@vertz/compiler 0.2.14 → 0.2.16

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 type DiagnosticSeverity = "error" | "warning" | "info";
-type DiagnosticCode = "VERTZ_SCHEMA_NAMING" | "VERTZ_SCHEMA_PLACEMENT" | "VERTZ_SCHEMA_EXECUTION" | "VERTZ_SCHEMA_MISSING_ID" | "VERTZ_SCHEMA_DYNAMIC_NAME" | "VERTZ_MODULE_CIRCULAR" | "VERTZ_MODULE_EXPORT_INVALID" | "VERTZ_MODULE_IMPORT_MISSING" | "VERTZ_MODULE_DUPLICATE_NAME" | "VERTZ_MODULE_DYNAMIC_NAME" | "VERTZ_MODULE_OPTIONS_INVALID" | "VERTZ_MODULE_WRONG_OWNERSHIP" | "VERTZ_SERVICE_INJECT_MISSING" | "VERTZ_SERVICE_UNUSED" | "VERTZ_SERVICE_DYNAMIC_NAME" | "VERTZ_ENV_MISSING_DEFAULT" | "VERTZ_ENV_DUPLICATE" | "VERTZ_ENV_DYNAMIC_CONFIG" | "VERTZ_MW_MISSING_NAME" | "VERTZ_MW_MISSING_HANDLER" | "VERTZ_MW_DYNAMIC_NAME" | "VERTZ_MW_NON_OBJECT_CONFIG" | "VERTZ_MW_REQUIRES_UNSATISFIED" | "VERTZ_MW_PROVIDES_COLLISION" | "VERTZ_MW_ORDER_INVALID" | "VERTZ_RT_UNKNOWN_MODULE_DEF" | "VERTZ_RT_DYNAMIC_PATH" | "VERTZ_RT_MISSING_HANDLER" | "VERTZ_RT_MISSING_PREFIX" | "VERTZ_RT_DYNAMIC_CONFIG" | "VERTZ_RT_INVALID_PATH" | "VERTZ_ROUTE_DUPLICATE" | "VERTZ_ROUTE_PARAM_MISMATCH" | "VERTZ_ROUTE_MISSING_RESPONSE" | "VERTZ_APP_MISSING" | "VERTZ_APP_NOT_FOUND" | "VERTZ_APP_DUPLICATE" | "VERTZ_APP_BASEPATH_FORMAT" | "VERTZ_APP_INLINE_MODULE" | "VERTZ_DEP_CYCLE" | "VERTZ_DEP_CIRCULAR" | "VERTZ_DEP_UNRESOLVED_INJECT" | "VERTZ_DEP_INIT_ORDER" | "VERTZ_CTX_COLLISION" | "VERTZ_DEAD_CODE" | "ENTITY_MISSING_ARGS" | "ENTITY_NON_LITERAL_NAME" | "ENTITY_INVALID_NAME" | "ENTITY_DUPLICATE_NAME" | "ENTITY_CONFIG_NOT_OBJECT" | "ENTITY_MISSING_MODEL" | "ENTITY_MODEL_UNRESOLVABLE" | "ENTITY_ACTION_NAME_COLLISION" | "ENTITY_ACTION_MISSING_SCHEMA" | "ENTITY_ACTION_INVALID_METHOD" | "ENTITY_UNKNOWN_ACCESS_OP" | "ENTITY_UNRESOLVED_IMPORT" | "ENTITY_ROUTE_COLLISION" | "ENTITY_NO_ROUTES" | "ENTITY_MODEL_NOT_REGISTERED";
+type DiagnosticCode = "VERTZ_SCHEMA_NAMING" | "VERTZ_SCHEMA_PLACEMENT" | "VERTZ_SCHEMA_EXECUTION" | "VERTZ_SCHEMA_MISSING_ID" | "VERTZ_SCHEMA_DYNAMIC_NAME" | "VERTZ_MODULE_CIRCULAR" | "VERTZ_MODULE_EXPORT_INVALID" | "VERTZ_MODULE_IMPORT_MISSING" | "VERTZ_MODULE_DUPLICATE_NAME" | "VERTZ_MODULE_DYNAMIC_NAME" | "VERTZ_MODULE_OPTIONS_INVALID" | "VERTZ_MODULE_WRONG_OWNERSHIP" | "VERTZ_SERVICE_INJECT_MISSING" | "VERTZ_SERVICE_UNUSED" | "VERTZ_SERVICE_DYNAMIC_NAME" | "VERTZ_ENV_MISSING_DEFAULT" | "VERTZ_ENV_DUPLICATE" | "VERTZ_ENV_DYNAMIC_CONFIG" | "VERTZ_MW_MISSING_NAME" | "VERTZ_MW_MISSING_HANDLER" | "VERTZ_MW_DYNAMIC_NAME" | "VERTZ_MW_NON_OBJECT_CONFIG" | "VERTZ_MW_REQUIRES_UNSATISFIED" | "VERTZ_MW_PROVIDES_COLLISION" | "VERTZ_MW_ORDER_INVALID" | "VERTZ_RT_UNKNOWN_MODULE_DEF" | "VERTZ_RT_DYNAMIC_PATH" | "VERTZ_RT_MISSING_HANDLER" | "VERTZ_RT_MISSING_PREFIX" | "VERTZ_RT_DYNAMIC_CONFIG" | "VERTZ_RT_INVALID_PATH" | "VERTZ_ROUTE_DUPLICATE" | "VERTZ_ROUTE_PARAM_MISMATCH" | "VERTZ_ROUTE_MISSING_RESPONSE" | "VERTZ_APP_MISSING" | "VERTZ_APP_NOT_FOUND" | "VERTZ_APP_DUPLICATE" | "VERTZ_APP_BASEPATH_FORMAT" | "VERTZ_APP_INLINE_MODULE" | "VERTZ_DEP_CYCLE" | "VERTZ_DEP_CIRCULAR" | "VERTZ_DEP_UNRESOLVED_INJECT" | "VERTZ_DEP_INIT_ORDER" | "VERTZ_CTX_COLLISION" | "VERTZ_DEAD_CODE" | "ENTITY_MISSING_ARGS" | "ENTITY_NON_LITERAL_NAME" | "ENTITY_INVALID_NAME" | "ENTITY_DUPLICATE_NAME" | "ENTITY_CONFIG_NOT_OBJECT" | "ENTITY_MISSING_MODEL" | "ENTITY_MODEL_UNRESOLVABLE" | "ENTITY_ACTION_NAME_COLLISION" | "ENTITY_ACTION_MISSING_SCHEMA" | "ENTITY_ACTION_INVALID_METHOD" | "ENTITY_UNKNOWN_ACCESS_OP" | "ENTITY_UNRESOLVED_IMPORT" | "ENTITY_ROUTE_COLLISION" | "ENTITY_NO_ROUTES" | "ENTITY_MODEL_NOT_REGISTERED" | "ACCESS_MULTIPLE_DEFINITIONS" | "ACCESS_NON_LITERAL_KEY" | "ACCESS_NON_LITERAL_ROLE" | "ACCESS_DUPLICATE_ENTITLEMENT" | "ACCESS_WHERE_NOT_TRANSLATABLE";
 interface SourceContext {
 	lines: {
 		number: number;
@@ -39,9 +39,32 @@ interface AppIR {
 	schemas: SchemaIR[];
 	entities: EntityIR[];
 	databases: DatabaseIR[];
+	access?: AccessIR;
 	dependencyGraph: DependencyGraphIR;
 	diagnostics: Diagnostic[];
 }
+interface AccessIR extends SourceLocation {
+	entities: AccessEntityIR[];
+	entitlements: string[];
+	whereClauses: AccessWhereClauseIR[];
+}
+interface AccessEntityIR {
+	name: string;
+	roles: string[];
+}
+interface AccessWhereClauseIR {
+	entitlement: string;
+	conditions: AccessWhereCondition[];
+}
+type AccessWhereCondition = {
+	kind: "marker";
+	column: string;
+	marker: "user.id" | "user.tenantId";
+} | {
+	kind: "literal";
+	column: string;
+	value: string | number | boolean;
+};
 interface AppDefinition extends SourceLocation {
 	basePath: string;
 	version?: string;
@@ -174,12 +197,16 @@ interface EntityIR extends SourceLocation {
 	hooks: EntityHooksIR;
 	actions: EntityActionIR[];
 	relations: EntityRelationIR[];
+	tenantScoped?: boolean;
+	table?: string;
 }
 interface EntityModelRef {
 	variableName: string;
 	importSource?: string;
 	tableName?: string;
 	schemaRefs: EntityModelSchemaRefs;
+	primaryKey?: string;
+	hiddenFields?: string[];
 }
 interface EntityModelSchemaRefs {
 	response?: SchemaRef;
@@ -215,6 +242,9 @@ interface EntityRelationIR {
 	type?: "one" | "many";
 	entity?: string;
 	selection: "all" | string[];
+	allowWhere?: string[];
+	allowOrderBy?: string[];
+	maxLimit?: number;
 }
 interface ModuleDefContext {
 	moduleDefVariables: Map<string, string>;
@@ -287,6 +317,21 @@ declare abstract class BaseAnalyzer<T> implements Analyzer<T> {
 	protected addDiagnostic(diagnostic: Diagnostic): void;
 	getDiagnostics(): Diagnostic[];
 }
+interface AccessAnalyzerResult {
+	access?: AccessIR;
+}
+declare class AccessAnalyzer extends BaseAnalyzer<AccessAnalyzerResult> {
+	analyze(): Promise<AccessAnalyzerResult>;
+	private findDefineAccessCalls;
+	private extractAccess;
+	private extractWhereClauses;
+	/** Find all .where() calls within a node — handles both r.where() and rules.where() */
+	private findWhereCalls;
+	/** Extract conditions from a where({ column: value }) call argument */
+	private extractWhereConditions;
+	/** Resolve a condition value to a marker or literal */
+	private extractConditionValue;
+}
 interface AppAnalyzerResult {
 	app: AppDefinition;
 }
@@ -379,6 +424,11 @@ declare class EntityAnalyzer extends BaseAnalyzer<EntityAnalyzerResult> {
 	private resolveSchemaFromExpression;
 	private extractRelations;
 	/**
+	* Extract primaryKey and hiddenFields from the model's table type.
