@zenstackhq/runtime 2.15.1 → 3.0.0-alpha.0

package/dist/plugins/policy.js

@@ -0,0 +1,2307 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/plugins/policy/errors.ts
+var RejectedByPolicyError = class extends Error {
+  static {
+    __name(this, "RejectedByPolicyError");
+  }
+  model;
+  reason;
+  constructor(model, reason) {
+    super(reason ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
+  }
+};
+
+// src/plugins/policy/policy-handler.ts
+import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode2, DeleteQueryNode, FromNode as FromNode2, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, PrimitiveValueListNode, RawNode, ReturningNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, TableNode as TableNode3, UpdateQueryNode, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
+import invariant6 from "tiny-invariant";
+import { match as match7 } from "ts-pattern";
+
+// src/client/crud/dialects/index.ts
+import { match as match4 } from "ts-pattern";
+
+// src/client/crud/dialects/postgresql.ts
+import { sql as sql2 } from "kysely";
+import invariant2 from "tiny-invariant";
+import { match as match2 } from "ts-pattern";
+
+// src/client/errors.ts
+var QueryError = class extends Error {
+  static {
+    __name(this, "QueryError");
+  }
+  constructor(message) {
+    super(message);
+  }
+};
+var InternalError = class extends Error {
+  static {
+    __name(this, "InternalError");
+  }
+  constructor(message) {
+    super(message);
+  }
+};
+
+// src/client/query-utils.ts
+function getModel(schema, model) {
+  return schema.models[model];
+}
+__name(getModel, "getModel");
+function requireModel(schema, model) {
+  const matchedName = Object.keys(schema.models).find((k) => k.toLowerCase() === model.toLowerCase());
+  if (!matchedName) {
+    throw new QueryError(`Model "${model}" not found`);
+  }
+  return schema.models[matchedName];
+}
+__name(requireModel, "requireModel");
+function getField(schema, model, field) {
+  const modelDef = getModel(schema, model);
+  return modelDef?.fields[field];
+}
+__name(getField, "getField");
+function requireField(schema, model, field) {
+  const modelDef = requireModel(schema, model);
+  if (!modelDef.fields[field]) {
+    throw new QueryError(`Field "${field}" not found in model "${model}"`);
+  }
+  return modelDef.fields[field];
+}
+__name(requireField, "requireField");
+function getIdFields(schema, model) {
+  const modelDef = requireModel(schema, model);
+  return modelDef?.idFields;
+}
+__name(getIdFields, "getIdFields");
+function getRelationForeignKeyFieldPairs(schema, model, relationField) {
+  const fieldDef = requireField(schema, model, relationField);
+  if (!fieldDef?.relation) {
+    throw new InternalError(`Field "${relationField}" is not a relation`);
+  }
+  if (fieldDef.relation.fields) {
+    if (!fieldDef.relation.references) {
+      throw new InternalError(`Relation references not defined for field "${relationField}"`);
+    }
+    return {
+      keyPairs: fieldDef.relation.fields.map((f, i) => ({
+        fk: f,
+        pk: fieldDef.relation.references[i]
+      })),
+      ownedByModel: true
+    };
+  } else {
+    if (!fieldDef.relation.opposite) {
+      throw new InternalError(`Opposite relation not defined for field "${relationField}"`);
+    }
+    const oppositeField = requireField(schema, fieldDef.type, fieldDef.relation.opposite);
+    if (!oppositeField.relation) {
+      throw new InternalError(`Field "${fieldDef.relation.opposite}" is not a relation`);
+    }
+    if (!oppositeField.relation.fields) {
+      throw new InternalError(`Relation fields not defined for field "${relationField}"`);
+    }
+    if (!oppositeField.relation.references) {
+      throw new InternalError(`Relation references not defined for field "${relationField}"`);
+    }
+    return {
+      keyPairs: oppositeField.relation.fields.map((f, i) => ({
+        fk: f,
+        pk: oppositeField.relation.references[i]
+      })),
+      ownedByModel: false
+    };
+  }
+}
+__name(getRelationForeignKeyFieldPairs, "getRelationForeignKeyFieldPairs");
+function getUniqueFields(schema, model) {
+  const modelDef = requireModel(schema, model);
+  const result = [];
+  for (const [key, value] of Object.entries(modelDef.uniqueFields)) {
+    if (typeof value !== "object") {
+      throw new InternalError(`Invalid unique field definition for "${key}"`);
+    }
+    if (typeof value.type === "string") {
+      result.push({
+        name: key,
+        def: requireField(schema, model, key)
+      });
+    } else {
+      result.push({
+        name: key,
+        defs: Object.fromEntries(Object.keys(value).map((k) => [
+          k,
+          requireField(schema, model, k)
+        ]))
+      });
+    }
+  }
+  return result;
+}
+__name(getUniqueFields, "getUniqueFields");
+function buildFieldRef(schema, model, field, options, eb, modelAlias) {
+  const fieldDef = requireField(schema, model, field);
+  if (!fieldDef.computed) {
+    return eb.ref(modelAlias ? `${modelAlias}.${field}` : field);
+  } else {
+    let computer;
+    if ("computedFields" in options) {
+      const computedFields = options.computedFields;
+      computer = computedFields?.[model]?.[field];
+    }
+    if (!computer) {
+      throw new QueryError(`Computed field "${field}" implementation not provided`);
+    }
+    return computer(eb);
+  }
+}
+__name(buildFieldRef, "buildFieldRef");
+function isEnum(schema, type) {
+  return !!schema.enums?.[type];
+}
+__name(isEnum, "isEnum");
+function buildJoinPairs(schema, model, modelAlias, relationField, relationModelAlias) {
+  const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(schema, model, relationField);
+  return keyPairs.map(({ fk, pk }) => {
+    if (ownedByModel) {
+      return [
+        `${relationModelAlias}.${pk}`,
+        `${modelAlias}.${fk}`
+      ];
+    } else {
+      return [
+        `${relationModelAlias}.${fk}`,
+        `${modelAlias}.${pk}`
+      ];
+    }
+  });
+}
+__name(buildJoinPairs, "buildJoinPairs");
+function makeDefaultOrderBy(schema, model) {
+  const idFields = getIdFields(schema, model);
+  return idFields.map((f) => ({
+    [f]: "asc"
+  }));
+}
+__name(makeDefaultOrderBy, "makeDefaultOrderBy");
+function getManyToManyRelation(schema, model, field) {
+  const fieldDef = requireField(schema, model, field);
+  if (!fieldDef.array || !fieldDef.relation?.opposite) {
+    return void 0;
+  }
+  const oppositeFieldDef = requireField(schema, fieldDef.type, fieldDef.relation.opposite);
+  if (oppositeFieldDef.array) {
+    const sortedModelNames = [
+      model,
+      fieldDef.type
+    ].sort();
+    return {
+      parentFkName: sortedModelNames[0] === model ? "A" : "B",
+      otherModel: fieldDef.type,
+      otherField: fieldDef.relation.opposite,
+      otherFkName: sortedModelNames[0] === fieldDef.type ? "A" : "B",
+      joinTable: fieldDef.relation.name ? `_${fieldDef.relation.name}` : `_${sortedModelNames[0]}To${sortedModelNames[1]}`
+    };
+  } else {
+    return void 0;
+  }
+}
+__name(getManyToManyRelation, "getManyToManyRelation");
+function flattenCompoundUniqueFilters(schema, model, filter) {
+  if (typeof filter !== "object" || !filter) {
+    return filter;
+  }
+  const uniqueFields = getUniqueFields(schema, model);
+  const compoundUniques = uniqueFields.filter((u) => "defs" in u);
+  if (compoundUniques.length === 0) {
+    return filter;
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(filter)) {
+    if (compoundUniques.some(({ name }) => name === key)) {
+      Object.assign(result, value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+__name(flattenCompoundUniqueFilters, "flattenCompoundUniqueFilters");
+
+// src/client/crud/dialects/base.ts
+import { sql } from "kysely";
+import invariant from "tiny-invariant";
+import { match, P } from "ts-pattern";
+
+// src/utils/enumerate.ts
+function enumerate(x) {
+  if (x === null || x === void 0) {
+    return [];
+  } else if (Array.isArray(x)) {
+    return x;
+  } else {
+    return [
+      x
+    ];
+  }
+}
+__name(enumerate, "enumerate");
+
+// src/client/crud/dialects/base.ts
+import { isPlainObject } from "is-plain-object";
+var BaseCrudDialect = class {
+  static {
+    __name(this, "BaseCrudDialect");
+  }
+  schema;
+  options;
+  constructor(schema, options) {
+    this.schema = schema;
+    this.options = options;
+  }
+  transformPrimitive(value, _type) {
+    return value;
+  }
+  buildFilter(eb, model, modelAlias, where) {
+    if (where === true || where === void 0) {
+      return this.true(eb);
+    }
+    if (where === false) {
+      return this.false(eb);
+    }
+    let result = this.true(eb);
+    const _where = flattenCompoundUniqueFilters(this.schema, model, where);
+    for (const [key, payload] of Object.entries(_where)) {
+      if (payload === void 0) {
+        continue;
+      }
+      if (key.startsWith("$")) {
+        continue;
+      }
+      if (key === "AND" || key === "OR" || key === "NOT") {
+        result = this.and(eb, result, this.buildCompositeFilter(eb, model, modelAlias, key, payload));
+        continue;
+      }
+      const fieldDef = requireField(this.schema, model, key);
+      if (fieldDef.relation) {
+        result = this.and(eb, result, this.buildRelationFilter(eb, model, modelAlias, key, fieldDef, payload));
+      } else if (fieldDef.array) {
+        result = this.and(eb, result, this.buildArrayFilter(eb, model, modelAlias, key, fieldDef, payload));
+      } else {
+        result = this.and(eb, result, this.buildPrimitiveFilter(eb, model, modelAlias, key, fieldDef, payload));
+      }
+    }
+    if ("$expr" in _where && typeof _where["$expr"] === "function") {
+      result = this.and(eb, result, _where["$expr"](eb));
+    }
+    return result;
+  }
