@prisma-idb/idb-client-generator 0.35.0 → 0.36.0

package/README.md

@@ -151,7 +151,7 @@ If you discover a security vulnerability, please follow our SECURITY.md guidelin
 
 ## License
 
-This project is licensed under the GNU Affero General Public License v3.0. See the LICENSE file for more details.
+This project is licensed under the MIT License. See the LICENSE file for more details.
 
 ## Acknowledgements
 

package/dist/fileCreators/batch-processor/create.js

@@ -15,31 +15,48 @@ exports.pushErrorTypes = {
     MAX_RETRIES: "MAX_RETRIES",
     CUSTOM_VALIDATION_FAILED: "CUSTOM_VALIDATION_FAILED",
 };
-function buildAuthorizationPath(targetModel, rootModel, models, dag) {
+function buildAllAuthorizationPaths(targetModel, rootModel, models, dag) {
     if (targetModel === rootModel) {
         return [];
     }
-    const path = [];
-    const visited = new Set();
     const modelMap = new Map(models.map((m) => [m.name, m]));
-    const dfs = (current) => {
-        if (current === rootModel)
-            return true;
+    const allPaths = [];
+    const dfs = (current, path, visited) => {
+        if (current === rootModel) {
+            allPaths.push([...path]);
+            return;
+        }
         visited.add(current);
         const model = modelMap.get(current);
         if (!model)
-            return false;
+            return;
         const relationFields = model.fields.filter((f) => f.kind === "object" && !f.isList && dag[f.type]);
         for (const field of relationFields) {
-            if (!visited.has(field.type) && dfs(field.type)) {
-                path.unshift(field.name);
-                return true;
+            if (!visited.has(field.type)) {
+                path.push(field.name);
+                dfs(field.type, path, new Set(visited));
+                path.pop();
             }
         }
-        return false;
     };
-    dfs(targetModel);
-    return path;
+    dfs(targetModel, [], new Set());
+    allPaths.sort((a, b) => {
+        if (a.length !== b.length)
+            return a.length - b.length;
+        const targetModelObj = modelMap.get(targetModel);
+        if (targetModelObj) {
+            const fieldA = targetModelObj.fields.find((f) => f.name === a[0]);
+            const fieldB = targetModelObj.fields.find((f) => f.name === b[0]);
+            if (fieldA && fieldB) {
+                if (fieldA.isRequired && !fieldB.isRequired)
+                    return -1;
+                if (!fieldA.isRequired && fieldB.isRequired)
+                    return 1;
+            }
+        }
+        return 0;
+    });
+    return allPaths;
 }
 function createBatchProcessorFile(writer, options) {
     const { models, prismaClientImport, rootModel } = options;
@@ -220,7 +237,7 @@ function createBatchProcessorFile(writer, options) {
             const pk = (0, utils_1.getUniqueIdentifiers)(model)[0];
             const pkFields = JSON.parse(pk.keyPath);
             const isRootModel = model.name === rootModel.name;
-            const authPath = buildAuthorizationPath(model.name, rootModel.name, models, dag);
+            const allAuthPaths = buildAllAuthorizationPaths(model.name, rootModel.name, models, dag);
             writer.writeLine(`      case "${model.name}": {`);
             writer.writeLine(`        const keyPathValidation = keyPathValidators.${model.name}.safeParse(log.keyPath);`);
             writer.writeLine(`        if (!keyPathValidation.success) {`);
@@ -242,7 +259,7 @@ function createBatchProcessorFile(writer, options) {
                 writer.writeLine(`        });`);
             }
             else {
-                const flatWhere = buildFlatWhereClause(pk.name, pkFields, authPath, rootModel);
+                const flatWhere = buildMultiPathFlatWhereClause(pk.name, pkFields, allAuthPaths, rootModel);
                 writer.writeLine(`        const record = await prisma.${modelNameLower}.findFirst({`);
                 writer.writeLine(`          where: ${flatWhere},`);
                 writer.writeLine(`          select: { ${selectFields} },`);
@@ -293,8 +310,10 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
     const modelNameLower = model.name.charAt(0).toLowerCase() + model.name.slice(1);
     const pk = (0, utils_1.getUniqueIdentifiers)(model)[0];
     const pkFields = JSON.parse(pk.keyPath);
-    const authPath = buildAuthorizationPath(model.name, rootModel.name, allModels, dag);
+    const allAuthPaths = buildAllAuthorizationPaths(model.name, rootModel.name, allModels, dag);
+    const authPath = allAuthPaths[0] || [];
     const isRootModel = model.name === rootModel.name;
