@cerebruminc/yates 4.0.0-beta.dangerous.df71802 → 4.0.1

package/dist/index.js

@@ -1,4 +1,8 @@
 "use strict";
+var __makeTemplateObject = (this && this.__makeTemplateObject) || function (cooked, raw) {
+    if (Object.defineProperty) { Object.defineProperty(cooked, "raw", { value: raw }); } else { cooked.raw = raw; }
+    return cooked;
+};
 var __assign = (this && this.__assign) || function () {
     __assign = Object.assign || function(t) {
         for (var s, i = 1, n = arguments.length; i < n; i++) {
@@ -10,6 +14,29 @@ var __assign = (this && this.__assign) || function () {
     };
     return __assign.apply(this, arguments);
 };
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -46,17 +73,6 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
-var __values = (this && this.__values) || function(o) {
-    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
-    if (m) return m.call(o);
-    if (o && typeof o.length === "number") return {
-        next: function () {
-            if (o && i >= o.length) o = void 0;
-            return { value: o && o[i++], done: !o };
-        }
-    };
-    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
-};
 var __read = (this && this.__read) || function (o, n) {
     var m = typeof Symbol === "function" && o[Symbol.iterator];
     if (!m) return o;
@@ -82,17 +98,59 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
     }
     return to.concat(ar || Array.prototype.slice.call(from));
 };
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setup = exports.__private = exports.Yates = exports.sanitizeSlug = void 0;
+exports.setup = exports.Yates = exports.sanitizeSlug = void 0;
+var crypto = __importStar(require("crypto"));
 var debug_1 = __importDefault(require("debug"));
 var cloneDeep_1 = __importDefault(require("lodash/cloneDeep"));
 var difference_1 = __importDefault(require("lodash/difference"));
-var isEqual_1 = __importDefault(require("lodash/isEqual"));
+var flatMap_1 = __importDefault(require("lodash/flatMap"));
+var map_1 = __importDefault(require("lodash/map"));
+var toPairs_1 = __importDefault(require("lodash/toPairs"));
+var expressions_1 = require("./expressions");
 var VALID_OPERATIONS = ["SELECT", "UPDATE", "INSERT", "DELETE"];
+var SETUP_MANIFEST_VERSION = "1";
+var YATES_VERSION = require("../package.json").version;
 var debug = (0, debug_1.default)("yates");
+/**
+ * This function is used to take a lock that is automatically released at the end of the current transaction.
+ * This is very convenient for ensuring we don't hit concurrency issues when running setup code.
+ */
+var takeLock = function (prisma) {
+    return prisma.$executeRawUnsafe("SELECT pg_advisory_xact_lock(2142616474639426746);");
+};
+var upsertAbility = function (prisma, ability) {
+    var ability_model = ability.ability_model, ability_name = ability.ability_name, ability_policy_name = ability.ability_policy_name, ability_description = ability.ability_description, ability_operation = ability.ability_operation, ability_expression = ability.ability_expression;
+    return prisma.$queryRaw(templateObject_1 || (templateObject_1 = __makeTemplateObject(["\n\t\tINSERT INTO _yates._yates_abilities (ability_model, ability_name, ability_policy_name, ability_description, ability_operation, ability_expression)\n\t\tVALUES (", ", ", ", ", ", ", ", ", ", ", ")\n\t\tON CONFLICT (ability_policy_name) DO UPDATE\n\t\tSET ability_model = EXCLUDED.ability_model, ability_name = EXCLUDED.ability_name, ability_description = EXCLUDED.ability_description, ability_operation = EXCLUDED.ability_operation, ability_expression = EXCLUDED.ability_expression, updated_at = now();\n\t"], ["\n\t\tINSERT INTO _yates._yates_abilities (ability_model, ability_name, ability_policy_name, ability_description, ability_operation, ability_expression)\n\t\tVALUES (", ", ", ", ", ", ", ", ", ", ", ")\n\t\tON CONFLICT (ability_policy_name) DO UPDATE\n\t\tSET ability_model = EXCLUDED.ability_model, ability_name = EXCLUDED.ability_name, ability_description = EXCLUDED.ability_description, ability_operation = EXCLUDED.ability_operation, ability_expression = EXCLUDED.ability_expression, updated_at = now();\n\t"])), ability_model, ability_name, ability_policy_name, ability_description, ability_operation, ability_expression);
+};
+/**
+ * In PostgreSQL, the maximum length for a role or policy name is 63 bytes.
+ * This limitation is derived from the value of the NAMEDATALEN configuration parameter,
+ * which is set to 64 bytes by default. One byte is reserved for the null-terminator,
+ * leaving 63 bytes for the actual role name.
+ * This function hashes the ability name to ensure it is within the 63 byte limit.
+ */
+var hashWithPrefix = function (prefix, abilityName) {
+    var hash = crypto.createHash("sha256");
+    hash.update(abilityName);
+    var hashedAbilityName = hash.digest("hex");
+    var maxLength = 63 - prefix.length;
+    return prefix + hashedAbilityName.slice(0, maxLength);
+};
 // Sanitize a single string by ensuring the it has only lowercase alpha characters and underscores
 var sanitizeSlug = function (slug) {
     return slug
@@ -101,1155 +159,215 @@ var sanitizeSlug = function (slug) {
         .replace(/[^a-z0-9_]/gi, "");
 };
 exports.sanitizeSlug = sanitizeSlug;
-var OPERATION_MAP = {
-    findUnique: "SELECT",
-    findUniqueOrThrow: "SELECT",
-    findFirst: "SELECT",
-    findFirstOrThrow: "SELECT",
-    findMany: "SELECT",
-    count: "SELECT",
-    aggregate: "SELECT",
-    groupBy: "SELECT",
-    create: "INSERT",
-    createMany: "INSERT",
-    update: "UPDATE",
-    updateMany: "UPDATE",
-    delete: "DELETE",
-    deleteMany: "DELETE",
-    upsert: "UPDATE",
-};
-var UNIQUE_OPERATIONS = new Set([
-    "findUnique",
-    "findUniqueOrThrow",
-    "update",
-    "delete",
-    "upsert",
-]);
-var SELECT_OPERATIONS = new Set([
-    "findUnique",
-    "findUniqueOrThrow",
-    "findFirst",
-    "findFirstOrThrow",
-    "findMany",
-    "count",
-    "aggregate",
-    "groupBy",
-]);
-var isPlainObject = function (value) {
-    return !!value && typeof value === "object" && !Array.isArray(value);
-};
-var lowerModelName = function (model) {
-    return model.length ? "".concat(model[0].toLowerCase()).concat(model.slice(1)) : model;
-};
-var isFieldRef = function (value) {
-    return isPlainObject(value) &&
-        typeof value.modelName === "string" &&
-        typeof value.name === "string";
-};
-var isEmptyWhere = function (where) {
-    return !where || (isPlainObject(where) && Object.keys(where).length === 0);
-};
-var combineAbilityFilters = function (filters) {
-    if (filters.length === 0)
-        return null;
-    if (filters.some(function (filter) { return isEmptyWhere(filter); }))
-        return {};
-    if (filters.length === 1)
-        return filters[0];
-    return { OR: filters };
-};
-var mergeWhere = function (base, extra) {
-    var _a;
-    if (!extra || isEmptyWhere(extra))
-        return (_a = base !== null && base !== void 0 ? base : extra) !== null && _a !== void 0 ? _a : undefined;
-    if (!base || isEmptyWhere(base))
-        return extra;
-    return { AND: [base, extra] };
-};
-var getFluentSelectionField = function (runtimeDataModel, model, args) {
-    var selection = args.select;
-    if (!isPlainObject(selection))
-        return null;
-    var keys = Object.keys(selection);
-    if (keys.length !== 1)
-        return null;
-    var field = keys[0];
-    var modelData = runtimeDataModel.models[model];
-    var fieldData = modelData === null || modelData === void 0 ? void 0 : modelData.fields.find(function (f) { return f.name === field; });
-    if (!fieldData || fieldData.kind !== "object")
-        return null;
-    return field;
-};
-var getIdField = function (runtimeDataModel, model) {
-    var _a;
-    var modelData = runtimeDataModel.models[model];
-    if (!modelData)
-        return null;
-    var idField = modelData.fields.find(function (field) { return field.isId; });
-    return (_a = idField === null || idField === void 0 ? void 0 : idField.name) !== null && _a !== void 0 ? _a : null;
-};
-var denyWhere = function (runtimeDataModel, model) {
-    var _a;
-    var idField = getIdField(runtimeDataModel, model);
-    if (idField) {
-        return _a = {},
-            _a[idField] = {
-                in: [],
-            },
-            _a;
-    }
-    throw new Error("Model \"".concat(model, "\" has no @id field. Yates requires an ID to safely deny queries."));
-};
-var validateContext = function (context) {
-    var e_1, _a, e_2, _b;
-    if (!context)
-        return;
-    try {
-        for (var _c = __values(Object.keys(context)), _d = _c.next(); !_d.done; _d = _c.next()) {
-            var key = _d.value;
-            if (!key.match(/^[a-z_\.]+$/)) {
-                throw new Error("Context variable \"".concat(key, "\" contains invalid characters. Context variables must only contain lowercase letters, numbers, periods and underscores."));
+var Yates = /** @class */ (function () {
+    function Yates(prisma) {
+        var _this = this;
+        this.prisma = prisma;
+        this.databaseScope = null;
+        this.init = function () { return __awaiter(_this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.ensureDatabaseScope()];
+                    case 1:
+                        _a.sent();
+                        debug("Setting up ability table");
+                        return [4 /*yield*/, this.setupAbilityTable()];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); };
+        this.createDatabaseScope = function (databaseName) {
+            var sanitizedName = (0, exports.sanitizeSlug)(databaseName);
+            if (sanitizedName.length > 0) {
+                return sanitizedName;
             }
-            var value = context[key];
-            if (typeof value !== "number" &&
-                typeof value !== "string" &&
-                !Array.isArray(value)) {
-                throw new Error("Context variable \"".concat(key, "\" must be a string, number or array. Got ").concat(typeof value));
+            var hash = crypto.createHash("sha256");
+            hash.update(databaseName);
+            return hash.digest("hex").slice(0, 8);
+        };
+        this.getDatabaseScope = function () {
+            if (!_this.databaseScope) {
+                throw new Error("Yates database scope has not been initialised. Ensure setup() has been called before using the client.");
             }
-            if (Array.isArray(value)) {
-                try {
-                    for (var _e = (e_2 = void 0, __values(value)), _f = _e.next(); !_f.done; _f = _e.next()) {
-                        var entry = _f.value;
-                        if (typeof entry !== "string") {
-                            throw new Error("Context variable \"".concat(key, "\" must be an array of strings. Got ").concat(typeof entry));
+            return _this.databaseScope;
+        };
+        this.ensureDatabaseScope = function () { return __awaiter(_this, void 0, void 0, function () {
+            var result, currentDatabase;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        if (this.databaseScope) {
+                            return [2 /*return*/, this.databaseScope];
                         }
-                    }
+                        return [4 /*yield*/, this.prisma.$queryRawUnsafe("select current_database() as current_database;")];
+                    case 1:
+                        result = _b.sent();
+                        currentDatabase = (_a = result[0]) === null || _a === void 0 ? void 0 : _a.current_database;
+                        debug("Current database for Yates:", currentDatabase);
+                        if (!currentDatabase) {
+                            throw new Error("Failed to determine the current database for scoping Yates roles.");
+                        }
+                        this.databaseScope = this.createDatabaseScope(currentDatabase);
+                        return [2 /*return*/, this.databaseScope];
                 }
-                catch (e_2_1) { e_2 = { error: e_2_1 }; }
-                finally {
-                    try {
-                        if (_f && !_f.done && (_b = _e.return)) _b.call(_e);
-                    }
-                    finally { if (e_2) throw e_2.error; }
+            });
+        }); };
+        /*
+         * This function creates a table used to track the abilities that have been
+         * defined in the system. We can use this to see if an ability needs to be updated.
+         * We can't look up the pg policy table for this, as pg performs formatting on
+         * the expression, making it very hard to check if the two expressions are equivalent.
+         *
+         * We also need to create a schema for this table, as we don't want to pollute the public schema.
+         * If we use the public schema, we could potentially conflict with a user's table and we will
+         * also cause issues for Prisma's migrate tooling, as it will detect a DB drift.
