@vibeorm/runtime 2.0.0-alpha.7 → 2.0.0-alpha.8

package/dist/client.d.ts

@@ -22,6 +22,8 @@ import type { RelationStrategy } from "./query-builder.ts";
 import type { ClientComputedOptions } from "./computed.ts";
 import type { ClientExtensionsOptions } from "./extensions.ts";
 import type { DefineViewFn } from "./views.ts";
+import type { WriteValidators } from "./validators.ts";
+import type { PolicyContextValue } from "./policy.ts";
 /** One executed statement, reported to `ClientOptions.onQuery`. */
 export type QueryEvent = {
     /** Model name, or `null` for raw queries. */
@@ -52,6 +54,13 @@ export type ClientOptions = {
      * v1 parity.
      */
     readonly distinctOrderByPk?: boolean;
+    /**
+     * Opt-in write-boundary validators (Standard Schema, per model × field):
+     * `{ User: { settings: zodSchema } }`. Run on every write path (nested
+     * creates included) before encoding; failure throws VIBE_VALIDATION with
+     * the validator's issues in `meta`. Reads are never taxed.
+     */
+    readonly validate?: WriteValidators;
 };
 /** Rows are plain objects keyed by field name; the generated client narrows them. */
 export type ClientRow = Record<string, unknown>;
@@ -128,6 +137,14 @@ export type DynamicClient = {
      * it is always present on a built client, transaction clients included.
      */
     readonly $defineView?: DefineViewFn;
+    /**
+     * Row scoping (@@policy): bind a per-request context — the returned client
+     * AND-s the policy predicate into every query on policied models and forces
+     * it into creates. Attached only when the schema declares @@policy.
+     */
+    readonly $withPolicy?: (context: Readonly<Record<string, PolicyContextValue>>) => DynamicClient;
+    /** Deliberate, greppable full-access escape from policy scoping. */
+    readonly $bypassPolicy?: () => DynamicClient;
 };
 /**
  * Build a client for a schema over an adapter.

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAMxE,OAAO,KAAK,EAAyC,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AAO7G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM3D,OAAO,KAAK,EAEV,uBAAuB,EAGxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,mEAAmE;AACnE,MAAM,MAAM,UAAU,GAAG;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACpF;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE;QACrB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,EAC3B,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAC3B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC;YAAE,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAAE,CAAC,CAAC;KACzD,CAAC;IACF,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClG,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/F,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;CACrC,CAAC;AAs4CF;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,4GAA4G;IAC5G,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC,GAAG,aAAa,CAyDhB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAMxE,OAAO,KAAK,EAAyC,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AAO7G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM3D,OAAO,KAAK,EAEV,uBAAuB,EAGxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAItD,mEAAmE;AACnE,MAAM,MAAM,UAAU,GAAG;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;CACrC,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACpF;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE;QACrB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,EAC3B,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAC3B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC;YAAE,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAAE,CAAC,CAAC;KACzD,CAAC;IACF,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClG,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/F,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,KAAK,aAAa,CAAC;IAChG,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,aAAa,CAAC;CAC9C,CAAC;AAo6CF;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,4GAA4G;IAC5G,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC,GAAG,aAAa,CAyDhB"}

package/dist/index.d.ts

