@vibeorm/runtime 2.0.0-alpha.8 → 2.0.0-alpha.9

package/dist/index.js

@@ -5843,8 +5843,939 @@ function attachPolicy(params) {
     enumerable: true
   });
 }
+// packages/runtime/src/scoped.ts
+import { ScopedQueryError, VibeError as VibeError13 } from "@vibeorm/schema";
+function refusal(params) {
+  return new ScopedQueryError(params);
+}
+function isPlainObject5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Date) && !(value instanceof Uint8Array);
+}
+var SCOPEABLE_COLUMN_TYPES = ["String", "Int", "BigInt"];
+var resolvedCache = new WeakMap;
+function nestedModeOf(params) {
+  const raw = params.entry.nested;
+  if (raw === undefined)
+    return "verify";
+  if (raw === "verify" || raw === "refuse")
+    return raw;
+  throw refusal({
+    model: params.model,
+    path: "models",
+    reason: "invalid_entry",
+    message: `$scoped: models.${params.model}.nested must be "verify" or "refuse", got ${String(raw)}`
+  });
+}
+function resolveScopedModels(params) {
+  const { meta, models } = params;
+  const byMap = resolvedCache.get(models) ?? new WeakMap;
+  const cached = byMap.get(meta);
+  if (cached !== undefined)
+    return cached;
+  for (const key of Object.keys(models)) {
+    if (!meta.modelByName.has(key)) {
+      throw refusal({
+        model: key,
+        path: "models",
+        reason: "unknown_model",
+        message: `$scoped: models map names unknown model "${key}"`
+      });
+    }
+  }
+  const resolved = new Map;
+  const missing = [];
+  for (const model of meta.models) {
+    const entry = models[model.name] ?? models[model.clientName];
+    if (entry === undefined) {
+      missing.push(model.name);
+      continue;
+    }
+    if (entry === "none") {
+      resolved.set(model.name, { kind: "none" });
+      continue;
+    }
+    if (!isPlainObject5(entry)) {
+      throw refusal({
+        model: model.name,
+        path: "models",
+        reason: "invalid_entry",
+        message: `$scoped: models.${model.name} must be "none", { column } or { through }`
+      });
+    }
+    const keys = Object.keys(entry).filter((key) => entry[key] !== undefined);
+    const extras = keys.filter((key) => key !== "column" && key !== "through" && key !== "nested");
+    if (extras.length > 0 || "column" in entry === "through" in entry) {
+      throw refusal({
+        model: model.name,
+        path: "models",
+        reason: "invalid_entry",
+        message: `$scoped: models.${model.name} must carry exactly one of column/through (plus optional nested)${extras.length > 0 ? ` \u2014 unknown propert${extras.length === 1 ? "y" : "ies"}: ${extras.join(", ")}` : ""}`
+      });
+    }
+    const nested = nestedModeOf({ entry, model: model.name });
+    if ("column" in entry) {
+      const field = model.fieldByName.get(String(entry.column));
+      if (field === undefined) {
+        throw refusal({
+          model: model.name,
+          path: "models",
+          reason: "unknown_column",
+          message: `$scoped: models.${model.name}.column names unknown field "${String(entry.column)}"`
+        });
+      }
+      if (field.isList || field.scalarType === null || !SCOPEABLE_COLUMN_TYPES.includes(field.scalarType)) {
+        throw refusal({
+          model: model.name,
+          path: "models",
+          reason: "column_not_scopeable",
+          message: `$scoped: models.${model.name}.column "${field.name}" must be a non-list String, Int or BigInt field`
+        });
+      }
+      resolved.set(model.name, { kind: "column", field, nested });
+      continue;
+    }
+    const relation = model.relationByName.get(String(entry.through));
+    if (relation === undefined || relation.isList) {
+      throw refusal({
+        model: model.name,
+        path: "models",
+        reason: "unknown_relation",
+        message: `$scoped: models.${model.name}.through must name a to-one relation \u2014 "${String(entry.through)}" ${relation === undefined ? "does not exist" : "is a list relation"}`
+      });
+    }
+    resolveRelationLink({ meta, model, relation });
+    resolved.set(model.name, { kind: "through", relation, targetModel: relation.targetModel, nested });
+  }
+  if (missing.length > 0) {
+    throw refusal({
+      model: missing[0],
+      path: "models",
+      reason: "unclassified_model",
+      message: `$scoped: the models map must classify EVERY model \u2014 missing: ${missing.join(", ")} (use "none" for global models)`
+    });
+  }
+  for (const [name, entry] of resolved) {
+    if (entry.kind !== "through")
+      continue;
+    const seen = new Set([name]);
+    let current = entry;
+    while (current.kind === "through") {
+      const nextName = current.targetModel;
+      if (seen.has(nextName)) {
+        throw refusal({
+          model: name,
+          path: "models",
+          reason: "through_chain_invalid",
+          message: `$scoped: models.${name} through-chain cycles (${[...seen, nextName].join(" \u2192 ")})`
+        });
+      }
+      seen.add(nextName);
+      const next = resolved.get(nextName);
+      if (next === undefined || next.kind === "none") {
+        throw refusal({
+          model: name,
+          path: "models",
+          reason: "through_chain_invalid",
+          message: `$scoped: models.${name} through-chain must end on a { column } model \u2014 "${nextName}" is ${next === undefined ? "unclassified" : '"none"'}`
+        });
+      }
+      current = next;
+    }
+  }
+  byMap.set(meta, resolved);
+  resolvedCache.set(models, byMap);
+  return resolved;
+}
+function assertScopeType(params) {
+  const { resolved, scope } = params;
+  for (const [name, entry] of resolved) {
+    if (entry.kind !== "column")
+      continue;
