@vibeorm/runtime 2.0.0-alpha.7 → 2.0.0-alpha.9

package/dist/index.js

@@ -133,6 +133,7 @@ function buildFieldMeta(params) {
   return {
     name: field.name,
     columnName: field.dbName ?? field.name,
+    ...field.collation === undefined ? {} : { collation: field.collation },
     type: field.type,
     scalarType: enumRef ? null : field.type,
     enumName: enumRef ? field.type.enum : null,
@@ -231,6 +232,7 @@ function buildModelMeta(params) {
     singleIndexUniques,
     relations: model.relations,
     relationByName: new Map(model.relations.map((relation) => [relation.name, relation])),
+    ...model.policy === undefined ? {} : { policy: model.policy },
     isView: model.isView,
     computed
   };
@@ -1440,6 +1442,7 @@ function compileOperatorFilter(params) {
   }
   const insensitive = mode === "insensitive";
   const strict = mode === "strict";
+  const ciCollated = (params2) => params2.dialect.name === "mysql" && params2.field.collation?.toLowerCase().endsWith("_ci") === true;
   const requireStringOperand = (operator, operand) => {
     if (typeof operand !== "string") {
       throw validationError2({
@@ -1467,7 +1470,8 @@ function compileOperatorFilter(params) {
             kind: "like",
             column,
             pattern: escapeLikePattern({ raw: requireStringOperand("equals", operand) }),
-            insensitive: true
+            insensitive: true,
+            ...ciCollated({ dialect, field }) ? { ciCollation: true } : {}
           });
           break;
         }
@@ -1564,7 +1568,8 @@ function compileOperatorFilter(params) {
           kind: "like",
           column,
           pattern: compileStringPattern({ operator, operand, field, model }),
-          insensitive
+          insensitive,
+          ...insensitive && ciCollated({ dialect, field }) ? { ciCollation: true } : {}
         });
         break;
       }
@@ -5505,8 +5510,1272 @@ function attachDefineView(params) {
   const value = (options) => createView({ meta, models, name: options.name, definition: options.definition });
   Object.defineProperty(client, "$defineView", { value, enumerable: true });
 }
+// packages/runtime/src/validators.ts
+import { VibeError as VibeError11 } from "@vibeorm/schema";
+function validationFailed(params) {
+  return new VibeError11({
+    code: "VIBE_VALIDATION",
+    message: `validation failed for ${params.model}.${params.field}: ${params.issues[0]?.message ?? "invalid value"}`,
+    meta: { model: params.model, field: params.field, issues: params.issues }
+  });
+}
+function validateValue(params) {
+  const result = params.schema["~standard"].validate(params.value);
+  if (result instanceof Promise) {
+    throw new VibeError11({
+      code: "VIBE_VALIDATION",
+      message: `async validator on ${params.model}.${params.field} \u2014 write validators must be synchronous (validate before calling the client for async rules)`,
+      meta: { model: params.model, field: params.field }
+    });
+  }
+  if (result.issues !== undefined) {
+    throw validationFailed({ model: params.model, field: params.field, issues: result.issues });
+  }
+  return result.value;
+}
+function validateWriteData(params) {
+  const { meta, model, data, validators } = params;
+  const fieldSchemas = validators[model.name];
+  const out = { ...data };
+  for (const [key, value] of Object.entries(data)) {
+    if (value === undefined)
+      continue;
+    const schema = fieldSchemas?.[key];
+    if (schema !== undefined) {
+      const isOperator = typeof value === "object" && value !== null && !Array.isArray(value) && "set" in value;
+      if (isOperator) {
+        const inner = value.set;
+        out[key] = { set: validateValue({ model: model.name, field: key, schema, value: inner }) };
+      } else {
+        out[key] = validateValue({ model: model.name, field: key, schema, value });
+      }
+      continue;
+    }
+    const relation = model.relationByName.get(key);
+    if (relation === undefined || typeof value !== "object" || value === null)
+      continue;
+    const target = meta.modelByName.get(relation.targetModel);
+    if (target === undefined || validators[target.name] === undefined)
+      continue;
+    const verbs = value;
+    const recurse = (row) => typeof row === "object" && row !== null ? validateWriteData({ meta, model: target, data: row, validators }) : row;
+    const next = { ...verbs };
+    if (verbs.create !== undefined) {
+      next.create = Array.isArray(verbs.create) ? verbs.create.map(recurse) : recurse(verbs.create);
+    }
+    if (verbs.connectOrCreate !== undefined) {
+      const entries = Array.isArray(verbs.connectOrCreate) ? verbs.connectOrCreate : [verbs.connectOrCreate];
+      const mapped = entries.map((entry) => {
+        const pair = entry;
+        return { ...pair, create: recurse(pair.create) };
+      });
+      next.connectOrCreate = Array.isArray(verbs.connectOrCreate) ? mapped : mapped[0];
+    }
+    if (verbs.update !== undefined && !Array.isArray(verbs.update)) {
+      const body = verbs.update;
+      next.update = body.data !== undefined ? { ...body, data: recurse(body.data) } : recurse(body);
+    }
+    if (verbs.upsert !== undefined && !Array.isArray(verbs.upsert)) {
+      const body = verbs.upsert;
+      next.upsert = { ...body, create: recurse(body.create), update: recurse(body.update) };
+    }
+    out[key] = next;
+  }
+  return out;
+}
+function applyWriteValidators(params) {
+  const { meta, model, method, args, validators } = params;
+  const validate = (row) => typeof row === "object" && row !== null ? validateWriteData({ meta, model, data: row, validators }) : row;
+  if (method === "create" || method === "update" || method === "updateMany") {
+    return args.data === undefined ? args : { ...args, data: validate(args.data) };
+  }
+  if (method === "createMany" || method === "createManyAndReturn") {
+    return Array.isArray(args.data) ? { ...args, data: args.data.map(validate) } : args;
+  }
+  if (method === "upsert") {
+    return { ...args, create: validate(args.create), update: validate(args.update) };
+  }
+  return args;
+}
+// packages/runtime/src/policy.ts
+import { VibeError as VibeError12 } from "@vibeorm/schema";
+function policyError(message, meta) {
+  return new VibeError12({ code: "VIBE_VALIDATION", message, meta: meta ?? {} });
+}
+function policiedModels(meta) {
+  return meta.models.filter((model) => model.policy !== undefined);
+}
+function mergeWhere(params) {
+  const { where, field, value } = params;
+  const predicate = { [field]: value };
+  return where === undefined ? predicate : { AND: [where, predicate] };
+}
+function uniqueToFilter(params) {
+  const out = {};
+  for (const [key, value] of Object.entries(params.where)) {
+    const isCompound = typeof value === "object" && value !== null && !Array.isArray(value) && params.model.compoundUniques.has(key);
+    if (isCompound)
+      Object.assign(out, value);
+    else
+      out[key] = value;
+  }
+  return out;
+}
+function scopeSelection(params) {
+  const { meta, model, args, context } = params;
+  const out = { ...args };
+  for (const key of ["include", "select"]) {
+    const block = args[key];
+    if (typeof block !== "object" || block === null)
+      continue;
+    const next = { ...block };
+    for (const [name, spec] of Object.entries(block)) {
+      const relation = model.relationByName.get(name);
+      if (relation === undefined)
+        continue;
+      const target = meta.modelByName.get(relation.targetModel);
+      if (target?.policy === undefined)
+        continue;
+      const value = context[target.policy.context];
+      const spec2 = spec === true ? {} : { ...spec };
+      spec2.where = mergeWhere({ where: spec2.where, field: target.policy.field, value });
+      next[name] = scopeSelection({ meta, model: target, args: spec2, context });
+    }
+    out[key] = next;
+  }
+  return out;
+}
+var REFERENCE_VERBS = ["connect", "connectOrCreate", "set", "disconnect", "update", "updateMany", "delete", "deleteMany", "upsert"];
+function forceCreateData(params) {