@@ -25,6 +25,10 @@ export type { ClientComputedOptions } from "./computed.ts";
 export { assertExtensionManifest, buildConnectHooks, buildExtensionOperatorMap, } from "./extensions.ts";
 export type { ClientExtensionMount, ClientExtensionsOptions, ConnectHook, ExtensionMountContext, } from "./extensions.ts";
 export { ViewResult, attachDefineView, createView } from "./views.ts";
+export { applyWriteValidators, validateWriteData } from "./validators.ts";
+export type { StandardIssue, StandardSchemaV1, WriteValidators } from "./validators.ts";
+export { attachPolicy } from "./policy.ts";
+export type { PolicyContextValue } from "./policy.ts";
 export type { DefineViewFn, ViewClientShape, ViewDefinition, ViewModelDelegate } from "./views.ts";
 export { createClient } from "./client.ts";
 export type { BatchResult, ClientOptions, ClientRow, DynamicClient, ModelDelegate, QueryEvent, } from "./client.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EACV,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIzE,OAAO,EACL,WAAW,EACX,UAAU,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAI7D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIxE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAI3D,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,WAAW,EACX,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAInG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EACV,WAAW,EACX,aAAa,EACb,SAAS,EACT,aAAa,EACb,aAAa,EACb,UAAU,GACX,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EACV,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIzE,OAAO,EACL,WAAW,EACX,UAAU,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAI7D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIxE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAI3D,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,WAAW,EACX,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAItE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAInG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EACV,WAAW,EACX,aAAa,EACb,SAAS,EACT,aAAa,EACb,aAAa,EACb,UAAU,GACX,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -133,6 +133,7 @@ function buildFieldMeta(params) {
   return {
     name: field.name,
     columnName: field.dbName ?? field.name,
+    ...field.collation === undefined ? {} : { collation: field.collation },
     type: field.type,
     scalarType: enumRef ? null : field.type,
     enumName: enumRef ? field.type.enum : null,
@@ -231,6 +232,7 @@ function buildModelMeta(params) {
     singleIndexUniques,
     relations: model.relations,
     relationByName: new Map(model.relations.map((relation) => [relation.name, relation])),
+    ...model.policy === undefined ? {} : { policy: model.policy },
     isView: model.isView,
     computed
   };
@@ -1440,6 +1442,7 @@ function compileOperatorFilter(params) {
   }
   const insensitive = mode === "insensitive";
   const strict = mode === "strict";
+  const ciCollated = (params2) => params2.dialect.name === "mysql" && params2.field.collation?.toLowerCase().endsWith("_ci") === true;
   const requireStringOperand = (operator, operand) => {
     if (typeof operand !== "string") {
       throw validationError2({
@@ -1467,7 +1470,8 @@ function compileOperatorFilter(params) {
             kind: "like",
             column,
             pattern: escapeLikePattern({ raw: requireStringOperand("equals", operand) }),
-            insensitive: true
+            insensitive: true,
+            ...ciCollated({ dialect, field }) ? { ciCollation: true } : {}
           });
           break;
         }
@@ -1564,7 +1568,8 @@ function compileOperatorFilter(params) {
           kind: "like",
           column,
           pattern: compileStringPattern({ operator, operand, field, model }),
-          insensitive
+          insensitive,
+          ...insensitive && ciCollated({ dialect, field }) ? { ciCollation: true } : {}
         });
         break;
       }
@@ -5505,8 +5510,341 @@ function attachDefineView(params) {
   const value = (options) => createView({ meta, models, name: options.name, definition: options.definition });
