@noxify/casl-drizzle 0.0.1-beta.3 → 0.2.0

package/LICENSE

@@ -1,6 +1,7 @@
 MIT License
 
 Copyright (c) 2026 Marcus Reinhardt
+Portions Copyright (c) Guilherme Araújo
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,107 +1,163 @@
-> work in progress :)
+# @noxify/casl-drizzle
 
-# casl-drizzle
+CASL v7 integration for Drizzle ORM ( 1.0.0-rc.3 ) - Add type-safe authorization to your database queries
 
-CASL integration for Drizzle ORM - Add type-safe authorization to your database queries
+## Features
+
+- 🔒 **Type-safe** - Full TypeScript support with Drizzle types
+- 🎯 **Relation support** - Filter by related table conditions
+- 🔁 **Many-to-many support** - Filter across join-table relations
+- 🔗 **Query operators** - All Drizzle operators (eq, gt, like, etc.)
+- 💡 **IDE autocomplete** - Subject-specific field suggestions
 
 ## Install
 
 ```sh
-npm install ucastle @casl/ability
+npm install @noxify/casl-drizzle @casl/ability drizzle-orm@1.0.0-rc.3
+```
+
+```sh
+pnpm add @noxify/casl-drizzle @casl/ability drizzle-orm@1.0.0-rc.3
 ```
 
-## Quick Start
+## Setup
 
-Define your abilities using Drizzle's query types directly:
+Define your Drizzle schema and relations:
 
 ```typescript
-import type { QueryInput } from "ucastle"
-import { integer, pgTable, text } from "drizzle-orm/pg-core"
-import { accessibleBy, defineAbility } from "ucastle"
+import { defineRelations, pgTable } from "drizzle-orm"
+import { integer, text } from "drizzle-orm/pg-core"
 
-// Define your Drizzle schema
 const users = pgTable("users", {
   id: integer().primaryKey(),
   name: text().notNull(),
-  email: text().notNull(),
 })
 
-const schema = { users }
-
-// Extract query types for your tables
-type UserQuery = QueryInput<typeof schema, "users">
-
-// Create abilities with subject-specific autocomplete
-const ability = defineAbility<{ users: UserQuery }>((can, cannot) => {
-  can("read", "users", { id: 1 }) // ✅ Autocomplete shows only user fields!
-  can("update", "users", { id: 1 })
-  cannot("delete", "users")
+const posts = pgTable("posts", {
+  id: integer().primaryKey(),
+  title: text().notNull(),
+  authorId: integer().notNull(),
 })
 
-// Use with accessibleBy to get database filters
-const filters = accessibleBy(ability, "read")
-const readableUsers = await db.query.users.findMany({ where: filters.users })
+export const relations = defineRelations({ users, posts }, (r) => ({
+  users: { posts: r.many.posts() },
+  posts: { author: r.one.users({ from: r.posts.authorId, to: r.users.id }) },
+}))
 ```
 
-## Features
+## Usage
 
-- 🔒 **Type-safe authorization** - Full TypeScript support with Drizzle types
-- 🎯 **CASL integration** - Leverage CASL's powerful rule system
-- 🗄️ **DB agnostic** - Works with PostgreSQL, MySQL, SQLite, etc.
-- 🔗 **Relation support** - Filter by related table conditions
-- 📦 **Zero overhead** - Direct type composition, no runtime wrappers
-- 💡 **Smart autocomplete** - Subject-specific field suggestions with `defineAbility()`
+Create type-safe abilities with Drizzle query conditions:
 
-## With Relations
+```typescript
+import type { QueryInput } from "@noxify/casl-drizzle"
+import { accessibleBy, createDrizzleAbility, some } from "@noxify/casl-drizzle"
+import { sql } from "drizzle-orm"
 
-For schemas with relations, use `RelationalQueryInput`:
+type PostQuery = QueryInput<typeof relations, "posts">
+type UserQuery = QueryInput<typeof relations, "users">
 
-```typescript
-import type { RelationalQueryInput } from "ucastle"
-import { defineRelations } from "drizzle-orm"
+const currentUserId = 1
 
-const posts = pgTable("posts", {
-  id: integer().primaryKey(),
-  title: text().notNull(),
-  authorId: integer().notNull(),
+const ability = createDrizzleAbility<
+  { posts: PostQuery; users: UserQuery },
+  "read" | "create" | "update" | "delete"
+>((can) => {
+  // Simple field filtering
+  can("read", "posts", { published: true })
+
+  // Filter by related table (author)
+  can("read", "posts", { author: { id: currentUserId } })
+
+  // Many-to-many filtering (example: users by groups)
+  can("read", "users", { groups: some(sql`name = 'Admins'`) })
+
+  // Complex conditions with operators
+  can("update", "posts", {
+    author: { id: currentUserId },
+    createdAt: { gte: new Date(Date.now() - 24 * 60 * 60 * 1000) },
+  })
+
+  // Raw SQL for complex queries
+  can("delete", "posts", {
+    RAW: sql`author_id = ${currentUserId} AND published = false`,
+  })
 })
 
-const relations = defineRelations({ users, posts }, (r) => ({
-  users: { posts: r.many(posts) },
-  posts: { author: r.one(users, { fields: [posts.authorId], references: [users.id] }) },
-}))
+// Convert abilities to database filters
+const filters = accessibleBy(ability, "read")
+const posts = await db.query.posts.findMany({ where: filters.posts })
+const users = await db.query.users.findMany({ where: filters.users })
+```
 
-type PostQuery = RelationalQueryInput<typeof relations, "posts">
+## Behavior Notes
 
-const ability = defineAbility<{ posts: PostQuery }>((can) => {
-  can("read", "posts", { published: true })
-  can("update", "posts", { authorId: 1 })
+### `every()` - All Related Records Must Match
+
+`every()` filters records where **all related records** satisfy the condition. Important: it currently requires that related records exist:
+
+```typescript
+// ✅ Returns users who have AT LEAST ONE post, and ALL their posts have views > 100
+can("read", "users", {
+  posts: every({ views: { gt: 100 } }),
 })
+
+// ❌ Returns no users if they have NO posts at all
+// (even though "all zero posts have >100 views" is technically true)
 ```
 
-## Alternative: AbilityBuilder
+Use when you need to enforce a condition across all related records that exist. For "users with no posts" scenarios, use `none()` instead.
 
-If you prefer the traditional AbilityBuilder pattern:
+### `none()` - No Related Records Match
+
+`none()` filters records where **no related records** satisfy the condition. Works reliably for simple cases but may behave unexpectedly in complex relation chains.
+
+**✅ Simple case (recommended):**
 
 ```typescript
-import type { DefineAbility } from "ucastle"
-import { AbilityBuilder } from "@casl/ability"
-import { createDrizzleAbilityFor } from "ucastle"
+can("read", "posts", { comments: none() })
+```
 
-type AppAbility = DefineAbility<{ users: UserQuery }>
+**⚠️ Complex paths - Known Issue:**
+When filtering through nested relations, `none()` semantics can be inverted:
 
-const { can, cannot, build } = new AbilityBuilder<AppAbility>(createDrizzleAbilityFor())
+```typescript
+// ❌ Behavior may be unexpected:
+can("read", "posts", {
+  comments: none({ author: { id: adminId } }),
+})
+```
 
