@vibeorm/runtime 2.0.0-alpha.6 → 2.0.0-alpha.8

package/dist/index.js

@@ -133,6 +133,7 @@ function buildFieldMeta(params) {
   return {
     name: field.name,
     columnName: field.dbName ?? field.name,
+    ...field.collation === undefined ? {} : { collation: field.collation },
     type: field.type,
     scalarType: enumRef ? null : field.type,
     enumName: enumRef ? field.type.enum : null,
@@ -191,6 +192,11 @@ function buildModelMeta(params) {
   };
   if (primaryKey.length > 1) {
     addCompound(primaryKey.map((field) => field.name), false, model.primaryKey?.clientName);
+  } else {
+    const only = primaryKey[0];
+    if (only !== undefined && !only.isId && !only.isUnique) {
+      singleIndexUniques.push({ fields: [only], nullsNotDistinct: false });
+    }
   }
   for (const index of model.indexes) {
     if (index.kind !== "unique" || index.where !== undefined)
@@ -226,6 +232,7 @@ function buildModelMeta(params) {
     singleIndexUniques,
     relations: model.relations,
     relationByName: new Map(model.relations.map((relation) => [relation.name, relation])),
+    ...model.policy === undefined ? {} : { policy: model.policy },
     isView: model.isView,
     computed
   };
@@ -1435,6 +1442,7 @@ function compileOperatorFilter(params) {
   }
   const insensitive = mode === "insensitive";
   const strict = mode === "strict";
+  const ciCollated = (params2) => params2.dialect.name === "mysql" && params2.field.collation?.toLowerCase().endsWith("_ci") === true;
   const requireStringOperand = (operator, operand) => {
     if (typeof operand !== "string") {
       throw validationError2({
@@ -1462,7 +1470,8 @@ function compileOperatorFilter(params) {
             kind: "like",
             column,
             pattern: escapeLikePattern({ raw: requireStringOperand("equals", operand) }),
-            insensitive: true
+            insensitive: true,
+            ...ciCollated({ dialect, field }) ? { ciCollation: true } : {}
           });
           break;
         }
@@ -1559,7 +1568,8 @@ function compileOperatorFilter(params) {
           kind: "like",
           column,
           pattern: compileStringPattern({ operator, operand, field, model }),
-          insensitive
+          insensitive,
+          ...insensitive && ciCollated({ dialect, field }) ? { ciCollation: true } : {}
         });
         break;
       }
@@ -5500,8 +5510,341 @@ function attachDefineView(params) {
   const value = (options) => createView({ meta, models, name: options.name, definition: options.definition });
   Object.defineProperty(client, "$defineView", { value, enumerable: true });
 }
+// packages/runtime/src/validators.ts
+import { VibeError as VibeError11 } from "@vibeorm/schema";
+function validationFailed(params) {
+  return new VibeError11({
+    code: "VIBE_VALIDATION",
+    message: `validation failed for ${params.model}.${params.field}: ${params.issues[0]?.message ?? "invalid value"}`,
+    meta: { model: params.model, field: params.field, issues: params.issues }
+  });
+}
+function validateValue(params) {
+  const result = params.schema["~standard"].validate(params.value);
+  if (result instanceof Promise) {
+    throw new VibeError11({
+      code: "VIBE_VALIDATION",
+      message: `async validator on ${params.model}.${params.field} \u2014 write validators must be synchronous (validate before calling the client for async rules)`,
+      meta: { model: params.model, field: params.field }
+    });
+  }
+  if (result.issues !== undefined) {
+    throw validationFailed({ model: params.model, field: params.field, issues: result.issues });
+  }
+  return result.value;
+}
+function validateWriteData(params) {
+  const { meta, model, data, validators } = params;
+  const fieldSchemas = validators[model.name];
+  const out = { ...data };
+  for (const [key, value] of Object.entries(data)) {
+    if (value === undefined)
+      continue;
+    const schema = fieldSchemas?.[key];
+    if (schema !== undefined) {
+      const isOperator = typeof value === "object" && value !== null && !Array.isArray(value) && "set" in value;
+      if (isOperator) {
+        const inner = value.set;
+        out[key] = { set: validateValue({ model: model.name, field: key, schema, value: inner }) };
+      } else {
+        out[key] = validateValue({ model: model.name, field: key, schema, value });
+      }
+      continue;
+    }
+    const relation = model.relationByName.get(key);
+    if (relation === undefined || typeof value !== "object" || value === null)
+      continue;