+  const { meta, model, data, context } = params;
+  const out = { ...data };
+  if (model.policy !== undefined) {
+    const value = context[model.policy.context];
+    const given = data[model.policy.field];
+    if (given !== undefined && given !== value) {
+      throw policyError(`create on ${model.name}: data.${model.policy.field} conflicts with the bound policy context`, { model: model.name, field: model.policy.field });
+    }
+    out[model.policy.field] = value;
+  }
+  for (const [name, spec] of Object.entries(data)) {
+    const relation = model.relationByName.get(name);
+    if (relation === undefined || typeof spec !== "object" || spec === null)
+      continue;
+    const target = meta.modelByName.get(relation.targetModel);
+    if (target?.policy === undefined)
+      continue;
+    const verbs = spec;
+    for (const verb of REFERENCE_VERBS) {
+      if (verbs[verb] !== undefined) {
+        throw policyError(`nested ${verb} on policied model ${target.name} is not policy-safe from a scoped client \u2014 perform it in an explicit $transaction on the scoped delegate`, { model: model.name, relation: name, verb });
+      }
+    }
+    if (verbs.create !== undefined) {
+      const recurse = (row) => forceCreateData({ meta, model: target, data: row, context });
+      out[name] = { ...verbs, create: Array.isArray(verbs.create) ? verbs.create.map(recurse) : recurse(verbs.create) };
+    }
+  }
+  return out;
+}
+function scopedDelegate(params) {
+  const { meta, model, base, context, transaction } = params;
+  const policy = model.policy;
+  const value = context[policy.context];
+  const pk = model.primaryKey.map((field) => field.name);
+  const scopeFind = (args) => {
+    const scoped = scopeSelection({ meta, model, args: args ?? {}, context });
+    return { ...scoped, where: mergeWhere({ where: scoped.where, field: policy.field, value }) };
+  };
+  const scopeUnique = (args) => {
+    const scoped = scopeSelection({ meta, model, args, context });
+    const flat = uniqueToFilter({ model, where: args.where ?? {} });
+    return { ...scoped, where: mergeWhere({ where: flat, field: policy.field, value }) };
+  };
+  const pkClientKey = () => {
+    for (const [key, group] of model.compoundUniques) {
+      const names = group.fields.map((field) => field.name);
+      if (names.length === pk.length && names.every((name) => pk.includes(name)))
+        return key;
+    }
+    return pk.join("_");
+  };
+  const lockThen = (args, write) => transaction(async (tx) => {
+    const raw = tx.$bypassPolicy === undefined ? tx : tx.$bypassPolicy();
+    const target = await raw.$models[model.name].findFirst({
+      where: scopeUnique(args).where,
+      select: Object.fromEntries(pk.map((name) => [name, true])),
+      lock: "update"
+    });
+    if (target === null)
+      return null;
+    const pkWhere = pk.length === 1 ? { [pk[0]]: target[pk[0]] } : { [pkClientKey()]: Object.fromEntries(pk.map((name) => [name, target[name]])) };
+    return write(raw, pkWhere);
+  });
+  const notFound2 = (method) => new VibeError12({ code: "VIBE_NOT_FOUND", message: `${method} on ${model.name}: no row matches the unique where inside the bound policy context`, meta: { model: model.name, method } });
+  return {
+    findMany: (args) => base.findMany(scopeFind(args)),
+    findFirst: (args) => base.findFirst(scopeFind(args)),
+    findFirstOrThrow: (args) => base.findFirstOrThrow(scopeFind(args)),
+    findUnique: (args) => base.findFirst(scopeUnique(args)),
+    findUniqueOrThrow: (args) => base.findFirstOrThrow(scopeUnique(args)),
+    create: async (args) => base.create({ ...args, data: forceCreateData({ meta, model, data: args.data ?? {}, context }) }),
+    createMany: async (args) => base.createMany({
+      ...args,
+      data: (args.data ?? []).map((row) => forceCreateData({ meta, model, data: row, context }))
+    }),
+    createManyAndReturn: async (args) => base.createManyAndReturn({
+      ...args,
+      data: (args.data ?? []).map((row) => forceCreateData({ meta, model, data: row, context }))
+    }),
+    update: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].update({ ...args, where: pkWhere }));
+      if (row === null)
+        throw notFound2("update");
+      return row;
+    },
+    updateMany: (args) => base.updateMany({ ...args, where: mergeWhere({ where: args.where, field: policy.field, value }) }),
+    upsert: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].update({ where: pkWhere, data: args.update, ...args.select === undefined ? {} : { select: args.select } }));
+      if (row !== null)
+        return row;
+      return await base.create({
+        data: forceCreateData({ meta, model, data: args.create ?? {}, context }),
+        ...args.select === undefined ? {} : { select: args.select }
+      });
+    },
+    delete: async (args) => {
+      const row = await lockThen(args, (raw, pkWhere) => raw.$models[model.name].delete({ ...args, where: pkWhere }));
+      if (row === null)
+        throw notFound2("delete");
+      return row;
+    },
+    deleteMany: (args) => base.deleteMany({ ...args ?? {}, where: mergeWhere({ where: args?.where, field: policy.field, value }) }),
+    count: (args) => base.count(scopeFind(args)),
+    aggregate: (args) => base.aggregate(scopeFind(args)),
+    groupBy: (args) => base.groupBy(scopeFind(args))
+  };
+}
+function scopeExtensionProps(params) {
+  const out = {};
+  for (const [key, prop] of Object.entries(params.base)) {
+    if (key in params.delegate)
+      continue;
+    if (typeof prop === "function") {
+      out[key] = (args) => prop({ ...args ?? {}, where: mergeWhere({ where: args?.where, field: params.field, value: params.value }) });
+    } else if (typeof prop === "object" && prop !== null) {
+      out[key] = scopeExtensionProps({ base: prop, delegate: {}, field: params.field, value: params.value });
+    }
+  }
+  return out;
+}
+function attachPolicy(params) {
+  const { client, meta } = params;
+  const policied = policiedModels(meta);
+  if (policied.length === 0)
+    return;
+  const originals = new Map;
+  for (const model of policied) {
+    const original = client.$models[model.name];
+    originals.set(model.name, { ...original });
+    const guard = (method) => () => Promise.reject(policyError(`model ${model.name} declares @@policy \u2014 bind a context with $withPolicy({ ${model.policy?.context}: ... }) or bypass deliberately with $bypassPolicy()`, { model: model.name, method }));
+    const guarded = {};
+    for (const key of Object.keys(original)) {
+      guarded[key] = typeof original[key] === "function" ? guard(key) : original[key];
+    }
+    Object.assign(original, guarded);
+  }
+  const buildScoped = (context) => {
+    for (const model of policied) {
+      const key = model.policy?.context;
+      if (context[key] === undefined || context[key] === null) {
+        throw policyError(`$withPolicy: missing context value "${key}" (required by ${model.name})`, { context: key });
+      }
+    }
+    const scoped = Object.create(client);
+    const scopedModels = { ...client.$models };
+    for (const model of policied) {
+      const base = originals.get(model.name);
+      const value = context[model.policy?.context];
+      const delegate = scopedDelegate({ meta, model, base, context, transaction: client.$transaction });
+      const full = { ...delegate, ...scopeExtensionProps({ base, delegate, field: model.policy?.field, value }) };
+      scopedModels[model.name] = full;
+      scopedModels[model.clientName] = full;
+      Object.defineProperty(scoped, model.clientName, { value: full, enumerable: true });
+    }
+    Object.defineProperty(scoped, "$models", { value: scopedModels, enumerable: true });
+    attachDefineView({ client: scoped, meta, models: scopedModels });
+    Object.defineProperty(scoped, "$transaction", {
+      value: (arg, options) => typeof arg === "function" ? client.$transaction((tx) => arg(buildScopedOver(tx, context)), options) : client.$transaction(arg, options),
+      enumerable: true
+    });
+    return scoped;
+  };