+	* Navigates ModelDef.table._columns to inspect column metadata.
+	*/
+	private extractModelTableMetadata;
+	/**
 	* Resolve relation types from the model's TypeScript type.
 	* Navigates ModelDef.relations to extract _type ('one'/'many') for each relation.
 	*/
@@ -474,6 +524,7 @@ interface CompilerDependencies {
 		app: Analyzer<AppAnalyzerResult>;
 		entity: Analyzer<EntityAnalyzerResult>;
 		database: Analyzer<DatabaseAnalyzerResult>;
+		access: Analyzer<AccessAnalyzerResult>;
 		dependencyGraph: Analyzer<DependencyGraphResult>;
 	};
 	validators: Validator[];
@@ -860,4 +911,4 @@ declare class PlacementValidator implements Validator {
 	private checkFileLocation;
 	private checkMixedExports;
 }
-export { typecheckWatch, typecheck, resolveImportPath, resolveIdentifier, resolveExport, resolveConfig, renderSchemaRegistryFile, renderRouteTableFile, renderBootFile, parseWatchBlock, parseTscOutput, parseSchemaName2 as parseSchemaName, parseInjectRefs, parseImports, mergeIR, mergeDiagnostics, isSchemaFile, isSchemaExpression, isFromImport, injectEntityRoutes, hasErrors, getVariableNameForCall, getStringValue, getSourceLocation, getPropertyValue, getProperties, getNumberValue, getBooleanValue, getArrayElements, findMethodCallsOnVariable, findCallExpressions, findAffectedModules, filterBySeverity, extractSchemaId, extractObjectLiteral, extractMethodSignatures, extractIdentifierNames, detectRouteCollisions, defineConfig, createSchemaExecutor, createNamedSchemaRef, createInlineSchemaRef, createEmptyDependencyGraph, createEmptyAppIR, createDiagnosticFromLocation, createDiagnostic, createCompiler, categorizeChanges, buildSchemaRegistry, buildRouteTable, buildManifest, buildBootManifest, addDiagnosticsToIR, VertzConfig, Validator, ValidationConfig, ValidPart, ValidOperation, TypecheckWatchOptions, TypecheckResult, TypecheckOptions, TypecheckDiagnostic, SourceLocation, SourceContext, ServiceMethodParam, ServiceMethodIR, ServiceIR, ServiceAnalyzerResult, ServiceAnalyzer, SchemaRegistryManifest, SchemaRegistryGenerator, SchemaRegistryEntry, SchemaRef, SchemaNameParts, SchemaIR, SchemaExecutor, SchemaExecutionResult, SchemaConfig, SchemaAnalyzerResult, SchemaAnalyzer, RouterIR, RouteTableSchemas, RouteTableManifest, RouteTableGenerator, RouteTableEntry, RouteIR, RouteAnalyzerResult, RouteAnalyzer, ResolvedImport, ResolvedConfig, PlacementValidator, ParsedSchemaName, OpenAPITag, OpenAPIServer, OpenAPIResponse, OpenAPIRequestBody, OpenAPIPathItem, OpenAPIParameter, OpenAPIOperation, OpenAPIInfo, OpenAPIGenerator, OpenAPIDocument, OpenAPIConfig, NamingValidator, NamedSchemaRef, ModuleValidator, ModuleRegistration, ModuleIR, ModuleDefContext, ModuleAnalyzerResult, ModuleAnalyzer, MiddlewareRef, MiddlewareIR, MiddlewareAnalyzerResult, MiddlewareAnalyzer, ManifestRoute, ManifestModule, ManifestMiddleware, ManifestGenerator, ManifestDiagnostic, ManifestDependencyEdge, JSONSchemaObject, InlineSchemaRef, InjectRef, IncrementalResult, IncrementalCompiler, ImportRef, HttpMethod, Generator, FileChange, FileCategory, EnvVariableIR, EnvIR, EnvAnalyzerResult, EnvAnalyzer, EntityRelationIR, EntityModelSchemaRefs, EntityModelRef, EntityIR, EntityHooksIR, EntityAnalyzerResult, EntityAnalyzer, EntityActionIR, EntityAccessRuleKind, EntityAccessIR, DiagnosticSeverity, DiagnosticCode, Diagnostic, DependencyNodeKind, DependencyNode, DependencyGraphResult, DependencyGraphInput, DependencyGraphIR, DependencyGraphAnalyzer, DependencyEdgeKind, DependencyEdge, DatabaseIR, DatabaseAnalyzerResult, DatabaseAnalyzer, CreateDiagnosticOptions, CompletenessValidator, CompilerDependencies, CompilerConfig, Compiler, CompileResult, CategorizedChanges, CategorizeOptions, BootModuleEntry, BootMiddlewareEntry, BootManifest, BootGenerator, BaseGenerator, BaseAnalyzer, AppManifest, AppIR, AppDefinition, AppAnalyzerResult, AppAnalyzer, Analyzer };
+export { typecheckWatch, typecheck, resolveImportPath, resolveIdentifier, resolveExport, resolveConfig, renderSchemaRegistryFile, renderRouteTableFile, renderBootFile, parseWatchBlock, parseTscOutput, parseSchemaName2 as parseSchemaName, parseInjectRefs, parseImports, mergeIR, mergeDiagnostics, isSchemaFile, isSchemaExpression, isFromImport, injectEntityRoutes, hasErrors, getVariableNameForCall, getStringValue, getSourceLocation, getPropertyValue, getProperties, getNumberValue, getBooleanValue, getArrayElements, findMethodCallsOnVariable, findCallExpressions, findAffectedModules, filterBySeverity, extractSchemaId, extractObjectLiteral, extractMethodSignatures, extractIdentifierNames, detectRouteCollisions, defineConfig, createSchemaExecutor, createNamedSchemaRef, createInlineSchemaRef, createEmptyDependencyGraph, createEmptyAppIR, createDiagnosticFromLocation, createDiagnostic, createCompiler, categorizeChanges, buildSchemaRegistry, buildRouteTable, buildManifest, buildBootManifest, addDiagnosticsToIR, VertzConfig, Validator, ValidationConfig, ValidPart, ValidOperation, TypecheckWatchOptions, TypecheckResult, TypecheckOptions, TypecheckDiagnostic, SourceLocation, SourceContext, ServiceMethodParam, ServiceMethodIR, ServiceIR, ServiceAnalyzerResult, ServiceAnalyzer, SchemaRegistryManifest, SchemaRegistryGenerator, SchemaRegistryEntry, SchemaRef, SchemaNameParts, SchemaIR, SchemaExecutor, SchemaExecutionResult, SchemaConfig, SchemaAnalyzerResult, SchemaAnalyzer, RouterIR, RouteTableSchemas, RouteTableManifest, RouteTableGenerator, RouteTableEntry, RouteIR, RouteAnalyzerResult, RouteAnalyzer, ResolvedImport, ResolvedConfig, PlacementValidator, ParsedSchemaName, OpenAPITag, OpenAPIServer, OpenAPIResponse, OpenAPIRequestBody, OpenAPIPathItem, OpenAPIParameter, OpenAPIOperation, OpenAPIInfo, OpenAPIGenerator, OpenAPIDocument, OpenAPIConfig, NamingValidator, NamedSchemaRef, ModuleValidator, ModuleRegistration, ModuleIR, ModuleDefContext, ModuleAnalyzerResult, ModuleAnalyzer, MiddlewareRef, MiddlewareIR, MiddlewareAnalyzerResult, MiddlewareAnalyzer, ManifestRoute, ManifestModule, ManifestMiddleware, ManifestGenerator, ManifestDiagnostic, ManifestDependencyEdge, JSONSchemaObject, InlineSchemaRef, InjectRef, IncrementalResult, IncrementalCompiler, ImportRef, HttpMethod, Generator, FileChange, FileCategory, EnvVariableIR, EnvIR, EnvAnalyzerResult, EnvAnalyzer, EntityRelationIR, EntityModelSchemaRefs, EntityModelRef, EntityIR, EntityHooksIR, EntityAnalyzerResult, EntityAnalyzer, EntityActionIR, EntityAccessRuleKind, EntityAccessIR, DiagnosticSeverity, DiagnosticCode, Diagnostic, DependencyNodeKind, DependencyNode, DependencyGraphResult, DependencyGraphInput, DependencyGraphIR, DependencyGraphAnalyzer, DependencyEdgeKind, DependencyEdge, DatabaseIR, DatabaseAnalyzerResult, DatabaseAnalyzer, CreateDiagnosticOptions, CompletenessValidator, CompilerDependencies, CompilerConfig, Compiler, CompileResult, CategorizedChanges, CategorizeOptions, BootModuleEntry, BootMiddlewareEntry, BootManifest, BootGenerator, BaseGenerator, BaseAnalyzer, AppManifest, AppIR, AppDefinition, AppAnalyzerResult, AppAnalyzer, Analyzer, AccessWhereCondition, AccessWhereClauseIR, AccessIR, AccessEntityIR, AccessAnalyzerResult, AccessAnalyzer };