+    const hasMultiplePaths = allAuthPaths.length > 1;
     writer.writeLine(`async function sync${model.name}(event: OutboxEventRecord, data: z.infer<typeof validators.${model.name}>, scopeKey: string, prisma: PrismaClient): Promise<PushResult>`);
     writer.block(() => {
         writer.writeLine(`const { id, operation } = event;`);
@@ -321,67 +340,72 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
         writer.writeLine(`        return { id, error: null, appliedChangelogId: existingLog.id };`);
         writer.writeLine(`      }`);
         writer.blankLine();
-        if (!isRootModel && authPath.length > 0) {
-            const firstRelationFieldName = authPath[0];
-            const relationField = model.fields.find((f) => f.name === firstRelationFieldName);
-            if (!relationField) {
-                throw new Error(`Failed to find relation field ${firstRelationFieldName} on model ${model.name}`);
-            }
-            if (!relationField.relationFromFields || relationField.relationFromFields.length === 0) {
-                throw new Error(`Relation field ${firstRelationFieldName} on model ${model.name} does not have foreign key fields`);
+        if (!isRootModel && allAuthPaths.length > 0) {
+            if (hasMultiplePaths) {
+                emitMultiPathPayloadOwnershipCheck(writer, "      ", allAuthPaths, model, allModels, rootModel, `Unauthorized: ${model.name} parent is not owned by authenticated scope`);
             }
-            const foreignKeyFields = relationField.relationFromFields;
-            const parentModel = allModels.find((m) => m.name === relationField.type);
-            if (!parentModel || foreignKeyFields.length === 0) {
-                throw new Error(`Failed to find parent model for ${model.name} via relation field ${firstRelationFieldName}`);
-            }
-            const parentModelLower = parentModel.name.charAt(0).toLowerCase() + parentModel.name.slice(1);
-            const remainingPath = authPath.slice(1);
-            if (remainingPath.length > 0) {
-                const parentSelectObj = buildSelectObject(remainingPath, rootModel);
-                const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
-                const parentPkFields = JSON.parse(parentPk.keyPath);
-                const rootPkFieldName = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
-                const accessChain = buildAccessChain(remainingPath, rootPkFieldName, parentModel, allModels);
-                if (!relationField.isRequired) {
-                    emitOptionalFkGuard(writer, "      ", foreignKeyFields, model.name);
-                }
-                writer.writeLine(`      const parentRecord = await tx.${parentModelLower}.findUnique({`);
-                if (parentPkFields.length === 1) {
-                    writer.writeLine(`        where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+            else {
+                const firstRelationFieldName = authPath[0];
+                const relationField = model.fields.find((f) => f.name === firstRelationFieldName);
+                if (!relationField) {
+                    throw new Error(`Failed to find relation field ${firstRelationFieldName} on model ${model.name}`);
                 }
-                else {
-                    const compositeKey = parentPkFields.map((field, i) => `${field}: data.${foreignKeyFields[i]}`).join(", ");
-                    writer.writeLine(`        where: { ${parentPk.name}: { ${compositeKey} } },`);
+                if (!relationField.relationFromFields || relationField.relationFromFields.length === 0) {
+                    throw new Error(`Relation field ${firstRelationFieldName} on model ${model.name} does not have foreign key fields`);
                 }
-                writer.writeLine(`        select: ${parentSelectObj},`);
-                writer.writeLine(`      });`);
-                writer.blankLine();
-                writer.writeLine(`      if (!parentRecord || parentRecord${accessChain} !== scopeKey) {`);
-                writer.writeLine(`        throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Unauthorized: ${model.name} parent is not owned by authenticated scope\`);`);
-                writer.writeLine(`      }`);
-            }
-            else {
-                const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
-                const parentPkFields = JSON.parse(parentPk.keyPath);
-                const parentPkFieldName = (0, utils_1.getUniqueIdentifiers)(parentModel)[0].name;
-                if (!relationField.isRequired) {
