@zenstackhq/plugin-policy 3.0.0-beta.19 → 3.0.0-beta.21

package/dist/index.cjs

@@ -27,12 +27,12 @@ module.exports = __toCommonJS(src_exports);
 
 // src/functions.ts
 var import_common_helpers4 = require("@zenstackhq/common-helpers");
-var import_orm4 = require("@zenstackhq/orm");
+var import_orm5 = require("@zenstackhq/orm");
 var import_kysely4 = require("kysely");
 
 // src/policy-handler.ts
 var import_common_helpers3 = require("@zenstackhq/common-helpers");
-var import_orm3 = require("@zenstackhq/orm");
+var import_orm4 = require("@zenstackhq/orm");
 var import_schema4 = require("@zenstackhq/orm/schema");
 var import_kysely3 = require("kysely");
 var import_ts_pattern3 = require("ts-pattern");
@@ -58,7 +58,7 @@ var ColumnCollector = class extends import_orm.KyselyUtils.DefaultOperationNodeV
 
 // src/expression-transformer.ts
 var import_common_helpers2 = require("@zenstackhq/common-helpers");
-var import_orm2 = require("@zenstackhq/orm");
+var import_orm3 = require("@zenstackhq/orm");
 var import_schema3 = require("@zenstackhq/orm/schema");
 var import_kysely2 = require("kysely");
 var import_ts_pattern2 = require("ts-pattern");
@@ -135,6 +135,7 @@ var ExpressionEvaluator = class {
 };
 
 // src/utils.ts
+var import_orm2 = require("@zenstackhq/orm");
 var import_schema2 = require("@zenstackhq/orm/schema");
 var import_kysely = require("kysely");
 function trueNode(dialect) {
@@ -236,6 +237,17 @@ function isBeforeInvocation(expr2) {
   return import_schema2.ExpressionUtils.isCall(expr2) && expr2.function === "before";
 }
 __name(isBeforeInvocation, "isBeforeInvocation");
+function createRejectedByPolicyError(model, reason, message) {
+  const err = new import_orm2.ORMError(import_orm2.ORMErrorReason.REJECTED_BY_POLICY, message ?? "operation is rejected by access policies");
+  err.rejectedByPolicyReason = reason;
+  err.model = model;
+  return err;
+}
+__name(createRejectedByPolicyError, "createRejectedByPolicyError");
+function createUnsupportedError(message) {
+  return new import_orm2.ORMError(import_orm2.ORMErrorReason.NOT_SUPPORTED, message);
+}
+__name(createUnsupportedError, "createUnsupportedError");
 
 // src/expression-transformer.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -267,7 +279,7 @@ var ExpressionTransformer = class {
   dialect;
   constructor(client) {
     this.client = client;
-    this.dialect = (0, import_orm2.getCrudDialect)(this.schema, this.clientOptions);
+    this.dialect = (0, import_orm3.getCrudDialect)(this.schema, this.clientOptions);
   }
   get schema() {
     return this.client.$schema;
@@ -280,7 +292,7 @@ var ExpressionTransformer = class {
   }
   get authType() {
     if (!this.schema.authType) {
-      throw new import_orm2.InternalError('Schema does not have an "authType" specified');
+      (0, import_common_helpers2.invariant)(false, 'Schema does not have an "authType" specified');
     }
     return this.schema.authType;
   }
@@ -298,7 +310,7 @@ var ExpressionTransformer = class {
     return import_kysely2.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
-    const fieldDef = import_orm2.QueryUtils.requireField(this.schema, context.model, expr2.field);
+    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.field);
     if (!fieldDef.relation) {
       return this.createColumnRef(expr2.field, context);
     } else {
@@ -389,7 +401,7 @@ var ExpressionTransformer = class {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
       const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
       (0, import_common_helpers2.invariant)(leftRelDef, "failed to get relation field definition");
-      const idFields = import_orm2.QueryUtils.requireIdFields(this.schema, leftRelDef.type);
+      const idFields = import_orm3.QueryUtils.requireIdFields(this.schema, leftRelDef.type);
       normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
     }
     let normalizedRight = expr2.right;
@@ -397,7 +409,7 @@ var ExpressionTransformer = class {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
       const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
       (0, import_common_helpers2.invariant)(rightRelDef, "failed to get relation field definition");
-      const idFields = import_orm2.QueryUtils.requireIdFields(this.schema, rightRelDef.type);
+      const idFields = import_orm3.QueryUtils.requireIdFields(this.schema, rightRelDef.type);
       normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
     }
     return {