package/dist/index.js

@@ -1,28 +1,6 @@
-// src/analyzers/app-analyzer.ts
+// src/analyzers/access-analyzer.ts
 import { SyntaxKind as SyntaxKind2 } from "ts-morph";
 
-// src/errors.ts
-function createDiagnostic(options) {
-  return { ...options };
-}
-function createDiagnosticFromLocation(location, options) {
-  return {
-    ...options,
-    file: location.sourceFile,
-    line: location.sourceLine,
-    column: location.sourceColumn
-  };
-}
-function hasErrors(diagnostics) {
-  return diagnostics.some((d) => d.severity === "error");
-}
-function filterBySeverity(diagnostics, severity) {
-  return diagnostics.filter((d) => d.severity === severity);
-}
-function mergeDiagnostics(a, b) {
-  return [...a, ...b];
-}
-
 // src/utils/ast-helpers.ts
 import {
   SyntaxKind
@@ -210,6 +188,254 @@ class BaseAnalyzer {
   }
 }
 
+// src/analyzers/access-analyzer.ts
+class AccessAnalyzer extends BaseAnalyzer {
+  async analyze() {
+    const files = this.project.getSourceFiles();
+    const calls = [];
+    for (const file of files) {
+      const found = this.findDefineAccessCalls(file);
+      for (const call2 of found) {
+        calls.push({ call: call2, file });
+      }
+    }
+    if (calls.length === 0) {
+      return { access: undefined };
+    }
+    if (calls.length > 1) {
+      for (const { call: call2 } of calls.slice(1)) {
+        this.addDiagnostic({
+          code: "ACCESS_MULTIPLE_DEFINITIONS",
+          severity: "error",
+          message: "Only one defineAccess() call is allowed per application",
+          ...getSourceLocation(call2)
+        });
+      }
+    }
+    const first = calls[0];
+    if (!first)
+      return { access: undefined };
+    const { call } = first;
+    const access = this.extractAccess(call);
+    return { access };
+  }
+  findDefineAccessCalls(file) {
+    const validCalls = [];
+    for (const call of file.getDescendantsOfKind(SyntaxKind2.CallExpression)) {
+      const expr = call.getExpression();
+      if (expr.isKind(SyntaxKind2.Identifier)) {
+        if (isFromImport(expr, "@vertz/server")) {
+          const name = expr.getText();
+          const sourceFile = expr.getSourceFile();
+          const importDecls = sourceFile.getImportDeclarations();
+          for (const decl of importDecls) {
+            if (decl.getModuleSpecifierValue() !== "@vertz/server")
+              continue;
+            for (const specifier of decl.getNamedImports()) {
+              const importedName = specifier.getName();
+              const alias = specifier.getAliasNode()?.getText();
+              if (importedName === "defineAccess" && (alias === name || !alias && importedName === name)) {
+                validCalls.push(call);
+              }
+            }
+          }
+        }
+        continue;
+      }
+      if (expr.isKind(SyntaxKind2.PropertyAccessExpression)) {
+        const propName = expr.getName();
+        if (propName !== "defineAccess")
+          continue;
+        const obj = expr.getExpression();
+        if (!obj.isKind(SyntaxKind2.Identifier))
+          continue;
+        const sourceFile = obj.getSourceFile();
+        const importDecl = sourceFile.getImportDeclarations().find((d) => d.getModuleSpecifierValue() === "@vertz/server" && d.getNamespaceImport()?.getText() === obj.getText());
+        if (importDecl) {
+          validCalls.push(call);
+        }
+      }
+    }
+    return validCalls;
+  }
+  extractAccess(call) {
+    const configObj = extractObjectLiteral(call, 0);
+    if (!configObj)
+      return;
+    const loc = getSourceLocation(call);
+    const entities = [];
+    const entitiesExpr = getPropertyValue(configObj, "entities");
+    if (entitiesExpr?.isKind(SyntaxKind2.ObjectLiteralExpression)) {
+      for (const prop of getProperties(entitiesExpr)) {
+        const roles = [];
+        if (prop.value.isKind(SyntaxKind2.ObjectLiteralExpression)) {
+          const rolesExpr = getPropertyValue(prop.value, "roles");
+          if (rolesExpr) {
+            for (const el of getArrayElements(rolesExpr)) {
+              const role = getStringValue(el);
+              if (role !== null) {
+                roles.push(role);
+              } else {
+                this.addDiagnostic({
+                  code: "ACCESS_NON_LITERAL_ROLE",
+                  severity: "warning",
+                  message: `Role in entity "${prop.name}" must be a string literal`,
+                  ...getSourceLocation(el)
+                });
+              }
+            }
+          }
+        }
+        entities.push({ name: prop.name, roles });
+      }
+    }
+    const entitlements = [];
+    const seenEntitlements = new Set;
+    const entitlementsExpr = getPropertyValue(configObj, "entitlements");
+    if (entitlementsExpr?.isKind(SyntaxKind2.ObjectLiteralExpression)) {
+      for (const prop of entitlementsExpr.getProperties()) {
+        if (prop.isKind(SyntaxKind2.PropertyAssignment) || prop.isKind(SyntaxKind2.MethodDeclaration)) {
+          const name = prop.getName();
+          const cleanName = name.replace(/^['"]|['"]$/g, "");
+          if (seenEntitlements.has(cleanName)) {
+            this.addDiagnostic({
+              code: "ACCESS_DUPLICATE_ENTITLEMENT",
+              severity: "warning",
+              message: `Duplicate entitlement "${cleanName}" — only the first occurrence is used`,
+              ...getSourceLocation(prop)
+            });
+          } else {
+            seenEntitlements.add(cleanName);
+            entitlements.push(cleanName);
+          }
+        } else if (prop.isKind(SyntaxKind2.SpreadAssignment)) {
+          this.addDiagnostic({
+            code: "ACCESS_NON_LITERAL_KEY",
+            severity: "warning",
+            message: "Spread in entitlements object cannot be statically analyzed — these entitlements will not be type-checked",
+            ...getSourceLocation(prop)
+          });
+        }
+      }
+    }
+    const whereClauses = this.extractWhereClauses(configObj);
+    return {
+      entities,
+      entitlements,
+      whereClauses,
+      sourceFile: loc.sourceFile,
+      sourceLine: loc.sourceLine,
+      sourceColumn: loc.sourceColumn
+    };
+  }
+  extractWhereClauses(configObj) {
+    const clauses = [];
+    const entitlementsExpr = getPropertyValue(configObj, "entitlements");
+    if (!entitlementsExpr?.isKind(SyntaxKind2.ObjectLiteralExpression))
+      return clauses;
+    for (const prop of entitlementsExpr.getProperties()) {
+      if (!prop.isKind(SyntaxKind2.PropertyAssignment) && !prop.isKind(SyntaxKind2.MethodDeclaration)) {
+        continue;
+      }
+      const entName = prop.getName().replace(/^['"]|['"]$/g, "");
+      const whereCalls = this.findWhereCalls(prop);
+      const allConditions = [];
+      for (const whereCall of whereCalls) {
+        const conditions = this.extractWhereConditions(whereCall);
+        allConditions.push(...conditions);
+      }
+      if (allConditions.length > 0) {
+        clauses.push({ entitlement: entName, conditions: allConditions });
+      }
+    }
+    return clauses;
+  }
+  findWhereCalls(expr) {