+  const buildScopedOver = (tx, context) => {
+    const rawTx = tx.$bypassPolicy === undefined ? tx : tx.$bypassPolicy();
+    const inner = Object.create(tx);
+    const scopedModels = { ...tx.$models };
+    for (const model of policied) {
+      const base = rawTx.$models[model.name];
+      const delegate = scopedDelegate({ meta, model, base, context, transaction: tx.$transaction });
+      scopedModels[model.name] = delegate;
+      scopedModels[model.clientName] = delegate;
+      Object.defineProperty(inner, model.clientName, { value: delegate, enumerable: true });
+    }
+    Object.defineProperty(inner, "$models", { value: scopedModels, enumerable: true });
+    attachDefineView({ client: inner, meta, models: scopedModels });
+    return inner;
+  };
+  Object.defineProperty(client, "$withPolicy", { value: (context) => buildScoped(context), enumerable: true });
+  Object.defineProperty(client, "$bypassPolicy", {
+    value: () => {
+      const bypass = Object.create(client);
+      const models = { ...client.$models };
+      for (const model of policied) {
+        const original = originals.get(model.name);
+        models[model.name] = original;
+        models[model.clientName] = original;
+        Object.defineProperty(bypass, model.clientName, { value: original, enumerable: true });
+      }
+      Object.defineProperty(bypass, "$models", { value: models, enumerable: true });
+      attachDefineView({ client: bypass, meta, models });
+      return bypass;
+    },
+    enumerable: true
+  });
+}
+// packages/runtime/src/scoped.ts
+import { ScopedQueryError, VibeError as VibeError13 } from "@vibeorm/schema";
+function refusal(params) {
+  return new ScopedQueryError(params);
+}
+function isPlainObject5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Date) && !(value instanceof Uint8Array);
+}
+var SCOPEABLE_COLUMN_TYPES = ["String", "Int", "BigInt"];
+var resolvedCache = new WeakMap;
+function nestedModeOf(params) {
+  const raw = params.entry.nested;
+  if (raw === undefined)
+    return "verify";
+  if (raw === "verify" || raw === "refuse")
+    return raw;
+  throw refusal({
+    model: params.model,
+    path: "models",
+    reason: "invalid_entry",
+    message: `$scoped: models.${params.model}.nested must be "verify" or "refuse", got ${String(raw)}`
+  });
+}
+function resolveScopedModels(params) {
+  const { meta, models } = params;
+  const byMap = resolvedCache.get(models) ?? new WeakMap;
+  const cached = byMap.get(meta);
+  if (cached !== undefined)
+    return cached;
+  for (const key of Object.keys(models)) {
+    if (!meta.modelByName.has(key)) {
+      throw refusal({
+        model: key,
+        path: "models",
+        reason: "unknown_model",
+        message: `$scoped: models map names unknown model "${key}"`
+      });
+    }
+  }
+  const resolved = new Map;
+  const missing = [];
+  for (const model of meta.models) {
+    const entry = models[model.name] ?? models[model.clientName];
+    if (entry === undefined) {
+      missing.push(model.name);
+      continue;
+    }
+    if (entry === "none") {
+      resolved.set(model.name, { kind: "none" });
+      continue;
+    }
+    if (!isPlainObject5(entry)) {
+      throw refusal({
+        model: model.name,
+        path: "models",
+        reason: "invalid_entry",
+        message: `$scoped: models.${model.name} must be "none", { column } or { through }`
+      });
+    }
+    const keys = Object.keys(entry).filter((key) => entry[key] !== undefined);
+    const extras = keys.filter((key) => key !== "column" && key !== "through" && key !== "nested");
+    if (extras.length > 0 || "column" in entry === "through" in entry) {
+      throw refusal({
+        model: model.name,
+        path: "models",
+        reason: "invalid_entry",
+        message: `$scoped: models.${model.name} must carry exactly one of column/through (plus optional nested)${extras.length > 0 ? ` \u2014 unknown propert${extras.length === 1 ? "y" : "ies"}: ${extras.join(", ")}` : ""}`
+      });
+    }
+    const nested = nestedModeOf({ entry, model: model.name });
+    if ("column" in entry) {
+      const field = model.fieldByName.get(String(entry.column));
+      if (field === undefined) {
+        throw refusal({
+          model: model.name,
+          path: "models",
+          reason: "unknown_column",
+          message: `$scoped: models.${model.name}.column names unknown field "${String(entry.column)}"`
+        });
+      }
+      if (field.isList || field.scalarType === null || !SCOPEABLE_COLUMN_TYPES.includes(field.scalarType)) {
+        throw refusal({
+          model: model.name,
+          path: "models",
+          reason: "column_not_scopeable",
+          message: `$scoped: models.${model.name}.column "${field.name}" must be a non-list String, Int or BigInt field`
+        });
+      }
+      resolved.set(model.name, { kind: "column", field, nested });
+      continue;
+    }
+    const relation = model.relationByName.get(String(entry.through));
+    if (relation === undefined || relation.isList) {
+      throw refusal({
+        model: model.name,
+        path: "models",
+        reason: "unknown_relation",
+        message: `$scoped: models.${model.name}.through must name a to-one relation \u2014 "${String(entry.through)}" ${relation === undefined ? "does not exist" : "is a list relation"}`
+      });
+    }
+    resolveRelationLink({ meta, model, relation });
+    resolved.set(model.name, { kind: "through", relation, targetModel: relation.targetModel, nested });
+  }
+  if (missing.length > 0) {
+    throw refusal({
+      model: missing[0],
+      path: "models",
+      reason: "unclassified_model",
+      message: `$scoped: the models map must classify EVERY model \u2014 missing: ${missing.join(", ")} (use "none" for global models)`
+    });
+  }
+  for (const [name, entry] of resolved) {
+    if (entry.kind !== "through")
+      continue;
+    const seen = new Set([name]);
+    let current = entry;
+    while (current.kind === "through") {
+      const nextName = current.targetModel;
+      if (seen.has(nextName)) {
+        throw refusal({
+          model: name,
+          path: "models",
+          reason: "through_chain_invalid",
+          message: `$scoped: models.${name} through-chain cycles (${[...seen, nextName].join(" \u2192 ")})`
+        });
+      }
+      seen.add(nextName);
+      const next = resolved.get(nextName);
+      if (next === undefined || next.kind === "none") {
+        throw refusal({
+          model: name,
+          path: "models",
+          reason: "through_chain_invalid",
+          message: `$scoped: models.${name} through-chain must end on a { column } model \u2014 "${nextName}" is ${next === undefined ? "unclassified" : '"none"'}`
+        });
+      }
+      current = next;
+    }
+  }
+  byMap.set(meta, resolved);
+  resolvedCache.set(models, byMap);
+  return resolved;
+}
+function assertScopeType(params) {
+  const { resolved, scope } = params;
+  for (const [name, entry] of resolved) {
+    if (entry.kind !== "column")
+      continue;
+    const scalar = entry.field.scalarType;
+    const ok = scalar === "String" ? typeof scope === "string" : scalar === "Int" ? typeof scope === "number" : typeof scope === "bigint" || typeof scope === "number";
+    if (!ok) {
+      throw refusal({
+        model: name,
+        path: "scope",
+        reason: "scope_type_mismatch",
+        message: `$scoped: scope value (${typeof scope}) does not match ${name}.${entry.field.name} (${scalar})`
+      });
+    }
+  }
+}
+function buildPreds(params) {
+  const { resolved, scope } = params;
+  const preds = new Map;
+  const predOf = (name) => {
+    const known = preds.get(name);
+    if (known !== undefined)
+      return known;
+    const entry = resolved.get(name);
+    const value = entry.kind === "none" ? null : entry.kind === "column" ? { [entry.field.name]: scope } : { [entry.relation.name]: predOf(entry.targetModel) };
+    preds.set(name, value);
+    return value;
+  };
+  for (const name of resolved.keys())
+    predOf(name);