-                    emitOptionalFkGuard(writer, "      ", foreignKeyFields, model.name);
+                const foreignKeyFields = relationField.relationFromFields;
+                const parentModel = allModels.find((m) => m.name === relationField.type);
+                if (!parentModel || foreignKeyFields.length === 0) {
+                    throw new Error(`Failed to find parent model for ${model.name} via relation field ${firstRelationFieldName}`);
                 }
-                writer.writeLine(`      const parentRecord = await tx.${parentModelLower}.findUnique({`);
-                if (parentPkFields.length === 1) {
-                    writer.writeLine(`        where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+                const parentModelLower = parentModel.name.charAt(0).toLowerCase() + parentModel.name.slice(1);
+                const remainingPath = authPath.slice(1);
+                if (remainingPath.length > 0) {
+                    const parentSelectObj = buildSelectObject(remainingPath, rootModel);
+                    const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
+                    const parentPkFields = JSON.parse(parentPk.keyPath);
+                    const rootPkFieldName = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
+                    const accessChain = buildAccessChain(remainingPath, rootPkFieldName, parentModel, allModels);
+                    if (!relationField.isRequired) {
+                        emitOptionalFkGuard(writer, "      ", foreignKeyFields, model.name);
+                    }
+                    writer.writeLine(`      const parentRecord = await tx.${parentModelLower}.findUnique({`);
+                    if (parentPkFields.length === 1) {
+                        writer.writeLine(`        where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+                    }
+                    else {
+                        const compositeKey = parentPkFields.map((field, i) => `${field}: data.${foreignKeyFields[i]}`).join(", ");
+                        writer.writeLine(`        where: { ${parentPk.name}: { ${compositeKey} } },`);
+                    }
+                    writer.writeLine(`        select: ${parentSelectObj},`);
+                    writer.writeLine(`      });`);
+                    writer.blankLine();
+                    writer.writeLine(`      if (!parentRecord || parentRecord${accessChain} !== scopeKey) {`);
+                    writer.writeLine(`        throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Unauthorized: ${model.name} parent is not owned by authenticated scope\`);`);
+                    writer.writeLine(`      }`);
                 }
                 else {
-                    const compositeKey = parentPkFields.map((field, i) => `${field}: data.${foreignKeyFields[i]}`).join(", ");
-                    writer.writeLine(`        where: { ${parentPk.name}: { ${compositeKey} } },`);
+                    const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
+                    const parentPkFields = JSON.parse(parentPk.keyPath);
+                    const parentPkFieldName = (0, utils_1.getUniqueIdentifiers)(parentModel)[0].name;
+                    if (!relationField.isRequired) {
+                        emitOptionalFkGuard(writer, "      ", foreignKeyFields, model.name);
+                    }
+                    writer.writeLine(`      const parentRecord = await tx.${parentModelLower}.findUnique({`);
+                    if (parentPkFields.length === 1) {
+                        writer.writeLine(`        where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+                    }
+                    else {
+                        const compositeKey = parentPkFields.map((field, i) => `${field}: data.${foreignKeyFields[i]}`).join(", ");
+                        writer.writeLine(`        where: { ${parentPk.name}: { ${compositeKey} } },`);
+                    }
+                    writer.writeLine(`        select: { ${parentPkFieldName}: true },`);
+                    writer.writeLine(`      });`);
+                    writer.blankLine();
+                    writer.writeLine(`      if (!parentRecord || parentRecord.${parentPkFieldName} !== scopeKey) {`);
+                    writer.writeLine(`        throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Unauthorized: ${model.name} parent is not owned by authenticated scope\`);`);
+                    writer.writeLine(`      }`);
                 }
-                writer.writeLine(`        select: { ${parentPkFieldName}: true },`);
-                writer.writeLine(`      });`);