   Object.defineProperty(client, "$defineView", { value, enumerable: true });
 }
+// packages/runtime/src/validators.ts
+import { VibeError as VibeError11 } from "@vibeorm/schema";
+function validationFailed(params) {
+  return new VibeError11({
+    code: "VIBE_VALIDATION",
+    message: `validation failed for ${params.model}.${params.field}: ${params.issues[0]?.message ?? "invalid value"}`,
+    meta: { model: params.model, field: params.field, issues: params.issues }
+  });
+}
+function validateValue(params) {
+  const result = params.schema["~standard"].validate(params.value);
+  if (result instanceof Promise) {
+    throw new VibeError11({
+      code: "VIBE_VALIDATION",
+      message: `async validator on ${params.model}.${params.field} \u2014 write validators must be synchronous (validate before calling the client for async rules)`,
+      meta: { model: params.model, field: params.field }
+    });
+  }
+  if (result.issues !== undefined) {
+    throw validationFailed({ model: params.model, field: params.field, issues: result.issues });
+  }
+  return result.value;
+}
+function validateWriteData(params) {
+  const { meta, model, data, validators } = params;
+  const fieldSchemas = validators[model.name];
+  const out = { ...data };
+  for (const [key, value] of Object.entries(data)) {
+    if (value === undefined)
+      continue;
+    const schema = fieldSchemas?.[key];
+    if (schema !== undefined) {
+      const isOperator = typeof value === "object" && value !== null && !Array.isArray(value) && "set" in value;
+      if (isOperator) {
+        const inner = value.set;
+        out[key] = { set: validateValue({ model: model.name, field: key, schema, value: inner }) };
+      } else {
+        out[key] = validateValue({ model: model.name, field: key, schema, value });
+      }
+      continue;
+    }
+    const relation = model.relationByName.get(key);
+    if (relation === undefined || typeof value !== "object" || value === null)
+      continue;
+    const target = meta.modelByName.get(relation.targetModel);
+    if (target === undefined || validators[target.name] === undefined)
+      continue;
+    const verbs = value;
+    const recurse = (row) => typeof row === "object" && row !== null ? validateWriteData({ meta, model: target, data: row, validators }) : row;
+    const next = { ...verbs };
+    if (verbs.create !== undefined) {
+      next.create = Array.isArray(verbs.create) ? verbs.create.map(recurse) : recurse(verbs.create);
+    }
+    if (verbs.connectOrCreate !== undefined) {
+      const entries = Array.isArray(verbs.connectOrCreate) ? verbs.connectOrCreate : [verbs.connectOrCreate];
+      const mapped = entries.map((entry) => {
+        const pair = entry;
+        return { ...pair, create: recurse(pair.create) };
+      });
+      next.connectOrCreate = Array.isArray(verbs.connectOrCreate) ? mapped : mapped[0];
+    }
+    if (verbs.update !== undefined && !Array.isArray(verbs.update)) {
+      const body = verbs.update;
+      next.update = body.data !== undefined ? { ...body, data: recurse(body.data) } : recurse(body);
+    }
+    if (verbs.upsert !== undefined && !Array.isArray(verbs.upsert)) {
+      const body = verbs.upsert;
+      next.upsert = { ...body, create: recurse(body.create), update: recurse(body.update) };
+    }
+    out[key] = next;
+  }
+  return out;
+}
+function applyWriteValidators(params) {
+  const { meta, model, method, args, validators } = params;
+  const validate = (row) => typeof row === "object" && row !== null ? validateWriteData({ meta, model, data: row, validators }) : row;
+  if (method === "create" || method === "update" || method === "updateMany") {
+    return args.data === undefined ? args : { ...args, data: validate(args.data) };
+  }
+  if (method === "createMany" || method === "createManyAndReturn") {
+    return Array.isArray(args.data) ? { ...args, data: args.data.map(validate) } : args;
+  }
+  if (method === "upsert") {
+    return { ...args, create: validate(args.create), update: validate(args.update) };
+  }
+  return args;
+}
+// packages/runtime/src/policy.ts
+import { VibeError as VibeError12 } from "@vibeorm/schema";
