@zenstackhq/plugin-policy 3.3.1 → 3.3.2-beta.1

package/dist/index.mjs

@@ -0,0 +1,1798 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/functions.ts
+import { invariant as invariant4 } from "@zenstackhq/common-helpers";
+import { CRUD, QueryUtils as QueryUtils3 } from "@zenstackhq/orm";
+import { ExpressionWrapper as ExpressionWrapper2, ValueNode as ValueNode4 } from "kysely";
+
+// src/policy-handler.ts
+import { invariant as invariant3 } from "@zenstackhq/common-helpers";
+import { getCrudDialect as getCrudDialect2, QueryUtils as QueryUtils2, RejectedByPolicyReason, SchemaUtils as SchemaUtils2 } from "@zenstackhq/orm";
+import { ExpressionUtils as ExpressionUtils4 } from "@zenstackhq/orm/schema";
+import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode3, DeleteQueryNode, expressionBuilder as expressionBuilder2, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReferenceNode as ReferenceNode3, ReturningNode, SelectAllNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql, TableNode as TableNode3, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
+import { match as match3 } from "ts-pattern";
+
+// src/column-collector.ts
+import { KyselyUtils } from "@zenstackhq/orm";
+var ColumnCollector = class extends KyselyUtils.DefaultOperationNodeVisitor {
+  static {
+    __name(this, "ColumnCollector");
+  }
+  columns = [];
+  collect(node) {
+    this.columns = [];
+    this.visitNode(node);
+    return this.columns;
+  }
+  visitColumn(node) {
+    if (!this.columns.includes(node.column.name)) {
+      this.columns.push(node.column.name);
+    }
+  }
+};
+
+// src/expression-transformer.ts
+import { invariant as invariant2 } from "@zenstackhq/common-helpers";
+import { getCrudDialect, QueryUtils, SchemaUtils } from "@zenstackhq/orm";
+import { ExpressionUtils as ExpressionUtils3 } from "@zenstackhq/orm/schema";
+import { AliasNode as AliasNode2, BinaryOperationNode as BinaryOperationNode2, ColumnNode as ColumnNode2, expressionBuilder, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode2, SelectionNode, SelectQueryNode, TableNode as TableNode2, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
+import { match as match2 } from "ts-pattern";
+
+// src/expression-evaluator.ts
+import { invariant } from "@zenstackhq/common-helpers";
+import { match } from "ts-pattern";
+import { ExpressionUtils } from "@zenstackhq/orm/schema";
+var ExpressionEvaluator = class {
+  static {
+    __name(this, "ExpressionEvaluator");
+  }
+  evaluate(expression, context) {
+    const result = match(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
+    return result ?? null;
+  }
+  evaluateCall(expr2, context) {
+    if (expr2.function === "auth") {
+      return context.auth;
+    } else {
+      throw new Error(`Unsupported call expression function: ${expr2.function}`);
+    }
+  }
+  evaluateUnary(expr2, context) {
+    return match(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
+  }
+  evaluateMember(expr2, context) {
+    let val = this.evaluate(expr2.receiver, context);
+    for (const member of expr2.members) {
+      val = val?.[member];
+    }
+    return val;
+  }
+  evaluateLiteral(expr2) {
+    return expr2.value;
+  }
+  evaluateField(expr2, context) {
+    return context.thisValue?.[expr2.field];
+  }
+  evaluateArray(expr2, context) {
+    return expr2.items.map((item) => this.evaluate(item, context));
+  }
+  evaluateBinary(expr2, context) {
+    if (expr2.op === "?" || expr2.op === "!" || expr2.op === "^") {
+      return this.evaluateCollectionPredicate(expr2, context);
+    }
+    const left = this.evaluate(expr2.left, context);
+    const right = this.evaluate(expr2.right, context);
+    if (![
+      "==",
+      "!="
+    ].includes(expr2.op) && (left === null || right === null)) {
+      return null;
+    }
+    return match(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
+      const _right = right ?? [];
+      invariant(Array.isArray(_right), 'expected array for "in" operator');
+      return _right.includes(left);
+    }).exhaustive();
+  }
+  evaluateCollectionPredicate(expr2, context) {
+    const op = expr2.op;
+    invariant(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    const left = this.evaluate(expr2.left, context);
+    if (left === null || left === void 0) {
+      return null;
+    }
+    invariant(Array.isArray(left), "expected array");
+    return match(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("^", () => !left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).exhaustive();
+  }
+};
+
+// src/types.ts
+var CollectionPredicateOperator = [
+  "?",
+  "!",
+  "^"
+];
+
+// src/utils.ts
+import { ORMError, ORMErrorReason } from "@zenstackhq/orm";
+import { ExpressionUtils as ExpressionUtils2 } from "@zenstackhq/orm/schema";
+import { AliasNode, AndNode, BinaryOperationNode, ColumnNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode, TableNode, UnaryOperationNode, ValueNode } from "kysely";
+function trueNode(dialect) {
+  return ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
+}
+__name(trueNode, "trueNode");
+function falseNode(dialect) {
+  return ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
+}
+__name(falseNode, "falseNode");
+function isTrueNode(node) {
+  return ValueNode.is(node) && (node.value === true || node.value === 1);
+}
+__name(isTrueNode, "isTrueNode");
+function isFalseNode(node) {
+  return ValueNode.is(node) && (node.value === false || node.value === 0);
+}
+__name(isFalseNode, "isFalseNode");
+function conjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return trueNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
+  if (nodes.some(isFalseNode)) {
+    return falseNode(dialect);
+  }
+  const items = nodes.filter((n) => !isTrueNode(n));
+  if (items.length === 0) {
+    return trueNode(dialect);
+  }
+  return items.reduce((acc, node) => AndNode.create(wrapParensIf(acc, OrNode.is), wrapParensIf(node, OrNode.is)));
+}
+__name(conjunction, "conjunction");
+function disjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return falseNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
+  if (nodes.some(isTrueNode)) {
+    return trueNode(dialect);
+  }
+  const items = nodes.filter((n) => !isFalseNode(n));
+  if (items.length === 0) {
+    return falseNode(dialect);
+  }
+  return items.reduce((acc, node) => OrNode.create(wrapParensIf(acc, AndNode.is), wrapParensIf(node, AndNode.is)));
+}
+__name(disjunction, "disjunction");
+function logicalNot(dialect, node) {
+  if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  }
+  return UnaryOperationNode.create(OperatorNode.create("not"), wrapParensIf(node, (n) => AndNode.is(n) || OrNode.is(n)));
+}
+__name(logicalNot, "logicalNot");
+function wrapParensIf(node, predicate) {
+  return predicate(node) ? ParensNode.create(node) : node;
+}
+__name(wrapParensIf, "wrapParensIf");
+function buildIsFalse(node, dialect) {
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  } else if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  return BinaryOperationNode.create(
+    // coalesce so null is treated as false
+    FunctionNode.create("coalesce", [
+      node,
+      falseNode(dialect)
+    ]),
+    OperatorNode.create("="),
+    falseNode(dialect)
+  );
+}
+__name(buildIsFalse, "buildIsFalse");
+function getTableName(node) {
+  if (!node) {
+    return node;
+  }
+  if (TableNode.is(node)) {
+    return node.table.identifier.name;
+  } else if (AliasNode.is(node)) {
+    return getTableName(node.node);
+  } else if (ReferenceNode.is(node) && node.table) {
+    return getTableName(node.table);
+  }
+  return void 0;
+}
+__name(getTableName, "getTableName");
+function isBeforeInvocation(expr2) {
+  return ExpressionUtils2.isCall(expr2) && expr2.function === "before";
+}
+__name(isBeforeInvocation, "isBeforeInvocation");
+function createRejectedByPolicyError(model, reason, message) {
+  const err = new ORMError(ORMErrorReason.REJECTED_BY_POLICY, message ?? "operation is rejected by access policies");
+  err.rejectedByPolicyReason = reason;
+  err.model = model;
+  return err;
+}
+__name(createRejectedByPolicyError, "createRejectedByPolicyError");
+function createUnsupportedError(message) {
+  return new ORMError(ORMErrorReason.NOT_SUPPORTED, message);
+}
+__name(createUnsupportedError, "createUnsupportedError");
+