+    const calls = [];
+    for (const call of expr.getDescendantsOfKind(SyntaxKind2.CallExpression)) {
+      const callExpr = call.getExpression();
+      if (callExpr.isKind(SyntaxKind2.PropertyAccessExpression) && callExpr.getName() === "where") {
+        calls.push(call);
+      }
+    }
+    return calls;
+  }
+  extractWhereConditions(call) {
+    const conditions = [];
+    const arg = call.getArguments()[0];
+    if (!arg?.isKind(SyntaxKind2.ObjectLiteralExpression))
+      return conditions;
+    for (const prop of arg.getProperties()) {
+      if (!prop.isKind(SyntaxKind2.PropertyAssignment))
+        continue;
+      const column = prop.getName().replace(/^['"]|['"]$/g, "");
+      const init = prop.getInitializer();
+      if (!init)
+        continue;
+      const condition = this.extractConditionValue(column, init);
+      if (condition) {
+        conditions.push(condition);
+      } else {
+        this.addDiagnostic({
+          code: "ACCESS_WHERE_NOT_TRANSLATABLE",
+          severity: "warning",
+          message: `Where condition for column "${column}" cannot be statically analyzed — no RLS policy will be generated`,
+          ...getSourceLocation(init)
+        });
+      }
+    }
+    return conditions;
+  }
+  extractConditionValue(column, expr) {
+    if (expr.isKind(SyntaxKind2.PropertyAccessExpression)) {
+      const text = expr.getText();
+      const markerMatch = text.match(/\.\buser\.(id|tenantId)$/);
+      if (markerMatch) {
+        const marker = `user.${markerMatch[1]}`;
+        return { kind: "marker", column, marker };
+      }
+    }
+    const strVal = getStringValue(expr);
+    if (strVal !== null) {
+      return { kind: "literal", column, value: strVal };
+    }
+    if (expr.isKind(SyntaxKind2.TrueKeyword)) {
+      return { kind: "literal", column, value: true };
+    }
+    if (expr.isKind(SyntaxKind2.FalseKeyword)) {
+      return { kind: "literal", column, value: false };
+    }
+    if (expr.isKind(SyntaxKind2.NumericLiteral)) {
+      return { kind: "literal", column, value: Number(expr.getText()) };
+    }
+    return;
+  }
+}
+// src/analyzers/app-analyzer.ts
+import { SyntaxKind as SyntaxKind3 } from "ts-morph";
+
+// src/errors.ts
+function createDiagnostic(options) {
+  return { ...options };
+}
+function createDiagnosticFromLocation(location, options) {
+  return {
+    ...options,
+    file: location.sourceFile,
+    line: location.sourceLine,
+    column: location.sourceColumn
+  };
+}
+function hasErrors(diagnostics) {
+  return diagnostics.some((d) => d.severity === "error");
+}
+function filterBySeverity(diagnostics, severity) {
+  return diagnostics.filter((d) => d.severity === severity);
+}
+function mergeDiagnostics(a, b) {
+  return [...a, ...b];
+}
+
 // src/analyzers/app-analyzer.ts
 class AppAnalyzer extends BaseAnalyzer {
   async analyze() {
@@ -278,13 +504,13 @@ class AppAnalyzer extends BaseAnalyzer {
   collectChainedCalls(appCall) {
     const results = [];
     let current = appCall;
-    while (current.getParent()?.isKind(SyntaxKind2.PropertyAccessExpression)) {
+    while (current.getParent()?.isKind(SyntaxKind3.PropertyAccessExpression)) {
       const propAccess = current.getParentOrThrow();
-      if (!propAccess.isKind(SyntaxKind2.PropertyAccessExpression))
+      if (!propAccess.isKind(SyntaxKind3.PropertyAccessExpression))
         break;
       const methodName = propAccess.getName();
       const parentCall = propAccess.getParent();
-      if (!parentCall?.isKind(SyntaxKind2.CallExpression))
+      if (!parentCall?.isKind(SyntaxKind3.CallExpression))
         break;
       results.push({ methodName, call: parentCall });
       current = parentCall;
@@ -301,7 +527,7 @@ class AppAnalyzer extends BaseAnalyzer {
         continue;
       const elements = getArrayElements(arrArg);
       for (const el of elements) {
-        if (el.isKind(SyntaxKind2.Identifier)) {
+        if (el.isKind(SyntaxKind3.Identifier)) {
           const resolved = resolveIdentifier(el, this.project);
           middleware.push({
             name: el.getText(),
@@ -321,7 +547,7 @@ class AppAnalyzer extends BaseAnalyzer {
       const moduleArg = args.at(0);
       if (!moduleArg)
         continue;
-      const moduleName = moduleArg.isKind(SyntaxKind2.Identifier) ? moduleArg.getText() : undefined;
+      const moduleName = moduleArg.isKind(SyntaxKind3.Identifier) ? moduleArg.getText() : undefined;
       if (!moduleName) {
         this.addDiagnostic(createDiagnosticFromLocation(getSourceLocation(call), {
           severity: "warning",
@@ -339,20 +565,20 @@ class AppAnalyzer extends BaseAnalyzer {
   extractOptions(obj) {
     const result = {};
     for (const prop of obj.getProperties()) {
-      if (!prop.isKind(SyntaxKind2.PropertyAssignment))
+      if (!prop.isKind(SyntaxKind3.PropertyAssignment))
         continue;
       const name = prop.getName();
       const init = prop.getInitializerOrThrow();
       const strValue = getStringValue(init);
       if (strValue !== null) {
         result[name] = strValue;
-      } else if (init.isKind(SyntaxKind2.TrueKeyword)) {
+      } else if (init.isKind(SyntaxKind3.TrueKeyword)) {
         result[name] = true;
-      } else if (init.isKind(SyntaxKind2.FalseKeyword)) {
+      } else if (init.isKind(SyntaxKind3.FalseKeyword)) {
         result[name] = false;
-      } else if (init.isKind(SyntaxKind2.NumericLiteral)) {
+      } else if (init.isKind(SyntaxKind3.NumericLiteral)) {
         result[name] = Number(init.getText());
-      } else if (init.isKind(SyntaxKind2.ObjectLiteralExpression)) {
+      } else if (init.isKind(SyntaxKind3.ObjectLiteralExpression)) {
         result[name] = this.extractOptions(init);
       }
     }
@@ -360,7 +586,7 @@ class AppAnalyzer extends BaseAnalyzer {
   }
 }
 // src/analyzers/database-analyzer.ts
-import { SyntaxKind as SyntaxKind3 } from "ts-morph";
+import { SyntaxKind as SyntaxKind4 } from "ts-morph";
 class DatabaseAnalyzer extends BaseAnalyzer {
   async analyze() {
     const databases = [];
@@ -376,20 +602,20 @@ class DatabaseAnalyzer extends BaseAnalyzer {
   }
   findCreateDbCalls(file) {
     const validCalls = [];
-    for (const call of file.getDescendantsOfKind(SyntaxKind3.CallExpression)) {
+    for (const call of file.getDescendantsOfKind(SyntaxKind4.CallExpression)) {
       const expr = call.getExpression();
-      if (expr.isKind(SyntaxKind3.Identifier)) {
+      if (expr.isKind(SyntaxKind4.Identifier)) {
         if (isFromImport(expr, "@vertz/db")) {
           validCalls.push(call);
         }
         continue;
       }
-      if (expr.isKind(SyntaxKind3.PropertyAccessExpression)) {
+      if (expr.isKind(SyntaxKind4.PropertyAccessExpression)) {
         const propName = expr.getName();
         if (propName !== "createDb")
           continue;
         const obj = expr.getExpression();
-        if (!obj.isKind(SyntaxKind3.Identifier))
+        if (!obj.isKind(SyntaxKind4.Identifier))
           continue;
         const sourceFile = obj.getSourceFile();