+function policyError(message, meta) {
+  return new VibeError12({ code: "VIBE_VALIDATION", message, meta: meta ?? {} });
+}
+function policiedModels(meta) {
+  return meta.models.filter((model) => model.policy !== undefined);
+}
+function mergeWhere(params) {
+  const { where, field, value } = params;
+  const predicate = { [field]: value };
+  return where === undefined ? predicate : { AND: [where, predicate] };
+}
+function uniqueToFilter(params) {
+  const out = {};
+  for (const [key, value] of Object.entries(params.where)) {
+    const isCompound = typeof value === "object" && value !== null && !Array.isArray(value) && params.model.compoundUniques.has(key);
+    if (isCompound)
+      Object.assign(out, value);
+    else
+      out[key] = value;
+  }
+  return out;
+}
+function scopeSelection(params) {
+  const { meta, model, args, context } = params;
+  const out = { ...args };
+  for (const key of ["include", "select"]) {
+    const block = args[key];
+    if (typeof block !== "object" || block === null)
+      continue;
+    const next = { ...block };
+    for (const [name, spec] of Object.entries(block)) {
+      const relation = model.relationByName.get(name);
+      if (relation === undefined)
+        continue;
+      const target = meta.modelByName.get(relation.targetModel);
+      if (target?.policy === undefined)
+        continue;
+      const value = context[target.policy.context];
+      const spec2 = spec === true ? {} : { ...spec };
+      spec2.where = mergeWhere({ where: spec2.where, field: target.policy.field, value });
+      next[name] = scopeSelection({ meta, model: target, args: spec2, context });
+    }
+    out[key] = next;
+  }
+  return out;
+}
+var REFERENCE_VERBS = ["connect", "connectOrCreate", "set", "disconnect", "update", "updateMany", "delete", "deleteMany", "upsert"];
+function forceCreateData(params) {
+  const { meta, model, data, context } = params;
+  const out = { ...data };
+  if (model.policy !== undefined) {
+    const value = context[model.policy.context];
+    const given = data[model.policy.field];
+    if (given !== undefined && given !== value) {
+      throw policyError(`create on ${model.name}: data.${model.policy.field} conflicts with the bound policy context`, { model: model.name, field: model.policy.field });
+    }
+    out[model.policy.field] = value;
+  }
+  for (const [name, spec] of Object.entries(data)) {
+    const relation = model.relationByName.get(name);
+    if (relation === undefined || typeof spec !== "object" || spec === null)
+      continue;
+    const target = meta.modelByName.get(relation.targetModel);
+    if (target?.policy === undefined)
+      continue;
+    const verbs = spec;
+    for (const verb of REFERENCE_VERBS) {
+      if (verbs[verb] !== undefined) {
+        throw policyError(`nested ${verb} on policied model ${target.name} is not policy-safe from a scoped client \u2014 perform it in an explicit $transaction on the scoped delegate`, { model: model.name, relation: name, verb });
+      }
+    }
+    if (verbs.create !== undefined) {
+      const recurse = (row) => forceCreateData({ meta, model: target, data: row, context });
+      out[name] = { ...verbs, create: Array.isArray(verbs.create) ? verbs.create.map(recurse) : recurse(verbs.create) };
+    }
+  }
+  return out;
+}
+function scopedDelegate(params) {
+  const { meta, model, base, context, transaction } = params;
+  const policy = model.policy;
+  const value = context[policy.context];
+  const pk = model.primaryKey.map((field) => field.name);
+  const scopeFind = (args) => {
+    const scoped = scopeSelection({ meta, model, args: args ?? {}, context });
+    return { ...scoped, where: mergeWhere({ where: scoped.where, field: policy.field, value }) };
+  };
+  const scopeUnique = (args) => {
+    const scoped = scopeSelection({ meta, model, args, context });
+    const flat = uniqueToFilter({ model, where: args.where ?? {} });
+    return { ...scoped, where: mergeWhere({ where: flat, field: policy.field, value }) };
+  };
+  const pkClientKey = () => {