+// src/expression-transformer.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+var expressionHandlers = /* @__PURE__ */ new Map();
+function expr(kind) {
+  return function(_target, _propertyKey, descriptor) {
+    if (!expressionHandlers.get(kind)) {
+      expressionHandlers.set(kind, descriptor);
+    }
+    return descriptor;
+  };
+}
+__name(expr, "expr");
+var ExpressionTransformer = class {
+  static {
+    __name(this, "ExpressionTransformer");
+  }
+  client;
+  dialect;
+  constructor(client) {
+    this.client = client;
+    this.dialect = getCrudDialect(this.schema, this.clientOptions);
+  }
+  get schema() {
+    return this.client.$schema;
+  }
+  get clientOptions() {
+    return this.client.$options;
+  }
+  get auth() {
+    return this.client.$auth;
+  }
+  get authType() {
+    if (!this.schema.authType) {
+      invariant2(false, 'Schema does not have an "authType" specified');
+    }
+    return this.schema.authType;
+  }
+  transform(expression, context) {
+    const handler = expressionHandlers.get(expression.kind);
+    if (!handler) {
+      throw new Error(`Unsupported expression kind: ${expression.kind}`);
+    }
+    return handler.value.call(this, expression, context);
+  }
+  _literal(expr2) {
+    return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
+  }
+  _array(expr2, context) {
+    return ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
+  }
+  _field(expr2, context) {
+    if (context.contextValue) {
+      const fieldDef2 = QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
+      return this.transformValue(context.contextValue[expr2.field], fieldDef2.type);
+    }
+    const fieldDef = QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
+    if (!fieldDef.relation) {
+      return this.createColumnRef(expr2.field, context);
+    } else {
+      const { memberFilter, memberSelect, ...restContext } = context;
+      const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
+      return {
+        ...relation,
+        where: this.mergeWhere(relation.where, memberFilter),
+        selections: memberSelect ? [
+          memberSelect
+        ] : relation.selections
+      };
+    }
+  }
+  mergeWhere(where, memberFilter) {
+    if (!where) {
+      return WhereNode.create(memberFilter ?? trueNode(this.dialect));
+    }
+    if (!memberFilter) {
+      return where;
+    }
+    return WhereNode.create(conjunction(this.dialect, [
+      where.where,
+      memberFilter
+    ]));
+  }
+  _null() {
+    return ValueNode2.createImmediate(null);
+  }
+  _binary(expr2, context) {
+    if (expr2.op === "&&") {
+      return conjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    } else if (expr2.op === "||") {
+      return disjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    }
+    if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
+      return this.transformAuthBinary(expr2, context);
+    }
+    const op = expr2.op;
+    if (op === "?" || op === "!" || op === "^") {
+      return this.transformCollectionPredicate(expr2, context);
+    }
+    const { normalizedLeft, normalizedRight } = this.normalizeBinaryOperationOperands(expr2, context);
+    const left = this.transform(normalizedLeft, context);
+    const right = this.transform(normalizedRight, context);
+    if (op === "in") {
+      if (this.isNullNode(left)) {
+        return this.transformValue(false, "Boolean");
+      } else {
+        if (ValueListNode.is(right)) {
+          return BinaryOperationNode2.create(left, OperatorNode2.create("in"), right);
+        } else {
+          return BinaryOperationNode2.create(left, OperatorNode2.create("="), FunctionNode2.create("any", [
+            right
+          ]));
+        }
+      }
+    }
+    if (this.isNullNode(right)) {
+      return this.transformNullCheck(left, expr2.op);
+    } else if (this.isNullNode(left)) {
+      return this.transformNullCheck(right, expr2.op);
+    } else {
+      return BinaryOperationNode2.create(left, this.transformOperator(op), right);
+    }
+  }
+  transformNullCheck(expr2, operator) {
+    if (operator === "==" || operator === "!=") {
+      if (ValueNode2.is(expr2)) {
+        if (expr2.value === null) {
+          return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+        } else {
+          return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        }
+      } else {
+        return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+      }
+    } else {
+      return ValueNode2.createImmediate(null);
+    }
+  }
+  normalizeBinaryOperationOperands(expr2, context) {
+    if (context.contextValue) {
+      return {
+        normalizedLeft: expr2.left,
+        normalizedRight: expr2.right
+      };
+    }
+    let normalizedLeft = expr2.left;
+    if (this.isRelationField(expr2.left, context.modelOrType)) {
+      invariant2(ExpressionUtils3.isNull(expr2.right), "only null comparison is supported for relation field");
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
+      invariant2(leftRelDef, "failed to get relation field definition");
+      const idFields = QueryUtils.requireIdFields(this.schema, leftRelDef.type);
+      normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
+    }
+    let normalizedRight = expr2.right;
+    if (this.isRelationField(expr2.right, context.modelOrType)) {
+      invariant2(ExpressionUtils3.isNull(expr2.left), "only null comparison is supported for relation field");
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.modelOrType);
+      invariant2(rightRelDef, "failed to get relation field definition");
+      const idFields = QueryUtils.requireIdFields(this.schema, rightRelDef.type);
+      normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
+    }
+    return {
+      normalizedLeft,
+      normalizedRight
+    };
+  }
+  transformCollectionPredicate(expr2, context) {
+    this.ensureCollectionPredicateOperator(expr2.op);
+    if (this.isAuthMember(expr2.left) || context.contextValue) {
+      invariant2(ExpressionUtils3.isMember(expr2.left) || ExpressionUtils3.isField(expr2.left), "expected member or field expression");
+      const evaluator = new ExpressionEvaluator();
+      const receiver = evaluator.evaluate(expr2.left, {
+        thisValue: context.contextValue,
+        auth: this.auth
+      });
+      const baseType = this.isAuthMember(expr2.left) ? this.authType : context.modelOrType;
+      const memberType = this.getMemberType(baseType, expr2.left);
+      return this.transformValueCollectionPredicate(receiver, expr2, {
+        ...context,
+        modelOrType: memberType
+      });
+    }
+    invariant2(ExpressionUtils3.isField(expr2.left) || ExpressionUtils3.isMember(expr2.left), "left operand must be field or member access");
+    let newContextModel;
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
+    if (fieldDef) {
+      invariant2(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
+      newContextModel = fieldDef.type;
+    } else {
+      invariant2(ExpressionUtils3.isMember(expr2.left) && ExpressionUtils3.isField(expr2.left.receiver), "left operand must be member access with field receiver");
+      const fieldDef2 = QueryUtils.requireField(this.schema, context.modelOrType, expr2.left.receiver.field);
+      newContextModel = fieldDef2.type;
+      for (const member of expr2.left.members) {
+        const memberDef = QueryUtils.requireField(this.schema, newContextModel, member);
+        newContextModel = memberDef.type;
+      }
+    }
+    let predicateFilter = this.transform(expr2.right, {
+      ...context,
+      modelOrType: newContextModel,
+      alias: void 0
+    });
+    if (expr2.op === "!") {
+      predicateFilter = logicalNot(this.dialect, predicateFilter);
+    }
+    const count = FunctionNode2.create("count", [
+      ValueNode2.createImmediate(1)
+    ]);
+    const predicateResult = match2(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode2.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).exhaustive();
+    return this.transform(expr2.left, {
+      ...context,
+      memberSelect: SelectionNode.create(AliasNode2.create(predicateResult, IdentifierNode.create("$t"))),
+      memberFilter: predicateFilter
+    });
+  }
+  ensureCollectionPredicateOperator(op) {
+    invariant2(CollectionPredicateOperator.includes(op), 'expected "?" or "!" or "^" operator');
+  }
