@zenstackhq/runtime 3.0.0-beta.3 → 3.0.0-beta.5

package/dist/plugins/policy/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
@@ -16,57 +18,70 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/plugins/policy/index.ts
 var policy_exports = {};
 __export(policy_exports, {
   PolicyPlugin: () => PolicyPlugin,
-  RejectedByPolicyError: () => RejectedByPolicyError
+  RejectedByPolicyError: () => RejectedByPolicyError,
+  RejectedByPolicyReason: () => RejectedByPolicyReason
 });
 module.exports = __toCommonJS(policy_exports);
 
 // src/plugins/policy/errors.ts
+var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
+  RejectedByPolicyReason2["NO_ACCESS"] = "no-access";
+  RejectedByPolicyReason2["CANNOT_READ_BACK"] = "cannot-read-back";
+  RejectedByPolicyReason2["OTHER"] = "other";
+  return RejectedByPolicyReason2;
+}({});
 var RejectedByPolicyError = class extends Error {
   static {
     __name(this, "RejectedByPolicyError");
   }
   model;
   reason;
-  constructor(model, reason) {
-    super(reason ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
+  constructor(model, reason = "no-access", message) {
+    super(message ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
   }
 };
 
-// src/plugins/policy/policy-handler.ts
-var import_common_helpers6 = require("@zenstackhq/common-helpers");
-var import_kysely7 = require("kysely");
-var import_ts_pattern8 = require("ts-pattern");
-
-// src/client/crud/dialects/index.ts
-var import_ts_pattern5 = require("ts-pattern");
+// src/plugins/policy/functions.ts
+var import_common_helpers8 = require("@zenstackhq/common-helpers");
+var import_kysely9 = require("kysely");
 
-// src/client/crud/dialects/postgresql.ts
-var import_common_helpers2 = require("@zenstackhq/common-helpers");
-var import_kysely2 = require("kysely");
-var import_ts_pattern3 = require("ts-pattern");
-
-// src/client/constants.ts
-var DELEGATE_JOINED_FIELD_PREFIX = "$delegate$";
-var LOGICAL_COMBINATORS = [
-  "AND",
-  "OR",
-  "NOT"
-];
-var AGGREGATE_OPERATORS = [
-  "_count",
-  "_sum",
-  "_avg",
-  "_min",
-  "_max"
+// src/client/contract.ts
+var CRUD = [
+  "create",
+  "read",
+  "update",
+  "delete"
 ];
 
+// src/client/kysely-utils.ts
+var import_kysely = require("kysely");
+function extractFieldName(node) {
+  if (import_kysely.ReferenceNode.is(node) && import_kysely.ColumnNode.is(node.column)) {
+    return node.column.column.name;
+  } else if (import_kysely.ColumnNode.is(node)) {
+    return node.column.name;
+  } else {
+    return void 0;
+  }
+}
+__name(extractFieldName, "extractFieldName");
+
 // src/client/query-utils.ts
+var import_common_helpers = require("@zenstackhq/common-helpers");
 var import_ts_pattern = require("ts-pattern");
 
 // src/schema/expression.ts
@@ -134,6 +149,9 @@ var ExpressionUtils = {
   or: /* @__PURE__ */ __name((expr2, ...expressions) => {
     return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "||", exp), expr2);
   }, "or"),
+  not: /* @__PURE__ */ __name((expr2) => {
+    return ExpressionUtils.unary("!", expr2);
+  }, "not"),
   is: /* @__PURE__ */ __name((value, kind) => {
     return !!value && typeof value === "object" && "kind" in value && value.kind === kind;
   }, "is"),
@@ -170,15 +188,19 @@ var InternalError = class extends Error {
 
 // src/client/query-utils.ts
 function getModel(schema, model) {
-  return schema.models[model];
+  return Object.values(schema.models).find((m) => m.name.toLowerCase() === model.toLowerCase());
 }
 __name(getModel, "getModel");
+function getTypeDef(schema, type) {
+  return schema.typeDefs?.[type];
+}
+__name(getTypeDef, "getTypeDef");
 function requireModel(schema, model) {
-  const matchedName = Object.keys(schema.models).find((k) => k.toLowerCase() === model.toLowerCase());
-  if (!matchedName) {
+  const modelDef = getModel(schema, model);
+  if (!modelDef) {
     throw new QueryError(`Model "${model}" not found in schema`);
   }
-  return schema.models[matchedName];
+  return modelDef;
 }
 __name(requireModel, "requireModel");
 function getField(schema, model, field) {
@@ -186,19 +208,35 @@ function getField(schema, model, field) {
   return modelDef?.fields[field];
 }
 __name(getField, "getField");
-function requireField(schema, model, field) {
-  const modelDef = requireModel(schema, model);
-  if (!modelDef.fields[field]) {
-    throw new QueryError(`Field "${field}" not found in model "${model}"`);
+function requireField(schema, modelOrType, field) {
+  const modelDef = getModel(schema, modelOrType);
+  if (modelDef) {
+    if (!modelDef.fields[field]) {
+      throw new QueryError(`Field "${field}" not found in model "${modelOrType}"`);
+    } else {
+      return modelDef.fields[field];
+    }
   }
-  return modelDef.fields[field];
+  const typeDef = getTypeDef(schema, modelOrType);
+  if (typeDef) {
+    if (!typeDef.fields[field]) {
+      throw new QueryError(`Field "${field}" not found in type "${modelOrType}"`);
+    } else {
+      return typeDef.fields[field];
+    }
+  }
+  throw new QueryError(`Model or type "${modelOrType}" not found in schema`);
 }
 __name(requireField, "requireField");
-function getIdFields(schema, model) {
+function requireIdFields(schema, model) {
   const modelDef = requireModel(schema, model);
-  return modelDef?.idFields;
+  const result = modelDef?.idFields;
+  if (!result) {
+    throw new InternalError(`Model "${model}" does not have ID field(s)`);
+  }
+  return result;
 }
-__name(getIdFields, "getIdFields");
+__name(requireIdFields, "requireIdFields");
 function getRelationForeignKeyFieldPairs(schema, model, relationField) {
   const fieldDef = requireField(schema, model, relationField);
   if (!fieldDef?.relation) {
@@ -291,7 +329,7 @@ function buildFieldRef(schema, model, field, options, eb, modelAlias, inlineComp
       throw new QueryError(`Computed field "${field}" implementation not provided for model "${model}"`);
     }
     return computer(eb, {
-      currentModel: modelAlias
+      modelAlias
     });
   }
 }
@@ -318,7 +356,7 @@ function buildJoinPairs(schema, model, modelAlias, relationField, relationModelA
 }
 __name(buildJoinPairs, "buildJoinPairs");
 function makeDefaultOrderBy(schema, model) {
-  const idFields = getIdFields(schema, model);
+  const idFields = requireIdFields(schema, model);
   return idFields.map((f) => ({
     [f]: "asc"
   }));
@@ -357,11 +395,17 @@ function getManyToManyRelation(schema, model, field) {
         "A"
       ];
     }
+    const modelIdFields = requireIdFields(schema, model);
+    (0, import_common_helpers.invariant)(modelIdFields.length === 1, "Only single-field ID is supported for many-to-many relation");
+    const otherIdFields = requireIdFields(schema, fieldDef.type);
+    (0, import_common_helpers.invariant)(otherIdFields.length === 1, "Only single-field ID is supported for many-to-many relation");
     return {
       parentFkName: orderedFK[0],
+      parentPKName: modelIdFields[0],
       otherModel: fieldDef.type,
       otherField: fieldDef.relation.opposite,
       otherFkName: orderedFK[1],
+      otherPKName: otherIdFields[0],
       joinTable: fieldDef.relation.name ? `_${fieldDef.relation.name}` : `_${sortedModelNames[0]}To${sortedModelNames[1]}`
     };
   } else {
@@ -417,9 +461,38 @@ function aggregate(eb, expr2, op) {
 }
 __name(aggregate, "aggregate");
 
-// src/client/crud/dialects/base.ts
-var import_common_helpers = require("@zenstackhq/common-helpers");
-var import_kysely = require("kysely");
+// src/plugins/policy/policy-handler.ts
+var import_common_helpers7 = require("@zenstackhq/common-helpers");
+var import_kysely8 = require("kysely");
+var import_ts_pattern8 = require("ts-pattern");
+
+// src/client/crud/dialects/index.ts
+var import_ts_pattern5 = require("ts-pattern");
+
+// src/client/crud/dialects/postgresql.ts
+var import_common_helpers3 = require("@zenstackhq/common-helpers");
+var import_decimal = __toESM(require("decimal.js"), 1);
+var import_kysely3 = require("kysely");
+var import_ts_pattern3 = require("ts-pattern");
+
+// src/client/constants.ts
+var DELEGATE_JOINED_FIELD_PREFIX = "$delegate$";
+var LOGICAL_COMBINATORS = [
+  "AND",
+  "OR",
+  "NOT"
+];
+var AGGREGATE_OPERATORS = [
+  "_count",
+  "_sum",
+  "_avg",
+  "_min",
+  "_max"
+];
+
+// src/client/crud/dialects/base-dialect.ts
+var import_common_helpers2 = require("@zenstackhq/common-helpers");
+var import_kysely2 = require("kysely");
 var import_ts_pattern2 = require("ts-pattern");
 