+    const target = meta.modelByName.get(relation.targetModel);
+    if (target === undefined || validators[target.name] === undefined)
+      continue;
+    const verbs = value;
+    const recurse = (row) => typeof row === "object" && row !== null ? validateWriteData({ meta, model: target, data: row, validators }) : row;
+    const next = { ...verbs };
+    if (verbs.create !== undefined) {
+      next.create = Array.isArray(verbs.create) ? verbs.create.map(recurse) : recurse(verbs.create);
+    }
+    if (verbs.connectOrCreate !== undefined) {
+      const entries = Array.isArray(verbs.connectOrCreate) ? verbs.connectOrCreate : [verbs.connectOrCreate];
+      const mapped = entries.map((entry) => {
+        const pair = entry;
+        return { ...pair, create: recurse(pair.create) };
+      });
+      next.connectOrCreate = Array.isArray(verbs.connectOrCreate) ? mapped : mapped[0];
+    }
+    if (verbs.update !== undefined && !Array.isArray(verbs.update)) {
+      const body = verbs.update;
+      next.update = body.data !== undefined ? { ...body, data: recurse(body.data) } : recurse(body);
+    }
+    if (verbs.upsert !== undefined && !Array.isArray(verbs.upsert)) {
+      const body = verbs.upsert;
+      next.upsert = { ...body, create: recurse(body.create), update: recurse(body.update) };
+    }
+    out[key] = next;
+  }
+  return out;
+}
+function applyWriteValidators(params) {
+  const { meta, model, method, args, validators } = params;
+  const validate = (row) => typeof row === "object" && row !== null ? validateWriteData({ meta, model, data: row, validators }) : row;
+  if (method === "create" || method === "update" || method === "updateMany") {
+    return args.data === undefined ? args : { ...args, data: validate(args.data) };
+  }
+  if (method === "createMany" || method === "createManyAndReturn") {
+    return Array.isArray(args.data) ? { ...args, data: args.data.map(validate) } : args;
+  }
+  if (method === "upsert") {
+    return { ...args, create: validate(args.create), update: validate(args.update) };
+  }
+  return args;
+}
+// packages/runtime/src/policy.ts
+import { VibeError as VibeError12 } from "@vibeorm/schema";
+function policyError(message, meta) {
+  return new VibeError12({ code: "VIBE_VALIDATION", message, meta: meta ?? {} });
+}
+function policiedModels(meta) {
+  return meta.models.filter((model) => model.policy !== undefined);
+}
+function mergeWhere(params) {
+  const { where, field, value } = params;
+  const predicate = { [field]: value };
+  return where === undefined ? predicate : { AND: [where, predicate] };
+}
+function uniqueToFilter(params) {
+  const out = {};
+  for (const [key, value] of Object.entries(params.where)) {
+    const isCompound = typeof value === "object" && value !== null && !Array.isArray(value) && params.model.compoundUniques.has(key);
+    if (isCompound)
+      Object.assign(out, value);
+    else
+      out[key] = value;
+  }
+  return out;
+}
+function scopeSelection(params) {
+  const { meta, model, args, context } = params;
+  const out = { ...args };
+  for (const key of ["include", "select"]) {
+    const block = args[key];
+    if (typeof block !== "object" || block === null)
+      continue;
+    const next = { ...block };
+    for (const [name, spec] of Object.entries(block)) {
+      const relation = model.relationByName.get(name);
+      if (relation === undefined)
+        continue;
+      const target = meta.modelByName.get(relation.targetModel);
+      if (target?.policy === undefined)
+        continue;
+      const value = context[target.policy.context];
+      const spec2 = spec === true ? {} : { ...spec };
+      spec2.where = mergeWhere({ where: spec2.where, field: target.policy.field, value });
+      next[name] = scopeSelection({ meta, model: target, args: spec2, context });
+    }
+    out[key] = next;
+  }
+  return out;
+}
+var REFERENCE_VERBS = ["connect", "connectOrCreate", "set", "disconnect", "update", "updateMany", "delete", "deleteMany", "upsert"];
+function forceCreateData(params) {
+  const { meta, model, data, context } = params;
+  const out = { ...data };
+  if (model.policy !== undefined) {
+    const value = context[model.policy.context];
+    const given = data[model.policy.field];
+    if (given !== undefined && given !== value) {
+      throw policyError(`create on ${model.name}: data.${model.policy.field} conflicts with the bound policy context`, { model: model.name, field: model.policy.field });
+    }
+    out[model.policy.field] = value;
+  }