+  return preds;
+}
+function entryOf(ctx, model) {
+  return ctx.resolved.get(model.name);
+}
+function requirePred(params) {
+  const { ctx, model, path } = params;
+  if (ctx.scope === null) {
+    throw refusal({
+      model: model.name,
+      path,
+      reason: "null_scope",
+      message: `$scoped: scope is null \u2014 calls touching scoped model ${model.name} refuse until a scope is bound`
+    });
+  }
+  return ctx.preds.get(model.name);
+}
+function mergeWhere2(params) {
+  const { where, pred } = params;
+  if (where === undefined)
+    return pred;
+  return { AND: [where, pred] };
+}
+function injectUniqueWhere(params) {
+  const { where, pred } = params;
+  if (!isPlainObject5(where))
+    return { AND: [pred] };
+  const existing = where.AND === undefined ? [] : Array.isArray(where.AND) ? where.AND : [where.AND];
+  return { ...where, AND: [...existing, pred] };
+}
+function flattenUniqueWhere(params) {
+  const { model, where } = params;
+  if (model.compoundUniques.size === 0)
+    return where;
+  const out = {};
+  for (const [key, value] of Object.entries(where)) {
+    if (isPlainObject5(value) && model.compoundUniques.has(key))
+      Object.assign(out, value);
+    else
+      out[key] = value;
+  }
+  return out;
+}
+function isTenancyInverse(params) {
+  const { ctx, model, relation } = params;
+  const targetEntry = ctx.resolved.get(relation.targetModel);
+  if (targetEntry === undefined || targetEntry.kind !== "through")
+    return false;
+  const through = targetEntry.relation;
+  return through.targetModel === model.name && (through.relationName ?? null) === (relation.relationName ?? null) && !(relation.model === relation.targetModel && through.name === relation.name);
+}
+function walkWhere(params) {
+  const { ctx, model, where, path } = params;
+  const out = {};
+  const extra = [];
+  const walkGroup = (value, key) => {
+    const walkItem = (item) => isPlainObject5(item) ? walkWhere({ ctx, model, where: item, path: `${path}.${key}` }) : item;
+    return Array.isArray(value) ? value.map(walkItem) : walkItem(value);
+  };
+  for (const [key, value] of Object.entries(where)) {
+    if (value === undefined)
+      continue;
+    if (key === "AND" || key === "OR" || key === "NOT") {
+      out[key] = walkGroup(value, key);
+      continue;
+    }
+    const relation = model.relationByName.get(key);
+    if (relation === undefined) {
+      out[key] = value;
+      continue;
+    }
+    const target = ctx.meta.modelByName.get(relation.targetModel);
+    const targetEntry = entryOf(ctx, target);
+    const scoped = targetEntry.kind !== "none";
+    const childPath = `${path}.${key}`;
+    const pred = () => requirePred({ ctx, model: target, path: childPath });
+    const walkChild = (child, op) => isPlainObject5(child) ? walkWhere({ ctx, model: target, where: child, path: `${childPath}.${op}` }) : child;
+    const parts = [];
+    if (relation.isList) {
+      if (!isPlainObject5(value)) {
+        out[key] = value;
+        continue;
+      }
+      for (const [op, operand] of Object.entries(value)) {
+        if (operand === undefined)
+          continue;
+        if (op === "some" || op === "none") {
+          const walked = walkChild(operand, op);
+          parts.push({ [op]: scoped ? { AND: [walked, pred()] } : walked });
+        } else if (op === "every") {
+          const walked = walkChild(operand, op);
+          parts.push(scoped ? { none: { AND: [pred(), { NOT: [walked] }] } } : { every: walked });
+        } else {
+          parts.push({ [op]: operand });
+        }
+      }
+    } else {
+      const arms = [];
+      if (value === null) {
+        arms.push({ arm: "is", operand: null });
+      } else if (isPlainObject5(value) && (("is" in value) || ("isNot" in value))) {
+        let mixed = false;
+        for (const [op, operand] of Object.entries(value)) {
+          if (operand === undefined)
+            continue;
+          if (op === "is" || op === "isNot")
+            arms.push({ arm: op, operand });
+          else
+            mixed = true;
+        }
+        if (mixed) {
+          out[key] = value;
+          continue;
+        }
+      } else if (isPlainObject5(value)) {
+        arms.push({ arm: "is", operand: value });
+      } else {
+        out[key] = value;
+        continue;
+      }
+      for (const { arm, operand } of arms) {
+        if (operand === null) {
+          parts.push(scoped ? arm === "is" ? { isNot: pred() } : { is: pred() } : { [arm]: null });
+        } else {
+          const walked = walkChild(operand, arm);
+          parts.push({ [arm]: scoped ? { AND: [walked, pred()] } : walked });
+        }
+      }
+    }
+    if (parts.length === 0) {
+      out[key] = value;
+      continue;
+    }
+    const combined = {};
+    for (const part of parts) {
+      const opKey = Object.keys(part)[0];
+      if (opKey in combined)
+        extra.push({ [key]: part });
+      else
+        combined[opKey] = part[opKey];
+    }
+    out[key] = combined;
+  }
+  if (extra.length > 0) {
+    const existing = out.AND === undefined ? [] : Array.isArray(out.AND) ? out.AND : [out.AND];
+    out.AND = [...existing, ...extra];
+  }
+  return out;
+}
+function walkOrderTerm(params) {
+  const { ctx, model, term, path } = params;
+  const entry = entryOf(ctx, model);
+  for (const [key, spec] of Object.entries(term)) {
+    if (spec === undefined)
+      continue;
+    const relation = model.relationByName.get(key);
+    if (relation === undefined)
+      continue;
+    const target = ctx.meta.modelByName.get(relation.targetModel);
+    const targetEntry = entryOf(ctx, target);
+    const tenancyEdge = entry.kind === "through" && entry.relation.name === key;
+    if (targetEntry.kind !== "none" && !tenancyEdge) {
+      throw refusal({
+        model: target.name,
+        path: `${path}.${key}`,
+        reason: "relation_orderby_on_scoped",
+        message: `$scoped: orderBy through ${model.name}.${key} reaches scoped model ${target.name} \u2014 ordering by a foreign row's values would leak; order by own columns instead`
+      });
+    }
+    if (isPlainObject5(spec)) {
+      walkOrderTerm({ ctx, model: target, term: spec, path: `${path}.${key}` });
+    }
+  }
+}
+function walkOrderBy(params) {
+  const { ctx, model, orderBy, path } = params;
+  const terms = Array.isArray(orderBy) ? orderBy : [orderBy];
+  for (const term of terms) {
+    if (isPlainObject5(term))
+      walkOrderTerm({ ctx, model, term, path });
+  }
+}
+function walkCountSpec(params) {
+  const { ctx, model, spec, path } = params;
+  const guard = (relation) => {
+    const target = ctx.meta.modelByName.get(relation.targetModel);
+    const targetEntry = entryOf(ctx, target);
+    if (targetEntry.kind === "none")
+      return;
+    if (isTenancyInverse({ ctx, model, relation }))
+      return;
+    throw refusal({
+      model: target.name,
+      path: `${path}.${relation.name}`,
+      reason: "count_on_scoped_relation",
+      message: `$scoped: _count of ${model.name}.${relation.name} would count ${target.name} rows across tenants (relation counts take no filter) \u2014 select the relation with a where instead`
+    });
+  };
+  if (spec === true) {
+    for (const relation of model.relations) {
+      if (relation.isList)
+        guard(relation);
+    }
+    return;
+  }
+  if (!isPlainObject5(spec) || !isPlainObject5(spec.select))
+    return;
+  for (const [name, flag] of Object.entries(spec.select)) {
+    if (flag === undefined || flag === false)
+      continue;
+    const relation = model.relationByName.get(name);
+    if (relation !== undefined)
+      guard(relation);
+  }
+}
+function walkSelection(params) {
+  const { ctx, model, args, path } = params;
+  for (const blockKey of ["include", "select"]) {
+    const block = args[blockKey];
+    if (!isPlainObject5(block))
+      continue;
+    const next = { ...block };
+    for (const [name, spec] of Object.entries(block)) {
+      if (spec === undefined || spec === false)
+        continue;
+      const blockPath = `${path}.${blockKey}`;