+  transformValueCollectionPredicate(receiver, expr2, context) {
+    if (!receiver) {
+      return ValueNode2.createImmediate(null);
+    }
+    this.ensureCollectionPredicateOperator(expr2.op);
+    const visitor = new SchemaUtils.MatchingExpressionVisitor((e) => ExpressionUtils3.isThis(e));
+    if (!visitor.find(expr2.right)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth,
+        thisValue: context.contextValue
+      });
+      return this.transformValue(value, "Boolean");
+    } else {
+      invariant2(Array.isArray(receiver), "array value is expected");
+      const components = receiver.map((item) => this.transform(expr2.right, {
+        operation: context.operation,
+        thisType: context.thisType,
+        thisAlias: context.thisAlias,
+        modelOrType: context.modelOrType,
+        contextValue: item
+      }));
+      return match2(expr2.op).with("?", () => disjunction(this.dialect, components)).with("!", () => conjunction(this.dialect, components)).with("^", () => logicalNot(this.dialect, disjunction(this.dialect, components))).exhaustive();
+    }
+  }
+  getMemberType(receiverType, expr2) {
+    if (ExpressionUtils3.isField(expr2)) {
+      const fieldDef = QueryUtils.requireField(this.schema, receiverType, expr2.field);
+      return fieldDef.type;
+    } else {
+      let currType = receiverType;
+      for (const member of expr2.members) {
+        const fieldDef = QueryUtils.requireField(this.schema, currType, member);
+        currType = fieldDef.type;
+      }
+      return currType;
+    }
+  }
+  transformAuthBinary(expr2, context) {
+    if (expr2.op !== "==" && expr2.op !== "!=") {
+      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.modelOrType}": ${expr2.op}`);
+    }
+    let authExpr;
+    let other;
+    if (this.isAuthCall(expr2.left)) {
+      authExpr = expr2.left;
+      other = expr2.right;
+    } else {
+      authExpr = expr2.right;
+      other = expr2.left;
+    }
+    if (ExpressionUtils3.isNull(other)) {
+      return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
+    } else {
+      const authModel = QueryUtils.getModel(this.schema, this.authType);
+      if (!authModel) {
+        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.modelOrType}", comparing with \`auth()\` is only possible when auth type is a model`);
+      }
+      const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
+      invariant2(idFields.length > 0, "auth type model must have at least one id field");
+      const conditions = idFields.map((fieldName) => ExpressionUtils3.binary(ExpressionUtils3.member(authExpr, [
+        fieldName
+      ]), "==", this.makeOrAppendMember(other, fieldName)));
+      let result = this.buildAnd(conditions);
+      if (expr2.op === "!=") {
+        result = this.buildLogicalNot(result);
+      }
+      return this.transform(result, context);
+    }
+  }
+  makeOrAppendMember(other, fieldName) {
+    if (ExpressionUtils3.isMember(other)) {
+      return ExpressionUtils3.member(other.receiver, [
+        ...other.members,
+        fieldName
+      ]);
+    } else {
+      return ExpressionUtils3.member(other, [
+        fieldName
+      ]);
+    }
+  }
+  transformValue(value, type) {
+    if (value === true) {
+      return trueNode(this.dialect);
+    } else if (value === false) {
+      return falseNode(this.dialect);
+    } else {
+      const transformed = this.dialect.transformPrimitive(value, type, false) ?? null;
+      if (!Array.isArray(transformed)) {
+        return ValueNode2.createImmediate(transformed);
+      } else {
+        return ValueNode2.create(transformed);
+      }
+    }
+  }
+  _unary(expr2, context) {
+    invariant2(expr2.op === "!", 'only "!" operator is supported');
+    return logicalNot(this.dialect, this.transform(expr2.operand, context));
+  }
+  transformOperator(op) {
+    const mappedOp = match2(op).with("==", () => "=").otherwise(() => op);
+    return OperatorNode2.create(mappedOp);
+  }
+  _call(expr2, context) {
+    const result = this.transformCall(expr2, context);
+    return result.toOperationNode();
+  }
+  transformCall(expr2, context) {
+    const func = this.getFunctionImpl(expr2.function);
+    if (!func) {
+      throw createUnsupportedError(`Function not implemented: ${expr2.function}`);
+    }
+    const eb = expressionBuilder();
+    return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
+      client: this.client,
+      dialect: this.dialect,
+      model: context.modelOrType,
+      modelAlias: context.alias ?? context.modelOrType,
+      operation: context.operation
+    });
+  }
+  getFunctionImpl(functionName) {
+    let func = this.clientOptions.functions?.[functionName];
+    if (!func) {
+      for (const plugin of this.clientOptions.plugins ?? []) {
+        if (plugin.functions?.[functionName]) {
+          func = plugin.functions[functionName];
+          break;
+        }
+      }
+    }
+    return func;
+  }
+  transformCallArg(eb, arg, context) {
+    if (ExpressionUtils3.isLiteral(arg)) {
+      return eb.val(arg.value);
+    }
+    if (ExpressionUtils3.isField(arg)) {
+      return eb.ref(arg.field);
+    }
+    if (ExpressionUtils3.isCall(arg)) {
+      return this.transformCall(arg, context);
+    }
+    if (this.isAuthMember(arg)) {
+      const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
+      return valNode ? eb.val(valNode.value) : eb.val(null);
+    }
+    throw createUnsupportedError(`Unsupported argument expression: ${arg.kind}`);
+  }
+  _member(expr2, context) {
+    if (this.isAuthCall(expr2.receiver)) {
+      return this.valueMemberAccess(this.auth, expr2, this.authType);
+    }
+    if (isBeforeInvocation(expr2.receiver)) {
+      invariant2(context.operation === "post-update", "before() can only be used in post-update policy");
+      invariant2(expr2.members.length === 1, "before() can only be followed by a scalar field access");
+      return ReferenceNode2.create(ColumnNode2.create(expr2.members[0]), TableNode2.create("$before"));
+    }
+    invariant2(ExpressionUtils3.isField(expr2.receiver) || ExpressionUtils3.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    let members = expr2.members;
+    let receiver;
+    const { memberFilter, memberSelect, ...restContext } = context;
+    if (ExpressionUtils3.isThis(expr2.receiver)) {
+      if (expr2.members.length === 1) {
+        return this._field(ExpressionUtils3.field(expr2.members[0]), {
+          ...context,
+          alias: context.thisAlias,
+          modelOrType: context.thisType,
+          thisType: context.thisType,
+          contextValue: void 0
+        });
+      } else {
+        const firstMemberFieldDef = QueryUtils.requireField(this.schema, context.thisType, expr2.members[0]);
+        receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
+        members = expr2.members.slice(1);
+      }
+    } else {
+      receiver = this.transform(expr2.receiver, restContext);
+    }
+    invariant2(SelectQueryNode.is(receiver), "expected receiver to be select query");
+    let startType;
+    if (ExpressionUtils3.isField(expr2.receiver)) {
+      const receiverField = QueryUtils.requireField(this.schema, context.modelOrType, expr2.receiver.field);
+      startType = receiverField.type;
+    } else {
+      startType = context.thisType;
+    }
+    const memberFields = [];
+    let currType = startType;
+    for (const member of members) {
+      const fieldDef = QueryUtils.requireField(this.schema, currType, member);
+      memberFields.push({
+        fieldDef,
+        fromModel: currType
+      });
+      currType = fieldDef.type;
+    }
+    let currNode = void 0;
+    for (let i = members.length - 1; i >= 0; i--) {
+      const member = members[i];
+      const { fieldDef, fromModel } = memberFields[i];
+      if (fieldDef.relation) {
+        const relation = this.transformRelationAccess(member, fieldDef.type, {
+          ...restContext,
+          modelOrType: fromModel,
+          alias: void 0
+        });
+        if (currNode) {
+          currNode = {
+            ...relation,
+            selections: [
+              SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create(members[i + 1])))
+            ]
+          };
+        } else {
+          currNode = {
+            ...relation,
+            where: this.mergeWhere(relation.where, memberFilter),