+         */
+        this.setupAbilityTable = function () {
+            return _this.prisma.$transaction([
+                takeLock(_this.prisma),
+                _this.prisma.$executeRawUnsafe("\n\t\t\t\tCREATE SCHEMA IF NOT EXISTS _yates;\n\t\t\t"),
+                _this.prisma.$executeRawUnsafe("\n\t\t\t\tCREATE TABLE IF NOT EXISTS _yates._yates_abilities (\n\t\t\t\t\tid SERIAL PRIMARY KEY,\n\t\t\t\t\tability_model TEXT NOT NULL,\n\t\t\t\t\tability_name TEXT NOT NULL,\n\t\t\t\t\tability_policy_name TEXT NOT NULL UNIQUE,\n\t\t\t\t\tability_description TEXT NOT NULL,\n\t\t\t\t\tability_operation TEXT NOT NULL,\n\t\t\t\t\tability_expression TEXT NOT NULL,\n\t\t\t\t\tcreated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,\n\t\t\t\t\tupdated_at TIMESTAMP\n\t\t\t\t);\n\t\t\t"),
+                _this.prisma.$executeRawUnsafe("\n\t\t\t\tCREATE TABLE IF NOT EXISTS _yates._yates_schema_syncs (\n\t\t\t\t\tid TEXT PRIMARY KEY,\n\t\t\t\t\tmanifest_hash TEXT NOT NULL,\n\t\t\t\t\tmanifest_version TEXT,\n\t\t\t\t\tyates_version TEXT,\n\t\t\t\t\tapp_name TEXT,\n\t\t\t\t\tapplied_at TIMESTAMPTZ NOT NULL DEFAULT now()\n\t\t\t\t);\n\t\t\t"),
+                _this.prisma.$executeRawUnsafe("\n\t\t\t\tDO $$\n\t\t\t\tBEGIN\n\t\t\t\t\tIF EXISTS (\n\t\t\t\t\t\tSELECT 1 FROM information_schema.columns\n\t\t\t\t\t\tWHERE table_schema = '_yates'\n\t\t\t\t\t\tAND table_name = '_yates_schema_syncs'\n\t\t\t\t\t\tAND column_name = 'yates_version'\n\t\t\t\t\t) AND NOT EXISTS (\n\t\t\t\t\t\tSELECT 1 FROM information_schema.columns\n\t\t\t\t\t\tWHERE table_schema = '_yates'\n\t\t\t\t\t\tAND table_name = '_yates_schema_syncs'\n\t\t\t\t\t\tAND column_name = 'manifest_version'\n\t\t\t\t\t) THEN\n\t\t\t\t\t\tALTER TABLE _yates._yates_schema_syncs RENAME COLUMN yates_version TO manifest_version;\n\t\t\t\t\tELSIF NOT EXISTS (\n\t\t\t\t\t\tSELECT 1 FROM information_schema.columns\n\t\t\t\t\t\tWHERE table_schema = '_yates'\n\t\t\t\t\t\tAND table_name = '_yates_schema_syncs'\n\t\t\t\t\t\tAND column_name = 'manifest_version'\n\t\t\t\t\t) THEN\n\t\t\t\t\t\tALTER TABLE _yates._yates_schema_syncs ADD COLUMN manifest_version TEXT;\n\t\t\t\t\tEND IF;\n\n\t\t\t\t\tIF NOT EXISTS (\n\t\t\t\t\t\tSELECT 1 FROM information_schema.columns\n\t\t\t\t\t\tWHERE table_schema = '_yates'\n\t\t\t\t\t\tAND table_name = '_yates_schema_syncs'\n\t\t\t\t\t\tAND column_name = 'yates_version'\n\t\t\t\t\t) THEN\n\t\t\t\t\t\tALTER TABLE _yates._yates_schema_syncs ADD COLUMN yates_version TEXT;\n\t\t\t\t\tEND IF;\n\t\t\t\tEND\n\t\t\t\t$$;\n\t\t\t"),
+            ]);
+        };
+        this.createAbilityName = function (model, ability) {
+            var scope = _this.getDatabaseScope();
+            return (0, exports.sanitizeSlug)(hashWithPrefix("yates_ability_", "".concat(scope, "_").concat(model, "_").concat(ability)));
+        };
+        this.createRoleName = function (name) {
+            var scope = _this.getDatabaseScope();
+            return (0, exports.sanitizeSlug)(hashWithPrefix("yates_role_", "".concat(scope, "_").concat(name)));
+        };
+        this.quoteIdentifier = function (identifier) {
+            return "\"".concat(identifier.replace(/"/g, '""'), "\"");
+        };
+        this.enableRowLevelSecurityIfNeeded = function (prisma, table) { return __awaiter(_this, void 0, void 0, function () {
+            var rlsState;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\tSELECT c.relrowsecurity\n\t\t\t\tFROM pg_catalog.pg_class c\n\t\t\t\tJOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace\n\t\t\t\tWHERE n.nspname = 'public'\n\t\t\t\tAND c.relname = $1\n\t\t\t\tAND c.relkind IN ('r', 'p')\n\t\t\t\tLIMIT 1;\n\t\t\t", table)];
+                    case 1:
+                        rlsState = _b.sent();
+                        if ((_a = rlsState[0]) === null || _a === void 0 ? void 0 : _a.relrowsecurity) {
+                            debug("Row level security already enabled for", table);
+                            return [2 /*return*/];
+                        }
+                        debug("Enabling row level security for", table);
+                        return [4 /*yield*/, prisma.$executeRawUnsafe("ALTER table ".concat(this.quoteIdentifier("public"), ".").concat(this.quoteIdentifier(table), " enable row level security;"))];
+                    case 2:
+                        _b.sent();
+                        return [2 /*return*/];
                 }
-            }
-        }
-    }
-    catch (e_1_1) { e_1 = { error: e_1_1 }; }
-    finally {
-        try {
-            if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
-        }
-        finally { if (e_1) throw e_1.error; }
-    }
-};
-var permissionError = function (model, operation) {
-    return new Error("You do not have permission to perform this action: ".concat(model, ".").concat(operation, "(...)"));
-};
-var updateNotFoundError = function () { return new Error("Record to update not found"); };
-var deleteNotFoundError = function () { return new Error("Record to delete does not exist"); };
-var matchesScalarFilter = function (value, filter, data) {
-    if (!isPlainObject(filter)) {
-        if (isFieldRef(filter)) {
-            return value === data[filter.name];
-        }
-        return value === filter;
-    }
-    if ("equals" in filter) {
-        var target = filter.equals;
-        if (isFieldRef(target)) {
-            return value === data[target.name];
-        }
-        return value === target;
-    }
-    if ("in" in filter) {
-        return Array.isArray(filter.in) && filter.in.includes(value);
-    }
-    if ("notIn" in filter) {
-        return Array.isArray(filter.notIn) && !filter.notIn.includes(value);
-    }
-    if ("lt" in filter)
-        return value < filter.lt;
-    if ("lte" in filter)
-        return value <= filter.lte;
-    if ("gt" in filter)
-        return value > filter.gt;
-    if ("gte" in filter)
-        return value >= filter.gte;
-    if ("contains" in filter)
-        return typeof value === "string" && value.includes(filter.contains);
-    if ("startsWith" in filter)
-        return typeof value === "string" && value.startsWith(filter.startsWith);
-    if ("endsWith" in filter)
-        return typeof value === "string" && value.endsWith(filter.endsWith);
-    if ("not" in filter)
-        return !matchesScalarFilter(value, filter.not, data);
-    return value === filter;
-};
-var getRelationConstraints = function (data, fieldData) {
-    var e_3, _a;
-    var _b, _c;
-    var constraints = [];
-    var relationInput = data[fieldData.name];
-    if (isPlainObject(relationInput)) {
-        var connect = relationInput.connect;
-        if (connect) {
-            var items = Array.isArray(connect) ? connect : [connect];
+            });
+        }); };
+        this.createSetupManifestHash = function (manifest) {
+            var normalizedManifest = {
+                abilities: __spreadArray([], __read(manifest.abilities), false).sort(function (a, b) {
+                    return "".concat(a.model, ":").concat(a.slug, ":").concat(a.operation, ":").concat(a.policyName).localeCompare("".concat(b.model, ":").concat(b.slug, ":").concat(b.operation, ":").concat(b.policyName));
+                }),
+                databaseScope: manifest.databaseScope,
+                roles: __spreadArray([], __read(manifest.roles), false).map(function (role) { return (__assign(__assign({}, role), { grants: Array.isArray(role.grants)
+                        ? __spreadArray([], __read(role.grants), false).sort()
+                        : role.grants })); })
+                    .sort(function (a, b) { return a.roleName.localeCompare(b.roleName); }),
+                version: SETUP_MANIFEST_VERSION,
+            };
+            var hash = crypto.createHash("sha256");
+            hash.update(JSON.stringify(normalizedManifest));
+            return hash.digest("hex");
+        };
+        this.createSetupManifest = function (abilities, roles) {
+            var e_1, _a, e_2, _b;
+            var _c, _d;
+            var manifestAbilities = [];
             try {
-                for (var items_1 = __values(items), items_1_1 = items_1.next(); !items_1_1.done; items_1_1 = items_1.next()) {
-                    var item = items_1_1.value;
-                    if (isPlainObject(item)) {
-                        constraints.push(item);
+                for (var _e = __values(Object.keys(abilities).sort()), _f = _e.next(); !_f.done; _f = _e.next()) {
+                    var model = _f.value;
+                    var modelAbilities = abilities[model];
+                    if (!modelAbilities)
+                        continue;
+                    try {
+                        for (var _g = (e_2 = void 0, __values(Object.keys(modelAbilities).sort())), _h = _g.next(); !_h.done; _h = _g.next()) {
+                            var slug = _h.value;
+                            var ability = modelAbilities[slug];
+                            if (!ability)
+                                continue;
+                            manifestAbilities.push({
+                                expression: (_d = (_c = ability.expression) === null || _c === void 0 ? void 0 : _c.toString()) !== null && _d !== void 0 ? _d : null,
+                                model: model,
+                                operation: ability.operation,
+                                policyName: _this.createAbilityName(model, slug),
+                                slug: slug,
+                            });
+                        }
+                    }
+                    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+                    finally {
+                        try {
+                            if (_h && !_h.done && (_b = _g.return)) _b.call(_g);
+                        }
+                        finally { if (e_2) throw e_2.error; }
                     }
                 }
             }
-            catch (e_3_1) { e_3 = { error: e_3_1 }; }
+            catch (e_1_1) { e_1 = { error: e_1_1 }; }
             finally {
                 try {
-                    if (items_1_1 && !items_1_1.done && (_a = items_1.return)) _a.call(items_1);
+                    if (_f && !_f.done && (_a = _e.return)) _a.call(_e);
                 }
-                finally { if (e_3) throw e_3.error; }
+                finally { if (e_1) throw e_1.error; }
             }
-        }
-    }
-    var fromFields = (_b = fieldData.relationFromFields) !== null && _b !== void 0 ? _b : [];
-    var toFields = (_c = fieldData.relationToFields) !== null && _c !== void 0 ? _c : [];
-    if (fromFields.length > 0) {
-        var hasAll = fromFields.every(function (field) { return data[field] !== undefined && data[field] !== null; });
-        if (hasAll) {
-            var where_1 = {};
-            fromFields.forEach(function (fromField, index) {
-                var _a;
-                var toField = (_a = toFields[index]) !== null && _a !== void 0 ? _a : fromField;
-                where_1[toField] = data[fromField];
-            });
-            constraints.push(where_1);
-        }
-    }
-    return constraints.length > 0 ? constraints : null;
-};
-var matchesRelationFilter = function (prisma, runtimeDataModel, fieldData, data, condition) { return __awaiter(void 0, void 0, void 0, function () {
-    var relatedModel, constraints, relationInput, hasIs, hasIsNot, relationWhere_1, isNegated, constraintWhere_1, combinedWhere_1, delegate_1, record, hasSome, hasEvery, hasNone, operator, relationWhere, constraintWhere, combinedWhere, delegate, record, record, results;
-    var _a, _b, _c, _d;
-    var _e, _f, _g, _h, _j, _k, _l, _m;
-    return __generator(this, function (_o) {
-        switch (_o.label) {
-            case 0:
-                relatedModel = fieldData.type;
-                constraints = (_e = getRelationConstraints(data, fieldData)) !== null && _e !== void 0 ? _e : [];
-                relationInput = isPlainObject(condition) ? condition : {};
-                if (!!fieldData.isList) return [3 /*break*/, 2];
-                hasIs = isPlainObject(condition) && "is" in condition;
-                hasIsNot = isPlainObject(condition) && "isNot" in condition;
-                relationWhere_1 = hasIs
-                    ? relationInput.is
-                    : hasIsNot
-                        ? relationInput.isNot
-                        : condition;
-                isNegated = hasIsNot;
-                if (relationWhere_1 === null) {
-                    return [2 /*return*/, isNegated ? constraints.length > 0 : constraints.length === 0];
-                }
-                if (constraints.length === 0)
-                    return [2 /*return*/, false];
-                constraintWhere_1 = constraints.length === 1 ? constraints[0] : { OR: constraints };
-                combinedWhere_1 = (_f = mergeWhere(relationWhere_1 !== null && relationWhere_1 !== void 0 ? relationWhere_1 : {}, constraintWhere_1)) !== null && _f !== void 0 ? _f : constraintWhere_1;
-                delegate_1 = prisma[lowerModelName(relatedModel)];
-                return [4 /*yield*/, delegate_1.findFirst({
-                        where: combinedWhere_1,
-                        select: (_a = {}, _a[(_g = getIdField(runtimeDataModel, relatedModel)) !== null && _g !== void 0 ? _g : "id"] = true, _a),
-                    })];
-            case 1:
-                record = _o.sent();
-                return [2 /*return*/, isNegated ? !record : !!record];
-            case 2:
-                hasSome = isPlainObject(condition) && "some" in condition;
-                hasEvery = isPlainObject(condition) && "every" in condition;
-                hasNone = isPlainObject(condition) && "none" in condition;
-                operator = hasEvery ? "every" : hasNone ? "none" : "some";
-                relationWhere = (_h = relationInput[operator]) !== null && _h !== void 0 ? _h : condition;
-                if (constraints.length === 0) {
-                    if (operator === "none")
-                        return [2 /*return*/, true];
-                    if (operator === "every")
-                        return [2 /*return*/, true];
-                    return [2 /*return*/, false];
-                }
-                constraintWhere = constraints.length === 1 ? constraints[0] : { OR: constraints };
-                combinedWhere = (_j = mergeWhere(relationWhere !== null && relationWhere !== void 0 ? relationWhere : {}, constraintWhere)) !== null && _j !== void 0 ? _j : constraintWhere;
-                delegate = prisma[lowerModelName(relatedModel)];
-                if (!(operator === "some")) return [3 /*break*/, 4];
-                return [4 /*yield*/, delegate.findFirst({
-                        where: combinedWhere,
-                        select: (_b = {}, _b[(_k = getIdField(runtimeDataModel, relatedModel)) !== null && _k !== void 0 ? _k : "id"] = true, _b),
-                    })];
-            case 3:
-                record = _o.sent();
-                return [2 /*return*/, !!record];
-            case 4:
-                if (!(operator === "none")) return [3 /*break*/, 6];
-                return [4 /*yield*/, delegate.findFirst({
-                        where: combinedWhere,
-                        select: (_c = {}, _c[(_l = getIdField(runtimeDataModel, relatedModel)) !== null && _l !== void 0 ? _l : "id"] = true, _c),
-                    })];
-            case 5:
-                record = _o.sent();
-                return [2 /*return*/, !record];
-            case 6: return [4 /*yield*/, delegate.findMany({
-                    where: combinedWhere,
-                    select: (_d = {}, _d[(_m = getIdField(runtimeDataModel, relatedModel)) !== null && _m !== void 0 ? _m : "id"] = true, _d),
-                })];
-            case 7:
-                results = _o.sent();
-                return [2 /*return*/, results.length === constraints.length];
-        }
-    });
-}); };
-var matchesCreateWhere = function (prisma, runtimeDataModel, model, data, where) { return __awaiter(void 0, void 0, void 0, function () {
-    var clauses, checks, clauses, checks, clauses, checks, _loop_1, _a, _b, _c, field, condition, state_1, e_4_1;
-    var e_4, _d;
-    return __generator(this, function (_e) {
-        switch (_e.label) {
-            case 0:
-                if (!where.AND) return [3 /*break*/, 2];
-                clauses = Array.isArray(where.AND) ? where.AND : [where.AND];
-                return [4 /*yield*/, Promise.all(clauses.map(function (clause) {
-                        return matchesCreateWhere(prisma, runtimeDataModel, model, data, clause);
-                    }))];
-            case 1:
-                checks = _e.sent();
-                if (!checks.every(Boolean))
-                    return [2 /*return*/, false];
-                _e.label = 2;
-            case 2:
-                if (!where.OR) return [3 /*break*/, 4];
-                clauses = Array.isArray(where.OR) ? where.OR : [where.OR];
-                return [4 /*yield*/, Promise.all(clauses.map(function (clause) {
-                        return matchesCreateWhere(prisma, runtimeDataModel, model, data, clause);
-                    }))];
-            case 3:
-                checks = _e.sent();
-                if (!checks.some(Boolean))
-                    return [2 /*return*/, false];
-                _e.label = 4;
-            case 4:
-                if (!where.NOT) return [3 /*break*/, 6];
-                clauses = Array.isArray(where.NOT) ? where.NOT : [where.NOT];
-                return [4 /*yield*/, Promise.all(clauses.map(function (clause) {
-                        return matchesCreateWhere(prisma, runtimeDataModel, model, data, clause);
-                    }))];
-            case 5:
-                checks = _e.sent();
-                if (checks.some(Boolean))
-                    return [2 /*return*/, false];
-                _e.label = 6;
-            case 6:
-                _loop_1 = function (field, condition) {
-                    var modelData, fieldData, ok, value;
-                    return __generator(this, function (_f) {
-                        switch (_f.label) {
-                            case 0:
-                                if (field === "AND" || field === "OR" || field === "NOT")
-                                    return [2 /*return*/, "continue"];
-                                modelData = runtimeDataModel.models[model];
-                                fieldData = modelData === null || modelData === void 0 ? void 0 : modelData.fields.find(function (f) { return f.name === field; });
-                                if (!fieldData)
-                                    return [2 /*return*/, "continue"];
-                                if (!(fieldData.kind === "object")) return [3 /*break*/, 2];