 // src/utils/enumerate.ts
@@ -436,7 +509,7 @@ function enumerate(x) {
 }
 __name(enumerate, "enumerate");
 
-// src/client/crud/dialects/base.ts
+// src/client/crud/dialects/base-dialect.ts
 var BaseCrudDialect = class {
   static {
     __name(this, "BaseCrudDialect");
@@ -450,6 +523,9 @@ var BaseCrudDialect = class {
   transformPrimitive(value, _type, _forArrayField) {
     return value;
   }
+  transformOutput(value, _type) {
+    return value;
+  }
   // #region common query builders
   buildSelectModel(eb, model, modelAlias) {
     const modelDef = requireModel(this.schema, model);
@@ -478,7 +554,7 @@ var BaseCrudDialect = class {
     if ("distinct" in args && args.distinct) {
       const distinct = ensureArray(args.distinct);
       if (this.supportsDistinctOn) {
-        result = result.distinctOn(distinct.map((f) => import_kysely.sql.ref(`${modelAlias}.${f}`)));
+        result = result.distinctOn(distinct.map((f) => import_kysely2.sql.ref(`${modelAlias}.${f}`)));
       } else {
         throw new QueryError(`"distinct" is not supported by "${this.schema.provider.type}" provider`);
       }
@@ -528,7 +604,7 @@ var BaseCrudDialect = class {
   buildCursorFilter(model, query, cursor, orderBy, negateOrderBy, modelAlias) {
     const _orderBy = orderBy ?? makeDefaultOrderBy(this.schema, model);
     const orderByItems = ensureArray(_orderBy).flatMap((obj) => Object.entries(obj));
-    const eb = (0, import_kysely.expressionBuilder)();
+    const eb = (0, import_kysely2.expressionBuilder)();
     const subQueryAlias = `${model}$cursor$sub`;
     const cursorFilter = this.buildFilter(eb, model, subQueryAlias, cursor);
     let result = query;
@@ -563,7 +639,7 @@ var BaseCrudDialect = class {
     if (payload === null) {
       const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, field);
       if (ownedByModel && !fieldDef.originModel) {
-        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely.sql.ref(`${modelAlias}.${fk}`), "is", null)));
+        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely2.sql.ref(`${modelAlias}.${fk}`), "is", null)));
       } else {
         return this.buildToOneRelationFilter(eb, model, modelAlias, field, fieldDef, {
           is: null
@@ -580,7 +656,7 @@ var BaseCrudDialect = class {
       joinAlias
     );
     const filterResultField = `${field}$filter`;
-    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
+    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
     const conditions = [];
     if ("is" in payload || "isNot" in payload) {
       if ("is" in payload) {
@@ -610,24 +686,26 @@ var BaseCrudDialect = class {
   }
   buildToManyRelationFilter(eb, model, modelAlias, field, fieldDef, payload) {
     if (payload === null) {
-      return eb(import_kysely.sql.ref(`${modelAlias}.${field}`), "is", null);
+      return eb(import_kysely2.sql.ref(`${modelAlias}.${field}`), "is", null);
     }
     const relationModel = fieldDef.type;
     const relationFilterSelectAlias = `${modelAlias}$${field}$filter`;
     const buildPkFkWhereRefs = /* @__PURE__ */ __name((eb2) => {
       const m2m = getManyToManyRelation(this.schema, model, field);
       if (m2m) {
-        const modelIdField = getIdFields(this.schema, model)[0];
-        const relationIdField = getIdFields(this.schema, relationModel)[0];
-        return eb2(import_kysely.sql.ref(`${relationFilterSelectAlias}.${relationIdField}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely.sql.ref(`${modelAlias}.${modelIdField}`)));
+        const modelIdFields = requireIdFields(this.schema, model);
+        (0, import_common_helpers2.invariant)(modelIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        const relationIdFields = requireIdFields(this.schema, relationModel);
+        (0, import_common_helpers2.invariant)(relationIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        return eb2(import_kysely2.sql.ref(`${relationFilterSelectAlias}.${relationIdFields[0]}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely2.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely2.sql.ref(`${modelAlias}.${modelIdFields[0]}`)));
       } else {
         const relationKeyPairs = getRelationForeignKeyFieldPairs(this.schema, model, field);
         let result2 = this.true(eb2);
         for (const { fk, pk } of relationKeyPairs.keyPairs) {
           if (relationKeyPairs.ownedByModel) {
-            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${modelAlias}.${fk}`), "=", import_kysely.sql.ref(`${relationFilterSelectAlias}.${pk}`)));
+            result2 = this.and(eb2, result2, eb2(import_kysely2.sql.ref(`${modelAlias}.${fk}`), "=", import_kysely2.sql.ref(`${relationFilterSelectAlias}.${pk}`)));
           } else {
-            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${modelAlias}.${pk}`), "=", import_kysely.sql.ref(`${relationFilterSelectAlias}.${fk}`)));
+            result2 = this.and(eb2, result2, eb2(import_kysely2.sql.ref(`${modelAlias}.${pk}`), "=", import_kysely2.sql.ref(`${relationFilterSelectAlias}.${fk}`)));
           }
         }
         return result2;
@@ -710,7 +788,7 @@ var BaseCrudDialect = class {
     return eb(lhs, "=", rhs !== null && rhs !== void 0 ? this.transformPrimitive(rhs, type, false) : rhs);
   }
   buildStandardFilter(eb, type, payload, lhs, getRhs, recurse, throwIfInvalid = false, onlyForKeys = void 0, excludeKeys = []) {
-    if (payload === null || !(0, import_common_helpers.isPlainObject)(payload)) {
+    if (payload === null || !(0, import_common_helpers2.isPlainObject)(payload)) {
       return {
         conditions: [
           this.buildLiteralFilter(eb, lhs, type, payload)
@@ -729,14 +807,14 @@ var BaseCrudDialect = class {
       }
       const rhs = Array.isArray(value) ? value.map(getRhs) : getRhs(value);
       const condition = (0, import_ts_pattern2.match)(op).with("equals", () => rhs === null ? eb(lhs, "is", null) : eb(lhs, "=", rhs)).with("in", () => {
-        (0, import_common_helpers.invariant)(Array.isArray(rhs), "right hand side must be an array");
+        (0, import_common_helpers2.invariant)(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.false(eb);
         } else {
           return eb(lhs, "in", rhs);
         }
       }).with("notIn", () => {
-        (0, import_common_helpers.invariant)(Array.isArray(rhs), "right hand side must be an array");
+        (0, import_common_helpers2.invariant)(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.true(eb);
         } else {
@@ -776,7 +854,7 @@ var BaseCrudDialect = class {
         if (key === "mode" || consumedKeys.includes(key)) {
           continue;
         }
-        const condition = (0, import_ts_pattern2.match)(key).with("contains", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`%${value}%`)) : eb(fieldRef, "like", import_kysely.sql.val(`%${value}%`))).with("startsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`${value}%`)) : eb(fieldRef, "like", import_kysely.sql.val(`${value}%`))).with("endsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`%${value}`)) : eb(fieldRef, "like", import_kysely.sql.val(`%${value}`))).otherwise(() => {
+        const condition = (0, import_ts_pattern2.match)(key).with("contains", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`%${value}%`)) : eb(fieldRef, "like", import_kysely2.sql.val(`%${value}%`))).with("startsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`${value}%`)) : eb(fieldRef, "like", import_kysely2.sql.val(`${value}%`))).with("endsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`%${value}`)) : eb(fieldRef, "like", import_kysely2.sql.val(`%${value}`))).otherwise(() => {
           throw new QueryError(`Invalid string filter key: ${key}`);
         });
         if (condition) {
@@ -788,16 +866,16 @@ var BaseCrudDialect = class {
   }
   prepStringCasing(eb, value, mode) {
     if (!mode || mode === "default") {
-      return value === null ? value : import_kysely.sql.val(value);
+      return value === null ? value : import_kysely2.sql.val(value);
     }
     if (typeof value === "string") {
       return eb.fn("lower", [
-        import_kysely.sql.val(value)
+        import_kysely2.sql.val(value)
       ]);
     } else if (Array.isArray(value)) {
       return value.map((v) => this.prepStringCasing(eb, v, mode));
     } else {
-      return value === null ? null : import_kysely.sql.val(value);
+      return value === null ? null : import_kysely2.sql.val(value);
     }
   }
   buildNumberFilter(eb, fieldRef, type, payload) {
@@ -854,19 +932,19 @@ var BaseCrudDialect = class {
           "_min",
           "_max"
         ].includes(field)) {
-          (0, import_common_helpers.invariant)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
+          (0, import_common_helpers2.invariant)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
           for (const [k, v] of Object.entries(value)) {
-            (0, import_common_helpers.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-            result = result.orderBy((eb) => aggregate(eb, this.fieldRef(model, k, eb, modelAlias), field), import_kysely.sql.raw(this.negateSort(v, negated)));
+            (0, import_common_helpers2.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+            result = result.orderBy((eb) => aggregate(eb, this.fieldRef(model, k, eb, modelAlias), field), import_kysely2.sql.raw(this.negateSort(v, negated)));
           }
           continue;
         }
         switch (field) {
           case "_count": {
-            (0, import_common_helpers.invariant)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
+            (0, import_common_helpers2.invariant)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
             for (const [k, v] of Object.entries(value)) {
-              (0, import_common_helpers.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-              result = result.orderBy((eb) => eb.fn.count(this.fieldRef(model, k, eb, modelAlias)), import_kysely.sql.raw(this.negateSort(v, negated)));
+              (0, import_common_helpers2.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+              result = result.orderBy((eb) => eb.fn.count(this.fieldRef(model, k, eb, modelAlias)), import_kysely2.sql.raw(this.negateSort(v, negated)));
             }
             continue;
           }
@@ -875,11 +953,11 @@ var BaseCrudDialect = class {
         }
         const fieldDef = requireField(this.schema, model, field);
         if (!fieldDef.relation) {
-          const fieldRef = this.fieldRef(model, field, (0, import_kysely.expressionBuilder)(), modelAlias);
+          const fieldRef = this.fieldRef(model, field, (0, import_kysely2.expressionBuilder)(), modelAlias);
           if (value === "asc" || value === "desc") {
             result = result.orderBy(fieldRef, this.negateSort(value, negated));
           } else if (value && typeof value === "object" && "nulls" in value && "sort" in value && (value.sort === "asc" || value.sort === "desc") && (value.nulls === "first" || value.nulls === "last")) {
-            result = result.orderBy(fieldRef, import_kysely.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
+            result = result.orderBy(fieldRef, import_kysely2.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
           }
         } else {
           const relationModel = fieldDef.type;
@@ -888,13 +966,13 @@ var BaseCrudDialect = class {
               throw new QueryError(`invalid orderBy value for field "${field}"`);
             }
             if ("_count" in value) {