+            selections: memberSelect ? [
+              memberSelect
+            ] : relation.selections
+          };
+        }
+      } else {
+        invariant2(i === members.length - 1, "plain field access must be the last segment");
+        invariant2(!currNode, "plain field access must be the last segment");
+        currNode = ColumnNode2.create(member);
+      }
+    }
+    return {
+      ...receiver,
+      selections: [
+        SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create("$t")))
+      ]
+    };
+  }
+  valueMemberAccess(receiver, expr2, receiverType) {
+    if (!receiver) {
+      return ValueNode2.createImmediate(null);
+    }
+    invariant2(expr2.members.length > 0, "member expression must have at least one member");
+    let curr = receiver;
+    let currType = receiverType;
+    for (let i = 0; i < expr2.members.length; i++) {
+      const field = expr2.members[i];
+      curr = curr?.[field];
+      if (curr === void 0) {
+        curr = ValueNode2.createImmediate(null);
+        break;
+      }
+      currType = QueryUtils.requireField(this.schema, currType, field).type;
+      if (i === expr2.members.length - 1) {
+        curr = this.transformValue(curr, currType);
+      }
+    }
+    return curr;
+  }
+  transformRelationAccess(field, relationModel, context) {
+    const m2m = QueryUtils.getManyToManyRelation(this.schema, context.modelOrType, field);
+    if (m2m) {
+      return this.transformManyToManyRelationAccess(m2m, context);
+    }
+    const fromModel = context.modelOrType;
+    const relationFieldDef = QueryUtils.requireField(this.schema, fromModel, field);
+    const { keyPairs, ownedByModel } = QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
+    let condition;
+    if (ownedByModel) {
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => {
+        let fkRef = ReferenceNode2.create(ColumnNode2.create(fk), TableNode2.create(context.alias ?? fromModel));
+        if (relationFieldDef.originModel && relationFieldDef.originModel !== fromModel) {
+          fkRef = this.buildDelegateBaseFieldSelect(fromModel, context.alias ?? fromModel, fk, relationFieldDef.originModel);
+        }
+        return BinaryOperationNode2.create(fkRef, OperatorNode2.create("="), ReferenceNode2.create(ColumnNode2.create(pk), TableNode2.create(relationModel)));
+      }));
+    } else {
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode2.create(pk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode2.create(fk), TableNode2.create(relationModel)))));
+    }
+    return {
+      kind: "SelectQueryNode",
+      from: FromNode.create([
+        TableNode2.create(relationModel)
+      ]),
+      where: WhereNode.create(condition)
+    };
+  }
+  transformManyToManyRelationAccess(m2m, context) {
+    const eb = expressionBuilder();
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.modelOrType}.${m2m.parentPKName}`));
+    return relationQuery.toOperationNode();
+  }
+  createColumnRef(column, context) {
+    const tableName = context.alias ?? context.modelOrType;
+    if (context.operation === "create") {
+      return ReferenceNode2.create(ColumnNode2.create(column), TableNode2.create(tableName));
+    }
+    const fieldDef = QueryUtils.requireField(this.schema, context.modelOrType, column);
+    if (!fieldDef.originModel || fieldDef.originModel === context.modelOrType) {
+      return ReferenceNode2.create(ColumnNode2.create(column), TableNode2.create(tableName));
+    }
+    return this.buildDelegateBaseFieldSelect(context.modelOrType, tableName, column, fieldDef.originModel);
+  }
+  buildDelegateBaseFieldSelect(model, modelAlias, field, baseModel) {
+    const idFields = QueryUtils.requireIdFields(this.client.$schema, model);
+    return {
+      kind: "SelectQueryNode",
+      from: FromNode.create([
+        TableNode2.create(baseModel)
+      ]),
+      selections: [
+        SelectionNode.create(ReferenceNode2.create(ColumnNode2.create(field), TableNode2.create(baseModel)))
+      ],
+      where: WhereNode.create(conjunction(this.dialect, idFields.map((idField) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode2.create(idField), TableNode2.create(baseModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode2.create(idField), TableNode2.create(modelAlias))))))
+    };
+  }
+  isAuthCall(value) {
+    return ExpressionUtils3.isCall(value) && value.function === "auth";
+  }
+  isAuthMember(expr2) {
+    return ExpressionUtils3.isMember(expr2) && this.isAuthCall(expr2.receiver);
+  }
+  isNullNode(node) {
+    return ValueNode2.is(node) && node.value === null;
+  }
+  buildLogicalNot(result) {
+    return ExpressionUtils3.unary("!", result);
+  }
+  buildAnd(conditions) {
+    if (conditions.length === 0) {
+      return ExpressionUtils3.literal(true);
+    } else if (conditions.length === 1) {
+      return conditions[0];
+    } else {
+      return conditions.reduce((acc, condition) => ExpressionUtils3.binary(acc, "&&", condition));
+    }
+  }
+  isRelationField(expr2, model) {
+    const fieldDef = this.getFieldDefFromFieldRef(expr2, model);
+    return !!fieldDef?.relation;
+  }
+  getFieldDefFromFieldRef(expr2, model) {
+    if (ExpressionUtils3.isField(expr2)) {
+      return QueryUtils.getField(this.schema, model, expr2.field);
+    } else if (ExpressionUtils3.isMember(expr2) && expr2.members.length === 1 && ExpressionUtils3.isThis(expr2.receiver)) {
+      return QueryUtils.getField(this.schema, model, expr2.members[0]);
+    } else {
+      return void 0;
+    }
+  }
+};
+_ts_decorate([
+  expr("literal"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof LiteralExpression === "undefined" ? Object : LiteralExpression
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_literal", null);
+_ts_decorate([
+  expr("array"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof ArrayExpression === "undefined" ? Object : ArrayExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_array", null);
+_ts_decorate([
+  expr("field"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FieldExpression === "undefined" ? Object : FieldExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_field", null);
+_ts_decorate([
+  expr("null"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", []),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_null", null);
+_ts_decorate([
+  expr("binary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof BinaryExpression === "undefined" ? Object : BinaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_binary", null);
+_ts_decorate([
+  expr("unary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof UnaryExpression === "undefined" ? Object : UnaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_unary", null);
+_ts_decorate([
+  expr("call"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof CallExpression === "undefined" ? Object : CallExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_call", null);
+_ts_decorate([
+  expr("member"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof MemberExpression === "undefined" ? Object : MemberExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_member", null);
+
+// src/policy-handler.ts
+var PolicyHandler = class extends OperationNodeTransformer {
+  static {
+    __name(this, "PolicyHandler");
+  }
+  client;
+  dialect;
+  constructor(client) {
+    super(), this.client = client;
+    this.dialect = getCrudDialect2(this.client.$schema, this.client.$options);
+  }
+  get kysely() {
+    return this.client.$qb;
+  }
+  // #region main entry point
+  async handle(node, proceed) {
+    if (!this.isCrudQueryNode(node)) {
+      throw createRejectedByPolicyError(void 0, RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
+    }
+    if (!this.isMutationQueryNode(node)) {
+      return proceed(this.transformNode(node));
+    }
+    const { mutationModel } = this.getMutationModel(node);
+    this.tryRejectNonexistentModel(mutationModel);
+    if (InsertQueryNode.is(node)) {
+      await this.preCreateCheck(mutationModel, node, proceed);
+    }
+    if (UpdateQueryNode.is(node)) {
+      await this.preUpdateCheck(mutationModel, node, proceed);
+    }
+    const hasPostUpdatePolicies = UpdateQueryNode.is(node) && this.hasPostUpdatePolicies(mutationModel);
+    let beforeUpdateInfo;
+    if (hasPostUpdatePolicies) {
+      beforeUpdateInfo = await this.loadBeforeUpdateEntities(mutationModel, node.where, proceed);