-                                return [4 /*yield*/, matchesRelationFilter(prisma, runtimeDataModel, fieldData, data, condition)];
-                            case 1:
-                                ok = _f.sent();
-                                if (!ok)
-                                    return [2 /*return*/, { value: false }];
-                                return [2 /*return*/, "continue"];
-                            case 2:
-                                value = data[field];
-                                if (!matchesScalarFilter(value, condition, data))
-                                    return [2 /*return*/, { value: false }];
-                                return [2 /*return*/];
-                        }
-                    });
-                };
-                _e.label = 7;
-            case 7:
-                _e.trys.push([7, 12, 13, 14]);
-                _a = __values(Object.entries(where)), _b = _a.next();
-                _e.label = 8;
-            case 8:
-                if (!!_b.done) return [3 /*break*/, 11];
-                _c = __read(_b.value, 2), field = _c[0], condition = _c[1];
-                return [5 /*yield**/, _loop_1(field, condition)];
-            case 9:
-                state_1 = _e.sent();
-                if (typeof state_1 === "object")
-                    return [2 /*return*/, state_1.value];
-                _e.label = 10;
-            case 10:
-                _b = _a.next();
-                return [3 /*break*/, 8];
-            case 11: return [3 /*break*/, 14];
-            case 12:
-                e_4_1 = _e.sent();
-                e_4 = { error: e_4_1 };
-                return [3 /*break*/, 14];
-            case 13:
-                try {
-                    if (_b && !_b.done && (_d = _a.return)) _d.call(_a);
-                }
-                finally { if (e_4) throw e_4.error; }
-                return [7 /*endfinally*/];
-            case 14: return [2 /*return*/, true];
-        }
-    });
-}); };
-var extractModelFields = function (runtimeDataModel, model) {
-    var _a;
-    var modelData = runtimeDataModel.models[model];
-    return (_a = modelData === null || modelData === void 0 ? void 0 : modelData.fields) !== null && _a !== void 0 ? _a : [];
-};
-var buildRowHelper = function (prisma, runtimeDataModel, model) {
-    return (function (col) {
-        var _a;
-        var modelData = runtimeDataModel.models[model];
-        if (!modelData) {
-            throw new Error("Could not retrieve model data for '".concat(model, "'"));
-        }
-        var fieldData = modelData.fields.find(function (field) { return field.name === col; });
-        if (!fieldData) {
-            throw new Error("Could not retrieve field data from Prisma Client for field '".concat(model, ".").concat(col, "'"));
-        }
-        var delegate = prisma[lowerModelName(model)];
-        var fieldRef = (_a = delegate === null || delegate === void 0 ? void 0 : delegate.fields) === null || _a === void 0 ? void 0 : _a[col];
-        if (!fieldRef) {
-            throw new Error("Could not resolve field reference for '".concat(model, ".").concat(col, "'"));
-        }
-        return fieldRef;
-    });
-};
-var buildContextHelper = function (context) {
-    return (function (key) {
-        return context ? context[key] : undefined;
-    });
-};
-var resolveExpression = function (prisma, runtimeDataModel, model, expression, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var row, ctx;
-    return __generator(this, function (_a) {
-        switch (_a.label) {
-            case 0:
-                if (!expression)
-                    return [2 /*return*/, {}];
-                if (typeof expression !== "function")
-                    return [2 /*return*/, expression];
-                row = buildRowHelper(prisma, runtimeDataModel, model);
-                ctx = buildContextHelper(context);
-                return [4 /*yield*/, expression(prisma, row, ctx)];
-            case 1: return [2 /*return*/, (_a.sent())];
-        }
-    });
-}); };
-var dedupeAbilityList = function (abilityList) {
-    var seen = new Set();
-    return abilityList.filter(function (ability) {
-        if (seen.has(ability)) {
-            return false;
-        }
-        seen.add(ability);
-        return true;
-    });
-};
-var buildRoleAbilities = function (roles, allAbilities) {
-    var e_5, _a;
-    var roleAbilities = {};
-    try {
-        for (var _b = __values(Object.entries(roles)), _c = _b.next(); !_c.done; _c = _b.next()) {
-            var _d = __read(_c.value, 2), role = _d[0], abilities = _d[1];
-            var abilityList = abilities === "*"
-                ? allAbilities
-                : abilities;
-            roleAbilities[role] = dedupeAbilityList(abilityList);
-        }
-    }
-    catch (e_5_1) { e_5 = { error: e_5_1 }; }
-    finally {
-        try {
-            if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
-        }
-        finally { if (e_5) throw e_5.error; }
-    }
-    return roleAbilities;
-};
-var getAbilityFilters = function (prisma, runtimeDataModel, roleAbilities, role, model, operation, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var abilities, relevant;
-    return __generator(this, function (_a) {
-        abilities = roleAbilities[role] || [];
-        relevant = abilities.filter(function (ability) { return ability.model === model && ability.operation === operation; });
-        if (relevant.length === 0) {
-            return [2 /*return*/, []];
-        }
-        return [2 /*return*/, Promise.all(relevant.map(function (ability) {
-                return resolveExpression(prisma, runtimeDataModel, model, ability.expression, context);
-            }))];
-    });
-}); };
-var applyReadSelections = function (prisma, runtimeDataModel, roleAbilities, role, model, args, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var _a, _b, key, selection, _loop_2, _c, _d, _e, field, value, e_6_1, e_7_1;
-    var e_7, _f, e_6, _g;
-    var _h;
-    return __generator(this, function (_j) {
-        switch (_j.label) {
-            case 0:
-                _j.trys.push([0, 11, 12, 13]);
-                _a = __values(["include", "select"]), _b = _a.next();
-                _j.label = 1;
-            case 1:
-                if (!!_b.done) return [3 /*break*/, 10];
-                key = _b.value;
-                selection = args[key];
-                if (!selection || !isPlainObject(selection))
-                    return [3 /*break*/, 9];
-                _loop_2 = function (field, value) {
-                    var fields, fieldMeta, relatedModel, abilityFilters, abilityWhere, nextArgs;
-                    return __generator(this, function (_k) {
-                        switch (_k.label) {
-                            case 0:
-                                fields = extractModelFields(runtimeDataModel, model);
-                                fieldMeta = fields.find(function (f) { return f.name === field; });
-                                if (!fieldMeta || fieldMeta.kind !== "object")
-                                    return [2 /*return*/, "continue"];
-                                relatedModel = fieldMeta.type;
-                                return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "SELECT", context)];
-                            case 1:
-                                abilityFilters = _k.sent();
-                                if (!abilityFilters || abilityFilters.length === 0) {
-                                    selection[field] = false;
-                                    return [2 /*return*/, "continue"];
-                                }
-                                abilityWhere = combineAbilityFilters(abilityFilters);
-                                nextArgs = value === true ? {} : __assign({}, value);
-                                if (fieldMeta.isList) {
-                                    nextArgs.where =
-                                        (_h = mergeWhere(nextArgs.where, abilityWhere)) !== null && _h !== void 0 ? _h : nextArgs.where;
-                                }
-                                return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, relatedModel, nextArgs, context)];
-                            case 2:
-                                _k.sent();
-                                selection[field] = nextArgs;
-                                return [2 /*return*/];
+            var manifestRoles = Object.keys(roles)
+                .sort()
+                .map(function (roleName) {
+                var roleAbilities = roles[roleName];
+                var grants = Array.isArray(roleAbilities)
+                    ? roleAbilities.map(function (ability) {
+                        if (!ability.model || !ability.slug) {
+                            throw new Error("Ability for role ".concat(roleName, " is missing model or slug"));
                         }
-                    });
-                };
-                _j.label = 2;
-            case 2:
-                _j.trys.push([2, 7, 8, 9]);
-                _c = (e_6 = void 0, __values(Object.entries(selection))), _d = _c.next();
-                _j.label = 3;
-            case 3:
-                if (!!_d.done) return [3 /*break*/, 6];
-                _e = __read(_d.value, 2), field = _e[0], value = _e[1];
-                return [5 /*yield**/, _loop_2(field, value)];
-            case 4:
-                _j.sent();
-                _j.label = 5;
-            case 5:
-                _d = _c.next();
-                return [3 /*break*/, 3];
-            case 6: return [3 /*break*/, 9];
-            case 7:
-                e_6_1 = _j.sent();
-                e_6 = { error: e_6_1 };
-                return [3 /*break*/, 9];
-            case 8:
-                try {
-                    if (_d && !_d.done && (_g = _c.return)) _g.call(_c);
-                }
-                finally { if (e_6) throw e_6.error; }
-                return [7 /*endfinally*/];
-            case 9:
-                _b = _a.next();
-                return [3 /*break*/, 1];
-            case 10: return [3 /*break*/, 13];
-            case 11:
-                e_7_1 = _j.sent();
-                e_7 = { error: e_7_1 };
-                return [3 /*break*/, 13];
-            case 12:
-                try {
-                    if (_b && !_b.done && (_f = _a.return)) _f.call(_a);
-                }
-                finally { if (e_7) throw e_7.error; }
-                return [7 /*endfinally*/];
-            case 13: return [2 /*return*/];
-        }
-    });
-}); };
-var assertCreateAllowed = function (prisma, runtimeDataModel, roleAbilities, role, model, data, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var abilityFilters, abilityWhere;
-    var _a;
-    return __generator(this, function (_b) {
-        switch (_b.label) {
-            case 0: return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "INSERT", context)];
-            case 1:
-                abilityFilters = (_a = (_b.sent())) !== null && _a !== void 0 ? _a : [];
-                abilityWhere = combineAbilityFilters(abilityFilters);
-                if (!abilityWhere) {
-                    throw permissionError(model, "create");
-                }
-                if (isEmptyWhere(abilityWhere))
-                    return [2 /*return*/];
-                return [4 /*yield*/, matchesCreateWhere(prisma, runtimeDataModel, model, data, abilityWhere)];
-            case 2:
-                if (!(_b.sent())) {
-                    throw permissionError(model, "create");
-                }
-                return [2 /*return*/];
-        }
-    });
-}); };
-var assertRecordAllowed = function (prisma, runtimeDataModel, roleAbilities, role, model, operation, where, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var abilityFilters, abilityWhere, combinedWhere, delegate, record;
-    var _a;
-    var _b, _c, _d;
-    return __generator(this, function (_e) {
-        switch (_e.label) {
-            case 0: return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, operation, context)];
-            case 1:
-                abilityFilters = (_b = (_e.sent())) !== null && _b !== void 0 ? _b : [];
-                abilityWhere = combineAbilityFilters(abilityFilters);
-                if (!abilityWhere) {
-                    return [2 /*return*/, false];
-                }
-                combinedWhere = (_c = mergeWhere(where, abilityWhere)) !== null && _c !== void 0 ? _c : where;
-                delegate = prisma[lowerModelName(model)];
-                return [4 /*yield*/, delegate.findFirst({
-                        where: combinedWhere,
-                        select: (_a = {}, _a[(_d = getIdField(runtimeDataModel, model)) !== null && _d !== void 0 ? _d : "id"] = true, _a),
-                    })];
-            case 2:
-                record = _e.sent();
-                return [2 /*return*/, !!record];
-        }
-    });
-}); };
-var assertConnectStyleTargetsAllowed = function (prisma, runtimeDataModel, roleAbilities, role, model, targetInput, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var items, abilityFilters, abilityWhere, uniqueItems, _loop_3, items_2, items_2_1, item, delegate, combinedWhere, matchedCount;
-    var e_8, _a;
-    var _b, _c;
-    return __generator(this, function (_d) {
-        switch (_d.label) {
-            case 0:
-                items = (Array.isArray(targetInput) ? targetInput : [targetInput]).filter(function (item) {
-                    return isPlainObject(item) && !isEmptyWhere(item);
-                });
-                if (items.length === 0)
-                    return [2 /*return*/];
-                return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "UPDATE", context)];
-            case 1:
-                abilityFilters = (_b = (_d.sent())) !== null && _b !== void 0 ? _b : [];
-                abilityWhere = combineAbilityFilters(abilityFilters);
-                if (!abilityWhere) {
-                    throw updateNotFoundError();
-                }
-                if (isEmptyWhere(abilityWhere))
-                    return [2 /*return*/];
-                uniqueItems = [];
-                _loop_3 = function (item) {
-                    if (!uniqueItems.some(function (candidate) { return (0, isEqual_1.default)(candidate, item); })) {
-                        uniqueItems.push(item);
-                    }
-                };
-                try {
-                    for (items_2 = __values(items), items_2_1 = items_2.next(); !items_2_1.done; items_2_1 = items_2.next()) {
-                        item = items_2_1.value;
-                        _loop_3(item);
-                    }
-                }
-                catch (e_8_1) { e_8 = { error: e_8_1 }; }
-                finally {
-                    try {
-                        if (items_2_1 && !items_2_1.done && (_a = items_2.return)) _a.call(items_2);
-                    }
-                    finally { if (e_8) throw e_8.error; }
-                }
-                delegate = prisma[lowerModelName(model)];
-                combinedWhere = (_c = mergeWhere({ OR: uniqueItems }, abilityWhere)) !== null && _c !== void 0 ? _c : {
-                    OR: uniqueItems,
-                };
-                return [4 /*yield*/, delegate.count({ where: combinedWhere })];
-            case 2:
-                matchedCount = _d.sent();
-                if (matchedCount < uniqueItems.length) {
-                    throw updateNotFoundError();
-                }
-                return [2 /*return*/];
-        }
-    });
-}); };
-var assertCurrentRelationTargetsAllowed = function (prisma, runtimeDataModel, roleAbilities, role, model, fieldMeta, currentWhere, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var relatedModel, relatedIdField, delegate, currentRecord, currentRelationValue, currentTargets;
-    var _a, _b;
-    return __generator(this, function (_c) {
-        switch (_c.label) {
-            case 0:
-                if (!currentWhere || isEmptyWhere(currentWhere))
-                    return [2 /*return*/];
-                relatedModel = fieldMeta.type;
-                relatedIdField = getIdField(runtimeDataModel, relatedModel);
-                if (!relatedIdField)
-                    return [2 /*return*/];
-                delegate = prisma[lowerModelName(model)];
-                return [4 /*yield*/, delegate.findFirst({
-                        where: currentWhere,
-                        select: (_a = {},
-                            _a[fieldMeta.name] = {
-                                select: (_b = {},
-                                    _b[relatedIdField] = true,
-                                    _b),
-                            },
-                            _a),
-                    })];
-            case 1:
-                currentRecord = _c.sent();
-                if (!currentRecord)
-                    return [2 /*return*/];
-                currentRelationValue = currentRecord[fieldMeta.name];
-                currentTargets = fieldMeta.isList
-                    ? Array.isArray(currentRelationValue)
-                        ? currentRelationValue
-                        : []
-                    : currentRelationValue
-                        ? [currentRelationValue]
-                        : [];
-                if (currentTargets.length === 0)
-                    return [2 /*return*/];
-                return [4 /*yield*/, assertConnectStyleTargetsAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, currentTargets, context)];
-            case 2:
-                _c.sent();
-                return [2 /*return*/];
-        }
-    });
-}); };
-var applyNestedWrites = function (prisma_1, runtimeDataModel_1, roleAbilities_1, role_1, model_1, data_1, context_1) {
-    var args_1 = [];
-    for (var _i = 7; _i < arguments.length; _i++) {
-        args_1[_i - 7] = arguments[_i];
-    }
-    return __awaiter(void 0, __spreadArray([prisma_1, runtimeDataModel_1, roleAbilities_1, role_1, model_1, data_1, context_1], __read(args_1), false), void 0, function (prisma, runtimeDataModel, roleAbilities, role, model, data, context, options) {
-        var mode, currentWhere, shouldCheckRelationMutations, fields, _loop_4, _a, _b, _c, field, value, e_9_1;
-        var e_9, _d;
-        var _e, _f, _g, _h, _j, _k, _l, _m;
-        if (options === void 0) { options = {}; }
-        return __generator(this, function (_o) {
-            switch (_o.label) {
-                case 0:
-                    mode = (_e = options.mode) !== null && _e !== void 0 ? _e : "create";
-                    currentWhere = options.currentWhere;
-                    shouldCheckRelationMutations = mode === "update";
-                    if (!isPlainObject(data))
-                        return [2 /*return*/];
-                    fields = extractModelFields(runtimeDataModel, model);