-              (0, import_common_helpers.invariant)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
+              (0, import_common_helpers2.invariant)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
               const sort = this.negateSort(value._count, negated);
               result = result.orderBy((eb) => {
                 const subQueryAlias = `${modelAlias}$orderBy$${field}$count`;
                 let subQuery = this.buildSelectModel(eb, relationModel, subQueryAlias);
                 const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, subQueryAlias);
-                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
+                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
                 subQuery = subQuery.select(() => eb.fn.count(eb.lit(1)).as("_count"));
                 return subQuery;
               }, sort);
@@ -902,7 +980,7 @@ var BaseCrudDialect = class {
           } else {
             result = result.leftJoin(relationModel, (join) => {
               const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
-              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
+              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
             });
             result = this.buildOrderBy(result, fieldDef.type, relationModel, value, false, negated);
           }
@@ -954,13 +1032,13 @@ var BaseCrudDialect = class {
     if (fieldDef.computed) {
       return query.select((eb) => this.fieldRef(model, field, eb, modelAlias).as(field));
     } else if (!fieldDef.originModel) {
-      return query.select(import_kysely.sql.ref(`${modelAlias}.${field}`).as(field));
+      return query.select(import_kysely2.sql.ref(`${modelAlias}.${field}`).as(field));
     } else {
       return this.buildSelectField(query, fieldDef.originModel, fieldDef.originModel, field);
     }
   }
   buildDelegateJoin(thisModel, thisModelAlias, otherModelAlias, query) {
-    const idFields = getIdFields(this.schema, thisModel);
+    const idFields = requireIdFields(this.schema, thisModel);
     query = query.leftJoin(otherModelAlias, (qb) => {
       for (const idField of idFields) {
         qb = qb.onRef(`${thisModelAlias}.${idField}`, "=", `${otherModelAlias}.${idField}`);
@@ -982,10 +1060,16 @@ var BaseCrudDialect = class {
     for (const [field, value] of Object.entries(selections.select)) {
       const fieldDef = requireField(this.schema, model, field);
       const fieldModel = fieldDef.type;
-      const joinPairs = buildJoinPairs(this.schema, model, parentAlias, field, fieldModel);
-      let fieldCountQuery = eb.selectFrom(fieldModel).select(eb.fn.countAll().as(`_count$${field}`));
-      for (const [left, right] of joinPairs) {
-        fieldCountQuery = fieldCountQuery.whereRef(left, "=", right);
+      let fieldCountQuery;
+      const m2m = getManyToManyRelation(this.schema, model, field);
+      if (m2m) {
+        fieldCountQuery = eb.selectFrom(fieldModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.joinTable}.${m2m.otherFkName}`, "=", `${fieldModel}.${m2m.otherPKName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${parentAlias}.${m2m.parentPKName}`)).select(eb.fn.countAll().as(`_count$${field}`));
+      } else {
+        fieldCountQuery = eb.selectFrom(fieldModel).select(eb.fn.countAll().as(`_count$${field}`));
+        const joinPairs = buildJoinPairs(this.schema, model, parentAlias, field, fieldModel);
+        for (const [left, right] of joinPairs) {
+          fieldCountQuery = fieldCountQuery.whereRef(left, "=", right);
+        }
       }
       if (value && typeof value === "object" && "where" in value && value.where && typeof value.where === "object") {
         const filter = this.buildFilter(eb, fieldModel, fieldModel, value.where);
@@ -1065,6 +1149,9 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   static {
     __name(this, "PostgresCrudDialect");
   }
+  constructor(schema, options) {
+    super(schema, options);
+  }
   get provider() {
     return "postgresql";
   }
@@ -1079,8 +1166,40 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
         return value.map((v) => this.transformPrimitive(v, type, false));
       }
     } else {
-      return (0, import_ts_pattern3.match)(type).with("DateTime", () => value instanceof Date ? value : typeof value === "string" ? new Date(value) : value).with("Decimal", () => value !== null ? value.toString() : value).otherwise(() => value);
+      return (0, import_ts_pattern3.match)(type).with("DateTime", () => value instanceof Date ? value.toISOString() : typeof value === "string" ? new Date(value).toISOString() : value).with("Decimal", () => value !== null ? value.toString() : value).otherwise(() => value);
+    }
+  }
+  transformOutput(value, type) {
+    if (value === null || value === void 0) {
+      return value;
+    }
+    return (0, import_ts_pattern3.match)(type).with("DateTime", () => this.transformOutputDate(value)).with("Bytes", () => this.transformOutputBytes(value)).with("BigInt", () => this.transformOutputBigInt(value)).with("Decimal", () => this.transformDecimal(value)).otherwise(() => super.transformOutput(value, type));
+  }
+  transformOutputBigInt(value) {
+    if (typeof value === "bigint") {
+      return value;
+    }
+    (0, import_common_helpers3.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    return BigInt(value);
+  }
+  transformDecimal(value) {
+    if (value instanceof import_decimal.default) {
+      return value;
     }
+    (0, import_common_helpers3.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal.default, `Expected string, number or Decimal, got ${typeof value}`);
+    return new import_decimal.default(value);
+  }
+  transformOutputDate(value) {
+    if (typeof value === "string") {
+      return new Date(value);
+    } else if (value instanceof Date && this.options.fixPostgresTimezone !== false) {
+      return new Date(value.getTime() - value.getTimezoneOffset() * 60 * 1e3);
+    } else {
+      return value;
+    }
+  }
+  transformOutputBytes(value) {
+    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
   }
   buildRelationSelection(query, model, relationField, parentAlias, payload) {
     const relationResultName = `${parentAlias}$${relationField}`;
@@ -1112,14 +1231,14 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   buildRelationJoinFilter(query, model, relationField, relationModel, relationModelAlias, parentAlias) {
     const m2m = getManyToManyRelation(this.schema, model, relationField);
     if (m2m) {
-      const parentIds = getIdFields(this.schema, model);
-      const relationIds = getIdFields(this.schema, relationModel);
-      (0, import_common_helpers2.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      (0, import_common_helpers2.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      const parentIds = requireIdFields(this.schema, model);
+      const relationIds = requireIdFields(this.schema, relationModel);
+      (0, import_common_helpers3.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers3.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       query = query.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const joinPairs = buildJoinPairs(this.schema, model, parentAlias, relationField, relationModelAlias);
-      query = query.where((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
+      query = query.where((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely3.sql.ref(left), "=", import_kysely3.sql.ref(right)))));
     }
     return query;
   }
@@ -1127,9 +1246,9 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     qb = qb.select((eb) => {
       const objArgs = this.buildRelationObjectArgs(relationModel, relationModelAlias, eb, payload, parentResultName);
       if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely2.sql`jsonb_agg(jsonb_build_object(${import_kysely2.sql.join(objArgs)}))`, import_kysely2.sql`'[]'::jsonb`).as("$data");
+        return eb.fn.coalesce(import_kysely3.sql`jsonb_agg(jsonb_build_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`'[]'::jsonb`).as("$data");
       } else {
-        return import_kysely2.sql`jsonb_build_object(${import_kysely2.sql.join(objArgs)})`.as("$data");
+        return import_kysely3.sql`jsonb_build_object(${import_kysely3.sql.join(objArgs)})`.as("$data");
       }
     });
     return qb;
@@ -1140,13 +1259,13 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     const descendantModels = getDelegateDescendantModels(this.schema, relationModel);
     if (descendantModels.length > 0) {
       objArgs.push(...descendantModels.map((subModel) => [
-        import_kysely2.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
+        import_kysely3.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
         eb.ref(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`)
       ]).flatMap((v) => v));
     }
     if (payload === true || !payload.select) {
       objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-        import_kysely2.sql.lit(field),
+        import_kysely3.sql.lit(field),
         this.fieldRef(relationModel, field, eb, relationModelAlias, false)
       ]).flatMap((v) => v));
     } else if (payload.select) {
@@ -1154,14 +1273,14 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
         if (field === "_count") {
           const subJson = this.buildCountJson(relationModel, eb, relationModelAlias, value);
           return [
-            import_kysely2.sql.lit(field),
+            import_kysely3.sql.lit(field),
             subJson
           ];
         } else {
           const fieldDef = requireField(this.schema, relationModel, field);
           const fieldValue = fieldDef.relation ? eb.ref(`${parentResultName}$${field}.$data`) : this.fieldRef(relationModel, field, eb, relationModelAlias, false);
           return [
-            import_kysely2.sql.lit(field),
+            import_kysely3.sql.lit(field),
             fieldValue
           ];
         }
@@ -1169,7 +1288,7 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     }
     if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
       objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field]) => [
-        import_kysely2.sql.lit(field),
+        import_kysely3.sql.lit(field),
         // reference the synthesized JSON field
         eb.ref(`${parentResultName}$${field}.$data`)
       ]).flatMap((v) => v));
@@ -1199,7 +1318,7 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   }
   buildJsonObject(eb, value) {
     return eb.fn("jsonb_build_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely2.sql.lit(key),
+      import_kysely3.sql.lit(key),
       value2
     ]));
   }
@@ -1227,11 +1346,33 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   get supportInsertWithDefault() {
     return true;
   }
+  getFieldSqlType(fieldDef) {
+    if (fieldDef.relation) {
+      throw new QueryError("Cannot get SQL type of a relation field");
+    }
+    let result;
+    if (this.schema.enums?.[fieldDef.type]) {
+      result = "text";
+    } else {
+      result = (0, import_ts_pattern3.match)(fieldDef.type).with("String", () => "text").with("Boolean", () => "boolean").with("Int", () => "integer").with("BigInt", () => "bigint").with("Float", () => "double precision").with("Decimal", () => "decimal").with("DateTime", () => "timestamp").with("Bytes", () => "bytea").with("Json", () => "jsonb").otherwise(() => "text");
+    }
+    if (fieldDef.array) {
+      result += "[]";
+    }
+    return result;
+  }
+  getStringCasingBehavior() {
+    return {
+      supportsILike: true,
+      likeCaseSensitive: true
+    };
+  }
 };
 