+    for (const [key, group] of model.compoundUniques) {
+      const names = group.fields.map((field) => field.name);
+      if (names.length === pk.length && names.every((name) => pk.includes(name)))
+        return key;
+    }
+    return pk.join("_");
+  };
+  const lockThen = (args, write) => transaction(async (tx) => {
+    const raw = tx.$bypassPolicy === undefined ? tx : tx.$bypassPolicy();
+    const target = await raw.$models[model.name].findFirst({
+      where: scopeUnique(args).where,
+      select: Object.fromEntries(pk.map((name) => [name, true])),
+      lock: "update"
+    });
+    if (target === null)
+      return null;
+    const pkWhere = pk.length === 1 ? { [pk[0]]: target[pk[0]] } : { [pkClientKey()]: Object.fromEntries(pk.map((name) => [name, target[name]])) };
+    return write(raw, pkWhere);
+  });
+  const notFound2 = (method) => new VibeError12({ code: "VIBE_NOT_FOUND", message: `${method} on ${model.name}: no row matches the unique where inside the bound policy context`, meta: { model: model.name, method } });
+  return {
+    findMany: (args) => base.findMany(scopeFind(args)),
+    findFirst: (args) => base.findFirst(scopeFind(args)),
+    findFirstOrThrow: (args) => base.findFirstOrThrow(scopeFind(args)),
+    findUnique: (args) => base.findFirst(scopeUnique(args)),
+    findUniqueOrThrow: (args) => base.findFirstOrThrow(scopeUnique(args)),
+    create: async (args) => base.create({ ...args, data: forceCreateData({ meta, model, data: args.data ?? {}, context }) }),
+    createMany: async (args) => base.createMany({
+      ...args,
+      data: (args.data ?? []).map((row) => forceCreateData({ meta, model, data: row, context }))
+    }),
+    createManyAndReturn: async (args) => base.createManyAndReturn({
+      ...args,
+      data: (args.data ?? []).map((row) => forceCreateData({ meta, model, data: row, context }))
+    }),
+    update: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].update({ ...args, where: pkWhere }));
+      if (row === null)
+        throw notFound2("update");
+      return row;
+    },
+    updateMany: (args) => base.updateMany({ ...args, where: mergeWhere({ where: args.where, field: policy.field, value }) }),
+    upsert: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].update({ where: pkWhere, data: args.update, ...args.select === undefined ? {} : { select: args.select } }));
+      if (row !== null)
+        return row;
+      return await base.create({
+        data: forceCreateData({ meta, model, data: args.create ?? {}, context }),
+        ...args.select === undefined ? {} : { select: args.select }
+      });
+    },
+    delete: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].delete({ ...args, where: pkWhere }));
+      if (row === null)
+        throw notFound2("delete");
+      return row;
+    },
+    deleteMany: (args) => base.deleteMany({ ...args ?? {}, where: mergeWhere({ where: args?.where, field: policy.field, value }) }),
+    count: (args) => base.count(scopeFind(args)),
+    aggregate: (args) => base.aggregate(scopeFind(args)),
+    groupBy: (args) => base.groupBy(scopeFind(args))
+  };
+}
+function scopeExtensionProps(params) {
+  const out = {};
+  for (const [key, prop] of Object.entries(params.base)) {
+    if (key in params.delegate)
+      continue;
+    if (typeof prop === "function") {
+      out[key] = (args) => prop({ ...args ?? {}, where: mergeWhere({ where: args?.where, field: params.field, value: params.value }) });
+    } else if (typeof prop === "object" && prop !== null) {
+      out[key] = scopeExtensionProps({ base: prop, delegate: {}, field: params.field, value: params.value });
+    }
+  }
+  return out;
+}
+function attachPolicy(params) {
+  const { client, meta } = params;
+  const policied = policiedModels(meta);
+  if (policied.length === 0)
+    return;
+  const originals = new Map;
+  for (const model of policied) {
+    const original = client.$models[model.name];
+    originals.set(model.name, { ...original });
+    const guard = (method) => () => Promise.reject(policyError(`model ${model.name} declares @@policy \u2014 bind a context with $withPolicy({ ${model.policy?.context}: ... }) or bypass deliberately with $bypassPolicy()`, { model: model.name, method }));
