@vibeorm/schema 2.0.0-alpha.6 → 2.0.0-alpha.8

package/dist/index.js

@@ -16,18 +16,26 @@ function providerToDialect(params) {
 function isEnumType(fieldType) {
   return typeof fieldType === "object" && "enum" in fieldType;
 }
+var ENUM_STORAGES = ["database", "string"];
+function enumStorageOf(params) {
+  return params.enumDef.storage ?? "database";
+}
 // packages/schema/src/errors.ts
 var VIBE_ERROR_CODES = [
   "VIBE_NOT_FOUND",
   "VIBE_UNIQUE_VIOLATION",
   "VIBE_FK_VIOLATION",
   "VIBE_VALIDATION",
+  "VIBE_DATA_INVALID",
   "VIBE_SCHEMA_INVALID",
   "VIBE_UNSUPPORTED_CAPABILITY",
   "VIBE_STALE_CLIENT",
   "VIBE_CONFIG",
   "VIBE_MIGRATION",
   "VIBE_TRANSACTION",
+  "VIBE_SCOPED",
+  "VIBE_RLS_CONTEXT",
+  "VIBE_PERMISSION_DENIED",
   "VIBE_ADAPTER",
   "VIBE_INTERNAL"
 ];
@@ -50,6 +58,23 @@ function unsupportedCapability(params) {
     meta: { dialect, feature }
   });
 }
+var STORED_VALUE_PREVIEW_LENGTH = 80;
+function describeStoredValue(params) {
+  const { value } = params;
+  if (typeof value !== "string")
+    return value === null ? "null" : typeof value;
+  return value.length > STORED_VALUE_PREVIEW_LENGTH ? `${value.slice(0, STORED_VALUE_PREVIEW_LENGTH)}\u2026` : value;
+}
+function invalidStoredData(params) {
+  const { model, field, enum: enumName, value } = params;
+  const preview = describeStoredValue({ value });
+  const invariant = enumName === undefined ? "the schema's invariant" : `enum ${enumName}`;
+  return new VibeError({
+    code: "VIBE_DATA_INVALID",
+    message: `Stored value on ${model}.${field} violates ${invariant}: ${JSON.stringify(preview)} \u2014 clean the rows (or stop the writer) before reading them through the ORM`,
+    meta: { model, field, ...enumName === undefined ? {} : { enum: enumName }, value: preview }
+  });
+}
 function internalError(params) {
   return new VibeError({
     code: "VIBE_INTERNAL",
@@ -57,6 +82,154 @@ function internalError(params) {
     meta: params.meta
   });
 }
+var RLS_CONTEXT_REASONS = Object.freeze([
+  "missing",
+  "invalid",
+  "expired",
+  "conflicting"
+]);
+
+class RlsContextError extends VibeError {
+  reason;
+  constructor(params) {
+    super({
+      code: "VIBE_RLS_CONTEXT",
+      message: `Native RLS context is ${params.reason}${params.key === undefined ? "" : ` at key ${JSON.stringify(params.key)}`}`,
+      meta: { reason: params.reason, ...params.key === undefined ? {} : { key: params.key } }
+    });
+    this.name = "RlsContextError";
+    this.reason = params.reason;
+  }
+}
+var SCOPED_REFUSAL_REASONS = [
+  "policy_conflict",
+  "unclassified_model",
+  "unknown_model",
+  "unknown_column",
+  "column_not_scopeable",
+  "unknown_relation",
+  "through_chain_invalid",
+  "invalid_entry",
+  "scope_type_mismatch",
+  "null_scope",
+  "raw_forbidden",
+  "rescope_forbidden",
+  "explicit_scope_mismatch",
+  "through_fk_write",
+  "nested_refused",
+  "relation_orderby_on_scoped",
+  "count_on_scoped_relation"
+];
+
+class ScopedQueryError extends VibeError {
+  model;
+  path;
+  reason;
+  constructor(params) {
+    super({
+      code: "VIBE_SCOPED",
+      message: params.message,
+      meta: { ...params.meta, model: params.model, path: params.path, reason: params.reason }
+    });
+    this.name = "ScopedQueryError";
+    this.model = params.model;
+    this.path = params.path;
+    this.reason = params.reason;
+  }
+}
+// packages/schema/src/prisma-literal.ts
+var STRING_ESCAPES = {
+  '"': '"',
+  "'": "'",
+  "\\": "\\",
+  "/": "/",
+  n: `
+`,
+  r: "\r",
+  t: "\t",
+  b: "\b",
+  f: "\f"
+};
+function malformed(params) {
+  return new VibeError({
+    code: "VIBE_SCHEMA_INVALID",
+    message: `Malformed string literal ${JSON.stringify(params.raw)}: ${params.detail}`,
+    meta: { issues: [{ rule: "malformed-string-literal", message: params.detail }], literal: params.raw }
+  });