-                    _loop_4 = function (field, value) {
-                        var fieldMeta, relatedModel, handleCreate, handleUpdate, handleDelete, items, items_3, items_3_1, item, filters, abilityWhere, e_10_1, items, items_4, items_4_1, item, where, canUpdate, e_11_1, items, items_5, items_5_1, item, filters, abilityWhere, _p, _q, key, merged, _r, _s, key, e_12_1;
-                        var e_10, _t, e_11, _u, e_12, _v, e_13, _w, e_14, _x;
-                        return __generator(this, function (_y) {
-                            switch (_y.label) {
-                                case 0:
-                                    fieldMeta = fields.find(function (f) { return f.name === field; });
-                                    if (!fieldMeta || fieldMeta.kind !== "object")
-                                        return [2 /*return*/, "continue"];
-                                    relatedModel = fieldMeta.type;
-                                    if (!isPlainObject(value))
-                                        return [2 /*return*/, "continue"];
-                                    handleCreate = function (createValue) { return __awaiter(void 0, void 0, void 0, function () {
-                                        var items, items_6, items_6_1, item, e_15_1;
-                                        var e_15, _a;
-                                        return __generator(this, function (_b) {
-                                            switch (_b.label) {
-                                                case 0:
-                                                    items = Array.isArray(createValue) ? createValue : [createValue];
-                                                    _b.label = 1;
-                                                case 1:
-                                                    _b.trys.push([1, 7, 8, 9]);
-                                                    items_6 = __values(items), items_6_1 = items_6.next();
-                                                    _b.label = 2;
-                                                case 2:
-                                                    if (!!items_6_1.done) return [3 /*break*/, 6];
-                                                    item = items_6_1.value;
-                                                    if (!isPlainObject(item)) return [3 /*break*/, 5];
-                                                    return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item, context)];
-                                                case 3:
-                                                    _b.sent();
-                                                    return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item, context, options)];
-                                                case 4:
-                                                    _b.sent();
-                                                    _b.label = 5;
-                                                case 5:
-                                                    items_6_1 = items_6.next();
-                                                    return [3 /*break*/, 2];
-                                                case 6: return [3 /*break*/, 9];
-                                                case 7:
-                                                    e_15_1 = _b.sent();
-                                                    e_15 = { error: e_15_1 };
-                                                    return [3 /*break*/, 9];
-                                                case 8:
-                                                    try {
-                                                        if (items_6_1 && !items_6_1.done && (_a = items_6.return)) _a.call(items_6);
-                                                    }
-                                                    finally { if (e_15) throw e_15.error; }
-                                                    return [7 /*endfinally*/];
-                                                case 9: return [2 /*return*/];
-                                            }
-                                        });
-                                    }); };
-                                    handleUpdate = function (updateValue) { return __awaiter(void 0, void 0, void 0, function () {
-                                        var items, items_7, items_7_1, item, where, allowed, e_16_1;
-                                        var e_16, _a;
-                                        var _b;
-                                        return __generator(this, function (_c) {
-                                            switch (_c.label) {
-                                                case 0:
-                                                    items = Array.isArray(updateValue) ? updateValue : [updateValue];
-                                                    _c.label = 1;
-                                                case 1:
-                                                    _c.trys.push([1, 7, 8, 9]);
-                                                    items_7 = __values(items), items_7_1 = items_7.next();
-                                                    _c.label = 2;
-                                                case 2:
-                                                    if (!!items_7_1.done) return [3 /*break*/, 6];
-                                                    item = items_7_1.value;
-                                                    if (!isPlainObject(item))
-                                                        return [3 /*break*/, 5];
-                                                    where = (_b = item.where) !== null && _b !== void 0 ? _b : {};
-                                                    return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "UPDATE", where, context)];
-                                                case 3:
-                                                    allowed = _c.sent();
-                                                    if (!allowed) {
-                                                        throw updateNotFoundError();
-                                                    }
-                                                    if (!item.data) return [3 /*break*/, 5];
-                                                    return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.data, context, __assign(__assign({}, options), { currentWhere: where }))];
-                                                case 4:
-                                                    _c.sent();
-                                                    _c.label = 5;
-                                                case 5:
-                                                    items_7_1 = items_7.next();
-                                                    return [3 /*break*/, 2];
-                                                case 6: return [3 /*break*/, 9];
-                                                case 7:
-                                                    e_16_1 = _c.sent();
-                                                    e_16 = { error: e_16_1 };
-                                                    return [3 /*break*/, 9];
-                                                case 8:
-                                                    try {
-                                                        if (items_7_1 && !items_7_1.done && (_a = items_7.return)) _a.call(items_7);
-                                                    }
-                                                    finally { if (e_16) throw e_16.error; }
-                                                    return [7 /*endfinally*/];
-                                                case 9: return [2 /*return*/];
-                                            }
-                                        });
-                                    }); };
-                                    handleDelete = function (deleteValue) { return __awaiter(void 0, void 0, void 0, function () {
-                                        var items, items_8, items_8_1, item, where, allowed, e_17_1;
-                                        var e_17, _a;
-                                        return __generator(this, function (_b) {
-                                            switch (_b.label) {
-                                                case 0:
-                                                    items = Array.isArray(deleteValue) ? deleteValue : [deleteValue];
-                                                    _b.label = 1;
-                                                case 1:
-                                                    _b.trys.push([1, 6, 7, 8]);
-                                                    items_8 = __values(items), items_8_1 = items_8.next();
-                                                    _b.label = 2;
-                                                case 2:
-                                                    if (!!items_8_1.done) return [3 /*break*/, 5];
-                                                    item = items_8_1.value;
-                                                    where = isPlainObject(item) ? item : {};
-                                                    return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "DELETE", where, context)];
-                                                case 3:
-                                                    allowed = _b.sent();
-                                                    if (!allowed) {
-                                                        throw deleteNotFoundError();
-                                                    }
-                                                    _b.label = 4;
-                                                case 4:
-                                                    items_8_1 = items_8.next();
-                                                    return [3 /*break*/, 2];
-                                                case 5: return [3 /*break*/, 8];
-                                                case 6:
-                                                    e_17_1 = _b.sent();
-                                                    e_17 = { error: e_17_1 };
-                                                    return [3 /*break*/, 8];
-                                                case 7:
-                                                    try {
-                                                        if (items_8_1 && !items_8_1.done && (_a = items_8.return)) _a.call(items_8);
-                                                    }
-                                                    finally { if (e_17) throw e_17.error; }
-                                                    return [7 /*endfinally*/];
-                                                case 8: return [2 /*return*/];
-                                            }
-                                        });
-                                    }); };
-                                    if (!value.create) return [3 /*break*/, 2];
-                                    return [4 /*yield*/, handleCreate(value.create)];
-                                case 1:
-                                    _y.sent();
-                                    _y.label = 2;
-                                case 2:
-                                    if (!((_f = value.createMany) === null || _f === void 0 ? void 0 : _f.data)) return [3 /*break*/, 4];
-                                    return [4 /*yield*/, handleCreate(value.createMany.data)];
-                                case 3:
-                                    _y.sent();
-                                    _y.label = 4;
-                                case 4:
-                                    if (!value.update) return [3 /*break*/, 6];
-                                    return [4 /*yield*/, handleUpdate(value.update)];
-                                case 5:
-                                    _y.sent();
-                                    _y.label = 6;
-                                case 6:
-                                    if (!value.updateMany) return [3 /*break*/, 15];
-                                    items = Array.isArray(value.updateMany)
-                                        ? value.updateMany
-                                        : [value.updateMany];
-                                    _y.label = 7;
-                                case 7:
-                                    _y.trys.push([7, 13, 14, 15]);
-                                    items_3 = (e_10 = void 0, __values(items)), items_3_1 = items_3.next();
-                                    _y.label = 8;
-                                case 8:
-                                    if (!!items_3_1.done) return [3 /*break*/, 12];
-                                    item = items_3_1.value;
-                                    if (!isPlainObject(item))
-                                        return [3 /*break*/, 11];
-                                    return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "UPDATE", context)];
-                                case 9:
-                                    filters = (_g = (_y.sent())) !== null && _g !== void 0 ? _g : [];
-                                    abilityWhere = combineAbilityFilters(filters);
-                                    if (!abilityWhere) {
-                                        item.where = denyWhere(runtimeDataModel, relatedModel);
-                                    }
-                                    else {
-                                        item.where = (_j = mergeWhere((_h = item.where) !== null && _h !== void 0 ? _h : {}, abilityWhere)) !== null && _j !== void 0 ? _j : item.where;
-                                    }
-                                    if (!item.data) return [3 /*break*/, 11];
-                                    return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.data, context, __assign(__assign({}, options), { currentWhere: (_k = item.where) !== null && _k !== void 0 ? _k : {} }))];
-                                case 10:
-                                    _y.sent();
-                                    _y.label = 11;
-                                case 11:
-                                    items_3_1 = items_3.next();
-                                    return [3 /*break*/, 8];
-                                case 12: return [3 /*break*/, 15];
-                                case 13:
-                                    e_10_1 = _y.sent();
-                                    e_10 = { error: e_10_1 };
-                                    return [3 /*break*/, 15];
-                                case 14:
-                                    try {
-                                        if (items_3_1 && !items_3_1.done && (_t = items_3.return)) _t.call(items_3);
-                                    }
-                                    finally { if (e_10) throw e_10.error; }
-                                    return [7 /*endfinally*/];
-                                case 15:
-                                    if (!value.upsert) return [3 /*break*/, 29];
-                                    items = Array.isArray(value.upsert) ? value.upsert : [value.upsert];
-                                    _y.label = 16;
-                                case 16:
-                                    _y.trys.push([16, 27, 28, 29]);
-                                    items_4 = (e_11 = void 0, __values(items)), items_4_1 = items_4.next();
-                                    _y.label = 17;
-                                case 17:
-                                    if (!!items_4_1.done) return [3 /*break*/, 26];
-                                    item = items_4_1.value;
-                                    if (!isPlainObject(item))
-                                        return [3 /*break*/, 25];
-                                    where = (_l = item.where) !== null && _l !== void 0 ? _l : {};
-                                    return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "UPDATE", where, context)];
-                                case 18:
-                                    canUpdate = _y.sent();
-                                    if (!canUpdate) return [3 /*break*/, 21];
-                                    if (!item.update) return [3 /*break*/, 20];
-                                    return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.update, context, __assign(__assign({}, options), { currentWhere: where }))];
-                                case 19:
-                                    _y.sent();
-                                    _y.label = 20;
-                                case 20: return [3 /*break*/, 25];
-                                case 21:
-                                    if (!item.create) return [3 /*break*/, 24];
-                                    return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.create, context)];
-                                case 22:
-                                    _y.sent();
-                                    return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, relatedModel, item.create, context, options)];
-                                case 23:
-                                    _y.sent();
-                                    return [3 /*break*/, 25];
-                                case 24: throw updateNotFoundError();
-                                case 25:
-                                    items_4_1 = items_4.next();
-                                    return [3 /*break*/, 17];
-                                case 26: return [3 /*break*/, 29];
-                                case 27:
-                                    e_11_1 = _y.sent();
-                                    e_11 = { error: e_11_1 };
-                                    return [3 /*break*/, 29];
-                                case 28:
-                                    try {
-                                        if (items_4_1 && !items_4_1.done && (_u = items_4.return)) _u.call(items_4);
-                                    }
-                                    finally { if (e_11) throw e_11.error; }
-                                    return [7 /*endfinally*/];
-                                case 29:
-                                    if (!value.delete) return [3 /*break*/, 31];
-                                    return [4 /*yield*/, handleDelete(value.delete)];
-                                case 30:
-                                    _y.sent();
-                                    _y.label = 31;