+    }
+    const result = await proceed(this.transformNode(node));
+    if (hasPostUpdatePolicies && result.rows.length > 0) {
+      if (beforeUpdateInfo) {
+        invariant3(beforeUpdateInfo.rows.length === result.rows.length);
+        const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+        for (const postRow of result.rows) {
+          const beforeRow = beforeUpdateInfo.rows.find((r) => idFields.every((f) => r[f] === postRow[f]));
+          if (!beforeRow) {
+            throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.OTHER, "Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
+          }
+        }
+      }
+      const idConditions = this.buildIdConditions(mutationModel, result.rows);
+      const postUpdateFilter = this.buildPolicyFilter(mutationModel, void 0, "post-update");
+      const eb = expressionBuilder2();
+      const beforeUpdateTable = beforeUpdateInfo ? {
+        kind: "SelectQueryNode",
+        from: FromNode2.create([
+          ParensNode2.create(ValuesNode.create(beforeUpdateInfo.rows.map((r) => PrimitiveValueListNode.create(beforeUpdateInfo.fields.map((f) => r[f])))))
+        ]),
+        selections: beforeUpdateInfo.fields.map((name, index) => {
+          const def = QueryUtils2.requireField(this.client.$schema, mutationModel, name);
+          const castedColumnRef = sql`CAST(${eb.ref(`column${index + 1}`)} as ${sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+          return SelectionNode2.create(castedColumnRef.toOperationNode());
+        })
+      } : void 0;
+      const postUpdateQuery = eb.selectFrom(mutationModel).select(() => [
+        eb(eb.fn("COUNT", [
+          eb.lit(1)
+        ]), "=", result.rows.length).as("$condition")
+      ]).where(() => new ExpressionWrapper(conjunction(this.dialect, [
+        idConditions,
+        postUpdateFilter
+      ]))).$if(!!beforeUpdateInfo, (qb) => qb.leftJoin(() => new ExpressionWrapper(beforeUpdateTable).as("$before"), (join) => {
+        const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+        return idFields.reduce((acc, f) => acc.onRef(`${mutationModel}.${f}`, "=", `$before.${f}`), join);
+      }));
+      const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
+      if (!postUpdateResult.rows[0]?.$condition) {
+        throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+      }
+    }
+    if (!node.returning || this.onlyReturningId(node)) {
+      return this.postProcessMutationResult(result, node);
+    } else {
+      const readBackResult = await this.processReadBack(node, result, proceed);
+      if (readBackResult.rows.length !== result.rows.length) {
+        throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+      }
+      return readBackResult;
+    }
+  }
+  async preCreateCheck(mutationModel, node, proceed) {
+    const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
+    let needCheckPreCreate = true;
+    if (!isManyToManyJoinTable) {
+      const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
+      if (constCondition === true) {
+        needCheckPreCreate = false;
+      } else if (constCondition === false) {
+        throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS);
+      }
+    }
+    if (needCheckPreCreate) {
+      await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
+    }
+  }
+  async preUpdateCheck(mutationModel, node, proceed) {
+    const fieldsToUpdate = node.updates?.map((u) => ColumnNode3.is(u.column) ? u.column.column.name : void 0).filter((f) => !!f) ?? [];
+    const fieldUpdatePolicies = fieldsToUpdate.map((f) => this.buildFieldPolicyFilter(mutationModel, f, "update"));
+    const fieldLevelFilter = conjunction(this.dialect, fieldUpdatePolicies);
+    if (isTrueNode(fieldLevelFilter)) {
+      return;
+    }
+    const modelLevelFilter = this.buildPolicyFilter(mutationModel, void 0, "update");
+    const updateFilter = conjunction(this.dialect, [
+      modelLevelFilter,
+      node.where?.where ?? trueNode(this.dialect)
+    ]);
+    const preUpdateCheckQuery = expressionBuilder2().selectFrom(mutationModel).select((eb) => eb.fn.coalesce(eb.fn.sum(eb.cast(new ExpressionWrapper(logicalNot(this.dialect, fieldLevelFilter)), "integer")), eb.lit(0)).as("$filteredCount")).where(() => new ExpressionWrapper(updateFilter));
+    const preUpdateResult = await proceed(preUpdateCheckQuery.toOperationNode());
+    if (preUpdateResult.rows[0].$filteredCount > 0) {
+      throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some rows cannot be updated due to field policies");
+    }
+  }
+  // #endregion
+  // #region Transformations
+  transformSelectQuery(node) {
+    if (!node.from) {
+      return super.transformSelectQuery(node);
+    }
+    this.tryRejectNonexistingTables(node.from.froms);
+    let result = super.transformSelectQuery(node);
+    const hasFieldLevelPolicies = node.from.froms.some((table) => {
+      const extractedTable = this.extractTableName(table);
+      if (extractedTable) {
+        return this.hasFieldLevelPolicies(extractedTable.model, "read");
+      } else {
+        return false;
+      }
+    });
+    if (hasFieldLevelPolicies) {
+      const updatedFroms = [];
+      for (const table of result.from.froms) {
+        const extractedTable = this.extractTableName(table);
+        if (extractedTable?.model && QueryUtils2.getModel(this.client.$schema, extractedTable.model)) {
+          const { query } = this.createSelectAllFieldsWithPolicies(extractedTable.model, extractedTable.alias, "read");
+          updatedFroms.push(query);
+        } else {
+          updatedFroms.push(table);
+        }
+      }
+      result = {
+        ...result,
+        from: FromNode2.create(updatedFroms)
+      };
+    } else {
+      let whereNode = result.where;
+      const policyFilter = this.createPolicyFilterForFrom(result.from);
+      if (policyFilter && !isTrueNode(policyFilter)) {
+        whereNode = WhereNode2.create(whereNode?.where ? conjunction(this.dialect, [
+          whereNode.where,
+          policyFilter
+        ]) : policyFilter);
+      }
+      result = {
+        ...result,
+        where: whereNode
+      };
+    }
+    return result;
+  }
+  transformJoin(node) {
+    const table = this.extractTableName(node.table);
+    if (!table) {
+      return super.transformJoin(node);
+    }
+    this.tryRejectNonexistentModel(table.model);
+    if (!QueryUtils2.getModel(this.client.$schema, table.model)) {
+      return super.transformJoin(node);
+    }
+    const result = super.transformJoin(node);
+    const { hasPolicies, query: nestedQuery } = this.createSelectAllFieldsWithPolicies(table.model, table.alias, "read");
+    if (!hasPolicies) {
+      return result;
+    }
+    return {
+      ...result,
+      table: nestedQuery
+    };
+  }
+  transformInsertQuery(node) {
+    let onConflict = node.onConflict;
+    if (onConflict?.updates) {
+      const { mutationModel, alias } = this.getMutationModel(node);
+      const filter = this.buildPolicyFilter(mutationModel, alias, "update");
+      if (onConflict.updateWhere) {
+        onConflict = {
+          ...onConflict,
+          updateWhere: WhereNode2.create(conjunction(this.dialect, [
+            onConflict.updateWhere.where,
+            filter
+          ]))
+        };
+      } else {
+        onConflict = {
+          ...onConflict,
+          updateWhere: WhereNode2.create(filter)
+        };
+      }
+    }
+    const processedNode = onConflict ? {
+      ...node,
+      onConflict
+    } : node;
+    const result = super.transformInsertQuery(processedNode);
+    let returning = result.returning;
+    if (returning) {
+      const { mutationModel } = this.getMutationModel(node);
+      const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+      returning = ReturningNode.create(idFields.map((f) => SelectionNode2.create(ColumnNode3.create(f))));
+    }
+    return {
+      ...result,
+      returning
+    };
+  }
+  transformUpdateQuery(node) {
+    const result = super.transformUpdateQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "update");
+    if (node.from) {
+      this.tryRejectNonexistingTables(node.from.froms);
+      const joinFilter = this.createPolicyFilterForFrom(node.from);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    let returning = result.returning;