-can("read", "users", { id: 1 })
-cannot("delete", "users")
+**✅ Solution - Use Drizzle's type-safe subquery:**
 
-const ability = build()
+```typescript
+import { notExists, eq, and } from "drizzle-orm"
+
+can("read", "posts", {
+  RAW: notExists(
+    db
+      .select()
+      .from(comments)
+      .where(and(eq(comments.postId, posts.id), eq(comments.authorId, adminId)))
+  ),
+})
+```
+
+⚠️ **Current limitation**: Due to Drizzle's alias handling in subqueries, both `notExists()` and raw SQL with outer table references currently fail. For now, the most reliable approach is to avoid complex `none()` filters and use simpler patterns or application-level filtering for edge cases.
+
+**For simple cases without outer table references:**
+
+```typescript
+// This works: Simple static condition without referencing outer table
+can("read", "users", {
+  posts: none(), // All users with no posts
+})
 ```
 
-## Documentation
+For critical authorization rules involving complex relation filters, always use explicit `RAW` SQL to ensure predictable behavior.
 
-See [SIMPLIFIED_API.md](./SIMPLIFIED_API.md) for detailed examples and patterns.
+## Acknowledgements
 
-## License
+This project was heavily inspired by [ucastle](https://github.com/araujogui/ucastle) by Guilherme Araujo and evolved through substantial refactoring and extension for Drizzle relation support.
 
-MIT
+If you are looking for the original foundation and ideas, please also check the ucastle repository.

package/dist/index.d.mts

@@ -1,12 +1,12 @@
-import { AbilityOptions, AbilityOptionsOf, AbilityTuple, AnyAbility, ForcedSubject, PureAbility, RawRuleFrom, RawRuleOf, hkt } from "@casl/ability";
-import * as _ucast_core0 from "@ucast/core";
-import { DBQueryConfig, SchemaEntry, TablesRelationalConfig } from "drizzle-orm/relations";
+import { Ability, AbilityOptions, AbilityOptionsOf, AbilityTuple, AnyAbility, ForcedSubject, RawRuleFrom, RawRuleOf, hkt } from "@casl/ability";
+import { SQL, Table, operators } from "drizzle-orm";
+import { DBQueryConfig, TablesRelationalConfig } from "drizzle-orm/relations";
 import { KnownKeysOnly } from "drizzle-orm/utils";
 
 //#region src/drizzle-query.d.ts
 declare const drizzleQuery: (query: Record<string, unknown>, ...args: unknown[]) => {
   (...args: any[]): any;
-  ast: _ucast_core0.Condition;
+  ast: import("@ucast/core").Condition;
 };
 type Model<T, TName extends string> = T & ForcedSubject<TName>;
 type Subjects<T extends Partial<Record<string, Record<string, unknown>>>> = keyof T | { [K in keyof T]: Model<T[K], K & string> }[keyof T];
@@ -20,149 +20,321 @@ type ExtractModelName<TObject, TModelName extends PropertyKey> = TObject extends
 } ? TObject["__typename"] : TModelName;
 //#endregion
 //#region src/types.d.ts
+/**
+ * Unique symbol used by CASL's HKT (Higher-Kinded Types) system.
+ * This is used internally to mark types that belong to the Drizzle query system.
+ * @internal
+ */
+declare const ɵdrizzleTypes: unique symbol;
+/**
+ * Internal marker interface for CASL's HKT system.
+ * Used to identify types that are part of the Drizzle query system.
+ * This enables type-safe composition of abilities with subject-specific conditions.
+ * @internal
+ */
 interface BaseDrizzleQuery {
   [ɵdrizzleTypes]?: Record<string, unknown>;
 }
-declare const ɵdrizzleTypes: unique symbol;
+/**
+ * Internal factory type used by CASL to create ability instances.
+ * Combines a record base with CASL's HKT container interface and the Drizzle marker.
+ * Used internally by `createDrizzleAbilityFor()` and `defineAbility()`.
+ * @internal
+ */
 type DrizzleQueryFactory = Record<string, unknown> & hkt.Container<hkt.GenericFactory> & BaseDrizzleQuery;
-type DrizzleModel = Model<Record<string, unknown>, string>;
-type WhereInput = Record<string, unknown>;
 /**
- * Utility type to recursively remove the RAW property from Drizzle query types.
- * RAW is used internally by Drizzle for SQL functions but shouldn't be exposed in our API.
+ * Internal type representing a Drizzle model for CASL.
+ * Used by the query system to enforce type safety for model-based permissions.
+ * @internal
  */
-type OmitRaw<T> = T extends object ? { [K in keyof T as K extends "RAW" ? never : K]: T[K] extends object ? T[K] extends any[] ? OmitRaw<T[K][number]>[] : OmitRaw<T[K]> : T[K] } : T;
+type DrizzleModel = Model<Record<string, unknown>, string>;
 /**
- * Query input for tables WITH relations.
- * Extracts the complete where type including relation filters from Drizzle's DBQueryConfig.
- *
- * @example
- * ```ts
- * import { defineRelations } from "drizzle-orm"
- * import type { RelationalQueryInput } from "ucastle"
- *
- * const relations = defineRelations({ users, posts }, ...)
- * type UserQuery = RelationalQueryInput<typeof relations, "users">
- *
- * // Now includes: field conditions + relation filters + AND/OR/NOT
- * ```
+ * Internal type representing query conditions extracted from a query input.
+ * This is the return type of `accessibleBy()` and is used internally by the query interpreter.
+ * @internal
  */
-type RelationalQueryInput<TSchema extends TablesRelationalConfig, TTableName extends keyof TSchema> = OmitRaw<Exclude<KnownKeysOnly<DBQueryConfig<"many", TSchema, TSchema[TTableName]>, DBQueryConfig<"many", TSchema, TSchema[TTableName]>>["where"], undefined>>;
+type WhereInput = Record<string, unknown>;
 /**
- * Query input for tables WITHOUT relations.
- * Supports both field conditions and compound operators (AND/OR/NOT) at root level.
+ * Typed query input for Drizzle tables with full operator support.
+ * Extracts the complete query type from Drizzle's RQB v2, including all field operators
+ * (comparison, membership, string, null, relation, and compound operators), nested relations,
+ * and raw SQL conditions.
+ *
+ * @template TSchema - The Drizzle relations configuration object
+ * @template TTableName - The key of the table within TSchema
  *
  * @example
  * ```ts
- * import type { QueryInput } from "ucastle"
- *
- * const schema = { users, posts }
- * type UserQuery = QueryInput<typeof schema, "users">