+}
+function decodePrismaString(params) {
+  const { raw } = params;
+  const quoted = raw.length >= 2 && raw.startsWith('"') && raw.endsWith('"');
+  const body = quoted ? raw.slice(1, -1) : raw;
+  if (!body.includes("\\"))
+    return body;
+  let out = "";
+  for (let index = 0;index < body.length; index += 1) {
+    const char = body[index];
+    if (char !== "\\") {
+      out += char;
+      continue;
+    }
+    const next = body[index + 1];
+    if (next === undefined)
+      throw malformed({ raw, detail: "it ends with a lone backslash" });
+    if (next === "u") {
+      const digits = body.slice(index + 2, index + 6);
+      if (!/^[0-9a-fA-F]{4}$/.test(digits)) {
+        throw malformed({ raw, detail: `\\u must be followed by four hex digits, found "${digits}"` });
+      }
+      out += String.fromCharCode(Number.parseInt(digits, 16));
+      index += 5;
+      continue;
+    }
+    const decoded = STRING_ESCAPES[next];
+    if (decoded === undefined)
+      throw malformed({ raw, detail: `unknown escape "\\${next}"` });
+    out += decoded;
+    index += 1;
+  }
+  return out;
+}
+function unicodeEscape(params) {
+  return `\\u${params.char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
+function encodePrismaString(params) {
+  const { value } = params;
+  let out = '"';
+  for (const char of value) {
+    if (char === "\\")
+      out += "\\\\";
+    else if (char === '"')
+      out += "\\\"";
+    else if (char === `
+`)
+      out += "\\n";
+    else if (char === "\r")
+      out += "\\r";
+    else if (char === "\t")
+      out += "\\t";
+    else if (char < " " || char === "\x7F")
+      out += unicodeEscape({ char });
+    else
+      out += char;
+  }
+  return `${out}"`;
+}
+var INTEGER_LITERAL = /^-?\d+$/;
+function exactIntegerLiteral(params) {
+  const { text } = params;
+  if (!INTEGER_LITERAL.test(text)) {
+    throw new VibeError({
+      code: "VIBE_SCHEMA_INVALID",
+      message: `Not an integer literal: ${JSON.stringify(text)}`,
+      meta: { issues: [{ rule: "malformed-integer-literal", message: text }], literal: text }
+    });
+  }
+  const asNumber = Number(text);
+  if (Number.isSafeInteger(asNumber))
+    return asNumber;
+  return BigInt(text).toString();
+}
 // packages/schema/src/reserved.ts
 var RESERVED_DELEGATE_NAMES = [
   "findMany",
@@ -69,6 +242,7 @@ var RESERVED_DELEGATE_NAMES = [
   "createManyAndReturn",
   "update",
   "updateMany",
+  "updateManyAndReturn",
   "upsert",
   "delete",
   "deleteMany",
@@ -89,7 +263,8 @@ var RESERVED_CLIENT_NAMES = [
   "$extends",
   "$defineView",
   "$withPolicy",
-  "$bypassPolicy"
+  "$bypassPolicy",
+  "$scoped"
 ];
 var RESERVED_COLUMN_PREFIX = "__vibe_";
 function isReservedDelegateName(params) {
@@ -292,7 +467,260 @@ function validateComputedConfig(params) {
     });
   }
 }
+// packages/schema/src/capabilities.ts
+var POSTGRES_CAPABILITIES = Object.freeze({
+  nativeRowLevelSecurity: true,
+  returning: true,
+  scalarArrays: true,
+  nativeEnums: true,
+  ilike: true,
+  lateralJoin: true,
+  distinctOn: true,
+  partialIndexes: true,
+  conflictTargetConstraint: true,
+  transactionalDdl: true,
+  createManyAndReturn: true,
+  jsonColumnType: true,
+  orderByNulls: true,
+  fullTextEngines: Object.freeze(["bm25", "tsvector"])
+});
+var SQLITE_CAPABILITIES = Object.freeze({
+  nativeRowLevelSecurity: false,
+  returning: true,
+  scalarArrays: false,
+  nativeEnums: false,
+  ilike: false,
+  lateralJoin: false,
+  distinctOn: false,
+  partialIndexes: true,
+  conflictTargetConstraint: false,
+  transactionalDdl: true,
+  createManyAndReturn: true,
+  jsonColumnType: false,
+  orderByNulls: true,
+  fullTextEngines: Object.freeze(["fts5"])
+});
+var MYSQL_CAPABILITIES = Object.freeze({
+  nativeRowLevelSecurity: false,
+  returning: false,
+  scalarArrays: false,
+  nativeEnums: true,
