@zenstackhq/runtime 2.15.1 → 3.0.0-alpha.0

package/dist/plugins/policy.cjs

@@ -0,0 +1,2343 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/policy/index.ts
+var policy_exports = {};
+__export(policy_exports, {
+  PolicyPlugin: () => PolicyPlugin,
+  RejectedByPolicyError: () => RejectedByPolicyError
+});
+module.exports = __toCommonJS(policy_exports);
+
+// src/plugins/policy/errors.ts
+var RejectedByPolicyError = class extends Error {
+  static {
+    __name(this, "RejectedByPolicyError");
+  }
+  model;
+  reason;
+  constructor(model, reason) {
+    super(reason ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
+  }
+};
+
+// src/plugins/policy/policy-handler.ts
+var import_kysely7 = require("kysely");
+var import_tiny_invariant6 = __toESM(require("tiny-invariant"), 1);
+var import_ts_pattern7 = require("ts-pattern");
+
+// src/client/crud/dialects/index.ts
+var import_ts_pattern4 = require("ts-pattern");
+
+// src/client/crud/dialects/postgresql.ts
+var import_kysely2 = require("kysely");
+var import_tiny_invariant2 = __toESM(require("tiny-invariant"), 1);
+var import_ts_pattern2 = require("ts-pattern");
+
+// src/client/errors.ts
+var QueryError = class extends Error {
+  static {
+    __name(this, "QueryError");
+  }
+  constructor(message) {
+    super(message);
+  }
+};
+var InternalError = class extends Error {
+  static {
+    __name(this, "InternalError");
+  }
+  constructor(message) {
+    super(message);
+  }
+};
+
+// src/client/query-utils.ts
+function getModel(schema, model) {
+  return schema.models[model];
+}
+__name(getModel, "getModel");
+function requireModel(schema, model) {
+  const matchedName = Object.keys(schema.models).find((k) => k.toLowerCase() === model.toLowerCase());
+  if (!matchedName) {
+    throw new QueryError(`Model "${model}" not found`);
+  }
+  return schema.models[matchedName];
+}
+__name(requireModel, "requireModel");
+function getField(schema, model, field) {
+  const modelDef = getModel(schema, model);
+  return modelDef?.fields[field];
+}
+__name(getField, "getField");
+function requireField(schema, model, field) {
+  const modelDef = requireModel(schema, model);
+  if (!modelDef.fields[field]) {
+    throw new QueryError(`Field "${field}" not found in model "${model}"`);
+  }
+  return modelDef.fields[field];
+}
+__name(requireField, "requireField");
+function getIdFields(schema, model) {
+  const modelDef = requireModel(schema, model);
+  return modelDef?.idFields;
+}
+__name(getIdFields, "getIdFields");
+function getRelationForeignKeyFieldPairs(schema, model, relationField) {
+  const fieldDef = requireField(schema, model, relationField);
+  if (!fieldDef?.relation) {
+    throw new InternalError(`Field "${relationField}" is not a relation`);
+  }
+  if (fieldDef.relation.fields) {
+    if (!fieldDef.relation.references) {
+      throw new InternalError(`Relation references not defined for field "${relationField}"`);
+    }
+    return {
+      keyPairs: fieldDef.relation.fields.map((f, i) => ({
+        fk: f,
+        pk: fieldDef.relation.references[i]
+      })),
+      ownedByModel: true
+    };
+  } else {
+    if (!fieldDef.relation.opposite) {
+      throw new InternalError(`Opposite relation not defined for field "${relationField}"`);
+    }
+    const oppositeField = requireField(schema, fieldDef.type, fieldDef.relation.opposite);
+    if (!oppositeField.relation) {
+      throw new InternalError(`Field "${fieldDef.relation.opposite}" is not a relation`);
+    }
+    if (!oppositeField.relation.fields) {
+      throw new InternalError(`Relation fields not defined for field "${relationField}"`);
+    }
+    if (!oppositeField.relation.references) {
+      throw new InternalError(`Relation references not defined for field "${relationField}"`);
+    }
+    return {
+      keyPairs: oppositeField.relation.fields.map((f, i) => ({
+        fk: f,
+        pk: oppositeField.relation.references[i]
+      })),
+      ownedByModel: false
+    };
+  }
+}
+__name(getRelationForeignKeyFieldPairs, "getRelationForeignKeyFieldPairs");
+function getUniqueFields(schema, model) {
+  const modelDef = requireModel(schema, model);
+  const result = [];
+  for (const [key, value] of Object.entries(modelDef.uniqueFields)) {
+    if (typeof value !== "object") {
+      throw new InternalError(`Invalid unique field definition for "${key}"`);
+    }
+    if (typeof value.type === "string") {
+      result.push({
+        name: key,
+        def: requireField(schema, model, key)
+      });
+    } else {
+      result.push({
+        name: key,
+        defs: Object.fromEntries(Object.keys(value).map((k) => [
+          k,
+          requireField(schema, model, k)
+        ]))
+      });
+    }
+  }
+  return result;
+}
+__name(getUniqueFields, "getUniqueFields");
+function buildFieldRef(schema, model, field, options, eb, modelAlias) {
+  const fieldDef = requireField(schema, model, field);
+  if (!fieldDef.computed) {
+    return eb.ref(modelAlias ? `${modelAlias}.${field}` : field);
+  } else {
+    let computer;
+    if ("computedFields" in options) {
+      const computedFields = options.computedFields;
+      computer = computedFields?.[model]?.[field];
+    }
+    if (!computer) {
+      throw new QueryError(`Computed field "${field}" implementation not provided`);
+    }
+    return computer(eb);
+  }
+}
+__name(buildFieldRef, "buildFieldRef");
+function isEnum(schema, type) {
+  return !!schema.enums?.[type];
+}
+__name(isEnum, "isEnum");
+function buildJoinPairs(schema, model, modelAlias, relationField, relationModelAlias) {
+  const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(schema, model, relationField);
+  return keyPairs.map(({ fk, pk }) => {
+    if (ownedByModel) {
+      return [
+        `${relationModelAlias}.${pk}`,
+        `${modelAlias}.${fk}`
+      ];
+    } else {
+      return [
+        `${relationModelAlias}.${fk}`,
+        `${modelAlias}.${pk}`
+      ];
+    }
+  });
+}
+__name(buildJoinPairs, "buildJoinPairs");
+function makeDefaultOrderBy(schema, model) {
+  const idFields = getIdFields(schema, model);
+  return idFields.map((f) => ({
+    [f]: "asc"
+  }));
+}
+__name(makeDefaultOrderBy, "makeDefaultOrderBy");
+function getManyToManyRelation(schema, model, field) {
+  const fieldDef = requireField(schema, model, field);
+  if (!fieldDef.array || !fieldDef.relation?.opposite) {
+    return void 0;
+  }
+  const oppositeFieldDef = requireField(schema, fieldDef.type, fieldDef.relation.opposite);
+  if (oppositeFieldDef.array) {
+    const sortedModelNames = [
+      model,
+      fieldDef.type
+    ].sort();
+    return {
+      parentFkName: sortedModelNames[0] === model ? "A" : "B",
+      otherModel: fieldDef.type,
+      otherField: fieldDef.relation.opposite,
+      otherFkName: sortedModelNames[0] === fieldDef.type ? "A" : "B",
+      joinTable: fieldDef.relation.name ? `_${fieldDef.relation.name}` : `_${sortedModelNames[0]}To${sortedModelNames[1]}`
+    };
+  } else {
+    return void 0;
+  }
+}
+__name(getManyToManyRelation, "getManyToManyRelation");
+function flattenCompoundUniqueFilters(schema, model, filter) {
+  if (typeof filter !== "object" || !filter) {
+    return filter;
+  }
+  const uniqueFields = getUniqueFields(schema, model);
+  const compoundUniques = uniqueFields.filter((u) => "defs" in u);
+  if (compoundUniques.length === 0) {
+    return filter;
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(filter)) {
+    if (compoundUniques.some(({ name }) => name === key)) {
+      Object.assign(result, value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+__name(flattenCompoundUniqueFilters, "flattenCompoundUniqueFilters");
+
+// src/client/crud/dialects/base.ts
+var import_kysely = require("kysely");
+var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
+var import_ts_pattern = require("ts-pattern");
+
+// src/utils/enumerate.ts
+function enumerate(x) {
+  if (x === null || x === void 0) {
+    return [];
+  } else if (Array.isArray(x)) {
+    return x;
+  } else {
+    return [
+      x
+    ];
+  }
+}
+__name(enumerate, "enumerate");
+
+// src/client/crud/dialects/base.ts
+var import_is_plain_object = require("is-plain-object");
+var BaseCrudDialect = class {
+  static {
+    __name(this, "BaseCrudDialect");
+  }
+  schema;
+  options;
+  constructor(schema, options) {
+    this.schema = schema;
+    this.options = options;
+  }
+  transformPrimitive(value, _type) {
+    return value;
+  }
+  buildFilter(eb, model, modelAlias, where) {
+    if (where === true || where === void 0) {
+      return this.true(eb);
+    }
+    if (where === false) {
+      return this.false(eb);
+    }
+    let result = this.true(eb);
+    const _where = flattenCompoundUniqueFilters(this.schema, model, where);
+    for (const [key, payload] of Object.entries(_where)) {
+      if (payload === void 0) {
+        continue;
+      }
+      if (key.startsWith("$")) {
+        continue;
+      }
+      if (key === "AND" || key === "OR" || key === "NOT") {
+        result = this.and(eb, result, this.buildCompositeFilter(eb, model, modelAlias, key, payload));
+        continue;
+      }
+      const fieldDef = requireField(this.schema, model, key);
+      if (fieldDef.relation) {
+        result = this.and(eb, result, this.buildRelationFilter(eb, model, modelAlias, key, fieldDef, payload));
+      } else if (fieldDef.array) {
+        result = this.and(eb, result, this.buildArrayFilter(eb, model, modelAlias, key, fieldDef, payload));
+      } else {
+        result = this.and(eb, result, this.buildPrimitiveFilter(eb, model, modelAlias, key, fieldDef, payload));
+      }
+    }
+    if ("$expr" in _where && typeof _where["$expr"] === "function") {
+      result = this.and(eb, result, _where["$expr"](eb));
+    }
+    return result;
+  }
+  buildCompositeFilter(eb, model, modelAlias, key, payload) {
+    return (0, import_ts_pattern.match)(key).with("AND", () => this.and(eb, ...enumerate(payload).map((subPayload) => this.buildFilter(eb, model, modelAlias, subPayload)))).with("OR", () => this.or(eb, ...enumerate(payload).map((subPayload) => this.buildFilter(eb, model, modelAlias, subPayload)))).with("NOT", () => eb.not(this.buildCompositeFilter(eb, model, modelAlias, "AND", payload))).exhaustive();
