@zenstackhq/plugin-policy 3.0.0-beta.9 → 3.0.0

package/dist/index.cjs

@@ -27,20 +27,19 @@ module.exports = __toCommonJS(src_exports);
 
 // src/functions.ts
 var import_common_helpers4 = require("@zenstackhq/common-helpers");
-var import_runtime8 = require("@zenstackhq/runtime");
+var import_orm5 = require("@zenstackhq/orm");
 var import_kysely4 = require("kysely");
 
 // src/policy-handler.ts
 var import_common_helpers3 = require("@zenstackhq/common-helpers");
-var import_runtime6 = require("@zenstackhq/runtime");
-var import_schema4 = require("@zenstackhq/runtime/schema");
-var import_sdk2 = require("@zenstackhq/sdk");
+var import_orm4 = require("@zenstackhq/orm");
+var import_schema4 = require("@zenstackhq/orm/schema");
 var import_kysely3 = require("kysely");
 var import_ts_pattern3 = require("ts-pattern");
 
 // src/column-collector.ts
-var import_sdk = require("@zenstackhq/sdk");
-var ColumnCollector = class extends import_sdk.DefaultOperationNodeVisitor {
+var import_orm = require("@zenstackhq/orm");
+var ColumnCollector = class extends import_orm.KyselyUtils.DefaultOperationNodeVisitor {
   static {
     __name(this, "ColumnCollector");
   }
@@ -59,15 +58,15 @@ var ColumnCollector = class extends import_sdk.DefaultOperationNodeVisitor {
 
 // src/expression-transformer.ts
 var import_common_helpers2 = require("@zenstackhq/common-helpers");
-var import_runtime4 = require("@zenstackhq/runtime");
-var import_schema3 = require("@zenstackhq/runtime/schema");
+var import_orm3 = require("@zenstackhq/orm");
+var import_schema3 = require("@zenstackhq/orm/schema");
 var import_kysely2 = require("kysely");
 var import_ts_pattern2 = require("ts-pattern");
 
 // src/expression-evaluator.ts
 var import_common_helpers = require("@zenstackhq/common-helpers");
 var import_ts_pattern = require("ts-pattern");
-var import_schema = require("@zenstackhq/runtime/schema");
+var import_schema = require("@zenstackhq/orm/schema");
 var ExpressionEvaluator = class {
   static {
     __name(this, "ExpressionEvaluator");
@@ -108,6 +107,12 @@ var ExpressionEvaluator = class {
     }
     const left = this.evaluate(expr2.left, context);
     const right = this.evaluate(expr2.right, context);
+    if (![
+      "==",
+      "!="
+    ].includes(expr2.op) && (left === null || right === null)) {
+      return null;
+    }
     return (0, import_ts_pattern.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
       (0, import_common_helpers.invariant)(Array.isArray(_right), 'expected array for "in" operator');
@@ -118,8 +123,8 @@ var ExpressionEvaluator = class {
     const op = expr2.op;
     (0, import_common_helpers.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
-    if (!left) {
-      return false;
+    if (left === null || left === void 0) {
+      return null;
     }
     (0, import_common_helpers.invariant)(Array.isArray(left), "expected array");
     return (0, import_ts_pattern.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
@@ -135,8 +140,16 @@ var ExpressionEvaluator = class {
   }
 };
 
+// src/types.ts
+var CollectionPredicateOperator = [
+  "?",
+  "!",
+  "^"
+];
+
 // src/utils.ts
-var import_schema2 = require("@zenstackhq/runtime/schema");
+var import_orm2 = require("@zenstackhq/orm");
+var import_schema2 = require("@zenstackhq/orm/schema");
 var import_kysely = require("kysely");
 function trueNode(dialect) {
   return import_kysely.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
@@ -237,6 +250,17 @@ function isBeforeInvocation(expr2) {
   return import_schema2.ExpressionUtils.isCall(expr2) && expr2.function === "before";
 }
 __name(isBeforeInvocation, "isBeforeInvocation");
+function createRejectedByPolicyError(model, reason, message) {
+  const err = new import_orm2.ORMError(import_orm2.ORMErrorReason.REJECTED_BY_POLICY, message ?? "operation is rejected by access policies");
+  err.rejectedByPolicyReason = reason;
+  err.model = model;
+  return err;
+}
+__name(createRejectedByPolicyError, "createRejectedByPolicyError");
+function createUnsupportedError(message) {
+  return new import_orm2.ORMError(import_orm2.ORMErrorReason.NOT_SUPPORTED, message);
+}
+__name(createUnsupportedError, "createUnsupportedError");
 
 // src/expression-transformer.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -268,7 +292,7 @@ var ExpressionTransformer = class {
   dialect;
   constructor(client) {
     this.client = client;
-    this.dialect = (0, import_runtime4.getCrudDialect)(this.schema, this.clientOptions);
+    this.dialect = (0, import_orm3.getCrudDialect)(this.schema, this.clientOptions);
   }
   get schema() {
     return this.client.$schema;
@@ -281,7 +305,7 @@ var ExpressionTransformer = class {
   }
   get authType() {
     if (!this.schema.authType) {
-      throw new import_runtime4.InternalError('Schema does not have an "authType" specified');
+      (0, import_common_helpers2.invariant)(false, 'Schema does not have an "authType" specified');