         const importDecl = sourceFile.getImportDeclarations().find((d) => d.getModuleSpecifierValue() === "@vertz/db" && d.getNamespaceImport()?.getText() === obj.getText());
@@ -415,14 +641,14 @@ class DatabaseAnalyzer extends BaseAnalyzer {
     return { modelKeys, ...loc };
   }
   resolveObjectLiteral(expr) {
-    if (expr.isKind(SyntaxKind3.ObjectLiteralExpression))
+    if (expr.isKind(SyntaxKind4.ObjectLiteralExpression))
       return expr;
-    if (expr.isKind(SyntaxKind3.Identifier)) {
+    if (expr.isKind(SyntaxKind4.Identifier)) {
       const defs = expr.getDefinitionNodes();
       for (const def of defs) {
-        if (def.isKind(SyntaxKind3.VariableDeclaration)) {
+        if (def.isKind(SyntaxKind4.VariableDeclaration)) {
           const init = def.getInitializer();
-          if (init?.isKind(SyntaxKind3.ObjectLiteralExpression))
+          if (init?.isKind(SyntaxKind4.ObjectLiteralExpression))
             return init;
         }
       }
@@ -432,8 +658,8 @@ class DatabaseAnalyzer extends BaseAnalyzer {
   extractModelKeys(obj, loc) {
     const keys = [];
     for (const prop of obj.getProperties()) {
-      if (prop.isKind(SyntaxKind3.PropertyAssignment)) {
-        if (prop.getNameNode().isKind(SyntaxKind3.ComputedPropertyName)) {
+      if (prop.isKind(SyntaxKind4.PropertyAssignment)) {
+        if (prop.getNameNode().isKind(SyntaxKind4.ComputedPropertyName)) {
           this.addDiagnostic({
             severity: "warning",
             code: "ENTITY_MODEL_NOT_REGISTERED",
@@ -443,9 +669,9 @@ class DatabaseAnalyzer extends BaseAnalyzer {
         } else {
           keys.push(prop.getName());
         }
-      } else if (prop.isKind(SyntaxKind3.ShorthandPropertyAssignment)) {
+      } else if (prop.isKind(SyntaxKind4.ShorthandPropertyAssignment)) {
         keys.push(prop.getName());
-      } else if (prop.isKind(SyntaxKind3.SpreadAssignment)) {
+      } else if (prop.isKind(SyntaxKind4.SpreadAssignment)) {
         this.addDiagnostic({
           severity: "warning",
           code: "ENTITY_MODEL_NOT_REGISTERED",
@@ -706,7 +932,7 @@ class DependencyGraphAnalyzer extends BaseAnalyzer {
   }
 }
 // src/analyzers/entity-analyzer.ts
-import { SyntaxKind as SyntaxKind4 } from "ts-morph";
+import { SyntaxKind as SyntaxKind5 } from "ts-morph";
 var ENTITY_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
 var CRUD_OPS = ["list", "get", "create", "update", "delete"];
 
@@ -763,9 +989,9 @@ class EntityAnalyzer extends BaseAnalyzer {
   }
   findEntityCalls(file) {
     const validCalls = [];
-    for (const call of file.getDescendantsOfKind(SyntaxKind4.CallExpression)) {
+    for (const call of file.getDescendantsOfKind(SyntaxKind5.CallExpression)) {
       const expr = call.getExpression();
-      if (expr.isKind(SyntaxKind4.Identifier)) {
+      if (expr.isKind(SyntaxKind5.Identifier)) {
         const isValid = isFromImport(expr, "@vertz/server");
         if (!isValid && expr.getText() === "entity") {
           this.addDiagnostic({
@@ -781,12 +1007,12 @@ class EntityAnalyzer extends BaseAnalyzer {
         }
         continue;
       }
-      if (expr.isKind(SyntaxKind4.PropertyAccessExpression)) {
+      if (expr.isKind(SyntaxKind5.PropertyAccessExpression)) {
         const propName = expr.getName();
         if (propName !== "entity")
           continue;
         const obj = expr.getExpression();
-        if (!obj.isKind(SyntaxKind4.Identifier))
+        if (!obj.isKind(SyntaxKind5.Identifier))
           continue;
         const sourceFile = obj.getSourceFile();
         const importDecl = sourceFile.getImportDeclarations().find((d) => d.getModuleSpecifierValue() === "@vertz/server" && d.getNamespaceImport()?.getText() === obj.getText());
@@ -846,6 +1072,13 @@ class EntityAnalyzer extends BaseAnalyzer {
     const actions = this.extractActions(configObj);
     const modelExpr = getPropertyValue(configObj, "model");
     const relations = this.extractRelations(configObj, modelExpr ?? undefined);
+    const tenantScopedExpr = getPropertyValue(configObj, "tenantScoped");
+    const tenantScoped = tenantScopedExpr ? getBooleanValue(tenantScopedExpr) : undefined;
+    const tableExpr = getPropertyValue(configObj, "table");
+    const table = tableExpr ? getStringValue(tableExpr) : undefined;
+    if (modelExpr) {
+      this.extractModelTableMetadata(modelExpr, modelRef);
+    }
     for (const action of actions) {
       if (CRUD_OPS.includes(action.name)) {
         this.addDiagnostic({
@@ -867,7 +1100,17 @@ class EntityAnalyzer extends BaseAnalyzer {
       }
     }
     return {
-      entity: { name, modelRef, access, hooks, actions, relations, ...loc },
+      entity: {
+        name,
+        modelRef,
+        access,
+        hooks,
+        actions,
+        relations,
+        ...tenantScoped !== undefined && tenantScoped !== null ? { tenantScoped } : {},
+        ...table !== undefined && table !== null ? { table } : {},
+        ...loc
+      },
       modelExpr: modelExpr ?? undefined
     };
   }
@@ -882,9 +1125,9 @@ class EntityAnalyzer extends BaseAnalyzer {
       });
       return null;
     }
-    const variableName = modelExpr.isKind(SyntaxKind4.Identifier) ? modelExpr.getText() : modelExpr.getText();
+    const variableName = modelExpr.isKind(SyntaxKind5.Identifier) ? modelExpr.getText() : modelExpr.getText();
     let importSource;
-    if (modelExpr.isKind(SyntaxKind4.Identifier)) {
+    if (modelExpr.isKind(SyntaxKind5.Identifier)) {
       const importInfo = this.findImportForIdentifier(modelExpr);
       if (importInfo) {
         importSource = importInfo.importDecl.getModuleSpecifierValue();
@@ -1053,7 +1296,7 @@ class EntityAnalyzer extends BaseAnalyzer {
       custom: {}
     };
     const accessExpr = getPropertyValue(configObj, "access");
-    if (!accessExpr || !accessExpr.isKind(SyntaxKind4.ObjectLiteralExpression))
+    if (!accessExpr || !accessExpr.isKind(SyntaxKind5.ObjectLiteralExpression))
       return defaults;
     const result = { ...defaults };
     const knownOps = new Set([...CRUD_OPS]);
@@ -1078,14 +1321,14 @@ class EntityAnalyzer extends BaseAnalyzer {
   extractHooks(configObj) {
     const hooks = { before: [], after: [] };
     const beforeExpr = getPropertyValue(configObj, "before");
-    if (beforeExpr?.isKind(SyntaxKind4.ObjectLiteralExpression)) {
+    if (beforeExpr?.isKind(SyntaxKind5.ObjectLiteralExpression)) {
       for (const { name } of getProperties(beforeExpr)) {
         if (name === "create" || name === "update")
           hooks.before.push(name);
       }
     }
     const afterExpr = getPropertyValue(configObj, "after");
-    if (afterExpr?.isKind(SyntaxKind4.ObjectLiteralExpression)) {
+    if (afterExpr?.isKind(SyntaxKind5.ObjectLiteralExpression)) {
       for (const { name } of getProperties(afterExpr)) {
         if (name === "create" || name === "update" || name === "delete")
           hooks.after.push(name);
@@ -1095,10 +1338,10 @@ class EntityAnalyzer extends BaseAnalyzer {
   }
   extractActions(configObj) {
     const actionsExpr = getPropertyValue(configObj, "actions");
-    if (!actionsExpr?.isKind(SyntaxKind4.ObjectLiteralExpression))