+    if (returning || this.hasPostUpdatePolicies(mutationModel)) {
+      const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+      returning = ReturningNode.create(idFields.map((f) => SelectionNode2.create(ColumnNode3.create(f))));
+    }
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter),
+      returning
+    };
+  }
+  transformDeleteQuery(node) {
+    const result = super.transformDeleteQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "delete");
+    if (node.using) {
+      this.tryRejectNonexistingTables(node.using.tables);
+      const joinFilter = this.createPolicyFilterForTables(node.using.tables);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  // #endregion
+  // #region post-update
+  async loadBeforeUpdateEntities(model, where, proceed) {
+    const beforeUpdateAccessFields = this.getFieldsAccessForBeforeUpdatePolicies(model);
+    if (!beforeUpdateAccessFields || beforeUpdateAccessFields.length === 0) {
+      return void 0;
+    }
+    const policyFilter = this.buildPolicyFilter(model, model, "update");
+    const combinedFilter = where ? conjunction(this.dialect, [
+      where.where,
+      policyFilter
+    ]) : policyFilter;
+    const query = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        TableNode3.create(model)
+      ]),
+      where: WhereNode2.create(combinedFilter),
+      selections: [
+        ...beforeUpdateAccessFields.map((f) => SelectionNode2.create(ColumnNode3.create(f)))
+      ]
+    };
+    const result = await proceed(query);
+    return {
+      fields: beforeUpdateAccessFields,
+      rows: result.rows
+    };
+  }
+  getFieldsAccessForBeforeUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    if (policies.length === 0) {
+      return void 0;
+    }
+    const fields = /* @__PURE__ */ new Set();
+    const fieldCollector = new class extends SchemaUtils2.ExpressionVisitor {
+      visitMember(e) {
+        if (isBeforeInvocation(e.receiver)) {
+          invariant3(e.members.length === 1, "before() can only be followed by a scalar field access");
+          fields.add(e.members[0]);
+        }
+        super.visitMember(e);
+      }
+    }();
+    for (const policy of policies) {
+      fieldCollector.visit(policy.condition);
+    }
+    if (fields.size === 0) {
+      return void 0;
+    }
+    QueryUtils2.requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
+    return Array.from(fields).sort();
+  }
+  hasPostUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    return policies.length > 0;
+  }
+  // #endregion
+  // #region field-level policies
+  createSelectAllFieldsWithPolicies(model, alias, operation) {
+    let hasPolicies = false;
+    const modelDef = QueryUtils2.requireModel(this.client.$schema, model);
+    let selections = [];
+    for (const fieldDef of Object.values(modelDef.fields).filter(
+      // exclude relation/computed/inherited fields
+      (f) => !f.relation && !f.computed && !f.originModel
+    )) {
+      const { hasPolicies: fieldHasPolicies, selection } = this.createFieldSelectionWithPolicy(model, fieldDef.name, operation);
+      hasPolicies = hasPolicies || fieldHasPolicies;
+      selections.push(selection);
+    }
+    if (!hasPolicies) {
+      selections = [
+        SelectionNode2.create(SelectAllNode.create())
+      ];
+    }
+    const modelPolicyFilter = this.buildPolicyFilter(model, alias, operation);
+    if (!isTrueNode(modelPolicyFilter)) {
+      hasPolicies = true;
+    }
+    const nestedQuery = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        TableNode3.create(model)
+      ]),
+      where: isTrueNode(modelPolicyFilter) ? void 0 : WhereNode2.create(modelPolicyFilter),
+      selections
+    };
+    return {
+      hasPolicies,
+      query: AliasNode3.create(ParensNode2.create(nestedQuery), IdentifierNode2.create(alias ?? model))
+    };
+  }
+  createFieldSelectionWithPolicy(model, field, operation) {
+    const filter = this.buildFieldPolicyFilter(model, field, operation);
+    if (isTrueNode(filter)) {
+      return {
+        hasPolicies: false,
+        selection: SelectionNode2.create(ColumnNode3.create(field))
+      };
+    }
+    const eb = expressionBuilder2();
+    const selection = eb.case().when(new ExpressionWrapper(filter)).then(eb.ref(field)).else(null).end().as(field).toOperationNode();
+    return {
+      hasPolicies: true,
+      selection: SelectionNode2.create(selection)
+    };
+  }
+  hasFieldLevelPolicies(model, operation) {
+    const modelDef = QueryUtils2.getModel(this.client.$schema, model);
+    if (!modelDef) {
+      return false;
+    }
+    return Object.keys(modelDef.fields).some((field) => this.getFieldPolicies(model, field, operation).length > 0);
+  }
+  buildFieldPolicyFilter(model, field, operation) {
+    const policies = this.getFieldPolicies(model, field, operation);
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, model, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, model, operation, policy));
+    let combinedPolicy;
+    if (allows.length === 0) {
+      combinedPolicy = trueNode(this.dialect);
+    } else {
+      combinedPolicy = disjunction(this.dialect, allows);
+    }
+    if (denies.length !== 0) {
+      const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+      combinedPolicy = conjunction(this.dialect, [
+        combinedPolicy,
+        combinedDenies
+      ]);
+    }
+    return combinedPolicy;
+  }
+  // #endregion
+  // #region helpers
+  onlyReturningId(node) {
+    if (!node.returning) {
+      return true;
+    }
+    const { mutationModel } = this.getMutationModel(node);
+    const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+    if (node.returning.selections.some((s) => SelectAllNode.is(s.selection))) {
+      const modelDef = QueryUtils2.requireModel(this.client.$schema, mutationModel);
+      if (Object.keys(modelDef.fields).some((f) => !idFields.includes(f))) {
+        return false;
+      } else {
+        return true;
+      }
+    }
+    const collector = new ColumnCollector();
+    const selectedColumns = collector.collect(node.returning);
+    return selectedColumns.every((c) => idFields.includes(c));
+  }
+  async enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed) {
+    const fields = node.columns?.map((c) => c.column.name) ?? [];
+    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, mutationModel, fields, isManyToManyJoinTable) : [
+      []
+    ];
+    for (const values of valueRows) {
+      if (isManyToManyJoinTable) {
+        await this.enforcePreCreatePolicyForManyToManyJoinTable(mutationModel, fields, values.map((v) => v.node), proceed);
+      } else {
+        await this.enforcePreCreatePolicyForOne(mutationModel, fields, values.map((v) => v.node), proceed);
+      }
+    }
+  }
+  async enforcePreCreatePolicyForManyToManyJoinTable(tableName, fields, values, proceed) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    invariant3(m2m);
+    invariant3(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
+    const aIndex = fields.indexOf("A");
+    const aNode = values[aIndex];
+    const bIndex = fields.indexOf("B");
+    const bNode = values[bIndex];
+    invariant3(ValueNode3.is(aNode) && ValueNode3.is(bNode), "A and B values must be ValueNode");
+    const aValue = aNode.value;
+    const bValue = bNode.value;
+    invariant3(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
+    invariant3(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
+    const eb = expressionBuilder2();
+    const filterA = this.buildPolicyFilter(m2m.firstModel, void 0, "update");
+    const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new ExpressionWrapper(filterA).as("$t"));
+    const filterB = this.buildPolicyFilter(m2m.secondModel, void 0, "update");
+    const queryB = eb.selectFrom(m2m.secondModel).where(eb(eb.ref(`${m2m.secondModel}.${m2m.secondIdField}`), "=", bValue)).select(() => new ExpressionWrapper(filterB).as("$t"));
+    const queryNode = {
+      kind: "SelectQueryNode",
+      selections: [
+        SelectionNode2.create(AliasNode3.create(queryA.toOperationNode(), IdentifierNode2.create("$conditionA"))),
+        SelectionNode2.create(AliasNode3.create(queryB.toOperationNode(), IdentifierNode2.create("$conditionB")))
+      ]
+    };
+    const result = await proceed(queryNode);
+    if (!result.rows[0]?.$conditionA) {