-                writer.blankLine();
-                writer.writeLine(`      if (!parentRecord || parentRecord.${parentPkFieldName} !== scopeKey) {`);
-                writer.writeLine(`        throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Unauthorized: ${model.name} parent is not owned by authenticated scope\`);`);
-                writer.writeLine(`      }`);
             }
             writer.blankLine();
         }
@@ -422,7 +446,7 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
             writer.writeLine(`      }`);
         }
         else {
-            const selectObj = buildSelectObject(authPath, rootModel);
+            const selectObj = buildMultiPathSelectObject(allAuthPaths, rootModel);
             if (pkFields.length === 1) {
                 writer.writeLine(`      const record = await tx.${modelNameLower}.findUnique({`);
                 writer.writeLine(`        where: { ${pkFields[0]}: validKeyPath[0] },`);
@@ -440,11 +464,14 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
             writer.writeLine(`      if (record) {`);
             writer.writeLine(`        // Case A: Record exists - verify ownership from DB`);
             const rootPkFieldName = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
-            const accessChain = buildAccessChain(authPath, rootPkFieldName, model, allModels);
-            writer.writeLine(`        if (record${accessChain} !== scopeKey) {`);
+            const ownershipCondition = buildMultiPathOwnershipCondition(allAuthPaths, rootPkFieldName, model, allModels);
+            writer.writeLine(`        if (${ownershipCondition}) {`);
             writer.writeLine(`          throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Unauthorized: ${model.name} is not owned by the authenticated scope\`);`);
             writer.writeLine(`        }`);
-            if (authPath.length > 0) {
+            if (hasMultiplePaths) {
+                emitMultiPathPayloadOwnershipCheck(writer, "        ", allAuthPaths, model, allModels, rootModel, `Cannot reassign ${model.name} to parent outside scope`);
+            }
+            else if (authPath.length > 0) {
                 const firstRelationFieldName = authPath[0];
                 const relationField = model.fields.find((f) => f.name === firstRelationFieldName);
                 if (relationField && relationField.relationFromFields && relationField.relationFromFields.length > 0) {
@@ -489,42 +516,49 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
             }
             writer.writeLine(`      } else {`);
             writer.writeLine(`        // Case B: Record doesn't exist (resurrection) - verify ownership from payload`);
-            const firstRelationFieldName = authPath[0];
-            const relationField = model.fields.find((f) => f.name === firstRelationFieldName);
-            if (relationField && relationField.relationFromFields && relationField.relationFromFields.length > 0) {
-                const foreignKeyFields = relationField.relationFromFields;
-                const parentModel = allModels.find((m) => m.name === relationField.type);
-                if (parentModel) {
-                    const parentModelLower = parentModel.name.charAt(0).toLowerCase() + parentModel.name.slice(1);
-                    const remainingPath = authPath.slice(1);
-                    if (remainingPath.length > 0) {
-                        const parentSelectObj = buildSelectObject(remainingPath, rootModel);
-                        const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
-                        const parentPkFields = JSON.parse(parentPk.keyPath);
-                        const rootPkFieldName2 = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
-                        const accessChainRemaining = buildAccessChain(remainingPath, rootPkFieldName2, parentModel, allModels);
-                        if (!relationField.isRequired) {
-                            emitOptionalFkGuard(writer, "        ", foreignKeyFields, model.name);
-                        }
-                        writer.writeLine(`        const parent = await tx.${parentModelLower}.findUnique({`);
-                        if (parentPkFields.length === 1) {
-                            writer.writeLine(`          where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+            if (hasMultiplePaths) {
+                emitMultiPathPayloadOwnershipCheck(writer, "        ", allAuthPaths, model, allModels, rootModel, `Cannot resurrect ${model.name} into unauthorized scope`);
+            }
+            else {
+                const firstRelationFieldName = authPath[0];