+  buildCompositeFilter(eb, model, modelAlias, key, payload) {
+    return match(key).with("AND", () => this.and(eb, ...enumerate(payload).map((subPayload) => this.buildFilter(eb, model, modelAlias, subPayload)))).with("OR", () => this.or(eb, ...enumerate(payload).map((subPayload) => this.buildFilter(eb, model, modelAlias, subPayload)))).with("NOT", () => eb.not(this.buildCompositeFilter(eb, model, modelAlias, "AND", payload))).exhaustive();
+  }
+  buildRelationFilter(eb, model, modelAlias, field, fieldDef, payload) {
+    if (!fieldDef.array) {
+      return this.buildToOneRelationFilter(eb, model, modelAlias, field, fieldDef, payload);
+    } else {
+      return this.buildToManyRelationFilter(eb, model, modelAlias, field, fieldDef, payload);
+    }
+  }
+  buildToOneRelationFilter(eb, model, table, field, fieldDef, payload) {
+    if (payload === null) {
+      const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, field);
+      if (ownedByModel) {
+        return this.and(eb, ...keyPairs.map(({ fk }) => eb(sql.ref(`${table}.${fk}`), "is", null)));
+      } else {
+        return this.buildToOneRelationFilter(eb, model, table, field, fieldDef, {
+          is: null
+        });
+      }
+    }
+    const joinAlias = `${table}$${field}`;
+    const joinPairs = buildJoinPairs(this.schema, model, table, field, joinAlias);
+    const filterResultField = `${field}$filter`;
+    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(sql.ref(left), "=", sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
+    const conditions = [];
+    if ("is" in payload || "isNot" in payload) {
+      if ("is" in payload) {
+        if (payload.is === null) {
+          conditions.push(eb(joinSelect, "=", 0));
+        } else {
+          conditions.push(eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload.is)), ">", 0));
+        }
+      }
+      if ("isNot" in payload) {
+        if (payload.isNot === null) {
+          conditions.push(eb(joinSelect, ">", 0));
+        } else {
+          conditions.push(this.or(
+            eb,
+            // is null
+            eb(joinSelect, "=", 0),
+            // found one that matches the filter
+            eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload.isNot)), "=", 0)
+          ));
+        }
+      }
+    } else {
+      conditions.push(eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload)), ">", 0));
+    }
+    return this.and(eb, ...conditions);
+  }
+  buildToManyRelationFilter(eb, model, table, field, fieldDef, payload) {
+    if (payload === null) {
+      return eb(sql.ref(`${table}.${field}`), "is", null);
+    }
+    const relationModel = fieldDef.type;
+    const buildPkFkWhereRefs = /* @__PURE__ */ __name((eb2) => {
+      const m2m = getManyToManyRelation(this.schema, model, field);
+      if (m2m) {
+        const modelIdField = getIdFields(this.schema, model)[0];
+        const relationIdField = getIdFields(this.schema, relationModel)[0];
+        return eb2(sql.ref(`${relationModel}.${relationIdField}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", sql.ref(`${table}.${modelIdField}`)));
+      } else {
+        const relationKeyPairs = getRelationForeignKeyFieldPairs(this.schema, model, field);
+        let result2 = this.true(eb2);
+        for (const { fk, pk } of relationKeyPairs.keyPairs) {
+          if (relationKeyPairs.ownedByModel) {
+            result2 = this.and(eb2, result2, eb2(sql.ref(`${table}.${fk}`), "=", sql.ref(`${relationModel}.${pk}`)));
+          } else {
+            result2 = this.and(eb2, result2, eb2(sql.ref(`${table}.${pk}`), "=", sql.ref(`${relationModel}.${fk}`)));
+          }
+        }
+        return result2;
+      }
+    }, "buildPkFkWhereRefs");
+    let result = this.true(eb);
+    for (const [key, subPayload] of Object.entries(payload)) {
+      if (!subPayload) {
+        continue;
+      }
+      switch (key) {
+        case "some": {
+          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => this.buildFilter(eb1, relationModel, relationModel, subPayload)), ">", 0));
+          break;
+        }
+        case "every": {
+          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => eb1.not(this.buildFilter(eb1, relationModel, relationModel, subPayload))), "=", 0));
+          break;
+        }
+        case "none": {
+          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => this.buildFilter(eb1, relationModel, relationModel, subPayload)), "=", 0));
+          break;
+        }
+      }
+    }
+    return result;
+  }
+  buildArrayFilter(eb, model, modelAlias, field, fieldDef, payload) {
+    const clauses = [];
+    const fieldType = fieldDef.type;
+    const fieldRef = buildFieldRef(this.schema, model, field, this.options, eb, modelAlias);
+    for (const [key, _value] of Object.entries(payload)) {
+      if (_value === void 0) {
+        continue;
+      }
+      const value = this.transformPrimitive(_value, fieldType);
+      switch (key) {
+        case "equals": {
+          clauses.push(this.buildLiteralFilter(eb, fieldRef, fieldType, eb.val(value)));
+          break;
+        }
+        case "has": {
+          clauses.push(eb(fieldRef, "@>", eb.val([
+            value
+          ])));
+          break;
+        }
+        case "hasEvery": {
+          clauses.push(eb(fieldRef, "@>", eb.val(value)));
+          break;
+        }
+        case "hasSome": {
+          clauses.push(eb(fieldRef, "&&", eb.val(value)));
+          break;
+        }
+        case "isEmpty": {
+          clauses.push(eb(fieldRef, value === true ? "=" : "!=", eb.val([])));
+          break;
+        }
+        default: {
+          throw new InternalError(`Invalid array filter key: ${key}`);
+        }
+      }
+    }
+    return this.and(eb, ...clauses);
+  }
+  buildPrimitiveFilter(eb, model, modelAlias, field, fieldDef, payload) {
+    if (payload === null) {
+      return eb(sql.ref(`${modelAlias}.${field}`), "is", null);
+    }
+    if (isEnum(this.schema, fieldDef.type)) {
+      return this.buildEnumFilter(eb, modelAlias, field, fieldDef, payload);
+    }
+    return match(fieldDef.type).with("String", () => this.buildStringFilter(eb, modelAlias, field, payload)).with(P.union("Int", "Float", "Decimal", "BigInt"), (type) => this.buildNumberFilter(eb, model, modelAlias, field, type, payload)).with("Boolean", () => this.buildBooleanFilter(eb, modelAlias, field, payload)).with("DateTime", () => this.buildDateTimeFilter(eb, modelAlias, field, payload)).with("Bytes", () => this.buildBytesFilter(eb, modelAlias, field, payload)).exhaustive();
+  }
+  buildLiteralFilter(eb, lhs, type, rhs) {
+    return eb(lhs, "=", rhs !== null && rhs !== void 0 ? this.transformPrimitive(rhs, type) : rhs);
+  }
+  buildStandardFilter(eb, type, payload, lhs, getRhs, recurse, throwIfInvalid = false, onlyForKeys = void 0) {
+    if (payload === null || !isPlainObject(payload)) {
+      return {
+        conditions: [
+          this.buildLiteralFilter(eb, lhs, type, payload)
+        ],
+        consumedKeys: []
+      };
+    }
+    const conditions = [];
+    const consumedKeys = [];
+    for (const [op, value] of Object.entries(payload)) {
+      if (onlyForKeys && !onlyForKeys.includes(op)) {
+        continue;
+      }
+      const rhs = Array.isArray(value) ? value.map(getRhs) : getRhs(value);
+      const condition = match(op).with("equals", () => rhs === null ? eb(lhs, "is", null) : eb(lhs, "=", rhs)).with("in", () => {
+        invariant(Array.isArray(rhs), "right hand side must be an array");
+        if (rhs.length === 0) {
+          return this.false(eb);
+        } else {
+          return eb(lhs, "in", rhs);
+        }
+      }).with("notIn", () => {
+        invariant(Array.isArray(rhs), "right hand side must be an array");
+        if (rhs.length === 0) {
+          return this.true(eb);
+        } else {
+          return eb.not(eb(lhs, "in", rhs));
+        }
+      }).with("lt", () => eb(lhs, "<", rhs)).with("lte", () => eb(lhs, "<=", rhs)).with("gt", () => eb(lhs, ">", rhs)).with("gte", () => eb(lhs, ">=", rhs)).with("not", () => eb.not(recurse(value))).otherwise(() => {
+        if (throwIfInvalid) {
+          throw new QueryError(`Invalid filter key: ${op}`);
+        } else {
+          return void 0;
+        }
+      });
+      if (condition) {
+        conditions.push(condition);
+        consumedKeys.push(op);
+      }
+    }
+    return {
+      conditions,
+      consumedKeys
+    };
+  }
+  buildStringFilter(eb, table, field, payload) {
+    const fieldDef = getField(this.schema, table, field);
+    let fieldRef = fieldDef?.computed ? sql.ref(field) : sql.ref(`${table}.${field}`);
+    let insensitive = false;
+    if (payload && typeof payload === "object" && "mode" in payload && payload.mode === "insensitive") {
+      insensitive = true;
+      fieldRef = eb.fn("lower", [
+        fieldRef
+      ]);
+    }
+    const { conditions, consumedKeys } = this.buildStandardFilter(eb, "String", payload, fieldRef, (value) => this.prepStringCasing(eb, value, insensitive), (value) => this.buildStringFilter(eb, table, field, value));
+    if (payload && typeof payload === "object") {
+      for (const [key, value] of Object.entries(payload)) {
+        if (key === "mode" || consumedKeys.includes(key)) {
+          continue;
+        }
+        const condition = match(key).with("contains", () => insensitive ? eb(fieldRef, "ilike", sql.lit(`%${value}%`)) : eb(fieldRef, "like", sql.lit(`%${value}%`))).with("startsWith", () => insensitive ? eb(fieldRef, "ilike", sql.lit(`${value}%`)) : eb(fieldRef, "like", sql.lit(`${value}%`))).with("endsWith", () => insensitive ? eb(fieldRef, "ilike", sql.lit(`%${value}`)) : eb(fieldRef, "like", sql.lit(`%${value}`))).otherwise(() => {
+          throw new Error(`Invalid string filter key: ${key}`);