+    const guarded = {};
+    for (const key of Object.keys(original)) {
+      guarded[key] = typeof original[key] === "function" ? guard(key) : original[key];
+    }
+    Object.assign(original, guarded);
+  }
+  const buildScoped = (context) => {
+    for (const model of policied) {
+      const key = model.policy?.context;
+      if (context[key] === undefined || context[key] === null) {
+        throw policyError(`$withPolicy: missing context value "${key}" (required by ${model.name})`, { context: key });
+      }
+    }
+    const scoped = Object.create(client);
+    const scopedModels = { ...client.$models };
+    for (const model of policied) {
+      const base = originals.get(model.name);
+      const value = context[model.policy?.context];
+      const delegate = scopedDelegate({ meta, model, base, context, transaction: client.$transaction });
+      const full = { ...delegate, ...scopeExtensionProps({ base, delegate, field: model.policy?.field, value }) };
+      scopedModels[model.name] = full;
+      scopedModels[model.clientName] = full;
+      Object.defineProperty(scoped, model.clientName, { value: full, enumerable: true });
+    }
+    Object.defineProperty(scoped, "$models", { value: scopedModels, enumerable: true });
+    attachDefineView({ client: scoped, meta, models: scopedModels });
+    Object.defineProperty(scoped, "$transaction", {
+      value: (arg, options) => typeof arg === "function" ? client.$transaction((tx) => arg(buildScopedOver(tx, context)), options) : client.$transaction(arg, options),
+      enumerable: true
+    });
+    return scoped;
+  };
+  const buildScopedOver = (tx, context) => {
+    const rawTx = tx.$bypassPolicy === undefined ? tx : tx.$bypassPolicy();
+    const inner = Object.create(tx);
+    const scopedModels = { ...tx.$models };
+    for (const model of policied) {
+      const base = rawTx.$models[model.name];
+      const delegate = scopedDelegate({ meta, model, base, context, transaction: tx.$transaction });
+      scopedModels[model.name] = delegate;
+      scopedModels[model.clientName] = delegate;
+      Object.defineProperty(inner, model.clientName, { value: delegate, enumerable: true });
+    }
+    Object.defineProperty(inner, "$models", { value: scopedModels, enumerable: true });
+    attachDefineView({ client: inner, meta, models: scopedModels });
+    return inner;
+  };
+  Object.defineProperty(client, "$withPolicy", { value: (context) => buildScoped(context), enumerable: true });
+  Object.defineProperty(client, "$bypassPolicy", {
+    value: () => {
+      const bypass = Object.create(client);
+      const models = { ...client.$models };
+      for (const model of policied) {
+        const original = originals.get(model.name);
+        models[model.name] = original;
+        models[model.clientName] = original;
+        Object.defineProperty(bypass, model.clientName, { value: original, enumerable: true });
+      }
+      Object.defineProperty(bypass, "$models", { value: models, enumerable: true });
+      attachDefineView({ client: bypass, meta, models });
+      return bypass;
+    },
+    enumerable: true
+  });
+}
 // packages/runtime/src/client.ts
-import { VibeError as VibeError11, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
+import { VibeError as VibeError13, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
 import { ParamCollector, getSqlDialect } from "@vibeorm/sql";
 
 // packages/runtime/src/render-cache.ts
@@ -5956,7 +6294,7 @@ function renderStatementCached(params) {
 // packages/runtime/src/client.ts
 function notFound2(params) {
   const { model, method } = params;
-  return new VibeError11({
+  return new VibeError13({
     code: "VIBE_NOT_FOUND",
     message: `no ${model} record matched the where clause of ${method}()`,
     meta: { model, method }
@@ -5964,7 +6302,7 @@ function notFound2(params) {
 }
 function viewIsReadOnly(params) {
   const { model, method } = params;
-  return new VibeError11({
+  return new VibeError13({