+      if (name === "_count") {
+        walkCountSpec({ ctx, model, spec, path: `${blockPath}._count` });
+        continue;
+      }
+      const relation = model.relationByName.get(name);
+      if (relation === undefined)
+        continue;
+      const target = ctx.meta.modelByName.get(relation.targetModel);
+      const targetEntry = entryOf(ctx, target);
+      const scoped = targetEntry.kind !== "none";
+      const childPath = `${blockPath}.${name}`;
+      if (spec === true && !scoped)
+        continue;
+      const child = spec === true ? {} : isPlainObject5(spec) ? { ...spec } : spec;
+      if (!isPlainObject5(child))
+        continue;
+      const walkedWhere = isPlainObject5(child.where) ? walkWhere({ ctx, model: target, where: child.where, path: `${childPath}.where` }) : child.where;
+      if (scoped) {
+        child.where = mergeWhere2({ where: walkedWhere, pred: requirePred({ ctx, model: target, path: childPath }) });
+      } else if (walkedWhere !== undefined) {
+        child.where = walkedWhere;
+      }
+      if (child.orderBy !== undefined) {
+        walkOrderBy({ ctx, model: target, orderBy: child.orderBy, path: `${childPath}.orderBy` });
+      }
+      walkSelection({ ctx, model: target, args: child, path: childPath });
+      next[name] = child;
+    }
+    args[blockKey] = next;
+  }
+}
+var REFERENCE_VERBS2 = [
+  "connect",
+  "connectOrCreate",
+  "set",
+  "disconnect",
+  "update",
+  "updateMany",
+  "upsert",
+  "delete",
+  "deleteMany"
+];
+function nestedModeFor(entry) {
+  return entry.kind === "none" ? "verify" : entry.nested;
+}
+function mapItems(value, fn) {
+  return Array.isArray(value) ? value.map(fn) : fn(value);
+}
+function walkCreateData(params) {
+  const { ctx, model, data, path } = params;
+  if (!isPlainObject5(data))
+    return data;
+  const entry = entryOf(ctx, model);
+  const out = { ...data };
+  if (entry.kind === "column") {
+    requirePred({ ctx, model, path });
+    const given = out[entry.field.name];
+    if (given !== undefined && given !== ctx.scope) {
+      throw refusal({
+        model: model.name,
+        path: `${path}.${entry.field.name}`,
+        reason: "explicit_scope_mismatch",
+        message: `$scoped: create on ${model.name} sets ${entry.field.name} to ${given === null ? "null" : "a different tenant"} \u2014 the scoped handle owns that column`
+      });
+    }
+    out[entry.field.name] = ctx.scope;
+  }
+  if (entry.kind === "through" && params.viaTenancyEdge !== true) {
+    requirePred({ ctx, model, path });
+    const link = resolveRelationLink({ meta: ctx.meta, model, relation: entry.relation });
+    if (link.kind === "toOneOwner" && out[link.parentKey.name] !== undefined) {
+      throw refusal({
+        model: model.name,
+        path: `${path}.${link.parentKey.name}`,
+        reason: "through_fk_write",
+        message: `$scoped: writing ${model.name}.${link.parentKey.name} directly would bypass tenant verification \u2014 use ${entry.relation.name}: { connect: \u2026 } instead`
+      });
+    }
+    if (out[entry.relation.name] === undefined) {
+      throw refusal({
+        model: model.name,
+        path,
+        reason: "through_fk_write",
+        message: `$scoped: create on ${model.name} must bind its tenancy parent \u2014 provide ${entry.relation.name}: { connect | create | connectOrCreate: \u2026 }`
+      });
+    }
+  }
+  for (const [key, value] of Object.entries(out)) {
+    const relation = model.relationByName.get(key);
+    if (relation === undefined || !isPlainObject5(value))
+      continue;
+    out[key] = walkNestedVerbs({ ctx, model, relation, verbs: value, path: `${path}.${key}`, phase: "create" });
+  }
+  return out;
+}
+function walkUpdateData(params) {
+  const { ctx, model, data, path } = params;
+  if (!isPlainObject5(data))
+    return data;
+  const entry = entryOf(ctx, model);
+  const out = { ...data };
+  if (entry.kind === "column") {
+    const given = out[entry.field.name];
+    if (given !== undefined) {
+      const setValue = isPlainObject5(given) && Object.keys(given).length === 1 ? given.set : given;
+      if (setValue !== ctx.scope) {
+        throw refusal({
+          model: model.name,
+          path: `${path}.${entry.field.name}`,
+          reason: "explicit_scope_mismatch",
+          message: `$scoped: update on ${model.name} writes ${entry.field.name} \u2014 a scoped handle cannot move rows between tenants`
+        });
+      }
+    }
+  }
+  if (entry.kind === "through") {
+    const link = resolveRelationLink({ meta: ctx.meta, model, relation: entry.relation });
+    if (link.kind === "toOneOwner" && out[link.parentKey.name] !== undefined) {
+      throw refusal({
+        model: model.name,
+        path: `${path}.${link.parentKey.name}`,
+        reason: "through_fk_write",
+        message: `$scoped: writing ${model.name}.${link.parentKey.name} directly would bypass tenant verification \u2014 use ${entry.relation.name}: { connect: \u2026 } instead`
+      });
+    }
+  }
+  for (const [key, value] of Object.entries(out)) {
+    const relation = model.relationByName.get(key);
+    if (relation === undefined || !isPlainObject5(value))
+      continue;
+    out[key] = walkNestedVerbs({ ctx, model, relation, verbs: value, path: `${path}.${key}`, phase: "update" });
+  }
+  return out;
+}
+function walkNestedVerbs(params) {
+  const { ctx, model, relation, verbs, path, phase } = params;
+  const target = ctx.meta.modelByName.get(relation.targetModel);
+  const targetEntry = entryOf(ctx, target);
+  const scoped = targetEntry.kind !== "none";
+  const modelEntry = entryOf(ctx, model);
+  const pairedDown = scoped && isTenancyInverse({ ctx, model, relation });
+  const tenancyEdge = modelEntry.kind === "through" && modelEntry.relation.name === relation.name;
+  const implicitSafe = pairedDown || tenancyEdge;
+  const mode = nestedModeFor(targetEntry);
+  const out = { ...verbs };
+  const pred = (verbPath) => requirePred({ ctx, model: target, path: verbPath });
+  const refuse = (verb, why) => {
+    throw refusal({
+      model: target.name,
+      path: `${path}.${verb}`,
+      reason: "nested_refused",
+      message: `$scoped: nested "${verb}" on ${model.name}.${relation.name} (${target.name}) ${why}`
+    });
+  };
+  const walkTargetWhere = (where, verbPath) => isPlainObject5(where) ? walkWhere({ ctx, model: target, where, path: verbPath }) : where;
+  const uniqueWhere = (where, verbPath) => {
+    const walked = walkTargetWhere(where, verbPath);
+    return scoped ? injectUniqueWhere({ where: walked, pred: pred(verbPath) }) : walked;
+  };
+  const filterWhere = (where, verbPath) => {
+    const walked = walkTargetWhere(where, verbPath);
+    return scoped ? mergeWhere2({ where: walked ?? {}, pred: pred(verbPath) }) : walked;
+  };
+  const walkChildCreate = (item, verbPath) => walkCreateData({ ctx, model: target, data: item, path: verbPath, viaTenancyEdge: pairedDown });
+  const walkChildUpdate = (item, verbPath) => walkUpdateData({ ctx, model: target, data: item, path: verbPath });
+  const link = () => resolveRelationLink({ meta: ctx.meta, model, relation });
+  for (const [verb, operand] of Object.entries(verbs)) {
+    if (operand === undefined)
+      continue;
+    const verbPath = `${path}.${verb}`;
+    if (verb === "create") {
+      out[verb] = mapItems(operand, (item) => walkChildCreate(item, verbPath));
+      continue;
+    }
+    if (scoped && mode === "refuse" && REFERENCE_VERBS2.includes(verb)) {
+      refuse(verb, `is disabled \u2014 ${target.name} is configured nested: "refuse"; go through the base client or its own delegate`);
+    }
+    switch (verb) {
+      case "connect":
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      case "connectOrCreate":
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? { ...item, where: uniqueWhere(item.where, verbPath), create: walkChildCreate(item.create, verbPath) } : item);
+        break;
+      case "set": {
+        if (phase === "create")
+          break;
+        if (scoped) {
+          const kind = link().kind;