+                const relationField = model.fields.find((f) => f.name === firstRelationFieldName);
+                if (relationField && relationField.relationFromFields && relationField.relationFromFields.length > 0) {
+                    const foreignKeyFields = relationField.relationFromFields;
+                    const parentModel = allModels.find((m) => m.name === relationField.type);
+                    if (parentModel) {
+                        const parentModelLower = parentModel.name.charAt(0).toLowerCase() + parentModel.name.slice(1);
+                        const remainingPath = authPath.slice(1);
+                        if (remainingPath.length > 0) {
+                            const parentSelectObj = buildSelectObject(remainingPath, rootModel);
+                            const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
+                            const parentPkFields = JSON.parse(parentPk.keyPath);
+                            const rootPkFieldName2 = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
+                            const accessChainRemaining = buildAccessChain(remainingPath, rootPkFieldName2, parentModel, allModels);
+                            if (!relationField.isRequired) {
+                                emitOptionalFkGuard(writer, "        ", foreignKeyFields, model.name);
+                            }
+                            writer.writeLine(`        const parent = await tx.${parentModelLower}.findUnique({`);
+                            if (parentPkFields.length === 1) {
+                                writer.writeLine(`          where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+                            }
+                            else {
+                                const compositeKey = parentPkFields
+                                    .map((field, i) => `${field}: data.${foreignKeyFields[i]}`)
+                                    .join(", ");
+                                writer.writeLine(`          where: { ${parentPk.name}: { ${compositeKey} } },`);
+                            }
+                            writer.writeLine(`          select: ${parentSelectObj},`);
+                            writer.writeLine(`        });`);
+                            writer.blankLine();
+                            writer.writeLine(`        if (!parent || parent${accessChainRemaining} !== scopeKey) {`);
+                            writer.writeLine(`          throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Cannot resurrect ${model.name} into unauthorized scope\`);`);
+                            writer.writeLine(`        }`);
                         }
                         else {
-                            const compositeKey = parentPkFields.map((field, i) => `${field}: data.${foreignKeyFields[i]}`).join(", ");
-                            writer.writeLine(`          where: { ${parentPk.name}: { ${compositeKey} } },`);
+                            writer.writeLine(`        if (data.${foreignKeyFields[0]} !== scopeKey) {`);
+                            writer.writeLine(`          throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Cannot resurrect ${model.name} into different ${parentModel.name}\`);`);
+                            writer.writeLine(`        }`);
                         }
-                        writer.writeLine(`          select: ${parentSelectObj},`);
-                        writer.writeLine(`        });`);
-                        writer.blankLine();
-                        writer.writeLine(`        if (!parent || parent${accessChainRemaining} !== scopeKey) {`);
-                        writer.writeLine(`          throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Cannot resurrect ${model.name} into unauthorized scope\`);`);
-                        writer.writeLine(`        }`);
-                    }
-                    else {
-                        writer.writeLine(`        if (data.${foreignKeyFields[0]} !== scopeKey) {`);
-                        writer.writeLine(`          throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Cannot resurrect ${model.name} into different ${parentModel.name}\`);`);
-                        writer.writeLine(`        }`);
                     }
                 }
             }
@@ -565,7 +599,7 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
             writer.writeLine(`      }`);
         }
         else {
-            const selectObj = buildSelectObject(authPath, rootModel);
+            const selectObj = buildMultiPathSelectObject(allAuthPaths, rootModel);