+  }
+  buildRelationFilter(eb, model, modelAlias, field, fieldDef, payload) {
+    if (!fieldDef.array) {
+      return this.buildToOneRelationFilter(eb, model, modelAlias, field, fieldDef, payload);
+    } else {
+      return this.buildToManyRelationFilter(eb, model, modelAlias, field, fieldDef, payload);
+    }
+  }
+  buildToOneRelationFilter(eb, model, table, field, fieldDef, payload) {
+    if (payload === null) {
+      const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, field);
+      if (ownedByModel) {
+        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely.sql.ref(`${table}.${fk}`), "is", null)));
+      } else {
+        return this.buildToOneRelationFilter(eb, model, table, field, fieldDef, {
+          is: null
+        });
+      }
+    }
+    const joinAlias = `${table}$${field}`;
+    const joinPairs = buildJoinPairs(this.schema, model, table, field, joinAlias);
+    const filterResultField = `${field}$filter`;
+    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
+    const conditions = [];
+    if ("is" in payload || "isNot" in payload) {
+      if ("is" in payload) {
+        if (payload.is === null) {
+          conditions.push(eb(joinSelect, "=", 0));
+        } else {
+          conditions.push(eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload.is)), ">", 0));
+        }
+      }
+      if ("isNot" in payload) {
+        if (payload.isNot === null) {
+          conditions.push(eb(joinSelect, ">", 0));
+        } else {
+          conditions.push(this.or(
+            eb,
+            // is null
+            eb(joinSelect, "=", 0),
+            // found one that matches the filter
+            eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload.isNot)), "=", 0)
+          ));
+        }
+      }
+    } else {
+      conditions.push(eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload)), ">", 0));
+    }
+    return this.and(eb, ...conditions);
+  }
+  buildToManyRelationFilter(eb, model, table, field, fieldDef, payload) {
+    if (payload === null) {
+      return eb(import_kysely.sql.ref(`${table}.${field}`), "is", null);
+    }
+    const relationModel = fieldDef.type;
+    const buildPkFkWhereRefs = /* @__PURE__ */ __name((eb2) => {
+      const m2m = getManyToManyRelation(this.schema, model, field);
+      if (m2m) {
+        const modelIdField = getIdFields(this.schema, model)[0];
+        const relationIdField = getIdFields(this.schema, relationModel)[0];
+        return eb2(import_kysely.sql.ref(`${relationModel}.${relationIdField}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely.sql.ref(`${table}.${modelIdField}`)));
+      } else {
+        const relationKeyPairs = getRelationForeignKeyFieldPairs(this.schema, model, field);
+        let result2 = this.true(eb2);
+        for (const { fk, pk } of relationKeyPairs.keyPairs) {
+          if (relationKeyPairs.ownedByModel) {
+            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${table}.${fk}`), "=", import_kysely.sql.ref(`${relationModel}.${pk}`)));
+          } else {
+            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${table}.${pk}`), "=", import_kysely.sql.ref(`${relationModel}.${fk}`)));
+          }
+        }
+        return result2;
+      }
+    }, "buildPkFkWhereRefs");
+    let result = this.true(eb);
+    for (const [key, subPayload] of Object.entries(payload)) {
+      if (!subPayload) {
+        continue;
+      }
+      switch (key) {
+        case "some": {
+          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => this.buildFilter(eb1, relationModel, relationModel, subPayload)), ">", 0));
+          break;
+        }
+        case "every": {
+          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => eb1.not(this.buildFilter(eb1, relationModel, relationModel, subPayload))), "=", 0));
+          break;
+        }
+        case "none": {
+          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => this.buildFilter(eb1, relationModel, relationModel, subPayload)), "=", 0));
+          break;
+        }
+      }
+    }
+    return result;
+  }
+  buildArrayFilter(eb, model, modelAlias, field, fieldDef, payload) {
+    const clauses = [];
+    const fieldType = fieldDef.type;
+    const fieldRef = buildFieldRef(this.schema, model, field, this.options, eb, modelAlias);
+    for (const [key, _value] of Object.entries(payload)) {
+      if (_value === void 0) {
+        continue;
+      }
+      const value = this.transformPrimitive(_value, fieldType);
+      switch (key) {
+        case "equals": {
+          clauses.push(this.buildLiteralFilter(eb, fieldRef, fieldType, eb.val(value)));
+          break;
+        }
+        case "has": {
+          clauses.push(eb(fieldRef, "@>", eb.val([
+            value
+          ])));
+          break;
+        }
+        case "hasEvery": {
+          clauses.push(eb(fieldRef, "@>", eb.val(value)));
+          break;
+        }
+        case "hasSome": {
+          clauses.push(eb(fieldRef, "&&", eb.val(value)));
+          break;
+        }
+        case "isEmpty": {
+          clauses.push(eb(fieldRef, value === true ? "=" : "!=", eb.val([])));
+          break;
+        }
+        default: {
+          throw new InternalError(`Invalid array filter key: ${key}`);
+        }
+      }
+    }
+    return this.and(eb, ...clauses);
+  }
+  buildPrimitiveFilter(eb, model, modelAlias, field, fieldDef, payload) {
+    if (payload === null) {
+      return eb(import_kysely.sql.ref(`${modelAlias}.${field}`), "is", null);
+    }
+    if (isEnum(this.schema, fieldDef.type)) {
+      return this.buildEnumFilter(eb, modelAlias, field, fieldDef, payload);
+    }
+    return (0, import_ts_pattern.match)(fieldDef.type).with("String", () => this.buildStringFilter(eb, modelAlias, field, payload)).with(import_ts_pattern.P.union("Int", "Float", "Decimal", "BigInt"), (type) => this.buildNumberFilter(eb, model, modelAlias, field, type, payload)).with("Boolean", () => this.buildBooleanFilter(eb, modelAlias, field, payload)).with("DateTime", () => this.buildDateTimeFilter(eb, modelAlias, field, payload)).with("Bytes", () => this.buildBytesFilter(eb, modelAlias, field, payload)).exhaustive();
+  }
+  buildLiteralFilter(eb, lhs, type, rhs) {
+    return eb(lhs, "=", rhs !== null && rhs !== void 0 ? this.transformPrimitive(rhs, type) : rhs);
+  }
+  buildStandardFilter(eb, type, payload, lhs, getRhs, recurse, throwIfInvalid = false, onlyForKeys = void 0) {
+    if (payload === null || !(0, import_is_plain_object.isPlainObject)(payload)) {
+      return {
+        conditions: [
+          this.buildLiteralFilter(eb, lhs, type, payload)
+        ],
+        consumedKeys: []
+      };
+    }
+    const conditions = [];
+    const consumedKeys = [];
+    for (const [op, value] of Object.entries(payload)) {
+      if (onlyForKeys && !onlyForKeys.includes(op)) {
+        continue;
+      }
+      const rhs = Array.isArray(value) ? value.map(getRhs) : getRhs(value);
+      const condition = (0, import_ts_pattern.match)(op).with("equals", () => rhs === null ? eb(lhs, "is", null) : eb(lhs, "=", rhs)).with("in", () => {
+        (0, import_tiny_invariant.default)(Array.isArray(rhs), "right hand side must be an array");
+        if (rhs.length === 0) {
+          return this.false(eb);
+        } else {
+          return eb(lhs, "in", rhs);
+        }
+      }).with("notIn", () => {
+        (0, import_tiny_invariant.default)(Array.isArray(rhs), "right hand side must be an array");
+        if (rhs.length === 0) {
+          return this.true(eb);
+        } else {
+          return eb.not(eb(lhs, "in", rhs));
+        }
+      }).with("lt", () => eb(lhs, "<", rhs)).with("lte", () => eb(lhs, "<=", rhs)).with("gt", () => eb(lhs, ">", rhs)).with("gte", () => eb(lhs, ">=", rhs)).with("not", () => eb.not(recurse(value))).otherwise(() => {
+        if (throwIfInvalid) {
+          throw new QueryError(`Invalid filter key: ${op}`);
+        } else {
+          return void 0;
+        }
+      });
+      if (condition) {
+        conditions.push(condition);
+        consumedKeys.push(op);
+      }
+    }
+    return {
+      conditions,
+      consumedKeys
+    };
+  }
+  buildStringFilter(eb, table, field, payload) {
+    const fieldDef = getField(this.schema, table, field);
+    let fieldRef = fieldDef?.computed ? import_kysely.sql.ref(field) : import_kysely.sql.ref(`${table}.${field}`);
+    let insensitive = false;
+    if (payload && typeof payload === "object" && "mode" in payload && payload.mode === "insensitive") {
+      insensitive = true;
+      fieldRef = eb.fn("lower", [
+        fieldRef
+      ]);
+    }
+    const { conditions, consumedKeys } = this.buildStandardFilter(eb, "String", payload, fieldRef, (value) => this.prepStringCasing(eb, value, insensitive), (value) => this.buildStringFilter(eb, table, field, value));
+    if (payload && typeof payload === "object") {
+      for (const [key, value] of Object.entries(payload)) {
+        if (key === "mode" || consumedKeys.includes(key)) {
+          continue;
+        }
+        const condition = (0, import_ts_pattern.match)(key).with("contains", () => insensitive ? eb(fieldRef, "ilike", import_kysely.sql.lit(`%${value}%`)) : eb(fieldRef, "like", import_kysely.sql.lit(`%${value}%`))).with("startsWith", () => insensitive ? eb(fieldRef, "ilike", import_kysely.sql.lit(`${value}%`)) : eb(fieldRef, "like", import_kysely.sql.lit(`${value}%`))).with("endsWith", () => insensitive ? eb(fieldRef, "ilike", import_kysely.sql.lit(`%${value}`)) : eb(fieldRef, "like", import_kysely.sql.lit(`%${value}`))).otherwise(() => {
+          throw new Error(`Invalid string filter key: ${key}`);
+        });
+        if (condition) {
+          conditions.push(condition);
+        }
+      }
+    }
+    return this.and(eb, ...conditions);
+  }
+  prepStringCasing(eb, value, toLower = true) {
+    if (typeof value === "string") {