     }
     return this.schema.authType;
   }
@@ -299,7 +323,11 @@ var ExpressionTransformer = class {
     return import_kysely2.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
-    const fieldDef = import_runtime4.QueryUtils.requireField(this.schema, context.model, expr2.field);
+    if (context.contextValue) {
+      const fieldDef2 = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
+      return this.transformValue(context.contextValue[expr2.field], fieldDef2.type);
+    }
+    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
     if (!fieldDef.relation) {
       return this.createColumnRef(expr2.field, context);
     } else {
@@ -373,32 +401,41 @@ var ExpressionTransformer = class {
     }
   }
   transformNullCheck(expr2, operator) {
-    (0, import_common_helpers2.invariant)(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
-    if (import_kysely2.ValueNode.is(expr2)) {
-      if (expr2.value === null) {
-        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+    if (operator === "==" || operator === "!=") {
+      if (import_kysely2.ValueNode.is(expr2)) {
+        if (expr2.value === null) {
+          return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+        } else {
+          return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        }
       } else {
-        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        return operator === "==" ? import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is"), import_kysely2.ValueNode.createImmediate(null)) : import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is not"), import_kysely2.ValueNode.createImmediate(null));
       }
     } else {
-      return operator === "==" ? import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is"), import_kysely2.ValueNode.createImmediate(null)) : import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is not"), import_kysely2.ValueNode.createImmediate(null));
+      return import_kysely2.ValueNode.createImmediate(null);
     }
   }
   normalizeBinaryOperationOperands(expr2, context) {
+    if (context.contextValue) {
+      return {
+        normalizedLeft: expr2.left,
+        normalizedRight: expr2.right
+      };
+    }
     let normalizedLeft = expr2.left;
-    if (this.isRelationField(expr2.left, context.model)) {
+    if (this.isRelationField(expr2.left, context.modelOrType)) {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
-      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
       (0, import_common_helpers2.invariant)(leftRelDef, "failed to get relation field definition");
-      const idFields = import_runtime4.QueryUtils.requireIdFields(this.schema, leftRelDef.type);
+      const idFields = import_orm3.QueryUtils.requireIdFields(this.schema, leftRelDef.type);
       normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
     }
     let normalizedRight = expr2.right;
-    if (this.isRelationField(expr2.right, context.model)) {
+    if (this.isRelationField(expr2.right, context.modelOrType)) {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
-      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.modelOrType);
       (0, import_common_helpers2.invariant)(rightRelDef, "failed to get relation field definition");
-      const idFields = import_runtime4.QueryUtils.requireIdFields(this.schema, rightRelDef.type);
+      const idFields = import_orm3.QueryUtils.requireIdFields(this.schema, rightRelDef.type);
       normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
     }
     return {
@@ -407,31 +444,39 @@ var ExpressionTransformer = class {
     };
   }
   transformCollectionPredicate(expr2, context) {
-    (0, import_common_helpers2.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
-    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
-      const value = new ExpressionEvaluator().evaluate(expr2, {
+    this.ensureCollectionPredicateOperator(expr2.op);
+    if (this.isAuthMember(expr2.left) || context.contextValue) {
+      (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isMember(expr2.left) || import_schema3.ExpressionUtils.isField(expr2.left), "expected member or field expression");
+      const evaluator = new ExpressionEvaluator();
+      const receiver = evaluator.evaluate(expr2.left, {
+        thisValue: context.contextValue,
         auth: this.auth
       });
-      return this.transformValue(value, "Boolean");
+      const baseType = this.isAuthMember(expr2.left) ? this.authType : context.modelOrType;
+      const memberType = this.getMemberType(baseType, expr2.left);
+      return this.transformValueCollectionPredicate(receiver, expr2, {
+        ...context,
+        modelOrType: memberType
+      });
     }
     (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isField(expr2.left) || import_schema3.ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