+ * import { relations, sql } from "drizzle-orm"
+ * import type { QueryInput } from "@noxify/casl-drizzle"
  *
- * // Field conditions
- * const q1: UserQuery = { id: 1, name: "John" }
+ * const relations = defineRelations({ users, posts }, (r) => ({
+ *   users: { posts: r.many(posts) },
+ *   posts: { author: r.one(users) }
+ * }))
  *
- * // With operators
- * const q2: UserQuery = { id: { gte: 1 }, AND: [{ name: "John" }] }
+ * type PostQuery = QueryInput<typeof relations, "posts">
  *
- * // Compound operators
- * const q3: UserQuery = { OR: [{ age: 18 }, { role: "admin" }] }
+ * const ability = defineAbility<{ posts: PostQuery }>((can) => {
+ *   can("read", "posts", { published: true })
+ *   can("update", "posts", { authorId: 1 })
+ *   // Raw SQL for complex conditions
+ *   can("delete", "posts", {
+ *     RAW: sql`EXISTS (SELECT 1 FROM contributors WHERE post_id = posts.id)`
+ *   })
+ * })
  * ```
  */
-type QueryInput<TSchema extends Record<string, SchemaEntry>, TTableName extends keyof TSchema> = OmitRaw<{ [K in keyof (TSchema[TTableName] extends {
-  $inferSelect: infer S;
-} ? S : never)]?: any } & {
-  AND?: QueryInput<TSchema, TTableName>[];
-  OR?: QueryInput<TSchema, TTableName>[];
-  NOT?: QueryInput<TSchema, TTableName>;
-}>;
+type QueryInput<TSchema extends TablesRelationalConfig, TTableName extends keyof TSchema> = Exclude<KnownKeysOnly<DBQueryConfig<"many", TSchema, TSchema[TTableName]>, DBQueryConfig<"many", TSchema, TSchema[TTableName]>>["where"], undefined> & {
+  /**
+   * Optional raw SQL condition for complex queries that can't be expressed with field operators.
+   * The SQL template literal will be passed directly to Drizzle's where clause.
+   *
+   * **IMPORTANT**: Ensure the SQL is properly parameterized to prevent SQL injection.
+   *
+   * @example
+   * ```ts
+   * { RAW: sql`${table.age} BETWEEN 25 AND 35` }
+   * { RAW: sql`EXISTS (SELECT 1 FROM related WHERE ...)` }
+   * ```
+   */
+  RAW?: unknown;
+};
 /**
- * Helper type to create CASL subjects from a mapping of table names to query types.
- * Similar to @casl/prisma's Subjects pattern.
+ * Creates a union of all possible CASL subjects from a query type mapping.
+ * Each table name becomes a subject, plus model objects for relation-based filtering.
+ * Used to define subject-specific abilities with type-safe condition validation.
+ *
+ * @template T - An object mapping table names to their query input types
  *
  * @example
  * ```ts
- * import { PureAbility } from "@casl/ability"
- * import type { RelationalQueryInput, Subjects } from "ucastle"
+ * import { Ability } from "@casl/ability"
+ * import type { QueryInput, Subjects } from "@noxify/casl-drizzle"
  *
- * type UserQuery = RelationalQueryInput<typeof relations, "users">
- * type PostQuery = RelationalQueryInput<typeof relations, "posts">
+ * type QueryMap = {
+ *   users: QueryInput<typeof relations, "users">
+ *   posts: QueryInput<typeof relations, "posts">
+ * }
  *
- * type AppAbility = PureAbility<[string, Subjects<{
- *   users: UserQuery,
- *   posts: PostQuery
- * }>]>
+ * type AppAbility = Ability<[string, Subjects<QueryMap>]>
  * ```
  */
 type Subjects$1<T> = { [K in keyof T]: Model<T[K], K & string> }[keyof T] | Extract<keyof T, string>;
 /**
- * Custom Ability type with subject-specific conditions.
- * Similar to @casl/prisma's PrismaAbility.
+ * CASL ability type with Drizzle query conditions and typed actions.
+ * Provides type-safe permission checking with action and subject validation.
+ * Use with `defineAbility()` for automatic type inference and  autocomplete.
  *
- * This type ensures that conditions are properly typed based on the subject mapping.
+ * @template T - An object mapping subject names to their query input types
+ * @template TActions - A union of action strings (e.g. "read" | "update")
  *
  * @example
  * ```ts
- * import type { DrizzleAbility } from "ucastle"
+ * import type { DrizzleAbility, QueryInput } from "@noxify/casl-drizzle"
+ *
+ * type AllowedAction = "read" | "create" | "update" | "delete"
  *
  * type SubjectMap = {
- *   users: UserQuery
- *   posts: PostQuery
+ *   users: QueryInput<typeof relations, "users">
+ *   posts: QueryInput<typeof relations, "posts">
  * }
  *
- * type AppAbility = DrizzleAbility<SubjectMap>
+ * type AppAbility = DrizzleAbility<SubjectMap, AllowedAction>
  * ```
  */
-type DrizzleAbility$1<T> = PureAbility<[string, Subjects$1<T>], T[keyof T]>;
+type DrizzleAbility<T, TActions extends string = string> = Ability<[TActions, Subjects$1<T>], T[keyof T]>;
 /**
- * Helper type to create a fully-typed DrizzleAbility from a subject mapping.
- * Provides subject-specific autocomplete in `can()` and `cannot()` methods
- * when used with `defineAbility()`.
- * Works with both `type` and `interface`.
+ * Helper type for defining abilities with full type inference for actions and subjects.
+ * When used with `createDrizzleAbility()`, enables IDE autocomplete for `can()` and `cannot()`
+ * showing only the relevant actions and subject fields.
+ *
+ * @template T - An object mapping subject names to their query input types
+ * @template TActions - A union of action strings (e.g. "read" | "update")
  *
  * @example
  * ```ts
- * import { defineAbility, type DefineAbility } from "ucastle"
+ * import { createDrizzleAbility, type DefineDrizzleAbility } from "@noxify/casl-drizzle"
+ * import type { QueryInput } from "@noxify/casl-drizzle"
  *
- * // Works with type
- * type SubjectMap = {
- *   users: UserQuery
- *   posts: PostQuery
- * }
+ * type AllowedAction = "read" | "create" | "update" | "delete"
  *
- * // Also works with interface
- * interface SubjectMap {
- *   users: UserQuery
- *   posts: PostQuery
+ * type SubjectMap = {
+ *   users: QueryInput<typeof relations, "users">
+ *   posts: QueryInput<typeof relations, "posts">
  * }
  *
- * // Use with defineAbility for subject-specific autocomplete:
- * const ability = defineAbility<SubjectMap>((can, cannot) => {
- *   can("read", "users", { id: 1 }) // ✅ Only user fields!