+    if (!actionsExpr?.isKind(SyntaxKind5.ObjectLiteralExpression))
       return [];
     return getProperties(actionsExpr).map(({ name, value }) => {
-      const actionObj = value.isKind(SyntaxKind4.ObjectLiteralExpression) ? value : null;
+      const actionObj = value.isKind(SyntaxKind5.ObjectLiteralExpression) ? value : null;
       const loc = getSourceLocation(value);
       const bodyExpr = actionObj ? getPropertyValue(actionObj, "body") : null;
       const responseExpr = actionObj ? getPropertyValue(actionObj, "response") : null;
@@ -1158,7 +1401,7 @@ class EntityAnalyzer extends BaseAnalyzer {
     });
   }
   resolveSchemaFromExpression(expr, loc) {
-    if (expr.isKind(SyntaxKind4.Identifier)) {
+    if (expr.isKind(SyntaxKind5.Identifier)) {
       const varName = expr.getText();
       return { kind: "named", schemaName: varName, sourceFile: loc.sourceFile };
     }
@@ -1171,7 +1414,7 @@ class EntityAnalyzer extends BaseAnalyzer {
   }
   extractRelations(configObj, modelExpr) {
     const relExpr = getPropertyValue(configObj, "relations");
-    if (!relExpr?.isKind(SyntaxKind4.ObjectLiteralExpression))
+    if (!relExpr?.isKind(SyntaxKind5.ObjectLiteralExpression))
       return [];
     const modelRelTypes = modelExpr ? this.resolveModelRelationTypes(modelExpr) : new Map;
     return getProperties(relExpr).filter(({ value }) => {
@@ -1179,16 +1422,74 @@ class EntityAnalyzer extends BaseAnalyzer {
       return boolVal !== false;
     }).map(({ name, value }) => {
       const boolVal = getBooleanValue(value);
-      const selection = boolVal === true ? "all" : value.isKind(SyntaxKind4.ObjectLiteralExpression) ? getProperties(value).map((p) => p.name) : "all";
       const relType = modelRelTypes.get(name);
+      if (boolVal === true || !value.isKind(SyntaxKind5.ObjectLiteralExpression)) {
+        return { name, type: relType?.type, entity: relType?.entity, selection: "all" };
+      }
+      const selectExpr = getPropertyValue(value, "select");
+      const selection = selectExpr?.isKind(SyntaxKind5.ObjectLiteralExpression) ? getProperties(selectExpr).map((p) => p.name) : "all";
+      const allowWhereExpr = getPropertyValue(value, "allowWhere");
+      const allowWhere = allowWhereExpr ? getArrayElements(allowWhereExpr).map((el) => getStringValue(el)).filter((s) => s !== null) : undefined;
+      const allowOrderByExpr = getPropertyValue(value, "allowOrderBy");
+      const allowOrderBy = allowOrderByExpr ? getArrayElements(allowOrderByExpr).map((el) => getStringValue(el)).filter((s) => s !== null) : undefined;
+      const maxLimitExpr = getPropertyValue(value, "maxLimit");
+      const maxLimit = maxLimitExpr ? getNumberValue(maxLimitExpr) ?? undefined : undefined;
       return {
         name,
         type: relType?.type,
         entity: relType?.entity,
-        selection
+        selection,
+        ...allowWhere ? { allowWhere } : {},
+        ...allowOrderBy ? { allowOrderBy } : {},
+        ...maxLimit !== undefined ? { maxLimit } : {}
       };
     });
   }
+  extractModelTableMetadata(modelExpr, modelRef) {
+    try {
+      const modelType = modelExpr.getType();
+      const tableProp = modelType.getProperty("table");
+      if (!tableProp)
+        return;
+      const tableType = tableProp.getTypeAtLocation(modelExpr);
+      const columnsProp = tableType.getProperty("_columns");
+      if (!columnsProp)
+        return;
+      const columnsType = columnsProp.getTypeAtLocation(modelExpr);
+      const hiddenFields = [];
+      for (const colProp of columnsType.getProperties()) {
+        const colName = colProp.getName();
+        const colType = colProp.getTypeAtLocation(modelExpr);
+        const metaProp = colType.getProperty("_meta");
+        if (!metaProp)
+          continue;
+        const metaType = metaProp.getTypeAtLocation(modelExpr);
+        const primaryProp = metaType.getProperty("primary");
+        if (primaryProp) {
+          const primaryType = primaryProp.getTypeAtLocation(modelExpr);
+          if (primaryType.getText() === "true") {
+            modelRef.primaryKey = colName;
+          }
+        }
+        const annotationsProp = metaType.getProperty("_annotations");
+        if (annotationsProp) {
+          const annotationsType = annotationsProp.getTypeAtLocation(modelExpr);
+          const hiddenProp = annotationsType.getProperty("hidden");
+          if (hiddenProp) {
+            const hiddenType = hiddenProp.getTypeAtLocation(modelExpr);
+            if (hiddenType.getText() === "true") {
+              hiddenFields.push(colName);
+            }
+          }
+        }
+      }
+      if (hiddenFields.length > 0 || columnsType.getProperties().length > 0) {
+        modelRef.hiddenFields = hiddenFields;
+      }
+    } catch (e) {
+      this.debug(`extractModelTableMetadata failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
   resolveModelRelationTypes(modelExpr) {
     const result = new Map;
     try {
@@ -1266,10 +1567,10 @@ class EntityAnalyzer extends BaseAnalyzer {
   }
 }
 // src/analyzers/env-analyzer.ts
-import { SyntaxKind as SyntaxKind6 } from "ts-morph";
+import { SyntaxKind as SyntaxKind7 } from "ts-morph";
 
 // src/analyzers/schema-analyzer.ts
-import { SyntaxKind as SyntaxKind5 } from "ts-morph";
+import { SyntaxKind as SyntaxKind6 } from "ts-morph";
 class SchemaAnalyzer extends BaseAnalyzer {
   async analyze() {
     const schemas = [];
@@ -1279,7 +1580,7 @@ class SchemaAnalyzer extends BaseAnalyzer {
       for (const exportSymbol of file.getExportSymbols()) {
         const declarations = exportSymbol.getDeclarations();
         for (const decl of declarations) {
-          if (!decl.isKind(SyntaxKind5.VariableDeclaration))
+          if (!decl.isKind(SyntaxKind6.VariableDeclaration))
             continue;
           const initializer = decl.getInitializer();
           if (!initializer)
@@ -1334,9 +1635,9 @@ function isSchemaExpression(_file, expr) {
 }
 function extractSchemaId(expr) {
   let current = expr;
-  while (current.isKind(SyntaxKind5.CallExpression)) {
+  while (current.isKind(SyntaxKind6.CallExpression)) {
     const access = current.getExpression();
-    if (access.isKind(SyntaxKind5.PropertyAccessExpression) && access.getName() === "id") {
+    if (access.isKind(SyntaxKind6.PropertyAccessExpression) && access.getName() === "id") {
       const args = current.getArguments();
       if (args.length === 1) {
         const firstArg = args.at(0);
@@ -1345,7 +1646,7 @@ function extractSchemaId(expr) {
           return value;
       }
     }
-    if (access.isKind(SyntaxKind5.PropertyAccessExpression)) {
+    if (access.isKind(SyntaxKind6.PropertyAccessExpression)) {
       current = access.getExpression();
     } else {
       break;
@@ -1363,13 +1664,13 @@ function createInlineSchemaRef(sourceFile) {
   return { kind: "inline", sourceFile };
 }
 function findRootIdentifier(expr) {
-  if (expr.isKind(SyntaxKind5.CallExpression)) {
+  if (expr.isKind(SyntaxKind6.CallExpression)) {
     return findRootIdentifier(expr.getExpression());
   }
-  if (expr.isKind(SyntaxKind5.PropertyAccessExpression)) {