-    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
     if (fieldDef) {
       (0, import_common_helpers2.invariant)(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isMember(expr2.left) && import_schema3.ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
-      const fieldDef2 = import_runtime4.QueryUtils.requireField(this.schema, context.model, expr2.left.receiver.field);
+      const fieldDef2 = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.left.receiver.field);
       newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
-        const memberDef = import_runtime4.QueryUtils.requireField(this.schema, newContextModel, member);
+        const memberDef = import_orm3.QueryUtils.requireField(this.schema, newContextModel, member);
         newContextModel = memberDef.type;
       }
     }
     let predicateFilter = this.transform(expr2.right, {
       ...context,
-      model: newContextModel,
+      modelOrType: newContextModel,
       alias: void 0
     });
     if (expr2.op === "!") {
@@ -447,9 +492,49 @@ var ExpressionTransformer = class {
       memberFilter: predicateFilter
     });
   }
+  ensureCollectionPredicateOperator(op) {
+    (0, import_common_helpers2.invariant)(CollectionPredicateOperator.includes(op), 'expected "?" or "!" or "^" operator');
+  }
+  transformValueCollectionPredicate(receiver, expr2, context) {
+    if (!receiver) {
+      return import_kysely2.ValueNode.createImmediate(null);
+    }
+    this.ensureCollectionPredicateOperator(expr2.op);
+    const visitor = new import_orm3.SchemaUtils.MatchingExpressionVisitor((e) => import_schema3.ExpressionUtils.isThis(e));
+    if (!visitor.find(expr2.right)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth,
+        thisValue: context.contextValue
+      });
+      return this.transformValue(value, "Boolean");
+    } else {
+      (0, import_common_helpers2.invariant)(Array.isArray(receiver), "array value is expected");
+      const components = receiver.map((item) => this.transform(expr2.right, {
+        operation: context.operation,
+        thisType: context.thisType,
+        thisAlias: context.thisAlias,
+        modelOrType: context.modelOrType,
+        contextValue: item
+      }));
+      return (0, import_ts_pattern2.match)(expr2.op).with("?", () => disjunction(this.dialect, components)).with("!", () => conjunction(this.dialect, components)).with("^", () => logicalNot(this.dialect, disjunction(this.dialect, components))).exhaustive();
+    }
+  }
+  getMemberType(receiverType, expr2) {
+    if (import_schema3.ExpressionUtils.isField(expr2)) {
+      const fieldDef = import_orm3.QueryUtils.requireField(this.schema, receiverType, expr2.field);
+      return fieldDef.type;
+    } else {
+      let currType = receiverType;
+      for (const member of expr2.members) {
+        const fieldDef = import_orm3.QueryUtils.requireField(this.schema, currType, member);
+        currType = fieldDef.type;
+      }
+      return currType;
+    }
+  }
   transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw new import_runtime4.QueryError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
+      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.modelOrType}": ${expr2.op}`);
     }
     let authExpr;
     let other;
@@ -463,9 +548,9 @@ var ExpressionTransformer = class {
     if (import_schema3.ExpressionUtils.isNull(other)) {
       return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
     } else {
-      const authModel = import_runtime4.QueryUtils.getModel(this.schema, this.authType);
+      const authModel = import_orm3.QueryUtils.getModel(this.schema, this.authType);
       if (!authModel) {
-        throw new import_runtime4.QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.modelOrType}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
       (0, import_common_helpers2.invariant)(idFields.length > 0, "auth type model must have at least one id field");
@@ -497,7 +582,12 @@ var ExpressionTransformer = class {
     } else if (value === false) {
       return falseNode(this.dialect);
     } else {
-      return import_kysely2.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+      const transformed = this.dialect.transformPrimitive(value, type, false) ?? null;
+      if (!Array.isArray(transformed)) {
+        return import_kysely2.ValueNode.createImmediate(transformed);
+      } else {
+        return import_kysely2.ValueNode.create(transformed);
+      }
     }
   }
   _unary(expr2, context) {
@@ -515,14 +605,14 @@ var ExpressionTransformer = class {
   transformCall(expr2, context) {
     const func = this.getFunctionImpl(expr2.function);
     if (!func) {
-      throw new import_runtime4.QueryError(`Function not implemented: ${expr2.function}`);
+      throw createUnsupportedError(`Function not implemented: ${expr2.function}`);
     }
     const eb = (0, import_kysely2.expressionBuilder)();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
