@zenstackhq/runtime 3.0.0-alpha.9 → 3.0.0-beta.10

package/dist/plugins/policy.cjs

@@ -1,2357 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/plugins/policy/index.ts
-var policy_exports = {};
-__export(policy_exports, {
-  PolicyPlugin: () => PolicyPlugin,
-  RejectedByPolicyError: () => RejectedByPolicyError
-});
-module.exports = __toCommonJS(policy_exports);
-
-// src/plugins/policy/errors.ts
-var RejectedByPolicyError = class extends Error {
-  static {
-    __name(this, "RejectedByPolicyError");
-  }
-  model;
-  reason;
-  constructor(model, reason) {
-    super(reason ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
-  }
-};
-
-// src/plugins/policy/policy-handler.ts
-var import_common_helpers6 = require("@zenstackhq/common-helpers");
-var import_kysely7 = require("kysely");
-var import_ts_pattern7 = require("ts-pattern");
-
-// src/client/crud/dialects/index.ts
-var import_ts_pattern4 = require("ts-pattern");
-
-// src/client/crud/dialects/postgresql.ts
-var import_common_helpers2 = require("@zenstackhq/common-helpers");
-var import_kysely2 = require("kysely");
-var import_ts_pattern2 = require("ts-pattern");
-
-// src/client/errors.ts
-var QueryError = class extends Error {
-  static {
-    __name(this, "QueryError");
-  }
-  constructor(message, cause) {
-    super(message, {
-      cause
-    });
-  }
-};
-var InternalError = class extends Error {
-  static {
-    __name(this, "InternalError");
-  }
-  constructor(message) {
-    super(message);
-  }
-};
-
-// src/client/query-utils.ts
-function getModel(schema, model) {
-  return schema.models[model];
-}
-__name(getModel, "getModel");
-function requireModel(schema, model) {
-  const matchedName = Object.keys(schema.models).find((k) => k.toLowerCase() === model.toLowerCase());
-  if (!matchedName) {
-    throw new QueryError(`Model "${model}" not found in schema`);
-  }
-  return schema.models[matchedName];
-}
-__name(requireModel, "requireModel");
-function getField(schema, model, field) {
-  const modelDef = getModel(schema, model);
-  return modelDef?.fields[field];
-}
-__name(getField, "getField");
-function requireField(schema, model, field) {
-  const modelDef = requireModel(schema, model);
-  if (!modelDef.fields[field]) {
-    throw new QueryError(`Field "${field}" not found in model "${model}"`);
-  }
-  return modelDef.fields[field];
-}
-__name(requireField, "requireField");
-function getIdFields(schema, model) {
-  const modelDef = requireModel(schema, model);
-  return modelDef?.idFields;
-}
-__name(getIdFields, "getIdFields");
-function getRelationForeignKeyFieldPairs(schema, model, relationField) {
-  const fieldDef = requireField(schema, model, relationField);
-  if (!fieldDef?.relation) {
-    throw new InternalError(`Field "${relationField}" is not a relation`);
-  }
-  if (fieldDef.relation.fields) {
-    if (!fieldDef.relation.references) {
-      throw new InternalError(`Relation references not defined for field "${relationField}"`);
-    }
-    return {
-      keyPairs: fieldDef.relation.fields.map((f, i) => ({
-        fk: f,
-        pk: fieldDef.relation.references[i]
-      })),
-      ownedByModel: true
-    };
-  } else {
-    if (!fieldDef.relation.opposite) {
-      throw new InternalError(`Opposite relation not defined for field "${relationField}"`);
-    }
-    const oppositeField = requireField(schema, fieldDef.type, fieldDef.relation.opposite);
-    if (!oppositeField.relation) {
-      throw new InternalError(`Field "${fieldDef.relation.opposite}" is not a relation`);
-    }
-    if (!oppositeField.relation.fields) {
-      throw new InternalError(`Relation fields not defined for field "${relationField}"`);
-    }
-    if (!oppositeField.relation.references) {
-      throw new InternalError(`Relation references not defined for field "${relationField}"`);
-    }
-    return {
-      keyPairs: oppositeField.relation.fields.map((f, i) => ({
-        fk: f,
-        pk: oppositeField.relation.references[i]
-      })),
-      ownedByModel: false
-    };
-  }
-}
-__name(getRelationForeignKeyFieldPairs, "getRelationForeignKeyFieldPairs");
-function isRelationField(schema, model, field) {
-  const fieldDef = requireField(schema, model, field);
-  return !!fieldDef.relation;
-}
-__name(isRelationField, "isRelationField");
-function getUniqueFields(schema, model) {
-  const modelDef = requireModel(schema, model);
-  const result = [];
-  for (const [key, value] of Object.entries(modelDef.uniqueFields)) {
-    if (typeof value !== "object") {
-      throw new InternalError(`Invalid unique field definition for "${key}"`);
-    }
-    if (typeof value.type === "string") {
-      result.push({
-        name: key,
-        def: requireField(schema, model, key)
-      });
-    } else {
-      result.push({
-        name: key,
-        defs: Object.fromEntries(Object.keys(value).map((k) => [
-          k,
-          requireField(schema, model, k)
-        ]))
-      });
-    }
-  }
-  return result;
-}
-__name(getUniqueFields, "getUniqueFields");
-function buildFieldRef(schema, model, field, options, eb, modelAlias) {
-  const fieldDef = requireField(schema, model, field);
-  if (!fieldDef.computed) {
-    return eb.ref(modelAlias ? `${modelAlias}.${field}` : field);
-  } else {
-    let computer;
-    if ("computedFields" in options) {
-      const computedFields = options.computedFields;
-      computer = computedFields?.[model]?.[field];
-    }
-    if (!computer) {
-      throw new QueryError(`Computed field "${field}" implementation not provided for model "${model}"`);
-    }
-    return computer(eb);
-  }
-}
-__name(buildFieldRef, "buildFieldRef");
-function isEnum(schema, type) {
-  return !!schema.enums?.[type];
-}
-__name(isEnum, "isEnum");
-function buildJoinPairs(schema, model, modelAlias, relationField, relationModelAlias) {
-  const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(schema, model, relationField);
-  return keyPairs.map(({ fk, pk }) => {
-    if (ownedByModel) {
-      return [
-        `${relationModelAlias}.${pk}`,
-        `${modelAlias}.${fk}`
-      ];
-    } else {
-      return [
-        `${relationModelAlias}.${fk}`,
-        `${modelAlias}.${pk}`
-      ];
-    }
-  });
-}
-__name(buildJoinPairs, "buildJoinPairs");
-function makeDefaultOrderBy(schema, model) {
-  const idFields = getIdFields(schema, model);
-  return idFields.map((f) => ({
-    [f]: "asc"
-  }));
-}
-__name(makeDefaultOrderBy, "makeDefaultOrderBy");
-function getManyToManyRelation(schema, model, field) {
-  const fieldDef = requireField(schema, model, field);
-  if (!fieldDef.array || !fieldDef.relation?.opposite) {
-    return void 0;
-  }
-  const oppositeFieldDef = requireField(schema, fieldDef.type, fieldDef.relation.opposite);
-  if (oppositeFieldDef.array) {
-    const sortedModelNames = [
-      model,
-      fieldDef.type
-    ].sort();
-    return {
-      parentFkName: sortedModelNames[0] === model ? "A" : "B",
-      otherModel: fieldDef.type,
-      otherField: fieldDef.relation.opposite,
-      otherFkName: sortedModelNames[0] === fieldDef.type ? "A" : "B",
-      joinTable: fieldDef.relation.name ? `_${fieldDef.relation.name}` : `_${sortedModelNames[0]}To${sortedModelNames[1]}`
-    };
-  } else {
-    return void 0;
-  }
-}
-__name(getManyToManyRelation, "getManyToManyRelation");
-function flattenCompoundUniqueFilters(schema, model, filter) {
-  if (typeof filter !== "object" || !filter) {
-    return filter;
-  }
-  const uniqueFields = getUniqueFields(schema, model);
-  const compoundUniques = uniqueFields.filter((u) => "defs" in u);
-  if (compoundUniques.length === 0) {
-    return filter;
-  }
-  const result = {};
-  for (const [key, value] of Object.entries(filter)) {
-    if (compoundUniques.some(({ name }) => name === key)) {
-      Object.assign(result, value);
-    } else {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-__name(flattenCompoundUniqueFilters, "flattenCompoundUniqueFilters");
-
-// src/client/crud/dialects/base.ts
-var import_common_helpers = require("@zenstackhq/common-helpers");
-var import_kysely = require("kysely");
-var import_ts_pattern = require("ts-pattern");
-
-// src/utils/enumerate.ts
-function enumerate(x) {
-  if (x === null || x === void 0) {
-    return [];
-  } else if (Array.isArray(x)) {
-    return x;
-  } else {
-    return [
-      x
-    ];
-  }
-}
-__name(enumerate, "enumerate");
-
-// src/client/crud/dialects/base.ts
-var BaseCrudDialect = class {
-  static {
-    __name(this, "BaseCrudDialect");
-  }
-  schema;
-  options;
-  constructor(schema, options) {
-    this.schema = schema;
-    this.options = options;
-  }
-  transformPrimitive(value, _type, _forArrayField) {
-    return value;
-  }
-  buildFilter(eb, model, modelAlias, where) {
-    if (where === true || where === void 0) {
-      return this.true(eb);
-    }
-    if (where === false) {
-      return this.false(eb);
-    }
-    let result = this.true(eb);
-    const _where = flattenCompoundUniqueFilters(this.schema, model, where);
-    for (const [key, payload] of Object.entries(_where)) {
-      if (payload === void 0) {
-        continue;
-      }
-      if (key.startsWith("$")) {
-        continue;
-      }
-      if (key === "AND" || key === "OR" || key === "NOT") {
-        result = this.and(eb, result, this.buildCompositeFilter(eb, model, modelAlias, key, payload));
-        continue;
-      }
-      const fieldDef = requireField(this.schema, model, key);
-      if (fieldDef.relation) {
-        result = this.and(eb, result, this.buildRelationFilter(eb, model, modelAlias, key, fieldDef, payload));
-      } else if (fieldDef.array) {
-        result = this.and(eb, result, this.buildArrayFilter(eb, model, modelAlias, key, fieldDef, payload));
-      } else {
-        result = this.and(eb, result, this.buildPrimitiveFilter(eb, model, modelAlias, key, fieldDef, payload));
-      }
-    }
-    if ("$expr" in _where && typeof _where["$expr"] === "function") {
-      result = this.and(eb, result, _where["$expr"](eb));
-    }
-    return result;
-  }
-  buildCompositeFilter(eb, model, modelAlias, key, payload) {
-    return (0, import_ts_pattern.match)(key).with("AND", () => this.and(eb, ...enumerate(payload).map((subPayload) => this.buildFilter(eb, model, modelAlias, subPayload)))).with("OR", () => this.or(eb, ...enumerate(payload).map((subPayload) => this.buildFilter(eb, model, modelAlias, subPayload)))).with("NOT", () => eb.not(this.buildCompositeFilter(eb, model, modelAlias, "AND", payload))).exhaustive();