+      return toLower ? eb.fn("lower", [
+        import_kysely.sql.lit(value)
+      ]) : import_kysely.sql.lit(value);
+    } else if (Array.isArray(value)) {
+      return value.map((v) => this.prepStringCasing(eb, v, toLower));
+    } else {
+      return value === null ? null : import_kysely.sql.lit(value);
+    }
+  }
+  buildNumberFilter(eb, model, table, field, type, payload) {
+    const { conditions } = this.buildStandardFilter(eb, type, payload, buildFieldRef(this.schema, model, field, this.options, eb), (value) => this.transformPrimitive(value, type), (value) => this.buildNumberFilter(eb, model, table, field, type, value));
+    return this.and(eb, ...conditions);
+  }
+  buildBooleanFilter(eb, table, field, payload) {
+    const { conditions } = this.buildStandardFilter(eb, "Boolean", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "Boolean"), (value) => this.buildBooleanFilter(eb, table, field, value), true, [
+      "equals",
+      "not"
+    ]);
+    return this.and(eb, ...conditions);
+  }
+  buildDateTimeFilter(eb, table, field, payload) {
+    const { conditions } = this.buildStandardFilter(eb, "DateTime", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "DateTime"), (value) => this.buildDateTimeFilter(eb, table, field, value), true);
+    return this.and(eb, ...conditions);
+  }
+  buildBytesFilter(eb, table, field, payload) {
+    const conditions = this.buildStandardFilter(eb, "Bytes", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "Bytes"), (value) => this.buildBytesFilter(eb, table, field, value), true, [
+      "equals",
+      "in",
+      "notIn",
+      "not"
+    ]);
+    return this.and(eb, ...conditions.conditions);
+  }
+  buildEnumFilter(eb, table, field, fieldDef, payload) {
+    const conditions = this.buildStandardFilter(eb, "String", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => value, (value) => this.buildEnumFilter(eb, table, field, fieldDef, value), true, [
+      "equals",
+      "in",
+      "notIn",
+      "not"
+    ]);
+    return this.and(eb, ...conditions.conditions);
+  }
+  buildOrderBy(query, model, modelAlias, orderBy, useDefaultIfEmpty, negated) {
+    if (!orderBy) {
+      if (useDefaultIfEmpty) {
+        orderBy = makeDefaultOrderBy(this.schema, model);
+      } else {
+        return query;
+      }
+    }
+    let result = query;
+    enumerate(orderBy).forEach((orderBy2) => {
+      for (const [field, value] of Object.entries(orderBy2)) {
+        if (!value) {
+          continue;
+        }
+        if ([
+          "_count",
+          "_avg",
+          "_sum",
+          "_min",
+          "_max"
+        ].includes(field)) {
+          (0, import_tiny_invariant.default)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
+          for (const [k, v] of Object.entries(value)) {
+            (0, import_tiny_invariant.default)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+            result = result.orderBy((eb) => eb.fn(field.slice(1), [
+              import_kysely.sql.ref(k)
+            ]), import_kysely.sql.raw(this.negateSort(v, negated)));
+          }
+          continue;
+        }
+        switch (field) {
+          case "_count": {
+            (0, import_tiny_invariant.default)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
+            for (const [k, v] of Object.entries(value)) {
+              (0, import_tiny_invariant.default)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+              result = result.orderBy((eb) => eb.fn.count(import_kysely.sql.ref(k)), import_kysely.sql.raw(this.negateSort(v, negated)));
+            }
+            continue;
+          }
+          default:
+            break;
+        }
+        const fieldDef = requireField(this.schema, model, field);
+        if (!fieldDef.relation) {
+          if (value === "asc" || value === "desc") {
+            result = result.orderBy(import_kysely.sql.ref(`${modelAlias}.${field}`), this.negateSort(value, negated));
+          } else if (value && typeof value === "object" && "nulls" in value && "sort" in value && (value.sort === "asc" || value.sort === "desc") && (value.nulls === "first" || value.nulls === "last")) {
+            result = result.orderBy(import_kysely.sql.ref(`${modelAlias}.${field}`), import_kysely.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
+          }
+        } else {
+          const relationModel = fieldDef.type;
+          if (fieldDef.array) {
+            if (typeof value !== "object") {
+              throw new QueryError(`invalid orderBy value for field "${field}"`);
+            }
+            if ("_count" in value) {
+              (0, import_tiny_invariant.default)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
+              const sort = this.negateSort(value._count, negated);
+              result = result.orderBy((eb) => {
+                let subQuery = eb.selectFrom(relationModel);
+                const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
+                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
+                subQuery = subQuery.select(() => eb.fn.count(eb.lit(1)).as("_count"));
+                return subQuery;
+              }, sort);
+            }
+          } else {
+            result = result.leftJoin(relationModel, (join) => {
+              const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
+              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
+            });
+            result = this.buildOrderBy(result, fieldDef.type, relationModel, value, false, negated);
+          }
+        }
+      }
+    });
+    return result;
+  }
+  negateSort(sort, negated) {
+    return negated ? sort === "asc" ? "desc" : "asc" : sort;
+  }
+  true(eb) {
+    return eb.lit(this.transformPrimitive(true, "Boolean"));
+  }
+  false(eb) {
+    return eb.lit(this.transformPrimitive(false, "Boolean"));
+  }
+  isTrue(expression) {
+    const node = expression.toOperationNode();
+    if (node.kind !== "ValueNode") {
+      return false;
+    }
+    return node.value === true || node.value === 1;
+  }
+  isFalse(expression) {
+    const node = expression.toOperationNode();
+    if (node.kind !== "ValueNode") {
+      return false;
+    }
+    return node.value === false || node.value === 0;
+  }
+  and(eb, ...args) {
+    const nonTrueArgs = args.filter((arg) => !this.isTrue(arg));
+    if (nonTrueArgs.length === 0) {
+      return this.true(eb);
+    } else if (nonTrueArgs.length === 1) {
+      return nonTrueArgs[0];
+    } else {
+      return eb.and(nonTrueArgs);
+    }
+  }
+  or(eb, ...args) {
+    const nonFalseArgs = args.filter((arg) => !this.isFalse(arg));
+    if (nonFalseArgs.length === 0) {
+      return this.false(eb);
+    } else if (nonFalseArgs.length === 1) {
+      return nonFalseArgs[0];
+    } else {
+      return eb.or(nonFalseArgs);
+    }
+  }
+  not(eb, ...args) {
+    return eb.not(this.and(eb, ...args));
+  }
+};
+
+// src/client/crud/dialects/postgresql.ts
+var PostgresCrudDialect = class extends BaseCrudDialect {
+  static {
+    __name(this, "PostgresCrudDialect");
+  }
+  get provider() {
+    return "postgresql";
+  }
+  transformPrimitive(value, type) {
+    if (value === void 0) {
+      return value;
+    }
+    if (Array.isArray(value)) {
+      return value.map((v) => this.transformPrimitive(v, type));
+    } else {
+      return (0, import_ts_pattern2.match)(type).with("DateTime", () => value instanceof Date ? value : typeof value === "string" ? new Date(value) : value).otherwise(() => value);
+    }
+  }
+  buildRelationSelection(query, model, relationField, parentAlias, payload) {
+    const joinedQuery = this.buildRelationJSON(model, query, relationField, parentAlias, payload);
+    return joinedQuery.select(`${parentAlias}$${relationField}.$j as ${relationField}`);
+  }
+  buildRelationJSON(model, qb, relationField, parentName, payload) {
+    const relationFieldDef = requireField(this.schema, model, relationField);
+    const relationModel = relationFieldDef.type;
+    return qb.leftJoinLateral((eb) => {
+      const joinTableName = `${parentName}$${relationField}`;
+      let result = eb.selectFrom(`${relationModel} as ${joinTableName}`);
+      result = eb.selectFrom(() => {
+        let subQuery = eb.selectFrom(`${relationModel}`).selectAll();
+        if (payload && typeof payload === "object") {
+          if (payload.where) {
+            subQuery = subQuery.where((eb2) => this.buildFilter(eb2, relationModel, relationModel, payload.where));
+          }
+          const skip = payload.skip;
+          let take = payload.take;
+          let negateOrderBy = false;
+          if (take !== void 0 && take < 0) {
+            negateOrderBy = true;
+            take = -take;
+          }
+          subQuery = this.buildSkipTake(subQuery, skip, take);
+          subQuery = this.buildOrderBy(subQuery, relationModel, relationModel, payload.orderBy, skip !== void 0 || take !== void 0, negateOrderBy);
+        }
+        const m2m = getManyToManyRelation(this.schema, model, relationField);
+        if (m2m) {
+          const parentIds = getIdFields(this.schema, model);
+          const relationIds = getIdFields(this.schema, relationModel);
+          (0, import_tiny_invariant2.default)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+          (0, import_tiny_invariant2.default)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+          subQuery = subQuery.where(eb(eb.ref(`${relationModel}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentName}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
+        } else {
+          const joinPairs = buildJoinPairs(this.schema, model, parentName, relationField, relationModel);
+          subQuery = subQuery.where((eb2) => this.and(eb2, ...joinPairs.map(([left, right]) => eb2(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
+        }
+        return subQuery.as(joinTableName);
+      });
+      result = this.buildRelationObjectSelect(relationModel, relationField, relationFieldDef, result, payload, parentName);