       client: this.client,
       dialect: this.dialect,
-      model: context.model,
-      modelAlias: context.alias ?? context.model,
+      model: context.modelOrType,
+      modelAlias: context.alias ?? context.modelOrType,
       operation: context.operation
     });
   }
@@ -552,7 +642,7 @@ var ExpressionTransformer = class {
       const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
       return valNode ? eb.val(valNode.value) : eb.val(null);
     }
-    throw new import_runtime4.InternalError(`Unsupported argument expression: ${arg.kind}`);
+    throw createUnsupportedError(`Unsupported argument expression: ${arg.kind}`);
   }
   _member(expr2, context) {
     if (this.isAuthCall(expr2.receiver)) {
@@ -569,9 +659,15 @@ var ExpressionTransformer = class {
     const { memberFilter, memberSelect, ...restContext } = context;
     if (import_schema3.ExpressionUtils.isThis(expr2.receiver)) {
       if (expr2.members.length === 1) {
-        return this._field(import_schema3.ExpressionUtils.field(expr2.members[0]), context);
+        return this._field(import_schema3.ExpressionUtils.field(expr2.members[0]), {
+          ...context,
+          alias: context.thisAlias,
+          modelOrType: context.thisType,
+          thisType: context.thisType,
+          contextValue: void 0
+        });
       } else {
-        const firstMemberFieldDef = import_runtime4.QueryUtils.requireField(this.schema, context.model, expr2.members[0]);
+        const firstMemberFieldDef = import_orm3.QueryUtils.requireField(this.schema, context.thisType, expr2.members[0]);
         receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
         members = expr2.members.slice(1);
       }
@@ -581,15 +677,15 @@ var ExpressionTransformer = class {
     (0, import_common_helpers2.invariant)(import_kysely2.SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (import_schema3.ExpressionUtils.isField(expr2.receiver)) {
-      const receiverField = import_runtime4.QueryUtils.requireField(this.schema, context.model, expr2.receiver.field);
+      const receiverField = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.receiver.field);
       startType = receiverField.type;
     } else {
-      startType = context.model;
+      startType = context.thisType;
     }
     const memberFields = [];
     let currType = startType;
     for (const member of members) {
-      const fieldDef = import_runtime4.QueryUtils.requireField(this.schema, currType, member);
+      const fieldDef = import_orm3.QueryUtils.requireField(this.schema, currType, member);
       memberFields.push({
         fieldDef,
         fromModel: currType
@@ -603,7 +699,7 @@ var ExpressionTransformer = class {
       if (fieldDef.relation) {
         const relation = this.transformRelationAccess(member, fieldDef.type, {
           ...restContext,
-          model: fromModel,
+          modelOrType: fromModel,
           alias: void 0
         });
         if (currNode) {
@@ -639,22 +735,31 @@ var ExpressionTransformer = class {
     if (!receiver) {
       return import_kysely2.ValueNode.createImmediate(null);
     }
-    if (expr2.members.length !== 1) {
-      throw new Error(`Only single member access is supported`);
+    (0, import_common_helpers2.invariant)(expr2.members.length > 0, "member expression must have at least one member");
+    let curr = receiver;
+    let currType = receiverType;
+    for (let i = 0; i < expr2.members.length; i++) {
+      const field = expr2.members[i];
+      curr = curr?.[field];
+      if (curr === void 0) {
+        curr = import_kysely2.ValueNode.createImmediate(null);
+        break;
+      }
+      currType = import_orm3.QueryUtils.requireField(this.schema, currType, field).type;
+      if (i === expr2.members.length - 1) {
+        curr = this.transformValue(curr, currType);
+      }
     }
-    const field = expr2.members[0];
-    const fieldDef = import_runtime4.QueryUtils.requireField(this.schema, receiverType, field);
-    const fieldValue = receiver[field] ?? null;
-    return this.transformValue(fieldValue, fieldDef.type);
+    return curr;
   }
   transformRelationAccess(field, relationModel, context) {
-    const m2m = import_runtime4.QueryUtils.getManyToManyRelation(this.schema, context.model, field);
+    const m2m = import_orm3.QueryUtils.getManyToManyRelation(this.schema, context.modelOrType, field);
     if (m2m) {
       return this.transformManyToManyRelationAccess(m2m, context);
     }
-    const fromModel = context.model;
-    const relationFieldDef = import_runtime4.QueryUtils.requireField(this.schema, fromModel, field);
-    const { keyPairs, ownedByModel } = import_runtime4.QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
+    const fromModel = context.modelOrType;
+    const relationFieldDef = import_orm3.QueryUtils.requireField(this.schema, fromModel, field);