+  if (expr.isKind(SyntaxKind6.PropertyAccessExpression)) {
     return findRootIdentifier(expr.getExpression());
   }
-  if (expr.isKind(SyntaxKind5.Identifier)) {
+  if (expr.isKind(SyntaxKind6.Identifier)) {
     return expr;
   }
   return null;
@@ -1398,7 +1699,7 @@ class EnvAnalyzer extends BaseAnalyzer {
         const loadFiles = loadExpr ? getArrayElements(loadExpr).map((e) => getStringValue(e)).filter((v) => v !== null) : [];
         const schemaExpr = getPropertyValue(obj, "schema");
         let schema;
-        if (schemaExpr?.isKind(SyntaxKind6.Identifier)) {
+        if (schemaExpr?.isKind(SyntaxKind7.Identifier)) {
           schema = createNamedSchemaRef(schemaExpr.getText(), file.getFilePath());
         }
         env = {
@@ -1413,10 +1714,10 @@ class EnvAnalyzer extends BaseAnalyzer {
   }
 }
 // src/analyzers/middleware-analyzer.ts
-import { SyntaxKind as SyntaxKind8 } from "ts-morph";
+import { SyntaxKind as SyntaxKind9 } from "ts-morph";
 
 // src/analyzers/service-analyzer.ts
-import { SyntaxKind as SyntaxKind7 } from "ts-morph";
+import { SyntaxKind as SyntaxKind8 } from "ts-morph";
 class ServiceAnalyzer extends BaseAnalyzer {
   async analyze() {
     return { services: [] };
@@ -1447,7 +1748,7 @@ class ServiceAnalyzer extends BaseAnalyzer {
 }
 function parseInjectFromObj(obj) {
   const injectExpr = getPropertyValue(obj, "inject");
-  if (!injectExpr?.isKind(SyntaxKind7.ObjectLiteralExpression))
+  if (!injectExpr?.isKind(SyntaxKind8.ObjectLiteralExpression))
     return [];
   return parseInjectRefs(injectExpr);
 }
@@ -1459,27 +1760,27 @@ function parseMethodsFromObj(obj) {
 }
 function parseInjectRefs(obj) {
   return getProperties(obj).map(({ name, value }) => {
-    const resolvedToken = value.isKind(SyntaxKind7.Identifier) ? value.getText() : name;
+    const resolvedToken = value.isKind(SyntaxKind8.Identifier) ? value.getText() : name;
     return { localName: name, resolvedToken };
   });
 }
 function extractMethodSignatures(expr) {
-  if (!expr.isKind(SyntaxKind7.ArrowFunction) && !expr.isKind(SyntaxKind7.FunctionExpression)) {
+  if (!expr.isKind(SyntaxKind8.ArrowFunction) && !expr.isKind(SyntaxKind8.FunctionExpression)) {
     return [];
   }
   const body = expr.getBody();
   let returnObj = null;
-  if (body.isKind(SyntaxKind7.ObjectLiteralExpression)) {
+  if (body.isKind(SyntaxKind8.ObjectLiteralExpression)) {
     returnObj = body;
-  } else if (body.isKind(SyntaxKind7.ParenthesizedExpression)) {
+  } else if (body.isKind(SyntaxKind8.ParenthesizedExpression)) {
     const inner = body.getExpression();
-    if (inner.isKind(SyntaxKind7.ObjectLiteralExpression)) {
+    if (inner.isKind(SyntaxKind8.ObjectLiteralExpression)) {
       returnObj = inner;
     }
-  } else if (body.isKind(SyntaxKind7.Block)) {
-    const returnStmt = body.getStatements().find((s) => s.isKind(SyntaxKind7.ReturnStatement));
-    const retExpr = returnStmt?.asKind(SyntaxKind7.ReturnStatement)?.getExpression();
-    if (retExpr?.isKind(SyntaxKind7.ObjectLiteralExpression)) {
+  } else if (body.isKind(SyntaxKind8.Block)) {
+    const returnStmt = body.getStatements().find((s) => s.isKind(SyntaxKind8.ReturnStatement));
+    const retExpr = returnStmt?.asKind(SyntaxKind8.ReturnStatement)?.getExpression();
+    if (retExpr?.isKind(SyntaxKind8.ObjectLiteralExpression)) {
       returnObj = retExpr;
     }
   }
@@ -1487,7 +1788,7 @@ function extractMethodSignatures(expr) {
     return [];
   const methods = [];
   for (const prop of returnObj.getProperties()) {
-    if (!prop.isKind(SyntaxKind7.PropertyAssignment))
+    if (!prop.isKind(SyntaxKind8.PropertyAssignment))
       continue;
     const methodName = prop.getName();
     const init = prop.getInitializer();
@@ -1504,7 +1805,7 @@ function extractMethodSignatures(expr) {
   return methods;
 }
 function extractFunctionParams(expr) {
-  if (!expr.isKind(SyntaxKind7.ArrowFunction) && !expr.isKind(SyntaxKind7.FunctionExpression)) {
+  if (!expr.isKind(SyntaxKind8.ArrowFunction) && !expr.isKind(SyntaxKind8.FunctionExpression)) {
     return [];
   }
   return expr.getParameters().map((p) => ({
@@ -1513,7 +1814,7 @@ function extractFunctionParams(expr) {
   }));
 }
 function inferReturnType(expr) {
-  if (expr.isKind(SyntaxKind7.ArrowFunction) || expr.isKind(SyntaxKind7.FunctionExpression)) {
+  if (expr.isKind(SyntaxKind8.ArrowFunction) || expr.isKind(SyntaxKind8.FunctionExpression)) {
     const retType = expr.getReturnType();
     return retType.getText(expr);
   }
@@ -1570,7 +1871,7 @@ class MiddlewareAnalyzer extends BaseAnalyzer {
           continue;
         }
         const injectExpr = getPropertyValue(obj, "inject");
-        const inject = injectExpr?.isKind(SyntaxKind8.ObjectLiteralExpression) ? parseInjectRefs(injectExpr) : [];
+        const inject = injectExpr?.isKind(SyntaxKind9.ObjectLiteralExpression) ? parseInjectRefs(injectExpr) : [];
         const filePath = file.getFilePath();
         const headers = this.resolveSchemaRef(obj, "headers", filePath);
         const params = this.resolveSchemaRef(obj, "params", filePath);
@@ -1597,7 +1898,7 @@ class MiddlewareAnalyzer extends BaseAnalyzer {
     const expr = getPropertyValue(obj, prop);
     if (!expr)
       return;
-    if (expr.isKind(SyntaxKind8.Identifier)) {
+    if (expr.isKind(SyntaxKind9.Identifier)) {
       const resolved = resolveIdentifier(expr, this.project);
       const resolvedPath = resolved ? resolved.sourceFile.getFilePath() : filePath;
       return createNamedSchemaRef(expr.getText(), resolvedPath);
@@ -1609,7 +1910,7 @@ class MiddlewareAnalyzer extends BaseAnalyzer {
   }
 }
 // src/analyzers/module-analyzer.ts
-import { SyntaxKind as SyntaxKind9 } from "ts-morph";
+import { SyntaxKind as SyntaxKind10 } from "ts-morph";
 class ModuleAnalyzer extends BaseAnalyzer {
   async analyze() {
     const modules = [];
@@ -1632,10 +1933,10 @@ class ModuleAnalyzer extends BaseAnalyzer {
         }
         const varName = getVariableNameForCall(call);
         const importsExpr = getPropertyValue(obj, "imports");
-        const imports = importsExpr?.isKind(SyntaxKind9.ObjectLiteralExpression) ? parseImports(importsExpr) : [];
+        const imports = importsExpr?.isKind(SyntaxKind10.ObjectLiteralExpression) ? parseImports(importsExpr) : [];
         const optionsExpr = getPropertyValue(obj, "options");
         let options;
-        if (optionsExpr?.isKind(SyntaxKind9.Identifier)) {
+        if (optionsExpr?.isKind(SyntaxKind10.Identifier)) {
           options = createNamedSchemaRef(optionsExpr.getText(), file.getFilePath());
         }
         const loc = getSourceLocation(call);
@@ -1661,7 +1962,7 @@ class ModuleAnalyzer extends BaseAnalyzer {
         if (args.length < 2)
           continue;
         const defArg = args.at(0);
-        if (!defArg?.isKind(SyntaxKind9.Identifier))
+        if (!defArg?.isKind(SyntaxKind10.Identifier))
           continue;
         const defVarName = defArg.getText();
         const idx = defVarToIndex.get(defVarName);
@@ -1689,12 +1990,12 @@ function parseImports(obj) {
   }));
 }
 function extractIdentifierNames(expr) {