- *   can("read", "posts", { authorId: 1 }) // ✅ Only post fields!
+ * const ability = createDrizzleAbility<SubjectMap, AllowedAction>((can, cannot) => {
+ *   can("read", "users", { id: 1 })
+ *   can("update", "posts", { authorId: 1 })
+ *   cannot("delete", "posts", { published: true })
  * })
  * ```
  */
-type DefineAbility<T> = DrizzleAbility$1<T>;
+type DefineDrizzleAbility<T, TActions extends string = string> = DrizzleAbility<T, TActions>;
 //#endregion
 //#region src/factories/accessible-by.d.ts
 /**
  * @deprecated use accessibleBy directly instead. It will infer the types from passed Ability instance.
  */
-declare const createAccessibleByFactory: <TResult extends Record<string, unknown>, TDrizzleQuery>() => <TAbility extends PureAbility<any, TDrizzleQuery>>(ability: TAbility, action?: TAbility["rules"][number]["action"]) => TResult;
-declare function accessibleBy<TAbility extends PureAbility<any, any>>(ability: TAbility, action?: TAbility["rules"][number]["action"]): Record<string, WhereInput>;
+declare const createAccessibleByFactory: <TResult extends Record<string, unknown>, TDrizzleQuery>() => <TAbility extends Ability<any, TDrizzleQuery>>(ability: TAbility, action?: TAbility["rules"][number]["action"]) => TResult;
+declare function accessibleBy<TSubjectMap, TActions extends string = string>(ability: DrizzleAbility<TSubjectMap, TActions>, action?: TActions): Record<Extract<keyof TSubjectMap, string>, WhereInput>;
+declare function accessibleBy<TAbility extends Ability<any, any>>(ability: TAbility, action?: TAbility["rules"][number]["action"]): Record<string, WhereInput>;
 //#endregion
 //#region src/factories/create-ability.d.ts
 declare function createAbilityFactory<TModelName extends string, TDrizzleQuery extends Record<string, any>>(): {
-  <T extends PureAbility<any, TDrizzleQuery>>(rules?: RawRuleOf<T>[], options?: AbilityOptionsOf<T>): T;
-  <A extends AbilityTuple = [string, TModelName], C extends TDrizzleQuery = TDrizzleQuery>(rules?: RawRuleFrom<A, C>[], options?: AbilityOptions<A, C>): PureAbility<A, C>;
+  <T extends Ability<any, TDrizzleQuery>>(rules?: RawRuleOf<T>[], options?: AbilityOptionsOf<T>): T;
+  <A extends AbilityTuple = [string, TModelName], C extends TDrizzleQuery = TDrizzleQuery>(rules?: RawRuleFrom<A, C>[], options?: AbilityOptions<A, C>): Ability<A, C>;
 };
 //#endregion
 //#region src/query-error.d.ts
 declare class ParsingQueryError extends Error {
+  name: string;
   static invalidArgument(operatorName: string, value: unknown, expectValueType: string): ParsingQueryError;
 }
 //#endregion
+//#region src/factories/relation-helpers.d.ts
+/**
+ * Type for the builder function parameter with operators and column proxies
+ */
+type RelationHelperBuilder = typeof operators & {
+  /**
+   * Proxy to access columns from the related table.
+   * Each property access returns a SQL reference to that column.
+   *
+   * TypeScript limitation: Due to how Proxy types work, columns is typed as Record<string, any>.
+   * At runtime, each property access returns a valid SQL instance.
+   *
+   * @example
+   * ```ts
+   * some(({ eq, columns }) => eq(columns.name, 'Alice'))
+   * // Generates: name = 'Alice' (in relation subquery context)
+   * ```
+   */
+  columns: Record<string, any>;
+};
+/**
+ * Helper to create a RAW condition for "some" relation filtering.
+ * Generates an EXISTS subquery that returns true if at least one related record matches the condition.
+ *
+ * Use this when you need to filter by relations with complex conditions not supported by QueryInput.
+ * Supports both raw SQL and builder function syntax with column proxies.
+ *
+ * @example
+ * ```ts
+ * import { some } from "@noxify/casl-drizzle"
+ * import { sql } from "drizzle-orm"
+ *
+ * // Using raw SQL
+ * can('update', 'documents', {
+ *   contributors: some(sql`user_id = ${userId}`),
+ * })
+ *
+ * // Using builder function with operators and columns (untyped)
+ * can('update', 'documents', {
+ *   contributors: some(({ eq, columns }) => eq(columns.userId, userId)),
+ * })
+ *
+ * // Type-safe version with table reference:
+ * can('read', 'posts', {
+ *   author: some(schema.users, ({ eq, columns }) => eq(columns.name, 'Alice')),
+ *   // columns is now type-safe with full autocomplete!
+ * })
+ * ```
+ *
+ * @param conditionOrTable - Raw SQL WHERE condition, builder function, or table reference
+ * @param maybeCondition - Optional builder function when first param is a table
+ * @returns A RAW condition object for use in ability definitions
+ */
+declare function some(condition: SQL | ((builder: RelationHelperBuilder) => SQL)): {
+  RAW: SQL;
+};
+declare function some<T extends Table>(table: T, condition: (builder: Omit<RelationHelperBuilder, "columns"> & {
+  columns: T["_"]["columns"];
+}) => SQL): {
+  RAW: SQL;
+};
+/**
+ * Helper to create a RAW condition for "every" relation filtering.
+ * Checks if ALL related records match the condition.
+ *
+ * Supports both raw SQL and builder function syntax with column proxies.
+ *
+ * @example
+ * ```ts
+ * // Only allow updates if ALL comments are approved
+ * can('update', 'documents', {
+ *   comments: every(sql`status = 'approved'`)
+ * })
+ *
+ * // Using builder function with operators
+ * can('update', 'documents', {
+ *   comments: every(({ eq, columns }) => eq(columns.status, 'approved'))
+ * })
+ *
+ * // Type-safe version with table reference:
+ * can('update', 'documents', {
+ *   comments: every(schema.comments, ({ eq, columns }) => eq(columns.status, 'approved'))
+ * })
+ * ```
+ *
+ * @param conditionOrTable - Raw SQL WHERE condition, builder function, or table reference
+ * @param maybeCondition - Optional builder function when first param is a table
+ * @returns A RAW condition object for use in ability definitions
+ */
+declare function every(condition: SQL | ((builder: RelationHelperBuilder) => SQL)): {
+  RAW: SQL;
+};
+declare function every<T extends Table>(table: T, condition: (builder: Omit<RelationHelperBuilder, "columns"> & {
+  columns: T["_"]["columns"];
+}) => SQL): {
+  RAW: SQL;
+};
+/**