-  }
-  buildRelationFilter(eb, model, modelAlias, field, fieldDef, payload) {
-    if (!fieldDef.array) {
-      return this.buildToOneRelationFilter(eb, model, modelAlias, field, fieldDef, payload);
-    } else {
-      return this.buildToManyRelationFilter(eb, model, modelAlias, field, fieldDef, payload);
-    }
-  }
-  buildToOneRelationFilter(eb, model, table, field, fieldDef, payload) {
-    if (payload === null) {
-      const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, field);
-      if (ownedByModel) {
-        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely.sql.ref(`${table}.${fk}`), "is", null)));
-      } else {
-        return this.buildToOneRelationFilter(eb, model, table, field, fieldDef, {
-          is: null
-        });
-      }
-    }
-    const joinAlias = `${table}$${field}`;
-    const joinPairs = buildJoinPairs(this.schema, model, table, field, joinAlias);
-    const filterResultField = `${field}$filter`;
-    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
-    const conditions = [];
-    if ("is" in payload || "isNot" in payload) {
-      if ("is" in payload) {
-        if (payload.is === null) {
-          conditions.push(eb(joinSelect, "=", 0));
-        } else {
-          conditions.push(eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload.is)), ">", 0));
-        }
-      }
-      if ("isNot" in payload) {
-        if (payload.isNot === null) {
-          conditions.push(eb(joinSelect, ">", 0));
-        } else {
-          conditions.push(this.or(
-            eb,
-            // is null
-            eb(joinSelect, "=", 0),
-            // found one that matches the filter
-            eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload.isNot)), "=", 0)
-          ));
-        }
-      }
-    } else {
-      conditions.push(eb(joinSelect.where(() => this.buildFilter(eb, fieldDef.type, joinAlias, payload)), ">", 0));
-    }
-    return this.and(eb, ...conditions);
-  }
-  buildToManyRelationFilter(eb, model, table, field, fieldDef, payload) {
-    if (payload === null) {
-      return eb(import_kysely.sql.ref(`${table}.${field}`), "is", null);
-    }
-    const relationModel = fieldDef.type;
-    const buildPkFkWhereRefs = /* @__PURE__ */ __name((eb2) => {
-      const m2m = getManyToManyRelation(this.schema, model, field);
-      if (m2m) {
-        const modelIdField = getIdFields(this.schema, model)[0];
-        const relationIdField = getIdFields(this.schema, relationModel)[0];
-        return eb2(import_kysely.sql.ref(`${relationModel}.${relationIdField}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely.sql.ref(`${table}.${modelIdField}`)));
-      } else {
-        const relationKeyPairs = getRelationForeignKeyFieldPairs(this.schema, model, field);
-        let result2 = this.true(eb2);
-        for (const { fk, pk } of relationKeyPairs.keyPairs) {
-          if (relationKeyPairs.ownedByModel) {
-            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${table}.${fk}`), "=", import_kysely.sql.ref(`${relationModel}.${pk}`)));
-          } else {
-            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${table}.${pk}`), "=", import_kysely.sql.ref(`${relationModel}.${fk}`)));
-          }
-        }
-        return result2;
-      }
-    }, "buildPkFkWhereRefs");
-    let result = this.true(eb);
-    for (const [key, subPayload] of Object.entries(payload)) {
-      if (!subPayload) {
-        continue;
-      }
-      switch (key) {
-        case "some": {
-          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => this.buildFilter(eb1, relationModel, relationModel, subPayload)), ">", 0));
-          break;
-        }
-        case "every": {
-          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => eb1.not(this.buildFilter(eb1, relationModel, relationModel, subPayload))), "=", 0));
-          break;
-        }
-        case "none": {
-          result = this.and(eb, result, eb(eb.selectFrom(relationModel).select((eb1) => eb1.fn.count(eb1.lit(1)).as("count")).where(buildPkFkWhereRefs(eb)).where((eb1) => this.buildFilter(eb1, relationModel, relationModel, subPayload)), "=", 0));
-          break;
-        }
-      }
-    }
-    return result;
-  }
-  buildArrayFilter(eb, model, modelAlias, field, fieldDef, payload) {
-    const clauses = [];
-    const fieldType = fieldDef.type;
-    const fieldRef = buildFieldRef(this.schema, model, field, this.options, eb, modelAlias);
-    for (const [key, _value] of Object.entries(payload)) {
-      if (_value === void 0) {
-        continue;
-      }
-      const value = this.transformPrimitive(_value, fieldType, !!fieldDef.array);
-      switch (key) {
-        case "equals": {
-          clauses.push(this.buildLiteralFilter(eb, fieldRef, fieldType, eb.val(value)));
-          break;
-        }
-        case "has": {
-          clauses.push(eb(fieldRef, "@>", eb.val([
-            value
-          ])));
-          break;
-        }
-        case "hasEvery": {
-          clauses.push(eb(fieldRef, "@>", eb.val(value)));
-          break;
-        }
-        case "hasSome": {
-          clauses.push(eb(fieldRef, "&&", eb.val(value)));
-          break;
-        }
-        case "isEmpty": {
-          clauses.push(eb(fieldRef, value === true ? "=" : "!=", eb.val([])));
-          break;
-        }
-        default: {
-          throw new InternalError(`Invalid array filter key: ${key}`);
-        }
-      }
-    }
-    return this.and(eb, ...clauses);
-  }
-  buildPrimitiveFilter(eb, model, modelAlias, field, fieldDef, payload) {
-    if (payload === null) {
-      return eb(import_kysely.sql.ref(`${modelAlias}.${field}`), "is", null);
-    }
-    if (isEnum(this.schema, fieldDef.type)) {
-      return this.buildEnumFilter(eb, modelAlias, field, fieldDef, payload);
-    }
-    return (0, import_ts_pattern.match)(fieldDef.type).with("String", () => this.buildStringFilter(eb, modelAlias, field, payload)).with(import_ts_pattern.P.union("Int", "Float", "Decimal", "BigInt"), (type) => this.buildNumberFilter(eb, model, modelAlias, field, type, payload)).with("Boolean", () => this.buildBooleanFilter(eb, modelAlias, field, payload)).with("DateTime", () => this.buildDateTimeFilter(eb, modelAlias, field, payload)).with("Bytes", () => this.buildBytesFilter(eb, modelAlias, field, payload)).with("Json", () => {
-      throw new InternalError("JSON filters are not supported yet");
-    }).with("Unsupported", () => {
-      throw new QueryError(`Unsupported field cannot be used in filters`);
-    }).exhaustive();
-  }
-  buildLiteralFilter(eb, lhs, type, rhs) {
-    return eb(lhs, "=", rhs !== null && rhs !== void 0 ? this.transformPrimitive(rhs, type, false) : rhs);
-  }
-  buildStandardFilter(eb, type, payload, lhs, getRhs, recurse, throwIfInvalid = false, onlyForKeys = void 0) {
-    if (payload === null || !(0, import_common_helpers.isPlainObject)(payload)) {
-      return {
-        conditions: [
-          this.buildLiteralFilter(eb, lhs, type, payload)
-        ],
-        consumedKeys: []
-      };
-    }
-    const conditions = [];
-    const consumedKeys = [];
-    for (const [op, value] of Object.entries(payload)) {
-      if (onlyForKeys && !onlyForKeys.includes(op)) {
-        continue;
-      }
-      const rhs = Array.isArray(value) ? value.map(getRhs) : getRhs(value);
-      const condition = (0, import_ts_pattern.match)(op).with("equals", () => rhs === null ? eb(lhs, "is", null) : eb(lhs, "=", rhs)).with("in", () => {
-        (0, import_common_helpers.invariant)(Array.isArray(rhs), "right hand side must be an array");
-        if (rhs.length === 0) {
-          return this.false(eb);
-        } else {
-          return eb(lhs, "in", rhs);
-        }
-      }).with("notIn", () => {
-        (0, import_common_helpers.invariant)(Array.isArray(rhs), "right hand side must be an array");
-        if (rhs.length === 0) {
-          return this.true(eb);
-        } else {
-          return eb.not(eb(lhs, "in", rhs));
-        }
-      }).with("lt", () => eb(lhs, "<", rhs)).with("lte", () => eb(lhs, "<=", rhs)).with("gt", () => eb(lhs, ">", rhs)).with("gte", () => eb(lhs, ">=", rhs)).with("not", () => eb.not(recurse(value))).otherwise(() => {
-        if (throwIfInvalid) {
-          throw new QueryError(`Invalid filter key: ${op}`);
-        } else {
-          return void 0;
-        }
-      });
-      if (condition) {
-        conditions.push(condition);
-        consumedKeys.push(op);
-      }
-    }
-    return {
-      conditions,
-      consumedKeys
-    };
-  }
-  buildStringFilter(eb, table, field, payload) {
-    const fieldDef = getField(this.schema, table, field);
-    let fieldRef = fieldDef?.computed ? import_kysely.sql.ref(field) : import_kysely.sql.ref(`${table}.${field}`);
-    let insensitive = false;
-    if (payload && typeof payload === "object" && "mode" in payload && payload.mode === "insensitive") {
-      insensitive = true;
-      fieldRef = eb.fn("lower", [
-        fieldRef
-      ]);
-    }
-    const { conditions, consumedKeys } = this.buildStandardFilter(eb, "String", payload, fieldRef, (value) => this.prepStringCasing(eb, value, insensitive), (value) => this.buildStringFilter(eb, table, field, value));
-    if (payload && typeof payload === "object") {
-      for (const [key, value] of Object.entries(payload)) {
-        if (key === "mode" || consumedKeys.includes(key)) {
-          continue;
-        }
-        const condition = (0, import_ts_pattern.match)(key).with("contains", () => insensitive ? eb(fieldRef, "ilike", import_kysely.sql.lit(`%${value}%`)) : eb(fieldRef, "like", import_kysely.sql.lit(`%${value}%`))).with("startsWith", () => insensitive ? eb(fieldRef, "ilike", import_kysely.sql.lit(`${value}%`)) : eb(fieldRef, "like", import_kysely.sql.lit(`${value}%`))).with("endsWith", () => insensitive ? eb(fieldRef, "ilike", import_kysely.sql.lit(`%${value}`)) : eb(fieldRef, "like", import_kysely.sql.lit(`%${value}`))).otherwise(() => {
-          throw new Error(`Invalid string filter key: ${key}`);
-        });
-        if (condition) {
-          conditions.push(condition);
-        }