+        });
+        if (condition) {
+          conditions.push(condition);
+        }
+      }
+    }
+    return this.and(eb, ...conditions);
+  }
+  prepStringCasing(eb, value, toLower = true) {
+    if (typeof value === "string") {
+      return toLower ? eb.fn("lower", [
+        sql.lit(value)
+      ]) : sql.lit(value);
+    } else if (Array.isArray(value)) {
+      return value.map((v) => this.prepStringCasing(eb, v, toLower));
+    } else {
+      return value === null ? null : sql.lit(value);
+    }
+  }
+  buildNumberFilter(eb, model, table, field, type, payload) {
+    const { conditions } = this.buildStandardFilter(eb, type, payload, buildFieldRef(this.schema, model, field, this.options, eb), (value) => this.transformPrimitive(value, type), (value) => this.buildNumberFilter(eb, model, table, field, type, value));
+    return this.and(eb, ...conditions);
+  }
+  buildBooleanFilter(eb, table, field, payload) {
+    const { conditions } = this.buildStandardFilter(eb, "Boolean", payload, sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "Boolean"), (value) => this.buildBooleanFilter(eb, table, field, value), true, [
+      "equals",
+      "not"
+    ]);
+    return this.and(eb, ...conditions);
+  }
+  buildDateTimeFilter(eb, table, field, payload) {
+    const { conditions } = this.buildStandardFilter(eb, "DateTime", payload, sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "DateTime"), (value) => this.buildDateTimeFilter(eb, table, field, value), true);
+    return this.and(eb, ...conditions);
+  }
+  buildBytesFilter(eb, table, field, payload) {
+    const conditions = this.buildStandardFilter(eb, "Bytes", payload, sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "Bytes"), (value) => this.buildBytesFilter(eb, table, field, value), true, [
+      "equals",
+      "in",
+      "notIn",
+      "not"
+    ]);
+    return this.and(eb, ...conditions.conditions);
+  }
+  buildEnumFilter(eb, table, field, fieldDef, payload) {
+    const conditions = this.buildStandardFilter(eb, "String", payload, sql.ref(`${table}.${field}`), (value) => value, (value) => this.buildEnumFilter(eb, table, field, fieldDef, value), true, [
+      "equals",
+      "in",
+      "notIn",
+      "not"
+    ]);
+    return this.and(eb, ...conditions.conditions);
+  }
+  buildOrderBy(query, model, modelAlias, orderBy, useDefaultIfEmpty, negated) {
+    if (!orderBy) {
+      if (useDefaultIfEmpty) {
+        orderBy = makeDefaultOrderBy(this.schema, model);
+      } else {
+        return query;
+      }
+    }
+    let result = query;
+    enumerate(orderBy).forEach((orderBy2) => {
+      for (const [field, value] of Object.entries(orderBy2)) {
+        if (!value) {
+          continue;
+        }
+        if ([
+          "_count",
+          "_avg",
+          "_sum",
+          "_min",
+          "_max"
+        ].includes(field)) {
+          invariant(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
+          for (const [k, v] of Object.entries(value)) {
+            invariant(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+            result = result.orderBy((eb) => eb.fn(field.slice(1), [
+              sql.ref(k)
+            ]), sql.raw(this.negateSort(v, negated)));
+          }
+          continue;
+        }
+        switch (field) {
+          case "_count": {
+            invariant(value && typeof value === "object", 'invalid orderBy value for field "_count"');
+            for (const [k, v] of Object.entries(value)) {
+              invariant(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+              result = result.orderBy((eb) => eb.fn.count(sql.ref(k)), sql.raw(this.negateSort(v, negated)));
+            }
+            continue;
+          }
+          default:
+            break;
+        }
+        const fieldDef = requireField(this.schema, model, field);
+        if (!fieldDef.relation) {
+          if (value === "asc" || value === "desc") {
+            result = result.orderBy(sql.ref(`${modelAlias}.${field}`), this.negateSort(value, negated));
+          } else if (value && typeof value === "object" && "nulls" in value && "sort" in value && (value.sort === "asc" || value.sort === "desc") && (value.nulls === "first" || value.nulls === "last")) {
+            result = result.orderBy(sql.ref(`${modelAlias}.${field}`), sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
+          }
+        } else {
+          const relationModel = fieldDef.type;
+          if (fieldDef.array) {
+            if (typeof value !== "object") {
+              throw new QueryError(`invalid orderBy value for field "${field}"`);
+            }
+            if ("_count" in value) {
+              invariant(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
+              const sort = this.negateSort(value._count, negated);
+              result = result.orderBy((eb) => {
+                let subQuery = eb.selectFrom(relationModel);
+                const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
+                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(sql.ref(left), "=", sql.ref(right)))));
+                subQuery = subQuery.select(() => eb.fn.count(eb.lit(1)).as("_count"));
+                return subQuery;
+              }, sort);
+            }
+          } else {
+            result = result.leftJoin(relationModel, (join) => {
+              const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
+              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(sql.ref(left), "=", sql.ref(right)))));
+            });
+            result = this.buildOrderBy(result, fieldDef.type, relationModel, value, false, negated);
+          }
+        }
+      }
+    });
+    return result;
+  }
+  negateSort(sort, negated) {
+    return negated ? sort === "asc" ? "desc" : "asc" : sort;
+  }
+  true(eb) {
+    return eb.lit(this.transformPrimitive(true, "Boolean"));
+  }
+  false(eb) {
+    return eb.lit(this.transformPrimitive(false, "Boolean"));
+  }
+  isTrue(expression) {
+    const node = expression.toOperationNode();
+    if (node.kind !== "ValueNode") {
+      return false;
+    }
+    return node.value === true || node.value === 1;
+  }
+  isFalse(expression) {
+    const node = expression.toOperationNode();
+    if (node.kind !== "ValueNode") {
+      return false;
+    }
+    return node.value === false || node.value === 0;
+  }
+  and(eb, ...args) {
+    const nonTrueArgs = args.filter((arg) => !this.isTrue(arg));
+    if (nonTrueArgs.length === 0) {
+      return this.true(eb);
+    } else if (nonTrueArgs.length === 1) {
+      return nonTrueArgs[0];
+    } else {
+      return eb.and(nonTrueArgs);
+    }
+  }
+  or(eb, ...args) {
+    const nonFalseArgs = args.filter((arg) => !this.isFalse(arg));
+    if (nonFalseArgs.length === 0) {
+      return this.false(eb);
+    } else if (nonFalseArgs.length === 1) {
+      return nonFalseArgs[0];
+    } else {
+      return eb.or(nonFalseArgs);
+    }
+  }
+  not(eb, ...args) {
+    return eb.not(this.and(eb, ...args));
+  }
+};
+
+// src/client/crud/dialects/postgresql.ts
+var PostgresCrudDialect = class extends BaseCrudDialect {
+  static {
+    __name(this, "PostgresCrudDialect");
+  }
+  get provider() {
+    return "postgresql";
+  }
+  transformPrimitive(value, type) {
+    if (value === void 0) {
+      return value;
+    }
+    if (Array.isArray(value)) {
+      return value.map((v) => this.transformPrimitive(v, type));
+    } else {
+      return match2(type).with("DateTime", () => value instanceof Date ? value : typeof value === "string" ? new Date(value) : value).otherwise(() => value);
+    }
+  }
+  buildRelationSelection(query, model, relationField, parentAlias, payload) {
+    const joinedQuery = this.buildRelationJSON(model, query, relationField, parentAlias, payload);
+    return joinedQuery.select(`${parentAlias}$${relationField}.$j as ${relationField}`);
+  }
+  buildRelationJSON(model, qb, relationField, parentName, payload) {
+    const relationFieldDef = requireField(this.schema, model, relationField);
+    const relationModel = relationFieldDef.type;
+    return qb.leftJoinLateral((eb) => {
+      const joinTableName = `${parentName}$${relationField}`;
+      let result = eb.selectFrom(`${relationModel} as ${joinTableName}`);
+      result = eb.selectFrom(() => {
+        let subQuery = eb.selectFrom(`${relationModel}`).selectAll();
+        if (payload && typeof payload === "object") {
+          if (payload.where) {
+            subQuery = subQuery.where((eb2) => this.buildFilter(eb2, relationModel, relationModel, payload.where));
+          }
+          const skip = payload.skip;
+          let take = payload.take;
+          let negateOrderBy = false;
+          if (take !== void 0 && take < 0) {
+            negateOrderBy = true;
+            take = -take;
+          }
+          subQuery = this.buildSkipTake(subQuery, skip, take);
+          subQuery = this.buildOrderBy(subQuery, relationModel, relationModel, payload.orderBy, skip !== void 0 || take !== void 0, negateOrderBy);
+        }
+        const m2m = getManyToManyRelation(this.schema, model, relationField);
+        if (m2m) {
+          const parentIds = getIdFields(this.schema, model);
+          const relationIds = getIdFields(this.schema, relationModel);
+          invariant2(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+          invariant2(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+          subQuery = subQuery.where(eb(eb.ref(`${relationModel}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentName}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
+        } else {
+          const joinPairs = buildJoinPairs(this.schema, model, parentName, relationField, relationModel);