+  ilike: false,
+  lateralJoin: false,
+  distinctOn: false,
+  partialIndexes: false,
+  conflictTargetConstraint: false,
+  transactionalDdl: false,
+  createManyAndReturn: false,
+  jsonColumnType: true,
+  orderByNulls: false,
+  fullTextEngines: Object.freeze(["fulltext"])
+});
+var DIALECT_CAPABILITIES = Object.freeze({
+  postgres: POSTGRES_CAPABILITIES,
+  sqlite: SQLITE_CAPABILITIES,
+  mysql: MYSQL_CAPABILITIES
+});
+
 // packages/schema/src/validate.ts
+var RESERVED_ENUM_NAMES = [
+  "enumValidators",
+  "enumValidator",
+  "OmittedKeys",
+  "ExactKeys",
+  "PossibleKeys",
+  "UncertainKeys",
+  "HasSelectedField",
+  "Provided",
+  "ViewDelegateMap",
+  "extensionManifest",
+  "extensionMounts",
+  "computedManifest",
+  "Object",
+  "Set",
+  "JSON",
+  "Record",
+  "Readonly",
+  "ReadonlyArray",
+  "Partial",
+  "Omit",
+  "NonNullable",
+  "Promise",
+  "PromiseLike",
+  "Awaited",
+  "TemplateStringsArray",
+  "Date",
+  "Uint8Array",
+  "schema",
+  "VibeClient",
+  "VibeClientInstance",
+  "VibeClientOptions",
+  "VibeError",
+  "VibeErrorCode",
+  "BatchPayload",
+  "UpsertManyPayload",
+  "QueryMode",
+  "RelationStrategy",
+  "SortOrder",
+  "SortOrderWithNulls",
+  "KeysetToken",
+  "KeysetOptions",
+  "JsonValue",
+  "InputJsonValue",
+  "InputJsonArray",
+  "InputJsonObject",
+  "VibeTelemetryOptions",
+  "VibeTelemetryExporter",
+  "VibeTelemetryOperationEvent",
+  "VibeTelemetryStatementEvent",
+  "VibeTelemetryHandle",
+  "ScopedClientInstance",
+  "ScopedModelsConfig",
+  "ScopedNestedMode",
+  "ViewClient",
+  "ViewDefinitionInput",
+  "ViewRow",
+  "createClient",
+  "DatabaseAdapter",
+  "DbNow",
+  "QueryEvent",
+  "Skip",
+  "TransactionOptions",
+  "SchemaIR",
+  "VibeExtension",
+  "ComputedConfig",
+  "WriteValidators",
+  "String",
+  "Bool",
+  "Int",
+  "BigInt",
+  "Float",
+  "Decimal",
+  "DateTime",
+  "Json",
+  "Bytes",
+  ...["String", "Bool", "Int", "BigInt", "Float", "Decimal", "DateTime", "Json", "Bytes"].flatMap((prefix) => ["Filter", "NullableFilter", "ListFilter"].map((suffix) => `${prefix}${suffix}`)),
+  ...["Int", "Float", "BigInt", "Decimal"].flatMap((prefix) => [`${prefix}FieldUpdateOperationsInput`, `Nullable${prefix}FieldUpdateOperationsInput`])
+];
+var GENERATED_TYPE_NAMES = {
+  enumSuffixes: ["", "Filter", "NullableFilter", "ListFilter", "Validator"],
+  modelSuffixes: [
+    "",
+    "ScalarFieldEnum",
+    "SelectableFieldEnum",
+    "Relations",
+    "CountSelect",
+    "Select",
+    "Include",
+    "OmitInput",
+    "Args",
+    "ListRelationFilter",
+    "RelationFilter",
+    "WhereInput",
+    "WhereUniqueInput",
+    "OrderByInput",
+    "CreateInput",
+    "UncheckedCreateInput",
+    "CreateManyInput",
+    "UpdateInput",
+    "UncheckedUpdateInput",
+    "UpdateManyInput",
+    "CountAggregateInput",
+    "AvgAggregateInput",
+    "SumAggregateInput",
+    "MinAggregateInput",
+    "MaxAggregateInput",
+    "FindManyArgs",
+    "FindFirstArgs",
+    "FindUniqueArgs",
+    "CreateArgs",
+    "ConflictTarget",
+    "CreateOnConflictInput",
+    "CreateOrSkipArgs",
+    "CreateManyArgs",
+    "CreateManyAndReturnArgs",
+    "UpdateArgs",
+    "UpdateManyArgs",
+    "UpdateWhereInput",
+    "UpdateManyAndReturnArgs",
+    "UpsertArgs",
+    "UpsertManyArgs",
+    "DeleteArgs",
+    "DeleteManyArgs",
+    "CountArgs",
+    "AggregateArgs",
+    "GroupByArgs",
+    "OmitBase",
+    "CountResult",
+    "CountPayload",
+    "AggregateValues",
+    "AggregateSelection",
+    "CountOutput",
+    "RelationPayload",
+    "IncludePayload",
+    "GetPayload",
+    "AggregateResult",
+    "GroupByResult",
+    "Delegate",
+    "ViewFields",
+    "ViewSelect",
+    "ViewInclude",
+    "ViewNestedArgs",
+    "ViewFindManyArgs",
+    "ViewFindUniqueArgs",
+    "ViewScalars",
+    "ViewSelectScalars",
+    "ViewReveal",
+    "ViewRelationResult",