-      }
-    }
-    return this.and(eb, ...conditions);
-  }
-  prepStringCasing(eb, value, toLower = true) {
-    if (typeof value === "string") {
-      return toLower ? eb.fn("lower", [
-        import_kysely.sql.lit(value)
-      ]) : import_kysely.sql.lit(value);
-    } else if (Array.isArray(value)) {
-      return value.map((v) => this.prepStringCasing(eb, v, toLower));
-    } else {
-      return value === null ? null : import_kysely.sql.lit(value);
-    }
-  }
-  buildNumberFilter(eb, model, table, field, type, payload) {
-    const { conditions } = this.buildStandardFilter(eb, type, payload, buildFieldRef(this.schema, model, field, this.options, eb), (value) => this.transformPrimitive(value, type, false), (value) => this.buildNumberFilter(eb, model, table, field, type, value));
-    return this.and(eb, ...conditions);
-  }
-  buildBooleanFilter(eb, table, field, payload) {
-    const { conditions } = this.buildStandardFilter(eb, "Boolean", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "Boolean", false), (value) => this.buildBooleanFilter(eb, table, field, value), true, [
-      "equals",
-      "not"
-    ]);
-    return this.and(eb, ...conditions);
-  }
-  buildDateTimeFilter(eb, table, field, payload) {
-    const { conditions } = this.buildStandardFilter(eb, "DateTime", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "DateTime", false), (value) => this.buildDateTimeFilter(eb, table, field, value), true);
-    return this.and(eb, ...conditions);
-  }
-  buildBytesFilter(eb, table, field, payload) {
-    const conditions = this.buildStandardFilter(eb, "Bytes", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => this.transformPrimitive(value, "Bytes", false), (value) => this.buildBytesFilter(eb, table, field, value), true, [
-      "equals",
-      "in",
-      "notIn",
-      "not"
-    ]);
-    return this.and(eb, ...conditions.conditions);
-  }
-  buildEnumFilter(eb, table, field, fieldDef, payload) {
-    const conditions = this.buildStandardFilter(eb, "String", payload, import_kysely.sql.ref(`${table}.${field}`), (value) => value, (value) => this.buildEnumFilter(eb, table, field, fieldDef, value), true, [
-      "equals",
-      "in",
-      "notIn",
-      "not"
-    ]);
-    return this.and(eb, ...conditions.conditions);
-  }
-  buildOrderBy(query, model, modelAlias, orderBy, useDefaultIfEmpty, negated) {
-    if (!orderBy) {
-      if (useDefaultIfEmpty) {
-        orderBy = makeDefaultOrderBy(this.schema, model);
-      } else {
-        return query;
-      }
-    }
-    let result = query;
-    enumerate(orderBy).forEach((orderBy2) => {
-      for (const [field, value] of Object.entries(orderBy2)) {
-        if (!value) {
-          continue;
-        }
-        if ([
-          "_count",
-          "_avg",
-          "_sum",
-          "_min",
-          "_max"
-        ].includes(field)) {
-          (0, import_common_helpers.invariant)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
-          for (const [k, v] of Object.entries(value)) {
-            (0, import_common_helpers.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-            result = result.orderBy((eb) => eb.fn(field.slice(1), [
-              import_kysely.sql.ref(k)
-            ]), import_kysely.sql.raw(this.negateSort(v, negated)));
-          }
-          continue;
-        }
-        switch (field) {
-          case "_count": {
-            (0, import_common_helpers.invariant)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
-            for (const [k, v] of Object.entries(value)) {
-              (0, import_common_helpers.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-              result = result.orderBy((eb) => eb.fn.count(import_kysely.sql.ref(k)), import_kysely.sql.raw(this.negateSort(v, negated)));
-            }
-            continue;
-          }
-          default:
-            break;
-        }
-        const fieldDef = requireField(this.schema, model, field);
-        if (!fieldDef.relation) {
-          if (value === "asc" || value === "desc") {
-            result = result.orderBy(import_kysely.sql.ref(`${modelAlias}.${field}`), this.negateSort(value, negated));
-          } else if (value && typeof value === "object" && "nulls" in value && "sort" in value && (value.sort === "asc" || value.sort === "desc") && (value.nulls === "first" || value.nulls === "last")) {
-            result = result.orderBy(import_kysely.sql.ref(`${modelAlias}.${field}`), import_kysely.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
-          }
-        } else {
-          const relationModel = fieldDef.type;
-          if (fieldDef.array) {
-            if (typeof value !== "object") {
-              throw new QueryError(`invalid orderBy value for field "${field}"`);
-            }
-            if ("_count" in value) {
-              (0, import_common_helpers.invariant)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
-              const sort = this.negateSort(value._count, negated);
-              result = result.orderBy((eb) => {
-                let subQuery = eb.selectFrom(relationModel);
-                const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
-                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
-                subQuery = subQuery.select(() => eb.fn.count(eb.lit(1)).as("_count"));
-                return subQuery;
-              }, sort);
-            }
-          } else {
-            result = result.leftJoin(relationModel, (join) => {
-              const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
-              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
-            });
-            result = this.buildOrderBy(result, fieldDef.type, relationModel, value, false, negated);
-          }
-        }
-      }
-    });
-    return result;
-  }
-  negateSort(sort, negated) {
-    return negated ? sort === "asc" ? "desc" : "asc" : sort;
-  }
-  true(eb) {
-    return eb.lit(this.transformPrimitive(true, "Boolean", false));
-  }
-  false(eb) {
-    return eb.lit(this.transformPrimitive(false, "Boolean", false));
-  }
-  isTrue(expression) {
-    const node = expression.toOperationNode();
-    if (node.kind !== "ValueNode") {
-      return false;
-    }
-    return node.value === true || node.value === 1;
-  }
-  isFalse(expression) {
-    const node = expression.toOperationNode();
-    if (node.kind !== "ValueNode") {
-      return false;
-    }
-    return node.value === false || node.value === 0;
-  }
-  and(eb, ...args) {
-    const nonTrueArgs = args.filter((arg) => !this.isTrue(arg));
-    if (nonTrueArgs.length === 0) {
-      return this.true(eb);
-    } else if (nonTrueArgs.length === 1) {
-      return nonTrueArgs[0];
-    } else {
-      return eb.and(nonTrueArgs);
-    }
-  }
-  or(eb, ...args) {
-    const nonFalseArgs = args.filter((arg) => !this.isFalse(arg));
-    if (nonFalseArgs.length === 0) {
-      return this.false(eb);
-    } else if (nonFalseArgs.length === 1) {
-      return nonFalseArgs[0];
-    } else {
-      return eb.or(nonFalseArgs);
-    }
-  }
-  not(eb, ...args) {
-    return eb.not(this.and(eb, ...args));
-  }
-};
-
-// src/client/crud/dialects/postgresql.ts
-var PostgresCrudDialect = class extends BaseCrudDialect {
-  static {
-    __name(this, "PostgresCrudDialect");
-  }
-  get provider() {
-    return "postgresql";
-  }
-  transformPrimitive(value, type, forArrayField) {
-    if (value === void 0) {
-      return value;
-    }
-    if (Array.isArray(value)) {
-      if (type === "Json" && !forArrayField) {
-        return JSON.stringify(value);
-      } else {
-        return value.map((v) => this.transformPrimitive(v, type, false));
-      }
-    } else {
-      return (0, import_ts_pattern2.match)(type).with("DateTime", () => value instanceof Date ? value : typeof value === "string" ? new Date(value) : value).with("Decimal", () => value !== null ? value.toString() : value).otherwise(() => value);
-    }
-  }
-  buildRelationSelection(query, model, relationField, parentAlias, payload) {
-    const joinedQuery = this.buildRelationJSON(model, query, relationField, parentAlias, payload);
-    return joinedQuery.select(`${parentAlias}$${relationField}.$j as ${relationField}`);
-  }
-  buildRelationJSON(model, qb, relationField, parentName, payload) {
-    const relationFieldDef = requireField(this.schema, model, relationField);
-    const relationModel = relationFieldDef.type;
-    return qb.leftJoinLateral((eb) => {
-      const joinTableName = `${parentName}$${relationField}`;
-      let result = eb.selectFrom(`${relationModel} as ${joinTableName}`);
-      result = eb.selectFrom(() => {
-        let subQuery = eb.selectFrom(`${relationModel}`).selectAll();
-        if (payload && typeof payload === "object") {
-          if (payload.where) {
-            subQuery = subQuery.where((eb2) => this.buildFilter(eb2, relationModel, relationModel, payload.where));
-          }
-          const skip = payload.skip;
-          let take = payload.take;
-          let negateOrderBy = false;
-          if (take !== void 0 && take < 0) {
-            negateOrderBy = true;
-            take = -take;
-          }
-          subQuery = this.buildSkipTake(subQuery, skip, take);
-          subQuery = this.buildOrderBy(subQuery, relationModel, relationModel, payload.orderBy, skip !== void 0 || take !== void 0, negateOrderBy);
-        }
-        const m2m = getManyToManyRelation(this.schema, model, relationField);
-        if (m2m) {
-          const parentIds = getIdFields(this.schema, model);
-          const relationIds = getIdFields(this.schema, relationModel);
-          (0, import_common_helpers2.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-          (0, import_common_helpers2.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
-          subQuery = subQuery.where(eb(eb.ref(`${relationModel}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentName}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
-        } else {
-          const joinPairs = buildJoinPairs(this.schema, model, parentName, relationField, relationModel);
-          subQuery = subQuery.where((eb2) => this.and(eb2, ...joinPairs.map(([left, right]) => eb2(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
-        }
-        return subQuery.as(joinTableName);