+      result = this.buildRelationJoins(relationModel, relationField, result, payload, parentName);
+      return result.as(joinTableName);
+    }, (join) => join.onTrue());
+  }
+  buildRelationObjectSelect(relationModel, relationField, relationFieldDef, qb, payload, parentName) {
+    qb = qb.select((eb) => {
+      const objArgs = this.buildRelationObjectArgs(relationModel, relationField, eb, payload, parentName);
+      if (relationFieldDef.array) {
+        return eb.fn.coalesce(import_kysely2.sql`jsonb_agg(jsonb_build_object(${import_kysely2.sql.join(objArgs)}))`, import_kysely2.sql`'[]'::jsonb`).as("$j");
+      } else {
+        return import_kysely2.sql`jsonb_build_object(${import_kysely2.sql.join(objArgs)})`.as("$j");
+      }
+    });
+    return qb;
+  }
+  buildRelationObjectArgs(relationModel, relationField, eb, payload, parentName) {
+    const relationModelDef = requireModel(this.schema, relationModel);
+    const objArgs = [];
+    if (payload === true || !payload.select) {
+      objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
+        import_kysely2.sql.lit(field),
+        buildFieldRef(this.schema, relationModel, field, this.options, eb)
+      ]).flatMap((v) => v));
+    } else if (payload.select) {
+      objArgs.push(...Object.entries(payload.select).filter(([, value]) => value).map(([field]) => [
+        import_kysely2.sql.lit(field),
+        buildFieldRef(this.schema, relationModel, field, this.options, eb)
+      ]).flatMap((v) => v));
+    }
+    if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
+      objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field]) => [
+        import_kysely2.sql.lit(field),
+        eb.ref(`${parentName}$${relationField}$${field}.$j`)
+      ]).flatMap((v) => v));
+    }
+    return objArgs;
+  }
+  buildRelationJoins(model, relationField, qb, payload, parentName) {
+    let result = qb;
+    if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
+      Object.entries(payload.include).filter(([, value]) => value).forEach(([field, value]) => {
+        result = this.buildRelationJSON(model, result, field, `${parentName}$${relationField}`, value);
+      });
+    }
+    return result;
+  }
+  buildSkipTake(query, skip, take) {
+    if (take !== void 0) {
+      query = query.limit(take);
+    }
+    if (skip !== void 0) {
+      query = query.offset(skip);
+    }
+    return query;
+  }
+  buildJsonObject(eb, value) {
+    return eb.fn("jsonb_build_object", Object.entries(value).flatMap(([key, value2]) => [
+      import_kysely2.sql.lit(key),
+      value2
+    ]));
+  }
+  get supportsUpdateWithLimit() {
+    return false;
+  }
+  get supportsDeleteWithLimit() {
+    return false;
+  }
+  get supportsDistinctOn() {
+    return true;
+  }
+  buildArrayLength(eb, array) {
+    return eb.fn("array_length", [
+      array
+    ]);
+  }
+  buildArrayLiteralSQL(values) {
+    if (values.length === 0) {
+      return "{}";
+    } else {
+      return `ARRAY[${values.map((v) => typeof v === "string" ? `'${v}'` : v)}]`;
+    }
+  }
+};
+
+// src/client/crud/dialects/sqlite.ts
+var import_kysely3 = require("kysely");
+var import_tiny_invariant3 = __toESM(require("tiny-invariant"), 1);
+var import_ts_pattern3 = require("ts-pattern");
+var SqliteCrudDialect = class extends BaseCrudDialect {
+  static {
+    __name(this, "SqliteCrudDialect");
+  }
+  get provider() {
+    return "sqlite";
+  }
+  transformPrimitive(value, type) {
+    if (value === void 0) {
+      return value;
+    }
+    if (Array.isArray(value)) {
+      return value.map((v) => this.transformPrimitive(v, type));
+    } else {
+      return (0, import_ts_pattern3.match)(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).otherwise(() => value);
+    }
+  }
+  buildRelationSelection(query, model, relationField, parentAlias, payload) {
+    return query.select((eb) => this.buildRelationJSON(model, eb, relationField, parentAlias, payload).as(relationField));
+  }
+  buildRelationJSON(model, eb, relationField, parentName, payload) {
+    const relationFieldDef = requireField(this.schema, model, relationField);
+    const relationModel = relationFieldDef.type;
+    const relationModelDef = requireModel(this.schema, relationModel);
+    const subQueryName = `${parentName}$${relationField}`;
+    let tbl = eb.selectFrom(() => {
+      let subQuery = eb.selectFrom(relationModel).selectAll();
+      if (payload && typeof payload === "object") {
+        if (payload.where) {
+          subQuery = subQuery.where((eb2) => this.buildFilter(eb2, relationModel, relationModel, payload.where));
+        }
+        const skip = payload.skip;
+        let take = payload.take;
+        let negateOrderBy = false;
+        if (take !== void 0 && take < 0) {
+          negateOrderBy = true;
+          take = -take;
+        }
+        subQuery = this.buildSkipTake(subQuery, skip, take);
+        subQuery = this.buildOrderBy(subQuery, relationModel, relationModel, payload.orderBy, skip !== void 0 || take !== void 0, negateOrderBy);
+      }
+      const m2m = getManyToManyRelation(this.schema, model, relationField);
+      if (m2m) {
+        const parentIds = getIdFields(this.schema, model);
+        const relationIds = getIdFields(this.schema, relationModel);
+        (0, import_tiny_invariant3.default)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+        (0, import_tiny_invariant3.default)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+        subQuery = subQuery.where(eb(eb.ref(`${relationModel}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentName}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
+      } else {
+        const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
+        keyPairs.forEach(({ fk, pk }) => {
+          if (ownedByModel) {
+            subQuery = subQuery.whereRef(`${relationModel}.${pk}`, "=", `${parentName}.${fk}`);
+          } else {
+            subQuery = subQuery.whereRef(`${relationModel}.${fk}`, "=", `${parentName}.${pk}`);
+          }
+        });
+      }
+      return subQuery.as(subQueryName);
+    });
+    tbl = tbl.select(() => {
+      const objArgs = [];
+      if (payload === true || !payload.select) {
+        objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
+          import_kysely3.sql.lit(field),
+          buildFieldRef(this.schema, relationModel, field, this.options, eb)
+        ]).flatMap((v) => v));
+      } else if (payload.select) {
+        objArgs.push(...Object.entries(payload.select).filter(([, value]) => value).map(([field, value]) => {
+          const fieldDef = requireField(this.schema, relationModel, field);
+          if (fieldDef.relation) {
+            const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentName}$${relationField}`, value);
+            return [
+              import_kysely3.sql.lit(field),
+              subJson
+            ];
+          } else {
+            return [
+              import_kysely3.sql.lit(field),
+              buildFieldRef(this.schema, relationModel, field, this.options, eb)
+            ];
+          }
+        }).flatMap((v) => v));
+      }
+      if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
+        objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field, value]) => {
+          const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentName}$${relationField}`, value);
+          return [
+            import_kysely3.sql.lit(field),
+            subJson
+          ];
+        }).flatMap((v) => v));
+      }
+      if (relationFieldDef.array) {
+        return eb.fn.coalesce(import_kysely3.sql`json_group_array(json_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`json_array()`).as("$j");
+      } else {
+        return import_kysely3.sql`json_object(${import_kysely3.sql.join(objArgs)})`.as("data");
+      }
+    });
+    return tbl;
+  }
+  buildSkipTake(query, skip, take) {
+    if (take !== void 0) {
+      query = query.limit(take);
+    }
+    if (skip !== void 0) {
+      query = query.offset(skip);
+      if (take === void 0) {
+        query = query.limit(-1);
+      }
+    }
+    return query;
+  }
+  buildJsonObject(eb, value) {
+    return eb.fn("json_object", Object.entries(value).flatMap(([key, value2]) => [
+      import_kysely3.sql.lit(key),
+      value2
+    ]));
+  }
+  get supportsUpdateWithLimit() {
+    return false;
+  }
+  get supportsDeleteWithLimit() {
+    return false;
+  }
+  get supportsDistinctOn() {
+    return false;
+  }
+  buildArrayLength(eb, array) {
+    return eb.fn("json_array_length", [
+      array
+    ]);
+  }
+  buildArrayLiteralSQL(_values) {
+    throw new Error("SQLite does not support array literals");
+  }
+};
+
+// src/client/crud/dialects/index.ts
+function getCrudDialect(schema, options) {
+  return (0, import_ts_pattern4.match)(schema.provider.type).with("sqlite", () => new SqliteCrudDialect(schema, options)).with("postgresql", () => new PostgresCrudDialect(schema, options)).exhaustive();
+}
+__name(getCrudDialect, "getCrudDialect");
+
+// src/schema/expression.ts
+var ExpressionUtils = {
+  literal: /* @__PURE__ */ __name((value) => {
+    return {
+      kind: "literal",
+      value
+    };
+  }, "literal"),
+  array: /* @__PURE__ */ __name((items) => {
+    return {
+      kind: "array",
+      items
+    };
+  }, "array"),
+  call: /* @__PURE__ */ __name((functionName, args) => {
+    return {
+      kind: "call",
+      function: functionName,
+      args
+    };
+  }, "call"),
+  binary: /* @__PURE__ */ __name((left, op, right) => {
+    return {
+      kind: "binary",
+      op,
+      left,
+      right
+    };
+  }, "binary"),
+  unary: /* @__PURE__ */ __name((op, operand) => {
+    return {
+      kind: "unary",
+      op,
+      operand
+    };
+  }, "unary"),
+  field: /* @__PURE__ */ __name((field) => {
+    return {
+      kind: "field",
+      field
+    };
+  }, "field"),
+  member: /* @__PURE__ */ __name((receiver, members) => {
+    return {
+      kind: "member",
+      receiver,
+      members
+    };
+  }, "member"),
+  _this: /* @__PURE__ */ __name(() => {
+    return {
+      kind: "this"