+    "ViewIncludeResult",
+    "ViewResult",
+    "ViewDelegate"
+  ],
+  nestedPrefixes: [
+    "Create",
+    "UncheckedCreate",
+    "Update",
+    "UncheckedUpdate",
+    "ConnectOrCreate",
+    "CreateNestedMany",
+    "UpdateNestedMany",
+    "CreateNestedOne",
+    "UpdateNestedOne",
+    "UpdateWithWhereUnique",
+    "UpdateManyWithWhere",
+    "UpsertWithWhereUnique"
+  ]
+};
+function validateGeneratedNames(params) {
+  const { schema, issues } = params;
+  const owners = new Map(RESERVED_ENUM_NAMES.map((name) => [name, "generated client"]));
+  if (schema.rls !== undefined) {
+    owners.set("RlsContext", "native RLS client");
+    owners.set("BoundVibeClientInstance", "native RLS client");
+  }
+  const register = (params2) => {
+    const previous = owners.get(params2.name);
+    if (previous !== undefined && previous !== params2.owner) {
+      issues.push({ rule: "generated-name-collision", message: `Generated name "${params2.name}" from ${params2.owner} conflicts with ${previous}` });
+    } else {
+      owners.set(params2.name, params2.owner);
+    }
+  };
+  for (const model of schema.models) {
+    const owner = `model "${model.name}"`;
+    for (const suffix of GENERATED_TYPE_NAMES.modelSuffixes)
+      register({ name: `${model.name}${suffix}`, owner });
+    const withouts = ["", ...model.relations.map((relation) => `Without${relation.name.charAt(0).toUpperCase()}${relation.name.slice(1)}`)];
+    for (const without of withouts) {
+      for (const prefix of GENERATED_TYPE_NAMES.nestedPrefixes)
+        register({ name: `${model.name}${prefix}${without}Input`, owner });
+    }
+  }
+  for (const declared of schema.enums) {
+    for (const suffix of GENERATED_TYPE_NAMES.enumSuffixes)
+      register({ name: `${declared.name}${suffix}`, owner: `enum "${declared.name}"` });
+  }
+}
 function validateSchemaIR(params) {
   const { schema } = params;
   const issues = [];
@@ -308,15 +736,15 @@ function validateSchemaIR(params) {
       modelByName.set(model.name, model);
     }
   }
-  const enumNames = new Set;
+  const enumByName = new Map;
   for (const enumDef of schema.enums) {
-    if (enumNames.has(enumDef.name)) {
+    if (enumByName.has(enumDef.name)) {
       issues.push({
         rule: "duplicate-enum",
         message: `Duplicate enum name "${enumDef.name}"`
       });
     } else {
-      enumNames.add(enumDef.name);
+      enumByName.set(enumDef.name, enumDef);
     }
     if (enumDef.values.length === 0) {
       issues.push({
@@ -324,9 +752,52 @@ function validateSchemaIR(params) {
         message: `Enum "${enumDef.name}" has no values`
       });
     }
+    const seenValues = new Set;
+    for (const value of enumDef.values) {
+      if (seenValues.has(value)) {
+        issues.push({
+          rule: "duplicate-enum-value",
+          message: `Enum "${enumDef.name}" lists value "${value}" more than once`
+        });
+      }
+      seenValues.add(value);
+    }
+    if (enumDef.storage !== undefined && !ENUM_STORAGES.includes(enumDef.storage)) {
+      issues.push({
+        rule: "invalid-enum-storage",
+        message: `Enum "${enumDef.name}" has storage ${JSON.stringify(enumDef.storage)} \u2014 expected one of ${ENUM_STORAGES.join(", ")}`
+      });
+    }
+    if (modelByName.has(enumDef.name)) {
+      issues.push({
+        rule: "enum-model-name-collision",
+        message: `Enum "${enumDef.name}" shares its name with a model \u2014 the generated client exports one type per name`,
+        model: enumDef.name
+      });
+    }
+    if (RESERVED_ENUM_NAMES.includes(enumDef.name)) {
+      issues.push({
+        rule: "enum-reserved-name",
+        message: `Enum "${enumDef.name}" collides with a name the generated client already exports or imports`
+      });
+    }
   }
   for (const model of schema.models) {