-      });
-      result = this.buildRelationObjectSelect(relationModel, relationField, relationFieldDef, result, payload, parentName);
-      result = this.buildRelationJoins(relationModel, relationField, result, payload, parentName);
-      return result.as(joinTableName);
-    }, (join) => join.onTrue());
-  }
-  buildRelationObjectSelect(relationModel, relationField, relationFieldDef, qb, payload, parentName) {
-    qb = qb.select((eb) => {
-      const objArgs = this.buildRelationObjectArgs(relationModel, relationField, eb, payload, parentName);
-      if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely2.sql`jsonb_agg(jsonb_build_object(${import_kysely2.sql.join(objArgs)}))`, import_kysely2.sql`'[]'::jsonb`).as("$j");
-      } else {
-        return import_kysely2.sql`jsonb_build_object(${import_kysely2.sql.join(objArgs)})`.as("$j");
-      }
-    });
-    return qb;
-  }
-  buildRelationObjectArgs(relationModel, relationField, eb, payload, parentName) {
-    const relationModelDef = requireModel(this.schema, relationModel);
-    const objArgs = [];
-    if (payload === true || !payload.select) {
-      objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-        import_kysely2.sql.lit(field),
-        buildFieldRef(this.schema, relationModel, field, this.options, eb)
-      ]).flatMap((v) => v));
-    } else if (payload.select) {
-      objArgs.push(...Object.entries(payload.select).filter(([, value]) => value).map(([field]) => {
-        const fieldDef = requireField(this.schema, relationModel, field);
-        const fieldValue = fieldDef.relation ? eb.ref(`${parentName}$${relationField}$${field}.$j`) : buildFieldRef(this.schema, relationModel, field, this.options, eb);
-        return [
-          import_kysely2.sql.lit(field),
-          fieldValue
-        ];
-      }).flatMap((v) => v));
-    }
-    if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
-      objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field]) => [
-        import_kysely2.sql.lit(field),
-        // reference the synthesized JSON field
-        eb.ref(`${parentName}$${relationField}$${field}.$j`)
-      ]).flatMap((v) => v));
-    }
-    return objArgs;
-  }
-  buildRelationJoins(relationModel, relationField, qb, payload, parentName) {
-    let result = qb;
-    if (typeof payload === "object") {
-      const selectInclude = payload.include ?? payload.select;
-      if (selectInclude && typeof selectInclude === "object") {
-        Object.entries(selectInclude).filter(([, value]) => value).filter(([field]) => isRelationField(this.schema, relationModel, field)).forEach(([field, value]) => {
-          result = this.buildRelationJSON(relationModel, result, field, `${parentName}$${relationField}`, value);
-        });
-      }
-    }
-    return result;
-  }
-  buildSkipTake(query, skip, take) {
-    if (take !== void 0) {
-      query = query.limit(take);
-    }
-    if (skip !== void 0) {
-      query = query.offset(skip);
-    }
-    return query;
-  }
-  buildJsonObject(eb, value) {
-    return eb.fn("jsonb_build_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely2.sql.lit(key),
-      value2
-    ]));
-  }
-  get supportsUpdateWithLimit() {
-    return false;
-  }
-  get supportsDeleteWithLimit() {
-    return false;
-  }
-  get supportsDistinctOn() {
-    return true;
-  }
-  buildArrayLength(eb, array) {
-    return eb.fn("array_length", [
-      array
-    ]);
-  }
-  buildArrayLiteralSQL(values) {
-    if (values.length === 0) {
-      return "{}";
-    } else {
-      return `ARRAY[${values.map((v) => typeof v === "string" ? `'${v}'` : v)}]`;
-    }
-  }
-};
-
-// src/client/crud/dialects/sqlite.ts
-var import_common_helpers3 = require("@zenstackhq/common-helpers");
-var import_kysely3 = require("kysely");
-var import_ts_pattern3 = require("ts-pattern");
-var SqliteCrudDialect = class extends BaseCrudDialect {
-  static {
-    __name(this, "SqliteCrudDialect");
-  }
-  get provider() {
-    return "sqlite";
-  }
-  transformPrimitive(value, type, _forArrayField) {
-    if (value === void 0) {
-      return value;
-    }
-    if (Array.isArray(value)) {
-      return value.map((v) => this.transformPrimitive(v, type, false));
-    } else {
-      return (0, import_ts_pattern3.match)(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).with("Json", () => JSON.stringify(value)).otherwise(() => value);
-    }
-  }
-  buildRelationSelection(query, model, relationField, parentAlias, payload) {
-    return query.select((eb) => this.buildRelationJSON(model, eb, relationField, parentAlias, payload).as(relationField));
-  }
-  buildRelationJSON(model, eb, relationField, parentName, payload) {
-    const relationFieldDef = requireField(this.schema, model, relationField);
-    const relationModel = relationFieldDef.type;
-    const relationModelDef = requireModel(this.schema, relationModel);
-    const subQueryName = `${parentName}$${relationField}`;
-    let tbl = eb.selectFrom(() => {
-      let subQuery = eb.selectFrom(relationModel).selectAll();
-      if (payload && typeof payload === "object") {
-        if (payload.where) {
-          subQuery = subQuery.where((eb2) => this.buildFilter(eb2, relationModel, relationModel, payload.where));
-        }
-        const skip = payload.skip;
-        let take = payload.take;
-        let negateOrderBy = false;
-        if (take !== void 0 && take < 0) {
-          negateOrderBy = true;
-          take = -take;
-        }
-        subQuery = this.buildSkipTake(subQuery, skip, take);
-        subQuery = this.buildOrderBy(subQuery, relationModel, relationModel, payload.orderBy, skip !== void 0 || take !== void 0, negateOrderBy);
-      }
-      const m2m = getManyToManyRelation(this.schema, model, relationField);
-      if (m2m) {
-        const parentIds = getIdFields(this.schema, model);
-        const relationIds = getIdFields(this.schema, relationModel);
-        (0, import_common_helpers3.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-        (0, import_common_helpers3.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
-        subQuery = subQuery.where(eb(eb.ref(`${relationModel}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentName}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
-      } else {
-        const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
-        keyPairs.forEach(({ fk, pk }) => {
-          if (ownedByModel) {
-            subQuery = subQuery.whereRef(`${relationModel}.${pk}`, "=", `${parentName}.${fk}`);
-          } else {
-            subQuery = subQuery.whereRef(`${relationModel}.${fk}`, "=", `${parentName}.${pk}`);
-          }
-        });
-      }
-      return subQuery.as(subQueryName);
-    });
-    tbl = tbl.select(() => {
-      const objArgs = [];
-      if (payload === true || !payload.select) {
-        objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-          import_kysely3.sql.lit(field),
-          buildFieldRef(this.schema, relationModel, field, this.options, eb)
-        ]).flatMap((v) => v));
-      } else if (payload.select) {
-        objArgs.push(...Object.entries(payload.select).filter(([, value]) => value).map(([field, value]) => {
-          const fieldDef = requireField(this.schema, relationModel, field);
-          if (fieldDef.relation) {
-            const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentName}$${relationField}`, value);
-            return [
-              import_kysely3.sql.lit(field),
-              subJson
-            ];
-          } else {
-            return [
-              import_kysely3.sql.lit(field),
-              buildFieldRef(this.schema, relationModel, field, this.options, eb)
-            ];
-          }
-        }).flatMap((v) => v));
-      }
-      if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
-        objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field, value]) => {
-          const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentName}$${relationField}`, value);
-          return [
-            import_kysely3.sql.lit(field),
-            subJson
-          ];
-        }).flatMap((v) => v));
-      }
-      if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely3.sql`json_group_array(json_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`json_array()`).as("$j");
-      } else {
-        return import_kysely3.sql`json_object(${import_kysely3.sql.join(objArgs)})`.as("data");
-      }
-    });
-    return tbl;
-  }
-  buildSkipTake(query, skip, take) {
-    if (take !== void 0) {
-      query = query.limit(take);
-    }
-    if (skip !== void 0) {
-      query = query.offset(skip);
-      if (take === void 0) {
-        query = query.limit(-1);
-      }
-    }
-    return query;
-  }
-  buildJsonObject(eb, value) {
-    return eb.fn("json_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely3.sql.lit(key),
-      value2
-    ]));
-  }
-  get supportsUpdateWithLimit() {
-    return false;
-  }
-  get supportsDeleteWithLimit() {
-    return false;
-  }
-  get supportsDistinctOn() {
-    return false;
-  }
-  buildArrayLength(eb, array) {
-    return eb.fn("json_array_length", [
-      array
-    ]);
-  }
-  buildArrayLiteralSQL(_values) {
-    throw new Error("SQLite does not support array literals");
-  }
-};
-
-// src/client/crud/dialects/index.ts
-function getCrudDialect(schema, options) {
-  return (0, import_ts_pattern4.match)(schema.provider.type).with("sqlite", () => new SqliteCrudDialect(schema, options)).with("postgresql", () => new PostgresCrudDialect(schema, options)).exhaustive();
-}
-__name(getCrudDialect, "getCrudDialect");
-
-// src/schema/expression.ts
-var ExpressionUtils = {
-  literal: /* @__PURE__ */ __name((value) => {
-    return {
-      kind: "literal",
-      value
-    };
-  }, "literal"),
-  array: /* @__PURE__ */ __name((items) => {
-    return {
-      kind: "array",
-      items
-    };
-  }, "array"),
-  call: /* @__PURE__ */ __name((functionName, args) => {
-    return {
-      kind: "call",
-      function: functionName,
-      args
-    };
-  }, "call"),
-  binary: /* @__PURE__ */ __name((left, op, right) => {
-    return {
-      kind: "binary",
-      op,
-      left,
-      right
-    };
-  }, "binary"),
-  unary: /* @__PURE__ */ __name((op, operand) => {
-    return {
-      kind: "unary",
-      op,