+    const { keyPairs, ownedByModel } = import_orm3.QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
     if (ownedByModel) {
       condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => {
@@ -677,22 +782,22 @@ var ExpressionTransformer = class {
   }
   transformManyToManyRelationAccess(m2m, context) {
     const eb = (0, import_kysely2.expressionBuilder)();
-    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.modelOrType}.${m2m.parentPKName}`));
     return relationQuery.toOperationNode();
   }
   createColumnRef(column, context) {
-    const tableName = context.alias ?? context.model;
+    const tableName = context.alias ?? context.modelOrType;
     if (context.operation === "create") {
       return import_kysely2.ReferenceNode.create(import_kysely2.ColumnNode.create(column), import_kysely2.TableNode.create(tableName));
     }
-    const fieldDef = import_runtime4.QueryUtils.requireField(this.schema, context.model, column);
-    if (!fieldDef.originModel || fieldDef.originModel === context.model) {
+    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, column);
+    if (!fieldDef.originModel || fieldDef.originModel === context.modelOrType) {
       return import_kysely2.ReferenceNode.create(import_kysely2.ColumnNode.create(column), import_kysely2.TableNode.create(tableName));
     }
-    return this.buildDelegateBaseFieldSelect(context.model, tableName, column, fieldDef.originModel);
+    return this.buildDelegateBaseFieldSelect(context.modelOrType, tableName, column, fieldDef.originModel);
   }
   buildDelegateBaseFieldSelect(model, modelAlias, field, baseModel) {
-    const idFields = import_runtime4.QueryUtils.requireIdFields(this.client.$schema, model);
+    const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, model);
     return {
       kind: "SelectQueryNode",
       from: import_kysely2.FromNode.create([
@@ -731,9 +836,9 @@ var ExpressionTransformer = class {
   }
   getFieldDefFromFieldRef(expr2, model) {
     if (import_schema3.ExpressionUtils.isField(expr2)) {
-      return import_runtime4.QueryUtils.requireField(this.schema, model, expr2.field);
+      return import_orm3.QueryUtils.getField(this.schema, model, expr2.field);
     } else if (import_schema3.ExpressionUtils.isMember(expr2) && expr2.members.length === 1 && import_schema3.ExpressionUtils.isThis(expr2.receiver)) {
-      return import_runtime4.QueryUtils.requireField(this.schema, model, expr2.members[0]);
+      return import_orm3.QueryUtils.getField(this.schema, model, expr2.members[0]);
     } else {
       return void 0;
     }
@@ -817,19 +922,20 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
   dialect;
   constructor(client) {
     super(), this.client = client;
-    this.dialect = (0, import_runtime6.getCrudDialect)(this.client.$schema, this.client.$options);
+    this.dialect = (0, import_orm4.getCrudDialect)(this.client.$schema, this.client.$options);
   }
   get kysely() {
     return this.client.$qb;
   }
   async handle(node, proceed) {
     if (!this.isCrudQueryNode(node)) {
-      throw new import_runtime6.RejectedByPolicyError(void 0, import_runtime6.RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
+      throw createRejectedByPolicyError(void 0, import_orm4.RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
     }
     if (!this.isMutationQueryNode(node)) {
       return proceed(this.transformNode(node));
     }
     const { mutationModel } = this.getMutationModel(node);
+    this.tryRejectNonexistentModel(mutationModel);
     if (import_kysely3.InsertQueryNode.is(node)) {
       const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
       let needCheckPreCreate = true;
@@ -838,7 +944,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
         if (constCondition === true) {
           needCheckPreCreate = false;
         } else if (constCondition === false) {
-          throw new import_runtime6.RejectedByPolicyError(mutationModel);
+          throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.NO_ACCESS);
         }
       }
       if (needCheckPreCreate) {
@@ -854,11 +960,11 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     if (hasPostUpdatePolicies && result.rows.length > 0) {
       if (beforeUpdateInfo) {
         (0, import_common_helpers3.invariant)(beforeUpdateInfo.rows.length === result.rows.length);
-        const idFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+        const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
         for (const postRow of result.rows) {
           const beforeRow = beforeUpdateInfo.rows.find((r) => idFields.every((f) => r[f] === postRow[f]));
           if (!beforeRow) {
-            throw new import_runtime6.QueryError("Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
+            throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.OTHER, "Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
           }
         }
       }