@@ -421,10 +433,10 @@ var ExpressionTransformer = class {
       newContextModel = fieldDef.type;
     } else {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isMember(expr2.left) && import_schema3.ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
-      const fieldDef2 = import_orm2.QueryUtils.requireField(this.schema, context.model, expr2.left.receiver.field);
+      const fieldDef2 = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.left.receiver.field);
       newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
-        const memberDef = import_orm2.QueryUtils.requireField(this.schema, newContextModel, member);
+        const memberDef = import_orm3.QueryUtils.requireField(this.schema, newContextModel, member);
         newContextModel = memberDef.type;
       }
     }
@@ -448,7 +460,7 @@ var ExpressionTransformer = class {
   }
   transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw new import_orm2.QueryError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
+      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
     }
     let authExpr;
     let other;
@@ -462,9 +474,9 @@ var ExpressionTransformer = class {
     if (import_schema3.ExpressionUtils.isNull(other)) {
       return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
     } else {
-      const authModel = import_orm2.QueryUtils.getModel(this.schema, this.authType);
+      const authModel = import_orm3.QueryUtils.getModel(this.schema, this.authType);
       if (!authModel) {
-        throw new import_orm2.QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
       (0, import_common_helpers2.invariant)(idFields.length > 0, "auth type model must have at least one id field");
@@ -514,7 +526,7 @@ var ExpressionTransformer = class {
   transformCall(expr2, context) {
     const func = this.getFunctionImpl(expr2.function);
     if (!func) {
-      throw new import_orm2.QueryError(`Function not implemented: ${expr2.function}`);
+      throw createUnsupportedError(`Function not implemented: ${expr2.function}`);
     }
     const eb = (0, import_kysely2.expressionBuilder)();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
@@ -551,7 +563,7 @@ var ExpressionTransformer = class {
       const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
       return valNode ? eb.val(valNode.value) : eb.val(null);
     }
-    throw new import_orm2.InternalError(`Unsupported argument expression: ${arg.kind}`);
+    throw createUnsupportedError(`Unsupported argument expression: ${arg.kind}`);
   }
   _member(expr2, context) {
     if (this.isAuthCall(expr2.receiver)) {
@@ -570,7 +582,7 @@ var ExpressionTransformer = class {
       if (expr2.members.length === 1) {
         return this._field(import_schema3.ExpressionUtils.field(expr2.members[0]), context);
       } else {
-        const firstMemberFieldDef = import_orm2.QueryUtils.requireField(this.schema, context.model, expr2.members[0]);
+        const firstMemberFieldDef = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.members[0]);
         receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
         members = expr2.members.slice(1);
       }
@@ -580,7 +592,7 @@ var ExpressionTransformer = class {
     (0, import_common_helpers2.invariant)(import_kysely2.SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (import_schema3.ExpressionUtils.isField(expr2.receiver)) {
-      const receiverField = import_orm2.QueryUtils.requireField(this.schema, context.model, expr2.receiver.field);
+      const receiverField = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.receiver.field);
       startType = receiverField.type;
     } else {
       startType = context.model;
@@ -588,7 +600,7 @@ var ExpressionTransformer = class {
     const memberFields = [];
     let currType = startType;
     for (const member of members) {
-      const fieldDef = import_orm2.QueryUtils.requireField(this.schema, currType, member);
+      const fieldDef = import_orm3.QueryUtils.requireField(this.schema, currType, member);
       memberFields.push({
         fieldDef,
         fromModel: currType
@@ -642,18 +654,18 @@ var ExpressionTransformer = class {
       throw new Error(`Only single member access is supported`);
     }
     const field = expr2.members[0];
-    const fieldDef = import_orm2.QueryUtils.requireField(this.schema, receiverType, field);
+    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, receiverType, field);
     const fieldValue = receiver[field] ?? null;
     return this.transformValue(fieldValue, fieldDef.type);