+  for (const [name, spec] of Object.entries(data)) {
+    const relation = model.relationByName.get(name);
+    if (relation === undefined || typeof spec !== "object" || spec === null)
+      continue;
+    const target = meta.modelByName.get(relation.targetModel);
+    if (target?.policy === undefined)
+      continue;
+    const verbs = spec;
+    for (const verb of REFERENCE_VERBS) {
+      if (verbs[verb] !== undefined) {
+        throw policyError(`nested ${verb} on policied model ${target.name} is not policy-safe from a scoped client \u2014 perform it in an explicit $transaction on the scoped delegate`, { model: model.name, relation: name, verb });
+      }
+    }
+    if (verbs.create !== undefined) {
+      const recurse = (row) => forceCreateData({ meta, model: target, data: row, context });
+      out[name] = { ...verbs, create: Array.isArray(verbs.create) ? verbs.create.map(recurse) : recurse(verbs.create) };
+    }
+  }
+  return out;
+}
+function scopedDelegate(params) {
+  const { meta, model, base, context, transaction } = params;
+  const policy = model.policy;
+  const value = context[policy.context];
+  const pk = model.primaryKey.map((field) => field.name);
+  const scopeFind = (args) => {
+    const scoped = scopeSelection({ meta, model, args: args ?? {}, context });
+    return { ...scoped, where: mergeWhere({ where: scoped.where, field: policy.field, value }) };
+  };
+  const scopeUnique = (args) => {
+    const scoped = scopeSelection({ meta, model, args, context });
+    const flat = uniqueToFilter({ model, where: args.where ?? {} });
+    return { ...scoped, where: mergeWhere({ where: flat, field: policy.field, value }) };
+  };
+  const pkClientKey = () => {
+    for (const [key, group] of model.compoundUniques) {
+      const names = group.fields.map((field) => field.name);
+      if (names.length === pk.length && names.every((name) => pk.includes(name)))
+        return key;
+    }
+    return pk.join("_");
+  };
+  const lockThen = (args, write) => transaction(async (tx) => {
+    const raw = tx.$bypassPolicy === undefined ? tx : tx.$bypassPolicy();
+    const target = await raw.$models[model.name].findFirst({
+      where: scopeUnique(args).where,
+      select: Object.fromEntries(pk.map((name) => [name, true])),
+      lock: "update"
+    });
+    if (target === null)
+      return null;
+    const pkWhere = pk.length === 1 ? { [pk[0]]: target[pk[0]] } : { [pkClientKey()]: Object.fromEntries(pk.map((name) => [name, target[name]])) };
+    return write(raw, pkWhere);
+  });
+  const notFound2 = (method) => new VibeError12({ code: "VIBE_NOT_FOUND", message: `${method} on ${model.name}: no row matches the unique where inside the bound policy context`, meta: { model: model.name, method } });
+  return {
+    findMany: (args) => base.findMany(scopeFind(args)),
+    findFirst: (args) => base.findFirst(scopeFind(args)),
+    findFirstOrThrow: (args) => base.findFirstOrThrow(scopeFind(args)),
+    findUnique: (args) => base.findFirst(scopeUnique(args)),
+    findUniqueOrThrow: (args) => base.findFirstOrThrow(scopeUnique(args)),
+    create: async (args) => base.create({ ...args, data: forceCreateData({ meta, model, data: args.data ?? {}, context }) }),
+    createMany: async (args) => base.createMany({
+      ...args,
+      data: (args.data ?? []).map((row) => forceCreateData({ meta, model, data: row, context }))
+    }),
+    createManyAndReturn: async (args) => base.createManyAndReturn({
+      ...args,
+      data: (args.data ?? []).map((row) => forceCreateData({ meta, model, data: row, context }))
+    }),
+    update: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].update({ ...args, where: pkWhere }));
+      if (row === null)
+        throw notFound2("update");
+      return row;
+    },
+    updateMany: (args) => base.updateMany({ ...args, where: mergeWhere({ where: args.where, field: policy.field, value }) }),
+    upsert: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].update({ where: pkWhere, data: args.update, ...args.select === undefined ? {} : { select: args.select } }));
+      if (row !== null)
+        return row;
+      return await base.create({
+        data: forceCreateData({ meta, model, data: args.create ?? {}, context }),
+        ...args.select === undefined ? {} : { select: args.select }
+      });
+    },
+    delete: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].delete({ ...args, where: pkWhere }));
+      if (row === null)
+        throw notFound2("delete");
+      return row;
+    },