+      throw createRejectedByPolicyError(m2m.firstModel, RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+    }
+    if (!result.rows[0]?.$conditionB) {
+      throw createRejectedByPolicyError(m2m.secondModel, RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
+    }
+  }
+  async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
+    const allFields = Object.entries(QueryUtils2.requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
+    const allValues = [];
+    for (const [name, _def] of allFields) {
+      const index = fields.indexOf(name);
+      if (index >= 0) {
+        allValues.push(values[index]);
+      } else {
+        allValues.push(ValueNode3.createImmediate(null));
+      }
+    }
+    const eb = expressionBuilder2();
+    const constTable = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        AliasNode3.create(ParensNode2.create(ValuesNode.create([
+          ValueListNode2.create(allValues)
+        ])), IdentifierNode2.create("$t"))
+      ]),
+      selections: allFields.map(([name, def], index) => {
+        const castedColumnRef = sql`CAST(${eb.ref(`column${index + 1}`)} as ${sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+        return SelectionNode2.create(castedColumnRef.toOperationNode());
+      })
+    };
+    const filter = this.buildPolicyFilter(model, void 0, "create");
+    const preCreateCheck = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        AliasNode3.create(constTable, IdentifierNode2.create(model))
+      ]),
+      selections: [
+        SelectionNode2.create(AliasNode3.create(BinaryOperationNode3.create(FunctionNode3.create("COUNT", [
+          ValueNode3.createImmediate(1)
+        ]), OperatorNode3.create(">"), ValueNode3.createImmediate(0)), IdentifierNode2.create("$condition")))
+      ],
+      where: WhereNode2.create(filter)
+    };
+    const result = await proceed(preCreateCheck);
+    if (!result.rows[0]?.$condition) {
+      throw createRejectedByPolicyError(model, RejectedByPolicyReason.NO_ACCESS);
+    }
+  }
+  unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
+    if (ValuesNode.is(node)) {
+      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields, isManyToManyJoinTable));
+    } else if (PrimitiveValueListNode.is(node)) {
+      return [
+        this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
+      ];
+    } else {
+      invariant3(false, `Unexpected node kind: ${node.kind} for unwrapping create values`);
+    }
+  }
+  unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
+    invariant3(data.length === fields.length, "data length must match fields length");
+    const result = [];
+    for (let i = 0; i < data.length; i++) {
+      const item = data[i];
+      if (typeof item === "object" && item && "kind" in item) {
+        const fieldDef = QueryUtils2.requireField(this.client.$schema, model, fields[i]);
+        invariant3(item.kind === "ValueNode", "expecting a ValueNode");
+        result.push({
+          node: ValueNode3.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
+          raw: item.value
+        });
+      } else {
+        let value = item;
+        if (!isImplicitManyToManyJoinTable) {
+          const fieldDef = QueryUtils2.requireField(this.client.$schema, model, fields[i]);
+          value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        }
+        if (Array.isArray(value)) {
+          result.push({
+            node: RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
+            raw: value
+          });
+        } else {
+          result.push({
+            node: ValueNode3.create(value),
+            raw: value
+          });
+        }
+      }
+    }
+    return result;
+  }
+  tryGetConstantPolicy(model, operation) {
+    const policies = this.getModelPolicies(model, operation);
+    if (!policies.some((p) => p.kind === "allow")) {
+      return false;
+    } else if (
+      // unconditional deny
+      policies.some((p) => p.kind === "deny" && this.isTrueExpr(p.condition))
+    ) {
+      return false;
+    } else if (
+      // unconditional allow
+      !policies.some((p) => p.kind === "deny") && policies.some((p) => p.kind === "allow" && this.isTrueExpr(p.condition))
+    ) {
+      return true;
+    } else {
+      return void 0;
+    }
+  }
+  isTrueExpr(expr2) {
+    return ExpressionUtils4.isLiteral(expr2) && expr2.value === true;
+  }
+  async processReadBack(node, result, proceed) {
+    if (result.rows.length === 0) {
+      return result;
+    }
+    if (!this.isMutationQueryNode(node) || !node.returning) {
+      return result;
+    }
+    const { mutationModel } = this.getMutationModel(node);
+    const idConditions = this.buildIdConditions(mutationModel, result.rows);
+    const policyFilter = this.buildPolicyFilter(mutationModel, void 0, "read");
+    const select = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        TableNode3.create(mutationModel)
+      ]),
+      where: WhereNode2.create(conjunction(this.dialect, [
+        idConditions,
+        policyFilter
+      ])),
+      selections: node.returning.selections
+    };
+    const selectResult = await proceed(select);
+    return selectResult;
+  }
+  buildIdConditions(table, rows) {
+    const idFields = QueryUtils2.requireIdFields(this.client.$schema, table);
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ReferenceNode3.create(ColumnNode3.create(field), TableNode3.create(table)), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
+  }
+  getMutationModel(node) {
+    const r = match3(node).when(InsertQueryNode.is, (node2) => ({
+      mutationModel: getTableName(node2.into),
+      alias: void 0
+    })).when(UpdateQueryNode.is, (node2) => {
+      if (!node2.table) {
+        invariant3(false, "Update query must have a table");
+      }
+      const r2 = this.extractTableName(node2.table);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
+    }).when(DeleteQueryNode.is, (node2) => {
+      if (node2.from.froms.length !== 1) {
+        throw createUnsupportedError("Only one from table is supported for delete");
+      }
+      const r2 = this.extractTableName(node2.from.froms[0]);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
+    }).exhaustive();
+    if (!r) {
+      invariant3(false, `Unable to get table name for query node: ${node}`);
+    }
+    return r;
+  }
+  isCrudQueryNode(node) {
+    return SelectQueryNode2.is(node) || InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+  }
+  isMutationQueryNode(node) {
+    return InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+  }
+  buildPolicyFilter(model, alias, operation) {
+    const m2mFilter = this.getModelPolicyFilterForManyToManyJoinTable(model, alias, operation);
+    if (m2mFilter) {
+      return m2mFilter;
+    }
+    const policies = this.getModelPolicies(model, operation);
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    let combinedPolicy;
+    if (allows.length === 0) {
+      if (operation === "post-update") {
+        combinedPolicy = trueNode(this.dialect);
+      } else {
+        combinedPolicy = falseNode(this.dialect);
+      }
+    } else {
+      combinedPolicy = disjunction(this.dialect, allows);
+    }
+    if (denies.length !== 0) {
+      const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+      combinedPolicy = conjunction(this.dialect, [
+        combinedPolicy,
+        combinedDenies
+      ]);
+    }
+    return combinedPolicy;
+  }
+  extractTableName(node) {
+    if (TableNode3.is(node)) {
+      return {
+        model: node.table.identifier.name
+      };
+    }
+    if (AliasNode3.is(node)) {
+      const inner = this.extractTableName(node.node);
+      if (!inner) {
+        return void 0;
+      }
+      return {
+        model: inner.model,
+        alias: IdentifierNode2.is(node.alias) ? node.alias.name : void 0
+      };
+    } else {
+      return void 0;
+    }
+  }
+  createPolicyFilterForFrom(node) {
+    if (!node) {
+      return void 0;
+    }
+    return this.createPolicyFilterForTables(node.froms);
+  }
+  createPolicyFilterForTables(tables) {
+    return tables.reduce((acc, table) => {
+      const extractResult = this.extractTableName(table);
+      if (extractResult) {
+        const { model, alias } = extractResult;
+        const filter = this.buildPolicyFilter(model, alias, "read");