+          if (kind === "manyToMany")
+            refuse(verb, "clears the whole join set \u2014 unlinking other tenants' rows cannot be verified; disconnect explicit rows instead");
+          if (!implicitSafe)
+            refuse(verb, "first detaches EVERY current child, which cannot be tenant-filtered on this edge; disconnect explicit rows instead");
+        }
+        out[verb] = mapItems(operand ?? [], (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      }
+      case "disconnect": {
+        if (!relation.isList) {
+          if (scoped) {
+            const kind = link().kind;
+            if (kind === "toOneOwner") {
+              if (tenancyEdge) {
+                refuse(verb, "would orphan the row out of its tenant (through-parent set to null) \u2014 delete it or connect a replacement");
+              }
+            } else if (!implicitSafe) {
+              refuse(verb, "targets whatever row currently points here \u2014 not tenant-verifiable on this edge");
+            }
+          }
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      }
+      case "delete": {
+        if (!relation.isList) {
+          if (scoped && !implicitSafe) {
+            refuse(verb, "targets whatever row is currently connected \u2014 not tenant-verifiable on this edge");
+          }
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      }
+      case "update": {
+        if (!relation.isList) {
+          if (scoped && !implicitSafe) {
+            refuse(verb, "targets whatever row is currently connected \u2014 not tenant-verifiable on this edge; update it through its own delegate");
+          }
+          out[verb] = isPlainObject5(operand) ? "data" in operand && isPlainObject5(operand.data) ? { ...operand, data: walkChildUpdate(operand.data, verbPath) } : walkChildUpdate(operand, verbPath) : operand;
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? { ...item, where: uniqueWhere(item.where, verbPath), data: walkChildUpdate(item.data, verbPath) } : item);
+        break;
+      }
+      case "updateMany":
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? { ...item, where: filterWhere(item.where, verbPath), data: walkChildUpdate(item.data, verbPath) } : item);
+        break;
+      case "deleteMany":
+        out[verb] = mapItems(operand, (item) => filterWhere(item, verbPath));
+        break;
+      case "upsert": {
+        if (!relation.isList) {
+          if (scoped && !implicitSafe) {
+            refuse(verb, "updates whatever row is currently connected \u2014 not tenant-verifiable on this edge");
+          }
+          out[verb] = isPlainObject5(operand) ? {
+            ...operand,
+            create: walkChildCreate(operand.create, verbPath),
+            update: walkChildUpdate(operand.update, verbPath)
+          } : operand;
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? {
+          ...item,
+          where: uniqueWhere(item.where, verbPath),
+          create: walkChildCreate(item.create, verbPath),
+          update: walkChildUpdate(item.update, verbPath)
+        } : item);
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  return out;
+}
+function createScopeRewriter(params) {
+  const { meta, models, scope } = params;
+  const resolved = resolveScopedModels({ meta, models });
+  if (scope !== null)
+    assertScopeType({ meta, resolved, scope });
+  const preds = scope === null ? new Map : buildPreds({ meta, resolved, scope });
+  return {
+    rewrite: (call) => rewriteScopedCall({
+      meta,
+      resolved,
+      scope,
+      preds,
+      model: call.model,
+      method: call.method,
+      args: call.args
+    })
+  };
+}
+var FIND_LIKE = ["findMany", "findFirst", "findFirstOrThrow", "count", "aggregate", "groupBy"];
+function rewriteScopedCall(params) {
+  const { meta, resolved, scope, preds, method } = params;
+  const ctx = { meta, resolved, scope, preds };
+  const model = getModelMeta({ meta, model: params.model });
+  const entry = entryOf(ctx, model);
+  const scoped = entry.kind !== "none";
+  const root = `${model.clientName}.${method}`;
+  const args = { ...params.args ?? {} };
+  const ownPred = () => requirePred({ ctx, model, path: root });
+  const walkOwnWhere = (where, path) => isPlainObject5(where) ? walkWhere({ ctx, model, where, path }) : where;
+  if (FIND_LIKE.includes(method)) {
+    const walked = walkOwnWhere(args.where, `${root}.where`);
+    if (scoped)
+      args.where = mergeWhere2({ where: walked, pred: ownPred() });
+    else if (walked !== undefined)
+      args.where = walked;
+    if (args.orderBy !== undefined)
+      walkOrderBy({ ctx, model, orderBy: args.orderBy, path: `${root}.orderBy` });
+    walkSelection({ ctx, model, args, path: root });
+    return { model: model.name, method, args };
+  }
+  switch (method) {
+    case "findUnique":
+    case "findUniqueOrThrow": {
+      walkSelection({ ctx, model, args, path: root });
+      if (!scoped) {
+        const walked2 = walkOwnWhere(args.where, `${root}.where`);
+        if (walked2 !== undefined)
+          args.where = walked2;
+        return { model: model.name, method, args };
+      }
+      const flat = isPlainObject5(args.where) ? flattenUniqueWhere({ model, where: args.where }) : args.where;
+      const walked = isPlainObject5(flat) ? walkWhere({ ctx, model, where: flat, path: `${root}.where` }) : flat;
+      args.where = mergeWhere2({ where: walked, pred: ownPred() });
+      return {
+        model: model.name,
+        method: method === "findUnique" ? "findFirst" : "findFirstOrThrow",
+        args
+      };
+    }
+    case "create": {
+      args.data = walkCreateData({ ctx, model, data: args.data ?? {}, path: `${root}.data` });
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "createMany":
+    case "createManyAndReturn": {
+      const rows = args.data;
+      args.data = Array.isArray(rows) ? rows.map((row) => walkCreateData({ ctx, model, data: row, path: `${root}.data` })) : walkCreateData({ ctx, model, data: rows ?? {}, path: `${root}.data` });
+      if (method === "createManyAndReturn")
+        walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "update": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      args.where = scoped ? injectUniqueWhere({ where: walked, pred: ownPred() }) : walked;
+      args.data = walkUpdateData({ ctx, model, data: args.data ?? {}, path: `${root}.data` });
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "updateMany": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      if (scoped)
+        args.where = mergeWhere2({ where: walked, pred: ownPred() });
+      else if (walked !== undefined)
+        args.where = walked;
+      args.data = walkUpdateData({ ctx, model, data: args.data ?? {}, path: `${root}.data` });
+      return { model: model.name, method, args };
+    }
+    case "upsert": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      args.where = scoped ? injectUniqueWhere({ where: walked, pred: ownPred() }) : walked;
+      args.create = walkCreateData({ ctx, model, data: args.create ?? {}, path: `${root}.create` });
+      args.update = walkUpdateData({ ctx, model, data: args.update ?? {}, path: `${root}.update` });
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "delete": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      args.where = scoped ? injectUniqueWhere({ where: walked, pred: ownPred() }) : walked;
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "deleteMany": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      if (scoped)
+        args.where = mergeWhere2({ where: walked, pred: ownPred() });
+      else if (walked !== undefined)
+        args.where = walked;
+      return { model: model.name, method, args };
+    }
+    default:
+      return { model: model.name, method, args: params.args };
+  }
+}
+function scopedDelegate2(params) {
+  const { ctx, model, base } = params;
+  const run = (method, args) => {
+    let rewritten;
+    try {
+      rewritten = rewriteScopedCall({
+        meta: ctx.meta,
+        resolved: ctx.resolved,
+        scope: ctx.scope,