+    const scalar = entry.field.scalarType;
+    const ok = scalar === "String" ? typeof scope === "string" : scalar === "Int" ? typeof scope === "number" : typeof scope === "bigint" || typeof scope === "number";
+    if (!ok) {
+      throw refusal({
+        model: name,
+        path: "scope",
+        reason: "scope_type_mismatch",
+        message: `$scoped: scope value (${typeof scope}) does not match ${name}.${entry.field.name} (${scalar})`
+      });
+    }
+  }
+}
+function buildPreds(params) {
+  const { resolved, scope } = params;
+  const preds = new Map;
+  const predOf = (name) => {
+    const known = preds.get(name);
+    if (known !== undefined)
+      return known;
+    const entry = resolved.get(name);
+    const value = entry.kind === "none" ? null : entry.kind === "column" ? { [entry.field.name]: scope } : { [entry.relation.name]: predOf(entry.targetModel) };
+    preds.set(name, value);
+    return value;
+  };
+  for (const name of resolved.keys())
+    predOf(name);
+  return preds;
+}
+function entryOf(ctx, model) {
+  return ctx.resolved.get(model.name);
+}
+function requirePred(params) {
+  const { ctx, model, path } = params;
+  if (ctx.scope === null) {
+    throw refusal({
+      model: model.name,
+      path,
+      reason: "null_scope",
+      message: `$scoped: scope is null \u2014 calls touching scoped model ${model.name} refuse until a scope is bound`
+    });
+  }
+  return ctx.preds.get(model.name);
+}
+function mergeWhere2(params) {
+  const { where, pred } = params;
+  if (where === undefined)
+    return pred;
+  return { AND: [where, pred] };
+}
+function injectUniqueWhere(params) {
+  const { where, pred } = params;
+  if (!isPlainObject5(where))
+    return { AND: [pred] };
+  const existing = where.AND === undefined ? [] : Array.isArray(where.AND) ? where.AND : [where.AND];
+  return { ...where, AND: [...existing, pred] };
+}
+function flattenUniqueWhere(params) {
+  const { model, where } = params;
+  if (model.compoundUniques.size === 0)
+    return where;
+  const out = {};
+  for (const [key, value] of Object.entries(where)) {
+    if (isPlainObject5(value) && model.compoundUniques.has(key))
+      Object.assign(out, value);
+    else
+      out[key] = value;
+  }
+  return out;
+}
+function isTenancyInverse(params) {
+  const { ctx, model, relation } = params;
+  const targetEntry = ctx.resolved.get(relation.targetModel);
+  if (targetEntry === undefined || targetEntry.kind !== "through")
+    return false;
+  const through = targetEntry.relation;
+  return through.targetModel === model.name && (through.relationName ?? null) === (relation.relationName ?? null) && !(relation.model === relation.targetModel && through.name === relation.name);
+}
+function walkWhere(params) {
+  const { ctx, model, where, path } = params;
+  const out = {};
+  const extra = [];
+  const walkGroup = (value, key) => {
+    const walkItem = (item) => isPlainObject5(item) ? walkWhere({ ctx, model, where: item, path: `${path}.${key}` }) : item;
+    return Array.isArray(value) ? value.map(walkItem) : walkItem(value);
+  };
+  for (const [key, value] of Object.entries(where)) {
+    if (value === undefined)
+      continue;
+    if (key === "AND" || key === "OR" || key === "NOT") {
+      out[key] = walkGroup(value, key);
+      continue;
+    }
+    const relation = model.relationByName.get(key);
+    if (relation === undefined) {
+      out[key] = value;
+      continue;
+    }
+    const target = ctx.meta.modelByName.get(relation.targetModel);
+    const targetEntry = entryOf(ctx, target);
+    const scoped = targetEntry.kind !== "none";
+    const childPath = `${path}.${key}`;
+    const pred = () => requirePred({ ctx, model: target, path: childPath });
+    const walkChild = (child, op) => isPlainObject5(child) ? walkWhere({ ctx, model: target, where: child, path: `${childPath}.${op}` }) : child;
+    const parts = [];
+    if (relation.isList) {
+      if (!isPlainObject5(value)) {
+        out[key] = value;
+        continue;
+      }
+      for (const [op, operand] of Object.entries(value)) {
+        if (operand === undefined)
+          continue;
+        if (op === "some" || op === "none") {
+          const walked = walkChild(operand, op);
+          parts.push({ [op]: scoped ? { AND: [walked, pred()] } : walked });
+        } else if (op === "every") {
+          const walked = walkChild(operand, op);
+          parts.push(scoped ? { none: { AND: [pred(), { NOT: [walked] }] } } : { every: walked });
+        } else {
+          parts.push({ [op]: operand });
+        }
+      }
+    } else {
+      const arms = [];
+      if (value === null) {
+        arms.push({ arm: "is", operand: null });
+      } else if (isPlainObject5(value) && (("is" in value) || ("isNot" in value))) {
+        let mixed = false;
+        for (const [op, operand] of Object.entries(value)) {
+          if (operand === undefined)
+            continue;
+          if (op === "is" || op === "isNot")
+            arms.push({ arm: op, operand });
+          else
+            mixed = true;
+        }
+        if (mixed) {
+          out[key] = value;
+          continue;
+        }
+      } else if (isPlainObject5(value)) {
+        arms.push({ arm: "is", operand: value });
+      } else {
+        out[key] = value;
+        continue;
+      }
+      for (const { arm, operand } of arms) {
+        if (operand === null) {
+          parts.push(scoped ? arm === "is" ? { isNot: pred() } : { is: pred() } : { [arm]: null });
+        } else {
+          const walked = walkChild(operand, arm);
+          parts.push({ [arm]: scoped ? { AND: [walked, pred()] } : walked });
+        }
+      }
+    }