     code: "VIBE_VALIDATION",
     message: `${model} is a view \u2014 ${method}() is not available on views (they are read-only); write to the underlying table instead`,
     meta: { model, method }
@@ -6093,7 +6431,7 @@ class QueryPromise extends Promise {
   }
   claim() {
     if (this.started) {
-      throw new VibeError11({
+      throw new VibeError13({
         code: "VIBE_VALIDATION",
         message: "$transaction([...]) needs operations that have not dispatched \u2014 pass delegate calls in the same tick they are created (this one was awaited or created earlier and already executed outside the transaction)"
       });
@@ -6171,7 +6509,7 @@ async function runAffected(params) {
 function plan(params) {
   const { engine, model, method, args } = params;
   if (args !== undefined && args["lock"] !== undefined && engine.inTransaction !== true) {
-    throw new VibeError11({
+    throw new VibeError13({
       code: "VIBE_VALIDATION",
       message: `lock on ${model}.${method}() requires a transaction \u2014 call it on the client $transaction hands its callback (outside one, the lock would release at statement end)`,
       meta: { model, method }
@@ -6244,7 +6582,7 @@ async function insertedKeyWhere(params) {
   });
   const id = result.rows[0]?.id;
   if (id === undefined || id === null) {
-    throw new VibeError11({
+    throw new VibeError13({
       code: "VIBE_INTERNAL",
       message: `could not read back the generated key for ${source.model.name}`,
       meta: { model: source.model.name }
@@ -6546,7 +6884,7 @@ function createDelegate(params) {
     const skipping = args.onConflict !== undefined;
     if (hasNestedWrites({ model: modelMeta, data: args.data })) {
       if (skipping) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_VALIDATION",
           message: `onConflict cannot combine with nested writes on ${modelMeta.name}.create() \u2014 insert the parent row alone, then connect relations`,
           meta: { model: modelMeta.name }
@@ -6630,7 +6968,7 @@ function createDelegate(params) {
   const upsert = async (target, args) => {
     const modelMeta = getModelMeta({ meta: target.meta, model });
     if (hasNestedWrites({ model: modelMeta, data: args.create }) || hasNestedWrites({ model: modelMeta, data: args.update })) {
-      throw new VibeError11({
+      throw new VibeError13({
         code: "VIBE_VALIDATION",
         message: `nested writes are not supported inside upsert arms on ${modelMeta.name} \u2014 use create()/update() with nested data`,
         meta: { model: modelMeta.name }
@@ -6638,7 +6976,7 @@ function createDelegate(params) {
     }
     if (!upsertUsesNativeStatement({ model: modelMeta, args })) {
       if (args.onConflict !== undefined) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_VALIDATION",
           message: `onConflict on ${modelMeta.name}.upsert() needs the native single-statement path \u2014 this shape (a guard field beyond the conflict target, or create data not binding the where's key) runs the find-then-write fallback, which cannot honor an explicit conflict target`,
           meta: { model: modelMeta.name }
@@ -6765,6 +7103,17 @@ function createDelegate(params) {
   const meta = getModelMeta({ meta: engine.meta, model });
   return meta.isView ? readOnlyDelegate({ delegate, model: meta.name }) : delegate;
 }
+var WRITE_METHODS = ["create", "createMany", "createManyAndReturn", "update", "updateMany", "upsert"];
+function withWriteValidation(params) {
+  const { engine, delegate, model, validators } = params;
+  const meta = getModelMeta({ meta: engine.meta, model });
+  const wrapped = { ...delegate };
+  for (const method of WRITE_METHODS) {
+    const original = delegate[method];
+    wrapped[method] = (args) => original(applyWriteValidators({ meta: engine.meta, model: meta, method, args, validators }));
+  }
+  return wrapped;
+}
 function buildRawStatement(params) {
   const { dialect, strings, values } = params;
   const collector = new ParamCollector(dialect);
@@ -6778,7 +7127,11 @@ function buildClient(params) {
   const { engine } = params;
   const models = {};