   }
   transformRelationAccess(field, relationModel, context) {
-    const m2m = import_orm2.QueryUtils.getManyToManyRelation(this.schema, context.model, field);
+    const m2m = import_orm3.QueryUtils.getManyToManyRelation(this.schema, context.model, field);
     if (m2m) {
       return this.transformManyToManyRelationAccess(m2m, context);
     }
     const fromModel = context.model;
-    const relationFieldDef = import_orm2.QueryUtils.requireField(this.schema, fromModel, field);
-    const { keyPairs, ownedByModel } = import_orm2.QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
+    const relationFieldDef = import_orm3.QueryUtils.requireField(this.schema, fromModel, field);
+    const { keyPairs, ownedByModel } = import_orm3.QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
     if (ownedByModel) {
       condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => {
@@ -684,14 +696,14 @@ var ExpressionTransformer = class {
     if (context.operation === "create") {
       return import_kysely2.ReferenceNode.create(import_kysely2.ColumnNode.create(column), import_kysely2.TableNode.create(tableName));
     }
-    const fieldDef = import_orm2.QueryUtils.requireField(this.schema, context.model, column);
+    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.model, column);
     if (!fieldDef.originModel || fieldDef.originModel === context.model) {
       return import_kysely2.ReferenceNode.create(import_kysely2.ColumnNode.create(column), import_kysely2.TableNode.create(tableName));
     }
     return this.buildDelegateBaseFieldSelect(context.model, tableName, column, fieldDef.originModel);
   }
   buildDelegateBaseFieldSelect(model, modelAlias, field, baseModel) {
-    const idFields = import_orm2.QueryUtils.requireIdFields(this.client.$schema, model);
+    const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, model);
     return {
       kind: "SelectQueryNode",
       from: import_kysely2.FromNode.create([
@@ -730,9 +742,9 @@ var ExpressionTransformer = class {
   }
   getFieldDefFromFieldRef(expr2, model) {
     if (import_schema3.ExpressionUtils.isField(expr2)) {
-      return import_orm2.QueryUtils.requireField(this.schema, model, expr2.field);
+      return import_orm3.QueryUtils.requireField(this.schema, model, expr2.field);
     } else if (import_schema3.ExpressionUtils.isMember(expr2) && expr2.members.length === 1 && import_schema3.ExpressionUtils.isThis(expr2.receiver)) {
-      return import_orm2.QueryUtils.requireField(this.schema, model, expr2.members[0]);
+      return import_orm3.QueryUtils.requireField(this.schema, model, expr2.members[0]);
     } else {
       return void 0;
     }
@@ -816,14 +828,14 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
   dialect;
   constructor(client) {
     super(), this.client = client;
-    this.dialect = (0, import_orm3.getCrudDialect)(this.client.$schema, this.client.$options);
+    this.dialect = (0, import_orm4.getCrudDialect)(this.client.$schema, this.client.$options);
   }
   get kysely() {
     return this.client.$qb;
   }
   async handle(node, proceed) {
     if (!this.isCrudQueryNode(node)) {
-      throw new import_orm3.RejectedByPolicyError(void 0, import_orm3.RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
+      throw createRejectedByPolicyError(void 0, import_orm4.RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
     }
     if (!this.isMutationQueryNode(node)) {
       return proceed(this.transformNode(node));
@@ -837,7 +849,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
         if (constCondition === true) {
           needCheckPreCreate = false;
         } else if (constCondition === false) {
-          throw new import_orm3.RejectedByPolicyError(mutationModel, import_orm3.RejectedByPolicyReason.NO_ACCESS);
+          throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.NO_ACCESS);
         }
       }
       if (needCheckPreCreate) {
@@ -853,11 +865,11 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     if (hasPostUpdatePolicies && result.rows.length > 0) {
       if (beforeUpdateInfo) {
         (0, import_common_helpers3.invariant)(beforeUpdateInfo.rows.length === result.rows.length);
-        const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+        const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
         for (const postRow of result.rows) {
           const beforeRow = beforeUpdateInfo.rows.find((r) => idFields.every((f) => r[f] === postRow[f]));