 // src/client/crud/dialects/sqlite.ts
-var import_common_helpers3 = require("@zenstackhq/common-helpers");
-var import_kysely3 = require("kysely");
+var import_common_helpers4 = require("@zenstackhq/common-helpers");
+var import_decimal2 = __toESM(require("decimal.js"), 1);
+var import_kysely4 = require("kysely");
 var import_ts_pattern4 = require("ts-pattern");
 var SqliteCrudDialect = class extends BaseCrudDialect {
   static {
@@ -1250,9 +1391,57 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
       if (this.schema.typeDefs && type in this.schema.typeDefs) {
         return JSON.stringify(value);
       } else {
-        return (0, import_ts_pattern4.match)(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).with("Json", () => JSON.stringify(value)).otherwise(() => value);
+        return (0, import_ts_pattern4.match)(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : typeof value === "string" ? new Date(value).toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).with("Json", () => JSON.stringify(value)).otherwise(() => value);
+      }
+    }
+  }
+  transformOutput(value, type) {
+    if (value === null || value === void 0) {
+      return value;
+    } else if (this.schema.typeDefs && type in this.schema.typeDefs) {
+      return this.transformOutputJson(value);
+    } else {
+      return (0, import_ts_pattern4.match)(type).with("Boolean", () => this.transformOutputBoolean(value)).with("DateTime", () => this.transformOutputDate(value)).with("Bytes", () => this.transformOutputBytes(value)).with("Decimal", () => this.transformOutputDecimal(value)).with("BigInt", () => this.transformOutputBigInt(value)).with("Json", () => this.transformOutputJson(value)).otherwise(() => super.transformOutput(value, type));
+    }
+  }
+  transformOutputDecimal(value) {
+    if (value instanceof import_decimal2.default) {
+      return value;
+    }
+    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal2.default, `Expected string, number or Decimal, got ${typeof value}`);
+    return new import_decimal2.default(value);
+  }
+  transformOutputBigInt(value) {
+    if (typeof value === "bigint") {
+      return value;
+    }
+    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    return BigInt(value);
+  }
+  transformOutputBoolean(value) {
+    return !!value;
+  }
+  transformOutputDate(value) {
+    if (typeof value === "number") {
+      return new Date(value);
+    } else if (typeof value === "string") {
+      return new Date(value);
+    } else {
+      return value;
+    }
+  }
+  transformOutputBytes(value) {
+    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
+  }
+  transformOutputJson(value) {
+    if (typeof value === "string") {
+      try {
+        return JSON.parse(value);
+      } catch (e) {
+        throw new QueryError("Invalid JSON returned", e);
       }
     }
+    return value;
   }
   buildRelationSelection(query, model, relationField, parentAlias, payload) {
     return query.select((eb) => this.buildRelationJSON(model, eb, relationField, parentAlias, payload).as(relationField));
@@ -1279,13 +1468,13 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
       const descendantModels = getDelegateDescendantModels(this.schema, relationModel);
       if (descendantModels.length > 0) {
         objArgs.push(...descendantModels.map((subModel) => [
-          import_kysely3.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
+          import_kysely4.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
           eb.ref(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`)
         ]).flatMap((v) => v));
       }
       if (payload === true || !payload.select) {
         objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-          import_kysely3.sql.lit(field),
+          import_kysely4.sql.lit(field),
           this.fieldRef(relationModel, field, eb, subQueryName, false)
         ]).flatMap((v) => v));
       } else if (payload.select) {
@@ -1293,7 +1482,7 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
           if (field === "_count") {
             const subJson = this.buildCountJson(relationModel, eb, `${parentAlias}$${relationField}`, value);
             return [
-              import_kysely3.sql.lit(field),
+              import_kysely4.sql.lit(field),
               subJson
             ];
           } else {
@@ -1301,12 +1490,12 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
             if (fieldDef.relation) {
               const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentAlias}$${relationField}`, value);
               return [
-                import_kysely3.sql.lit(field),
+                import_kysely4.sql.lit(field),
                 subJson
               ];
             } else {
               return [
-                import_kysely3.sql.lit(field),
+                import_kysely4.sql.lit(field),
                 this.fieldRef(relationModel, field, eb, subQueryName, false)
               ];
             }
@@ -1317,15 +1506,15 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
         objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field, value]) => {
           const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentAlias}$${relationField}`, value);
           return [
-            import_kysely3.sql.lit(field),
+            import_kysely4.sql.lit(field),
             subJson
           ];
         }).flatMap((v) => v));
       }
       if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely3.sql`json_group_array(json_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`json_array()`).as("$data");
+        return eb.fn.coalesce(import_kysely4.sql`json_group_array(json_object(${import_kysely4.sql.join(objArgs)}))`, import_kysely4.sql`json_array()`).as("$data");
       } else {
-        return import_kysely3.sql`json_object(${import_kysely3.sql.join(objArgs)})`.as("$data");
+        return import_kysely4.sql`json_object(${import_kysely4.sql.join(objArgs)})`.as("$data");
       }
     });
     return tbl;
@@ -1335,10 +1524,10 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
     const relationModel = fieldDef.type;
     const m2m = getManyToManyRelation(this.schema, model, relationField);
     if (m2m) {
-      const parentIds = getIdFields(this.schema, model);
-      const relationIds = getIdFields(this.schema, relationModel);
-      (0, import_common_helpers3.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      (0, import_common_helpers3.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      const parentIds = requireIdFields(this.schema, model);
+      const relationIds = requireIdFields(this.schema, relationModel);
+      (0, import_common_helpers4.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers4.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       selectModelQuery = selectModelQuery.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
@@ -1366,7 +1555,7 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
   }
   buildJsonObject(eb, value) {
     return eb.fn("json_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely3.sql.lit(key),
+      import_kysely4.sql.lit(key),
       value2
     ]));
   }
@@ -1390,6 +1579,24 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
   get supportInsertWithDefault() {
     return false;
   }
+  getFieldSqlType(fieldDef) {
+    if (fieldDef.relation) {
+      throw new QueryError("Cannot get SQL type of a relation field");
+    }
+    if (fieldDef.array) {
+      throw new QueryError("SQLite does not support scalar list type");
+    }
+    if (this.schema.enums?.[fieldDef.type]) {
+      return "text";
+    }
+    return (0, import_ts_pattern4.match)(fieldDef.type).with("String", () => "text").with("Boolean", () => "integer").with("Int", () => "integer").with("BigInt", () => "integer").with("Float", () => "real").with("Decimal", () => "decimal").with("DateTime", () => "numeric").with("Bytes", () => "blob").with("Json", () => "jsonb").otherwise(() => "text");
+  }
+  getStringCasingBehavior() {
+    return {
+      supportsILike: false,
+      likeCaseSensitive: false
+    };
+  }
 };
 