-      operand
-    };
-  }, "unary"),
-  field: /* @__PURE__ */ __name((field) => {
-    return {
-      kind: "field",
-      field
-    };
-  }, "field"),
-  member: /* @__PURE__ */ __name((receiver, members) => {
-    return {
-      kind: "member",
-      receiver,
-      members
-    };
-  }, "member"),
-  _this: /* @__PURE__ */ __name(() => {
-    return {
-      kind: "this"
-    };
-  }, "_this"),
-  _null: /* @__PURE__ */ __name(() => {
-    return {
-      kind: "null"
-    };
-  }, "_null"),
-  and: /* @__PURE__ */ __name((expr2, ...expressions) => {
-    return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "&&", exp), expr2);
-  }, "and"),
-  or: /* @__PURE__ */ __name((expr2, ...expressions) => {
-    return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "||", exp), expr2);
-  }, "or"),
-  is: /* @__PURE__ */ __name((value, kind) => {
-    return !!value && typeof value === "object" && "kind" in value && value.kind === kind;
-  }, "is"),
-  isLiteral: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "literal"), "isLiteral"),
-  isArray: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "array"), "isArray"),
-  isCall: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "call"), "isCall"),
-  isNull: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "null"), "isNull"),
-  isThis: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "this"), "isThis"),
-  isUnary: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "unary"), "isUnary"),
-  isBinary: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "binary"), "isBinary"),
-  isField: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "field"), "isField"),
-  isMember: /* @__PURE__ */ __name((value) => ExpressionUtils.is(value, "member"), "isMember")
-};
-
-// src/utils/default-operation-node-visitor.ts
-var import_kysely4 = require("kysely");
-var DefaultOperationNodeVisitor = class extends import_kysely4.OperationNodeVisitor {
-  static {
-    __name(this, "DefaultOperationNodeVisitor");
-  }
-  defaultVisit(node) {
-    Object.values(node).forEach((value) => {
-      if (!value) {
-        return;
-      }
-      if (Array.isArray(value)) {
-        value.forEach((el) => this.defaultVisit(el));
-      }
-      if (typeof value === "object" && "kind" in value && typeof value.kind === "string") {
-        this.visitNode(value);
-      }
-    });
-  }
-  visitSelectQuery(node) {
-    this.defaultVisit(node);
-  }
-  visitSelection(node) {
-    this.defaultVisit(node);
-  }
-  visitColumn(node) {
-    this.defaultVisit(node);
-  }
-  visitAlias(node) {
-    this.defaultVisit(node);
-  }
-  visitTable(node) {
-    this.defaultVisit(node);
-  }
-  visitFrom(node) {
-    this.defaultVisit(node);
-  }
-  visitReference(node) {
-    this.defaultVisit(node);
-  }
-  visitAnd(node) {
-    this.defaultVisit(node);
-  }
-  visitOr(node) {
-    this.defaultVisit(node);
-  }
-  visitValueList(node) {
-    this.defaultVisit(node);
-  }
-  visitParens(node) {
-    this.defaultVisit(node);
-  }
-  visitJoin(node) {
-    this.defaultVisit(node);
-  }
-  visitRaw(node) {
-    this.defaultVisit(node);
-  }
-  visitWhere(node) {
-    this.defaultVisit(node);
-  }
-  visitInsertQuery(node) {
-    this.defaultVisit(node);
-  }
-  visitDeleteQuery(node) {
-    this.defaultVisit(node);
-  }
-  visitReturning(node) {
-    this.defaultVisit(node);
-  }
-  visitCreateTable(node) {
-    this.defaultVisit(node);
-  }
-  visitAddColumn(node) {
-    this.defaultVisit(node);
-  }
-  visitColumnDefinition(node) {
-    this.defaultVisit(node);
-  }
-  visitDropTable(node) {
-    this.defaultVisit(node);
-  }
-  visitOrderBy(node) {
-    this.defaultVisit(node);
-  }
-  visitOrderByItem(node) {
-    this.defaultVisit(node);
-  }
-  visitGroupBy(node) {
-    this.defaultVisit(node);
-  }
-  visitGroupByItem(node) {
-    this.defaultVisit(node);
-  }
-  visitUpdateQuery(node) {
-    this.defaultVisit(node);
-  }
-  visitColumnUpdate(node) {
-    this.defaultVisit(node);
-  }
-  visitLimit(node) {
-    this.defaultVisit(node);
-  }
-  visitOffset(node) {
-    this.defaultVisit(node);
-  }
-  visitOnConflict(node) {
-    this.defaultVisit(node);
-  }
-  visitOnDuplicateKey(node) {
-    this.defaultVisit(node);
-  }
-  visitCheckConstraint(node) {
-    this.defaultVisit(node);
-  }
-  visitDataType(node) {
-    this.defaultVisit(node);
-  }
-  visitSelectAll(node) {
-    this.defaultVisit(node);
-  }
-  visitIdentifier(node) {
-    this.defaultVisit(node);
-  }
-  visitSchemableIdentifier(node) {
-    this.defaultVisit(node);
-  }
-  visitValue(node) {
-    this.defaultVisit(node);
-  }
-  visitPrimitiveValueList(node) {
-    this.defaultVisit(node);
-  }
-  visitOperator(node) {
-    this.defaultVisit(node);
-  }
-  visitCreateIndex(node) {
-    this.defaultVisit(node);
-  }
-  visitDropIndex(node) {
-    this.defaultVisit(node);
-  }
-  visitList(node) {
-    this.defaultVisit(node);
-  }
-  visitPrimaryKeyConstraint(node) {
-    this.defaultVisit(node);
-  }
-  visitUniqueConstraint(node) {
-    this.defaultVisit(node);
-  }
-  visitReferences(node) {
-    this.defaultVisit(node);
-  }
-  visitWith(node) {
-    this.defaultVisit(node);
-  }
-  visitCommonTableExpression(node) {
-    this.defaultVisit(node);
-  }
-  visitCommonTableExpressionName(node) {
-    this.defaultVisit(node);
-  }
-  visitHaving(node) {
-    this.defaultVisit(node);
-  }
-  visitCreateSchema(node) {
-    this.defaultVisit(node);
-  }
-  visitDropSchema(node) {
-    this.defaultVisit(node);
-  }
-  visitAlterTable(node) {
-    this.defaultVisit(node);
-  }
-  visitDropColumn(node) {
-    this.defaultVisit(node);
-  }
-  visitRenameColumn(node) {
-    this.defaultVisit(node);
-  }
-  visitAlterColumn(node) {
-    this.defaultVisit(node);
-  }
-  visitModifyColumn(node) {
-    this.defaultVisit(node);
-  }
-  visitAddConstraint(node) {
-    this.defaultVisit(node);
-  }
-  visitDropConstraint(node) {
-    this.defaultVisit(node);
-  }
-  visitForeignKeyConstraint(node) {
-    this.defaultVisit(node);
-  }
-  visitCreateView(node) {
-    this.defaultVisit(node);
-  }
-  visitDropView(node) {
-    this.defaultVisit(node);
-  }
-  visitGenerated(node) {
-    this.defaultVisit(node);
-  }
-  visitDefaultValue(node) {
-    this.defaultVisit(node);
-  }
-  visitOn(node) {
-    this.defaultVisit(node);
-  }
-  visitValues(node) {
-    this.defaultVisit(node);
-  }
-  visitSelectModifier(node) {
-    this.defaultVisit(node);
-  }
-  visitCreateType(node) {
-    this.defaultVisit(node);
-  }
-  visitDropType(node) {
-    this.defaultVisit(node);
-  }
-  visitExplain(node) {
-    this.defaultVisit(node);
-  }
-  visitDefaultInsertValue(node) {
-    this.defaultVisit(node);
-  }
-  visitAggregateFunction(node) {
-    this.defaultVisit(node);
-  }
-  visitOver(node) {
-    this.defaultVisit(node);
-  }
-  visitPartitionBy(node) {
-    this.defaultVisit(node);
-  }
-  visitPartitionByItem(node) {
-    this.defaultVisit(node);
-  }
-  visitSetOperation(node) {
-    this.defaultVisit(node);
-  }
-  visitBinaryOperation(node) {
-    this.defaultVisit(node);
-  }
-  visitUnaryOperation(node) {
-    this.defaultVisit(node);
-  }
-  visitUsing(node) {
-    this.defaultVisit(node);
-  }
-  visitFunction(node) {
-    this.defaultVisit(node);
-  }
-  visitCase(node) {
-    this.defaultVisit(node);
-  }
-  visitWhen(node) {
-    this.defaultVisit(node);
-  }
-  visitJSONReference(node) {
-    this.defaultVisit(node);
-  }
-  visitJSONPath(node) {
-    this.defaultVisit(node);
-  }
-  visitJSONPathLeg(node) {
-    this.defaultVisit(node);
-  }
-  visitJSONOperatorChain(node) {
-    this.defaultVisit(node);
-  }
-  visitTuple(node) {
-    this.defaultVisit(node);
-  }
-  visitMergeQuery(node) {
-    this.defaultVisit(node);
-  }
-  visitMatched(node) {
-    this.defaultVisit(node);
-  }
-  visitAddIndex(node) {
-    this.defaultVisit(node);
-  }
-  visitCast(node) {
-    this.defaultVisit(node);
-  }
-  visitFetch(node) {
-    this.defaultVisit(node);
-  }
-  visitTop(node) {
-    this.defaultVisit(node);
-  }
-  visitOutput(node) {
-    this.defaultVisit(node);
-  }
-};
-
-// src/plugins/policy/column-collector.ts
-var ColumnCollector = class extends DefaultOperationNodeVisitor {
-  static {
-    __name(this, "ColumnCollector");
-  }
-  columns = [];
-  collect(node) {
-    this.columns = [];
-    this.visitNode(node);
-    return this.columns;
-  }
-  visitColumn(node) {
-    if (!this.columns.includes(node.column.name)) {
-      this.columns.push(node.column.name);
-    }
-  }
-};
-
-// src/plugins/policy/expression-transformer.ts
-var import_common_helpers5 = require("@zenstackhq/common-helpers");
-var import_kysely6 = require("kysely");
-var import_ts_pattern6 = require("ts-pattern");
-
-// src/plugins/policy/expression-evaluator.ts
-var import_common_helpers4 = require("@zenstackhq/common-helpers");
-var import_ts_pattern5 = require("ts-pattern");
-var ExpressionEvaluator = class {
-  static {
-    __name(this, "ExpressionEvaluator");
-  }
-  evaluate(expression, context) {
-    const result = (0, import_ts_pattern5.match)(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
-    return result ?? null;
-  }
-  evaluateCall(expr2, context) {
-    if (expr2.function === "auth") {
-      return context.auth;
-    } else {
-      throw new Error(`Unsupported call expression function: ${expr2.function}`);
-    }
-  }
-  evaluateUnary(expr2, context) {
-    return (0, import_ts_pattern5.match)(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
-  }
-  evaluateMember(expr2, context) {
-    let val = this.evaluate(expr2.receiver, context);
-    for (const member of expr2.members) {
-      val = val?.[member];
-    }
-    return val;
-  }
-  evaluateLiteral(expr2) {
-    return expr2.value;
-  }
-  evaluateField(expr2, context) {
-    return context.thisValue?.[expr2.field];
-  }
-  evaluateArray(expr2, context) {
-    return expr2.items.map((item) => this.evaluate(item, context));
-  }
-  evaluateBinary(expr2, context) {
-    if (expr2.op === "?" || expr2.op === "!" || expr2.op === "^") {
-      return this.evaluateCollectionPredicate(expr2, context);
-    }
-    const left = this.evaluate(expr2.left, context);
-    const right = this.evaluate(expr2.right, context);
-    return (0, import_ts_pattern5.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