           if (!beforeRow) {
-            throw new import_orm3.QueryError("Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
+            throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.OTHER, "Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
           }
         }
       }
@@ -870,7 +882,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
           import_kysely3.ParensNode.create(import_kysely3.ValuesNode.create(beforeUpdateInfo.rows.map((r) => import_kysely3.PrimitiveValueListNode.create(beforeUpdateInfo.fields.map((f) => r[f])))))
         ]),
         selections: beforeUpdateInfo.fields.map((name, index) => {
-          const def = import_orm3.QueryUtils.requireField(this.client.$schema, mutationModel, name);
+          const def = import_orm4.QueryUtils.requireField(this.client.$schema, mutationModel, name);
           const castedColumnRef = import_kysely3.sql`CAST(${eb.ref(`column${index + 1}`)} as ${import_kysely3.sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
           return import_kysely3.SelectionNode.create(castedColumnRef.toOperationNode());
         })
@@ -883,12 +895,12 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
         idConditions,
         postUpdateFilter
       ]))).$if(!!beforeUpdateInfo, (qb) => qb.leftJoin(() => new import_kysely3.ExpressionWrapper(beforeUpdateTable).as("$before"), (join) => {
-        const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+        const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
         return idFields.reduce((acc, f) => acc.onRef(`${mutationModel}.${f}`, "=", `$before.${f}`), join);
       }));
       const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
       if (!postUpdateResult.rows[0]?.$condition) {
-        throw new import_orm3.RejectedByPolicyError(mutationModel, import_orm3.RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+        throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
       }
     }
     if (!node.returning || this.onlyReturningId(node)) {
@@ -896,7 +908,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
-        throw new import_orm3.RejectedByPolicyError(mutationModel, import_orm3.RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+        throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       }
       return readBackResult;
     }
@@ -950,7 +962,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       return void 0;
     }
     const fields = /* @__PURE__ */ new Set();
-    const fieldCollector = new class extends import_orm3.SchemaUtils.ExpressionVisitor {
+    const fieldCollector = new class extends import_orm4.SchemaUtils.ExpressionVisitor {
       visitMember(e) {
         if (isBeforeInvocation(e.receiver)) {
           (0, import_common_helpers3.invariant)(e.members.length === 1, "before() can only be followed by a scalar field access");
@@ -965,7 +977,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     if (fields.size === 0) {
       return void 0;
     }
-    import_orm3.QueryUtils.requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
+    import_orm4.QueryUtils.requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
     return Array.from(fields).sort();
   }
   // #region overrides
@@ -1039,7 +1051,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     let returning = result.returning;
     if (returning) {
       const { mutationModel } = this.getMutationModel(node);
-      const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+      const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
       returning = import_kysely3.ReturningNode.create(idFields.map((f) => import_kysely3.SelectionNode.create(import_kysely3.ColumnNode.create(f))));
     }
     return {
@@ -1062,7 +1074,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     }
     let returning = result.returning;
     if (returning || this.hasPostUpdatePolicies(mutationModel)) {
-      const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+      const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
       returning = import_kysely3.ReturningNode.create(idFields.map((f) => import_kysely3.SelectionNode.create(import_kysely3.ColumnNode.create(f))));
     }
     return {
@@ -1102,9 +1114,9 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       return true;
     }
     const { mutationModel } = this.getMutationModel(node);
-    const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+    const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