+    deleteMany: (args) => base.deleteMany({ ...args ?? {}, where: mergeWhere({ where: args?.where, field: policy.field, value }) }),
+    count: (args) => base.count(scopeFind(args)),
+    aggregate: (args) => base.aggregate(scopeFind(args)),
+    groupBy: (args) => base.groupBy(scopeFind(args))
+  };
+}
+function scopeExtensionProps(params) {
+  const out = {};
+  for (const [key, prop] of Object.entries(params.base)) {
+    if (key in params.delegate)
+      continue;
+    if (typeof prop === "function") {
+      out[key] = (args) => prop({ ...args ?? {}, where: mergeWhere({ where: args?.where, field: params.field, value: params.value }) });
+    } else if (typeof prop === "object" && prop !== null) {
+      out[key] = scopeExtensionProps({ base: prop, delegate: {}, field: params.field, value: params.value });
+    }
+  }
+  return out;
+}
+function attachPolicy(params) {
+  const { client, meta } = params;
+  const policied = policiedModels(meta);
+  if (policied.length === 0)
+    return;
+  const originals = new Map;
+  for (const model of policied) {
+    const original = client.$models[model.name];
+    originals.set(model.name, { ...original });
+    const guard = (method) => () => Promise.reject(policyError(`model ${model.name} declares @@policy \u2014 bind a context with $withPolicy({ ${model.policy?.context}: ... }) or bypass deliberately with $bypassPolicy()`, { model: model.name, method }));
+    const guarded = {};
+    for (const key of Object.keys(original)) {
+      guarded[key] = typeof original[key] === "function" ? guard(key) : original[key];
+    }
+    Object.assign(original, guarded);
+  }
+  const buildScoped = (context) => {
+    for (const model of policied) {
+      const key = model.policy?.context;
+      if (context[key] === undefined || context[key] === null) {
+        throw policyError(`$withPolicy: missing context value "${key}" (required by ${model.name})`, { context: key });
+      }
+    }
+    const scoped = Object.create(client);
+    const scopedModels = { ...client.$models };
+    for (const model of policied) {
+      const base = originals.get(model.name);
+      const value = context[model.policy?.context];
+      const delegate = scopedDelegate({ meta, model, base, context, transaction: client.$transaction });
+      const full = { ...delegate, ...scopeExtensionProps({ base, delegate, field: model.policy?.field, value }) };
+      scopedModels[model.name] = full;
+      scopedModels[model.clientName] = full;
+      Object.defineProperty(scoped, model.clientName, { value: full, enumerable: true });
+    }
+    Object.defineProperty(scoped, "$models", { value: scopedModels, enumerable: true });
+    attachDefineView({ client: scoped, meta, models: scopedModels });
+    Object.defineProperty(scoped, "$transaction", {
+      value: (arg, options) => typeof arg === "function" ? client.$transaction((tx) => arg(buildScopedOver(tx, context)), options) : client.$transaction(arg, options),
+      enumerable: true
+    });
+    return scoped;
+  };
+  const buildScopedOver = (tx, context) => {
+    const rawTx = tx.$bypassPolicy === undefined ? tx : tx.$bypassPolicy();
+    const inner = Object.create(tx);
+    const scopedModels = { ...tx.$models };
+    for (const model of policied) {
+      const base = rawTx.$models[model.name];
+      const delegate = scopedDelegate({ meta, model, base, context, transaction: tx.$transaction });
+      scopedModels[model.name] = delegate;
+      scopedModels[model.clientName] = delegate;
+      Object.defineProperty(inner, model.clientName, { value: delegate, enumerable: true });
+    }
+    Object.defineProperty(inner, "$models", { value: scopedModels, enumerable: true });
+    attachDefineView({ client: inner, meta, models: scopedModels });
+    return inner;
+  };
+  Object.defineProperty(client, "$withPolicy", { value: (context) => buildScoped(context), enumerable: true });
+  Object.defineProperty(client, "$bypassPolicy", {
+    value: () => {
+      const bypass = Object.create(client);
+      const models = { ...client.$models };
+      for (const model of policied) {
+        const original = originals.get(model.name);
+        models[model.name] = original;
+        models[model.clientName] = original;
+        Object.defineProperty(bypass, model.clientName, { value: original, enumerable: true });
+      }
+      Object.defineProperty(bypass, "$models", { value: models, enumerable: true });
+      attachDefineView({ client: bypass, meta, models });
+      return bypass;
+    },