+    };
+  }, "_this"),
+  _null: /* @__PURE__ */ __name(() => {
+    return {
+      kind: "null"
+    };
+  }, "_null"),
+  and: /* @__PURE__ */ __name((expr2, ...expressions) => {
+    return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "&&", exp), expr2);
+  }, "and"),
+  or: /* @__PURE__ */ __name((expr2, ...expressions) => {
+    return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "||", exp), expr2);
+  }, "or"),
+  is: /* @__PURE__ */ __name((value, kind) => {
+    return !!value && typeof value === "object" && "kind" in value && value.kind === kind;
+  }, "is"),
+  isLiteral: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "literal"), "isLiteral"),
+  isArray: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "array"), "isArray"),
+  isCall: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "call"), "isCall"),
+  isNull: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "null"), "isNull"),
+  isThis: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "this"), "isThis"),
+  isUnary: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "unary"), "isUnary"),
+  isBinary: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "binary"), "isBinary"),
+  isField: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "field"), "isField"),
+  isMember: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "member"), "isMember")
+};
+
+// src/utils/default-operation-node-visitor.ts
+var import_kysely4 = require("kysely");
+var DefaultOperationNodeVisitor = class extends import_kysely4.OperationNodeVisitor {
+  static {
+    __name(this, "DefaultOperationNodeVisitor");
+  }
+  defaultVisit(node) {
+    Object.values(node).forEach((value) => {
+      if (!value) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((el) => this.defaultVisit(el));
+      }
+      if (typeof value === "object" && "kind" in value && typeof value.kind === "string") {
+        this.visitNode(value);
+      }
+    });
+  }
+  visitSelectQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitSelection(node) {
+    this.defaultVisit(node);
+  }
+  visitColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitAlias(node) {
+    this.defaultVisit(node);
+  }
+  visitTable(node) {
+    this.defaultVisit(node);
+  }
+  visitFrom(node) {
+    this.defaultVisit(node);
+  }
+  visitReference(node) {
+    this.defaultVisit(node);
+  }
+  visitAnd(node) {
+    this.defaultVisit(node);
+  }
+  visitOr(node) {
+    this.defaultVisit(node);
+  }
+  visitValueList(node) {
+    this.defaultVisit(node);
+  }
+  visitParens(node) {
+    this.defaultVisit(node);
+  }
+  visitJoin(node) {
+    this.defaultVisit(node);
+  }
+  visitRaw(node) {
+    this.defaultVisit(node);
+  }
+  visitWhere(node) {
+    this.defaultVisit(node);
+  }
+  visitInsertQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitDeleteQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitReturning(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateTable(node) {
+    this.defaultVisit(node);
+  }
+  visitAddColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitColumnDefinition(node) {
+    this.defaultVisit(node);
+  }
+  visitDropTable(node) {
+    this.defaultVisit(node);
+  }
+  visitOrderBy(node) {
+    this.defaultVisit(node);
+  }
+  visitOrderByItem(node) {
+    this.defaultVisit(node);
+  }
+  visitGroupBy(node) {
+    this.defaultVisit(node);
+  }
+  visitGroupByItem(node) {
+    this.defaultVisit(node);
+  }
+  visitUpdateQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitColumnUpdate(node) {
+    this.defaultVisit(node);
+  }
+  visitLimit(node) {
+    this.defaultVisit(node);
+  }
+  visitOffset(node) {
+    this.defaultVisit(node);
+  }
+  visitOnConflict(node) {
+    this.defaultVisit(node);
+  }
+  visitOnDuplicateKey(node) {
+    this.defaultVisit(node);
+  }
+  visitCheckConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitDataType(node) {
+    this.defaultVisit(node);
+  }
+  visitSelectAll(node) {
+    this.defaultVisit(node);
+  }
+  visitIdentifier(node) {
+    this.defaultVisit(node);
+  }
+  visitSchemableIdentifier(node) {
+    this.defaultVisit(node);
+  }
+  visitValue(node) {
+    this.defaultVisit(node);
+  }
+  visitPrimitiveValueList(node) {
+    this.defaultVisit(node);
+  }
+  visitOperator(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateIndex(node) {
+    this.defaultVisit(node);
+  }
+  visitDropIndex(node) {
+    this.defaultVisit(node);
+  }
+  visitList(node) {
+    this.defaultVisit(node);
+  }
+  visitPrimaryKeyConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitUniqueConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitReferences(node) {
+    this.defaultVisit(node);
+  }
+  visitWith(node) {
+    this.defaultVisit(node);
+  }
+  visitCommonTableExpression(node) {
+    this.defaultVisit(node);
+  }
+  visitCommonTableExpressionName(node) {
+    this.defaultVisit(node);
+  }
+  visitHaving(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateSchema(node) {
+    this.defaultVisit(node);
+  }
+  visitDropSchema(node) {
+    this.defaultVisit(node);
+  }
+  visitAlterTable(node) {
+    this.defaultVisit(node);
+  }
+  visitDropColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitRenameColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitAlterColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitModifyColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitAddConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitDropConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitForeignKeyConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateView(node) {
+    this.defaultVisit(node);
+  }
+  visitDropView(node) {
+    this.defaultVisit(node);
+  }
+  visitGenerated(node) {
+    this.defaultVisit(node);
+  }
+  visitDefaultValue(node) {
+    this.defaultVisit(node);
+  }
+  visitOn(node) {
+    this.defaultVisit(node);
+  }
+  visitValues(node) {
+    this.defaultVisit(node);
+  }
+  visitSelectModifier(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateType(node) {
+    this.defaultVisit(node);
+  }
+  visitDropType(node) {
+    this.defaultVisit(node);
+  }
+  visitExplain(node) {
+    this.defaultVisit(node);
+  }
+  visitDefaultInsertValue(node) {
+    this.defaultVisit(node);
+  }
+  visitAggregateFunction(node) {
+    this.defaultVisit(node);
+  }
+  visitOver(node) {
+    this.defaultVisit(node);
+  }
+  visitPartitionBy(node) {
+    this.defaultVisit(node);
+  }
+  visitPartitionByItem(node) {
+    this.defaultVisit(node);
+  }
+  visitSetOperation(node) {
+    this.defaultVisit(node);
+  }
+  visitBinaryOperation(node) {
+    this.defaultVisit(node);
+  }
+  visitUnaryOperation(node) {
+    this.defaultVisit(node);
+  }
+  visitUsing(node) {
+    this.defaultVisit(node);
+  }
+  visitFunction(node) {
+    this.defaultVisit(node);
+  }
+  visitCase(node) {
+    this.defaultVisit(node);
+  }
+  visitWhen(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONReference(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONPath(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONPathLeg(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONOperatorChain(node) {
+    this.defaultVisit(node);
+  }
+  visitTuple(node) {
+    this.defaultVisit(node);
+  }
+  visitMergeQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitMatched(node) {
+    this.defaultVisit(node);
+  }
+  visitAddIndex(node) {
+    this.defaultVisit(node);
+  }
+  visitCast(node) {
+    this.defaultVisit(node);
+  }
+  visitFetch(node) {
+    this.defaultVisit(node);
+  }
+  visitTop(node) {
+    this.defaultVisit(node);
+  }
+  visitOutput(node) {
+    this.defaultVisit(node);
+  }
+};
+
+// src/plugins/policy/column-collector.ts
+var ColumnCollector = class extends DefaultOperationNodeVisitor {
+  static {
+    __name(this, "ColumnCollector");
+  }
+  columns = [];
+  collect(node) {
+    this.columns = [];
+    this.visitNode(node);
+    return this.columns;
+  }
+  visitColumn(node) {
+    if (!this.columns.includes(node.column.name)) {
+      this.columns.push(node.column.name);
+    }
+  }
+};
+
+// src/plugins/policy/expression-transformer.ts
+var import_kysely6 = require("kysely");
+var import_tiny_invariant5 = __toESM(require("tiny-invariant"), 1);
+var import_ts_pattern6 = require("ts-pattern");
+
+// src/plugins/policy/expression-evaluator.ts
+var import_tiny_invariant4 = __toESM(require("tiny-invariant"), 1);
+var import_ts_pattern5 = require("ts-pattern");
+var ExpressionEvaluator = class {
+  static {
+    __name(this, "ExpressionEvaluator");
+  }
+  evaluate(expression, context) {
+    const result = (0, import_ts_pattern5.match)(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
+    return result ?? null;
+  }
+  evaluateCall(expr2, context) {
+    if (expr2.function === "auth") {
+      return context.auth;
+    } else {
+      throw new Error(`Unsupported call expression function: ${expr2.function}`);
+    }
+  }
+  evaluateUnary(expr2, context) {
+    return (0, import_ts_pattern5.match)(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
+  }
+  evaluateMember(expr2, context) {
+    let val = this.evaluate(expr2.receiver, context);
+    for (const member of expr2.members) {
+      val = val?.[member];
+    }
+    return val;
+  }
+  evaluateLiteral(expr2) {
+    return expr2.value;
+  }
+  evaluateField(expr2, context) {
+    return context.thisValue?.[expr2.field];
+  }
+  evaluateArray(expr2, context) {
+    return expr2.items.map((item) => this.evaluate(item, context));
+  }
+  evaluateBinary(expr2, context) {
+    if (expr2.op === "?" || expr2.op === "!" || expr2.op === "^") {
+      return this.evaluateCollectionPredicate(expr2, context);
+    }
+    const left = this.evaluate(expr2.left, context);
+    const right = this.evaluate(expr2.right, context);
+    return (0, import_ts_pattern5.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
+      const _right = right ?? [];
+      (0, import_tiny_invariant4.default)(Array.isArray(_right), 'expected array for "in" operator');
+      return _right.includes(left);
+    }).exhaustive();
+  }
+  evaluateCollectionPredicate(expr2, context) {