 // src/client/crud/dialects/index.ts
@@ -1399,8 +1606,8 @@ function getCrudDialect(schema, options) {
 __name(getCrudDialect, "getCrudDialect");
 
 // src/utils/default-operation-node-visitor.ts
-var import_kysely4 = require("kysely");
-var DefaultOperationNodeVisitor = class extends import_kysely4.OperationNodeVisitor {
+var import_kysely5 = require("kysely");
+var DefaultOperationNodeVisitor = class extends import_kysely5.OperationNodeVisitor {
   static {
     __name(this, "DefaultOperationNodeVisitor");
   }
@@ -1717,12 +1924,12 @@ var ColumnCollector = class extends DefaultOperationNodeVisitor {
 };
 
 // src/plugins/policy/expression-transformer.ts
-var import_common_helpers5 = require("@zenstackhq/common-helpers");
-var import_kysely6 = require("kysely");
+var import_common_helpers6 = require("@zenstackhq/common-helpers");
+var import_kysely7 = require("kysely");
 var import_ts_pattern7 = require("ts-pattern");
 
 // src/plugins/policy/expression-evaluator.ts
-var import_common_helpers4 = require("@zenstackhq/common-helpers");
+var import_common_helpers5 = require("@zenstackhq/common-helpers");
 var import_ts_pattern6 = require("ts-pattern");
 var ExpressionEvaluator = class {
   static {
@@ -1766,18 +1973,18 @@ var ExpressionEvaluator = class {
     const right = this.evaluate(expr2.right, context);
     return (0, import_ts_pattern6.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
-      (0, import_common_helpers4.invariant)(Array.isArray(_right), 'expected array for "in" operator');
+      (0, import_common_helpers5.invariant)(Array.isArray(_right), 'expected array for "in" operator');
       return _right.includes(left);
     }).exhaustive();
   }
   evaluateCollectionPredicate(expr2, context) {
     const op = expr2.op;
-    (0, import_common_helpers4.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    (0, import_common_helpers5.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
     if (!left) {
       return false;
     }
-    (0, import_common_helpers4.invariant)(Array.isArray(left), "expected array");
+    (0, import_common_helpers5.invariant)(Array.isArray(left), "expected array");
     return (0, import_ts_pattern6.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
       ...context,
       thisValue: item
@@ -1792,24 +1999,30 @@ var ExpressionEvaluator = class {
 };
 