@@ -871,7 +977,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
           import_kysely3.ParensNode.create(import_kysely3.ValuesNode.create(beforeUpdateInfo.rows.map((r) => import_kysely3.PrimitiveValueListNode.create(beforeUpdateInfo.fields.map((f) => r[f])))))
         ]),
         selections: beforeUpdateInfo.fields.map((name, index) => {
-          const def = import_runtime6.QueryUtils.requireField(this.client.$schema, mutationModel, name);
+          const def = import_orm4.QueryUtils.requireField(this.client.$schema, mutationModel, name);
           const castedColumnRef = import_kysely3.sql`CAST(${eb.ref(`column${index + 1}`)} as ${import_kysely3.sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
           return import_kysely3.SelectionNode.create(castedColumnRef.toOperationNode());
         })
@@ -884,12 +990,12 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
         idConditions,
         postUpdateFilter
       ]))).$if(!!beforeUpdateInfo, (qb) => qb.leftJoin(() => new import_kysely3.ExpressionWrapper(beforeUpdateTable).as("$before"), (join) => {
-        const idFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+        const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
         return idFields.reduce((acc, f) => acc.onRef(`${mutationModel}.${f}`, "=", `$before.${f}`), join);
       }));
       const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
       if (!postUpdateResult.rows[0]?.$condition) {
-        throw new import_runtime6.RejectedByPolicyError(mutationModel, import_runtime6.RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+        throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
       }
     }
     if (!node.returning || this.onlyReturningId(node)) {
@@ -897,7 +1003,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
-        throw new import_runtime6.RejectedByPolicyError(mutationModel, import_runtime6.RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+        throw createRejectedByPolicyError(mutationModel, import_orm4.RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       }
       return readBackResult;
     }
@@ -951,7 +1057,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       return void 0;
     }
     const fields = /* @__PURE__ */ new Set();
-    const fieldCollector = new class extends import_sdk2.ExpressionVisitor {
+    const fieldCollector = new class extends import_orm4.SchemaUtils.ExpressionVisitor {
       visitMember(e) {
         if (isBeforeInvocation(e.receiver)) {
           (0, import_common_helpers3.invariant)(e.members.length === 1, "before() can only be followed by a scalar field access");
@@ -966,7 +1072,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     if (fields.size === 0) {
       return void 0;
     }
-    import_runtime6.QueryUtils.requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
+    import_orm4.QueryUtils.requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
     return Array.from(fields).sort();
   }
   // #region overrides
@@ -996,6 +1102,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     if (!table) {
       return super.transformJoin(node);
     }
+    this.tryRejectNonexistentModel(table.model);
     const filter = this.buildPolicyFilter(table.model, table.alias, "read");
     const nestedSelect = {
       kind: "SelectQueryNode",
@@ -1040,7 +1147,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     let returning = result.returning;
     if (returning) {
       const { mutationModel } = this.getMutationModel(node);
-      const idFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+      const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
       returning = import_kysely3.ReturningNode.create(idFields.map((f) => import_kysely3.SelectionNode.create(import_kysely3.ColumnNode.create(f))));
     }
     return {
@@ -1063,7 +1170,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     }
     let returning = result.returning;
     if (returning || this.hasPostUpdatePolicies(mutationModel)) {
-      const idFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+      const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
       returning = import_kysely3.ReturningNode.create(idFields.map((f) => import_kysely3.SelectionNode.create(import_kysely3.ColumnNode.create(f))));
     }
     return {
@@ -1103,9 +1210,9 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       return true;
     }
     const { mutationModel } = this.getMutationModel(node);
-    const idFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
+    const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, mutationModel);
     if (node.returning.selections.some((s) => import_kysely3.SelectAllNode.is(s.selection))) {
-      const modelDef = import_runtime6.QueryUtils.requireModel(this.client.$schema, mutationModel);
+      const modelDef = import_orm4.QueryUtils.requireModel(this.client.$schema, mutationModel);