     if (node.returning.selections.some((s) => import_kysely3.SelectAllNode.is(s.selection))) {
-      const modelDef = import_orm3.QueryUtils.requireModel(this.client.$schema, mutationModel);
+      const modelDef = import_orm4.QueryUtils.requireModel(this.client.$schema, mutationModel);
       if (Object.keys(modelDef.fields).some((f) => !idFields.includes(f))) {
         return false;
       } else {
@@ -1155,14 +1167,14 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     };
     const result = await proceed(queryNode);
     if (!result.rows[0]?.$conditionA) {
-      throw new import_orm3.RejectedByPolicyError(m2m.firstModel, import_orm3.RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+      throw createRejectedByPolicyError(m2m.firstModel, import_orm4.RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
     }
     if (!result.rows[0]?.$conditionB) {
-      throw new import_orm3.RejectedByPolicyError(m2m.secondModel, import_orm3.RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
+      throw createRejectedByPolicyError(m2m.secondModel, import_orm4.RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
     }
   }
   async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
-    const allFields = Object.entries(import_orm3.QueryUtils.requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
+    const allFields = Object.entries(import_orm4.QueryUtils.requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
     const allValues = [];
     for (const [name, _def] of allFields) {
       const index = fields.indexOf(name);
@@ -1200,7 +1212,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
-      throw new import_orm3.RejectedByPolicyError(model, import_orm3.RejectedByPolicyReason.NO_ACCESS);
+      throw createRejectedByPolicyError(model, import_orm4.RejectedByPolicyReason.NO_ACCESS);
     }
   }
   unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
@@ -1211,7 +1223,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
         this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
       ];
     } else {
-      throw new import_orm3.InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
+      (0, import_common_helpers3.invariant)(false, `Unexpected node kind: ${node.kind} for unwrapping create values`);
     }
   }
   unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
@@ -1220,7 +1232,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     for (let i = 0; i < data.length; i++) {
       const item = data[i];
       if (typeof item === "object" && item && "kind" in item) {
-        const fieldDef = import_orm3.QueryUtils.requireField(this.client.$schema, model, fields[i]);
+        const fieldDef = import_orm4.QueryUtils.requireField(this.client.$schema, model, fields[i]);
         (0, import_common_helpers3.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
         result.push({
           node: import_kysely3.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
@@ -1229,7 +1241,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       } else {
         let value = item;
         if (!isImplicitManyToManyJoinTable) {
-          const fieldDef = import_orm3.QueryUtils.requireField(this.client.$schema, model, fields[i]);
+          const fieldDef = import_orm4.QueryUtils.requireField(this.client.$schema, model, fields[i]);
           value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
         }
         if (Array.isArray(value)) {
@@ -1293,7 +1305,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     return selectResult;
   }
   buildIdConditions(table, rows) {
-    const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, table);
+    const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, table);
     return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely3.BinaryOperationNode.create(import_kysely3.ReferenceNode.create(import_kysely3.ColumnNode.create(field), import_kysely3.TableNode.create(table)), import_kysely3.OperatorNode.create("="), import_kysely3.ValueNode.create(row[field]))))));
   }
   getMutationModel(node) {
@@ -1302,7 +1314,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       alias: void 0
     })).when(import_kysely3.UpdateQueryNode.is, (node2) => {
       if (!node2.table) {
-        throw new import_orm3.QueryError("Update query must have a table");
+        (0, import_common_helpers3.invariant)(false, "Update query must have a table");
       }
       const r2 = this.extractTableName(node2.table);