-    validateModel({ model, modelByName, enumNames, issues });
+    validateModel({ model, modelByName, enumByName, issues });
+  }
+  for (const model of schema.models) {
+    for (const relation of model.relations) {
+      if (relation.targetModel !== model.name)
+        continue;
+      if (!isImplicitManyToManyRelation({ model, relation, models: schema.models }))
+        continue;
+      issues.push({
+        rule: "implicit-self-many-to-many",
+        message: `Relation "${model.name}.${relation.name}" is an implicit self many-to-many. Both sides of a self ` + `relation own the same join-table column, so this field and its inverse read the same rows. Replace ` + `it with an explicit junction model carrying one foreign key per direction, each under its own ` + `@relation name, and point "${relation.name}" at that model. Worked example, and the row copy for a ` + `join table that already exists: docs/queries.md, "Directed self relations".`,
+        model: model.name,
+        field: relation.name
+      });
+    }
   }
   const provider = schema.datasource.provider;
   for (const model of schema.models) {
@@ -424,10 +895,12 @@ function validateSchemaIR(params) {
       });
     }
   }
+  validateGeneratedNames({ schema, issues });
+  validateNativeRls({ schema, issues });
   return issues;
 }
 function validateModel(params) {
-  const { model, modelByName, enumNames, issues } = params;
+  const { model, modelByName, enumByName, issues } = params;
   const memberNames = new Set;
   for (const field of model.fields) {
     if (memberNames.has(field.name)) {
@@ -439,13 +912,27 @@ function validateModel(params) {
       });
     }
     memberNames.add(field.name);
-    if (isEnumType(field.type) && !enumNames.has(field.type.enum)) {
-      issues.push({
-        rule: "unknown-enum",
-        message: `Field "${model.name}.${field.name}" references unknown enum "${field.type.enum}"`,
-        model: model.name,
-        field: field.name
-      });
+    if (isEnumType(field.type)) {
+      const enumDef = enumByName.get(field.type.enum);
+      if (enumDef === undefined) {
+        issues.push({
+          rule: "unknown-enum",
+          message: `Field "${model.name}.${field.name}" references unknown enum "${field.type.enum}"`,
+          model: model.name,
+          field: field.name
+        });
+      } else {
+        const defaultValue = field.default;
+        const candidate = defaultValue === undefined ? undefined : defaultValue.kind === "enumValue" ? defaultValue.value : defaultValue.kind === "literal" && typeof defaultValue.value === "string" ? defaultValue.value : undefined;
+        if (candidate !== undefined && !enumDef.values.includes(candidate)) {
+          issues.push({
+            rule: "enum-default-not-member",
+            message: `Default "${candidate}" on "${model.name}.${field.name}" is not a member of enum "${enumDef.name}" (${enumDef.values.join(", ")})`,
+            model: model.name,
+            field: field.name
+          });
+        }
+      }
     }
     const columnName = field.dbName ?? field.name;
     if (columnName.startsWith(RESERVED_COLUMN_PREFIX)) {
@@ -609,6 +1096,10 @@ function validateModel(params) {
   }
 }
 function assertValidSchemaIR(params) {
+  const dialect = providerToDialect({ provider: params.schema.datasource.provider });
+  if (params.schema.rls !== undefined && !DIALECT_CAPABILITIES[dialect].nativeRowLevelSecurity) {
+    throw unsupportedCapability({ dialect, feature: "nativeRowLevelSecurity" });
+  }
   const issues = validateSchemaIR(params);
   if (issues.length > 0) {
     throw new VibeError({
@@ -618,6 +1109,181 @@ function assertValidSchemaIR(params) {
     });
   }
 }
+function rlsRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null) && Reflect.ownKeys(value).every((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return typeof key === "string" && descriptor?.enumerable === true && "value" in descriptor;