+    enumerable: true
+  });
+}
 // packages/runtime/src/client.ts
-import { VibeError as VibeError11, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
+import { VibeError as VibeError13, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
 import { ParamCollector, getSqlDialect } from "@vibeorm/sql";
 
 // packages/runtime/src/render-cache.ts
@@ -5951,7 +6294,7 @@ function renderStatementCached(params) {
 // packages/runtime/src/client.ts
 function notFound2(params) {
   const { model, method } = params;
-  return new VibeError11({
+  return new VibeError13({
     code: "VIBE_NOT_FOUND",
     message: `no ${model} record matched the where clause of ${method}()`,
     meta: { model, method }
@@ -5959,7 +6302,7 @@ function notFound2(params) {
 }
 function viewIsReadOnly(params) {
   const { model, method } = params;
-  return new VibeError11({
+  return new VibeError13({
     code: "VIBE_VALIDATION",
     message: `${model} is a view \u2014 ${method}() is not available on views (they are read-only); write to the underlying table instead`,
     meta: { model, method }
@@ -6088,7 +6431,7 @@ class QueryPromise extends Promise {
   }
   claim() {
     if (this.started) {
-      throw new VibeError11({
+      throw new VibeError13({
         code: "VIBE_VALIDATION",
         message: "$transaction([...]) needs operations that have not dispatched \u2014 pass delegate calls in the same tick they are created (this one was awaited or created earlier and already executed outside the transaction)"
       });
@@ -6166,7 +6509,7 @@ async function runAffected(params) {
 function plan(params) {
   const { engine, model, method, args } = params;
   if (args !== undefined && args["lock"] !== undefined && engine.inTransaction !== true) {
-    throw new VibeError11({
+    throw new VibeError13({
       code: "VIBE_VALIDATION",
       message: `lock on ${model}.${method}() requires a transaction \u2014 call it on the client $transaction hands its callback (outside one, the lock would release at statement end)`,
       meta: { model, method }
@@ -6239,7 +6582,7 @@ async function insertedKeyWhere(params) {
   });
   const id = result.rows[0]?.id;
   if (id === undefined || id === null) {
-    throw new VibeError11({
+    throw new VibeError13({
       code: "VIBE_INTERNAL",
       message: `could not read back the generated key for ${source.model.name}`,
       meta: { model: source.model.name }
@@ -6541,7 +6884,7 @@ function createDelegate(params) {
     const skipping = args.onConflict !== undefined;
     if (hasNestedWrites({ model: modelMeta, data: args.data })) {
       if (skipping) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_VALIDATION",
           message: `onConflict cannot combine with nested writes on ${modelMeta.name}.create() \u2014 insert the parent row alone, then connect relations`,
           meta: { model: modelMeta.name }
@@ -6625,7 +6968,7 @@ function createDelegate(params) {
   const upsert = async (target, args) => {
     const modelMeta = getModelMeta({ meta: target.meta, model });
     if (hasNestedWrites({ model: modelMeta, data: args.create }) || hasNestedWrites({ model: modelMeta, data: args.update })) {
-      throw new VibeError11({
+      throw new VibeError13({
         code: "VIBE_VALIDATION",
         message: `nested writes are not supported inside upsert arms on ${modelMeta.name} \u2014 use create()/update() with nested data`,
         meta: { model: modelMeta.name }
@@ -6633,7 +6976,7 @@ function createDelegate(params) {
     }
     if (!upsertUsesNativeStatement({ model: modelMeta, args })) {
       if (args.onConflict !== undefined) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_VALIDATION",
           message: `onConflict on ${modelMeta.name}.upsert() needs the native single-statement path \u2014 this shape (a guard field beyond the conflict target, or create data not binding the where's key) runs the find-then-write fallback, which cannot honor an explicit conflict target`,
           meta: { model: modelMeta.name }
@@ -6760,6 +7103,17 @@ function createDelegate(params) {
   const meta = getModelMeta({ meta: engine.meta, model });
   return meta.isView ? readOnlyDelegate({ delegate, model: meta.name }) : delegate;
 }
+var WRITE_METHODS = ["create", "createMany", "createManyAndReturn", "update", "updateMany", "upsert"];
+function withWriteValidation(params) {
+  const { engine, delegate, model, validators } = params;
+  const meta = getModelMeta({ meta: engine.meta, model });
+  const wrapped = { ...delegate };