-  if (!expr.isKind(SyntaxKind9.ArrayLiteralExpression))
+  if (!expr.isKind(SyntaxKind10.ArrayLiteralExpression))
     return [];
-  return expr.getElements().filter((e) => e.isKind(SyntaxKind9.Identifier)).map((e) => e.getText());
+  return expr.getElements().filter((e) => e.isKind(SyntaxKind10.Identifier)).map((e) => e.getText());
 }
 // src/analyzers/route-analyzer.ts
-import { SyntaxKind as SyntaxKind10 } from "ts-morph";
+import { SyntaxKind as SyntaxKind11 } from "ts-morph";
 var HTTP_METHODS = {
   get: "GET",
   post: "POST",
@@ -1731,7 +2032,7 @@ class RouteAnalyzer extends BaseAnalyzer {
           }
           const loc = getSourceLocation(call);
           const injectExpr = obj ? getPropertyValue(obj, "inject") : null;
-          const inject = injectExpr?.isKind(SyntaxKind10.ObjectLiteralExpression) ? parseInjectRefs(injectExpr) : [];
+          const inject = injectExpr?.isKind(SyntaxKind11.ObjectLiteralExpression) ? parseInjectRefs(injectExpr) : [];
           const routes = this.extractRoutes(file, varName, prefix, moduleName);
           routers.push({
             name: varName,
@@ -1748,15 +2049,15 @@ class RouteAnalyzer extends BaseAnalyzer {
     return { routers };
   }
   detectUnknownRouterCalls(file, knownModuleDefVars) {
-    const allCalls = file.getDescendantsOfKind(SyntaxKind10.CallExpression);
+    const allCalls = file.getDescendantsOfKind(SyntaxKind11.CallExpression);
     for (const call of allCalls) {
       const expr = call.getExpression();
-      if (!expr.isKind(SyntaxKind10.PropertyAccessExpression))
+      if (!expr.isKind(SyntaxKind11.PropertyAccessExpression))
         continue;
       if (expr.getName() !== "router")
         continue;
       const obj = expr.getExpression();
-      if (!obj.isKind(SyntaxKind10.Identifier))
+      if (!obj.isKind(SyntaxKind11.Identifier))
         continue;
       if (knownModuleDefVars.has(obj.getText()))
         continue;
@@ -1790,25 +2091,25 @@ class RouteAnalyzer extends BaseAnalyzer {
     return routes;
   }
   findChainedHttpCalls(file, routerVarName, methodName) {
-    return file.getDescendantsOfKind(SyntaxKind10.CallExpression).filter((call) => {
+    return file.getDescendantsOfKind(SyntaxKind11.CallExpression).filter((call) => {
       const expr = call.getExpression();
-      if (!expr.isKind(SyntaxKind10.PropertyAccessExpression))
+      if (!expr.isKind(SyntaxKind11.PropertyAccessExpression))
         return false;
       if (expr.getName() !== methodName)
         return false;
       const obj = expr.getExpression();
-      if (!obj.isKind(SyntaxKind10.CallExpression))
+      if (!obj.isKind(SyntaxKind11.CallExpression))
         return false;
       return this.chainResolvesToVariable(obj, routerVarName);
     });
   }
   chainResolvesToVariable(expr, varName) {
-    if (expr.isKind(SyntaxKind10.Identifier)) {
+    if (expr.isKind(SyntaxKind11.Identifier)) {
       return expr.getText() === varName;
     }
-    if (expr.isKind(SyntaxKind10.CallExpression)) {
+    if (expr.isKind(SyntaxKind11.CallExpression)) {
       const inner = expr.getExpression();
-      if (inner.isKind(SyntaxKind10.PropertyAccessExpression)) {
+      if (inner.isKind(SyntaxKind11.PropertyAccessExpression)) {
         return this.chainResolvesToVariable(inner.getExpression(), varName);
       }
     }
@@ -1882,7 +2183,7 @@ class RouteAnalyzer extends BaseAnalyzer {
     const expr = getPropertyValue(obj, prop);
     if (!expr)
       return;
-    if (expr.isKind(SyntaxKind10.Identifier)) {
+    if (expr.isKind(SyntaxKind11.Identifier)) {
       const resolved = resolveIdentifier(expr, this.project);
       const resolvedPath = resolved ? resolved.sourceFile.getFilePath() : filePath;
       return createNamedSchemaRef(expr.getText(), resolvedPath);
@@ -1897,7 +2198,7 @@ class RouteAnalyzer extends BaseAnalyzer {
     if (!expr)
       return [];
     const elements = getArrayElements(expr);
-    return elements.filter((el) => el.isKind(SyntaxKind10.Identifier)).map((el) => {
+    return elements.filter((el) => el.isKind(SyntaxKind11.Identifier)).map((el) => {
       const resolved = resolveIdentifier(el, this.project);
       return {
         name: el.getText(),
@@ -1907,9 +2208,9 @@ class RouteAnalyzer extends BaseAnalyzer {
   }
   generateOperationId(moduleName, method, path, handlerExpr, usedIds) {
     let handlerName = null;
-    if (handlerExpr?.isKind(SyntaxKind10.Identifier)) {
+    if (handlerExpr?.isKind(SyntaxKind11.Identifier)) {
       handlerName = handlerExpr.getText();
-    } else if (handlerExpr?.isKind(SyntaxKind10.PropertyAccessExpression)) {
+    } else if (handlerExpr?.isKind(SyntaxKind11.PropertyAccessExpression)) {
       handlerName = handlerExpr.getName();
     }
     const id = handlerName ? `${moduleName}_${handlerName}` : `${moduleName}_${method.toLowerCase()}_${sanitizePath(path)}`;
@@ -3270,6 +3571,7 @@ class Compiler {
     const appResult = await analyzers.app.analyze();
     const entityResult = await analyzers.entity.analyze();
     const databaseResult = await analyzers.database.analyze();
+    const accessResult = await analyzers.access.analyze();
     const depGraphResult = await analyzers.dependencyGraph.analyze();
     ir.env = envResult.env;
     ir.schemas = schemaResult.schemas;
@@ -3278,8 +3580,9 @@ class Compiler {
     ir.app = appResult.app;
     ir.entities = entityResult.entities;
     ir.databases = databaseResult.databases;
+    ir.access = accessResult.access;
     ir.dependencyGraph = depGraphResult.graph;
-    ir.diagnostics.push(...analyzers.env.getDiagnostics(), ...analyzers.schema.getDiagnostics(), ...analyzers.middleware.getDiagnostics(), ...analyzers.module.getDiagnostics(), ...analyzers.app.getDiagnostics(), ...analyzers.entity.getDiagnostics(), ...analyzers.database.getDiagnostics(), ...analyzers.dependencyGraph.getDiagnostics());
+    ir.diagnostics.push(...analyzers.env.getDiagnostics(), ...analyzers.schema.getDiagnostics(), ...analyzers.middleware.getDiagnostics(), ...analyzers.module.getDiagnostics(), ...analyzers.app.getDiagnostics(), ...analyzers.entity.getDiagnostics(), ...analyzers.database.getDiagnostics(), ...analyzers.access.getDiagnostics(), ...analyzers.dependencyGraph.getDiagnostics());
     injectEntityRoutes(ir);
     const collisionDiags = detectRouteCollisions(ir);
     ir.diagnostics.push(...collisionDiags);
@@ -3324,6 +3627,7 @@ function createCompiler(config) {
       app: new AppAnalyzer(project, resolved),
       entity: new EntityAnalyzer(project, resolved),
       database: new DatabaseAnalyzer(project, resolved),
+      access: new AccessAnalyzer(project, resolved),
       dependencyGraph: new DependencyGraphAnalyzer(project, resolved)
     },
     validators: [
@@ -3693,5 +3997,6 @@ export {
   BootGenerator,
   BaseGenerator,
   BaseAnalyzer,
-  AppAnalyzer
+  AppAnalyzer,
+  AccessAnalyzer
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertz/compiler",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "type": "module",
   "license": "MIT",
   "description": "Vertz compiler — internal, no stability guarantee",