+    if (parts.length === 0) {
+      out[key] = value;
+      continue;
+    }
+    const combined = {};
+    for (const part of parts) {
+      const opKey = Object.keys(part)[0];
+      if (opKey in combined)
+        extra.push({ [key]: part });
+      else
+        combined[opKey] = part[opKey];
+    }
+    out[key] = combined;
+  }
+  if (extra.length > 0) {
+    const existing = out.AND === undefined ? [] : Array.isArray(out.AND) ? out.AND : [out.AND];
+    out.AND = [...existing, ...extra];
+  }
+  return out;
+}
+function walkOrderTerm(params) {
+  const { ctx, model, term, path } = params;
+  const entry = entryOf(ctx, model);
+  for (const [key, spec] of Object.entries(term)) {
+    if (spec === undefined)
+      continue;
+    const relation = model.relationByName.get(key);
+    if (relation === undefined)
+      continue;
+    const target = ctx.meta.modelByName.get(relation.targetModel);
+    const targetEntry = entryOf(ctx, target);
+    const tenancyEdge = entry.kind === "through" && entry.relation.name === key;
+    if (targetEntry.kind !== "none" && !tenancyEdge) {
+      throw refusal({
+        model: target.name,
+        path: `${path}.${key}`,
+        reason: "relation_orderby_on_scoped",
+        message: `$scoped: orderBy through ${model.name}.${key} reaches scoped model ${target.name} \u2014 ordering by a foreign row's values would leak; order by own columns instead`
+      });
+    }
+    if (isPlainObject5(spec)) {
+      walkOrderTerm({ ctx, model: target, term: spec, path: `${path}.${key}` });
+    }
+  }
+}
+function walkOrderBy(params) {
+  const { ctx, model, orderBy, path } = params;
+  const terms = Array.isArray(orderBy) ? orderBy : [orderBy];
+  for (const term of terms) {
+    if (isPlainObject5(term))
+      walkOrderTerm({ ctx, model, term, path });
+  }
+}
+function walkCountSpec(params) {
+  const { ctx, model, spec, path } = params;
+  const guard = (relation) => {
+    const target = ctx.meta.modelByName.get(relation.targetModel);
+    const targetEntry = entryOf(ctx, target);
+    if (targetEntry.kind === "none")
+      return;
+    if (isTenancyInverse({ ctx, model, relation }))
+      return;
+    throw refusal({
+      model: target.name,
+      path: `${path}.${relation.name}`,
+      reason: "count_on_scoped_relation",
+      message: `$scoped: _count of ${model.name}.${relation.name} would count ${target.name} rows across tenants (relation counts take no filter) \u2014 select the relation with a where instead`
+    });
+  };
+  if (spec === true) {
+    for (const relation of model.relations) {
+      if (relation.isList)
+        guard(relation);
+    }
+    return;
+  }
+  if (!isPlainObject5(spec) || !isPlainObject5(spec.select))
+    return;
+  for (const [name, flag] of Object.entries(spec.select)) {
+    if (flag === undefined || flag === false)
+      continue;
+    const relation = model.relationByName.get(name);
+    if (relation !== undefined)
+      guard(relation);
+  }
+}
+function walkSelection(params) {
+  const { ctx, model, args, path } = params;
+  for (const blockKey of ["include", "select"]) {
+    const block = args[blockKey];
+    if (!isPlainObject5(block))
+      continue;
+    const next = { ...block };
+    for (const [name, spec] of Object.entries(block)) {
+      if (spec === undefined || spec === false)
+        continue;
+      const blockPath = `${path}.${blockKey}`;
+      if (name === "_count") {
+        walkCountSpec({ ctx, model, spec, path: `${blockPath}._count` });
+        continue;
+      }
+      const relation = model.relationByName.get(name);
+      if (relation === undefined)
+        continue;
+      const target = ctx.meta.modelByName.get(relation.targetModel);
+      const targetEntry = entryOf(ctx, target);
+      const scoped = targetEntry.kind !== "none";
+      const childPath = `${blockPath}.${name}`;
+      if (spec === true && !scoped)
+        continue;
+      const child = spec === true ? {} : isPlainObject5(spec) ? { ...spec } : spec;
+      if (!isPlainObject5(child))
+        continue;
+      const walkedWhere = isPlainObject5(child.where) ? walkWhere({ ctx, model: target, where: child.where, path: `${childPath}.where` }) : child.where;
+      if (scoped) {
+        child.where = mergeWhere2({ where: walkedWhere, pred: requirePred({ ctx, model: target, path: childPath }) });
+      } else if (walkedWhere !== undefined) {
+        child.where = walkedWhere;
+      }
+      if (child.orderBy !== undefined) {
+        walkOrderBy({ ctx, model: target, orderBy: child.orderBy, path: `${childPath}.orderBy` });
+      }
+      walkSelection({ ctx, model: target, args: child, path: childPath });
+      next[name] = child;
+    }
+    args[blockKey] = next;
+  }
+}
+var REFERENCE_VERBS2 = [
+  "connect",
+  "connectOrCreate",
+  "set",
+  "disconnect",
+  "update",
+  "updateMany",
+  "upsert",
+  "delete",
+  "deleteMany"
+];
+function nestedModeFor(entry) {
+  return entry.kind === "none" ? "verify" : entry.nested;
+}
+function mapItems(value, fn) {
+  return Array.isArray(value) ? value.map(fn) : fn(value);
+}
+function walkCreateData(params) {
+  const { ctx, model, data, path } = params;
+  if (!isPlainObject5(data))
+    return data;
+  const entry = entryOf(ctx, model);
+  const out = { ...data };
+  if (entry.kind === "column") {
+    requirePred({ ctx, model, path });
+    const given = out[entry.field.name];
+    if (given !== undefined && given !== ctx.scope) {
+      throw refusal({
+        model: model.name,
+        path: `${path}.${entry.field.name}`,
+        reason: "explicit_scope_mismatch",
+        message: `$scoped: create on ${model.name} sets ${entry.field.name} to ${given === null ? "null" : "a different tenant"} \u2014 the scoped handle owns that column`