+  for (const method of WRITE_METHODS) {
+    const original = delegate[method];
+    wrapped[method] = (args) => original(applyWriteValidators({ meta: engine.meta, model: meta, method, args, validators }));
+  }
+  return wrapped;
+}
 function buildRawStatement(params) {
   const { dialect, strings, values } = params;
   const collector = new ParamCollector(dialect);
@@ -6773,7 +7127,11 @@ function buildClient(params) {
   const { engine } = params;
   const models = {};
   for (const model of engine.meta.models) {
-    const delegate = createDelegate({ engine, model: model.name });
+    let delegate = createDelegate({ engine, model: model.name });
+    const validators = engine.options?.validate;
+    if (validators?.[model.name] !== undefined) {
+      delegate = withWriteValidation({ engine, delegate, model: model.name, validators });
+    }
     models[model.name] = delegate;
     models[model.clientName] = delegate;
   }
@@ -6795,7 +7153,7 @@ function buildClient(params) {
     let claimError = null;
     for (const operation of operations) {
       if (!(operation instanceof QueryPromise)) {
-        claimError = new VibeError11({
+        claimError = new VibeError13({
           code: "VIBE_VALIDATION",
           message: "$transaction([...]) takes query promises from model delegate calls \u2014 a foreign promise is already running and cannot join the transaction"
         });
@@ -6834,7 +7192,7 @@ function buildClient(params) {
     $models: models,
     $on: (event, listener) => {
       if (event !== "query") {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_VALIDATION",
           message: `unknown client event "${String(event)}" \u2014 supported: "query"`,
           meta: { event }
@@ -6868,6 +7226,7 @@ function buildClient(params) {
   }
   attachExtensionMounts({ engine, client, models });
   attachDefineView({ client, meta: engine.meta, models });
+  attachPolicy({ client, meta: engine.meta });
   return client;
 }
 function makeMountContext(params) {
@@ -6897,7 +7256,7 @@ function makeMountContext(params) {
     compileWhere: ({ where, model: modelName, qualify }) => {
       const target = modelName === undefined ? model : getModelMeta({ meta: engine.meta, model: modelName });
       if (target === null) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_INTERNAL",
           message: `extension "${extension}" compiled a where with no model in scope`,
           meta: { extension }
@@ -6923,7 +7282,7 @@ function attachExtensionMounts(params) {
       const model = getModelMeta({ meta: engine.meta, model: mount.model ?? "" });
       const delegate = models[model.name];
       if (delegate === undefined || mount.property in delegate) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_CONFIG",
           message: `extension "${mount.extension}" cannot mount "${mount.property}" on ${model.name} \u2014 the name is taken`,
           meta: { extension: mount.extension, model: model.name, property: mount.property }
@@ -6934,7 +7293,7 @@ function attachExtensionMounts(params) {
       continue;
     }
     if (!mount.property.startsWith("$") || mount.property in client) {
-      throw new VibeError11({
+      throw new VibeError13({
         code: "VIBE_CONFIG",
         message: `extension "${mount.extension}" cannot mount client property "${mount.property}" \u2014 root mounts are $-prefixed and must not collide`,
         meta: { extension: mount.extension, property: mount.property }
@@ -6954,7 +7313,7 @@ function createClient(params) {
     assertComputedManifest({ manifest: computed.manifest, specs: computed.specs });
   }
   if (computed === undefined && options !== undefined && options["computed"] !== undefined) {
-    throw new VibeError11({
+    throw new VibeError13({
       code: "VIBE_CONFIG",
       message: "this client was generated without computed fields \u2014 declare them in vibeorm.config.ts and re-run vibeorm generate",
       meta: {}
@@ -6982,6 +7341,7 @@ function createClient(params) {
   });
 }
 export {
+  validateWriteData,
   updateWithNested,
   toSqlExecutor,
   toClientName,
@@ -7017,10 +7377,12 @@ export {
   buildExtensionOperatorMap,
   buildConnectHooks,
   attachRelations,
+  attachPolicy,
   attachLateralRelations,
   attachDefineView,
   assertExtensionManifest,
   assertComputedManifest,
+  applyWriteValidators,
   applyComputedFields,
   ViewResult,
   SQLITE_CODECS,
@@ -7030,4 +7392,4 @@ export {
   COUNT_ALIAS
 };
 
-//# debugId=4B6B11C516D4A81A64756E2164756E21
+//# debugId=EC61C00B9601D9AD64756E2164756E21