       if (Object.keys(modelDef.fields).some((f) => !idFields.includes(f))) {
         return false;
       } else {
@@ -1156,14 +1263,14 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     };
     const result = await proceed(queryNode);
     if (!result.rows[0]?.$conditionA) {
-      throw new import_runtime6.RejectedByPolicyError(m2m.firstModel, import_runtime6.RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+      throw createRejectedByPolicyError(m2m.firstModel, import_orm4.RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
     }
     if (!result.rows[0]?.$conditionB) {
-      throw new import_runtime6.RejectedByPolicyError(m2m.secondModel, import_runtime6.RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
+      throw createRejectedByPolicyError(m2m.secondModel, import_orm4.RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
     }
   }
   async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
-    const allFields = Object.entries(import_runtime6.QueryUtils.requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
+    const allFields = Object.entries(import_orm4.QueryUtils.requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
     const allValues = [];
     for (const [name, _def] of allFields) {
       const index = fields.indexOf(name);
@@ -1201,7 +1308,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
-      throw new import_runtime6.RejectedByPolicyError(model);
+      throw createRejectedByPolicyError(model, import_orm4.RejectedByPolicyReason.NO_ACCESS);
     }
   }
   unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
@@ -1212,7 +1319,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
         this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
       ];
     } else {
-      throw new import_runtime6.InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
+      (0, import_common_helpers3.invariant)(false, `Unexpected node kind: ${node.kind} for unwrapping create values`);
     }
   }
   unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
@@ -1221,7 +1328,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     for (let i = 0; i < data.length; i++) {
       const item = data[i];
       if (typeof item === "object" && item && "kind" in item) {
-        const fieldDef = import_runtime6.QueryUtils.requireField(this.client.$schema, model, fields[i]);
+        const fieldDef = import_orm4.QueryUtils.requireField(this.client.$schema, model, fields[i]);
         (0, import_common_helpers3.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
         result.push({
           node: import_kysely3.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
@@ -1230,7 +1337,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       } else {
         let value = item;
         if (!isImplicitManyToManyJoinTable) {
-          const fieldDef = import_runtime6.QueryUtils.requireField(this.client.$schema, model, fields[i]);
+          const fieldDef = import_orm4.QueryUtils.requireField(this.client.$schema, model, fields[i]);
           value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
         }
         if (Array.isArray(value)) {
@@ -1294,7 +1401,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     return selectResult;
   }
   buildIdConditions(table, rows) {
-    const idFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, table);
+    const idFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, table);
     return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely3.BinaryOperationNode.create(import_kysely3.ReferenceNode.create(import_kysely3.ColumnNode.create(field), import_kysely3.TableNode.create(table)), import_kysely3.OperatorNode.create("="), import_kysely3.ValueNode.create(row[field]))))));
   }
   getMutationModel(node) {
@@ -1303,7 +1410,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       alias: void 0
     })).when(import_kysely3.UpdateQueryNode.is, (node2) => {
       if (!node2.table) {
-        throw new import_runtime6.QueryError("Update query must have a table");
+        (0, import_common_helpers3.invariant)(false, "Update query must have a table");
       }
       const r2 = this.extractTableName(node2.table);
       return r2 ? {
@@ -1312,7 +1419,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       } : void 0;
     }).when(import_kysely3.DeleteQueryNode.is, (node2) => {
       if (node2.from.froms.length !== 1) {
-        throw new import_runtime6.QueryError("Only one from table is supported for delete");
+        throw createUnsupportedError("Only one from table is supported for delete");
       }
       const r2 = this.extractTableName(node2.from.froms[0]);
       return r2 ? {
@@ -1321,7 +1428,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       } : void 0;
     }).exhaustive();
     if (!r) {
-      throw new import_runtime6.InternalError(`Unable to get table name for query node: ${node}`);