+  });
+}
+function rlsKeys(params) {
+  const own = Reflect.ownKeys(params.value);
+  return own.length === params.keys.length && params.keys.every((key) => Object.hasOwn(params.value, key));
+}
+function validateRlsContextIR(params) {
+  const { context } = params;
+  const issues = [];
+  if (!rlsRecord(context))
+    return [{ rule: "rls-invalid-context", message: "Native RLS context must be a named scalar-slot map" }];
+  const seen = new Set;
+  for (const key of Reflect.ownKeys(context)) {
+    const slot = typeof key === "string" ? context[key] : undefined;
+    if (typeof key !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || seen.has(key.toLowerCase()) || !rlsRecord(slot) || !rlsKeys({ value: slot, keys: ["type", "nullable"] }) || typeof slot.nullable !== "boolean" || (typeof slot.type !== "string" || !["String", "Boolean", "Int", "BigInt", "Float", "Decimal", "DateTime"].includes(slot.type))) {
+      issues.push({ rule: "rls-invalid-context", message: `Invalid native RLS context slot ${String(key)}; use distinct setting keys and supported scalar slots with explicit nullable` });
+    }
+    if (typeof key === "string")
+      seen.add(key.toLowerCase());
+  }
+  return issues;
+}
+function isImplicitManyToManyRelation(params) {
+  const { model, relation, models } = params;
+  if (model.isView || !relation.isList || (relation.fields?.length ?? 0) !== 0)
+    return false;
+  const target = models.find((candidate) => candidate.name === relation.targetModel);
+  if (target === undefined || target.isView)
+    return false;
+  const counterpart = soleRelationCounterpart({ relation, ownModel: model.name, target });
+  if (counterpart === undefined || !counterpart.isList || (counterpart.fields?.length ?? 0) !== 0)
+    return false;
+  return soleRelationCounterpart({ relation: counterpart, ownModel: target.name, target: model }) === relation;
+}
+function soleRelationCounterpart(params) {
+  const { relation, ownModel, target } = params;
+  const candidates = target.relations.filter((candidate) => candidate !== relation && candidate.targetModel === ownModel && candidate.relationName === relation.relationName);
+  return candidates.length === 1 ? candidates[0] : undefined;
+}
+function validateNativeRls(params) {
+  const { schema, issues } = params;
+  if (schema.rls === undefined) {
+    if (schema.models.some((model) => model.rls !== undefined)) {
+      issues.push({ rule: "rls-missing-context", message: "Model RLS rules require a schema-level rls.context declaration" });
+    }
+    return;
+  }
+  const dialect = providerToDialect({ provider: schema.datasource.provider });
+  if (!DIALECT_CAPABILITIES[dialect].nativeRowLevelSecurity) {
+    issues.push({ rule: "rls-unsupported-capability", message: `nativeRowLevelSecurity is not supported on ${dialect}` });
+  }
+  if (!rlsRecord(schema.rls) || !rlsKeys({ value: schema.rls, keys: ["context"] })) {
+    issues.push({ rule: "rls-invalid-context", message: "Native RLS supports only a schema-level context declaration" });
+    return;
+  }
+  const contextIssues = validateRlsContextIR({ context: schema.rls.context });
+  issues.push(...contextIssues);
+  const context = contextIssues.length === 0 ? schema.rls.context : undefined;
+  const byName = new Map(schema.models.map((model) => [model.name, model]));
+  const tables = new Set;
+  const throughTargets = new Map;
+  for (const model of schema.models) {
+    const add = (params2) => {
+      issues.push({ ...params2, model: model.name });
+    };
+    const table = model.dbName ?? model.name;
+    if (tables.has(table))
+      add({ rule: "rls-duplicate-table", message: `RLS models share physical table ${table}` });
+    tables.add(table);
+    const columns = new Set;
+    for (const field of model.fields) {
