = combinedWhere !== null && combinedWhere !== void 0 ? combinedWhere : queryArgs.where;
+                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
+                                    case 16:
+                                        _o.sent();
+                                        return [2 /*return*/, query(args)];
+                                    case 17:
+                                        if (!(op === "INSERT")) return [3 /*break*/, 30];
+                                        if (!(operation === "create")) return [3 /*break*/, 20];
+                                        return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context)];
+                                    case 18:
+                                        _o.sent();
+                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context)];
+                                    case 19:
+                                        _o.sent();
+                                        return [2 /*return*/, query(args)];
+                                    case 20:
+                                        if (!(operation === "createMany")) return [3 /*break*/, 30];
+                                        items = Array.isArray(queryArgs.data)
+                                            ? queryArgs.data
+                                            : [queryArgs.data];
+                                        _o.label = 21;
+                                    case 21:
+                                        _o.trys.push([21, 27, 28, 29]);
+                                        items_8 = __values(items), items_8_1 = items_8.next();
+                                        _o.label = 22;
+                                    case 22:
+                                        if (!!items_8_1.done) return [3 /*break*/, 26];
+                                        item = items_8_1.value;
+                                        return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, model, item, context)];
+                                    case 23:
+                                        _o.sent();
+                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, item, context)];
+                                    case 24:
+                                        _o.sent();
+                                        _o.label = 25;
+                                    case 25:
+                                        items_8_1 = items_8.next();
+                                        return [3 /*break*/, 22];
+                                    case 26: return [3 /*break*/, 29];
+                                    case 27:
+                                        e_19_1 = _o.sent();
+                                        e_19 = { error: e_19_1 };
+                                        return [3 /*break*/, 29];
+                                    case 28:
+                                        try {
+                                            if (items_8_1 && !items_8_1.done && (_c = items_8.return)) _c.call(items_8);
+                                        }
+                                        finally { if (e_19) throw e_19.error; }
+                                        return [7 /*endfinally*/];
+                                    case 29: return [2 /*return*/, query(args)];
+                                    case 30:
+                                        if (!(op === "UPDATE")) return [3 /*break*/, 47];
+                                        if (!(operation === "update")) return [3 /*break*/, 34];
+                                        return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, model, "UPDATE", queryArgs.where, context)];
+                                    case 31:
+                                        allowed = _o.sent();
+                                        if (!allowed)
+                                            throw updateNotFoundError();
+                                        if (!queryArgs.data) return [3 /*break*/, 33];
+                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context)];
+                                    case 32:
+                                        _o.sent();
+                                        _o.label = 33;
+                                    case 33: return [2 /*return*/, query(args)];
+                                    case 34:
+                                        if (!(operation === "updateMany")) return [3 /*break*/, 38];
+                                        return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "UPDATE", context)];
+                                    case 35:
+                                        filters = (_g = (_o.sent())) !== null && _g !== void 0 ? _g : [];
+                                        abilityWhere = combineAbilityFilters(filters);
+                                        if (!abilityWhere) {
+                                            queryArgs.where = denyWhere(runtimeDataModel, model);
+                                        }
+                                        else {
+                                            queryArgs.where =
+                                                (_j = mergeWhere((_h = queryArgs.where) !== null && _h !== void 0 ? _h : {}, abilityWhere)) !== null && _j !== void 0 ? _j : queryArgs.where;
+                                        }
+                                        if (!queryArgs.data) return [3 /*break*/, 37];
+                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context)];
+                                    case 36:
+                                        _o.sent();
+                                        _o.label = 37;
+                                    case 37: return [2 /*return*/, query(args)];
+                                    case 38:
+                                        if (!(operation === "upsert")) return [3 /*break*/, 47];
+                                        return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, model, "UPDATE", queryArgs.where, context)];
+                                    case 39:
+                                        canUpdate = _o.sent();
+                                        if (!canUpdate) return [3 /*break*/, 42];
+                                        if (!args.update) return [3 /*break*/, 41];
+                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, args.update, context)];
+                                    case 40:
+                                        _o.sent();
+                                        _o.label = 41;
+                                    case 41: return [3 /*break*/, 46];
+                                    case 42:
+                                        if (!args.create) return [3 /*break*/, 45];
+                                        return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, model, args.create, context)];
+                                    case 43:
+                                        _o.sent();
+                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, args.create, context)];
+                                    case 44:
+                                        _o.sent();
+                                        return [3 /*break*/, 46];
+                                    case 45: throw updateNotFoundError();
+                                    case 46: return [2 /*return*/, query(args)];
+                                    case 47:
+                                        if (!(op === "DELETE")) return [3 /*break*/, 51];
+                                        if (!(operation === "delete")) return [3 /*break*/, 49];
+                                        return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, model, "DELETE", queryArgs.where, context)];
+                                    case 48:
+                                        allowed = _o.sent();
+                                        if (!allowed)
+                                            throw deleteNotFoundError();
+                                        return [2 /*return*/, query(args)];
+                                    case 49:
+                                        if (!(operation === "deleteMany")) return [3 /*break*/, 51];
+                                        return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "DELETE", context)];
+                                    case 50:
+                                        filters = (_k = (_o.sent())) !== null && _k !== void 0 ? _k : [];
+                                        abilityWhere = combineAbilityFilters(filters);
+                                        if (!abilityWhere) {
+                                            queryArgs.where = denyWhere(runtimeDataModel, model);
+                                        }
+                                        else {
+                                            queryArgs.where =
+                                                (_m = mergeWhere((_l = queryArgs.where) !== null && _l !== void 0 ? _l : {}, abilityWhere)) !== null && _m !== void 0 ? _m : queryArgs.where;
+                                        }
+                                        return [2 /*return*/, query(args)];
+                                    case 51:
+                                        if (!UNIQUE_OPERATIONS.has(operation)) {
+                                            return [2 /*return*/, query(args)];
+                                        }
+                                        return [2 /*return*/, query(args)];
+                                }
+                            });
+                        });
+                    },
+                },
+            },
+        });
+        debug("Setup completed in", performance.now() - start, "ms");
+        return [2 /*return*/, client];
     });
 }); };
 exports.setup = setup;
-var templateObject_1, templateObject_2, templateObject_3;
 //# sourceMappingURL=index.js.map