 // src/plugins/policy/utils.ts
-var import_kysely5 = require("kysely");
+var import_kysely6 = require("kysely");
 function trueNode(dialect) {
-  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
+  return import_kysely6.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
 }
 __name(trueNode, "trueNode");
 function falseNode(dialect) {
-  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
+  return import_kysely6.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
 }
 __name(falseNode, "falseNode");
 function isTrueNode(node) {
-  return import_kysely5.ValueNode.is(node) && (node.value === true || node.value === 1);
+  return import_kysely6.ValueNode.is(node) && (node.value === true || node.value === 1);
 }
 __name(isTrueNode, "isTrueNode");
 function isFalseNode(node) {
-  return import_kysely5.ValueNode.is(node) && (node.value === false || node.value === 0);
+  return import_kysely6.ValueNode.is(node) && (node.value === false || node.value === 0);
 }
 __name(isFalseNode, "isFalseNode");
 function conjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return trueNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
   if (nodes.some(isFalseNode)) {
     return falseNode(dialect);
   }
@@ -1817,10 +2030,16 @@ function conjunction(dialect, nodes) {
   if (items.length === 0) {
     return trueNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely5.OrNode.is(node) ? import_kysely5.AndNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.AndNode.create(acc, node));
+  return items.reduce((acc, node) => import_kysely6.AndNode.create(wrapParensIf(acc, import_kysely6.OrNode.is), wrapParensIf(node, import_kysely6.OrNode.is)));
 }
 __name(conjunction, "conjunction");
 function disjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return falseNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
   if (nodes.some(isTrueNode)) {
     return trueNode(dialect);
   }
@@ -1828,26 +2047,36 @@ function disjunction(dialect, nodes) {
   if (items.length === 0) {
     return falseNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely5.AndNode.is(node) ? import_kysely5.OrNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.OrNode.create(acc, node));
+  return items.reduce((acc, node) => import_kysely6.OrNode.create(wrapParensIf(acc, import_kysely6.AndNode.is), wrapParensIf(node, import_kysely6.AndNode.is)));
 }
 __name(disjunction, "disjunction");
-function logicalNot(node) {
-  return import_kysely5.UnaryOperationNode.create(import_kysely5.OperatorNode.create("not"), import_kysely5.AndNode.is(node) || import_kysely5.OrNode.is(node) ? import_kysely5.ParensNode.create(node) : node);
+function logicalNot(dialect, node) {
+  if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  }
+  return import_kysely6.UnaryOperationNode.create(import_kysely6.OperatorNode.create("not"), wrapParensIf(node, (n) => import_kysely6.AndNode.is(n) || import_kysely6.OrNode.is(n)));
 }
 __name(logicalNot, "logicalNot");
+function wrapParensIf(node, predicate) {
+  return predicate(node) ? import_kysely6.ParensNode.create(node) : node;
+}
+__name(wrapParensIf, "wrapParensIf");
 function buildIsFalse(node, dialect) {
   if (isFalseNode(node)) {
     return trueNode(dialect);
   } else if (isTrueNode(node)) {
     return falseNode(dialect);
   }
-  return import_kysely5.BinaryOperationNode.create(
+  return import_kysely6.BinaryOperationNode.create(
     // coalesce so null is treated as false
-    import_kysely5.FunctionNode.create("coalesce", [
+    import_kysely6.FunctionNode.create("coalesce", [
       node,
       falseNode(dialect)
     ]),
-    import_kysely5.OperatorNode.create("="),
+    import_kysely6.OperatorNode.create("="),
     falseNode(dialect)
   );
 }
@@ -1856,11 +2085,11 @@ function getTableName(node) {
   if (!node) {
     return node;
   }
-  if (import_kysely5.TableNode.is(node)) {
+  if (import_kysely6.TableNode.is(node)) {
     return node.table.identifier.name;
-  } else if (import_kysely5.AliasNode.is(node)) {
+  } else if (import_kysely6.AliasNode.is(node)) {
     return getTableName(node.node);
-  } else if (import_kysely5.ReferenceNode.is(node) && node.table) {
+  } else if (import_kysely6.ReferenceNode.is(node) && node.table) {
     return getTableName(node.table);
   }
   return void 0;
@@ -1893,16 +2122,21 @@ var ExpressionTransformer = class {
   static {
     __name(this, "ExpressionTransformer");
   }
-  schema;
-  clientOptions;
-  auth;
+  client;
   dialect;
-  constructor(schema, clientOptions, auth) {
-    this.schema = schema;
-    this.clientOptions = clientOptions;
-    this.auth = auth;
+  constructor(client) {
+    this.client = client;
     this.dialect = getCrudDialect(this.schema, this.clientOptions);
   }
+  get schema() {
+    return this.client.$schema;
+  }
+  get clientOptions() {
+    return this.client.$options;
+  }
+  get auth() {
+    return this.client.$auth;
+  }
   get authType() {
     if (!this.schema.authType) {
       throw new InternalError('Schema does not have an "authType" specified');
@@ -1920,16 +2154,12 @@ var ExpressionTransformer = class {
     return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
   }
   _array(expr2, context) {
-    return import_kysely6.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
+    return import_kysely7.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
     const fieldDef = requireField(this.schema, context.model, expr2.field);
     if (!fieldDef.relation) {
-      if (context.thisEntity) {
-        return context.thisEntity[expr2.field];
-      } else {
-        return this.createColumnRef(expr2.field, context);
-      }
+      return this.createColumnRef(expr2.field, context);
     } else {
       const { memberFilter, memberSelect, ...restContext } = context;
       const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
@@ -1944,18 +2174,18 @@ var ExpressionTransformer = class {
   }
   mergeWhere(where, memberFilter) {
     if (!where) {
-      return import_kysely6.WhereNode.create(memberFilter ?? trueNode(this.dialect));
+      return import_kysely7.WhereNode.create(memberFilter ?? trueNode(this.dialect));
     }
     if (!memberFilter) {
       return where;
     }
-    return import_kysely6.WhereNode.create(conjunction(this.dialect, [
+    return import_kysely7.WhereNode.create(conjunction(this.dialect, [
       where.where,
       memberFilter
     ]));
   }
   _null() {
-    return import_kysely6.ValueNode.createImmediate(null);
+    return import_kysely7.ValueNode.createImmediate(null);
   }
   _binary(expr2, context) {
     if (expr2.op === "&&") {
@@ -1970,51 +2200,88 @@ var ExpressionTransformer = class {
       ]);
     }
     if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
-      return this.transformAuthBinary(expr2);
+      return this.transformAuthBinary(expr2, context);
     }
     const op = expr2.op;
     if (op === "?" || op === "!" || op === "^") {
       return this.transformCollectionPredicate(expr2, context);
     }
-    const left = this.transform(expr2.left, context);
-    const right = this.transform(expr2.right, context);
+    const { normalizedLeft, normalizedRight } = this.normalizeBinaryOperationOperands(expr2, context);
+    const left = this.transform(normalizedLeft, context);
+    const right = this.transform(normalizedRight, context);
     if (op === "in") {
       if (this.isNullNode(left)) {
         return this.transformValue(false, "Boolean");
       } else {
-        if (import_kysely6.ValueListNode.is(right)) {
-          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("in"), right);
+        if (import_kysely7.ValueListNode.is(right)) {
+          return import_kysely7.BinaryOperationNode.create(left, import_kysely7.OperatorNode.create("in"), right);
         } else {
-          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("="), import_kysely6.FunctionNode.create("any", [
+          return import_kysely7.BinaryOperationNode.create(left, import_kysely7.OperatorNode.create("="), import_kysely7.FunctionNode.create("any", [
             right
           ]));
         }
       }
     }
     if (this.isNullNode(right)) {
-      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is"), right) : import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is not"), right);
+      return this.transformNullCheck(left, expr2.op);
     } else if (this.isNullNode(left)) {
-      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is"), import_kysely6.ValueNode.createImmediate(null)) : import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is not"), import_kysely6.ValueNode.createImmediate(null));
+      return this.transformNullCheck(right, expr2.op);
+    } else {
+      return import_kysely7.BinaryOperationNode.create(left, this.transformOperator(op), right);
     }
-    return import_kysely6.BinaryOperationNode.create(left, this.transformOperator(op), right);
+  }
+  transformNullCheck(expr2, operator) {
+    (0, import_common_helpers6.invariant)(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
+    if (import_kysely7.ValueNode.is(expr2)) {
+      if (expr2.value === null) {
+        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+      } else {
+        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+      }
+    } else {
+      return operator === "==" ? import_kysely7.BinaryOperationNode.create(expr2, import_kysely7.OperatorNode.create("is"), import_kysely7.ValueNode.createImmediate(null)) : import_kysely7.BinaryOperationNode.create(expr2, import_kysely7.OperatorNode.create("is not"), import_kysely7.ValueNode.createImmediate(null));
+    }
+  }
+  normalizeBinaryOperationOperands(expr2, context) {
+    let normalizedLeft = expr2.left;
+    if (this.isRelationField(expr2.left, context.model)) {
+      (0, import_common_helpers6.invariant)(ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      (0, import_common_helpers6.invariant)(leftRelDef, "failed to get relation field definition");
+      const idFields = requireIdFields(this.schema, leftRelDef.type);
+      normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
+    }
+    let normalizedRight = expr2.right;
+    if (this.isRelationField(expr2.right, context.model)) {
+      (0, import_common_helpers6.invariant)(ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      (0, import_common_helpers6.invariant)(rightRelDef, "failed to get relation field definition");
+      const idFields = requireIdFields(this.schema, rightRelDef.type);
+      normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
+    }
+    return {
+      normalizedLeft,
+      normalizedRight
+    };
   }
   transformCollectionPredicate(expr2, context) {
-    (0, import_common_helpers5.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    (0, import_common_helpers6.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
     if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
       const value = new ExpressionEvaluator().evaluate(expr2, {
         auth: this.auth
       });
       return this.transformValue(value, "Boolean");
     }
-    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
+    (0, import_common_helpers6.invariant)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
-    if (ExpressionUtils.isField(expr2.left)) {
-      const fieldDef = requireField(this.schema, context.model, expr2.left.field);
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    if (fieldDef) {
+      (0, import_common_helpers6.invariant)(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
-      (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.left.receiver));
-      const fieldDef = requireField(this.schema, context.model, expr2.left.receiver.field);
-      newContextModel = fieldDef.type;
+      (0, import_common_helpers6.invariant)(ExpressionUtils.isMember(expr2.left) && ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
+      const fieldDef2 = requireField(this.schema, context.model, expr2.left.receiver.field);
+      newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
         const memberDef = requireField(this.schema, newContextModel, member);
         newContextModel = memberDef.type;
@@ -2023,71 +2290,118 @@ var ExpressionTransformer = class {
     let predicateFilter = this.transform(expr2.right, {
       ...context,
       model: newContextModel,
-      alias: void 0,
-      thisEntity: void 0
+      alias: void 0
     });
     if (expr2.op === "!") {
-      predicateFilter = logicalNot(predicateFilter);
+      predicateFilter = logicalNot(this.dialect, predicateFilter);
     }
-    const count = import_kysely6.FunctionNode.create("count", [
-      import_kysely6.ValueNode.createImmediate(1)
+    const count = import_kysely7.FunctionNode.create("count", [
+      import_kysely7.ValueNode.createImmediate(1)
     ]);
-    const predicateResult = (0, import_ts_pattern7.match)(expr2.op).with("?", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create(">"), import_kysely6.ValueNode.createImmediate(0))).with("!", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).with("^", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).exhaustive();