+        return acc ? conjunction(this.dialect, [
+          acc,
+          filter
+        ]) : filter;
+      }
+      return acc;
+    }, void 0);
+  }
+  compilePolicyCondition(model, alias, operation, policy) {
+    return new ExpressionTransformer(this.client).transform(policy.condition, {
+      modelOrType: model,
+      thisType: model,
+      thisAlias: alias,
+      alias,
+      operation
+    });
+  }
+  getModelPolicies(model, operation) {
+    const modelDef = QueryUtils2.requireModel(this.client.$schema, model);
+    const result = [];
+    const extractOperations = /* @__PURE__ */ __name((expr2) => {
+      invariant3(ExpressionUtils4.isLiteral(expr2), "expecting a literal");
+      invariant3(typeof expr2.value === "string", "expecting a string literal");
+      return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
+    }, "extractOperations");
+    if (modelDef.attributes) {
+      result.push(...modelDef.attributes.filter((attr) => attr.name === "@@allow" || attr.name === "@@deny").map((attr) => ({
+        kind: attr.name === "@@allow" ? "allow" : "deny",
+        operations: extractOperations(attr.args[0].value),
+        condition: attr.args[1].value
+      })).filter((policy) => operation !== "post-update" && policy.operations.includes("all") || policy.operations.includes(operation)));
+    }
+    return result;
+  }
+  getFieldPolicies(model, field, operation) {
+    const fieldDef = QueryUtils2.requireField(this.client.$schema, model, field);
+    const result = [];
+    const extractOperations = /* @__PURE__ */ __name((expr2) => {
+      invariant3(ExpressionUtils4.isLiteral(expr2), "expecting a literal");
+      invariant3(typeof expr2.value === "string", "expecting a string literal");
+      return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
+    }, "extractOperations");
+    if (fieldDef.attributes) {
+      result.push(...fieldDef.attributes.filter((attr) => attr.name === "@allow" || attr.name === "@deny").map((attr) => ({
+        kind: attr.name === "@allow" ? "allow" : "deny",
+        operations: extractOperations(attr.args[0].value),
+        condition: attr.args[1].value
+      })).filter((policy) => policy.operations.includes("all") || policy.operations.includes(operation)));
+    }
+    return result;
+  }
+  resolveManyToManyJoinTable(tableName) {
+    for (const model of Object.values(this.client.$schema.models)) {
+      for (const field of Object.values(model.fields)) {
+        const m2m = QueryUtils2.getManyToManyRelation(this.client.$schema, model.name, field.name);
+        if (m2m?.joinTable === tableName) {
+          const sortedRecord = [
+            {
+              model: model.name,
+              field: field.name
+            },
+            {
+              model: m2m.otherModel,
+              field: m2m.otherField
+            }
+          ].sort(this.manyToManySorter);
+          const firstIdFields = QueryUtils2.requireIdFields(this.client.$schema, sortedRecord[0].model);
+          const secondIdFields = QueryUtils2.requireIdFields(this.client.$schema, sortedRecord[1].model);
+          invariant3(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
+          return {
+            firstModel: sortedRecord[0].model,
+            firstField: sortedRecord[0].field,
+            firstIdField: firstIdFields[0],
+            secondModel: sortedRecord[1].model,
+            secondField: sortedRecord[1].field,
+            secondIdField: secondIdFields[0]
+          };
+        }
+      }
+    }
+    return void 0;
+  }
+  manyToManySorter(a, b) {
+    return a.model !== b.model ? a.model.localeCompare(b.model) : a.field.localeCompare(b.field);
+  }
+  isManyToManyJoinTable(tableName) {
+    return !!this.resolveManyToManyJoinTable(tableName);
+  }
+  getModelPolicyFilterForManyToManyJoinTable(tableName, alias, operation) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    if (!m2m) {
+      return void 0;
+    }
+    const checkForOperation = operation === "read" ? "read" : "update";
+    const eb = expressionBuilder2();
+    const joinTable = alias ?? tableName;
+    const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
+    const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
+    return eb.and([
+      aQuery,
+      bQuery
+    ]).toOperationNode();
+  }
+  tryRejectNonexistentModel(model) {
+    if (!QueryUtils2.hasModel(this.client.$schema, model) && !this.isManyToManyJoinTable(model)) {
+      throw createRejectedByPolicyError(model, RejectedByPolicyReason.NO_ACCESS);
+    }
+  }
+  tryRejectNonexistingTables(tables) {
+    for (const table of tables) {
+      const extractResult = this.extractTableName(table);
+      if (extractResult) {
+        this.tryRejectNonexistentModel(extractResult.model);
+      }
+    }
+  }
+  // correction to kysely mutation result may be needed because we might have added
+  // returning clause to the query and caused changes to the result shape
+  postProcessMutationResult(result, node) {
+    if (node.returning) {
+      return result;
+    } else {
+      return {
+        ...result,
+        rows: [],
+        numAffectedRows: result.numAffectedRows ?? BigInt(result.rows.length)
+      };
+    }
+  }
+};
+
+// src/functions.ts
+var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, operation }) => {
+  invariant4(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
+  const arg1Node = args[0].toOperationNode();
+  const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
+  if (arg2Node) {
+    invariant4(ValueNode4.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
+    invariant4(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+  }
+  const fieldName = QueryUtils3.extractFieldName(arg1Node);
+  invariant4(fieldName, 'Failed to extract field name from the first argument of "check" function');
+  const fieldDef = QueryUtils3.requireField(client.$schema, model, fieldName);
+  invariant4(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
+  invariant4(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
+  const relationModel = fieldDef.type;
+  const joinConditions = [];
+  const fkInfo = QueryUtils3.getRelationForeignKeyFieldPairs(client.$schema, model, fieldName);
+  const idFields = QueryUtils3.requireIdFields(client.$schema, model);
+  const buildBaseSelect = /* @__PURE__ */ __name((baseModel, field) => {
+    return eb.selectFrom(baseModel).select(field).where(eb.and(idFields.map((idField) => eb(eb.ref(`${fieldDef.originModel}.${idField}`), "=", eb.ref(`${modelAlias}.${idField}`)))));
+  }, "buildBaseSelect");
+  if (fkInfo.ownedByModel) {
+    joinConditions.push(...fkInfo.keyPairs.map(({ fk, pk }) => {
+      let fkRef;
+      if (fieldDef.originModel && fieldDef.originModel !== model) {
+        fkRef = buildBaseSelect(fieldDef.originModel, fk);
+      } else {
+        fkRef = eb.ref(`${modelAlias}.${fk}`);
+      }
+      return eb(fkRef, "=", eb.ref(`${relationModel}.${pk}`));
+    }));
+  } else {
+    joinConditions.push(...fkInfo.keyPairs.map(({ fk, pk }) => {
+      let pkRef;
+      if (fieldDef.originModel && fieldDef.originModel !== model) {
+        pkRef = buildBaseSelect(fieldDef.originModel, pk);
+      } else {
+        pkRef = eb.ref(`${modelAlias}.${pk}`);
+      }
+      return eb(pkRef, "=", eb.ref(`${relationModel}.${fk}`));
+    }));
+  }
+  const joinCondition = joinConditions.length === 1 ? joinConditions[0] : eb.and(joinConditions);
+  const policyHandler = new PolicyHandler(client);
+  const op = arg2Node ? arg2Node.value : operation;
+  const policyCondition = policyHandler.buildPolicyFilter(relationModel, void 0, op);
+  const result = eb.selectFrom(relationModel).where(joinCondition).select(new ExpressionWrapper2(policyCondition).as("$condition"));
+  return result;
+}, "check");
+
+// src/plugin.ts
+var PolicyPlugin = class {
+  static {
+    __name(this, "PolicyPlugin");
+  }
+  get id() {
+    return "policy";
+  }
+  get name() {
+    return "Access Policy";
+  }
+  get description() {
+    return "Enforces access policies defined in the schema.";
+  }
+  get functions() {
+    return {
+      check
+    };
+  }
+  onKyselyQuery({ query, client, proceed }) {
+    const handler = new PolicyHandler(client);
+    return handler.handle(query, proceed);
+  }
+};
+export {
+  PolicyPlugin
+};
+//# sourceMappingURL=index.mjs.map