+      (0, import_common_helpers3.invariant)(false, `Unable to get table name for query node: ${node}`);
     }
     return r;
   }
@@ -1388,6 +1495,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       const extractResult = this.extractTableName(table);
       if (extractResult) {
         const { model, alias } = extractResult;
+        this.tryRejectNonexistentModel(model);
         const filter = this.buildPolicyFilter(model, alias, "read");
         return acc ? conjunction(this.dialect, [
           acc,
@@ -1399,13 +1507,15 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
   }
   compilePolicyCondition(model, alias, operation, policy) {
     return new ExpressionTransformer(this.client).transform(policy.condition, {
-      model,
+      modelOrType: model,
+      thisType: model,
+      thisAlias: alias,
       alias,
       operation
     });
   }
   getModelPolicies(model, operation) {
-    const modelDef = import_runtime6.QueryUtils.requireModel(this.client.$schema, model);
+    const modelDef = import_orm4.QueryUtils.requireModel(this.client.$schema, model);
     const result = [];
     const extractOperations = /* @__PURE__ */ __name((expr2) => {
       (0, import_common_helpers3.invariant)(import_schema4.ExpressionUtils.isLiteral(expr2), "expecting a literal");
@@ -1424,7 +1534,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
   resolveManyToManyJoinTable(tableName) {
     for (const model of Object.values(this.client.$schema.models)) {
       for (const field of Object.values(model.fields)) {
-        const m2m = import_runtime6.QueryUtils.getManyToManyRelation(this.client.$schema, model.name, field.name);
+        const m2m = import_orm4.QueryUtils.getManyToManyRelation(this.client.$schema, model.name, field.name);
         if (m2m?.joinTable === tableName) {
           const sortedRecord = [
             {
@@ -1436,8 +1546,8 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
               field: m2m.otherField
             }
           ].sort(this.manyToManySorter);
-          const firstIdFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[0].model);
-          const secondIdFields = import_runtime6.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[1].model);
+          const firstIdFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[0].model);
+          const secondIdFields = import_orm4.QueryUtils.requireIdFields(this.client.$schema, sortedRecord[1].model);
           (0, import_common_helpers3.invariant)(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
           return {
             firstModel: sortedRecord[0].model,
@@ -1473,6 +1583,11 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       bQuery
     ]).toOperationNode();
   }
+  tryRejectNonexistentModel(model) {
+    if (!import_orm4.QueryUtils.hasModel(this.client.$schema, model) && !this.isManyToManyJoinTable(model)) {
+      throw createRejectedByPolicyError(model, import_orm4.RejectedByPolicyReason.NO_ACCESS);
+    }
+  }
 };
 
 // src/functions.ts
@@ -1482,17 +1597,17 @@ var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, opera
   const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
   if (arg2Node) {
     (0, import_common_helpers4.invariant)(import_kysely4.ValueNode.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
-    (0, import_common_helpers4.invariant)(import_runtime8.CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+    (0, import_common_helpers4.invariant)(import_orm5.CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
   }
-  const fieldName = import_runtime8.QueryUtils.extractFieldName(arg1Node);
+  const fieldName = import_orm5.QueryUtils.extractFieldName(arg1Node);
   (0, import_common_helpers4.invariant)(fieldName, 'Failed to extract field name from the first argument of "check" function');
-  const fieldDef = import_runtime8.QueryUtils.requireField(client.$schema, model, fieldName);
+  const fieldDef = import_orm5.QueryUtils.requireField(client.$schema, model, fieldName);
   (0, import_common_helpers4.invariant)(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
   (0, import_common_helpers4.invariant)(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
   const relationModel = fieldDef.type;
   const joinConditions = [];
-  const fkInfo = import_runtime8.QueryUtils.getRelationForeignKeyFieldPairs(client.$schema, model, fieldName);
-  const idFields = import_runtime8.QueryUtils.requireIdFields(client.$schema, model);
+  const fkInfo = import_orm5.QueryUtils.getRelationForeignKeyFieldPairs(client.$schema, model, fieldName);
+  const idFields = import_orm5.QueryUtils.requireIdFields(client.$schema, model);
   const buildBaseSelect = /* @__PURE__ */ __name((baseModel, field) => {
     return eb.selectFrom(baseModel).select(field).where(eb.and(idFields.map((idField) => eb(eb.ref(`${fieldDef.originModel}.${idField}`), "=", eb.ref(`${modelAlias}.${idField}`)))));
   }, "buildBaseSelect");