+    const predicateResult = (0, import_ts_pattern7.match)(expr2.op).with("?", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create(">"), import_kysely7.ValueNode.createImmediate(0))).with("!", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.createImmediate(0))).with("^", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.createImmediate(0))).exhaustive();
     return this.transform(expr2.left, {
       ...context,
-      memberSelect: import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(predicateResult, import_kysely6.IdentifierNode.create("$t"))),
+      memberSelect: import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(predicateResult, import_kysely7.IdentifierNode.create("$t"))),
       memberFilter: predicateFilter
     });
   }
-  transformAuthBinary(expr2) {
+  transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw new Error(`Unsupported operator for auth call: ${expr2.op}`);
+      throw new QueryError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
     }
+    let authExpr;
     let other;
     if (this.isAuthCall(expr2.left)) {
+      authExpr = expr2.left;
       other = expr2.right;
     } else {
+      authExpr = expr2.right;
       other = expr2.left;
     }
     if (ExpressionUtils.isNull(other)) {
       return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
     } else {
-      throw new Error("Unsupported binary expression with `auth()`");
+      const authModel = getModel(this.schema, this.authType);
+      if (!authModel) {
+        throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+      }
+      const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
+      (0, import_common_helpers6.invariant)(idFields.length > 0, "auth type model must have at least one id field");
+      const conditions = idFields.map((fieldName) => ExpressionUtils.binary(ExpressionUtils.member(authExpr, [
+        fieldName
+      ]), "==", this.makeOrAppendMember(other, fieldName)));
+      let result = this.buildAnd(conditions);
+      if (expr2.op === "!=") {
+        result = this.buildLogicalNot(result);
+      }
+      return this.transform(result, context);
+    }
+  }
+  makeOrAppendMember(other, fieldName) {
+    if (ExpressionUtils.isMember(other)) {
+      return ExpressionUtils.member(other.receiver, [
+        ...other.members,
+        fieldName
+      ]);
+    } else {
+      return ExpressionUtils.member(other, [
+        fieldName
+      ]);
     }
   }
   transformValue(value, type) {
-    return import_kysely6.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+    if (value === true) {
+      return trueNode(this.dialect);
+    } else if (value === false) {
+      return falseNode(this.dialect);
+    } else {
+      return import_kysely7.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+    }
   }
   _unary(expr2, context) {
-    (0, import_common_helpers5.invariant)(expr2.op === "!", 'only "!" operator is supported');
-    return import_kysely6.BinaryOperationNode.create(this.transform(expr2.operand, context), this.transformOperator("!="), trueNode(this.dialect));
+    (0, import_common_helpers6.invariant)(expr2.op === "!", 'only "!" operator is supported');
+    return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
     const mappedOp = (0, import_ts_pattern7.match)(op).with("==", () => "=").otherwise(() => op);
-    return import_kysely6.OperatorNode.create(mappedOp);
+    return import_kysely7.OperatorNode.create(mappedOp);
   }
   _call(expr2, context) {
     const result = this.transformCall(expr2, context);
     return result.toOperationNode();
   }
   transformCall(expr2, context) {
-    const func = this.clientOptions.functions?.[expr2.function];
+    const func = this.getFunctionImpl(expr2.function);
     if (!func) {
       throw new QueryError(`Function not implemented: ${expr2.function}`);
     }
-    const eb = (0, import_kysely6.expressionBuilder)();
+    const eb = (0, import_kysely7.expressionBuilder)();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
+      client: this.client,
       dialect: this.dialect,
       model: context.model,
+      modelAlias: context.alias ?? context.model,
       operation: context.operation
     });
   }
+  getFunctionImpl(functionName) {
+    let func = this.clientOptions.functions?.[functionName];
+    if (!func) {
+      for (const plugin of this.clientOptions.plugins ?? []) {
+        if (plugin.functions?.[functionName]) {
+          func = plugin.functions[functionName];
+          break;
+        }
+      }
+    }
+    return func;
+  }
   transformCallArg(eb, arg, context) {
     if (ExpressionUtils.isLiteral(arg)) {
       return eb.val(arg.value);
     }
     if (ExpressionUtils.isField(arg)) {
-      return context.thisEntityRaw ? eb.val(context.thisEntityRaw[arg.field]) : eb.ref(arg.field);
+      return eb.ref(arg.field);
     }
     if (ExpressionUtils.isCall(arg)) {
       return this.transformCall(arg, context);
@@ -2102,14 +2416,32 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
-    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.receiver), "expect receiver to be field expression");
+    (0, import_common_helpers6.invariant)(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    let members = expr2.members;
+    let receiver;
     const { memberFilter, memberSelect, ...restContext } = context;
-    const receiver = this.transform(expr2.receiver, restContext);
-    (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(receiver), "expected receiver to be select query");
-    const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+    if (ExpressionUtils.isThis(expr2.receiver)) {
+      if (expr2.members.length === 1) {
+        return this._field(ExpressionUtils.field(expr2.members[0]), context);
+      } else {
+        const firstMemberFieldDef = requireField(this.schema, context.model, expr2.members[0]);
+        receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
+        members = expr2.members.slice(1);
+      }
+    } else {
+      receiver = this.transform(expr2.receiver, restContext);
+    }
+    (0, import_common_helpers6.invariant)(import_kysely7.SelectQueryNode.is(receiver), "expected receiver to be select query");
+    let startType;
+    if (ExpressionUtils.isField(expr2.receiver)) {
+      const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+      startType = receiverField.type;
+    } else {
+      startType = context.model;
+    }
     const memberFields = [];
-    let currType = receiverField.type;
-    for (const member of expr2.members) {
+    let currType = startType;
+    for (const member of members) {
       const fieldDef = requireField(this.schema, currType, member);
       memberFields.push({
         fieldDef,
@@ -2118,22 +2450,21 @@ var ExpressionTransformer = class {
       currType = fieldDef.type;
     }
     let currNode = void 0;
-    for (let i = expr2.members.length - 1; i >= 0; i--) {
-      const member = expr2.members[i];
+    for (let i = members.length - 1; i >= 0; i--) {
+      const member = members[i];
       const { fieldDef, fromModel } = memberFields[i];
       if (fieldDef.relation) {
         const relation = this.transformRelationAccess(member, fieldDef.type, {
           ...restContext,
           model: fromModel,
-          alias: void 0,
-          thisEntity: void 0
+          alias: void 0
         });
         if (currNode) {
-          (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(currNode), "expected select query node");
+          (0, import_common_helpers6.invariant)(import_kysely7.SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
-              import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create(expr2.members[i + 1])))
+              import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(currNode, import_kysely7.IdentifierNode.create(members[i + 1])))
             ]
           };
         } else {
@@ -2146,21 +2477,21 @@ var ExpressionTransformer = class {
           };
         }
       } else {
-        (0, import_common_helpers5.invariant)(i === expr2.members.length - 1, "plain field access must be the last segment");
-        (0, import_common_helpers5.invariant)(!currNode, "plain field access must be the last segment");
-        currNode = import_kysely6.ColumnNode.create(member);
+        (0, import_common_helpers6.invariant)(i === members.length - 1, "plain field access must be the last segment");
+        (0, import_common_helpers6.invariant)(!currNode, "plain field access must be the last segment");
+        currNode = import_kysely7.ColumnNode.create(member);
       }
     }
     return {
       ...receiver,
       selections: [
-        import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create("$t")))
+        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(currNode, import_kysely7.IdentifierNode.create("$t")))
       ]
     };
   }
   valueMemberAccess(receiver, expr2, receiverType) {
     if (!receiver) {
-      return import_kysely6.ValueNode.createImmediate(null);
+      return import_kysely7.ValueNode.createImmediate(null);
     }
     if (expr2.members.length !== 1) {
       throw new Error(`Only single member access is supported`);
@@ -2171,40 +2502,33 @@ var ExpressionTransformer = class {
     return this.transformValue(fieldValue, fieldDef.type);
   }
   transformRelationAccess(field, relationModel, context) {
+    const m2m = getManyToManyRelation(this.schema, context.model, field);
+    if (m2m) {
+      return this.transformManyToManyRelationAccess(m2m, context);
+    }
     const fromModel = context.model;
     const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
-    if (context.thisEntity) {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[fk])));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[pk])));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: import_kysely6.FromNode.create([
-          import_kysely6.TableNode.create(relationModel)
-        ]),
-        where: import_kysely6.WhereNode.create(condition)
-      };
+    let condition;
+    if (ownedByModel) {
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely7.BinaryOperationNode.create(import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(fk), import_kysely7.TableNode.create(context.alias ?? fromModel)), import_kysely7.OperatorNode.create("="), import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(pk), import_kysely7.TableNode.create(relationModel)))));
     } else {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)))));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)))));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: import_kysely6.FromNode.create([
-          import_kysely6.TableNode.create(relationModel)
-        ]),
-        where: import_kysely6.WhereNode.create(condition)
-      };
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely7.BinaryOperationNode.create(import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(pk), import_kysely7.TableNode.create(context.alias ?? fromModel)), import_kysely7.OperatorNode.create("="), import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(fk), import_kysely7.TableNode.create(relationModel)))));
     }
+    return {
+      kind: "SelectQueryNode",
+      from: import_kysely7.FromNode.create([
+        import_kysely7.TableNode.create(relationModel)
+      ]),
+      where: import_kysely7.WhereNode.create(condition)
+    };
+  }
+  transformManyToManyRelationAccess(m2m, context) {
+    const eb = (0, import_kysely7.expressionBuilder)();
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    return relationQuery.toOperationNode();
   }
   createColumnRef(column, context) {
-    return import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(column), import_kysely6.TableNode.create(context.alias ?? context.model));
+    return import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(column), import_kysely7.TableNode.create(context.alias ?? context.model));
   }
   isAuthCall(value) {
     return ExpressionUtils.isCall(value) && value.function === "auth";
@@ -2213,7 +2537,32 @@ var ExpressionTransformer = class {
     return ExpressionUtils.isMember(expr2) && this.isAuthCall(expr2.receiver);
   }
   isNullNode(node) {
-    return import_kysely6.ValueNode.is(node) && node.value === null;
+    return import_kysely7.ValueNode.is(node) && node.value === null;
+  }
+  buildLogicalNot(result) {
+    return ExpressionUtils.unary("!", result);
+  }
+  buildAnd(conditions) {
+    if (conditions.length === 0) {
+      return ExpressionUtils.literal(true);
+    } else if (conditions.length === 1) {
+      return conditions[0];
+    } else {
+      return conditions.reduce((acc, condition) => ExpressionUtils.binary(acc, "&&", condition));
+    }
+  }
+  isRelationField(expr2, model) {
+    const fieldDef = this.getFieldDefFromFieldRef(expr2, model);
+    return !!fieldDef?.relation;
+  }
+  getFieldDefFromFieldRef(expr2, model) {
+    if (ExpressionUtils.isField(expr2)) {
+      return requireField(this.schema, model, expr2.field);
+    } else if (ExpressionUtils.isMember(expr2) && expr2.members.length === 1 && ExpressionUtils.isThis(expr2.receiver)) {
+      return requireField(this.schema, model, expr2.members[0]);
+    } else {
+      return void 0;
+    }
   }
 };
 _ts_decorate([
@@ -2286,7 +2635,7 @@ _ts_decorate([
 ], ExpressionTransformer.prototype, "_member", null);
 