             if (pkFields.length === 1) {
                 writer.writeLine(`      const record = await tx.${modelNameLower}.findUnique({`);
                 writer.writeLine(`        where: { ${pkFields[0]}: validKeyPath[0] },`);
@@ -582,8 +616,8 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
             writer.blankLine();
             writer.writeLine(`      if (record) {`);
             const rootPkFieldName = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
-            const accessChain = buildAccessChain(authPath, rootPkFieldName, model, allModels);
-            writer.writeLine(`        if (record${accessChain} !== scopeKey) {`);
+            const ownershipCondition = buildMultiPathOwnershipCondition(allAuthPaths, rootPkFieldName, model, allModels);
+            writer.writeLine(`        if (${ownershipCondition}) {`);
             writer.writeLine(`          throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Unauthorized: ${model.name} is not owned by the authenticated scope\`);`);
             writer.writeLine(`        }`);
             writer.writeLine(`      }`);
@@ -612,16 +646,6 @@ function generateModelSyncHandler(writer, model, allModels, rootModel, dag) {
     });
     writer.blankLine();
 }
-function buildFlatWhereClause(pkName, pkFields, authPath, rootModel) {
-    const whereWithScope = buildWhereWithScopeCondition(authPath, rootModel);
-    if (pkFields.length === 1) {
-        return `{ ${pkFields[0]}: validKeyPath[0], ${whereWithScope} }`;
-    }
-    else {
-        const compositePkFields = pkFields.map((field, i) => `${field}: validKeyPath[${i}]`).join(", ");
-        return `{ ${compositePkFields}, ${whereWithScope} }`;
-    }
-}
 function buildSelectObject(authPath, rootModel) {
     if (authPath.length === 0)
         return "{}";
@@ -679,6 +703,151 @@ function emitOptionalFkGuard(writer, indent, foreignKeyFields, modelName) {
     writer.writeLine(`${indent}  throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`Unauthorized: ${modelName} has null foreign key(s) in ownership path\`);`);
     writer.writeLine(`${indent}}`);
 }
+function buildMultiPathSelectObject(allPaths, rootModel) {
+    if (allPaths.length === 0)
+        return "{}";
+    if (allPaths.length === 1)
+        return buildSelectObject(allPaths[0], rootModel);
+    const rootPkFieldName = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
+    function mergePathIntoTree(tree, path) {
+        if (path.length === 0)
+            return;
+        const [first, ...rest] = path;
+        if (rest.length === 0) {
+            if (!tree[first] || typeof tree[first] === "boolean") {
+                tree[first] = { [rootPkFieldName]: true };
+            }
+            else {
+                tree[first][rootPkFieldName] = true;
+            }
+        }
+        else {
+            if (!tree[first] || typeof tree[first] === "boolean") {
+                tree[first] = {};
+            }
+            mergePathIntoTree(tree[first], rest);
+        }
+    }
+    function serializeTree(tree) {
+        const parts = [];
+        for (const [key, value] of Object.entries(tree)) {
+            if (typeof value === "boolean") {
+                parts.push(`${key}: true`);
+            }
+            else {
+                parts.push(`${key}: { select: ${serializeTree(value)} }`);
+            }
+        }
+        return `{ ${parts.join(", ")} }`;
+    }
+    const tree = {};
+    for (const path of allPaths) {
+        mergePathIntoTree(tree, path);
+    }
+    return serializeTree(tree);
+}
+function buildMultiPathOwnershipCondition(allPaths, rootPkFieldName, model, allModels, varName = "record") {
+    const chains = allPaths.map((path) => {
+        const accessChain = buildAccessChain(path, rootPkFieldName, model, allModels);
+        return `${varName}${accessChain} !== scopeKey`;
+    });
+    return chains.join(" && ");
+}
+function buildMultiPathFlatWhereClause(pkName, pkFields, allPaths, rootModel) {
+    let pkCondition;
+    if (pkFields.length === 1) {
+        pkCondition = `${pkFields[0]}: validKeyPath[0]`;
+    }
+    else {
+        pkCondition = pkFields.map((field, i) => `${field}: validKeyPath[${i}]`).join(", ");
+    }
+    if (allPaths.length === 1) {
+        return `{ ${pkCondition}, ${buildWhereWithScopeCondition(allPaths[0], rootModel)} }`;
+    }
+    const scopeConditions = allPaths.map((path) => {
+        const whereWithScope = buildWhereWithScopeCondition(path, rootModel);
+        return `{ ${whereWithScope} }`;
+    });
+    return `{ ${pkCondition}, OR: [${scopeConditions.join(", ")}] }`;
+}