+          subQuery = subQuery.where((eb2) => this.and(eb2, ...joinPairs.map(([left, right]) => eb2(sql2.ref(left), "=", sql2.ref(right)))));
+        }
+        return subQuery.as(joinTableName);
+      });
+      result = this.buildRelationObjectSelect(relationModel, relationField, relationFieldDef, result, payload, parentName);
+      result = this.buildRelationJoins(relationModel, relationField, result, payload, parentName);
+      return result.as(joinTableName);
+    }, (join) => join.onTrue());
+  }
+  buildRelationObjectSelect(relationModel, relationField, relationFieldDef, qb, payload, parentName) {
+    qb = qb.select((eb) => {
+      const objArgs = this.buildRelationObjectArgs(relationModel, relationField, eb, payload, parentName);
+      if (relationFieldDef.array) {
+        return eb.fn.coalesce(sql2`jsonb_agg(jsonb_build_object(${sql2.join(objArgs)}))`, sql2`'[]'::jsonb`).as("$j");
+      } else {
+        return sql2`jsonb_build_object(${sql2.join(objArgs)})`.as("$j");
+      }
+    });
+    return qb;
+  }
+  buildRelationObjectArgs(relationModel, relationField, eb, payload, parentName) {
+    const relationModelDef = requireModel(this.schema, relationModel);
+    const objArgs = [];
+    if (payload === true || !payload.select) {
+      objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
+        sql2.lit(field),
+        buildFieldRef(this.schema, relationModel, field, this.options, eb)
+      ]).flatMap((v) => v));
+    } else if (payload.select) {
+      objArgs.push(...Object.entries(payload.select).filter(([, value]) => value).map(([field]) => [
+        sql2.lit(field),
+        buildFieldRef(this.schema, relationModel, field, this.options, eb)
+      ]).flatMap((v) => v));
+    }
+    if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
+      objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field]) => [
+        sql2.lit(field),
+        eb.ref(`${parentName}$${relationField}$${field}.$j`)
+      ]).flatMap((v) => v));
+    }
+    return objArgs;
+  }
+  buildRelationJoins(model, relationField, qb, payload, parentName) {
+    let result = qb;
+    if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
+      Object.entries(payload.include).filter(([, value]) => value).forEach(([field, value]) => {
+        result = this.buildRelationJSON(model, result, field, `${parentName}$${relationField}`, value);
+      });
+    }
+    return result;
+  }
+  buildSkipTake(query, skip, take) {
+    if (take !== void 0) {
+      query = query.limit(take);
+    }
+    if (skip !== void 0) {
+      query = query.offset(skip);
+    }
+    return query;
+  }
+  buildJsonObject(eb, value) {
+    return eb.fn("jsonb_build_object", Object.entries(value).flatMap(([key, value2]) => [
+      sql2.lit(key),
+      value2
+    ]));
+  }
+  get supportsUpdateWithLimit() {
+    return false;
+  }
+  get supportsDeleteWithLimit() {
+    return false;
+  }
+  get supportsDistinctOn() {
+    return true;
+  }
+  buildArrayLength(eb, array) {
+    return eb.fn("array_length", [
+      array
+    ]);
+  }
+  buildArrayLiteralSQL(values) {
+    if (values.length === 0) {
+      return "{}";
+    } else {
+      return `ARRAY[${values.map((v) => typeof v === "string" ? `'${v}'` : v)}]`;
+    }
+  }
+};
+
+// src/client/crud/dialects/sqlite.ts
+import { sql as sql3 } from "kysely";
+import invariant3 from "tiny-invariant";
+import { match as match3 } from "ts-pattern";
+var SqliteCrudDialect = class extends BaseCrudDialect {
+  static {
+    __name(this, "SqliteCrudDialect");
+  }
+  get provider() {
+    return "sqlite";
+  }
+  transformPrimitive(value, type) {
+    if (value === void 0) {
+      return value;
+    }
+    if (Array.isArray(value)) {
+      return value.map((v) => this.transformPrimitive(v, type));
+    } else {
+      return match3(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).otherwise(() => value);
+    }
+  }
+  buildRelationSelection(query, model, relationField, parentAlias, payload) {
+    return query.select((eb) => this.buildRelationJSON(model, eb, relationField, parentAlias, payload).as(relationField));
+  }
+  buildRelationJSON(model, eb, relationField, parentName, payload) {
+    const relationFieldDef = requireField(this.schema, model, relationField);
+    const relationModel = relationFieldDef.type;
+    const relationModelDef = requireModel(this.schema, relationModel);
+    const subQueryName = `${parentName}$${relationField}`;
+    let tbl = eb.selectFrom(() => {
+      let subQuery = eb.selectFrom(relationModel).selectAll();
+      if (payload && typeof payload === "object") {
+        if (payload.where) {
+          subQuery = subQuery.where((eb2) => this.buildFilter(eb2, relationModel, relationModel, payload.where));
+        }
+        const skip = payload.skip;
+        let take = payload.take;
+        let negateOrderBy = false;
+        if (take !== void 0 && take < 0) {
+          negateOrderBy = true;
+          take = -take;
+        }
+        subQuery = this.buildSkipTake(subQuery, skip, take);
+        subQuery = this.buildOrderBy(subQuery, relationModel, relationModel, payload.orderBy, skip !== void 0 || take !== void 0, negateOrderBy);
+      }
+      const m2m = getManyToManyRelation(this.schema, model, relationField);
+      if (m2m) {
+        const parentIds = getIdFields(this.schema, model);
+        const relationIds = getIdFields(this.schema, relationModel);
+        invariant3(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+        invariant3(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+        subQuery = subQuery.where(eb(eb.ref(`${relationModel}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentName}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
+      } else {
+        const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
+        keyPairs.forEach(({ fk, pk }) => {
+          if (ownedByModel) {
+            subQuery = subQuery.whereRef(`${relationModel}.${pk}`, "=", `${parentName}.${fk}`);
+          } else {
+            subQuery = subQuery.whereRef(`${relationModel}.${fk}`, "=", `${parentName}.${pk}`);
+          }
+        });
+      }
+      return subQuery.as(subQueryName);
+    });
+    tbl = tbl.select(() => {
+      const objArgs = [];
+      if (payload === true || !payload.select) {
+        objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
+          sql3.lit(field),
+          buildFieldRef(this.schema, relationModel, field, this.options, eb)
+        ]).flatMap((v) => v));
+      } else if (payload.select) {
+        objArgs.push(...Object.entries(payload.select).filter(([, value]) => value).map(([field, value]) => {
+          const fieldDef = requireField(this.schema, relationModel, field);
+          if (fieldDef.relation) {
+            const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentName}$${relationField}`, value);
+            return [
+              sql3.lit(field),
+              subJson
+            ];
+          } else {
+            return [
+              sql3.lit(field),
+              buildFieldRef(this.schema, relationModel, field, this.options, eb)
+            ];
+          }
+        }).flatMap((v) => v));
+      }
+      if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
+        objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field, value]) => {
+          const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentName}$${relationField}`, value);
+          return [
+            sql3.lit(field),
+            subJson
+          ];
+        }).flatMap((v) => v));
+      }
+      if (relationFieldDef.array) {
+        return eb.fn.coalesce(sql3`json_group_array(json_object(${sql3.join(objArgs)}))`, sql3`json_array()`).as("$j");
+      } else {
+        return sql3`json_object(${sql3.join(objArgs)})`.as("data");
+      }
+    });
+    return tbl;
+  }
+  buildSkipTake(query, skip, take) {
+    if (take !== void 0) {
+      query = query.limit(take);
+    }
+    if (skip !== void 0) {
+      query = query.offset(skip);
+      if (take === void 0) {
+        query = query.limit(-1);
+      }
+    }
+    return query;
+  }
+  buildJsonObject(eb, value) {
+    return eb.fn("json_object", Object.entries(value).flatMap(([key, value2]) => [
+      sql3.lit(key),
+      value2
+    ]));
+  }
+  get supportsUpdateWithLimit() {
+    return false;
+  }
+  get supportsDeleteWithLimit() {
+    return false;
+  }
+  get supportsDistinctOn() {
+    return false;
+  }
+  buildArrayLength(eb, array) {
+    return eb.fn("json_array_length", [
+      array
+    ]);
+  }
+  buildArrayLiteralSQL(_values) {
+    throw new Error("SQLite does not support array literals");
+  }
+};
+
+// src/client/crud/dialects/index.ts
+function getCrudDialect(schema, options) {
+  return match4(schema.provider.type).with("sqlite", () => new SqliteCrudDialect(schema, options)).with("postgresql", () => new PostgresCrudDialect(schema, options)).exhaustive();
+}
+__name(getCrudDialect, "getCrudDialect");
+
+// src/schema/expression.ts
+var ExpressionUtils = {
+  literal: /* @__PURE__ */ __name((value) => {
+    return {
+      kind: "literal",
+      value
+    };
+  }, "literal"),
+  array: /* @__PURE__ */ __name((items) => {
+    return {
+      kind: "array",
+      items
+    };
+  }, "array"),
+  call: /* @__PURE__ */ __name((functionName, args) => {
+    return {
+      kind: "call",
+      function: functionName,
+      args
+    };
+  }, "call"),
+  binary: /* @__PURE__ */ __name((left, op, right) => {
+    return {
+      kind: "binary",
+      op,
+      left,
+      right
+    };
+  }, "binary"),
+  unary: /* @__PURE__ */ __name((op, operand) => {
+    return {
+      kind: "unary",
+      op,
+      operand
+    };
+  }, "unary"),
+  field: /* @__PURE__ */ __name((field) => {
+    return {
+      kind: "field",