+      });
+    }
+    out[entry.field.name] = ctx.scope;
+  }
+  if (entry.kind === "through" && params.viaTenancyEdge !== true) {
+    requirePred({ ctx, model, path });
+    const link = resolveRelationLink({ meta: ctx.meta, model, relation: entry.relation });
+    if (link.kind === "toOneOwner" && out[link.parentKey.name] !== undefined) {
+      throw refusal({
+        model: model.name,
+        path: `${path}.${link.parentKey.name}`,
+        reason: "through_fk_write",
+        message: `$scoped: writing ${model.name}.${link.parentKey.name} directly would bypass tenant verification \u2014 use ${entry.relation.name}: { connect: \u2026 } instead`
+      });
+    }
+    if (out[entry.relation.name] === undefined) {
+      throw refusal({
+        model: model.name,
+        path,
+        reason: "through_fk_write",
+        message: `$scoped: create on ${model.name} must bind its tenancy parent \u2014 provide ${entry.relation.name}: { connect | create | connectOrCreate: \u2026 }`
+      });
+    }
+  }
+  for (const [key, value] of Object.entries(out)) {
+    const relation = model.relationByName.get(key);
+    if (relation === undefined || !isPlainObject5(value))
+      continue;
+    out[key] = walkNestedVerbs({ ctx, model, relation, verbs: value, path: `${path}.${key}`, phase: "create" });
+  }
+  return out;
+}
+function walkUpdateData(params) {
+  const { ctx, model, data, path } = params;
+  if (!isPlainObject5(data))
+    return data;
+  const entry = entryOf(ctx, model);
+  const out = { ...data };
+  if (entry.kind === "column") {
+    const given = out[entry.field.name];
+    if (given !== undefined) {
+      const setValue = isPlainObject5(given) && Object.keys(given).length === 1 ? given.set : given;
+      if (setValue !== ctx.scope) {
+        throw refusal({
+          model: model.name,
+          path: `${path}.${entry.field.name}`,
+          reason: "explicit_scope_mismatch",
+          message: `$scoped: update on ${model.name} writes ${entry.field.name} \u2014 a scoped handle cannot move rows between tenants`
+        });
+      }
+    }
+  }
+  if (entry.kind === "through") {
+    const link = resolveRelationLink({ meta: ctx.meta, model, relation: entry.relation });
+    if (link.kind === "toOneOwner" && out[link.parentKey.name] !== undefined) {
+      throw refusal({
+        model: model.name,
+        path: `${path}.${link.parentKey.name}`,
+        reason: "through_fk_write",
+        message: `$scoped: writing ${model.name}.${link.parentKey.name} directly would bypass tenant verification \u2014 use ${entry.relation.name}: { connect: \u2026 } instead`
+      });
+    }
+  }
+  for (const [key, value] of Object.entries(out)) {
+    const relation = model.relationByName.get(key);
+    if (relation === undefined || !isPlainObject5(value))
+      continue;
+    out[key] = walkNestedVerbs({ ctx, model, relation, verbs: value, path: `${path}.${key}`, phase: "update" });
+  }
+  return out;
+}
+function walkNestedVerbs(params) {
+  const { ctx, model, relation, verbs, path, phase } = params;
+  const target = ctx.meta.modelByName.get(relation.targetModel);
+  const targetEntry = entryOf(ctx, target);
+  const scoped = targetEntry.kind !== "none";
+  const modelEntry = entryOf(ctx, model);
+  const pairedDown = scoped && isTenancyInverse({ ctx, model, relation });
+  const tenancyEdge = modelEntry.kind === "through" && modelEntry.relation.name === relation.name;
+  const implicitSafe = pairedDown || tenancyEdge;
+  const mode = nestedModeFor(targetEntry);
+  const out = { ...verbs };
+  const pred = (verbPath) => requirePred({ ctx, model: target, path: verbPath });
+  const refuse = (verb, why) => {
+    throw refusal({
+      model: target.name,
+      path: `${path}.${verb}`,
+      reason: "nested_refused",
+      message: `$scoped: nested "${verb}" on ${model.name}.${relation.name} (${target.name}) ${why}`
+    });
+  };
+  const walkTargetWhere = (where, verbPath) => isPlainObject5(where) ? walkWhere({ ctx, model: target, where, path: verbPath }) : where;
+  const uniqueWhere = (where, verbPath) => {
+    const walked = walkTargetWhere(where, verbPath);
+    return scoped ? injectUniqueWhere({ where: walked, pred: pred(verbPath) }) : walked;
+  };
+  const filterWhere = (where, verbPath) => {
+    const walked = walkTargetWhere(where, verbPath);
+    return scoped ? mergeWhere2({ where: walked ?? {}, pred: pred(verbPath) }) : walked;
+  };
+  const walkChildCreate = (item, verbPath) => walkCreateData({ ctx, model: target, data: item, path: verbPath, viaTenancyEdge: pairedDown });
+  const walkChildUpdate = (item, verbPath) => walkUpdateData({ ctx, model: target, data: item, path: verbPath });
+  const link = () => resolveRelationLink({ meta: ctx.meta, model, relation });
+  for (const [verb, operand] of Object.entries(verbs)) {
+    if (operand === undefined)
+      continue;
+    const verbPath = `${path}.${verb}`;
+    if (verb === "create") {
+      out[verb] = mapItems(operand, (item) => walkChildCreate(item, verbPath));
+      continue;
+    }
+    if (scoped && mode === "refuse" && REFERENCE_VERBS2.includes(verb)) {
+      refuse(verb, `is disabled \u2014 ${target.name} is configured nested: "refuse"; go through the base client or its own delegate`);
+    }
+    switch (verb) {
+      case "connect":
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      case "connectOrCreate":
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? { ...item, where: uniqueWhere(item.where, verbPath), create: walkChildCreate(item.create, verbPath) } : item);
+        break;
+      case "set": {
+        if (phase === "create")