-                                case 31:
-                                    if (!value.deleteMany) return [3 /*break*/, 39];
-                                    items = Array.isArray(value.deleteMany)
-                                        ? value.deleteMany
-                                        : [value.deleteMany];
-                                    _y.label = 32;
-                                case 32:
-                                    _y.trys.push([32, 37, 38, 39]);
-                                    items_5 = (e_12 = void 0, __values(items)), items_5_1 = items_5.next();
-                                    _y.label = 33;
-                                case 33:
-                                    if (!!items_5_1.done) return [3 /*break*/, 36];
-                                    item = items_5_1.value;
-                                    if (!isPlainObject(item))
-                                        return [3 /*break*/, 35];
-                                    return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, relatedModel, "DELETE", context)];
-                                case 34:
-                                    filters = (_m = (_y.sent())) !== null && _m !== void 0 ? _m : [];
-                                    abilityWhere = combineAbilityFilters(filters);
-                                    if (!abilityWhere) {
-                                        try {
-                                            for (_p = (e_13 = void 0, __values(Object.keys(item))), _q = _p.next(); !_q.done; _q = _p.next()) {
-                                                key = _q.value;
-                                                delete item[key];
-                                            }
-                                        }
-                                        catch (e_13_1) { e_13 = { error: e_13_1 }; }
-                                        finally {
-                                            try {
-                                                if (_q && !_q.done && (_w = _p.return)) _w.call(_p);
-                                            }
-                                            finally { if (e_13) throw e_13.error; }
-                                        }
-                                        Object.assign(item, denyWhere(runtimeDataModel, relatedModel));
-                                    }
-                                    else {
-                                        merged = mergeWhere((0, cloneDeep_1.default)(item), abilityWhere);
-                                        if (merged && merged !== item) {
-                                            try {
-                                                for (_r = (e_14 = void 0, __values(Object.keys(item))), _s = _r.next(); !_s.done; _s = _r.next()) {
-                                                    key = _s.value;
-                                                    delete item[key];
-                                                }
-                                            }
-                                            catch (e_14_1) { e_14 = { error: e_14_1 }; }
-                                            finally {
-                                                try {
-                                                    if (_s && !_s.done && (_x = _r.return)) _x.call(_r);
-                                                }
-                                                finally { if (e_14) throw e_14.error; }
-                                            }
-                                            Object.assign(item, merged);
-                                        }
-                                    }
-                                    _y.label = 35;
-                                case 35:
-                                    items_5_1 = items_5.next();
-                                    return [3 /*break*/, 33];
-                                case 36: return [3 /*break*/, 39];
-                                case 37:
-                                    e_12_1 = _y.sent();
-                                    e_12 = { error: e_12_1 };
-                                    return [3 /*break*/, 39];
-                                case 38:
-                                    try {
-                                        if (items_5_1 && !items_5_1.done && (_v = items_5.return)) _v.call(items_5);
-                                    }
-                                    finally { if (e_12) throw e_12.error; }
-                                    return [7 /*endfinally*/];
-                                case 39:
-                                    if (!shouldCheckRelationMutations) return [3 /*break*/, 48];
-                                    if (!value.connect) return [3 /*break*/, 41];
-                                    return [4 /*yield*/, assertConnectStyleTargetsAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, value.connect, context)];
-                                case 40:
-                                    _y.sent();
-                                    _y.label = 41;
-                                case 41:
-                                    if (!value.set) return [3 /*break*/, 44];
-                                    return [4 /*yield*/, assertConnectStyleTargetsAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, value.set, context)];
-                                case 42:
-                                    _y.sent();
-                                    if (!fieldMeta.isList) return [3 /*break*/, 44];
-                                    return [4 /*yield*/, assertCurrentRelationTargetsAllowed(prisma, runtimeDataModel, roleAbilities, role, model, fieldMeta, currentWhere, context)];
-                                case 43:
-                                    _y.sent();
-                                    _y.label = 44;
-                                case 44:
-                                    if (!(value.disconnect &&
-                                        value.disconnect !== true &&
-                                        value.disconnect !== false)) return [3 /*break*/, 46];
-                                    return [4 /*yield*/, assertConnectStyleTargetsAllowed(prisma, runtimeDataModel, roleAbilities, role, relatedModel, value.disconnect, context)];
-                                case 45:
-                                    _y.sent();
-                                    _y.label = 46;
-                                case 46:
-                                    if (!(value.disconnect === true && !fieldMeta.isList)) return [3 /*break*/, 48];
-                                    return [4 /*yield*/, assertCurrentRelationTargetsAllowed(prisma, runtimeDataModel, roleAbilities, role, model, fieldMeta, currentWhere, context)];
-                                case 47:
-                                    _y.sent();
-                                    _y.label = 48;
-                                case 48: return [2 /*return*/];
-                            }
-                        });
-                    };
-                    _o.label = 1;
-                case 1:
-                    _o.trys.push([1, 6, 7, 8]);
-                    _a = __values(Object.entries(data)), _b = _a.next();
-                    _o.label = 2;
-                case 2:
-                    if (!!_b.done) return [3 /*break*/, 5];
-                    _c = __read(_b.value, 2), field = _c[0], value = _c[1];
-                    return [5 /*yield**/, _loop_4(field, value)];
-                case 3:
-                    _o.sent();
-                    _o.label = 4;
-                case 4:
-                    _b = _a.next();
-                    return [3 /*break*/, 2];
-                case 5: return [3 /*break*/, 8];
-                case 6:
-                    e_9_1 = _o.sent();
-                    e_9 = { error: e_9_1 };
-                    return [3 /*break*/, 8];
-                case 7:
-                    try {
-                        if (_b && !_b.done && (_d = _a.return)) _d.call(_a);
-                    }
-                    finally { if (e_9) throw e_9.error; }
-                    return [7 /*endfinally*/];
-                case 8: return [2 /*return*/];
+                        return _this.createAbilityName(ability.model, ability.slug);
+                    })
+                    : "*";
+                return { grants: grants, roleName: roleName };
+            });
+            return {
+                abilities: manifestAbilities,
+                databaseScope: _this.getDatabaseScope(),
+                roles: manifestRoles,
+            };
+        };
+        this.getSetupManifestId = function () { return "".concat(_this.getDatabaseScope(), ":public"); };
+        this.getStoredSetupManifestHash = function (manifestId_1) {
+            var args_1 = [];
+            for (var _i = 1; _i < arguments.length; _i++) {
+                args_1[_i - 1] = arguments[_i];
             }
-        });
-    });
-};
-var Yates = /** @class */ (function () {
-    function Yates(prisma) {
-        var _this = this;
-        this.prisma = prisma;
-        this.inspectRunTimeDataModel = function () {
-            var runtimeDataModel = _this.prisma
-                ._runtimeDataModel;
-            return runtimeDataModel;
+            return __awaiter(_this, __spreadArray([manifestId_1], __read(args_1), false), void 0, function (manifestId, prisma) {
+                var rows;
+                var _a, _b;
+                if (prisma === void 0) { prisma = this.prisma; }
+                return __generator(this, function (_c) {
+                    switch (_c.label) {
+                        case 0: return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\tSELECT manifest_hash\n\t\t\t\tFROM _yates._yates_schema_syncs\n\t\t\t\tWHERE id = $1\n\t\t\t\tLIMIT 1;\n\t\t\t", manifestId)];
+                        case 1:
+                            rows = _c.sent();
+                            return [2 /*return*/, (_b = (_a = rows[0]) === null || _a === void 0 ? void 0 : _a.manifest_hash) !== null && _b !== void 0 ? _b : null];
+                    }
+                });
+            });
+        };
+        this.upsertSetupManifestHash = function (manifestId, manifestHash, prisma) {
+            if (prisma === void 0) { prisma = _this.prisma; }
+            return prisma.$executeRawUnsafe("\n\t\t\t\tINSERT INTO _yates._yates_schema_syncs (id, manifest_hash, manifest_version, yates_version, app_name, applied_at)\n\t\t\t\tVALUES ($1, $2, $3, $4, $5, now())\n\t\t\t\tON CONFLICT (id) DO UPDATE\n\t\t\t\tSET manifest_hash = EXCLUDED.manifest_hash,\n\t\t\t\t\tmanifest_version = EXCLUDED.manifest_version,\n\t\t\t\t\tyates_version = EXCLUDED.yates_version,\n\t\t\t\t\tapp_name = EXCLUDED.app_name,\n\t\t\t\t\tapplied_at = now();\n\t\t\t", manifestId, manifestHash, SETUP_MANIFEST_VERSION, YATES_VERSION, "yates");
         };
         this.getDefaultAbilities = function (models) {
-            var e_18, _a;
+            var e_3, _a;
             var abilities = {};
             try {
                 for (var models_1 = __values(models), models_1_1 = models_1.next(); !models_1_1.done; models_1_1 = models_1.next()) {
@@ -1257,28 +375,28 @@ var Yates = /** @class */ (function () {
                     abilities[model] = {
                         create: {
                             description: "Create ".concat(model),
-                            expression: {},
+                            expression: "true",
                             operation: "INSERT",
                             model: model,
                             slug: "create",
                         },
                         read: {
                             description: "Read ".concat(model),
-                            expression: {},
+                            expression: "true",
                             operation: "SELECT",
                             model: model,
                             slug: "read",
                         },
                         update: {
                             description: "Update ".concat(model),
-                            expression: {},
+                            expression: "true",
                             operation: "UPDATE",
                             model: model,
                             slug: "update",
                         },
                         delete: {
                             description: "Delete ".concat(model),
-                            expression: {},
+                            expression: "true",
                             operation: "DELETE",
                             model: model,
                             slug: "delete",
@@ -1286,312 +404,801 @@ var Yates = /** @class */ (function () {
                     };
                 }
             }
-            catch (e_18_1) { e_18 = { error: e_18_1 }; }
+            catch (e_3_1) { e_3 = { error: e_3_1 }; }
             finally {
                 try {
                     if (models_1_1 && !models_1_1.done && (_a = models_1.return)) _a.call(models_1);
                 }
-                finally { if (e_18) throw e_18.error; }
+                finally { if (e_3) throw e_3.error; }
             }
             return abilities;
         };
-    }
-    return Yates;
-}());
-exports.Yates = Yates;
-/**
- * Creates an extended client that applies role abilities to Prisma queries.
- **/
-exports.__private = {
-    denyWhere: denyWhere,
-    getIdField: getIdField,
-    matchesScalarFilter: matchesScalarFilter,
-    validateContext: validateContext,
-};
-var setup = function (params) { return __awaiter(void 0, void 0, void 0, function () {
-    var start, prisma, customAbilities, getRoles, getContext, yates, runtimeDataModel, models, diff, defaultAbilities, abilities, models_2, models_2_1, model, modelCustomAbilities, modelAbilities, ability, operation, roles, allAbilities, roleAbilities, client;
-    var e_19, _a;
-    var _b;
-    return __generator(this, function (_c) {
-        start = performance.now();
-        prisma = params.prisma, customAbilities = params.customAbilities, getRoles = params.getRoles, getContext = params.getContext;
-        yates = new Yates(prisma);
-        runtimeDataModel = yates.inspectRunTimeDataModel();
-        models = Object.keys(runtimeDataModel.models).map(function (m) { return runtimeDataModel.models[m].dbName || m; });
-        if (customAbilities) {
-            diff = (0, difference_1.default)(Object.keys(customAbilities), models);
-            if (diff.length) {
-                throw new Error("Invalid models in custom abilities: ".concat(diff.join(", ")));
-            }
-        }
-        defaultAbilities = yates.getDefaultAbilities(models);
-        abilities = (0, cloneDeep_1.default)(defaultAbilities);
-        try {
-            for (models_2 = __values(models), models_2_1 = models_2.next(); !models_2_1.done; models_2_1 = models_2.next()) {
-                model = models_2_1.value;
-                modelCustomAbilities = customAbilities === null || customAbilities === void 0 ? void 0 : customAbilities[model];
-                if (modelCustomAbilities) {
-                    if (!abilities[model]) {
-                        abilities[model] = {};
-                    }
-                    modelAbilities = abilities[model];
-                    for (ability in modelCustomAbilities) {
-                        operation = (_b = modelCustomAbilities === null || modelCustomAbilities === void 0 ? void 0 : modelCustomAbilities[ability]) === null || _b === void 0 ? void 0 : _b.operation;
-                        if (!operation)
-                            continue;
-                        if (!VALID_OPERATIONS.includes(operation)) {
-                            throw new Error("Invalid operation: ".concat(operation));
+        // This uses client extensions to set the role and context for the current user so that RLS can be applied
+        this.createClient = function (getContext, options) {
+            if (options === void 0) { options = {}; }
+            var prisma = _this.prisma;
+            // Set default options
+            var _a = options.txMaxWait, txMaxWait = _a === void 0 ? 30000 : _a, _b = options.txTimeout, txTimeout = _b === void 0 ? 30000 : _b;
+            // By default, Prisma will batch requests by the transaction ID if it is present.
+            // This behaviour prevents automatic batching from working when using Yates, since all queries are executed inside an interactive transaction.
+            // To get around this we by monkey patching the batching function to use the Yates ID as the batch ID.
+            // To get the batching to work we also need to ensure that all the requests we might want to batch together are generated inside the same tick.
+            // This means that all the requests per-tick that have the same role and context values will be batched together,
+            // allowing the in-built prisma batch optimizations to work for us.
+            // This is why we use process.nextTick and the tickActive flag to ensure we only tick once at a time.
+            // See:
+            // - https://github.com/prisma/prisma/blob/5.21.1/packages/client/src/runtime/RequestHandler.ts#L122
+            // - https://www.prisma.io/docs/orm/prisma-client/queries/query-optimization-performance
+            prisma._requestHandler.dataloader.options.batchBy = function (request) {
+                var _a;
+                var batchIdPQ = _this.getBatchId(request.protocolQuery);
+                if ((_a = request.transaction) === null || _a === void 0 ? void 0 : _a.id) {
+                    return "transaction-".concat(request.transaction.id).concat(batchIdPQ ? "-".concat(batchIdPQ) : "");
+                }
+                return _this.getBatchId(request.protocolQuery);
+            };
+            var tickActive = false;
+            var batches = {};
+            // This function is called once per tick, and processes all the batches that have been created during that tick.
+            // Each batch represents a unique role + context combination, and contains all the requests that need to be executed with that role + context.
+            var dispatchBatches = function () {
+                var e_4, _a;
+                var _loop_1 = function (key, batch) {
+                    delete batches[key];
+                    // Because batch transactions inside a prisma client query extension can run out of order if used with async middleware,
+                    // we need to run the logic inside an interactive transaction, however this brings a different set of problems in that the
+                    // main query will no longer automatically run inside the transaction. We resolve this issue by manually executing the prisma request.