+function emitMultiPathPayloadOwnershipCheck(writer, indent, allPaths, model, allModels, rootModel, errorMessage) {
+    writer.setIndentationLevel(indent);
+    writer.writeLine("let ownershipVerified = false;");
+    allPaths.forEach((path, pathIndex) => {
+        const firstRelationFieldName = path[0];
+        const relationField = model.fields.find((f) => f.name === firstRelationFieldName);
+        if (!relationField || !relationField.relationFromFields?.length)
+            return;
+        const foreignKeyFields = relationField.relationFromFields;
+        const parentModel = allModels.find((m) => m.name === relationField.type);
+        if (!parentModel)
+            return;
+        const parentModelLower = parentModel.name.charAt(0).toLowerCase() + parentModel.name.slice(1);
+        const remainingPath = path.slice(1);
+        const varName = `p${pathIndex}`;
+        const emitLookupAndCheck = () => {
+            if (remainingPath.length > 0) {
+                const parentSelectObj = buildSelectObject(remainingPath, rootModel);
+                const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
+                const parentPkFields = JSON.parse(parentPk.keyPath);
+                const rootPkFieldName = (0, utils_1.getUniqueIdentifiers)(rootModel)[0].name;
+                const accessChain = buildAccessChain(remainingPath, rootPkFieldName, parentModel, allModels);
+                writer.writeLine(`const ${varName} = await tx.${parentModelLower}.findUnique({`);
+                writer.indent(() => {
+                    if (parentPkFields.length === 1) {
+                        writer.writeLine(`where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+                    }
+                    else {
+                        const compositeKey = parentPkFields.map((field, i) => `${field}: data.${foreignKeyFields[i]}`).join(", ");
+                        writer.writeLine(`where: { ${parentPk.name}: { ${compositeKey} } },`);
+                    }
+                    writer.writeLine(`select: ${parentSelectObj},`);
+                });
+                writer.writeLine("});");
+                writer.write(`if (!${varName} || ${varName}${accessChain} !== scopeKey) `).block(() => {
+                    writer.writeLine(`throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`${errorMessage}\`);`);
+                });
+                writer.writeLine("ownershipVerified = true;");
+            }
+            else {
+                const parentPk = (0, utils_1.getUniqueIdentifiers)(parentModel)[0];
+                const parentPkFields = JSON.parse(parentPk.keyPath);
+                const parentPkFieldName = (0, utils_1.getUniqueIdentifiers)(parentModel)[0].name;
+                writer.writeLine(`const ${varName} = await tx.${parentModelLower}.findUnique({`);
+                writer.indent(() => {
+                    if (parentPkFields.length === 1) {
+                        writer.writeLine(`where: { ${parentPkFields[0]}: data.${foreignKeyFields[0]} },`);
+                    }
+                    else {
+                        const compositeKey = parentPkFields.map((field, i) => `${field}: data.${foreignKeyFields[i]}`).join(", ");
+                        writer.writeLine(`where: { ${parentPk.name}: { ${compositeKey} } },`);
+                    }
+                    writer.writeLine(`select: { ${parentPkFieldName}: true },`);
+                });
+                writer.writeLine("});");
+                writer.write(`if (!${varName} || ${varName}.${parentPkFieldName} !== scopeKey) `).block(() => {
+                    writer.writeLine(`throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`${errorMessage}\`);`);
+                });
+                writer.writeLine("ownershipVerified = true;");
+            }
+        };
+        if (!relationField.isRequired) {
+            const nullCheck = foreignKeyFields.length === 1
+                ? `data.${foreignKeyFields[0]} !== null`
+                : foreignKeyFields.map((f) => `data.${f} !== null`).join(" && ");
+            writer.write(`if (${nullCheck}) `).block(() => {
+                emitLookupAndCheck();
+            });
+        }
+        else {
+            emitLookupAndCheck();
+        }
+    });
+    writer.write("if (!ownershipVerified) ").block(() => {
+        writer.writeLine(`throw new PermanentSyncError("${exports.pushErrorTypes.SCOPE_VIOLATION}", \`${errorMessage}\`);`);
+    });
+    writer.setIndentationLevel(0);
+}
 function generateWhereClause(pkName, pkFields) {
     if (pkFields.length === 1) {
         return `{ ${pkFields[0]}: validKeyPath[0] }`;