+    const op = expr2.op;
+    (0, import_tiny_invariant4.default)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    const left = this.evaluate(expr2.left, context);
+    if (!left) {
+      return false;
+    }
+    (0, import_tiny_invariant4.default)(Array.isArray(left), "expected array");
+    return (0, import_ts_pattern5.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("^", () => !left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).exhaustive();
+  }
+};
+
+// src/plugins/policy/utils.ts
+var import_kysely5 = require("kysely");
+function trueNode(dialect) {
+  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean"));
+}
+__name(trueNode, "trueNode");
+function falseNode(dialect) {
+  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean"));
+}
+__name(falseNode, "falseNode");
+function isTrueNode(node) {
+  return import_kysely5.ValueNode.is(node) && (node.value === true || node.value === 1);
+}
+__name(isTrueNode, "isTrueNode");
+function isFalseNode(node) {
+  return import_kysely5.ValueNode.is(node) && (node.value === false || node.value === 0);
+}
+__name(isFalseNode, "isFalseNode");
+function conjunction(dialect, nodes) {
+  if (nodes.some(isFalseNode)) {
+    return falseNode(dialect);
+  }
+  const items = nodes.filter((n) => !isTrueNode(n));
+  if (items.length === 0) {
+    return trueNode(dialect);
+  }
+  return items.reduce((acc, node) => import_kysely5.OrNode.is(node) ? import_kysely5.AndNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.AndNode.create(acc, node));
+}
+__name(conjunction, "conjunction");
+function disjunction(dialect, nodes) {
+  if (nodes.some(isTrueNode)) {
+    return trueNode(dialect);
+  }
+  const items = nodes.filter((n) => !isFalseNode(n));
+  if (items.length === 0) {
+    return falseNode(dialect);
+  }
+  return items.reduce((acc, node) => import_kysely5.AndNode.is(node) ? import_kysely5.OrNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.OrNode.create(acc, node));
+}
+__name(disjunction, "disjunction");
+function logicalNot(node) {
+  return import_kysely5.UnaryOperationNode.create(import_kysely5.OperatorNode.create("not"), import_kysely5.AndNode.is(node) || import_kysely5.OrNode.is(node) ? import_kysely5.ParensNode.create(node) : node);
+}
+__name(logicalNot, "logicalNot");
+function buildIsFalse(node, dialect) {
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  } else if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  return import_kysely5.BinaryOperationNode.create(
+    // coalesce so null is treated as false
+    import_kysely5.FunctionNode.create("coalesce", [
+      node,
+      falseNode(dialect)
+    ]),
+    import_kysely5.OperatorNode.create("="),
+    falseNode(dialect)
+  );
+}
+__name(buildIsFalse, "buildIsFalse");
+function getTableName(node) {
+  if (!node) {
+    return node;
+  }
+  if (import_kysely5.TableNode.is(node)) {
+    return node.table.identifier.name;
+  } else if (import_kysely5.AliasNode.is(node)) {
+    return getTableName(node.node);
+  } else if (import_kysely5.ReferenceNode.is(node) && node.table) {
+    return getTableName(node.table);
+  }
+  return void 0;
+}
+__name(getTableName, "getTableName");
+
+// src/plugins/policy/expression-transformer.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+var expressionHandlers = /* @__PURE__ */ new Map();
+function expr(kind) {
+  return function(_target, _propertyKey, descriptor) {
+    if (!expressionHandlers.get(kind)) {
+      expressionHandlers.set(kind, descriptor);
+    }
+    return descriptor;
+  };
+}
+__name(expr, "expr");
+var ExpressionTransformer = class {
+  static {
+    __name(this, "ExpressionTransformer");
+  }
+  schema;
+  clientOptions;
+  auth;
+  dialect;
+  constructor(schema, clientOptions, auth) {
+    this.schema = schema;
+    this.clientOptions = clientOptions;
+    this.auth = auth;
+    this.dialect = getCrudDialect(this.schema, this.clientOptions);
+  }
+  get authType() {
+    if (!this.schema.authType) {
+      throw new InternalError('Schema does not have an "authType" specified');
+    }
+    return this.schema.authType;
+  }
+  transform(expression, context) {
+    const handler = expressionHandlers.get(expression.kind);
+    if (!handler) {
+      throw new Error(`Unsupported expression kind: ${expression.kind}`);
+    }
+    return handler.value.call(this, expression, context);
+  }
+  _literal(expr2) {
+    return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
+  }
+  _array(expr2, context) {
+    return import_kysely6.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
+  }
+  _field(expr2, context) {
+    const fieldDef = requireField(this.schema, context.model, expr2.field);
+    if (!fieldDef.relation) {
+      if (context.thisEntity) {
+        return context.thisEntity[expr2.field];
+      } else {
+        return this.createColumnRef(expr2.field, context);
+      }
+    } else {
+      const { memberFilter, memberSelect, ...restContext } = context;
+      const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
+      return {
+        ...relation,
+        where: this.mergeWhere(relation.where, memberFilter),
+        selections: memberSelect ? [
+          memberSelect
+        ] : relation.selections
+      };
+    }
+  }
+  mergeWhere(where, memberFilter) {
+    if (!where) {
+      return import_kysely6.WhereNode.create(memberFilter ?? trueNode(this.dialect));
+    }
+    if (!memberFilter) {
+      return where;
+    }
+    return import_kysely6.WhereNode.create(conjunction(this.dialect, [
+      where.where,
+      memberFilter
+    ]));
+  }
+  _null() {
+    return import_kysely6.ValueNode.createImmediate(null);
+  }
+  _binary(expr2, context) {
+    if (expr2.op === "&&") {
+      return conjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    } else if (expr2.op === "||") {
+      return disjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    }
+    if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
+      return this.transformAuthBinary(expr2);
+    }
+    const op = expr2.op;
+    if (op === "?" || op === "!" || op === "^") {
+      return this.transformCollectionPredicate(expr2, context);
+    }
+    const left = this.transform(expr2.left, context);
+    const right = this.transform(expr2.right, context);
+    if (op === "in") {
+      if (this.isNullNode(left)) {
+        return this.transformValue(false, "Boolean");
+      } else {
+        if (import_kysely6.ValueListNode.is(right)) {
+          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("in"), right);
+        } else {
+          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("="), import_kysely6.FunctionNode.create("any", [
+            right
+          ]));
+        }
+      }
+    }
+    if (this.isNullNode(right)) {
+      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is"), right) : import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is not"), right);
+    } else if (this.isNullNode(left)) {
+      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is"), import_kysely6.ValueNode.createImmediate(null)) : import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is not"), import_kysely6.ValueNode.createImmediate(null));
+    }
+    return import_kysely6.BinaryOperationNode.create(left, this.transformOperator(op), right);
+  }
+  transformCollectionPredicate(expr2, context) {
+    (0, import_tiny_invariant5.default)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth
+      });
+      return this.transformValue(value, "Boolean");
+    }
+    (0, import_tiny_invariant5.default)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
+    let newContextModel;
+    if (ExpressionUtils.isField(expr2.left)) {
+      const fieldDef = requireField(this.schema, context.model, expr2.left.field);
+      newContextModel = fieldDef.type;
+    } else {
+      (0, import_tiny_invariant5.default)(ExpressionUtils.isField(expr2.left.receiver));
+      const fieldDef = requireField(this.schema, context.model, expr2.left.receiver.field);
+      newContextModel = fieldDef.type;
+      for (const member of expr2.left.members) {
+        const memberDef = requireField(this.schema, newContextModel, member);
+        newContextModel = memberDef.type;
+      }
+    }
+    let predicateFilter = this.transform(expr2.right, {
+      ...context,
+      model: newContextModel,
+      alias: void 0,
+      thisEntity: void 0
+    });
+    if (expr2.op === "!") {
+      predicateFilter = logicalNot(predicateFilter);
+    }
+    const count = import_kysely6.FunctionNode.create("count", [
+      import_kysely6.ValueNode.createImmediate(1)
+    ]);
+    const predicateResult = (0, import_ts_pattern6.match)(expr2.op).with("?", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create(">"), import_kysely6.ValueNode.createImmediate(0))).with("!", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).with("^", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).exhaustive();
+    return this.transform(expr2.left, {
+      ...context,
+      memberSelect: import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(predicateResult, import_kysely6.IdentifierNode.create("$t"))),
+      memberFilter: predicateFilter
+    });
+  }
+  transformAuthBinary(expr2) {
+    if (expr2.op !== "==" && expr2.op !== "!=") {
+      throw new Error(`Unsupported operator for auth call: ${expr2.op}`);
+    }
+    let other;
+    if (this.isAuthCall(expr2.left)) {
+      other = expr2.right;
+    } else {
+      other = expr2.left;
+    }
+    if (ExpressionUtils.isNull(other)) {
+      return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
+    } else {
+      throw new Error("Unsupported binary expression with `auth()`");
+    }
+  }
+  transformValue(value, type) {
+    return import_kysely6.ValueNode.create(this.dialect.transformPrimitive(value, type) ?? null);
+  }
+  _unary(expr2, context) {
+    (0, import_tiny_invariant5.default)(expr2.op === "!", 'only "!" operator is supported');
+    return import_kysely6.BinaryOperationNode.create(this.transform(expr2.operand, context), this.transformOperator("!="), trueNode(this.dialect));