+                    // See https://github.com/prisma/prisma/issues/18276
+                    prisma
+                        .$transaction(function (tx) { return __awaiter(_this, void 0, void 0, function () {
+                        var _a, _b, _c, key_1, value, e_5_1, txId, results;
+                        var e_5, _d;
+                        return __generator(this, function (_e) {
+                            switch (_e.label) {
+                                case 0: 
+                                // Switch to the user role, We can't use a prepared statement here, due to limitations in PG not allowing prepared statements to be used in SET LOCAL ROLE
+                                return [4 /*yield*/, tx.$queryRawUnsafe("SET LOCAL ROLE ".concat(batch.pgRole))];
+                                case 1:
+                                    // Switch to the user role, We can't use a prepared statement here, due to limitations in PG not allowing prepared statements to be used in SET LOCAL ROLE
+                                    _e.sent();
+                                    _e.label = 2;
+                                case 2:
+                                    _e.trys.push([2, 7, 8, 9]);
+                                    _a = __values((0, toPairs_1.default)(batch.context)), _b = _a.next();
+                                    _e.label = 3;
+                                case 3:
+                                    if (!!_b.done) return [3 /*break*/, 6];
+                                    _c = __read(_b.value, 2), key_1 = _c[0], value = _c[1];
+                                    return [4 /*yield*/, tx.$queryRaw(templateObject_2 || (templateObject_2 = __makeTemplateObject(["SELECT set_config(", ", ", ", true);"], ["SELECT set_config(", ", ", ", true);"])), key_1, value.toString())];
+                                case 4:
+                                    _e.sent();
+                                    _e.label = 5;
+                                case 5:
+                                    _b = _a.next();
+                                    return [3 /*break*/, 3];
+                                case 6: return [3 /*break*/, 9];
+                                case 7:
+                                    e_5_1 = _e.sent();
+                                    e_5 = { error: e_5_1 };
+                                    return [3 /*break*/, 9];
+                                case 8:
+                                    try {
+                                        if (_b && !_b.done && (_d = _a.return)) _d.call(_a);
+                                    }
+                                    finally { if (e_5) throw e_5.error; }
+                                    return [7 /*endfinally*/];
+                                case 9:
+                                    txId = tx[Symbol.for("prisma.client.transaction.id")];
+                                    return [4 /*yield*/, Promise.all(batch.requests.map(function (request) {
+                                            return prisma._executeRequest(__assign(__assign({}, request.params), { transaction: {
+                                                    kind: "itx",
+                                                    id: txId,
+                                                } }));
+                                        }))];
+                                case 10:
+                                    results = _e.sent();
+                                    return [2 /*return*/, results];
+                            }
+                        });
+                    }); }, {
+                        maxWait: txMaxWait,
+                        timeout: txTimeout,
+                    })
+                        .then(function (results) {
+                        results.forEach(function (result, index) {
+                            batch.requests[index].resolve(result);
+                        });
+                    })
+                        .catch(function (e) {
+                        var e_6, _a;
+                        try {
+                            for (var _b = (e_6 = void 0, __values(batch.requests)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                                var request = _c.value;
+                                request.reject(e);
+                            }
+                        }
+                        catch (e_6_1) { e_6 = { error: e_6_1 }; }
+                        finally {
+                            try {
+                                if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+                            }
+                            finally { if (e_6) throw e_6.error; }
                         }
-                        modelAbilities[ability] = __assign(__assign({}, modelCustomAbilities[ability]), { operation: operation, model: model, slug: ability });
+                        delete batches[key];
+                    });
+                };
+                try {
+                    for (var _b = __values(Object.entries(batches)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                        var _d = __read(_c.value, 2), key = _d[0], batch = _d[1];
+                        _loop_1(key, batch);
                     }
                 }
-            }
-        }
-        catch (e_19_1) { e_19 = { error: e_19_1 }; }
-        finally {
-            try {
-                if (models_2_1 && !models_2_1.done && (_a = models_2.return)) _a.call(models_2);
-            }
-            finally { if (e_19) throw e_19.error; }
-        }
-        roles = getRoles(abilities);
-        allAbilities = Object.values(abilities).flatMap(function (modelAbilities) {
-            return modelAbilities ? Object.values(modelAbilities) : [];
-        });
-        roleAbilities = buildRoleAbilities(roles, allAbilities);
-        client = prisma.$extends({
-            name: "Yates client",
-            query: {
-                $allModels: {
-                    $allOperations: function (params) {
-                        return __awaiter(this, void 0, void 0, function () {
-                            var model, args, query, operation, queryArgs, ctx, op, context, role, filters, abilityWhere, combinedWhere, deniedWhere, fluentField, delegate, result, _a, fluentField, delegate, result, _b, items, items_9, items_9_1, item, e_20_1, allowed, filters, abilityWhere, canUpdate, allowed, filters, abilityWhere;
-                            var e_20, _c;
-                            var _d, _e, _f, _g, _h, _j, _k, _l, _m;
-                            return __generator(this, function (_o) {
-                                switch (_o.label) {
+                catch (e_4_1) { e_4 = { error: e_4_1 }; }
+                finally {
+                    try {
+                        if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+                    }
+                    finally { if (e_4) throw e_4.error; }
+                }
+            };
+            var createRoleName = _this.createRoleName.bind(_this);
+            var client = prisma.$extends({
+                name: "Yates client",
+                query: {
+                    $allModels: {
+                        $allOperations: function (params) {
+                            return __awaiter(this, void 0, void 0, function () {
+                                var model, args, query, operation, ctx, role, context, pgRole, _a, _b, k, _c, _d, v, txId, hash, __internalParams;
+                                var e_7, _e, e_8, _f;
+                                return __generator(this, function (_g) {
+                                    model = params.model, args = params.args, query = params.query, operation = params.operation;
+                                    if (!model) {
+                                        // If the model is not defined, we can't apply RLS
+                                        // This can occur when you are making a call with Prisma's $queryRaw method
+                                        return [2 /*return*/, query(args)];
+                                    }
+                                    ctx = getContext();
+                                    // If ctx is null, the middleware is explicitly skipped
+                                    if (ctx === null) {
+                                        return [2 /*return*/, query(args)];
+                                    }
+                                    role = ctx.role, context = ctx.context;
+                                    pgRole = createRoleName(role);
+                                    if (context) {
+                                        try {
+                                            for (_a = __values(Object.keys(context)), _b = _a.next(); !_b.done; _b = _a.next()) {
+                                                k = _b.value;
+                                                if (!k.match(/^[a-z_\.]+$/)) {
+                                                    throw new Error("Context variable \"".concat(k, "\" contains invalid characters. Context variables must only contain lowercase letters, numbers, periods and underscores."));
+                                                }
+                                                if (typeof context[k] !== "number" &&
+                                                    typeof context[k] !== "string" &&
+                                                    !Array.isArray(context[k])) {
+                                                    throw new Error("Context variable \"".concat(k, "\" must be a string, number or array. Got ").concat(typeof context[k]));
+                                                }
+                                                if (Array.isArray(context[k])) {
+                                                    try {
+                                                        for (_c = (e_8 = void 0, __values(context[k])), _d = _c.next(); !_d.done; _d = _c.next()) {
+                                                            v = _d.value;
+                                                            if (typeof v !== "string") {
+                                                                throw new Error("Context variable \"".concat(k, "\" must be an array of strings. Got ").concat(typeof v));
+                                                            }
+                                                        }
+                                                    }
+                                                    catch (e_8_1) { e_8 = { error: e_8_1 }; }
+                                                    finally {
+                                                        try {
+                                                            if (_d && !_d.done && (_f = _c.return)) _f.call(_c);
+                                                        }
+                                                        finally { if (e_8) throw e_8.error; }
+                                                    }
+                                                    // Cast to a JSON string so that it can be used in RLS expressions
+                                                    context[k] = JSON.stringify(context[k]);
+                                                }
+                                            }
+                                        }
+                                        catch (e_7_1) { e_7 = { error: e_7_1 }; }
+                                        finally {
+                                            try {
+                                                if (_b && !_b.done && (_e = _a.return)) _e.call(_a);
+                                            }
+                                            finally { if (e_7) throw e_7.error; }
+                                        }
+                                    }
+                                    txId = hashWithPrefix("yates_tx_", JSON.stringify(ctx));
+                                    hash = txId;
+                                    if (!batches[hash]) {
+                                        // Create a new batch for this role + context combination
+                                        batches[hash] = {
+                                            pgRole: pgRole,
+                                            context: context,
+                                            requests: [],
+                                        };
+                                        // make sure, that we only tick once at a time
+                                        if (!tickActive) {
+                                            tickActive = true;
+                                            process.nextTick(function () {
+                                                dispatchBatches();
+                                                tickActive = false;
+                                            });
+                                        }
+                                    }
+                                    __internalParams = params.__internalParams;
+                                    // Add the request to the batch, and return a promise that will be resolved or rejected in dispatchBatches
+                                    return [2 /*return*/, new Promise(function (resolve, reject) {
+                                            batches[hash].requests.push({
+                                                params: __internalParams,
+                                                query: query,
+                                                args: args,
+                                                resolve: resolve,
+                                                reject: reject,
+                                            });
+                                        }).catch(function (e) {
+                                            var _a;
+                                            // Normalize RLS errors to make them a bit more readable.
+                                            if ((_a = e.message) === null || _a === void 0 ? void 0 : _a.includes("new row violates row-level security policy for table")) {
+                                                throw new Error("You do not have permission to perform this action: ".concat(model, ".").concat(operation, "(...)"));
+                                            }
+                                            throw e;
+                                        })];
+                                });
+                            });
+                        },
+                    },
+                },
+            });
+            return client;
+        };
+        this.setRLS = function (prisma, table, roleName, slug, ability, resolvedExpression) { return __awaiter(_this, void 0, void 0, function () {
+            var operation, rawExpression, description, abilityExpression, policyExpression, policyName, quotedPolicyName, quotedRoleName, quotedTableName, existingAbilities, existingAbility, shouldUpdateAbilityTable;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        operation = ability.operation, rawExpression = ability.expression, description = ability.description;
+                        if (!rawExpression) {
+                            throw new Error("Expression must be defined for RLS abilities");
+                        }
+                        abilityExpression = resolvedExpression.abilityExpression, policyExpression = resolvedExpression.policyExpression;
+                        policyName = roleName;
+                        quotedPolicyName = this.quoteIdentifier(policyName);
+                        quotedRoleName = this.quoteIdentifier(roleName);
+                        quotedTableName = "".concat(this.quoteIdentifier("public"), ".").concat(this.quoteIdentifier(table));
+                        return [4 /*yield*/, prisma.$queryRaw(templateObject_3 || (templateObject_3 = __makeTemplateObject(["\n\t\t\t\tselect * from _yates._yates_abilities where ability_model = ", " and ability_policy_name = ", "\n\t\t\t"], ["\n\t\t\t\tselect * from _yates._yates_abilities where ability_model = ", " and ability_policy_name = ", "\n\t\t\t"])), table, policyName)];
+                    case 1:
+                        existingAbilities = _a.sent();
+                        existingAbility = existingAbilities[0];
+                        shouldUpdateAbilityTable = false;
+                        if (!!existingAbility) return [3 /*break*/, 6];
+                        debug("Creating RLS policy for", roleName, "on", table, "for", operation);
+                        if (!(operation === "INSERT")) return [3 /*break*/, 3];
+                        return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\t\tCREATE POLICY ".concat(quotedPolicyName, " ON ").concat(quotedTableName, " FOR ").concat(operation, " TO ").concat(quotedRoleName, " WITH CHECK (").concat(policyExpression, ");\n\t\t\t\t"))];
+                    case 2:
+                        _a.sent();
+                        return [3 /*break*/, 5];
+                    case 3: return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\t\tCREATE POLICY ".concat(quotedPolicyName, " ON ").concat(quotedTableName, " FOR ").concat(operation, " TO ").concat(quotedRoleName, " USING (").concat(policyExpression, ");\n\t\t\t\t"))];
+                    case 4:
+                        _a.sent();
+                        _a.label = 5;
+                    case 5:
+                        shouldUpdateAbilityTable = true;
+                        return [3 /*break*/, 11];
+                    case 6:
+                        if (!(existingAbility.ability_expression !== abilityExpression)) return [3 /*break*/, 11];
+                        debug("Updating RLS policy for", roleName, "on", table, "for", operation);
+                        if (!(operation === "INSERT")) return [3 /*break*/, 8];
+                        return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\t\tALTER POLICY ".concat(quotedPolicyName, " ON ").concat(quotedTableName, " TO ").concat(quotedRoleName, " WITH CHECK (").concat(policyExpression, ");\n\t\t\t\t"))];
+                    case 7:
+                        _a.sent();
+                        return [3 /*break*/, 10];
+                    case 8: return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\t\tALTER POLICY ".concat(quotedPolicyName, " ON ").concat(quotedTableName, " TO ").concat(quotedRoleName, " USING (").concat(policyExpression, ");\n\t\t\t\t"))];
+                    case 9:
+                        _a.sent();
+                        _a.label = 10;
+                    case 10:
+                        shouldUpdateAbilityTable = true;
+                        _a.label = 11;
+                    case 11:
+                        if (!shouldUpdateAbilityTable) return [3 /*break*/, 13];
+                        return [4 /*yield*/, upsertAbility(prisma, {
+                                ability_model: table,
+                                ability_name: slug,
+                                ability_policy_name: policyName,
+                                ability_description: description !== null && description !== void 0 ? description : "",
+                                ability_operation: operation,
+                                // We store the string representation of the expression so that
+                                // we can compare it later without having to recompute the SQL
+                                ability_expression: abilityExpression,
+                            })];
+                    case 12:
+                        _a.sent();
+                        _a.label = 13;
+                    case 13: return [2 /*return*/];
+                }
+            });
+        }); };
+        this.createRoles = function (_a) { return __awaiter(_this, [_a], void 0, function (_b) {
+            var _c, txMaxWait, _d, txTimeout, runtimeDataModel, models, diff, defaultAbilities, abilities, models_2, models_2_1, model, ability, operation, roles, setupManifest, setupManifestHash, setupManifestId, resolvedSetupAbilityExpressions, _e, _f, _g, _i, model, _h, _j, _k, _l, slug, ability, roleName, _m, _o;
+            var e_9, _p, _q;
+            var _this = this;
+            var _r;
+            var customAbilities = _b.customAbilities, getRoles = _b.getRoles, _s = _b.options, options = _s === void 0 ? {} : _s;
+            return __generator(this, function (_t) {
+                switch (_t.label) {
+                    case 0: return [4 /*yield*/, this.ensureDatabaseScope()];
+                    case 1:
+                        _t.sent();
+                        _c = options.txMaxWait, txMaxWait = _c === void 0 ? 30000 : _c, _d = options.txTimeout, txTimeout = _d === void 0 ? 30000 : _d;
+                        runtimeDataModel = this.inspectRunTimeDataModel();
+                        models = Object.keys(runtimeDataModel.models).map(function (m) { return runtimeDataModel.models[m].dbName || m; });