+ * Helper to create a RAW condition for "none" relation filtering.
+ * Checks if NO related records match the condition (or exist at all).
+ *
+ * Supports both raw SQL and builder function syntax with column proxies.
+ *
+ * @example
+ * ```ts
+ * // Using raw SQL
+ * can('delete', 'documents', {
+ *   comments: none(sql`status = 'pending'`)
+ * })
+ *
+ * // Using builder function with operators
+ * can('delete', 'documents', {
+ *   comments: none(({ eq, columns }) => eq(columns.status, 'pending'))
+ * })
+ *
+ * // Check that no related records exist
+ * can('delete', 'documents', {
+ *   comments: none()
+ * })
+ *
+ * // Type-safe version with table reference:
+ * can('delete', 'documents', {
+ *   comments: none(schema.comments, ({ eq, columns }) => eq(columns.status, 'pending'))
+ * })
+ * ```
+ *
+ * @param conditionOrTable - Raw SQL WHERE condition, builder function, table reference, or undefined
+ * @param maybeCondition - Optional builder function when first param is a table
+ * @returns A RAW condition object for use in ability definitions
+ */
+declare function none(): {
+  RAW: SQL;
+};
+declare function none(condition: SQL | ((builder: RelationHelperBuilder) => SQL)): {
+  RAW: SQL;
+};
+declare function none<T extends Table>(table: T, condition?: (builder: Omit<RelationHelperBuilder, "columns"> & {
+  columns: T["_"]["columns"];
+}) => SQL): {
+  RAW: SQL;
+};
+//#endregion
 //#region src/index.d.ts
 /**
  * Factory function to create a DrizzleAbility instance.
@@ -171,44 +343,49 @@ declare class ParsingQueryError extends Error {
  * @example
  * ```ts
  * import { AbilityBuilder } from "@casl/ability"
- * import { createDrizzleAbilityFor, type DefineAbility } from "ucastle"
+ * import { createDrizzleAbilityFor, type DefineDrizzleAbility } from "@noxify/casl-drizzle"
+ *
+ * type AllowedAction = "read" | "create" | "update" | "delete"
  *
- * type AppAbility = DefineAbility<{
+ * type AppAbility = DefineDrizzleAbility<{
  *   users: UserQuery
  *   posts: PostQuery
- * }>
+ * }, AllowedAction>
  *
- * const { can, build } = new AbilityBuilder<AppAbility>(createDrizzleAbilityFor())
+ * const { can, build } = new AbilityBuilder<AppAbility>(
+ *   createDrizzleAbilityFor<{
+ *     users: UserQuery
+ *     posts: PostQuery
+ *   }, AllowedAction>(),
+ * )
  * ```
  */
-declare function createDrizzleAbilityFor(): new (...args: ConstructorParameters<typeof PureAbility>) => AnyAbility;
+declare function createDrizzleAbilityFor(): new (...args: ConstructorParameters<typeof Ability>) => AnyAbility;
+declare function createDrizzleAbilityFor<TSubject, TActions extends string = string>(): new (...args: ConstructorParameters<typeof Ability>) => DrizzleAbility<TSubject, TActions>;
 /**
- * Create a type-safe ability with subject-specific conditions.
- * This provides better autocomplete than using AbilityBuilder directly.
+ * Create a type-safe ability with subject and action-specific conditions.
+ * Use this with a pre-defined ability type for full type inference.
+ *
+ * @template TAbility - A DrizzleAbility type (includes both actions and subjects)
  *
  * @example
  * ```ts
- * import { defineAbility } from "ucastle"
+ * import { createDrizzleAbility } from "@noxify/casl-drizzle"
+ * import type { QueryInput } from "@noxify/casl-drizzle"
  *
- * const ability = defineAbility<{
- *   users: UserQuery
- *   posts: PostQuery
- * }>((can, cannot) => {
- *   can("read", "users", { id: 1 }) // ✅ Only user fields
- *   can("read", "posts", { authorId: 1 }) // ✅ Only post fields
+ * type AllowedAction = "read" | "create" | "update" | "delete"
+ *
+ * type SubjectMap = {
+ *   users: QueryInput<typeof relations, "users">
+ *   posts: QueryInput<typeof relations, "posts">
+ * }
+ *
+ * const ability = createDrizzleAbility<SubjectMap, AllowedAction>((can, cannot) => {
+ *   can("read", "users", { id: 1 })
+ *   can("update", "posts", { authorId: 1 })
  * })
  * ```
  */
-declare function defineAbility<T>(define: (can: <S extends keyof T & string>(action: string, subject: S, conditions?: T[S]) => void, cannot: <S extends keyof T & string>(action: string, subject: S, conditions?: T[S]) => void) => void): PureAbility<[string, any], T[keyof T]>;
-/**
- * Uses conditional type to support union distribution
- */
-type ExtendedAbilityTuple<T extends AbilityTuple> = T extends AbilityTuple ? [T[0], "all" | T[1]] : never;
-/**
- * @deprecated use createDrizzleAbilityFor instead
- */
-declare class DrizzleAbility<A extends AbilityTuple = [string, string], C extends Record<string, unknown> = Record<string, unknown>> extends PureAbility<ExtendedAbilityTuple<A>, C> {
-  constructor(rules?: RawRuleFrom<ExtendedAbilityTuple<A>, C>[], options?: AbilityOptions<ExtendedAbilityTuple<A>, C>);
-}
+declare function createDrizzleAbility<TSubject, TActions extends string = string>(define: (can: <S extends keyof TSubject & string>(action: TActions, subject: S, conditions?: TSubject[S]) => void, cannot: <S extends keyof TSubject & string>(action: TActions, subject: S, conditions?: TSubject[S]) => void) => void): DrizzleAbility<TSubject, TActions>;
 //#endregion
-export { type BaseDrizzleQuery, type DefineAbility, DrizzleAbility, type DrizzleModel, type DrizzleQueryFactory, type Subjects as DrizzleSubjects, type ExtractModelName, type Model, ParsingQueryError, type QueryInput, type RelationalQueryInput, type Subjects$1 as Subjects, type WhereInput, accessibleBy, createAbilityFactory, createAccessibleByFactory, createDrizzleAbilityFor, defineAbility, drizzleQuery };
+export { type BaseDrizzleQuery, type DefineDrizzleAbility, type DrizzleModel, type DrizzleQueryFactory, type Subjects as DrizzleSubjects, type ExtractModelName, type Model, ParsingQueryError, type QueryInput, type Subjects$1 as Subjects, type WhereInput, accessibleBy, type createAbilityFactory, type createAccessibleByFactory, createDrizzleAbility, createDrizzleAbilityFor, drizzleQuery, every, none, some };

package/dist/index.mjs

@@ -1 +1 @@