-      const _right = right ?? [];
-      (0, import_common_helpers4.invariant)(Array.isArray(_right), 'expected array for "in" operator');
-      return _right.includes(left);
-    }).exhaustive();
-  }
-  evaluateCollectionPredicate(expr2, context) {
-    const op = expr2.op;
-    (0, import_common_helpers4.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
-    const left = this.evaluate(expr2.left, context);
-    if (!left) {
-      return false;
-    }
-    (0, import_common_helpers4.invariant)(Array.isArray(left), "expected array");
-    return (0, import_ts_pattern5.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
-      ...context,
-      thisValue: item
-    }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
-      ...context,
-      thisValue: item
-    }))).with("^", () => !left.some((item) => this.evaluate(expr2.right, {
-      ...context,
-      thisValue: item
-    }))).exhaustive();
-  }
-};
-
-// src/plugins/policy/utils.ts
-var import_kysely5 = require("kysely");
-function trueNode(dialect) {
-  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
-}
-__name(trueNode, "trueNode");
-function falseNode(dialect) {
-  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
-}
-__name(falseNode, "falseNode");
-function isTrueNode(node) {
-  return import_kysely5.ValueNode.is(node) && (node.value === true || node.value === 1);
-}
-__name(isTrueNode, "isTrueNode");
-function isFalseNode(node) {
-  return import_kysely5.ValueNode.is(node) && (node.value === false || node.value === 0);
-}
-__name(isFalseNode, "isFalseNode");
-function conjunction(dialect, nodes) {
-  if (nodes.some(isFalseNode)) {
-    return falseNode(dialect);
-  }
-  const items = nodes.filter((n) => !isTrueNode(n));
-  if (items.length === 0) {
-    return trueNode(dialect);
-  }
-  return items.reduce((acc, node) => import_kysely5.OrNode.is(node) ? import_kysely5.AndNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.AndNode.create(acc, node));
-}
-__name(conjunction, "conjunction");
-function disjunction(dialect, nodes) {
-  if (nodes.some(isTrueNode)) {
-    return trueNode(dialect);
-  }
-  const items = nodes.filter((n) => !isFalseNode(n));
-  if (items.length === 0) {
-    return falseNode(dialect);
-  }
-  return items.reduce((acc, node) => import_kysely5.AndNode.is(node) ? import_kysely5.OrNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.OrNode.create(acc, node));
-}
-__name(disjunction, "disjunction");
-function logicalNot(node) {
-  return import_kysely5.UnaryOperationNode.create(import_kysely5.OperatorNode.create("not"), import_kysely5.AndNode.is(node) || import_kysely5.OrNode.is(node) ? import_kysely5.ParensNode.create(node) : node);
-}
-__name(logicalNot, "logicalNot");
-function buildIsFalse(node, dialect) {
-  if (isFalseNode(node)) {
-    return trueNode(dialect);
-  } else if (isTrueNode(node)) {
-    return falseNode(dialect);
-  }
-  return import_kysely5.BinaryOperationNode.create(
-    // coalesce so null is treated as false
-    import_kysely5.FunctionNode.create("coalesce", [
-      node,
-      falseNode(dialect)
-    ]),
-    import_kysely5.OperatorNode.create("="),
-    falseNode(dialect)
-  );
-}
-__name(buildIsFalse, "buildIsFalse");
-function getTableName(node) {
-  if (!node) {
-    return node;
-  }
-  if (import_kysely5.TableNode.is(node)) {
-    return node.table.identifier.name;
-  } else if (import_kysely5.AliasNode.is(node)) {
-    return getTableName(node.node);
-  } else if (import_kysely5.ReferenceNode.is(node) && node.table) {
-    return getTableName(node.table);
-  }
-  return void 0;
-}
-__name(getTableName, "getTableName");
-
-// src/plugins/policy/expression-transformer.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata, "_ts_metadata");
-var expressionHandlers = /* @__PURE__ */ new Map();
-function expr(kind) {
-  return function(_target, _propertyKey, descriptor) {
-    if (!expressionHandlers.get(kind)) {
-      expressionHandlers.set(kind, descriptor);
-    }
-    return descriptor;
-  };
-}
-__name(expr, "expr");
-var ExpressionTransformer = class {
-  static {
-    __name(this, "ExpressionTransformer");
-  }
-  schema;
-  clientOptions;
-  auth;
-  dialect;
-  constructor(schema, clientOptions, auth) {
-    this.schema = schema;
-    this.clientOptions = clientOptions;
-    this.auth = auth;
-    this.dialect = getCrudDialect(this.schema, this.clientOptions);
-  }
-  get authType() {
-    if (!this.schema.authType) {
-      throw new InternalError('Schema does not have an "authType" specified');
-    }
-    return this.schema.authType;
-  }
-  transform(expression, context) {
-    const handler = expressionHandlers.get(expression.kind);
-    if (!handler) {
-      throw new Error(`Unsupported expression kind: ${expression.kind}`);
-    }
-    return handler.value.call(this, expression, context);
-  }
-  _literal(expr2) {
-    return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
-  }
-  _array(expr2, context) {
-    return import_kysely6.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
-  }
-  _field(expr2, context) {
-    const fieldDef = requireField(this.schema, context.model, expr2.field);
-    if (!fieldDef.relation) {
-      if (context.thisEntity) {
-        return context.thisEntity[expr2.field];
-      } else {
-        return this.createColumnRef(expr2.field, context);
-      }
-    } else {
-      const { memberFilter, memberSelect, ...restContext } = context;
-      const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
-      return {
-        ...relation,
-        where: this.mergeWhere(relation.where, memberFilter),
-        selections: memberSelect ? [
-          memberSelect
-        ] : relation.selections
-      };
-    }
-  }
-  mergeWhere(where, memberFilter) {
-    if (!where) {
-      return import_kysely6.WhereNode.create(memberFilter ?? trueNode(this.dialect));
-    }
-    if (!memberFilter) {
-      return where;
-    }
-    return import_kysely6.WhereNode.create(conjunction(this.dialect, [
-      where.where,
-      memberFilter
-    ]));
-  }
-  _null() {
-    return import_kysely6.ValueNode.createImmediate(null);
-  }
-  _binary(expr2, context) {
-    if (expr2.op === "&&") {
-      return conjunction(this.dialect, [
-        this.transform(expr2.left, context),
-        this.transform(expr2.right, context)
-      ]);
-    } else if (expr2.op === "||") {
-      return disjunction(this.dialect, [
-        this.transform(expr2.left, context),
-        this.transform(expr2.right, context)
-      ]);
-    }
-    if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
-      return this.transformAuthBinary(expr2);
-    }
-    const op = expr2.op;
-    if (op === "?" || op === "!" || op === "^") {
-      return this.transformCollectionPredicate(expr2, context);
-    }
-    const left = this.transform(expr2.left, context);
-    const right = this.transform(expr2.right, context);
-    if (op === "in") {
-      if (this.isNullNode(left)) {
-        return this.transformValue(false, "Boolean");
-      } else {
-        if (import_kysely6.ValueListNode.is(right)) {
-          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("in"), right);
-        } else {
-          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("="), import_kysely6.FunctionNode.create("any", [
-            right
-          ]));
-        }
-      }
-    }
-    if (this.isNullNode(right)) {
-      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is"), right) : import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is not"), right);
-    } else if (this.isNullNode(left)) {
-      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is"), import_kysely6.ValueNode.createImmediate(null)) : import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is not"), import_kysely6.ValueNode.createImmediate(null));
-    }
-    return import_kysely6.BinaryOperationNode.create(left, this.transformOperator(op), right);
-  }
-  transformCollectionPredicate(expr2, context) {
-    (0, import_common_helpers5.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
-    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
-      const value = new ExpressionEvaluator().evaluate(expr2, {
-        auth: this.auth
-      });
-      return this.transformValue(value, "Boolean");
-    }
-    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
-    let newContextModel;
-    if (ExpressionUtils.isField(expr2.left)) {
-      const fieldDef = requireField(this.schema, context.model, expr2.left.field);
-      newContextModel = fieldDef.type;
-    } else {
-      (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.left.receiver));
-      const fieldDef = requireField(this.schema, context.model, expr2.left.receiver.field);
-      newContextModel = fieldDef.type;
-      for (const member of expr2.left.members) {
-        const memberDef = requireField(this.schema, newContextModel, member);
-        newContextModel = memberDef.type;
-      }
-    }
-    let predicateFilter = this.transform(expr2.right, {
-      ...context,
-      model: newContextModel,
-      alias: void 0,
-      thisEntity: void 0
-    });
-    if (expr2.op === "!") {
-      predicateFilter = logicalNot(predicateFilter);
-    }
-    const count = import_kysely6.FunctionNode.create("count", [
-      import_kysely6.ValueNode.createImmediate(1)
-    ]);
-    const predicateResult = (0, import_ts_pattern6.match)(expr2.op).with("?", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create(">"), import_kysely6.ValueNode.createImmediate(0))).with("!", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).with("^", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).exhaustive();
-    return this.transform(expr2.left, {
-      ...context,
-      memberSelect: import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(predicateResult, import_kysely6.IdentifierNode.create("$t"))),
-      memberFilter: predicateFilter
-    });
-  }
-  transformAuthBinary(expr2) {
-    if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw new Error(`Unsupported operator for auth call: ${expr2.op}`);
-    }
-    let other;
-    if (this.isAuthCall(expr2.left)) {
-      other = expr2.right;
-    } else {
-      other = expr2.left;
-    }
-    if (ExpressionUtils.isNull(other)) {
-      return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
-    } else {