+      field
+    };
+  }, "field"),
+  member: /* @__PURE__ */ __name((receiver, members) => {
+    return {
+      kind: "member",
+      receiver,
+      members
+    };
+  }, "member"),
+  _this: /* @__PURE__ */ __name(() => {
+    return {
+      kind: "this"
+    };
+  }, "_this"),
+  _null: /* @__PURE__ */ __name(() => {
+    return {
+      kind: "null"
+    };
+  }, "_null"),
+  and: /* @__PURE__ */ __name((expr2, ...expressions) => {
+    return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "&&", exp), expr2);
+  }, "and"),
+  or: /* @__PURE__ */ __name((expr2, ...expressions) => {
+    return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "||", exp), expr2);
+  }, "or"),
+  is: /* @__PURE__ */ __name((value, kind) => {
+    return !!value && typeof value === "object" && "kind" in value && value.kind === kind;
+  }, "is"),
+  isLiteral: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "literal"), "isLiteral"),
+  isArray: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "array"), "isArray"),
+  isCall: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "call"), "isCall"),
+  isNull: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "null"), "isNull"),
+  isThis: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "this"), "isThis"),
+  isUnary: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "unary"), "isUnary"),
+  isBinary: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "binary"), "isBinary"),
+  isField: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "field"), "isField"),
+  isMember: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "member"), "isMember")
+};
+
+// src/utils/default-operation-node-visitor.ts
+import { OperationNodeVisitor } from "kysely";
+var DefaultOperationNodeVisitor = class extends OperationNodeVisitor {
+  static {
+    __name(this, "DefaultOperationNodeVisitor");
+  }
+  defaultVisit(node) {
+    Object.values(node).forEach((value) => {
+      if (!value) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((el) => this.defaultVisit(el));
+      }
+      if (typeof value === "object" && "kind" in value && typeof value.kind === "string") {
+        this.visitNode(value);
+      }
+    });
+  }
+  visitSelectQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitSelection(node) {
+    this.defaultVisit(node);
+  }
+  visitColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitAlias(node) {
+    this.defaultVisit(node);
+  }
+  visitTable(node) {
+    this.defaultVisit(node);
+  }
+  visitFrom(node) {
+    this.defaultVisit(node);
+  }
+  visitReference(node) {
+    this.defaultVisit(node);
+  }
+  visitAnd(node) {
+    this.defaultVisit(node);
+  }
+  visitOr(node) {
+    this.defaultVisit(node);
+  }
+  visitValueList(node) {
+    this.defaultVisit(node);
+  }
+  visitParens(node) {
+    this.defaultVisit(node);
+  }
+  visitJoin(node) {
+    this.defaultVisit(node);
+  }
+  visitRaw(node) {
+    this.defaultVisit(node);
+  }
+  visitWhere(node) {
+    this.defaultVisit(node);
+  }
+  visitInsertQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitDeleteQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitReturning(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateTable(node) {
+    this.defaultVisit(node);
+  }
+  visitAddColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitColumnDefinition(node) {
+    this.defaultVisit(node);
+  }
+  visitDropTable(node) {
+    this.defaultVisit(node);
+  }
+  visitOrderBy(node) {
+    this.defaultVisit(node);
+  }
+  visitOrderByItem(node) {
+    this.defaultVisit(node);
+  }
+  visitGroupBy(node) {
+    this.defaultVisit(node);
+  }
+  visitGroupByItem(node) {
+    this.defaultVisit(node);
+  }
+  visitUpdateQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitColumnUpdate(node) {
+    this.defaultVisit(node);
+  }
+  visitLimit(node) {
+    this.defaultVisit(node);
+  }
+  visitOffset(node) {
+    this.defaultVisit(node);
+  }
+  visitOnConflict(node) {
+    this.defaultVisit(node);
+  }
+  visitOnDuplicateKey(node) {
+    this.defaultVisit(node);
+  }
+  visitCheckConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitDataType(node) {
+    this.defaultVisit(node);
+  }
+  visitSelectAll(node) {
+    this.defaultVisit(node);
+  }
+  visitIdentifier(node) {
+    this.defaultVisit(node);
+  }
+  visitSchemableIdentifier(node) {
+    this.defaultVisit(node);
+  }
+  visitValue(node) {
+    this.defaultVisit(node);
+  }
+  visitPrimitiveValueList(node) {
+    this.defaultVisit(node);
+  }
+  visitOperator(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateIndex(node) {
+    this.defaultVisit(node);
+  }
+  visitDropIndex(node) {
+    this.defaultVisit(node);
+  }
+  visitList(node) {
+    this.defaultVisit(node);
+  }
+  visitPrimaryKeyConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitUniqueConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitReferences(node) {
+    this.defaultVisit(node);
+  }
+  visitWith(node) {
+    this.defaultVisit(node);
+  }
+  visitCommonTableExpression(node) {
+    this.defaultVisit(node);
+  }
+  visitCommonTableExpressionName(node) {
+    this.defaultVisit(node);
+  }
+  visitHaving(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateSchema(node) {
+    this.defaultVisit(node);
+  }
+  visitDropSchema(node) {
+    this.defaultVisit(node);
+  }
+  visitAlterTable(node) {
+    this.defaultVisit(node);
+  }
+  visitDropColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitRenameColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitAlterColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitModifyColumn(node) {
+    this.defaultVisit(node);
+  }
+  visitAddConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitDropConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitForeignKeyConstraint(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateView(node) {
+    this.defaultVisit(node);
+  }
+  visitDropView(node) {
+    this.defaultVisit(node);
+  }
+  visitGenerated(node) {
+    this.defaultVisit(node);
+  }
+  visitDefaultValue(node) {
+    this.defaultVisit(node);
+  }
+  visitOn(node) {
+    this.defaultVisit(node);
+  }
+  visitValues(node) {
+    this.defaultVisit(node);
+  }
+  visitSelectModifier(node) {
+    this.defaultVisit(node);
+  }
+  visitCreateType(node) {
+    this.defaultVisit(node);
+  }
+  visitDropType(node) {
+    this.defaultVisit(node);
+  }
+  visitExplain(node) {
+    this.defaultVisit(node);
+  }
+  visitDefaultInsertValue(node) {
+    this.defaultVisit(node);
+  }
+  visitAggregateFunction(node) {
+    this.defaultVisit(node);
+  }
+  visitOver(node) {
+    this.defaultVisit(node);
+  }
+  visitPartitionBy(node) {
+    this.defaultVisit(node);
+  }
+  visitPartitionByItem(node) {
+    this.defaultVisit(node);
+  }
+  visitSetOperation(node) {
+    this.defaultVisit(node);
+  }
+  visitBinaryOperation(node) {
+    this.defaultVisit(node);
+  }
+  visitUnaryOperation(node) {
+    this.defaultVisit(node);
+  }
+  visitUsing(node) {
+    this.defaultVisit(node);
+  }
+  visitFunction(node) {
+    this.defaultVisit(node);
+  }
+  visitCase(node) {
+    this.defaultVisit(node);
+  }
+  visitWhen(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONReference(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONPath(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONPathLeg(node) {
+    this.defaultVisit(node);
+  }
+  visitJSONOperatorChain(node) {
+    this.defaultVisit(node);
+  }
+  visitTuple(node) {
+    this.defaultVisit(node);
+  }
+  visitMergeQuery(node) {
+    this.defaultVisit(node);
+  }
+  visitMatched(node) {
+    this.defaultVisit(node);
+  }
+  visitAddIndex(node) {
+    this.defaultVisit(node);
+  }
+  visitCast(node) {
+    this.defaultVisit(node);
+  }
+  visitFetch(node) {
+    this.defaultVisit(node);
+  }
+  visitTop(node) {
+    this.defaultVisit(node);
+  }
+  visitOutput(node) {
+    this.defaultVisit(node);
+  }
+};
+
+// src/plugins/policy/column-collector.ts
+var ColumnCollector = class extends DefaultOperationNodeVisitor {
+  static {
+    __name(this, "ColumnCollector");
+  }
+  columns = [];
+  collect(node) {
+    this.columns = [];
+    this.visitNode(node);
+    return this.columns;
+  }
+  visitColumn(node) {
+    if (!this.columns.includes(node.column.name)) {
+      this.columns.push(node.column.name);
+    }
+  }
+};
+
+// src/plugins/policy/expression-transformer.ts
+import { AliasNode as AliasNode2, BinaryOperationNode as BinaryOperationNode2, ColumnNode, expressionBuilder, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode2, SelectionNode, SelectQueryNode, TableNode as TableNode2, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
+import invariant5 from "tiny-invariant";
+import { match as match6 } from "ts-pattern";
+
+// src/plugins/policy/expression-evaluator.ts
+import invariant4 from "tiny-invariant";
+import { match as match5 } from "ts-pattern";
+var ExpressionEvaluator = class {
+  static {
+    __name(this, "ExpressionEvaluator");
+  }
+  evaluate(expression, context) {
+    const result = match5(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
+    return result ?? null;
+  }
+  evaluateCall(expr2, context) {
+    if (expr2.function === "auth") {
+      return context.auth;
+    } else {
+      throw new Error(`Unsupported call expression function: ${expr2.function}`);
+    }
+  }
+  evaluateUnary(expr2, context) {
+    return match5(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
+  }
+  evaluateMember(expr2, context) {
+    let val = this.evaluate(expr2.receiver, context);
+    for (const member of expr2.members) {
+      val = val?.[member];
+    }
+    return val;
+  }
+  evaluateLiteral(expr2) {
+    return expr2.value;
+  }
+  evaluateField(expr2, context) {
+    return context.thisValue?.[expr2.field];
+  }