-import{AbilityBuilder as e,ForbiddenError as t,PureAbility as n,fieldPatternMatcher as r}from"@casl/ability";import{CompoundCondition as i,FieldCondition as a,NULL_CONDITION as o,ObjectQueryParser as s,buildAnd as c,createTranslatorFactory as l}from"@ucast/core";import{and as u,compare as d,createJsInterpreter as f,eq as p,gt as m,gte as h,lt as ee,lte as te,ne as g,or as _,within as v}from"@ucast/js";import{rulesToQuery as y}from"@casl/ability/extra";const b=(e,t,{get:n})=>n(t,e.field).startsWith(e.value),x=(e,t,{get:n})=>n(t,e.field).toLowerCase().startsWith(e.value.toLowerCase()),ne=(e,t,{get:n})=>n(t,e.field).endsWith(e.value),S=(e,t,{get:n})=>n(t,e.field).toLowerCase().endsWith(e.value.toLowerCase()),C=(e,t,{get:n})=>n(t,e.field).includes(e.value),w=(e,t,{get:n})=>n(t,e.field).toLowerCase().includes(e.value.toLowerCase()),T=(e,t,{get:n})=>{let r=n(t,e.field);return(Array.isArray(r)&&r.length===0)===e.value},E=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&r.includes(e.value)},D=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&e.value.some(e=>r.includes(e))},O=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&e.value.every(e=>r.includes(e))},k=(e,t,{get:n,interpret:r})=>{let i=n(t,e.field);return Array.isArray(i)&&i.length>0&&i.every(t=>r(e.value,t))},A=(e,t,{get:n,interpret:r})=>{let i=n(t,e.field);return Array.isArray(i)&&i.some(t=>r(e.value,t))},j=(e,t,{get:n,interpret:r})=>{let i=n(t,e.field);return typeof i==`object`&&!!i&&r(e.value,i)},M=(e,t,{interpret:n})=>e.value.every(e=>!n(e,t)),N=(e,t,{get:n})=>n(t,e.field)!==void 0;function P(e){return e&&typeof e==`object`?e.valueOf():e}const F=f({equals:p,notEquals:g,in:v,lt:ee,lte:te,gt:m,gte:h,startsWith:b,istartsWith:x,endsWith:ne,iendsWith:S,contains:C,icontains:w,isEmpty:T,has:E,hasSome:D,hasEvery:O,and:u,or:_,AND:u,OR:_,NOT:M,every:k,some:A,is:j,isSet:N},{get:(e,t)=>e[t],compare:(e,t)=>d(P(e),P(t))});var I=class extends Error{static invalidArgument(e,t,n){let r=`${typeof t}(${JSON.stringify(t,null,2)})`;return new this(`"${e}" expects to receive ${n} but instead got "${r}"`)}};const L=e=>typeof e==`object`&&!!e&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null),re={type:`field`,validate(e,t){if(Array.isArray(t)||L(t))throw new I(`"${e.name}" does not supports comparison of arrays and objects`)}},R={type:`field`,parse:((e,t,{hasOperators:n,field:r,parse:o})=>{if(L(t)&&!n(t)||Array.isArray(t))throw new I(`"${e.name}" does not supports comparison of arrays and objects`);return L(t)?new i(`NOT`,[o(t,{field:r})]):new a(`notEquals`,r,t)})},z={type:`field`,validate(e,t){if(!Array.isArray(t))throw I.invalidArgument(e.name,t,`an array`)}},B={type:`field`,validate(e,t){let n=typeof t;if(!(n===`string`||n===`number`&&Number.isFinite(t)||t instanceof Date))throw I.invalidArgument(e.name,t,`comparable value`)}},V=new Set([`insensitive`,`default`]),H={type:`field`,validate(e,t){if(!V.has(t))throw I.invalidArgument(e.name,t,`one of ${Array.from(V).join(`, `)}`)},parse:()=>o},U={type:`field`,validate(e,t){if(typeof t!=`string`)throw I.invalidArgument(e.name,t,`string`)},parse(e,t,{query:n,field:r}){return new a(n.mode===`insensitive`?`i${e.name}`:e.name,r,t)}},W={type:`compound`,validate(e,t){if(!t||typeof t!=`object`)throw I.invalidArgument(e.name,t,`an array or object`)},parse(e,t,{parse:n}){let r=(Array.isArray(t)?t:[t]).map(e=>n(e));return new i(e.name,r)}},G={type:`field`,validate(e,t){if(typeof t!=`boolean`)throw I.invalidArgument(e.name,t,`a boolean`)}},K={type:`field`},q={type:`field`,validate(e,t){if(!Array.isArray(t))throw I.invalidArgument(e.name,t,`an array`)}},J={type:`field`,parse(e,t,{field:n,parse:r}){if(!L(t))throw I.invalidArgument(e.name,t,`a query for nested relation`);return new a(e.name,n,r(t))}},Y=(e,t)=>{let n=t.parse?.bind(t);return n?{...t,parse(t,r,a){let o=n(t,r,a);if(o.operator!==t.name)throw Error(`Cannot invert "${e}" operator parser because it returns a complex Condition`);return o.operator=e,new i(`NOT`,[o])}}:{...t,parse(t,n,r){return new i(`NOT`,[new a(e,r.field,n)])}}},X={equals:re,not:R,in:z,notIn:Y(`in`,z),lt:B,lte:B,gt:B,gte:B,$lt:B,$lte:B,$gt:B,$gte:B,$in:z,$nin:Y(`in`,z),mode:H,startsWith:U,endsWith:U,contains:U,isEmpty:G,has:K,hasSome:q,hasEvery:q,NOT:W,AND:W,OR:W,every:J,some:J,none:Y(`some`,J),is:J,isNot:Y(`is`,J),isSet:G},Z=l(new class extends s{constructor(){super(X,{defaultOperatorName:`equals`})}parse(e,t){return t?.field?c(this.parseFieldOperators(t.field,e)):super.parse(e)}}().parse,F);function Q(e){if(typeof e!=`object`||!e)return e;if(Array.isArray(e))return e.map(Q);let t={};for(let[n,r]of Object.entries(e)){if(n===`OR`||n===`AND`){t[n]=Q(r);continue}if(n.startsWith(`$`)){let e=n.substring(1);t[e]=Q(r);continue}typeof r==`object`&&r&&!Array.isArray(r)?t[n]=Q(r):t[n]=r}return t}const ie={get(e,n){let r=y(e._ability,e._action,n,e=>e.inverted?{NOT:e.conditions}:e.conditions);if(r===null){let r=t.from(e._ability).setMessage(`It's not allowed to run "${e._action}" on "${n}"`);throw r.action=e._action,r.subjectType=r.subject=n,r}let i=Object.create(null);if(r.$or&&Array.isArray(r.$or)&&r.$or.length===1){let e=r.$or[0];Object.assign(i,e)}else r.$or&&(i.OR=r.$or);return r.$and&&(i.AND=r.$and),Q(i)}};function ae(e,t=`read`){return new Proxy({_ability:e,_action:t},ie)}function $(){function e(e=[],t={}){return new n(e,{...t,conditionsMatcher:Z,fieldMatcher:r})}return e}function oe(){return $()}function se(t){let n=new e($());return t((e,t,r)=>n.can(e,t,r),(e,t,r)=>n.cannot(e,t,r)),n.build()}var ce=class extends n{constructor(e,t){super(e,{conditionsMatcher:Z,fieldMatcher:r,...t})}};export{ce as DrizzleAbility,I as ParsingQueryError,ae as accessibleBy,oe as createDrizzleAbilityFor,se as defineAbility,Z as drizzleQuery};