+                        if (customAbilities) {
+                            diff = (0, difference_1.default)(Object.keys(customAbilities), models);
+                            if (diff.length) {
+                                throw new Error("Invalid models in custom abilities: ".concat(diff.join(", ")));
+                            }
+                        }
+                        defaultAbilities = this.getDefaultAbilities(models);
+                        abilities = (0, cloneDeep_1.default)(defaultAbilities);
+                        try {
+                            for (models_2 = __values(models), models_2_1 = models_2.next(); !models_2_1.done; models_2_1 = models_2.next()) {
+                                model = models_2_1.value;
+                                if (customAbilities === null || customAbilities === void 0 ? void 0 : customAbilities[model]) {
+                                    for (ability in customAbilities[model]) {
+                                        operation = 
+                                        // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                        (_r = customAbilities[model][ability]) === null || _r === void 0 ? void 0 : _r.operation;
+                                        if (!operation)
+                                            continue;
+                                        // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                        abilities[model][ability] = __assign(__assign({}, customAbilities[model][ability]), { operation: operation, model: model, slug: ability });
+                                    }
+                                }
+                            }
+                        }
+                        catch (e_9_1) { e_9 = { error: e_9_1 }; }
+                        finally {
+                            try {
+                                if (models_2_1 && !models_2_1.done && (_p = models_2.return)) _p.call(models_2);
+                            }
+                            finally { if (e_9) throw e_9.error; }
+                        }
+                        roles = getRoles(abilities);
+                        setupManifest = this.createSetupManifest(abilities, roles);
+                        setupManifestHash = this.createSetupManifestHash(setupManifest);
+                        setupManifestId = this.getSetupManifestId();
+                        return [4 /*yield*/, this.getStoredSetupManifestHash(setupManifestId)];
+                    case 2:
+                        if ((_t.sent()) ===
+                            setupManifestHash) {
+                            debug("Yates setup manifest unchanged; skipping role reconciliation");
+                            return [2 /*return*/];
+                        }
+                        resolvedSetupAbilityExpressions = {};
+                        _e = abilities;
+                        _f = [];
+                        for (_g in _e)
+                            _f.push(_g);
+                        _i = 0;
+                        _t.label = 3;
+                    case 3:
+                        if (!(_i < _f.length)) return [3 /*break*/, 8];
+                        _g = _f[_i];
+                        if (!(_g in _e)) return [3 /*break*/, 7];
+                        model = _g;
+                        _h = abilities[model];
+                        _j = [];
+                        for (_k in _h)
+                            _j.push(_k);
+                        _l = 0;
+                        _t.label = 4;
+                    case 4:
+                        if (!(_l < _j.length)) return [3 /*break*/, 7];
+                        _k = _j[_l];
+                        if (!(_k in _h)) return [3 /*break*/, 6];
+                        slug = _k;
+                        ability = 
+                        // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                        abilities[model][slug];
+                        if (!ability.expression) {
+                            return [3 /*break*/, 6];
+                        }
+                        roleName = this.createAbilityName(model, slug);
+                        _m = resolvedSetupAbilityExpressions;
+                        _o = roleName;
+                        _q = {
+                            abilityExpression: ability.expression.toString()
+                        };
+                        return [4 /*yield*/, (0, expressions_1.expressionToSQL)(ability.expression, model)];
+                    case 5:
+                        _m[_o] = (_q.policyExpression = _t.sent(),
+                            _q);
+                        _t.label = 6;
+                    case 6:
+                        _l++;
+                        return [3 /*break*/, 4];
+                    case 7:
+                        _i++;
+                        return [3 /*break*/, 3];
+                    case 8: return [4 /*yield*/, this.prisma.$transaction(function (tx) { return __awaiter(_this, void 0, void 0, function () {
+                            var prisma;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
                                     case 0:
-                                        model = params.model, args = params.args, query = params.query, operation = params.operation;
-                                        queryArgs = args;
-                                        if (!model) {
-                                            return [2 /*return*/, query(args)];
+                                        prisma = tx;
+                                        return [4 /*yield*/, takeLock(prisma)];
+                                    case 1:
+                                        _a.sent();
+                                        return [4 /*yield*/, this.getStoredSetupManifestHash(setupManifestId, prisma)];
+                                    case 2:
+                                        if ((_a.sent()) ===
+                                            setupManifestHash) {
+                                            debug("Yates setup manifest unchanged after acquiring lock; skipping role reconciliation");
+                                            return [2 /*return*/];
                                         }
-                                        ctx = getContext();
-                                        if (ctx === null) {
-                                            return [2 /*return*/, query(args)];
+                                        return [4 /*yield*/, this.reconcileRoles({
+                                                abilities: abilities,
+                                                defaultAbilities: defaultAbilities,
+                                                prisma: prisma,
+                                                resolvedSetupAbilityExpressions: resolvedSetupAbilityExpressions,
+                                                roles: roles,
+                                            })];
+                                    case 3:
+                                        _a.sent();
+                                        return [4 /*yield*/, this.upsertSetupManifestHash(setupManifestId, setupManifestHash, prisma)];
+                                    case 4:
+                                        _a.sent();
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); }, { maxWait: txMaxWait, timeout: txTimeout })];
+                    case 9:
+                        _t.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); };
+        this.reconcileRoles = function (_a) { return __awaiter(_this, [_a], void 0, function (_b) {
+            var pgRoles, existingAbilities, pgPolicies, migratedAbilities, migratedAbilities_1, migratedAbilities_1_1, migratedAbility, e_10_1, _c, _d, _e, _i, model, table, _loop_2, this_1, _f, _g, _h, _j, slug, _loop_3, this_2, _k, _l, _m, _o, key;
+            var e_10, _p;
+            var _this = this;
+            var abilities = _b.abilities, defaultAbilities = _b.defaultAbilities, prisma = _b.prisma, resolvedSetupAbilityExpressions = _b.resolvedSetupAbilityExpressions, roles = _b.roles;
+            return __generator(this, function (_q) {
+                switch (_q.label) {
+                    case 0: return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\tselect * from pg_catalog.pg_roles where rolname like 'yates%'\n\t\t")];
+                    case 1:
+                        pgRoles = _q.sent();
+                        return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\tselect * from _yates._yates_abilities;\n\t\t")];
+                    case 2:
+                        existingAbilities = _q.sent();
+                        if (!(existingAbilities.length === 0)) return [3 /*break*/, 12];
+                        debug('No existing abilities found, importing from "pg_policies" table');
+                        return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\tselect * from pg_catalog.pg_policies where policyname like 'yates%'\n\t\t\t")];
+                    case 3:
+                        pgPolicies = _q.sent();
+                        if (!pgPolicies.length) return [3 /*break*/, 12];
+                        migratedAbilities = pgPolicies.map(function (policy) {
+                            var _a, _b;
+                            return ({
+                                ability_model: policy.tablename,
+                                ability_name: policy.policyname,
+                                ability_policy_name: policy.policyname,
+                                ability_description: "",
+                                ability_operation: policy.cmd,
+                                ability_expression: (_b = (_a = policy.qual) !== null && _a !== void 0 ? _a : policy.with_check) !== null && _b !== void 0 ? _b : "",
+                            });
+                        });
+                        _q.label = 4;
+                    case 4:
+                        _q.trys.push([4, 9, 10, 11]);
+                        migratedAbilities_1 = __values(migratedAbilities), migratedAbilities_1_1 = migratedAbilities_1.next();
+                        _q.label = 5;
+                    case 5:
+                        if (!!migratedAbilities_1_1.done) return [3 /*break*/, 8];
+                        migratedAbility = migratedAbilities_1_1.value;
+                        return [4 /*yield*/, upsertAbility(prisma, migratedAbility)];
+                    case 6:
+                        _q.sent();
+                        _q.label = 7;
+                    case 7:
+                        migratedAbilities_1_1 = migratedAbilities_1.next();
+                        return [3 /*break*/, 5];
+                    case 8: return [3 /*break*/, 11];
+                    case 9:
+                        e_10_1 = _q.sent();
+                        e_10 = { error: e_10_1 };
+                        return [3 /*break*/, 11];
+                    case 10:
+                        try {
+                            if (migratedAbilities_1_1 && !migratedAbilities_1_1.done && (_p = migratedAbilities_1.return)) _p.call(migratedAbilities_1);
+                        }
+                        finally { if (e_10) throw e_10.error; }
+                        return [7 /*endfinally*/];
+                    case 11:
+                        existingAbilities.push.apply(existingAbilities, __spreadArray([], __read(migratedAbilities), false));
+                        _q.label = 12;
+                    case 12:
+                        _c = abilities;
+                        _d = [];
+                        for (_e in _c)
+                            _d.push(_e);
+                        _i = 0;
+                        _q.label = 13;
+                    case 13:
+                        if (!(_i < _d.length)) return [3 /*break*/, 19];
+                        _e = _d[_i];
+                        if (!(_e in _c)) return [3 /*break*/, 18];
+                        model = _e;
+                        table = model;
+                        return [4 /*yield*/, this.enableRowLevelSecurityIfNeeded(prisma, table)];
+                    case 14:
+                        _q.sent();
+                        _loop_2 = function (slug) {
+                            var ability, roleName, resolvedExpression;
+                            return __generator(this, function (_r) {
+                                switch (_r.label) {
+                                    case 0:
+                                        ability = 
+                                        // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                        abilities[model][slug];
+                                        if (!VALID_OPERATIONS.includes(ability.operation)) {
+                                            throw new Error("Invalid operation: ".concat(ability.operation));
                                         }
-                                        validateContext(ctx === null || ctx === void 0 ? void 0 : ctx.context);
-                                        op = OPERATION_MAP[operation];
-                                        if (!op) {
-                                            return [2 /*return*/, query(args)];
+                                        roleName = this_1.createAbilityName(model, slug);
+                                        if (!pgRoles.find(function (role) { return role.rolname === roleName; })) return [3 /*break*/, 1];
+                                        debug("Role already exists", roleName, model, slug);
+                                        return [3 /*break*/, 4];
+                                    case 1: return [4 /*yield*/, prisma.$executeRawUnsafe("\n\t\t\t\t\t\tdo\n\t\t\t\t\t\t$$\n\t\t\t\t\t\tbegin\n\t\t\t\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(roleName, "') then \n\t\t\t\t\t\t\tcreate role ").concat(roleName, ";\n\t\t\t\t\t\tend if;\n\t\t\t\t\t\tend\n\t\t\t\t\t\t$$\n\t\t\t\t\t\t;\n\t\t\t\t\t"))];
+                                    case 2:
+                                        _r.sent();
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("\n\t\t\t\t\t\tGRANT ".concat(ability.operation, " ON ").concat(this_1.quoteIdentifier("public"), ".").concat(this_1.quoteIdentifier(table), " TO ").concat(this_1.quoteIdentifier(roleName), ";\n\t\t\t\t\t"))];
+                                    case 3:
+                                        _r.sent();
+                                        _r.label = 4;
+                                    case 4:
+                                        if (!ability.expression) return [3 /*break*/, 6];
+                                        resolvedExpression = resolvedSetupAbilityExpressions[roleName];
+                                        if (!resolvedExpression) {
+                                            throw new Error("Missing resolved expression for ".concat(model, ".").concat(slug, " (").concat(roleName, ")"));
                                         }
-                                        context = ctx === null || ctx === void 0 ? void 0 : ctx.context;
-                                        role = ctx === null || ctx === void 0 ? void 0 : ctx.role;
-                                        if (!SELECT_OPERATIONS.has(operation)) return [3 /*break*/, 17];
-                                        return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "SELECT", context)];
+                                        return [4 /*yield*/, this_1.setRLS(prisma, table, roleName, slug, ability, resolvedExpression)];
+                                    case 5:
+                                        _r.sent();
+                                        _r.label = 6;
+                                    case 6: return [2 /*return*/];
+                                }
+                            });
+                        };
+                        this_1 = this;
+                        _f = abilities[model];
+                        _g = [];
+                        for (_h in _f)
+                            _g.push(_h);
+                        _j = 0;
+                        _q.label = 15;
+                    case 15:
+                        if (!(_j < _g.length)) return [3 /*break*/, 18];
+                        _h = _g[_j];
+                        if (!(_h in _f)) return [3 /*break*/, 17];
+                        slug = _h;
+                        return [5 /*yield**/, _loop_2(slug)];
+                    case 16:
+                        _q.sent();
+                        _q.label = 17;
+                    case 17:
+                        _j++;
+                        return [3 /*break*/, 15];
+                    case 18:
+                        _i++;
+                        return [3 /*break*/, 13];
+                    case 19:
+                        _loop_3 = function (key) {
+                            var role, wildCardAbilities, roleAbilities, rlsRoles, userRoles, oldRoles, policies, policies_1, policies_1_1, oldPolicy, e_11_1;
+                            var e_11, _s;
+                            return __generator(this, function (_t) {
+                                switch (_t.label) {
+                                    case 0:
+                                        role = this_2.createRoleName(key);
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("\n\t\t\t\tdo\n\t\t\t\t$$\n\t\t\t\tbegin\n\t\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(role, "') then \n\t\t\t\t\tcreate role ").concat(role, ";\n\t\t\t\tend if;\n\t\t\t\tend\n\t\t\t\t$$\n\t\t\t\t;\n\t\t\t"))];
                                     case 1:
-                                        filters = (_d = (_o.sent())) !== null && _d !== void 0 ? _d : [];
-                                        abilityWhere = combineAbilityFilters(filters);
-                                        combinedWhere = mergeWhere(queryArgs.where, abilityWhere);
-                                        if (!!abilityWhere) return [3 /*break*/, 9];
-                                        deniedWhere = denyWhere(runtimeDataModel, model);
-                                        if (!(operation === "findUnique" ||
-                                            operation === "findUniqueOrThrow")) return [3 /*break*/, 7];
-                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
+                                        _t.sent();
+                                        wildCardAbilities = (0, flatMap_1.default)(defaultAbilities, function (model, modelName) {
+                                            return (0, map_1.default)(model, function (_params, slug) {
+                                                return _this.createAbilityName(modelName, slug);
+                                            });
+                                        });
+                                        roleAbilities = roles[key];
+                                        rlsRoles = roleAbilities === "*"
+                                            ? wildCardAbilities
+                                            : roleAbilities.map(function (ability) {
+                                                // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                                return _this.createAbilityName(ability.model, ability.slug);
+                                            });
+                                        debug("Setting up role", key, role, "with abilities", rlsRoles.join(", "));
+                                        // Note: We need to GRANT all on schema public so that we can resolve relation queries with prisma, as they will sometimes use a join table.
+                                        // This is not ideal, but because we are using RLS, it's not a security risk. Any table with RLS also needs a corresponding policy for the role to have access.
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("GRANT ALL ON ALL TABLES IN SCHEMA public TO ".concat(role, ";"))];
                                     case 2:
-                                        _o.sent();
-                                        fluentField = getFluentSelectionField(runtimeDataModel, model, queryArgs);
-                                        delegate = prisma[lowerModelName(model)];
-                                        if (!(operation === "findUnique")) return [3 /*break*/, 4];
-                                        return [4 /*yield*/, delegate.findFirst(__assign(__assign({}, queryArgs), { where: deniedWhere }))];
+                                        // Note: We need to GRANT all on schema public so that we can resolve relation queries with prisma, as they will sometimes use a join table.
+                                        // This is not ideal, but because we are using RLS, it's not a security risk. Any table with RLS also needs a corresponding policy for the role to have access.