+          break;
+        if (scoped) {
+          const kind = link().kind;
+          if (kind === "manyToMany")
+            refuse(verb, "clears the whole join set \u2014 unlinking other tenants' rows cannot be verified; disconnect explicit rows instead");
+          if (!implicitSafe)
+            refuse(verb, "first detaches EVERY current child, which cannot be tenant-filtered on this edge; disconnect explicit rows instead");
+        }
+        out[verb] = mapItems(operand ?? [], (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      }
+      case "disconnect": {
+        if (!relation.isList) {
+          if (scoped) {
+            const kind = link().kind;
+            if (kind === "toOneOwner") {
+              if (tenancyEdge) {
+                refuse(verb, "would orphan the row out of its tenant (through-parent set to null) \u2014 delete it or connect a replacement");
+              }
+            } else if (!implicitSafe) {
+              refuse(verb, "targets whatever row currently points here \u2014 not tenant-verifiable on this edge");
+            }
+          }
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      }
+      case "delete": {
+        if (!relation.isList) {
+          if (scoped && !implicitSafe) {
+            refuse(verb, "targets whatever row is currently connected \u2014 not tenant-verifiable on this edge");
+          }
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? uniqueWhere(item, verbPath) : item);
+        break;
+      }
+      case "update": {
+        if (!relation.isList) {
+          if (scoped && !implicitSafe) {
+            refuse(verb, "targets whatever row is currently connected \u2014 not tenant-verifiable on this edge; update it through its own delegate");
+          }
+          out[verb] = isPlainObject5(operand) ? "data" in operand && isPlainObject5(operand.data) ? { ...operand, data: walkChildUpdate(operand.data, verbPath) } : walkChildUpdate(operand, verbPath) : operand;
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? { ...item, where: uniqueWhere(item.where, verbPath), data: walkChildUpdate(item.data, verbPath) } : item);
+        break;
+      }
+      case "updateMany":
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? { ...item, where: filterWhere(item.where, verbPath), data: walkChildUpdate(item.data, verbPath) } : item);
+        break;
+      case "deleteMany":
+        out[verb] = mapItems(operand, (item) => filterWhere(item, verbPath));
+        break;
+      case "upsert": {
+        if (!relation.isList) {
+          if (scoped && !implicitSafe) {
+            refuse(verb, "updates whatever row is currently connected \u2014 not tenant-verifiable on this edge");
+          }
+          out[verb] = isPlainObject5(operand) ? {
+            ...operand,
+            create: walkChildCreate(operand.create, verbPath),
+            update: walkChildUpdate(operand.update, verbPath)
+          } : operand;
+          break;
+        }
+        out[verb] = mapItems(operand, (item) => isPlainObject5(item) ? {
+          ...item,
+          where: uniqueWhere(item.where, verbPath),
+          create: walkChildCreate(item.create, verbPath),
+          update: walkChildUpdate(item.update, verbPath)
+        } : item);
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  return out;
+}
+function createScopeRewriter(params) {
+  const { meta, models, scope } = params;
+  const resolved = resolveScopedModels({ meta, models });
+  if (scope !== null)
+    assertScopeType({ meta, resolved, scope });
+  const preds = scope === null ? new Map : buildPreds({ meta, resolved, scope });
+  return {
+    rewrite: (call) => rewriteScopedCall({
+      meta,
+      resolved,
+      scope,
+      preds,
+      model: call.model,
+      method: call.method,
+      args: call.args
+    })
+  };
+}
+var FIND_LIKE = ["findMany", "findFirst", "findFirstOrThrow", "count", "aggregate", "groupBy"];
+function rewriteScopedCall(params) {
+  const { meta, resolved, scope, preds, method } = params;
+  const ctx = { meta, resolved, scope, preds };
+  const model = getModelMeta({ meta, model: params.model });
+  const entry = entryOf(ctx, model);
+  const scoped = entry.kind !== "none";
+  const root = `${model.clientName}.${method}`;
+  const args = { ...params.args ?? {} };
+  const ownPred = () => requirePred({ ctx, model, path: root });
+  const walkOwnWhere = (where, path) => isPlainObject5(where) ? walkWhere({ ctx, model, where, path }) : where;
+  if (FIND_LIKE.includes(method)) {
+    const walked = walkOwnWhere(args.where, `${root}.where`);
+    if (scoped)
+      args.where = mergeWhere2({ where: walked, pred: ownPred() });
+    else if (walked !== undefined)
+      args.where = walked;
+    if (args.orderBy !== undefined)
+      walkOrderBy({ ctx, model, orderBy: args.orderBy, path: `${root}.orderBy` });
+    walkSelection({ ctx, model, args, path: root });
+    return { model: model.name, method, args };
+  }
+  switch (method) {
+    case "findUnique":
+    case "findUniqueOrThrow": {
+      walkSelection({ ctx, model, args, path: root });
+      if (!scoped) {
+        const walked2 = walkOwnWhere(args.where, `${root}.where`);
+        if (walked2 !== undefined)
+          args.where = walked2;
+        return { model: model.name, method, args };
+      }
+      const flat = isPlainObject5(args.where) ? flattenUniqueWhere({ model, where: args.where }) : args.where;
+      const walked = isPlainObject5(flat) ? walkWhere({ ctx, model, where: flat, path: `${root}.where` }) : flat;
+      args.where = mergeWhere2({ where: walked, pred: ownPred() });
+      return {
+        model: model.name,
+        method: method === "findUnique" ? "findFirst" : "findFirstOrThrow",