+  evaluateArray(expr2, context) {
+    return expr2.items.map((item) => this.evaluate(item, context));
+  }
+  evaluateBinary(expr2, context) {
+    if (expr2.op === "?" || expr2.op === "!" || expr2.op === "^") {
+      return this.evaluateCollectionPredicate(expr2, context);
+    }
+    const left = this.evaluate(expr2.left, context);
+    const right = this.evaluate(expr2.right, context);
+    return match5(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
+      const _right = right ?? [];
+      invariant4(Array.isArray(_right), 'expected array for "in" operator');
+      return _right.includes(left);
+    }).exhaustive();
+  }
+  evaluateCollectionPredicate(expr2, context) {
+    const op = expr2.op;
+    invariant4(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    const left = this.evaluate(expr2.left, context);
+    if (!left) {
+      return false;
+    }
+    invariant4(Array.isArray(left), "expected array");
+    return match5(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("^", () => !left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).exhaustive();
+  }
+};
+
+// src/plugins/policy/utils.ts
+import { AliasNode, AndNode, BinaryOperationNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode, TableNode, UnaryOperationNode, ValueNode } from "kysely";
+function trueNode(dialect) {
+  return ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean"));
+}
+__name(trueNode, "trueNode");
+function falseNode(dialect) {
+  return ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean"));
+}
+__name(falseNode, "falseNode");
+function isTrueNode(node) {
+  return ValueNode.is(node) && (node.value === true || node.value === 1);
+}
+__name(isTrueNode, "isTrueNode");
+function isFalseNode(node) {
+  return ValueNode.is(node) && (node.value === false || node.value === 0);
+}
+__name(isFalseNode, "isFalseNode");
+function conjunction(dialect, nodes) {
+  if (nodes.some(isFalseNode)) {
+    return falseNode(dialect);
+  }
+  const items = nodes.filter((n) => !isTrueNode(n));
+  if (items.length === 0) {
+    return trueNode(dialect);
+  }
+  return items.reduce((acc, node) => OrNode.is(node) ? AndNode.create(acc, ParensNode.create(node)) : AndNode.create(acc, node));
+}
+__name(conjunction, "conjunction");
+function disjunction(dialect, nodes) {
+  if (nodes.some(isTrueNode)) {
+    return trueNode(dialect);
+  }
+  const items = nodes.filter((n) => !isFalseNode(n));
+  if (items.length === 0) {
+    return falseNode(dialect);
+  }
+  return items.reduce((acc, node) => AndNode.is(node) ? OrNode.create(acc, ParensNode.create(node)) : OrNode.create(acc, node));
+}
+__name(disjunction, "disjunction");
+function logicalNot(node) {
+  return UnaryOperationNode.create(OperatorNode.create("not"), AndNode.is(node) || OrNode.is(node) ? ParensNode.create(node) : node);
+}
+__name(logicalNot, "logicalNot");
+function buildIsFalse(node, dialect) {
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  } else if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  return BinaryOperationNode.create(
+    // coalesce so null is treated as false
+    FunctionNode.create("coalesce", [
+      node,
+      falseNode(dialect)
+    ]),
+    OperatorNode.create("="),
+    falseNode(dialect)
+  );
+}
+__name(buildIsFalse, "buildIsFalse");
+function getTableName(node) {
+  if (!node) {
+    return node;
+  }
+  if (TableNode.is(node)) {
+    return node.table.identifier.name;
+  } else if (AliasNode.is(node)) {
+    return getTableName(node.node);
+  } else if (ReferenceNode.is(node) && node.table) {
+    return getTableName(node.table);
+  }
+  return void 0;
+}
+__name(getTableName, "getTableName");
+
+// src/plugins/policy/expression-transformer.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+var expressionHandlers = /* @__PURE__ */ new Map();
+function expr(kind) {
+  return function(_target, _propertyKey, descriptor) {
+    if (!expressionHandlers.get(kind)) {
+      expressionHandlers.set(kind, descriptor);
+    }
+    return descriptor;
+  };
+}
+__name(expr, "expr");
+var ExpressionTransformer = class {
+  static {
+    __name(this, "ExpressionTransformer");
+  }
+  schema;
+  clientOptions;
+  auth;
+  dialect;
+  constructor(schema, clientOptions, auth) {
+    this.schema = schema;
+    this.clientOptions = clientOptions;
+    this.auth = auth;
+    this.dialect = getCrudDialect(this.schema, this.clientOptions);
+  }
+  get authType() {
+    if (!this.schema.authType) {
+      throw new InternalError('Schema does not have an "authType" specified');
+    }
+    return this.schema.authType;
+  }
+  transform(expression, context) {
+    const handler = expressionHandlers.get(expression.kind);
+    if (!handler) {
+      throw new Error(`Unsupported expression kind: ${expression.kind}`);
+    }
+    return handler.value.call(this, expression, context);
+  }
+  _literal(expr2) {
+    return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
+  }
+  _array(expr2, context) {
+    return ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
+  }
+  _field(expr2, context) {
+    const fieldDef = requireField(this.schema, context.model, expr2.field);
+    if (!fieldDef.relation) {
+      if (context.thisEntity) {
+        return context.thisEntity[expr2.field];
+      } else {
+        return this.createColumnRef(expr2.field, context);
+      }
+    } else {
+      const { memberFilter, memberSelect, ...restContext } = context;
+      const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
+      return {
+        ...relation,
+        where: this.mergeWhere(relation.where, memberFilter),
+        selections: memberSelect ? [
+          memberSelect
+        ] : relation.selections
+      };
+    }
+  }
+  mergeWhere(where, memberFilter) {
+    if (!where) {
+      return WhereNode.create(memberFilter ?? trueNode(this.dialect));
+    }
+    if (!memberFilter) {
+      return where;
+    }
+    return WhereNode.create(conjunction(this.dialect, [
+      where.where,
+      memberFilter
+    ]));
+  }
+  _null() {
+    return ValueNode2.createImmediate(null);
+  }
+  _binary(expr2, context) {
+    if (expr2.op === "&&") {
+      return conjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    } else if (expr2.op === "||") {
+      return disjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    }
+    if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
+      return this.transformAuthBinary(expr2);
+    }
+    const op = expr2.op;
+    if (op === "?" || op === "!" || op === "^") {
+      return this.transformCollectionPredicate(expr2, context);
+    }
+    const left = this.transform(expr2.left, context);
+    const right = this.transform(expr2.right, context);
+    if (op === "in") {
+      if (this.isNullNode(left)) {
+        return this.transformValue(false, "Boolean");
+      } else {
+        if (ValueListNode.is(right)) {
+          return BinaryOperationNode2.create(left, OperatorNode2.create("in"), right);
+        } else {
+          return BinaryOperationNode2.create(left, OperatorNode2.create("="), FunctionNode2.create("any", [
+            right
+          ]));
+        }
+      }
+    }
+    if (this.isNullNode(right)) {
+      return expr2.op === "==" ? BinaryOperationNode2.create(left, OperatorNode2.create("is"), right) : BinaryOperationNode2.create(left, OperatorNode2.create("is not"), right);
+    } else if (this.isNullNode(left)) {
+      return expr2.op === "==" ? BinaryOperationNode2.create(right, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(right, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+    }
+    return BinaryOperationNode2.create(left, this.transformOperator(op), right);
+  }
+  transformCollectionPredicate(expr2, context) {
+    invariant5(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth
+      });
+      return this.transformValue(value, "Boolean");
+    }
+    invariant5(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
+    let newContextModel;
+    if (ExpressionUtils.isField(expr2.left)) {
+      const fieldDef = requireField(this.schema, context.model, expr2.left.field);
+      newContextModel = fieldDef.type;
+    } else {
+      invariant5(ExpressionUtils.isField(expr2.left.receiver));
+      const fieldDef = requireField(this.schema, context.model, expr2.left.receiver.field);
+      newContextModel = fieldDef.type;
+      for (const member of expr2.left.members) {
+        const memberDef = requireField(this.schema, newContextModel, member);
+        newContextModel = memberDef.type;
+      }
+    }
+    let predicateFilter = this.transform(expr2.right, {
+      ...context,
+      model: newContextModel,
+      alias: void 0,
+      thisEntity: void 0
+    });
+    if (expr2.op === "!") {
+      predicateFilter = logicalNot(predicateFilter);
+    }
+    const count = FunctionNode2.create("count", [
+      ValueNode2.createImmediate(1)
+    ]);
+    const predicateResult = match6(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode2.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).exhaustive();
+    return this.transform(expr2.left, {
+      ...context,
+      memberSelect: SelectionNode.create(AliasNode2.create(predicateResult, IdentifierNode.create("$t"))),
+      memberFilter: predicateFilter
+    });
+  }
+  transformAuthBinary(expr2) {
+    if (expr2.op !== "==" && expr2.op !== "!=") {
+      throw new Error(`Unsupported operator for auth call: ${expr2.op}`);
+    }
+    let other;
+    if (this.isAuthCall(expr2.left)) {
+      other = expr2.right;
+    } else {
+      other = expr2.left;
+    }
+    if (ExpressionUtils.isNull(other)) {
+      return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
+    } else {
+      throw new Error("Unsupported binary expression with `auth()`");
+    }
+  }
+  transformValue(value, type) {