+import{Ability as e,AbilityBuilder as t,ForbiddenError as n,fieldPatternMatcher as r}from"@casl/ability";import{CompoundCondition as i,FieldCondition as a,NULL_CONDITION as o,ObjectQueryParser as ee,buildAnd as te,createTranslatorFactory as s}from"@ucast/core";import{and as c,compare as l,createJsInterpreter as u,gt as ne,gte as re,lt as ie,lte as ae,or as d,within as oe}from"@ucast/js";import{rulesToCondition as se}from"@casl/ability/extra";import{operators as f,sql as p}from"drizzle-orm";const ce=(e,t,{get:n})=>n(t,e.field).startsWith(e.value),le=(e,t,{get:n})=>n(t,e.field).toLowerCase().startsWith(e.value.toLowerCase()),m=(e,t,{get:n})=>n(t,e.field).endsWith(e.value),ue=(e,t,{get:n})=>n(t,e.field).toLowerCase().endsWith(e.value.toLowerCase()),h=(e,t,{get:n})=>n(t,e.field).includes(e.value),g=(e,t,{get:n})=>n(t,e.field).toLowerCase().includes(e.value.toLowerCase()),_=e=>{let t=`^${e.replaceAll(/[.*+?^${}()|[\]\\]/gu,`\\$&`).replaceAll(`%`,`.*`).replaceAll(`_`,`.`)}$`;return new RegExp(t,`u`)},v=(e,t,{get:n})=>{let r=n(t,e.field);return typeof r==`string`?_(e.value).test(r):!1},y=(e,t,{get:n})=>{let r=n(t,e.field);return typeof r==`string`?_(e.value.toLowerCase()).test(r.toLowerCase()):!1},b=(e,t,{get:n})=>{let r=n(t,e.field);return(Array.isArray(r)&&r.length===0)===e.value},de=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&r.includes(e.value)},fe=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&e.value.some(e=>r.includes(e))},pe=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&e.value.every(e=>r.includes(e))},me=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&e.value.some(e=>r.includes(e))},he=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&e.value.every(e=>r.includes(e))},x=(e,t,{get:n})=>{let r=n(t,e.field);return Array.isArray(r)&&r.every(t=>e.value.includes(t))},S=(e,t,{get:n,interpret:r})=>{let i=n(t,e.field);return Array.isArray(i)&&i.length>0&&i.every(t=>r(e.value,t))},C=(e,t,{get:n,interpret:r})=>{let i=n(t,e.field);return Array.isArray(i)&&i.some(t=>r(e.value,t))},w=(e,t,{get:n,interpret:r})=>{let i=n(t,e.field);return typeof i==`object`&&!!i&&r(e.value,i)},T=(e,t,{interpret:n})=>e.value.every(e=>!n(e,t)),E=(e,t,{get:n})=>n(t,e.field)!==void 0===e.value,D=(e,t,{get:n})=>n(t,e.field)===null===e.value,O=(e,t,{get:n})=>n(t,e.field)!==null===e.value;function k(e){return e&&typeof e==`object`?e.valueOf():e}const A=e=>typeof e==`object`&&!!e&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null),j=(e,t)=>{if(Object.is(e,t))return!0;if(e instanceof Date&&t instanceof Date)return e.getTime()===t.getTime();if(Array.isArray(e)&&Array.isArray(t))return e.length===t.length&&e.every((e,n)=>j(e,t[n]));if(A(e)&&A(t)){let n=Object.keys(e),r=Object.keys(t);return n.length===r.length&&n.every(n=>Object.hasOwn(t,n)&&j(e[n],t[n]))}return!1},M=e=>{let t=typeof e;return e===null||t===`string`||t===`number`||t===`boolean`||t===`bigint`||e instanceof Date},N=(e,t,{get:n,compare:r})=>{let i=n(t,e.field),a=e.value;return j(i,a)?!0:M(i)&&M(a)?r(i,a)===0:!1},P=u({eq:N,equals:N,notEquals:(e,t,n)=>!N(e,t,n),in:oe,lt:ie,lte:ae,gt:ne,gte:re,startsWith:ce,istartsWith:le,endsWith:m,iendsWith:ue,contains:h,icontains:g,like:v,ilike:y,isEmpty:b,has:de,hasSome:fe,hasEvery:pe,arrayOverlaps:me,arrayContained:x,arrayContains:he,and:c,or:d,AND:c,OR:d,NOT:T,every:S,some:C,is:w,isSet:E,isNull:D,isNotNull:O,RAW:()=>!0},{get:(e,t)=>e[t],compare:(e,t)=>l(k(e),k(t))});var F=class extends Error{name=`ParsingQueryError`;static invalidArgument(e,t,n){let r=`${typeof t}(${JSON.stringify(t,null,2)})`;return new this(`"${e}" expects to receive ${n} but instead got "${r}"`)}};const I=e=>typeof e==`object`&&!!e&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null),L={type:`field`},R={type:`field`,validate:void L.validate,parse(e,t,{field:n}){return new a(`notEquals`,n,t)}},ge={type:`field`,parse:((e,t,{hasOperators:n,field:r,parse:o})=>Array.isArray(t)||!I(t)||!n(t)?new a(`notEquals`,r,t):new i(`NOT`,[o(t,{field:r})]))},z={type:`field`,validate(e,t){if(!Array.isArray(t))throw F.invalidArgument(e.name,t,`an array`)}},B={type:`field`,validate(e,t){let n=typeof t;if(!(n===`string`||n===`number`&&Number.isFinite(t)||t instanceof Date))throw F.invalidArgument(e.name,t,`comparable value`)}},V=new Set([`insensitive`,`default`]),_e={type:`field`,validate(e,t){if(!V.has(t))throw F.invalidArgument(e.name,t,`one of ${[...V].join(`, `)}`)},parse:()=>o},H={type:`field`,validate(e,t){if(typeof t!=`string`)throw F.invalidArgument(e.name,t,`string`)},parse(e,t,{query:n,field:r}){return new a(n.mode===`insensitive`?`i${e.name}`:e.name,r,t)}},U={type:`field`,validate(e,t){if(typeof t!=`string`)throw F.invalidArgument(e.name,t,`string`)},parse(e,t,{query:n,field:r}){return e.name===`ilike`||n.mode===`insensitive`?new a(`ilike`,r,t):new a(`like`,r,t)}},W={type:`compound`,validate(e,t){if(!t||typeof t!=`object`)throw F.invalidArgument(e.name,t,`an array or object`)},parse(e,t,{parse:n}){let r=(Array.isArray(t)?t:[t]).map(e=>n(e));return new i(e.name,r)}},G={type:`field`,validate(e,t){if(typeof t!=`boolean`)throw F.invalidArgument(e.name,t,`a boolean`)}},ve={type:`field`},K={type:`field`,validate(e,t){if(!Array.isArray(t))throw F.invalidArgument(e.name,t,`an array`)}},q={type:`field`,validate(e,t){if(!Array.isArray(t))throw F.invalidArgument(e.name,t,`an array`)}},J={type:`field`,parse(e,t,{field:n,parse:r}){if(!I(t))throw F.invalidArgument(e.name,t,`a query for nested relation`);return new a(e.name,n,r(t))}},Y=(e,t)=>{let n=t.parse?.bind(t);return n?{...t,parse(t,r,a){let o=n(t,r,a);if(o.operator!==t.name)throw Error(`Cannot invert "${e}" operator parser because it returns a complex Condition`);return o.operator=e,new i(`NOT`,[o])}}:{...t,parse(t,n,r){return new i(`NOT`,[new a(e,r.field,n)])}}},ye={eq:L,ne:R,not:ge,in:z,notIn:Y(`in`,z),lt:B,lte:B,gt:B,gte:B,$lt:B,$lte:B,$gt:B,$gte:B,$in:z,$nin:Y(`in`,z),mode:_e,startsWith:H,endsWith:H,contains:H,like:U,ilike:U,notLike:{type:`field`,parse:((e,t,{field:n,parse:r})=>new i(`NOT`,[r({like:t},{field:n})]))},notIlike:{type:`field`,parse:((e,t,{field:n,parse:r})=>new i(`NOT`,[r({ilike:t},{field:n})]))},isNull:G,isNotNull:G,isEmpty:G,has:ve,hasSome:K,hasEvery:K,arrayOverlaps:q,arrayContained:q,arrayContains:q,NOT:W,AND:W,OR:W,every:J,some:J,none:Y(`some`,J),is:J,isNot:Y(`is`,J),isSet:G,RAW:{type:`field`,parse(e,t){return new a(`RAW`,`RAW`,t)}}},X=s(new class extends ee{constructor(){super(ye,{defaultOperatorName:`eq`})}normalizeEqOperator(e){if(Array.isArray(e))return e.map(e=>this.normalizeEqOperator(e));if(!I(e))return e;let t=Object.keys(e);if(t.length===1&&t[0]===`eq`)return this.normalizeEqOperator(e.eq);let n={};for(let[t,r]of Object.entries(e))n[t]=this.normalizeEqOperator(r);return n}parse(e,t){let n=this.normalizeEqOperator(e);return t?.field?te(this.parseFieldOperators(t.field,n)):super.parse(n)}}().parse,P);function Z(e){if(typeof e!