+      const name = field.dbName ?? field.name;
+      if (columns.has(name))
+        add({ rule: "rls-duplicate-column", message: `RLS model ${model.name} repeats physical column ${name}`, field: field.name });
+      columns.add(name);
+    }
+    if (model.policy !== undefined)
+      add({ rule: "rls-policy-conflict", message: "Native RLS cannot combine with application-level ModelIR.policy" });
+    if (model.isView)
+      add({ rule: "rls-view-unsupported", message: "Database views are not supported on native RLS clients; remove the view declaration" });
+    if (model.rls === undefined) {
+      add({ rule: "rls-unclassified-model", message: `Classify ${model.name} as where, through, unprotected or deny` });
+      continue;
+    }
+    if (model.rls !== "unprotected") {
+      for (const relation of model.relations) {
+        if (isImplicitManyToManyRelation({ model, relation, models: schema.models })) {
+          add({ rule: "rls-implicit-many-to-many", message: "Protected implicit many-to-many relations need an explicit junction model with its own rule", field: relation.name });
+        }
+      }
+    }
+    const rule = model.rls;
+    if (rule === "unprotected" || rule === "deny")
+      continue;
+    if (!rlsRecord(rule)) {
+      add({ rule: "rls-invalid-rule", message: "Native RLS accepts where, through, unprotected or deny only" });
+      continue;
+    }
+    if (rlsKeys({ value: rule, keys: ["where"] }) && rlsRecord(rule.where) && Reflect.ownKeys(rule.where).length > 0) {
+      for (const fieldName of Reflect.ownKeys(rule.where)) {
+        const ref = typeof fieldName === "string" ? rule.where[fieldName] : undefined;
+        if (!rlsRecord(ref) || !rlsKeys({ value: ref, keys: ["context"] }) || typeof ref.context !== "string") {
+          add({ rule: "rls-invalid-rule", message: "Ownership equality accepts a context reference only" });
+          continue;
+        }
+        const field = model.fields.find((f) => f.name === fieldName);
+        if (field === undefined) {
+          add({ rule: "rls-unknown-field", message: `Native RLS requires a direct scalar field, not path ${String(fieldName)}` });
+        } else if (field.isList || field.isUnsupported || isEnumType(field.type) || field.type === "Json" || field.type === "Bytes") {
+          add({ rule: "rls-unsupported-field", message: "Native RLS ownership requires a supported non-list scalar", field: field.name });
+        } else if (context !== undefined) {
+          const slot = Object.hasOwn(context, ref.context) ? context[ref.context] : undefined;
+          if (slot === undefined)
+            add({ rule: "rls-unknown-context", message: `Unknown native RLS context key ${ref.context}`, field: field.name });
+          else if (slot.type !== field.type)
+            add({ rule: "rls-context-type-mismatch", message: `Context ${ref.context} does not match ${model.name}.${field.name}`, field: field.name });
+        }
+      }
+      continue;
+    }
+    if (rlsKeys({ value: rule, keys: ["through"] }) && typeof rule.through === "string") {
+      const relation = model.relations.find((r) => r.name === rule.through);
+      const target = relation === undefined ? undefined : byName.get(relation.targetModel);
+      if (relation === undefined || target === undefined || relation.model !== model.name || relation.isList || relation.type !== "oneToOne" && relation.type !== "manyToOne" || !validRlsForeignKey({ model, target, relation })) {
+        add({ rule: "rls-invalid-through", message: "Native RLS through requires a to-one relation with an actual, complete foreign key on this model" });
+        continue;
+      }
+      if (relation.isOptional || relation.fields?.some((name) => model.fields.find((field) => field.name === name)?.isOptional)) {