+    return ValueNode2.create(this.dialect.transformPrimitive(value, type) ?? null);
+  }
+  _unary(expr2, context) {
+    invariant5(expr2.op === "!", 'only "!" operator is supported');
+    return BinaryOperationNode2.create(this.transform(expr2.operand, context), this.transformOperator("!="), trueNode(this.dialect));
+  }
+  transformOperator(op) {
+    const mappedOp = match6(op).with("==", () => "=").otherwise(() => op);
+    return OperatorNode2.create(mappedOp);
+  }
+  _call(expr2, context) {
+    const result = this.transformCall(expr2, context);
+    return result.toOperationNode();
+  }
+  transformCall(expr2, context) {
+    const func = this.clientOptions.functions?.[expr2.function];
+    if (!func) {
+      throw new QueryError(`Function not implemented: ${expr2.function}`);
+    }
+    const eb = expressionBuilder();
+    return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
+      dialect: this.dialect,
+      model: context.model,
+      operation: context.operation
+    });
+  }
+  transformCallArg(eb, arg, context) {
+    if (ExpressionUtils.isLiteral(arg)) {
+      return eb.val(arg.value);
+    }
+    if (ExpressionUtils.isField(arg)) {
+      return context.thisEntityRaw ? eb.val(context.thisEntityRaw[arg.field]) : eb.ref(arg.field);
+    }
+    if (ExpressionUtils.isCall(arg)) {
+      return this.transformCall(arg, context);
+    }
+    if (this.isAuthMember(arg)) {
+      const valNode = this.valueMemberAccess(context.auth, arg, this.authType);
+      return valNode ? eb.val(valNode.value) : eb.val(null);
+    }
+    throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
+  }
+  _member(expr2, context) {
+    if (this.isAuthCall(expr2.receiver)) {
+      return this.valueMemberAccess(this.auth, expr2, this.authType);
+    }
+    invariant5(ExpressionUtils.isField(expr2.receiver), "expect receiver to be field expression");
+    const { memberFilter, memberSelect, ...restContext } = context;
+    const receiver = this.transform(expr2.receiver, restContext);
+    invariant5(SelectQueryNode.is(receiver), "expected receiver to be select query");
+    const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+    const memberFields = [];
+    let currType = receiverField.type;
+    for (const member of expr2.members) {
+      const fieldDef = requireField(this.schema, currType, member);
+      memberFields.push({
+        fieldDef,
+        fromModel: currType
+      });
+      currType = fieldDef.type;
+    }
+    let currNode = void 0;
+    for (let i = expr2.members.length - 1; i >= 0; i--) {
+      const member = expr2.members[i];
+      const { fieldDef, fromModel } = memberFields[i];
+      if (fieldDef.relation) {
+        const relation = this.transformRelationAccess(member, fieldDef.type, {
+          ...restContext,
+          model: fromModel,
+          alias: void 0,
+          thisEntity: void 0
+        });
+        if (currNode) {
+          invariant5(SelectQueryNode.is(currNode), "expected select query node");
+          currNode = {
+            ...relation,
+            selections: [
+              SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create(expr2.members[i + 1])))
+            ]
+          };
+        } else {
+          currNode = {
+            ...relation,
+            where: this.mergeWhere(relation.where, memberFilter),
+            selections: memberSelect ? [
+              memberSelect
+            ] : relation.selections
+          };
+        }
+      } else {
+        invariant5(i === expr2.members.length - 1, "plain field access must be the last segment");
+        invariant5(!currNode, "plain field access must be the last segment");
+        currNode = ColumnNode.create(member);
+      }
+    }
+    return {
+      ...receiver,
+      selections: [
+        SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create("$t")))
+      ]
+    };
+  }
+  valueMemberAccess(receiver, expr2, receiverType) {
+    if (!receiver) {
+      return ValueNode2.createImmediate(null);
+    }
+    if (expr2.members.length !== 1) {
+      throw new Error(`Only single member access is supported`);
+    }
+    const field = expr2.members[0];
+    const fieldDef = requireField(this.schema, receiverType, field);
+    const fieldValue = receiver[field] ?? null;
+    return this.transformValue(fieldValue, fieldDef.type);
+  }
+  transformRelationAccess(field, relationModel, context) {
+    const fromModel = context.model;
+    const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
+    if (context.thisEntity) {
+      let condition;
+      if (ownedByModel) {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(relationModel)), OperatorNode2.create("="), context.thisEntity[fk])));
+      } else {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(relationModel)), OperatorNode2.create("="), context.thisEntity[pk])));
+      }
+      return {
+        kind: "SelectQueryNode",
+        from: FromNode.create([
+          TableNode2.create(relationModel)
+        ]),
+        where: WhereNode.create(condition)
+      };
+    } else {
+      let condition;
+      if (ownedByModel) {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(relationModel)))));
+      } else {
+        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(relationModel)))));
+      }
+      return {
+        kind: "SelectQueryNode",
+        from: FromNode.create([
+          TableNode2.create(relationModel)
+        ]),
+        where: WhereNode.create(condition)
+      };
+    }
+  }
+  createColumnRef(column, context) {
+    return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(context.alias ?? context.model));
+  }
+  isAuthCall(value) {
+    return ExpressionUtils.isCall(value) && value.function === "auth";
+  }
+  isAuthMember(expr2) {
+    return ExpressionUtils.isMember(expr2) && this.isAuthCall(expr2.receiver);
+  }
+  isNullNode(node) {
+    return ValueNode2.is(node) && node.value === null;
+  }
+};
+_ts_decorate([
+  expr("literal"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof LiteralExpression === "undefined" ? Object : LiteralExpression
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_literal", null);
+_ts_decorate([
+  expr("array"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof ArrayExpression === "undefined" ? Object : ArrayExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_array", null);
+_ts_decorate([
+  expr("field"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FieldExpression === "undefined" ? Object : FieldExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_field", null);
+_ts_decorate([
+  expr("null"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", []),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_null", null);
+_ts_decorate([
+  expr("binary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof BinaryExpression === "undefined" ? Object : BinaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_binary", null);
+_ts_decorate([
+  expr("unary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof UnaryExpression === "undefined" ? Object : UnaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_unary", null);
+_ts_decorate([
+  expr("call"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof CallExpression === "undefined" ? Object : CallExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_call", null);
+_ts_decorate([
+  expr("member"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof MemberExpression === "undefined" ? Object : MemberExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_member", null);
+
+// src/plugins/policy/policy-handler.ts
+var PolicyHandler = class extends OperationNodeTransformer {
+  static {
+    __name(this, "PolicyHandler");
+  }
+  client;
+  dialect;
+  constructor(client) {
+    super(), this.client = client;
+    this.dialect = getCrudDialect(this.client.$schema, this.client.$options);
+  }
+  get kysely() {
+    return this.client.$qb;
+  }
+  async handle(node, proceed, transaction) {
+    if (!this.isCrudQueryNode(node)) {
+      throw new RejectedByPolicyError(void 0, "non-CRUD queries are not allowed");
+    }
+    if (!this.isMutationQueryNode(node)) {
+      return proceed(this.transformNode(node));
+    }
+    let mutationRequiresTransaction = false;
+    const mutationModel = this.getMutationModel(node);
+    if (InsertQueryNode.is(node)) {
+      const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
+      if (constCondition === false) {
+        throw new RejectedByPolicyError(mutationModel);
+      } else if (constCondition === void 0) {
+        mutationRequiresTransaction = true;
+      }
+    }
+    if (!mutationRequiresTransaction && !node.returning) {
+      return proceed(this.transformNode(node));
+    }
+    let readBackError = false;
+    const result = await transaction(async (txProceed) => {
+      if (InsertQueryNode.is(node)) {
+        await this.enforcePreCreatePolicy(node, txProceed);
+      }
+      const transformedNode = this.transformNode(node);
+      const result2 = await txProceed(transformedNode);
+      if (!this.onlyReturningId(node)) {
+        const readBackResult = await this.processReadBack(node, result2, txProceed);
+        if (readBackResult.rows.length !== result2.rows.length) {
+          readBackError = true;
+        }
+        return readBackResult;
+      } else {
+        return result2;
+      }
+    });
+    if (readBackError) {
+      throw new RejectedByPolicyError(mutationModel, "result is not allowed to be read back");
+    }
+    return result;
+  }
+  onlyReturningId(node) {
+    if (!node.returning) {
+      return true;
+    }
+    const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
+    const collector = new ColumnCollector();
+    const selectedColumns = collector.collect(node.returning);