=`object`||!e)return e;if(Array.isArray(e))return e.map(Z);let t={};for(let[n,r]of Object.entries(e)){if(n===`OR`||n===`AND`){t[n]=Z(r);continue}if(n===`RAW`){t[n]=r;continue}if(n.startsWith(`$`)){let e=n.slice(1);t[e]=Z(r);continue}t[n]=typeof r==`object`&&r&&!Array.isArray(r)?Z(r):r}return t}const be={get(e,t){let r=se(e._ability.rulesFor(e._action,t),e=>e.inverted?{NOT:e.conditions}:e.conditions,{and:e=>({AND:e}),or:e=>({OR:e}),empty:()=>({})});if(r===null){let r=n.from(e._ability).setMessage(`It's not allowed to run "${e._action}" on "${t}"`);throw r.action=e._action,r.subjectType=t,r.subject=t,r}let i=Object.create(null);if(r.OR&&Array.isArray(r.OR)&&r.OR.length===1){let[e]=r.OR;Object.assign(i,e)}else r.OR&&(i.OR=r.OR);return Z(i)}};function xe(e,t){return new Proxy({_ability:e,_action:t},be)}function Q(){function t(t=[],n={}){return new e(t,{...n,conditionsMatcher:X,fieldMatcher:r})}return t}const $=()=>new Proxy({},{get:(e,t)=>p.raw(String(t))});function Se(e,t){if(e&&typeof e==`object`&&`_`in e&&`columns`in e._){if(!t)throw Error(`Condition is required when table is provided`);let{columns:n}=e._;return{RAW:t({...f,columns:n})}}let n=e;if(typeof n==`function`){let e=$();return{RAW:n({...f,columns:e})}}return{RAW:n}}function Ce(e,t){if(e&&typeof e==`object`&&`_`in e&&`columns`in e._){if(!t)throw Error(`Condition is required when table is provided`);let{columns:n}=e._;return{RAW:t({...f,columns:n})}}let n=e;if(typeof n==`function`){let e=$();return{RAW:n({...f,columns:e})}}return{RAW:n}}function we(e,t){if(!e)return{RAW:p`1=0`};if(e&&typeof e==`object`&&`_`in e&&`columns`in e._){if(!t)return{RAW:p`1=0`};let{columns:n}=e._;return{RAW:t({...f,columns:n})}}let n=e;if(typeof n==`function`){let e=$();return{RAW:n({...f,columns:e})}}return{RAW:n}}function Te(){return Q()}function Ee(e){let n=new t(Q());return e(n.can.bind(n),n.cannot.bind(n)),n.build()}export{F as ParsingQueryError,xe as accessibleBy,Ee as createDrizzleAbility,Te as createDrizzleAbilityFor,X as drizzleQuery,Ce as every,we as none,Se as some};

package/package.json

@@ -1,29 +1,31 @@
 {
   "name": "@noxify/casl-drizzle",
-  "version": "0.0.1-beta.3",
+  "version": "0.2.0",
   "description": "Drizzle-ORM adapter for CASL - generate Drizzle where inputs from CASL abilities",
   "keywords": [
+    "ability",
+    "acl",
+    "authorization",
+    "casl",
     "drizzle",
     "drizzle-orm",
-    "casl",
-    "ucast"
+    "permissions",
+    "query-builder",
+    "rbac",
+    "relational",
+    "type-safe",
+    "typescript"
   ],
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/noxify/casl-drizzle"
   },
-  "license": "MIT",
-  "authors": [
-    {
-      "name": "Marcus Reinhardt",
-      "email": "webstone@gmail.com"
-    },
-    {
-      "name": "Guilherme Araújo",
-      "email": "arauujogui@gmail.com"
-    }
+  "files": [
+    "dist"
   ],
   "type": "module",
+  "types": "./dist/index.d.mts",
   "exports": {
     ".": {
       "types": "./dist/index.d.mts",
@@ -31,61 +33,56 @@
       "default": "./src/index.ts"
     }
   },
-  "types": "./dist/index.d.mts",
-  "files": [
-    "dist"
-  ],
   "dependencies": {
-    "@ucast/core": "^1.10.2",
-    "@ucast/js": "3.1.0"
+    "@ucast/core": "2.0.0",
+    "@ucast/js": "4.0.1"
   },
-  "prettier": "./prettier.config.mjs",
   "devDependencies": {
-    "@casl/ability": "^6.8.0",
-    "@changesets/cli": "2.29.8",
-    "@eslint/compat": "2.0.2",
-    "@eslint/js": "9.39.2",
-    "@ianvs/prettier-plugin-sort-imports": "4.7.1",
-    "@testcontainers/postgresql": "^11.11.0",
+    "@casl/ability": "7.0.0",
+    "@changesets/cli": "2.31.0",
+    "@electric-sql/pglite": "0.4.6",
     "@types/js-yaml": "4.0.9",
-    "@types/node": "24.10.13",
-    "@vitest/coverage-v8": "4.0.18",
-    "dedent": "1.7.1",
-    "drizzle-kit": "beta",
-    "drizzle-orm": "beta",
-    "eslint": "9.39.2",
-    "eslint-plugin-import": "2.32.0",
-    "eslint-plugin-package-json": "0.88.2",
+    "@types/node": "24.12.4",
+    "@vitest/coverage-v8": "4.1.7",
+    "dedent": "1.7.2",
+    "drizzle-kit": "1.0.0-rc.3",
+    "drizzle-orm": "1.0.0-rc.3",
     "json-schema-to-typescript": "15.0.4",
-    "jsonc-eslint-parser": "2.4.2",
     "node-pty": "1.1.0",
-    "postgres": "3.4.8",
-    "prettier": "3.8.1",
-    "tsdown": "0.20.3",
-    "tsx": "4.21.0",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "8.55.0",
-    "vitest": "4.0.18"
+    "oxfmt": "0.52.0",
+    "oxlint": "1.67.0",
+    "tsdown": "0.22.1",
+    "tsx": "4.22.3",
+    "typescript": "6.0.3",
+    "ultracite": "7.8.0",
+    "vitest": "4.1.7"
   },
   "peerDependencies": {
-    "@casl/ability": "^6.8.0",
-    "drizzle-orm": ">=1.0.0-beta.15"
+    "@casl/ability": "^7.0.0",
+    "drizzle-orm": ">=1.0.0-rc.3"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
+  "authors": [
+    {
+      "name": "Marcus Reinhardt",
+      "email": "webstone@gmail.com"
+    }
+  ],
   "scripts": {
     "build": "tsdown",
     "ci:publish": "pnpm build && pnpm publish -r --access public --publish-branch main && pnpm changeset tag",
     "ci:version": "pnpm changeset version && pnpm install --no-frozen-lockfile && git add .",
     "cs": "changeset",
-    "format": "prettier --check . --ignore-path ./.gitignore --ignore-path ./.prettierignore",
-    "format:fix": "prettier --write . --ignore-path ./.gitignore --ignore-path ./.prettierignore",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
+    "lint": "ultracite check",
+    "lint:fix": "ultracite fix && pnpm format:fix",
+    "format": "oxfmt --check",
+    "format:fix": "oxfmt .",
     "test": "vitest --run",
     "test:coverage": "vitest --coverage",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "deps:update": "pnpm update -i -L -r"
   }
 }