+        add({ rule: "rls-nullable-through", message: "Native RLS through requires a non-nullable parent relation and foreign key; NULL parent links cannot satisfy WITH CHECK. Make the link required or use a direct ownership rule", field: relation.name });
+        continue;
+      }
+      if (table === "parent")
+        add({ rule: "rls-through-alias-conflict", message: "A through table mapped to parent would shadow the fixed policy parent alias; use another table name" });
+      throughTargets.set(model.name, target.name);
+      continue;
+    }
+    add({ rule: "rls-invalid-rule", message: "Native RLS accepts a nonempty equality map or a single through relation; extra properties and operation-specific rules refuse" });
+  }
+  for (const [origin, first] of throughTargets) {
+    const seen = new Set([origin]);
+    let current = first;
+    while (current !== undefined && !seen.has(current)) {
+      seen.add(current);
+      const rule = byName.get(current)?.rls;
+      if (rlsRecord(rule) && rlsKeys({ value: rule, keys: ["where"] }))
+        break;
+      current = throughTargets.get(current);
+    }
+    if (current === undefined || current === origin || throughTargets.has(current) && seen.has(current)) {
+      issues.push({ rule: "rls-through-chain-invalid", message: `Through chain from ${origin} must be acyclic and end in a direct where rule`, model: origin });
+    }
+  }
+}
+function validRlsForeignKey(params) {
+  const { model, target, relation } = params;
+  const fields = relation.fields;
+  const refs = relation.references;
+  if (fields === undefined || refs === undefined || fields.length === 0 || fields.length !== refs.length || new Set(fields).size !== fields.length || new Set(refs).size !== refs.length)
+    return false;
+  const validFields = fields.every((name, index) => {
+    const field = model.fields.find((f) => f.name === name);
+    const ref = target.fields.find((f) => f.name === refs[index]);
+    return field !== undefined && ref !== undefined && !field.isList && !ref.isList && !field.isUnsupported && !ref.isUnsupported && (field.type === ref.type || isEnumType(field.type) && isEnumType(ref.type) && field.type.enum === ref.type.enum);
+  });
+  const uniqueSets = [
+    ...target.fields.filter((f) => f.isId || f.isUnique).map((f) => [f.name]),
+    ...target.primaryKey === undefined ? [] : [target.primaryKey.fields],
+    ...target.indexes.filter((index) => index.kind === "unique" && index.where === undefined).map((index) => index.fields.map((f) => f.name))
+  ];
+  return validFields && uniqueSets.some((set) => set.length === refs.length && set.every((name) => refs.includes(name)));
+}
 // packages/schema/src/m2m.ts
 function implicitJoinTable(params) {
   const sorted = [params.modelA, params.modelB].sort();
@@ -634,28 +1300,45 @@ function implicitJoinTable(params) {
 }
 export {
   validateSchemaIR,
+  validateRlsContextIR,
   validateComputedConfig,
   unsupportedCapability,
   providerToDialect,
   mergeExtensionDeclarations,
   isReservedDelegateName,
   isReservedClientName,
+  isImplicitManyToManyRelation,
   isEnumType,
+  invalidStoredData,
   internalError,
   implicitJoinTable,
   extensionOptionsHash,
   extensionManifestEntry,
   extensionDeclarations,
+  exactIntegerLiteral,
+  enumStorageOf,
+  encodePrismaString,
   defineExtension,
+  decodePrismaString,
   buildExtensionRegistry,
   buildComputedManifest,
   assertValidSchemaIR,
   VibeError,
   VIBE_ERROR_CODES,
+  ScopedQueryError,
+  SQLITE_CAPABILITIES,
+  SCOPED_REFUSAL_REASONS,
+  RlsContextError,
+  RLS_CONTEXT_REASONS,
+  RESERVED_ENUM_NAMES,
   RESERVED_DELEGATE_NAMES,
   RESERVED_CLIENT_NAMES,
+  POSTGRES_CAPABILITIES,
+  MYSQL_CAPABILITIES,
+  ENUM_STORAGES,
   EMPTY_EXTENSION_REGISTRY,
+  DIALECT_CAPABILITIES,
   DIALECTS
 };
 
-//# debugId=5F1302B07BDA394664756E2164756E21
+//# debugId=917A26DA81AB84E364756E2164756E21