+                                        _t.sent();
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("\n\t\t\t\t\tGRANT ALL ON ALL SEQUENCES IN SCHEMA public TO ".concat(role, ";\n\t\t\t\t"))];
                                     case 3:
-                                        _a = _o.sent();
-                                        return [3 /*break*/, 6];
-                                    case 4: return [4 /*yield*/, delegate.findFirstOrThrow(__assign(__assign({}, queryArgs), { where: deniedWhere }))];
+                                        _t.sent();
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("\n\t\t\t\t\tGRANT ALL ON SCHEMA public TO ".concat(role, ";\n\t\t\t\t"))];
+                                    case 4:
+                                        _t.sent();
+                                        return [4 /*yield*/, prisma.$queryRawUnsafe("GRANT ".concat(rlsRoles.join(", "), " TO ").concat(role))];
                                     case 5:
-                                        _a = _o.sent();
-                                        _o.label = 6;
+                                        _t.sent();
+                                        return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\t\tWITH RECURSIVE cte AS (\n\t\t\t\t\tSELECT oid FROM pg_roles where rolname = '".concat(role, "'\n\t\t\t\t\tUNION ALL\n\t\t\t\t\tSELECT m.roleid\n\t\t\t\t\tFROM   cte\n\t\t\t\t\tJOIN   pg_auth_members m ON m.member = cte.oid\n\t\t\t\t\t)\n\t\t\t\tSELECT oid, oid::regrole::text AS rolename FROM cte where oid::regrole::text != '").concat(role, "'; \n\t\t"))];
                                     case 6:
-                                        result = _a;
-                                        if (fluentField && result) {
-                                            return [2 /*return*/, result[fluentField]];
-                                        }
-                                        return [2 /*return*/, result];
+                                        userRoles = _t.sent();
+                                        oldRoles = userRoles
+                                            .filter(function (_a) {
+                                            var rolename = _a.rolename;
+                                            return !rlsRoles.includes(rolename);
+                                        })
+                                            .map(function (_a) {
+                                            var rolename = _a.rolename;
+                                            return rolename;
+                                        });
+                                        if (!oldRoles.length) return [3 /*break*/, 18];
+                                        // Now revoke old roles from the user role
+                                        debug("Revoking old roles", key, role, oldRoles.join(", "));
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("REVOKE ".concat(oldRoles.join(", "), " FROM ").concat(role))];
                                     case 7:
-                                        queryArgs.where =
-                                            (_f = mergeWhere((_e = queryArgs.where) !== null && _e !== void 0 ? _e : {}, deniedWhere)) !== null && _f !== void 0 ? _f : queryArgs.where;
-                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
+                                        _t.sent();
+                                        return [4 /*yield*/, prisma.$queryRawUnsafe("SELECT * FROM pg_catalog.pg_policies WHERE policyname IN (".concat(oldRoles
+                                                .map(function (or) { return "'".concat(or, "'"); })
+                                                .join(", "), ")"))];
                                     case 8:
-                                        _o.sent();
-                                        return [2 /*return*/, query(args)];
+                                        policies = _t.sent();
+                                        _t.label = 9;
                                     case 9:
-                                        if (!(operation === "findUnique" ||
-                                            operation === "findUniqueOrThrow")) return [3 /*break*/, 15];
-                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
+                                        _t.trys.push([9, 14, 15, 16]);
+                                        policies_1 = (e_11 = void 0, __values(policies)), policies_1_1 = policies_1.next();
+                                        _t.label = 10;
                                     case 10:
-                                        _o.sent();
-                                        fluentField = getFluentSelectionField(runtimeDataModel, model, queryArgs);
-                                        delegate = prisma[lowerModelName(model)];
-                                        if (!(operation === "findUnique")) return [3 /*break*/, 12];
-                                        return [4 /*yield*/, delegate.findFirst(__assign(__assign({}, queryArgs), { where: combinedWhere }))];
+                                        if (!!policies_1_1.done) return [3 /*break*/, 13];
+                                        oldPolicy = policies_1_1.value;
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("DROP POLICY ".concat(oldPolicy.policyname, " ON \"").concat(oldPolicy.tablename, "\""))];
                                     case 11:
-                                        _b = _o.sent();
-                                        return [3 /*break*/, 14];
-                                    case 12: return [4 /*yield*/, delegate.findFirstOrThrow(__assign(__assign({}, queryArgs), { where: combinedWhere }))];
-                                    case 13:
-                                        _b = _o.sent();
-                                        _o.label = 14;
+                                        _t.sent();
+                                        _t.label = 12;
+                                    case 12:
+                                        policies_1_1 = policies_1.next();
+                                        return [3 /*break*/, 10];
+                                    case 13: return [3 /*break*/, 16];
                                     case 14:
-                                        result = _b;
-                                        if (fluentField && result) {
-                                            return [2 /*return*/, result[fluentField]];
-                                        }
-                                        return [2 /*return*/, result];
+                                        e_11_1 = _t.sent();
+                                        e_11 = { error: e_11_1 };
+                                        return [3 /*break*/, 16];
                                     case 15:
-                                        queryArgs.where = combinedWhere !== null && combinedWhere !== void 0 ? combinedWhere : queryArgs.where;
-                                        return [4 /*yield*/, applyReadSelections(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs, context)];
-                                    case 16:
-                                        _o.sent();
-                                        return [2 /*return*/, query(args)];
-                                    case 17:
-                                        if (!(op === "INSERT")) return [3 /*break*/, 30];
-                                        if (!(operation === "create")) return [3 /*break*/, 20];
-                                        return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context)];
-                                    case 18:
-                                        _o.sent();
-                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context)];
-                                    case 19:
-                                        _o.sent();
-                                        return [2 /*return*/, query(args)];
-                                    case 20:
-                                        if (!(operation === "createMany")) return [3 /*break*/, 30];
-                                        items = Array.isArray(queryArgs.data)
-                                            ? queryArgs.data
-                                            : [queryArgs.data];
-                                        _o.label = 21;
-                                    case 21:
-                                        _o.trys.push([21, 27, 28, 29]);
-                                        items_9 = __values(items), items_9_1 = items_9.next();
-                                        _o.label = 22;
-                                    case 22:
-                                        if (!!items_9_1.done) return [3 /*break*/, 26];
-                                        item = items_9_1.value;
-                                        return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, model, item, context)];
-                                    case 23:
-                                        _o.sent();
-                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, item, context)];
-                                    case 24:
-                                        _o.sent();
-                                        _o.label = 25;
-                                    case 25:
-                                        items_9_1 = items_9.next();
-                                        return [3 /*break*/, 22];
-                                    case 26: return [3 /*break*/, 29];
-                                    case 27:
-                                        e_20_1 = _o.sent();
-                                        e_20 = { error: e_20_1 };
-                                        return [3 /*break*/, 29];
-                                    case 28:
                                         try {
-                                            if (items_9_1 && !items_9_1.done && (_c = items_9.return)) _c.call(items_9);
+                                            if (policies_1_1 && !policies_1_1.done && (_s = policies_1.return)) _s.call(policies_1);
                                         }
-                                        finally { if (e_20) throw e_20.error; }
+                                        finally { if (e_11) throw e_11.error; }
                                         return [7 /*endfinally*/];
-                                    case 29: return [2 /*return*/, query(args)];
-                                    case 30:
-                                        if (!(op === "UPDATE")) return [3 /*break*/, 47];
-                                        if (!(operation === "update")) return [3 /*break*/, 34];
-                                        return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, model, "UPDATE", queryArgs.where, context)];
-                                    case 31:
-                                        allowed = _o.sent();
-                                        if (!allowed)
-                                            throw updateNotFoundError();
-                                        if (!queryArgs.data) return [3 /*break*/, 33];
-                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context, { mode: "update", currentWhere: queryArgs.where })];
-                                    case 32:
-                                        _o.sent();
-                                        _o.label = 33;
-                                    case 33: return [2 /*return*/, query(args)];
-                                    case 34:
-                                        if (!(operation === "updateMany")) return [3 /*break*/, 38];
-                                        return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "UPDATE", context)];
-                                    case 35:
-                                        filters = (_g = (_o.sent())) !== null && _g !== void 0 ? _g : [];
-                                        abilityWhere = combineAbilityFilters(filters);
-                                        if (!abilityWhere) {
-                                            queryArgs.where = denyWhere(runtimeDataModel, model);
-                                        }
-                                        else {
-                                            queryArgs.where =
-                                                (_j = mergeWhere((_h = queryArgs.where) !== null && _h !== void 0 ? _h : {}, abilityWhere)) !== null && _j !== void 0 ? _j : queryArgs.where;
-                                        }
-                                        if (!queryArgs.data) return [3 /*break*/, 37];
-                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, queryArgs.data, context, { mode: "update", currentWhere: queryArgs.where })];
-                                    case 36:
-                                        _o.sent();
-                                        _o.label = 37;
-                                    case 37: return [2 /*return*/, query(args)];
-                                    case 38:
-                                        if (!(operation === "upsert")) return [3 /*break*/, 47];
-                                        return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, model, "UPDATE", queryArgs.where, context)];
-                                    case 39:
-                                        canUpdate = _o.sent();
-                                        if (!canUpdate) return [3 /*break*/, 42];
-                                        if (!args.update) return [3 /*break*/, 41];
-                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, args.update, context, { mode: "update", currentWhere: queryArgs.where })];
-                                    case 40:
-                                        _o.sent();
-                                        _o.label = 41;
-                                    case 41: return [3 /*break*/, 46];
-                                    case 42:
-                                        if (!args.create) return [3 /*break*/, 45];
-                                        return [4 /*yield*/, assertCreateAllowed(prisma, runtimeDataModel, roleAbilities, role, model, args.create, context)];
-                                    case 43:
-                                        _o.sent();
-                                        return [4 /*yield*/, applyNestedWrites(prisma, runtimeDataModel, roleAbilities, role, model, args.create, context)];
-                                    case 44:
-                                        _o.sent();
-                                        return [3 /*break*/, 46];
-                                    case 45: throw updateNotFoundError();
-                                    case 46: return [2 /*return*/, query(args)];
-                                    case 47:
-                                        if (!(op === "DELETE")) return [3 /*break*/, 51];
-                                        if (!(operation === "delete")) return [3 /*break*/, 49];
-                                        return [4 /*yield*/, assertRecordAllowed(prisma, runtimeDataModel, roleAbilities, role, model, "DELETE", queryArgs.where, context)];
-                                    case 48:
-                                        allowed = _o.sent();
-                                        if (!allowed)
-                                            throw deleteNotFoundError();
-                                        return [2 /*return*/, query(args)];
-                                    case 49:
-                                        if (!(operation === "deleteMany")) return [3 /*break*/, 51];
-                                        return [4 /*yield*/, getAbilityFilters(prisma, runtimeDataModel, roleAbilities, role, model, "DELETE", context)];
-                                    case 50:
-                                        filters = (_k = (_o.sent())) !== null && _k !== void 0 ? _k : [];
-                                        abilityWhere = combineAbilityFilters(filters);
-                                        if (!abilityWhere) {
-                                            queryArgs.where = denyWhere(runtimeDataModel, model);
-                                        }
-                                        else {
-                                            queryArgs.where =
-                                                (_m = mergeWhere((_l = queryArgs.where) !== null && _l !== void 0 ? _l : {}, abilityWhere)) !== null && _m !== void 0 ? _m : queryArgs.where;
-                                        }
-                                        return [2 /*return*/, query(args)];
-                                    case 51:
-                                        if (!UNIQUE_OPERATIONS.has(operation)) {
-                                            return [2 /*return*/, query(args)];
-                                        }
-                                        return [2 /*return*/, query(args)];
+                                    case 16:
+                                        debug("Revoked old rows from ability table", oldRoles.join(", "));
+                                        return [4 /*yield*/, prisma.$executeRawUnsafe("DELETE FROM _yates._yates_abilities WHERE ability_policy_name IN (".concat(oldRoles
+                                                .map(function (or) { return "'".concat(or, "'"); })
+                                                .join(", "), ")"))];
+                                    case 17:
+                                        _t.sent();
+                                        _t.label = 18;
+                                    case 18: return [2 /*return*/];
                                 }
                             });
-                        });
-                    },
-                },
-            },
+                        };
+                        this_2 = this;
+                        _k = roles;
+                        _l = [];
+                        for (_m in _k)
+                            _l.push(_m);
+                        _o = 0;
+                        _q.label = 20;
+                    case 20:
+                        if (!(_o < _l.length)) return [3 /*break*/, 23];
+                        _m = _l[_o];
+                        if (!(_m in _k)) return [3 /*break*/, 22];
+                        key = _m;
+                        return [5 /*yield**/, _loop_3(key)];
+                    case 21:
+                        _q.sent();
+                        _q.label = 22;
+                    case 22:
+                        _o++;
+                        return [3 /*break*/, 20];
+                    case 23: return [2 /*return*/];
+                }
+            });
+        }); };
+        this.inspectDBRoles = function (role) { return __awaiter(_this, void 0, void 0, function () {
+            var hashedRoleName, roles;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.ensureDatabaseScope()];
+                    case 1:
+                        _a.sent();
+                        hashedRoleName = this.createRoleName(role);
+                        return [4 /*yield*/, this.prisma.$queryRawUnsafe("\n        WITH RECURSIVE role_tree AS(\n            --Start from your role\n            SELECT \n                r.oid,\n                    r.rolname\n            FROM pg_roles r\n            WHERE r.rolname = '".concat(hashedRoleName, "'\n\n            UNION\n\n            --Walk \"upwards\": all parent roles granted to it\n            SELECT \n                parent.oid,\n                    parent.rolname\n            FROM pg_auth_members m\n            JOIN role_tree rt\n            ON m.member = rt.oid\n            JOIN pg_roles parent\n            ON parent.oid = m.roleid\n                )\n                SELECT\n                p.tablename,\n                    p.policyname,\n                    p.cmd,\n                    p.roles:: text[]          AS policy_roles,\n                        rt.rolname                  AS matched_role\n        FROM pg_policies p\n        JOIN role_tree rt\n                ON(\n                    p.roles IS NULL\n            OR array_length(p.roles, 1) = 0\n            OR rt.rolname = ANY(p.roles:: text[])\n                )\n        WHERE p.schemaname = 'public'\n        ORDER BY p.policyname, matched_role;\n        "))];
+                    case 2:
+                        roles = _a.sent();
+                        return [2 /*return*/, roles];
+                }
+            });
+        }); };
+        this.inspectRunTimeDataModel = function () {
+            // See https://github.com/prisma/prisma/discussions/14777
+            // We are reaching into the prisma internals to get the data model.
+            // This is a bit sketchy, but we can get the internal type definition from the runtime library
+            // and there is even a test case in prisma that checks that this value is exported
+            // See https://github.com/prisma/prisma/blob/5.1.0/packages/client/tests/functional/extensions/pdp.ts#L51
+            // This is a private API, so not much we can do about the cast
+            var runtimeDataModel = _this.prisma
+                ._runtimeDataModel;
+            return runtimeDataModel;
+        };
+    }
+    // @ts-ignore
+    Yates.prototype.getBatchId = function (query) {
+        if (query.action !== "findUnique" && query.action !== "findUniqueOrThrow") {
+            return undefined;
+        }
+        var parts = [];
+        if (query.modelName) {
+            parts.push(query.modelName);
+        }
+        if (query.query.arguments) {
+            parts.push(this.buildKeysString(query.query.arguments));
+        }
+        parts.push(this.buildKeysString(query.query.selection));
+        return parts.join("");
+    };
+    Yates.prototype.buildKeysString = function (obj) {
+        var _this = this;
+        var keysArray = Object.keys(obj)
+            .sort()
+            .map(function (key) {
+            // @ts-ignore
+            var value = obj[key];
+            if (typeof value === "object" && value !== null) {
+                return "(".concat(key, " ").concat(_this.buildKeysString(value), ")");
+            }
+            return key;
         });
-        debug("Setup completed in", performance.now() - start, "ms");
-        return [2 /*return*/, client];
+        return "(".concat(keysArray.join(" "), ")");
+    };
+    return Yates;
+}());
+exports.Yates = Yates;
+/**
+ * Creates an extended client that sets contextual parameters and user role on every query
+ **/
+var setup = function (params) { return __awaiter(void 0, void 0, void 0, function () {
+    var start, prisma, customAbilities, getRoles, getContext, yates, client;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                start = performance.now();
+                prisma = params.prisma, customAbilities = params.customAbilities, getRoles = params.getRoles, getContext = params.getContext;
+                yates = new Yates(prisma);
+                return [4 /*yield*/, yates.init()];
+            case 1:
+                _a.sent();
+                return [4 /*yield*/, yates.createRoles({
+                        customAbilities: customAbilities,
+                        getRoles: getRoles,
+                        options: params.options,
+                    })];
+            case 2:
+                _a.sent();
+                client = yates.createClient(getContext, params.options);
+                debug("Setup completed in", performance.now() - start, "ms");
+                return [2 /*return*/, client];
+        }
     });
 }); };
 exports.setup = setup;
+var templateObject_1, templateObject_2, templateObject_3;
 //# sourceMappingURL=index.js.map