-      throw new Error("Unsupported binary expression with `auth()`");
-    }
-  }
-  transformValue(value, type) {
-    return import_kysely6.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
-  }
-  _unary(expr2, context) {
-    (0, import_common_helpers5.invariant)(expr2.op === "!", 'only "!" operator is supported');
-    return import_kysely6.BinaryOperationNode.create(this.transform(expr2.operand, context), this.transformOperator("!="), trueNode(this.dialect));
-  }
-  transformOperator(op) {
-    const mappedOp = (0, import_ts_pattern6.match)(op).with("==", () => "=").otherwise(() => op);
-    return import_kysely6.OperatorNode.create(mappedOp);
-  }
-  _call(expr2, context) {
-    const result = this.transformCall(expr2, context);
-    return result.toOperationNode();
-  }
-  transformCall(expr2, context) {
-    const func = this.clientOptions.functions?.[expr2.function];
-    if (!func) {
-      throw new QueryError(`Function not implemented: ${expr2.function}`);
-    }
-    const eb = (0, import_kysely6.expressionBuilder)();
-    return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
-      dialect: this.dialect,
-      model: context.model,
-      operation: context.operation
-    });
-  }
-  transformCallArg(eb, arg, context) {
-    if (ExpressionUtils.isLiteral(arg)) {
-      return eb.val(arg.value);
-    }
-    if (ExpressionUtils.isField(arg)) {
-      return context.thisEntityRaw ? eb.val(context.thisEntityRaw[arg.field]) : eb.ref(arg.field);
-    }
-    if (ExpressionUtils.isCall(arg)) {
-      return this.transformCall(arg, context);
-    }
-    if (this.isAuthMember(arg)) {
-      const valNode = this.valueMemberAccess(context.auth, arg, this.authType);
-      return valNode ? eb.val(valNode.value) : eb.val(null);
-    }
-    throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
-  }
-  _member(expr2, context) {
-    if (this.isAuthCall(expr2.receiver)) {
-      return this.valueMemberAccess(this.auth, expr2, this.authType);
-    }
-    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.receiver), "expect receiver to be field expression");
-    const { memberFilter, memberSelect, ...restContext } = context;
-    const receiver = this.transform(expr2.receiver, restContext);
-    (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(receiver), "expected receiver to be select query");
-    const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
-    const memberFields = [];
-    let currType = receiverField.type;
-    for (const member of expr2.members) {
-      const fieldDef = requireField(this.schema, currType, member);
-      memberFields.push({
-        fieldDef,
-        fromModel: currType
-      });
-      currType = fieldDef.type;
-    }
-    let currNode = void 0;
-    for (let i = expr2.members.length - 1; i >= 0; i--) {
-      const member = expr2.members[i];
-      const { fieldDef, fromModel } = memberFields[i];
-      if (fieldDef.relation) {
-        const relation = this.transformRelationAccess(member, fieldDef.type, {
-          ...restContext,
-          model: fromModel,
-          alias: void 0,
-          thisEntity: void 0
-        });
-        if (currNode) {
-          (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(currNode), "expected select query node");
-          currNode = {
-            ...relation,
-            selections: [
-              import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create(expr2.members[i + 1])))
-            ]
-          };
-        } else {
-          currNode = {
-            ...relation,
-            where: this.mergeWhere(relation.where, memberFilter),
-            selections: memberSelect ? [
-              memberSelect
-            ] : relation.selections
-          };
-        }
-      } else {
-        (0, import_common_helpers5.invariant)(i === expr2.members.length - 1, "plain field access must be the last segment");
-        (0, import_common_helpers5.invariant)(!currNode, "plain field access must be the last segment");
-        currNode = import_kysely6.ColumnNode.create(member);
-      }
-    }
-    return {
-      ...receiver,
-      selections: [
-        import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create("$t")))
-      ]
-    };
-  }
-  valueMemberAccess(receiver, expr2, receiverType) {
-    if (!receiver) {
-      return import_kysely6.ValueNode.createImmediate(null);
-    }
-    if (expr2.members.length !== 1) {
-      throw new Error(`Only single member access is supported`);
-    }
-    const field = expr2.members[0];
-    const fieldDef = requireField(this.schema, receiverType, field);
-    const fieldValue = receiver[field] ?? null;
-    return this.transformValue(fieldValue, fieldDef.type);
-  }
-  transformRelationAccess(field, relationModel, context) {
-    const fromModel = context.model;
-    const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
-    if (context.thisEntity) {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[fk])));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[pk])));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: import_kysely6.FromNode.create([
-          import_kysely6.TableNode.create(relationModel)
-        ]),
-        where: import_kysely6.WhereNode.create(condition)
-      };
-    } else {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)))));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)))));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: import_kysely6.FromNode.create([
-          import_kysely6.TableNode.create(relationModel)
-        ]),
-        where: import_kysely6.WhereNode.create(condition)
-      };
-    }
-  }
-  createColumnRef(column, context) {
-    return import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(column), import_kysely6.TableNode.create(context.alias ?? context.model));
-  }
-  isAuthCall(value) {
-    return ExpressionUtils.isCall(value) && value.function === "auth";
-  }
-  isAuthMember(expr2) {
-    return ExpressionUtils.isMember(expr2) && this.isAuthCall(expr2.receiver);
-  }
-  isNullNode(node) {
-    return import_kysely6.ValueNode.is(node) && node.value === null;
-  }
-};
-_ts_decorate([
-  expr("literal"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof LiteralExpression === "undefined" ? Object : LiteralExpression
-  ]),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_literal", null);
-_ts_decorate([
-  expr("array"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof ArrayExpression === "undefined" ? Object : ArrayExpression,
-    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
-  ]),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_array", null);
-_ts_decorate([
-  expr("field"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof FieldExpression === "undefined" ? Object : FieldExpression,
-    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
-  ]),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_field", null);
-_ts_decorate([
-  expr("null"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", []),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_null", null);
-_ts_decorate([
-  expr("binary"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof BinaryExpression === "undefined" ? Object : BinaryExpression,
-    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
-  ]),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_binary", null);
-_ts_decorate([
-  expr("unary"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof UnaryExpression === "undefined" ? Object : UnaryExpression,
-    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
-  ]),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_unary", null);
-_ts_decorate([
-  expr("call"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof CallExpression === "undefined" ? Object : CallExpression,
-    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
-  ]),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_call", null);
-_ts_decorate([
-  expr("member"),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof MemberExpression === "undefined" ? Object : MemberExpression,
-    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
-  ]),
-  _ts_metadata("design:returntype", void 0)
-], ExpressionTransformer.prototype, "_member", null);
-
-// src/plugins/policy/policy-handler.ts
-var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
-  static {
-    __name(this, "PolicyHandler");
-  }
-  client;
-  dialect;
-  constructor(client) {
-    super(), this.client = client;
-    this.dialect = getCrudDialect(this.client.$schema, this.client.$options);
-  }
-  get kysely() {
-    return this.client.$qb;
-  }
-  async handle(node, proceed) {
-    if (!this.isCrudQueryNode(node)) {
-      throw new RejectedByPolicyError(void 0, "non-CRUD queries are not allowed");
-    }
-    if (!this.isMutationQueryNode(node)) {
-      return proceed(this.transformNode(node));
-    }
-    let mutationRequiresTransaction = false;
-    const mutationModel = this.getMutationModel(node);
-    if (import_kysely7.InsertQueryNode.is(node)) {
-      const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
-      if (constCondition === false) {
-        throw new RejectedByPolicyError(mutationModel);
-      } else if (constCondition === void 0) {
-        mutationRequiresTransaction = true;
-      }
-    }
-    if (!mutationRequiresTransaction && !node.returning) {
-      return proceed(this.transformNode(node));
-    }
-    if (import_kysely7.InsertQueryNode.is(node)) {
-      await this.enforcePreCreatePolicy(node, proceed);
-    }
-    const transformedNode = this.transformNode(node);
-    const result = await proceed(transformedNode);
-    if (!this.onlyReturningId(node)) {
-      const readBackResult = await this.processReadBack(node, result, proceed);
-      if (readBackResult.rows.length !== result.rows.length) {
-        throw new RejectedByPolicyError(mutationModel, "result is not allowed to be read back");
-      }
-      return readBackResult;
-    } else {
-      return result;
-    }
-  }
-  onlyReturningId(node) {
-    if (!node.returning) {
-      return true;
-    }
-    const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
-    const collector = new ColumnCollector();
-    const selectedColumns = collector.collect(node.returning);
-    return selectedColumns.every((c) => idFields.includes(c));
-  }