+        args
+      };
+    }
+    case "create": {
+      args.data = walkCreateData({ ctx, model, data: args.data ?? {}, path: `${root}.data` });
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "createMany":
+    case "createManyAndReturn": {
+      const rows = args.data;
+      args.data = Array.isArray(rows) ? rows.map((row) => walkCreateData({ ctx, model, data: row, path: `${root}.data` })) : walkCreateData({ ctx, model, data: rows ?? {}, path: `${root}.data` });
+      if (method === "createManyAndReturn")
+        walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "update": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      args.where = scoped ? injectUniqueWhere({ where: walked, pred: ownPred() }) : walked;
+      args.data = walkUpdateData({ ctx, model, data: args.data ?? {}, path: `${root}.data` });
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "updateMany": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      if (scoped)
+        args.where = mergeWhere2({ where: walked, pred: ownPred() });
+      else if (walked !== undefined)
+        args.where = walked;
+      args.data = walkUpdateData({ ctx, model, data: args.data ?? {}, path: `${root}.data` });
+      return { model: model.name, method, args };
+    }
+    case "upsert": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      args.where = scoped ? injectUniqueWhere({ where: walked, pred: ownPred() }) : walked;
+      args.create = walkCreateData({ ctx, model, data: args.create ?? {}, path: `${root}.create` });
+      args.update = walkUpdateData({ ctx, model, data: args.update ?? {}, path: `${root}.update` });
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "delete": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      args.where = scoped ? injectUniqueWhere({ where: walked, pred: ownPred() }) : walked;
+      walkSelection({ ctx, model, args, path: root });
+      return { model: model.name, method, args };
+    }
+    case "deleteMany": {
+      const walked = walkOwnWhere(args.where, `${root}.where`);
+      if (scoped)
+        args.where = mergeWhere2({ where: walked, pred: ownPred() });
+      else if (walked !== undefined)
+        args.where = walked;
+      return { model: model.name, method, args };
+    }
+    default:
+      return { model: model.name, method, args: params.args };
+  }
+}
+function scopedDelegate2(params) {
+  const { ctx, model, base } = params;
+  const run = (method, args) => {
+    let rewritten;
+    try {
+      rewritten = rewriteScopedCall({
+        meta: ctx.meta,
+        resolved: ctx.resolved,
+        scope: ctx.scope,
+        preds: ctx.preds,
+        model: model.name,
+        method,
+        args
+      });
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    const target = base[rewritten.method];
+    return target(rewritten.args);
+  };
+  return {
+    findMany: (args) => run("findMany", args),
+    findFirst: (args) => run("findFirst", args),
+    findFirstOrThrow: (args) => run("findFirstOrThrow", args),
+    findUnique: (args) => run("findUnique", args),
+    findUniqueOrThrow: (args) => run("findUniqueOrThrow", args),
+    create: (args) => run("create", args),
+    createMany: (args) => run("createMany", args),
+    createManyAndReturn: (args) => run("createManyAndReturn", args),
+    update: (args) => run("update", args),
+    updateMany: (args) => run("updateMany", args),
+    upsert: (args) => run("upsert", args),
+    delete: (args) => run("delete", args),
+    deleteMany: (args) => run("deleteMany", args),
+    count: (args) => run("count", args),
+    aggregate: (args) => run("aggregate", args),
+    groupBy: (args) => run("groupBy", args)
+  };
+}
+function scopeExtensionProps2(params) {
+  const { ctx, model, base, delegate } = params;
+  const entry = entryOf(ctx, model);
+  const out = {};
+  for (const [key, prop] of Object.entries(base)) {
+    if (key in delegate)
+      continue;
+    if (typeof prop === "function") {
+      out[key] = (args) => {
+        try {
+          const path = `${model.clientName}.${key}`;
+          const walked = isPlainObject5(args?.where) ? walkWhere({ ctx, model, where: args.where, path: `${path}.where` }) : args?.where;
+          const where = entry.kind === "none" ? walked : mergeWhere2({ where: walked, pred: requirePred({ ctx, model, path }) });
+          return prop({ ...args ?? {}, ...where === undefined ? {} : { where } });
+        } catch (error) {
+          return Promise.reject(error);
+        }
+      };
+    } else if (isPlainObject5(prop)) {
+      out[key] = scopeExtensionProps2({
+        ctx,
+        model,
+        base: prop,
+        delegate: {}
+      });
+    }
+  }
+  return out;
+}
+function forbidden(params) {
+  return refusal({
+    model: "*",
+    path: params.method,
+    reason: "raw_forbidden",
+    message: `$scoped: ${params.method} is not available on a scoped handle \u2014 raw SQL cannot be tenant-verified; run it on the BASE client (the deliberate unscoped escape)`
+  });
+}
+var RAW_METHODS = ["$queryRaw", "$executeRaw", "$queryRawUnsafe", "$executeRawUnsafe"];
+function buildScopedOver(params) {
+  const { ctx, client } = params;
+  const scoped = Object.create(client);
+  const scopedModels = { ...client.$models };
+  for (const model of ctx.meta.models) {
+    const base = client.$models[model.name];
+    const delegate = scopedDelegate2({ ctx, model, base });
+    const full = { ...delegate, ...scopeExtensionProps2({ ctx, model, base, delegate }) };
+    scopedModels[model.name] = full;
+    scopedModels[model.clientName] = full;
+    Object.defineProperty(scoped, model.clientName, { value: full, enumerable: true });
+  }