+  }
+  transformOperator(op) {
+    const mappedOp = (0, import_ts_pattern6.match)(op).with("==", () => "=").otherwise(() => op);
+    return import_kysely6.OperatorNode.create(mappedOp);
+  }
+  _call(expr2, context) {
+    const result = this.transformCall(expr2, context);
+    return result.toOperationNode();
+  }
+  transformCall(expr2, context) {
+    const func = this.clientOptions.functions?.[expr2.function];
+    if (!func) {
+      throw new QueryError(`Function not implemented: ${expr2.function}`);
+    }
+    const eb = (0, import_kysely6.expressionBuilder)();
+    return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
+      dialect: this.dialect,
+      model: context.model,
+      operation: context.operation
+    });
+  }
+  transformCallArg(eb, arg, context) {
+    if (ExpressionUtils.isLiteral(arg)) {
+      return eb.val(arg.value);
+    }
+    if (ExpressionUtils.isField(arg)) {
+      return context.thisEntityRaw ? eb.val(context.thisEntityRaw[arg.field]) : eb.ref(arg.field);
+    }
+    if (ExpressionUtils.isCall(arg)) {
+      return this.transformCall(arg, context);
+    }
+    if (this.isAuthMember(arg)) {
+      const valNode = this.valueMemberAccess(context.auth, arg, this.authType);
+      return valNode ? eb.val(valNode.value) : eb.val(null);
+    }
+    throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
+  }
+  _member(expr2, context) {
+    if (this.isAuthCall(expr2.receiver)) {
+      return this.valueMemberAccess(this.auth, expr2, this.authType);
+    }
+    (0, import_tiny_invariant5.default)(ExpressionUtils.isField(expr2.receiver), "expect receiver to be field expression");
+    const { memberFilter, memberSelect, ...restContext } = context;
+    const receiver = this.transform(expr2.receiver, restContext);
+    (0, import_tiny_invariant5.default)(import_kysely6.SelectQueryNode.is(receiver), "expected receiver to be select query");
+    const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+    const memberFields = [];
+    let currType = receiverField.type;
+    for (const member of expr2.members) {
+      const fieldDef = requireField(this.schema, currType, member);
+      memberFields.push({
+        fieldDef,
+        fromModel: currType
+      });
+      currType = fieldDef.type;
+    }
+    let currNode = void 0;
+    for (let i = expr2.members.length - 1; i >= 0; i--) {
+      const member = expr2.members[i];
+      const { fieldDef, fromModel } = memberFields[i];
+      if (fieldDef.relation) {
+        const relation = this.transformRelationAccess(member, fieldDef.type, {
+          ...restContext,
+          model: fromModel,
+          alias: void 0,
+          thisEntity: void 0
+        });
+        if (currNode) {
+          (0, import_tiny_invariant5.default)(import_kysely6.SelectQueryNode.is(currNode), "expected select query node");
+          currNode = {
+            ...relation,
+            selections: [
+              import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create(expr2.members[i + 1])))
+            ]
+          };
+        } else {
+          currNode = {
+            ...relation,
+            where: this.mergeWhere(relation.where, memberFilter),
+            selections: memberSelect ? [
+              memberSelect
+            ] : relation.selections
+          };
+        }
+      } else {
+        (0, import_tiny_invariant5.default)(i === expr2.members.length - 1, "plain field access must be the last segment");
+        (0, import_tiny_invariant5.default)(!currNode, "plain field access must be the last segment");
+        currNode = import_kysely6.ColumnNode.create(member);
+      }
+    }
+    return {
+      ...receiver,
+      selections: [
+        import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create("$t")))
+      ]
+    };
+  }
+  valueMemberAccess(receiver, expr2, receiverType) {
+    if (!receiver) {
+      return import_kysely6.ValueNode.createImmediate(null);
+    }
+    if (expr2.members.length !== 1) {
+      throw new Error(`Only single member access is supported`);
+    }
+    const field = expr2.members[0];
+    const fieldDef = requireField(this.schema, receiverType, field);
+    const fieldValue = receiver[field] ?? null;
+    return this.transformValue(fieldValue, fieldDef.type);
+  }
+  transformRelationAccess(field, relationModel, context) {
+    const fromModel = context.model;
+    const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
+    if (context.thisEntity) {
+      let condition;
+      if (ownedByModel) {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[fk])));
+      } else {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[pk])));
+      }
+      return {
+        kind: "SelectQueryNode",
+        from: import_kysely6.FromNode.create([
+          import_kysely6.TableNode.create(relationModel)
+        ]),
+        where: import_kysely6.WhereNode.create(condition)
+      };
+    } else {
+      let condition;
+      if (ownedByModel) {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)))));
+      } else {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)))));
+      }
+      return {
+        kind: "SelectQueryNode",
+        from: import_kysely6.FromNode.create([
+          import_kysely6.TableNode.create(relationModel)
+        ]),
+        where: import_kysely6.WhereNode.create(condition)
+      };
+    }
+  }
+  createColumnRef(column, context) {
+    return import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(column), import_kysely6.TableNode.create(context.alias ?? context.model));
+  }
+  isAuthCall(value) {
+    return ExpressionUtils.isCall(value) && value.function === "auth";
+  }
+  isAuthMember(expr2) {
+    return ExpressionUtils.isMember(expr2) && this.isAuthCall(expr2.receiver);
+  }
+  isNullNode(node) {
+    return import_kysely6.ValueNode.is(node) && node.value === null;
+  }
+};
+_ts_decorate([
+  expr("literal"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof LiteralExpression === "undefined" ? Object : LiteralExpression
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_literal", null);
+_ts_decorate([
+  expr("array"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof ArrayExpression === "undefined" ? Object : ArrayExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_array", null);
+_ts_decorate([
+  expr("field"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FieldExpression === "undefined" ? Object : FieldExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_field", null);
+_ts_decorate([
+  expr("null"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", []),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_null", null);
+_ts_decorate([
+  expr("binary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof BinaryExpression === "undefined" ? Object : BinaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_binary", null);
+_ts_decorate([
+  expr("unary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof UnaryExpression === "undefined" ? Object : UnaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_unary", null);
+_ts_decorate([
+  expr("call"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof CallExpression === "undefined" ? Object : CallExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_call", null);
+_ts_decorate([
+  expr("member"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof MemberExpression === "undefined" ? Object : MemberExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_member", null);
+
+// src/plugins/policy/policy-handler.ts
+var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
+  static {
+    __name(this, "PolicyHandler");
+  }
+  client;
+  dialect;
+  constructor(client) {
+    super(), this.client = client;
+    this.dialect = getCrudDialect(this.client.$schema, this.client.$options);
+  }
+  get kysely() {
+    return this.client.$qb;
+  }
+  async handle(node, proceed, transaction) {
+    if (!this.isCrudQueryNode(node)) {
+      throw new RejectedByPolicyError(void 0, "non-CRUD queries are not allowed");
+    }
+    if (!this.isMutationQueryNode(node)) {
+      return proceed(this.transformNode(node));
+    }
+    let mutationRequiresTransaction = false;
+    const mutationModel = this.getMutationModel(node);
+    if (import_kysely7.InsertQueryNode.is(node)) {
+      const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
+      if (constCondition === false) {
+        throw new RejectedByPolicyError(mutationModel);
+      } else if (constCondition === void 0) {
+        mutationRequiresTransaction = true;
+      }
+    }
+    if (!mutationRequiresTransaction && !node.returning) {
+      return proceed(this.transformNode(node));
+    }
+    let readBackError = false;
+    const result = await transaction(async (txProceed) => {
+      if (import_kysely7.InsertQueryNode.is(node)) {
+        await this.enforcePreCreatePolicy(node, txProceed);
+      }
+      const transformedNode = this.transformNode(node);
+      const result2 = await txProceed(transformedNode);
+      if (!this.onlyReturningId(node)) {
+        const readBackResult = await this.processReadBack(node, result2, txProceed);
+        if (readBackResult.rows.length !== result2.rows.length) {
+          readBackError = true;
+        }
+        return readBackResult;
+      } else {
+        return result2;
+      }
+    });
+    if (readBackError) {
+      throw new RejectedByPolicyError(mutationModel, "result is not allowed to be read back");
+    }
+    return result;
+  }
+  onlyReturningId(node) {
+    if (!node.returning) {
+      return true;
+    }
+    const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
+    const collector = new ColumnCollector();
+    const selectedColumns = collector.collect(node.returning);
+    return selectedColumns.every((c) => idFields.includes(c));
+  }
+  async enforcePreCreatePolicy(node, proceed) {
+    if (!node.columns || !node.values) {
+      return;
+    }
+    const model = this.getMutationModel(node);
+    const fields = node.columns.map((c) => c.column.name);
+    const valueRows = this.unwrapCreateValueRows(node.values, model, fields);