+        preds: ctx.preds,
+        model: model.name,
+        method,
+        args
+      });
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    const target = base[rewritten.method];
+    return target(rewritten.args);
+  };
+  return {
+    findMany: (args) => run("findMany", args),
+    findFirst: (args) => run("findFirst", args),
+    findFirstOrThrow: (args) => run("findFirstOrThrow", args),
+    findUnique: (args) => run("findUnique", args),
+    findUniqueOrThrow: (args) => run("findUniqueOrThrow", args),
+    create: (args) => run("create", args),
+    createMany: (args) => run("createMany", args),
+    createManyAndReturn: (args) => run("createManyAndReturn", args),
+    update: (args) => run("update", args),
+    updateMany: (args) => run("updateMany", args),
+    upsert: (args) => run("upsert", args),
+    delete: (args) => run("delete", args),
+    deleteMany: (args) => run("deleteMany", args),
+    count: (args) => run("count", args),
+    aggregate: (args) => run("aggregate", args),
+    groupBy: (args) => run("groupBy", args)
+  };
+}
+function scopeExtensionProps2(params) {
+  const { ctx, model, base, delegate } = params;
+  const entry = entryOf(ctx, model);
+  const out = {};
+  for (const [key, prop] of Object.entries(base)) {
+    if (key in delegate)
+      continue;
+    if (typeof prop === "function") {
+      out[key] = (args) => {
+        try {
+          const path = `${model.clientName}.${key}`;
+          const walked = isPlainObject5(args?.where) ? walkWhere({ ctx, model, where: args.where, path: `${path}.where` }) : args?.where;
+          const where = entry.kind === "none" ? walked : mergeWhere2({ where: walked, pred: requirePred({ ctx, model, path }) });
+          return prop({ ...args ?? {}, ...where === undefined ? {} : { where } });
+        } catch (error) {
+          return Promise.reject(error);
+        }
+      };
+    } else if (isPlainObject5(prop)) {
+      out[key] = scopeExtensionProps2({
+        ctx,
+        model,
+        base: prop,
+        delegate: {}
+      });
+    }
+  }
+  return out;
+}
+function forbidden(params) {
+  return refusal({
+    model: "*",
+    path: params.method,
+    reason: "raw_forbidden",
+    message: `$scoped: ${params.method} is not available on a scoped handle \u2014 raw SQL cannot be tenant-verified; run it on the BASE client (the deliberate unscoped escape)`
+  });
+}
+var RAW_METHODS = ["$queryRaw", "$executeRaw", "$queryRawUnsafe", "$executeRawUnsafe"];
+function buildScopedOver(params) {
+  const { ctx, client } = params;
+  const scoped = Object.create(client);
+  const scopedModels = { ...client.$models };
+  for (const model of ctx.meta.models) {
+    const base = client.$models[model.name];
+    const delegate = scopedDelegate2({ ctx, model, base });
+    const full = { ...delegate, ...scopeExtensionProps2({ ctx, model, base, delegate }) };
+    scopedModels[model.name] = full;
+    scopedModels[model.clientName] = full;
+    Object.defineProperty(scoped, model.clientName, { value: full, enumerable: true });
+  }
+  Object.defineProperty(scoped, "$models", { value: scopedModels, enumerable: true });
+  attachDefineView({ client: scoped, meta: ctx.meta, models: scopedModels });
+  Object.defineProperty(scoped, "$transaction", {
+    value: (arg, options) => typeof arg === "function" ? client.$transaction((tx) => arg(buildScopedOver({ ctx, client: tx })), options) : client.$transaction(arg, options),
+    enumerable: true
+  });
+  for (const method of RAW_METHODS) {
+    Object.defineProperty(scoped, method, {
+      value: () => Promise.reject(forbidden({ method })),
+      enumerable: true
+    });
+  }
+  Object.defineProperty(scoped, "$scoped", {
+    value: () => {
+      throw refusal({
+        model: "*",
+        path: "$scoped",
+        reason: "rescope_forbidden",
+        message: "$scoped: this handle is already scoped \u2014 build a differently-scoped handle from the BASE client"
+      });
+    },
+    enumerable: true
+  });
+  return scoped;
+}
+function attachScoped(params) {
+  const { client, meta } = params;
+  Object.defineProperty(client, "$scoped", {
+    value: (config) => {
+      if (!isPlainObject5(config) || !isPlainObject5(config.models)) {
+        throw new VibeError13({
+          code: "VIBE_VALIDATION",
+          message: "$scoped takes { scope: string | number | bigint | null, models: { <Model>: \u2026 } }"
+        });
+      }
+      const policied = meta.models.filter((model) => model.policy !== undefined);
+      if (policied.length > 0) {
+        throw refusal({
+          model: policied[0]?.name,
+          path: "$scoped",
+          reason: "policy_conflict",
+          message: `$scoped: the schema declares @@policy on ${policied.map((model) => model.name).join(", ")} \u2014 use $withPolicy for policied schemas; the two scoping layers do not combine`
+        });
+      }
+      const scope = config.scope;
+      if (scope !== null && typeof scope !== "string" && typeof scope !== "number" && typeof scope !== "bigint") {
+        throw new VibeError13({
+          code: "VIBE_VALIDATION",
+          message: `$scoped: scope must be a string, number, bigint or null \u2014 got ${typeof scope}`
+        });
+      }
+      const resolved = resolveScopedModels({ meta, models: config.models });
+      if (scope !== null)
+        assertScopeType({ meta, resolved, scope });
+      const preds = scope === null ? new Map : buildPreds({ meta, resolved, scope });
+      const ctx = { meta, resolved, scope, preds };
+      return buildScopedOver({ ctx, client });
+    },
+    enumerable: true
+  });
+}
 // packages/runtime/src/client.ts
-import { VibeError as VibeError11, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
+import { VibeError as VibeError14, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
 import { ParamCollector, getSqlDialect } from "@vibeorm/sql";
 
 // packages/runtime/src/render-cache.ts
@@ -5693,7 +6962,7 @@ function walkExpr(walk, dialect, expr) {
       return true;
   }
 }
-function walkOrderTerm(walk, dialect, term) {
+function walkOrderTerm2(walk, dialect, term) {
   if ("agg" in term) {
     walk.key += "a";
     addAgg(walk, term.agg);
@@ -5743,7 +7012,7 @@ function walkSelect(walk, dialect, statement) {
       addCol(walk, column);
     walk.key += ":";
     for (const term of statement.rowNumber.orderBy) {
-      if (!walkOrderTerm(walk, dialect, term))
+      if (!walkOrderTerm2(walk, dialect, term))
         return false;
     }
     addIdent(walk, statement.rowNumber.alias);
@@ -5798,7 +7067,7 @@ function walkSelect(walk, dialect, statement) {
   if (statement.orderBy !== undefined && statement.orderBy.length > 0) {
     walk.key += "o(";
     for (const term of statement.orderBy) {
-      if (!walkOrderTerm(walk, dialect, term))
+      if (!walkOrderTerm2(walk, dialect, term))
         return false;
     }
     walk.key += ")";
@@ -5956,7 +7225,7 @@ function renderStatementCached(params) {
 // packages/runtime/src/client.ts
 function notFound2(params) {
   const { model, method } = params;
-  return new VibeError11({
+  return new VibeError14({
     code: "VIBE_NOT_FOUND",
     message: `no ${model} record matched the where clause of ${method}()`,
     meta: { model, method }
@@ -5964,7 +7233,7 @@ function notFound2(params) {
 }
 function viewIsReadOnly(params) {
   const { model, method } = params;
-  return new VibeError11({
+  return new VibeError14({
     code: "VIBE_VALIDATION",
     message: `${model} is a view \u2014 ${method}() is not available on views (they are read-only); write to the underlying table instead`,
     meta: { model, method }
@@ -6093,7 +7362,7 @@ class QueryPromise extends Promise {
   }
   claim() {
     if (this.started) {
-      throw new VibeError11({
+      throw new VibeError14({
         code: "VIBE_VALIDATION",
         message: "$transaction([...]) needs operations that have not dispatched \u2014 pass delegate calls in the same tick they are created (this one was awaited or created earlier and already executed outside the transaction)"
       });