+  Object.defineProperty(scoped, "$models", { value: scopedModels, enumerable: true });
+  attachDefineView({ client: scoped, meta: ctx.meta, models: scopedModels });
+  Object.defineProperty(scoped, "$transaction", {
+    value: (arg, options) => typeof arg === "function" ? client.$transaction((tx) => arg(buildScopedOver({ ctx, client: tx })), options) : client.$transaction(arg, options),
+    enumerable: true
+  });
+  for (const method of RAW_METHODS) {
+    Object.defineProperty(scoped, method, {
+      value: () => Promise.reject(forbidden({ method })),
+      enumerable: true
+    });
+  }
+  Object.defineProperty(scoped, "$scoped", {
+    value: () => {
+      throw refusal({
+        model: "*",
+        path: "$scoped",
+        reason: "rescope_forbidden",
+        message: "$scoped: this handle is already scoped \u2014 build a differently-scoped handle from the BASE client"
+      });
+    },
+    enumerable: true
+  });
+  return scoped;
+}
+function attachScoped(params) {
+  const { client, meta } = params;
+  Object.defineProperty(client, "$scoped", {
+    value: (config) => {
+      if (!isPlainObject5(config) || !isPlainObject5(config.models)) {
+        throw new VibeError13({
+          code: "VIBE_VALIDATION",
+          message: "$scoped takes { scope: string | number | bigint | null, models: { <Model>: \u2026 } }"
+        });
+      }
+      const policied = meta.models.filter((model) => model.policy !== undefined);
+      if (policied.length > 0) {
+        throw refusal({
+          model: policied[0]?.name,
+          path: "$scoped",
+          reason: "policy_conflict",
+          message: `$scoped: the schema declares @@policy on ${policied.map((model) => model.name).join(", ")} \u2014 use $withPolicy for policied schemas; the two scoping layers do not combine`
+        });
+      }
+      const scope = config.scope;
+      if (scope !== null && typeof scope !== "string" && typeof scope !== "number" && typeof scope !== "bigint") {
+        throw new VibeError13({
+          code: "VIBE_VALIDATION",
+          message: `$scoped: scope must be a string, number, bigint or null \u2014 got ${typeof scope}`
+        });
+      }
+      const resolved = resolveScopedModels({ meta, models: config.models });
+      if (scope !== null)
+        assertScopeType({ meta, resolved, scope });
+      const preds = scope === null ? new Map : buildPreds({ meta, resolved, scope });
+      const ctx = { meta, resolved, scope, preds };
+      return buildScopedOver({ ctx, client });
+    },
+    enumerable: true
+  });
+}
 // packages/runtime/src/client.ts
-import { VibeError as VibeError13, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
+import { VibeError as VibeError14, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
 import { ParamCollector, getSqlDialect } from "@vibeorm/sql";
 
 // packages/runtime/src/render-cache.ts
@@ -6031,7 +6962,7 @@ function walkExpr(walk, dialect, expr) {
       return true;
   }
 }
-function walkOrderTerm(walk, dialect, term) {
+function walkOrderTerm2(walk, dialect, term) {
   if ("agg" in term) {
     walk.key += "a";
     addAgg(walk, term.agg);
@@ -6081,7 +7012,7 @@ function walkSelect(walk, dialect, statement) {
       addCol(walk, column);
     walk.key += ":";
     for (const term of statement.rowNumber.orderBy) {
-      if (!walkOrderTerm(walk, dialect, term))
+      if (!walkOrderTerm2(walk, dialect, term))
         return false;
     }
     addIdent(walk, statement.rowNumber.alias);
@@ -6136,7 +7067,7 @@ function walkSelect(walk, dialect, statement) {
   if (statement.orderBy !== undefined && statement.orderBy.length > 0) {
     walk.key += "o(";
     for (const term of statement.orderBy) {
-      if (!walkOrderTerm(walk, dialect, term))
+      if (!walkOrderTerm2(walk, dialect, term))
         return false;
     }
     walk.key += ")";
@@ -6294,7 +7225,7 @@ function renderStatementCached(params) {
 // packages/runtime/src/client.ts
 function notFound2(params) {
   const { model, method } = params;
-  return new VibeError13({
+  return new VibeError14({
     code: "VIBE_NOT_FOUND",
     message: `no ${model} record matched the where clause of ${method}()`,
     meta: { model, method }
@@ -6302,7 +7233,7 @@ function notFound2(params) {
 }
 function viewIsReadOnly(params) {
   const { model, method } = params;
-  return new VibeError13({
+  return new VibeError14({
     code: "VIBE_VALIDATION",
     message: `${model} is a view \u2014 ${method}() is not available on views (they are read-only); write to the underlying table instead`,
     meta: { model, method }
@@ -6431,7 +7362,7 @@ class QueryPromise extends Promise {
   }
   claim() {
     if (this.started) {
-      throw new VibeError13({
+      throw new VibeError14({
         code: "VIBE_VALIDATION",
         message: "$transaction([...]) needs operations that have not dispatched \u2014 pass delegate calls in the same tick they are created (this one was awaited or created earlier and already executed outside the transaction)"
       });
@@ -6509,7 +7440,7 @@ async function runAffected(params) {
 function plan(params) {
   const { engine, model, method, args } = params;
   if (args !== undefined && args["lock"] !== undefined && engine.inTransaction !== true) {
-    throw new VibeError13({
+    throw new VibeError14({
       code: "VIBE_VALIDATION",
       message: `lock on ${model}.${method}() requires a transaction \u2014 call it on the client $transaction hands its callback (outside one, the lock would release at statement end)`,
       meta: { model, method }
@@ -6582,7 +7513,7 @@ async function insertedKeyWhere(params) {
   });
   const id = result.rows[0]?.id;
   if (id === undefined || id === null) {