+    for (const values of valueRows) {
+      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), values.map((v) => v.raw), proceed);
+    }
+  }
+  async enforcePreCreatePolicyForOne(model, fields, values, valuesRaw, proceed) {
+    const thisEntity = {};
+    const thisEntityRaw = {};
+    for (let i = 0; i < fields.length; i++) {
+      thisEntity[fields[i]] = values[i];
+      thisEntityRaw[fields[i]] = valuesRaw[i];
+    }
+    const filter = this.buildPolicyFilter(model, void 0, "create", thisEntity, thisEntityRaw);
+    const preCreateCheck = {
+      kind: "SelectQueryNode",
+      selections: [
+        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(filter, import_kysely7.IdentifierNode.create("$condition")))
+      ]
+    };
+    const result = await proceed(preCreateCheck);
+    if (!result.rows[0]?.$condition) {
+      throw new RejectedByPolicyError(model);
+    }
+  }
+  unwrapCreateValueRows(node, model, fields) {
+    if (import_kysely7.ValuesNode.is(node)) {
+      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields));
+    } else if (import_kysely7.PrimitiveValueListNode.is(node)) {
+      return [
+        this.unwrapCreateValueRow(node.values, model, fields)
+      ];
+    } else {
+      throw new InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
+    }
+  }
+  unwrapCreateValueRow(data, model, fields) {
+    (0, import_tiny_invariant6.default)(data.length === fields.length, "data length must match fields length");
+    const result = [];
+    for (let i = 0; i < data.length; i++) {
+      const item = data[i];
+      const fieldDef = requireField(this.client.$schema, model, fields[i]);
+      if (typeof item === "object" && item && "kind" in item) {
+        (0, import_tiny_invariant6.default)(item.kind === "ValueNode", "expecting a ValueNode");
+        result.push({
+          node: import_kysely7.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type)),
+          raw: item.value
+        });
+      } else {
+        const value = this.dialect.transformPrimitive(item, fieldDef.type);
+        if (Array.isArray(value)) {
+          result.push({
+            node: import_kysely7.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
+            raw: value
+          });
+        } else {
+          result.push({
+            node: import_kysely7.ValueNode.create(value),
+            raw: value
+          });
+        }
+      }
+    }
+    return result;
+  }
+  tryGetConstantPolicy(model, operation) {
+    const policies = this.getModelPolicies(model, operation);
+    if (!policies.some((p) => p.kind === "allow")) {
+      return false;
+    } else if (
+      // unconditional deny
+      policies.some((p) => p.kind === "deny" && this.isTrueExpr(p.condition))
+    ) {
+      return false;
+    } else if (
+      // unconditional allow
+      !policies.some((p) => p.kind === "deny") && policies.some((p) => p.kind === "allow" && this.isTrueExpr(p.condition))
+    ) {
+      return true;
+    } else {
+      return void 0;
+    }
+  }
+  isTrueExpr(expr2) {
+    return ExpressionUtils.isLiteral(expr2) && expr2.value === true;
+  }
+  async processReadBack(node, result, proceed) {
+    if (result.rows.length === 0) {
+      return result;
+    }
+    if (!this.isMutationQueryNode(node) || !node.returning) {
+      return result;
+    }
+    const table = this.getMutationModel(node);
+    if (!table) {
+      throw new InternalError(`Unable to get table name for query node: ${node}`);
+    }
+    const idConditions = this.buildIdConditions(table, result.rows);
+    const policyFilter = this.buildPolicyFilter(table, void 0, "read");
+    const select = {
+      kind: "SelectQueryNode",
+      from: import_kysely7.FromNode.create([
+        import_kysely7.TableNode.create(table)
+      ]),
+      where: import_kysely7.WhereNode.create(conjunction(this.dialect, [
+        idConditions,
+        policyFilter
+      ])),
+      selections: node.returning.selections
+    };
+    const selectResult = await proceed(select);
+    return selectResult;
+  }
+  buildIdConditions(table, rows) {
+    const idFields = getIdFields(this.client.$schema, table);
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely7.BinaryOperationNode.create(import_kysely7.ColumnNode.create(field), import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.create(row[field]))))));
+  }
+  getMutationModel(node) {
+    const r = (0, import_ts_pattern7.match)(node).when(import_kysely7.InsertQueryNode.is, (node2) => getTableName(node2.into)).when(import_kysely7.UpdateQueryNode.is, (node2) => getTableName(node2.table)).when(import_kysely7.DeleteQueryNode.is, (node2) => {
+      if (node2.from.froms.length !== 1) {
+        throw new InternalError("Only one from table is supported for delete");
+      }
+      return getTableName(node2.from.froms[0]);
+    }).exhaustive();
+    if (!r) {
+      throw new InternalError(`Unable to get table name for query node: ${node}`);
+    }
+    return r;
+  }
+  isCrudQueryNode(node) {
+    return import_kysely7.SelectQueryNode.is(node) || import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
+  }
+  isMutationQueryNode(node) {
+    return import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
+  }
+  buildPolicyFilter(model, alias, operation, thisEntity, thisEntityRaw) {
+    const policies = this.getModelPolicies(model, operation);
+    if (policies.length === 0) {
+      return falseNode(this.dialect);
+    }
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
+    let combinedPolicy;
+    if (allows.length === 0) {
+      combinedPolicy = falseNode(this.dialect);
+    } else {
+      combinedPolicy = disjunction(this.dialect, allows);
+      if (denies.length !== 0) {
+        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+        combinedPolicy = conjunction(this.dialect, [
+          combinedPolicy,
+          combinedDenies
+        ]);
+      }
+    }
+    return combinedPolicy;
+  }
+  transformSelectQuery(node) {
+    let whereNode = node.where;
+    node.from?.froms.forEach((from) => {
+      const extractResult = this.extractTableName(from);
+      if (extractResult) {
+        const { model, alias } = extractResult;
+        const filter = this.buildPolicyFilter(model, alias, "read");
+        whereNode = import_kysely7.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
+          whereNode.where,
+          filter
+        ]) : filter);
+      }
+    });
+    const baseResult = super.transformSelectQuery({
+      ...node,
+      where: void 0
+    });
+    return {
+      ...baseResult,
+      where: whereNode
+    };
+  }
+  transformInsertQuery(node) {
+    const result = super.transformInsertQuery(node);
+    if (!node.returning) {
+      return result;
+    }
+    if (this.onlyReturningId(node)) {
+      return result;
+    } else {
+      const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
+      return {
+        ...result,
+        returning: import_kysely7.ReturningNode.create(idFields.map((field) => import_kysely7.SelectionNode.create(import_kysely7.ColumnNode.create(field))))
+      };
+    }
+  }
+  transformUpdateQuery(node) {
+    const result = super.transformUpdateQuery(node);
+    const mutationModel = this.getMutationModel(node);
+    const filter = this.buildPolicyFilter(mutationModel, void 0, "update");
+    return {
+      ...result,
+      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  transformDeleteQuery(node) {
+    const result = super.transformDeleteQuery(node);
+    const mutationModel = this.getMutationModel(node);
+    const filter = this.buildPolicyFilter(mutationModel, void 0, "delete");
+    return {
+      ...result,
+      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  extractTableName(from) {
+    if (import_kysely7.TableNode.is(from)) {
+      return {
+        model: from.table.identifier.name
+      };
+    }
+    if (import_kysely7.AliasNode.is(from)) {
+      const inner = this.extractTableName(from.node);
+      if (!inner) {
+        return void 0;
+      }
+      return {
+        model: inner.model,
+        alias: import_kysely7.IdentifierNode.is(from.alias) ? from.alias.name : void 0
+      };
+    } else {
+      return void 0;
+    }
+  }
+  transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw) {
+    return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
+      model,
+      alias,
+      operation,
+      thisEntity,
+      thisEntityRaw,
+      auth: this.client.$auth
+    });
+  }
+  getModelPolicies(modelName, operation) {
+    const modelDef = requireModel(this.client.$schema, modelName);
+    const result = [];
+    const extractOperations = /* @__PURE__ */ __name((expr2) => {
+      (0, import_tiny_invariant6.default)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
+      (0, import_tiny_invariant6.default)(typeof expr2.value === "string", "expecting a string literal");
+      return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
+    }, "extractOperations");
+    if (modelDef.attributes) {
+      result.push(...modelDef.attributes.filter((attr) => attr.name === "@@allow" || attr.name === "@@deny").map((attr) => ({
+        kind: attr.name === "@@allow" ? "allow" : "deny",
+        operations: extractOperations(attr.args[0].value),
+        condition: attr.args[1].value
+      })).filter((policy) => policy.operations.includes("all") || policy.operations.includes(operation)));
+    }
+    return result;
+  }
+};
+
+// src/plugins/policy/plugin.ts
+var PolicyPlugin = class {
+  static {
+    __name(this, "PolicyPlugin");
+  }
+  get id() {
+    return "policy";
+  }
+  get name() {
+    return "Access Policy";
+  }
+  get description() {
+    return "Enforces access policies defined in the schema.";
+  }
+  onKyselyQuery({ query, client, proceed, transaction }) {
+    const handler = new PolicyHandler(client);
+    return handler.handle(query, proceed, transaction);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PolicyPlugin,
+  RejectedByPolicyError
+});
+//# sourceMappingURL=policy.cjs.map