-  async enforcePreCreatePolicy(node, proceed) {
-    if (!node.columns || !node.values) {
-      return;
-    }
-    const model = this.getMutationModel(node);
-    const fields = node.columns.map((c) => c.column.name);
-    const valueRows = this.unwrapCreateValueRows(node.values, model, fields);
-    for (const values of valueRows) {
-      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), values.map((v) => v.raw), proceed);
-    }
-  }
-  async enforcePreCreatePolicyForOne(model, fields, values, valuesRaw, proceed) {
-    const thisEntity = {};
-    const thisEntityRaw = {};
-    for (let i = 0; i < fields.length; i++) {
-      thisEntity[fields[i]] = values[i];
-      thisEntityRaw[fields[i]] = valuesRaw[i];
-    }
-    const filter = this.buildPolicyFilter(model, void 0, "create", thisEntity, thisEntityRaw);
-    const preCreateCheck = {
-      kind: "SelectQueryNode",
-      selections: [
-        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(filter, import_kysely7.IdentifierNode.create("$condition")))
-      ]
-    };
-    const result = await proceed(preCreateCheck);
-    if (!result.rows[0]?.$condition) {
-      throw new RejectedByPolicyError(model);
-    }
-  }
-  unwrapCreateValueRows(node, model, fields) {
-    if (import_kysely7.ValuesNode.is(node)) {
-      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields));
-    } else if (import_kysely7.PrimitiveValueListNode.is(node)) {
-      return [
-        this.unwrapCreateValueRow(node.values, model, fields)
-      ];
-    } else {
-      throw new InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
-    }
-  }
-  unwrapCreateValueRow(data, model, fields) {
-    (0, import_common_helpers6.invariant)(data.length === fields.length, "data length must match fields length");
-    const result = [];
-    for (let i = 0; i < data.length; i++) {
-      const item = data[i];
-      const fieldDef = requireField(this.client.$schema, model, fields[i]);
-      if (typeof item === "object" && item && "kind" in item) {
-        (0, import_common_helpers6.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
-        result.push({
-          node: import_kysely7.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
-          raw: item.value
-        });
-      } else {
-        const value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
-        if (Array.isArray(value)) {
-          result.push({
-            node: import_kysely7.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
-            raw: value
-          });
-        } else {
-          result.push({
-            node: import_kysely7.ValueNode.create(value),
-            raw: value
-          });
-        }
-      }
-    }
-    return result;
-  }
-  tryGetConstantPolicy(model, operation) {
-    const policies = this.getModelPolicies(model, operation);
-    if (!policies.some((p) => p.kind === "allow")) {
-      return false;
-    } else if (
-      // unconditional deny
-      policies.some((p) => p.kind === "deny" && this.isTrueExpr(p.condition))
-    ) {
-      return false;
-    } else if (
-      // unconditional allow
-      !policies.some((p) => p.kind === "deny") && policies.some((p) => p.kind === "allow" && this.isTrueExpr(p.condition))
-    ) {
-      return true;
-    } else {
-      return void 0;
-    }
-  }
-  isTrueExpr(expr2) {
-    return ExpressionUtils.isLiteral(expr2) && expr2.value === true;
-  }
-  async processReadBack(node, result, proceed) {
-    if (result.rows.length === 0) {
-      return result;
-    }
-    if (!this.isMutationQueryNode(node) || !node.returning) {
-      return result;
-    }
-    const table = this.getMutationModel(node);
-    if (!table) {
-      throw new InternalError(`Unable to get table name for query node: ${node}`);
-    }
-    const idConditions = this.buildIdConditions(table, result.rows);
-    const policyFilter = this.buildPolicyFilter(table, void 0, "read");
-    const select = {
-      kind: "SelectQueryNode",
-      from: import_kysely7.FromNode.create([
-        import_kysely7.TableNode.create(table)
-      ]),
-      where: import_kysely7.WhereNode.create(conjunction(this.dialect, [
-        idConditions,
-        policyFilter
-      ])),
-      selections: node.returning.selections
-    };
-    const selectResult = await proceed(select);
-    return selectResult;
-  }
-  buildIdConditions(table, rows) {
-    const idFields = getIdFields(this.client.$schema, table);
-    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely7.BinaryOperationNode.create(import_kysely7.ColumnNode.create(field), import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.create(row[field]))))));
-  }
-  getMutationModel(node) {
-    const r = (0, import_ts_pattern7.match)(node).when(import_kysely7.InsertQueryNode.is, (node2) => getTableName(node2.into)).when(import_kysely7.UpdateQueryNode.is, (node2) => getTableName(node2.table)).when(import_kysely7.DeleteQueryNode.is, (node2) => {
-      if (node2.from.froms.length !== 1) {
-        throw new InternalError("Only one from table is supported for delete");
-      }
-      return getTableName(node2.from.froms[0]);
-    }).exhaustive();
-    if (!r) {
-      throw new InternalError(`Unable to get table name for query node: ${node}`);
-    }
-    return r;
-  }
-  isCrudQueryNode(node) {
-    return import_kysely7.SelectQueryNode.is(node) || import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
-  }
-  isMutationQueryNode(node) {
-    return import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
-  }
-  buildPolicyFilter(model, alias, operation, thisEntity, thisEntityRaw) {
-    const policies = this.getModelPolicies(model, operation);
-    if (policies.length === 0) {
-      return falseNode(this.dialect);
-    }
-    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
-    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
-    let combinedPolicy;
-    if (allows.length === 0) {
-      combinedPolicy = falseNode(this.dialect);
-    } else {
-      combinedPolicy = disjunction(this.dialect, allows);
-      if (denies.length !== 0) {
-        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
-        combinedPolicy = conjunction(this.dialect, [
-          combinedPolicy,
-          combinedDenies
-        ]);
-      }
-    }
-    return combinedPolicy;
-  }
-  transformSelectQuery(node) {
-    let whereNode = node.where;
-    node.from?.froms.forEach((from) => {
-      const extractResult = this.extractTableName(from);
-      if (extractResult) {
-        const { model, alias } = extractResult;
-        const filter = this.buildPolicyFilter(model, alias, "read");
-        whereNode = import_kysely7.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
-          whereNode.where,
-          filter
-        ]) : filter);
-      }
-    });
-    const baseResult = super.transformSelectQuery({
-      ...node,
-      where: void 0
-    });
-    return {
-      ...baseResult,
-      where: whereNode
-    };
-  }
-  transformInsertQuery(node) {
-    const result = super.transformInsertQuery(node);
-    if (!node.returning) {
-      return result;
-    }
-    if (this.onlyReturningId(node)) {
-      return result;
-    } else {
-      const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
-      return {
-        ...result,
-        returning: import_kysely7.ReturningNode.create(idFields.map((field) => import_kysely7.SelectionNode.create(import_kysely7.ColumnNode.create(field))))
-      };
-    }
-  }
-  transformUpdateQuery(node) {
-    const result = super.transformUpdateQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "update");
-    return {
-      ...result,
-      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
-  }
-  transformDeleteQuery(node) {
-    const result = super.transformDeleteQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "delete");
-    return {
-      ...result,
-      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
-  }
-  extractTableName(from) {
-    if (import_kysely7.TableNode.is(from)) {
-      return {
-        model: from.table.identifier.name
-      };
-    }
-    if (import_kysely7.AliasNode.is(from)) {
-      const inner = this.extractTableName(from.node);
-      if (!inner) {
-        return void 0;
-      }
-      return {
-        model: inner.model,
-        alias: import_kysely7.IdentifierNode.is(from.alias) ? from.alias.name : void 0
-      };
-    } else {
-      return void 0;
-    }
-  }
-  transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw) {
-    return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
-      model,
-      alias,
-      operation,
-      thisEntity,
-      thisEntityRaw,
-      auth: this.client.$auth
-    });
-  }
-  getModelPolicies(modelName, operation) {
-    const modelDef = requireModel(this.client.$schema, modelName);
-    const result = [];
-    const extractOperations = /* @__PURE__ */ __name((expr2) => {
-      (0, import_common_helpers6.invariant)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
-      (0, import_common_helpers6.invariant)(typeof expr2.value === "string", "expecting a string literal");
-      return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
-    }, "extractOperations");
-    if (modelDef.attributes) {
-      result.push(...modelDef.attributes.filter((attr) => attr.name === "@@allow" || attr.name === "@@deny").map((attr) => ({
-        kind: attr.name === "@@allow" ? "allow" : "deny",
-        operations: extractOperations(attr.args[0].value),
-        condition: attr.args[1].value
-      })).filter((policy) => policy.operations.includes("all") || policy.operations.includes(operation)));
-    }
-    return result;
-  }
-};
-
-// src/plugins/policy/plugin.ts
-var PolicyPlugin = class {
-  static {
-    __name(this, "PolicyPlugin");
-  }
-  get id() {
-    return "policy";
-  }
-  get name() {
-    return "Access Policy";
-  }
-  get description() {
-    return "Enforces access policies defined in the schema.";
-  }
-  onKyselyQuery({
-    query,
-    client,
-    proceed
-    /*, transaction*/
-  }) {
-    const handler = new PolicyHandler(client);
-    return handler.handle(
-      query,
-      proceed
-      /*, transaction*/
-    );
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  PolicyPlugin,
-  RejectedByPolicyError
-});
-//# sourceMappingURL=policy.cjs.map