@@ -6171,7 +7440,7 @@ async function runAffected(params) {
 function plan(params) {
   const { engine, model, method, args } = params;
   if (args !== undefined && args["lock"] !== undefined && engine.inTransaction !== true) {
-    throw new VibeError11({
+    throw new VibeError14({
       code: "VIBE_VALIDATION",
       message: `lock on ${model}.${method}() requires a transaction \u2014 call it on the client $transaction hands its callback (outside one, the lock would release at statement end)`,
       meta: { model, method }
@@ -6244,7 +7513,7 @@ async function insertedKeyWhere(params) {
   });
   const id = result.rows[0]?.id;
   if (id === undefined || id === null) {
-    throw new VibeError11({
+    throw new VibeError14({
       code: "VIBE_INTERNAL",
       message: `could not read back the generated key for ${source.model.name}`,
       meta: { model: source.model.name }
@@ -6546,7 +7815,7 @@ function createDelegate(params) {
     const skipping = args.onConflict !== undefined;
     if (hasNestedWrites({ model: modelMeta, data: args.data })) {
       if (skipping) {
-        throw new VibeError11({
+        throw new VibeError14({
           code: "VIBE_VALIDATION",
           message: `onConflict cannot combine with nested writes on ${modelMeta.name}.create() \u2014 insert the parent row alone, then connect relations`,
           meta: { model: modelMeta.name }
@@ -6630,7 +7899,7 @@ function createDelegate(params) {
   const upsert = async (target, args) => {
     const modelMeta = getModelMeta({ meta: target.meta, model });
     if (hasNestedWrites({ model: modelMeta, data: args.create }) || hasNestedWrites({ model: modelMeta, data: args.update })) {
-      throw new VibeError11({
+      throw new VibeError14({
         code: "VIBE_VALIDATION",
         message: `nested writes are not supported inside upsert arms on ${modelMeta.name} \u2014 use create()/update() with nested data`,
         meta: { model: modelMeta.name }
@@ -6638,7 +7907,7 @@ function createDelegate(params) {
     }
     if (!upsertUsesNativeStatement({ model: modelMeta, args })) {
       if (args.onConflict !== undefined) {
-        throw new VibeError11({
+        throw new VibeError14({
           code: "VIBE_VALIDATION",
           message: `onConflict on ${modelMeta.name}.upsert() needs the native single-statement path \u2014 this shape (a guard field beyond the conflict target, or create data not binding the where's key) runs the find-then-write fallback, which cannot honor an explicit conflict target`,
           meta: { model: modelMeta.name }
@@ -6765,6 +8034,17 @@ function createDelegate(params) {
   const meta = getModelMeta({ meta: engine.meta, model });
   return meta.isView ? readOnlyDelegate({ delegate, model: meta.name }) : delegate;
 }
+var WRITE_METHODS = ["create", "createMany", "createManyAndReturn", "update", "updateMany", "upsert"];
+function withWriteValidation(params) {
+  const { engine, delegate, model, validators } = params;
+  const meta = getModelMeta({ meta: engine.meta, model });
+  const wrapped = { ...delegate };
+  for (const method of WRITE_METHODS) {
+    const original = delegate[method];
+    wrapped[method] = (args) => original(applyWriteValidators({ meta: engine.meta, model: meta, method, args, validators }));
+  }
+  return wrapped;
+}
 function buildRawStatement(params) {
   const { dialect, strings, values } = params;
   const collector = new ParamCollector(dialect);
@@ -6778,7 +8058,11 @@ function buildClient(params) {
   const { engine } = params;
   const models = {};
   for (const model of engine.meta.models) {
-    const delegate = createDelegate({ engine, model: model.name });
+    let delegate = createDelegate({ engine, model: model.name });
+    const validators = engine.options?.validate;
+    if (validators?.[model.name] !== undefined) {
+      delegate = withWriteValidation({ engine, delegate, model: model.name, validators });
+    }
     models[model.name] = delegate;
     models[model.clientName] = delegate;
   }
@@ -6800,7 +8084,7 @@ function buildClient(params) {
     let claimError = null;
     for (const operation of operations) {
       if (!(operation instanceof QueryPromise)) {
-        claimError = new VibeError11({
+        claimError = new VibeError14({
           code: "VIBE_VALIDATION",
           message: "$transaction([...]) takes query promises from model delegate calls \u2014 a foreign promise is already running and cannot join the transaction"
         });
@@ -6839,7 +8123,7 @@ function buildClient(params) {
     $models: models,
     $on: (event, listener) => {
       if (event !== "query") {
-        throw new VibeError11({
+        throw new VibeError14({
           code: "VIBE_VALIDATION",
           message: `unknown client event "${String(event)}" \u2014 supported: "query"`,
           meta: { event }
@@ -6873,6 +8157,8 @@ function buildClient(params) {
   }
   attachExtensionMounts({ engine, client, models });
   attachDefineView({ client, meta: engine.meta, models });
+  attachScoped({ client, meta: engine.meta });
+  attachPolicy({ client, meta: engine.meta });
   return client;
 }
 function makeMountContext(params) {
@@ -6902,7 +8188,7 @@ function makeMountContext(params) {
     compileWhere: ({ where, model: modelName, qualify }) => {
       const target = modelName === undefined ? model : getModelMeta({ meta: engine.meta, model: modelName });
       if (target === null) {
-        throw new VibeError11({
+        throw new VibeError14({
           code: "VIBE_INTERNAL",
           message: `extension "${extension}" compiled a where with no model in scope`,
           meta: { extension }
@@ -6928,7 +8214,7 @@ function attachExtensionMounts(params) {
       const model = getModelMeta({ meta: engine.meta, model: mount.model ?? "" });
       const delegate = models[model.name];
       if (delegate === undefined || mount.property in delegate) {
-        throw new VibeError11({
+        throw new VibeError14({
           code: "VIBE_CONFIG",
           message: `extension "${mount.extension}" cannot mount "${mount.property}" on ${model.name} \u2014 the name is taken`,
           meta: { extension: mount.extension, model: model.name, property: mount.property }
@@ -6939,7 +8225,7 @@ function attachExtensionMounts(params) {
       continue;
     }
     if (!mount.property.startsWith("$") || mount.property in client) {
-      throw new VibeError11({
+      throw new VibeError14({
         code: "VIBE_CONFIG",
         message: `extension "${mount.extension}" cannot mount client property "${mount.property}" \u2014 root mounts are $-prefixed and must not collide`,
         meta: { extension: mount.extension, property: mount.property }
@@ -6959,7 +8245,7 @@ function createClient(params) {
     assertComputedManifest({ manifest: computed.manifest, specs: computed.specs });
   }
   if (computed === undefined && options !== undefined && options["computed"] !== undefined) {
-    throw new VibeError11({
+    throw new VibeError14({
       code: "VIBE_CONFIG",
       message: "this client was generated without computed fields \u2014 declare them in vibeorm.config.ts and re-run vibeorm generate",
       meta: {}
@@ -6987,9 +8273,12 @@ function createClient(params) {
   });
 }
 export {
+  validateWriteData,
   updateWithNested,
   toSqlExecutor,
   toClientName,
+  rewriteScopedCall,
+  resolveScopedModels,
   resolveResultShape,
   resolveRelationSelection,
   resolveRelationLink,
@@ -7013,6 +8302,7 @@ export {
   dbNow,
   createWithNested,
   createView,
+  createScopeRewriter,
   createClient,
   compileWhere,
   compileSelect,
@@ -7021,11 +8311,14 @@ export {
   buildQuery,
   buildExtensionOperatorMap,
   buildConnectHooks,
+  attachScoped,
   attachRelations,
+  attachPolicy,
   attachLateralRelations,
   attachDefineView,
   assertExtensionManifest,
   assertComputedManifest,
+  applyWriteValidators,
   applyComputedFields,
   ViewResult,
   SQLITE_CODECS,
@@ -7035,4 +8328,4 @@ export {
   COUNT_ALIAS
 };
 
-//# debugId=96AA73705B84E72364756E2164756E21
+//# debugId=AB87792190B87F3664756E2164756E21