       return r2 ? {
@@ -1311,7 +1323,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       } : void 0;
     }).when(import_kysely3.DeleteQueryNode.is, (node2) => {
       if (node2.from.froms.length !== 1) {
-        throw new import_orm3.QueryError("Only one from table is supported for delete");
+        throw createUnsupportedError("Only one from table is supported for delete");
       }
       const r2 = this.extractTableName(node2.from.froms[0]);
       return r2 ? {
@@ -1320,7 +1332,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       } : void 0;
     }).exhaustive();
     if (!r) {
-      throw new import_orm3.InternalError(`Unable to get table name for query node: ${node}`);
+      (0, import_common_helpers3.invariant)(false, `Unable to get table name for query node: ${node}`);
     }
     return r;
   }
@@ -1404,7 +1416,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     });
   }
   getModelPolicies(model, operation) {
-    const modelDef = import_orm3.QueryUtils.requireModel(this.client.$schema, model);
+    const modelDef = import_orm4.QueryUtils.requireModel(this.client.$schema, model);
     const result = [];
     const extractOperations = /* @__PURE__ */ __name((expr2) => {
       (0, import_common_helpers3.invariant)(import_schema4.ExpressionUtils.isLiteral(expr2), "expecting a literal");
@@ -1423,7 +1435,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
   resolveManyToManyJoinTable(tableName) {
     for (const model of Object.values(this.client.$schema.models)) {
       for (const field of Object.values(model.fields)) {
-        const m2m = import_orm3.QueryUtils.getManyToManyRelation(this.client.$schema, model.name, field.name);
+        const m2m = import_orm4.QueryUtils.getManyToManyRelation(this.client.$schema, model.name, field.name);
         if (m2m?.joinTable === tableName) {
           const sortedRecord = [
             {
@@ -1435,8 +1447,8 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
               field: m2m.otherField
             }
           ].sort(this.manyToManySorter);
-          const firstIdFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[0].model);
-          const secondIdFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[1].model);
+          const firstIdFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[0].model);
+          const secondIdFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[1].model);
           (0, import_common_helpers3.invariant)(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
           return {
             firstModel: sortedRecord[0].model,
@@ -1481,17 +1493,17 @@ var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, opera
   const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
   if (arg2Node) {
     (0, import_common_helpers4.invariant)(import_kysely4.ValueNode.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
-    (0, import_common_helpers4.invariant)(import_orm4.CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+    (0, import_common_helpers4.invariant)(import_orm5.CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
   }
-  const fieldName = import_orm4.QueryUtils.extractFieldName(arg1Node);
+  const fieldName = import_orm5.QueryUtils.extractFieldName(arg1Node);
   (0, import_common_helpers4.invariant)(fieldName, 'Failed to extract field name from the first argument of "check" function');
-  const fieldDef = import_orm4.QueryUtils.requireField(client.$schema, model, fieldName);
+  const fieldDef = import_orm5.QueryUtils.requireField(client.$schema, model, fieldName);
   (0, import_common_helpers4.invariant)(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
   (0, import_common_helpers4.invariant)(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
   const relationModel = fieldDef.type;
   const joinConditions = [];
-  const fkInfo = import_orm4.QueryUtils.getRelationForeignKeyFieldPairs(client.$schema, model, fieldName);
-  const idFields = import_orm4.QueryUtils.requireIdFields(client.$schema, model);
+  const fkInfo = import_orm5.QueryUtils.getRelationForeignKeyFieldPairs(client.$schema, model, fieldName);
+  const idFields = import_orm5.QueryUtils.requireIdFields(client.$schema, model);
   const buildBaseSelect = /* @__PURE__ */ __name((baseModel, field) => {
     return eb.selectFrom(baseModel).select(field).where(eb.and(idFields.map((idField) => eb(eb.ref(`${fieldDef.originModel}.${idField}`), "=", eb.ref(`${modelAlias}.${idField}`)))));
   }, "buildBaseSelect");