-    throw new VibeError13({
+    throw new VibeError14({
       code: "VIBE_INTERNAL",
       message: `could not read back the generated key for ${source.model.name}`,
       meta: { model: source.model.name }
@@ -6884,7 +7815,7 @@ function createDelegate(params) {
     const skipping = args.onConflict !== undefined;
     if (hasNestedWrites({ model: modelMeta, data: args.data })) {
       if (skipping) {
-        throw new VibeError13({
+        throw new VibeError14({
           code: "VIBE_VALIDATION",
           message: `onConflict cannot combine with nested writes on ${modelMeta.name}.create() \u2014 insert the parent row alone, then connect relations`,
           meta: { model: modelMeta.name }
@@ -6968,7 +7899,7 @@ function createDelegate(params) {
   const upsert = async (target, args) => {
     const modelMeta = getModelMeta({ meta: target.meta, model });
     if (hasNestedWrites({ model: modelMeta, data: args.create }) || hasNestedWrites({ model: modelMeta, data: args.update })) {
-      throw new VibeError13({
+      throw new VibeError14({
         code: "VIBE_VALIDATION",
         message: `nested writes are not supported inside upsert arms on ${modelMeta.name} \u2014 use create()/update() with nested data`,
         meta: { model: modelMeta.name }
@@ -6976,7 +7907,7 @@ function createDelegate(params) {
     }
     if (!upsertUsesNativeStatement({ model: modelMeta, args })) {
       if (args.onConflict !== undefined) {
-        throw new VibeError13({
+        throw new VibeError14({
           code: "VIBE_VALIDATION",
           message: `onConflict on ${modelMeta.name}.upsert() needs the native single-statement path \u2014 this shape (a guard field beyond the conflict target, or create data not binding the where's key) runs the find-then-write fallback, which cannot honor an explicit conflict target`,
           meta: { model: modelMeta.name }
@@ -7153,7 +8084,7 @@ function buildClient(params) {
     let claimError = null;
     for (const operation of operations) {
       if (!(operation instanceof QueryPromise)) {
-        claimError = new VibeError13({
+        claimError = new VibeError14({
           code: "VIBE_VALIDATION",
           message: "$transaction([...]) takes query promises from model delegate calls \u2014 a foreign promise is already running and cannot join the transaction"
         });
@@ -7192,7 +8123,7 @@ function buildClient(params) {
     $models: models,
     $on: (event, listener) => {
       if (event !== "query") {
-        throw new VibeError13({
+        throw new VibeError14({
           code: "VIBE_VALIDATION",
           message: `unknown client event "${String(event)}" \u2014 supported: "query"`,
           meta: { event }
@@ -7226,6 +8157,7 @@ function buildClient(params) {
   }
   attachExtensionMounts({ engine, client, models });
   attachDefineView({ client, meta: engine.meta, models });
+  attachScoped({ client, meta: engine.meta });
   attachPolicy({ client, meta: engine.meta });
   return client;
 }
@@ -7256,7 +8188,7 @@ function makeMountContext(params) {
     compileWhere: ({ where, model: modelName, qualify }) => {
       const target = modelName === undefined ? model : getModelMeta({ meta: engine.meta, model: modelName });
       if (target === null) {
-        throw new VibeError13({
+        throw new VibeError14({
           code: "VIBE_INTERNAL",
           message: `extension "${extension}" compiled a where with no model in scope`,
           meta: { extension }
@@ -7282,7 +8214,7 @@ function attachExtensionMounts(params) {
       const model = getModelMeta({ meta: engine.meta, model: mount.model ?? "" });
       const delegate = models[model.name];
       if (delegate === undefined || mount.property in delegate) {
-        throw new VibeError13({
+        throw new VibeError14({
           code: "VIBE_CONFIG",
           message: `extension "${mount.extension}" cannot mount "${mount.property}" on ${model.name} \u2014 the name is taken`,
           meta: { extension: mount.extension, model: model.name, property: mount.property }
@@ -7293,7 +8225,7 @@ function attachExtensionMounts(params) {
       continue;
     }
     if (!mount.property.startsWith("$") || mount.property in client) {
-      throw new VibeError13({
+      throw new VibeError14({
         code: "VIBE_CONFIG",
         message: `extension "${mount.extension}" cannot mount client property "${mount.property}" \u2014 root mounts are $-prefixed and must not collide`,
         meta: { extension: mount.extension, property: mount.property }
@@ -7313,7 +8245,7 @@ function createClient(params) {
     assertComputedManifest({ manifest: computed.manifest, specs: computed.specs });
   }
   if (computed === undefined && options !== undefined && options["computed"] !== undefined) {
-    throw new VibeError13({
+    throw new VibeError14({
       code: "VIBE_CONFIG",
       message: "this client was generated without computed fields \u2014 declare them in vibeorm.config.ts and re-run vibeorm generate",
       meta: {}
@@ -7345,6 +8277,8 @@ export {
   updateWithNested,
   toSqlExecutor,
   toClientName,
+  rewriteScopedCall,
+  resolveScopedModels,
   resolveResultShape,
   resolveRelationSelection,
   resolveRelationLink,
@@ -7368,6 +8302,7 @@ export {
   dbNow,
   createWithNested,
   createView,
+  createScopeRewriter,
   createClient,
   compileWhere,
   compileSelect,
@@ -7376,6 +8311,7 @@ export {
   buildQuery,
   buildExtensionOperatorMap,
   buildConnectHooks,
+  attachScoped,
   attachRelations,
   attachPolicy,
   attachLateralRelations,
@@ -7392,4 +8328,4 @@ export {
   COUNT_ALIAS
 };
 
-//# debugId=EC61C00B9601D9AD64756E2164756E21
+//# debugId=AB87792190B87F3664756E2164756E21