+    return selectedColumns.every((c) => idFields.includes(c));
+  }
+  async enforcePreCreatePolicy(node, proceed) {
+    if (!node.columns || !node.values) {
+      return;
+    }
+    const model = this.getMutationModel(node);
+    const fields = node.columns.map((c) => c.column.name);
+    const valueRows = this.unwrapCreateValueRows(node.values, model, fields);
+    for (const values of valueRows) {
+      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), values.map((v) => v.raw), proceed);
+    }
+  }
+  async enforcePreCreatePolicyForOne(model, fields, values, valuesRaw, proceed) {
+    const thisEntity = {};
+    const thisEntityRaw = {};
+    for (let i = 0; i < fields.length; i++) {
+      thisEntity[fields[i]] = values[i];
+      thisEntityRaw[fields[i]] = valuesRaw[i];
+    }
+    const filter = this.buildPolicyFilter(model, void 0, "create", thisEntity, thisEntityRaw);
+    const preCreateCheck = {
+      kind: "SelectQueryNode",
+      selections: [
+        SelectionNode2.create(AliasNode3.create(filter, IdentifierNode2.create("$condition")))
+      ]
+    };
+    const result = await proceed(preCreateCheck);
+    if (!result.rows[0]?.$condition) {
+      throw new RejectedByPolicyError(model);
+    }
+  }
+  unwrapCreateValueRows(node, model, fields) {
+    if (ValuesNode.is(node)) {
+      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields));
+    } else if (PrimitiveValueListNode.is(node)) {
+      return [
+        this.unwrapCreateValueRow(node.values, model, fields)
+      ];
+    } else {
+      throw new InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
+    }
+  }
+  unwrapCreateValueRow(data, model, fields) {
+    invariant6(data.length === fields.length, "data length must match fields length");
+    const result = [];
+    for (let i = 0; i < data.length; i++) {
+      const item = data[i];
+      const fieldDef = requireField(this.client.$schema, model, fields[i]);
+      if (typeof item === "object" && item && "kind" in item) {
+        invariant6(item.kind === "ValueNode", "expecting a ValueNode");
+        result.push({
+          node: ValueNode3.create(this.dialect.transformPrimitive(item.value, fieldDef.type)),
+          raw: item.value
+        });
+      } else {
+        const value = this.dialect.transformPrimitive(item, fieldDef.type);
+        if (Array.isArray(value)) {
+          result.push({
+            node: RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
+            raw: value
+          });
+        } else {
+          result.push({
+            node: ValueNode3.create(value),
+            raw: value
+          });
+        }
+      }
+    }
+    return result;
+  }
+  tryGetConstantPolicy(model, operation) {
+    const policies = this.getModelPolicies(model, operation);
+    if (!policies.some((p) => p.kind === "allow")) {
+      return false;
+    } else if (
+      // unconditional deny
+      policies.some((p) => p.kind === "deny" && this.isTrueExpr(p.condition))
+    ) {
+      return false;
+    } else if (
+      // unconditional allow
+      !policies.some((p) => p.kind === "deny") && policies.some((p) => p.kind === "allow" && this.isTrueExpr(p.condition))
+    ) {
+      return true;
+    } else {
+      return void 0;
+    }
+  }
+  isTrueExpr(expr2) {
+    return ExpressionUtils.isLiteral(expr2) && expr2.value === true;
+  }
+  async processReadBack(node, result, proceed) {
+    if (result.rows.length === 0) {
+      return result;
+    }
+    if (!this.isMutationQueryNode(node) || !node.returning) {
+      return result;
+    }
+    const table = this.getMutationModel(node);
+    if (!table) {
+      throw new InternalError(`Unable to get table name for query node: ${node}`);
+    }
+    const idConditions = this.buildIdConditions(table, result.rows);
+    const policyFilter = this.buildPolicyFilter(table, void 0, "read");
+    const select = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        TableNode3.create(table)
+      ]),
+      where: WhereNode2.create(conjunction(this.dialect, [
+        idConditions,
+        policyFilter
+      ])),
+      selections: node.returning.selections
+    };
+    const selectResult = await proceed(select);
+    return selectResult;
+  }
+  buildIdConditions(table, rows) {
+    const idFields = getIdFields(this.client.$schema, table);
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ColumnNode2.create(field), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
+  }
+  getMutationModel(node) {
+    const r = match7(node).when(InsertQueryNode.is, (node2) => getTableName(node2.into)).when(UpdateQueryNode.is, (node2) => getTableName(node2.table)).when(DeleteQueryNode.is, (node2) => {
+      if (node2.from.froms.length !== 1) {
+        throw new InternalError("Only one from table is supported for delete");
+      }
+      return getTableName(node2.from.froms[0]);
+    }).exhaustive();
+    if (!r) {
+      throw new InternalError(`Unable to get table name for query node: ${node}`);
+    }
+    return r;
+  }
+  isCrudQueryNode(node) {
+    return SelectQueryNode2.is(node) || InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+  }
+  isMutationQueryNode(node) {
+    return InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+  }
+  buildPolicyFilter(model, alias, operation, thisEntity, thisEntityRaw) {
+    const policies = this.getModelPolicies(model, operation);
+    if (policies.length === 0) {
+      return falseNode(this.dialect);
+    }
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
+    let combinedPolicy;
+    if (allows.length === 0) {
+      combinedPolicy = falseNode(this.dialect);
+    } else {
+      combinedPolicy = disjunction(this.dialect, allows);
+      if (denies.length !== 0) {
+        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+        combinedPolicy = conjunction(this.dialect, [
+          combinedPolicy,
+          combinedDenies
+        ]);
+      }
+    }
+    return combinedPolicy;
+  }
+  transformSelectQuery(node) {
+    let whereNode = node.where;
+    node.from?.froms.forEach((from) => {
+      const extractResult = this.extractTableName(from);
+      if (extractResult) {
+        const { model, alias } = extractResult;
+        const filter = this.buildPolicyFilter(model, alias, "read");
+        whereNode = WhereNode2.create(whereNode?.where ? conjunction(this.dialect, [
+          whereNode.where,
+          filter
+        ]) : filter);
+      }
+    });
+    const baseResult = super.transformSelectQuery({
+      ...node,
+      where: void 0
+    });
+    return {
+      ...baseResult,
+      where: whereNode
+    };
+  }
+  transformInsertQuery(node) {
+    const result = super.transformInsertQuery(node);
+    if (!node.returning) {
+      return result;
+    }
+    if (this.onlyReturningId(node)) {
+      return result;
+    } else {
+      const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
+      return {
+        ...result,
+        returning: ReturningNode.create(idFields.map((field) => SelectionNode2.create(ColumnNode2.create(field))))
+      };
+    }
+  }
+  transformUpdateQuery(node) {
+    const result = super.transformUpdateQuery(node);
+    const mutationModel = this.getMutationModel(node);
+    const filter = this.buildPolicyFilter(mutationModel, void 0, "update");
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  transformDeleteQuery(node) {
+    const result = super.transformDeleteQuery(node);
+    const mutationModel = this.getMutationModel(node);
+    const filter = this.buildPolicyFilter(mutationModel, void 0, "delete");
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  extractTableName(from) {
+    if (TableNode3.is(from)) {
+      return {
+        model: from.table.identifier.name
+      };
+    }
+    if (AliasNode3.is(from)) {
+      const inner = this.extractTableName(from.node);
+      if (!inner) {
+        return void 0;
+      }
+      return {
+        model: inner.model,
+        alias: IdentifierNode2.is(from.alias) ? from.alias.name : void 0
+      };
+    } else {
+      return void 0;
+    }
+  }
+  transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw) {
+    return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
+      model,
+      alias,
+      operation,
+      thisEntity,
+      thisEntityRaw,
+      auth: this.client.$auth
+    });
+  }
+  getModelPolicies(modelName, operation) {
+    const modelDef = requireModel(this.client.$schema, modelName);
+    const result = [];
+    const extractOperations = /* @__PURE__ */ __name((expr2) => {
+      invariant6(ExpressionUtils.isLiteral(expr2), "expecting a literal");
+      invariant6(typeof expr2.value === "string", "expecting a string literal");
+      return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
+    }, "extractOperations");
+    if (modelDef.attributes) {
+      result.push(...modelDef.attributes.filter((attr) => attr.name === "@@allow" || attr.name === "@@deny").map((attr) => ({
+        kind: attr.name === "@@allow" ? "allow" : "deny",
+        operations: extractOperations(attr.args[0].value),
+        condition: attr.args[1].value
+      })).filter((policy) => policy.operations.includes("all") || policy.operations.includes(operation)));
+    }
+    return result;
+  }
+};
+
+// src/plugins/policy/plugin.ts
+var PolicyPlugin = class {
+  static {
+    __name(this, "PolicyPlugin");
+  }
+  get id() {
+    return "policy";
+  }
+  get name() {
+    return "Access Policy";
+  }
+  get description() {
+    return "Enforces access policies defined in the schema.";
+  }
+  onKyselyQuery({ query, client, proceed, transaction }) {
+    const handler = new PolicyHandler(client);
+    return handler.handle(query, proceed, transaction);
+  }
+};
+export {
+  PolicyPlugin,
+  RejectedByPolicyError
+};
+//# sourceMappingURL=policy.js.map