   for (const model of engine.meta.models) {
-    const delegate = createDelegate({ engine, model: model.name });
+    let delegate = createDelegate({ engine, model: model.name });
+    const validators = engine.options?.validate;
+    if (validators?.[model.name] !== undefined) {
+      delegate = withWriteValidation({ engine, delegate, model: model.name, validators });
+    }
     models[model.name] = delegate;
     models[model.clientName] = delegate;
   }
@@ -6800,7 +7153,7 @@ function buildClient(params) {
     let claimError = null;
     for (const operation of operations) {
       if (!(operation instanceof QueryPromise)) {
-        claimError = new VibeError11({
+        claimError = new VibeError13({
           code: "VIBE_VALIDATION",
           message: "$transaction([...]) takes query promises from model delegate calls \u2014 a foreign promise is already running and cannot join the transaction"
         });
@@ -6839,7 +7192,7 @@ function buildClient(params) {
     $models: models,
     $on: (event, listener) => {
       if (event !== "query") {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_VALIDATION",
           message: `unknown client event "${String(event)}" \u2014 supported: "query"`,
           meta: { event }
@@ -6873,6 +7226,7 @@ function buildClient(params) {
   }
   attachExtensionMounts({ engine, client, models });
   attachDefineView({ client, meta: engine.meta, models });
+  attachPolicy({ client, meta: engine.meta });
   return client;
 }
 function makeMountContext(params) {
@@ -6902,7 +7256,7 @@ function makeMountContext(params) {
     compileWhere: ({ where, model: modelName, qualify }) => {
       const target = modelName === undefined ? model : getModelMeta({ meta: engine.meta, model: modelName });
       if (target === null) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_INTERNAL",
           message: `extension "${extension}" compiled a where with no model in scope`,
           meta: { extension }
@@ -6928,7 +7282,7 @@ function attachExtensionMounts(params) {
       const model = getModelMeta({ meta: engine.meta, model: mount.model ?? "" });
       const delegate = models[model.name];
       if (delegate === undefined || mount.property in delegate) {
-        throw new VibeError11({
+        throw new VibeError13({
           code: "VIBE_CONFIG",
           message: `extension "${mount.extension}" cannot mount "${mount.property}" on ${model.name} \u2014 the name is taken`,
           meta: { extension: mount.extension, model: model.name, property: mount.property }
@@ -6939,7 +7293,7 @@ function attachExtensionMounts(params) {
       continue;
     }
     if (!mount.property.startsWith("$") || mount.property in client) {
-      throw new VibeError11({
+      throw new VibeError13({
         code: "VIBE_CONFIG",
         message: `extension "${mount.extension}" cannot mount client property "${mount.property}" \u2014 root mounts are $-prefixed and must not collide`,
         meta: { extension: mount.extension, property: mount.property }
@@ -6959,7 +7313,7 @@ function createClient(params) {
     assertComputedManifest({ manifest: computed.manifest, specs: computed.specs });
   }
   if (computed === undefined && options !== undefined && options["computed"] !== undefined) {
-    throw new VibeError11({
+    throw new VibeError13({
       code: "VIBE_CONFIG",
       message: "this client was generated without computed fields \u2014 declare them in vibeorm.config.ts and re-run vibeorm generate",
       meta: {}
@@ -6987,6 +7341,7 @@ function createClient(params) {
   });
 }
 export {
+  validateWriteData,
   updateWithNested,
   toSqlExecutor,
   toClientName,
@@ -7022,10 +7377,12 @@ export {
   buildExtensionOperatorMap,
   buildConnectHooks,
   attachRelations,
+  attachPolicy,
   attachLateralRelations,
   attachDefineView,
   assertExtensionManifest,
   assertComputedManifest,
+  applyWriteValidators,
   applyComputedFields,
   ViewResult,
   SQLITE_CODECS,
@@ -7035,4 +7392,4 @@ export {
   COUNT_ALIAS
 };
 
-//# debugId=96AA73705B84E72364756E2164756E21
+//# debugId=EC61C00B9601D9AD64756E2164756E21