 // src/plugins/policy/policy-handler.ts
-var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
+var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
   static {
     __name(this, "PolicyHandler");
   }
@@ -2301,111 +2650,296 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
   }
   async handle(node, proceed) {
     if (!this.isCrudQueryNode(node)) {
-      throw new RejectedByPolicyError(void 0, "non-CRUD queries are not allowed");
+      throw new RejectedByPolicyError(void 0, RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
     }
     if (!this.isMutationQueryNode(node)) {
       return proceed(this.transformNode(node));
     }
-    let mutationRequiresTransaction = false;
-    const mutationModel = this.getMutationModel(node);
-    if (import_kysely7.InsertQueryNode.is(node)) {
-      const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
-      if (constCondition === false) {
-        throw new RejectedByPolicyError(mutationModel);
-      } else if (constCondition === void 0) {
-        mutationRequiresTransaction = true;
+    const { mutationModel } = this.getMutationModel(node);
+    if (import_kysely8.InsertQueryNode.is(node)) {
+      const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
+      let needCheckPreCreate = true;
+      if (!isManyToManyJoinTable) {
+        const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
+        if (constCondition === true) {
+          needCheckPreCreate = false;
+        } else if (constCondition === false) {
+          throw new RejectedByPolicyError(mutationModel);
+        }
+      }
+      if (needCheckPreCreate) {
+        await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
       }
     }
-    if (!mutationRequiresTransaction && !node.returning) {
-      return proceed(this.transformNode(node));
-    }
-    if (import_kysely7.InsertQueryNode.is(node)) {
-      await this.enforcePreCreatePolicy(node, proceed);
-    }
-    const transformedNode = this.transformNode(node);
-    const result = await proceed(transformedNode);
-    if (!this.onlyReturningId(node)) {
+    const result = await proceed(this.transformNode(node));
+    if (!node.returning || this.onlyReturningId(node)) {
+      return result;
+    } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
-        throw new RejectedByPolicyError(mutationModel, "result is not allowed to be read back");
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       }
       return readBackResult;
-    } else {
+    }
+  }
+  // #region overrides
+  transformSelectQuery(node) {
+    let whereNode = this.transformNode(node.where);
+    const policyFilter = this.createPolicyFilterForFrom(node.from);
+    if (policyFilter) {
+      whereNode = import_kysely8.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
+        whereNode.where,
+        policyFilter
+      ]) : policyFilter);
+    }
+    const baseResult = super.transformSelectQuery({
+      ...node,
+      where: void 0
+    });
+    return {
+      ...baseResult,
+      where: whereNode
+    };
+  }
+  transformJoin(node) {
+    const table = this.extractTableName(node.table);
+    if (!table) {
+      return super.transformJoin(node);
+    }
+    const filter = this.buildPolicyFilter(table.model, table.alias, "read");
+    const nestedSelect = {
+      kind: "SelectQueryNode",
+      from: import_kysely8.FromNode.create([
+        node.table
+      ]),
+      selections: [
+        import_kysely8.SelectionNode.createSelectAll()
+      ],
+      where: import_kysely8.WhereNode.create(filter)
+    };
+    return {
+      ...node,
+      table: import_kysely8.AliasNode.create(import_kysely8.ParensNode.create(nestedSelect), import_kysely8.IdentifierNode.create(table.alias ?? table.model))
+    };
+  }
+  transformInsertQuery(node) {
+    let onConflict = node.onConflict;
+    if (onConflict?.updates) {
+      const { mutationModel, alias } = this.getMutationModel(node);
+      const filter = this.buildPolicyFilter(mutationModel, alias, "update");
+      if (onConflict.updateWhere) {
+        onConflict = {
+          ...onConflict,
+          updateWhere: import_kysely8.WhereNode.create(conjunction(this.dialect, [
+            onConflict.updateWhere.where,
+            filter
+          ]))
+        };
+      } else {
+        onConflict = {
+          ...onConflict,
+          updateWhere: import_kysely8.WhereNode.create(filter)
+        };
+      }
+    }
+    const processedNode = onConflict ? {
+      ...node,
+      onConflict
+    } : node;
+    const result = super.transformInsertQuery(processedNode);
+    if (!node.returning) {
+      return result;
+    }
+    if (this.onlyReturningId(node)) {
       return result;
+    } else {
+      const { mutationModel } = this.getMutationModel(node);
+      const idFields = requireIdFields(this.client.$schema, mutationModel);
+      return {
+        ...result,
+        returning: import_kysely8.ReturningNode.create(idFields.map((field) => import_kysely8.SelectionNode.create(import_kysely8.ColumnNode.create(field))))
+      };
     }
   }
+  transformUpdateQuery(node) {
+    const result = super.transformUpdateQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "update");
+    if (node.from) {
+      const joinFilter = this.createPolicyFilterForFrom(node.from);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    return {
+      ...result,
+      where: import_kysely8.WhereNode.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  transformDeleteQuery(node) {
+    const result = super.transformDeleteQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "delete");
+    if (node.using) {
+      const joinFilter = this.createPolicyFilterForTables(node.using.tables);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    return {
+      ...result,
+      where: import_kysely8.WhereNode.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  // #endregion
+  // #region helpers
   onlyReturningId(node) {
     if (!node.returning) {
       return true;
     }
-    const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
+    const { mutationModel } = this.getMutationModel(node);
+    const idFields = requireIdFields(this.client.$schema, mutationModel);
     const collector = new ColumnCollector();
     const selectedColumns = collector.collect(node.returning);
     return selectedColumns.every((c) => idFields.includes(c));
   }
-  async enforcePreCreatePolicy(node, proceed) {
-    if (!node.columns || !node.values) {
-      return;
-    }
-    const model = this.getMutationModel(node);
-    const fields = node.columns.map((c) => c.column.name);
-    const valueRows = this.unwrapCreateValueRows(node.values, model, fields);
+  async enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed) {
+    const fields = node.columns?.map((c) => c.column.name) ?? [];
+    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, mutationModel, fields, isManyToManyJoinTable) : [
+      []
+    ];
     for (const values of valueRows) {
-      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), values.map((v) => v.raw), proceed);
+      if (isManyToManyJoinTable) {
+        await this.enforcePreCreatePolicyForManyToManyJoinTable(mutationModel, fields, values.map((v) => v.node), proceed);
+      } else {
+        await this.enforcePreCreatePolicyForOne(mutationModel, fields, values.map((v) => v.node), proceed);
+      }
     }
   }
-  async enforcePreCreatePolicyForOne(model, fields, values, valuesRaw, proceed) {
-    const thisEntity = {};
-    const thisEntityRaw = {};
-    for (let i = 0; i < fields.length; i++) {
-      thisEntity[fields[i]] = values[i];
-      thisEntityRaw[fields[i]] = valuesRaw[i];
+  async enforcePreCreatePolicyForManyToManyJoinTable(tableName, fields, values, proceed) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    (0, import_common_helpers7.invariant)(m2m);
+    (0, import_common_helpers7.invariant)(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
+    const aIndex = fields.indexOf("A");
+    const aNode = values[aIndex];
+    const bIndex = fields.indexOf("B");
+    const bNode = values[bIndex];
+    (0, import_common_helpers7.invariant)(import_kysely8.ValueNode.is(aNode) && import_kysely8.ValueNode.is(bNode), "A and B values must be ValueNode");
+    const aValue = aNode.value;
+    const bValue = bNode.value;
+    (0, import_common_helpers7.invariant)(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
+    (0, import_common_helpers7.invariant)(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
+    const eb = (0, import_kysely8.expressionBuilder)();
+    const filterA = this.buildPolicyFilter(m2m.firstModel, void 0, "update");
+    const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new import_kysely8.ExpressionWrapper(filterA).as("$t"));
+    const filterB = this.buildPolicyFilter(m2m.secondModel, void 0, "update");
+    const queryB = eb.selectFrom(m2m.secondModel).where(eb(eb.ref(`${m2m.secondModel}.${m2m.secondIdField}`), "=", bValue)).select(() => new import_kysely8.ExpressionWrapper(filterB).as("$t"));
+    const queryNode = {
+      kind: "SelectQueryNode",
+      selections: [
+        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(queryA.toOperationNode(), import_kysely8.IdentifierNode.create("$conditionA"))),
+        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(queryB.toOperationNode(), import_kysely8.IdentifierNode.create("$conditionB")))
+      ]
+    };
+    const result = await proceed(queryNode);
+    if (!result.rows[0]?.$conditionA) {
+      throw new RejectedByPolicyError(m2m.firstModel, RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+    }
+    if (!result.rows[0]?.$conditionB) {
+      throw new RejectedByPolicyError(m2m.secondModel, RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
     }
-    const filter = this.buildPolicyFilter(model, void 0, "create", thisEntity, thisEntityRaw);
+  }
+  async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
+    const allFields = Object.entries(requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
+    const allValues = [];
+    for (const [name, _def] of allFields) {
+      const index = fields.indexOf(name);
+      if (index >= 0) {
+        allValues.push(values[index]);
+      } else {
+        allValues.push(import_kysely8.ValueNode.createImmediate(null));
+      }
+    }
+    const eb = (0, import_kysely8.expressionBuilder)();
+    const constTable = {
+      kind: "SelectQueryNode",
+      from: import_kysely8.FromNode.create([
+        import_kysely8.AliasNode.create(import_kysely8.ParensNode.create(import_kysely8.ValuesNode.create([
+          import_kysely8.ValueListNode.create(allValues)
+        ])), import_kysely8.IdentifierNode.create("$t"))
+      ]),
+      selections: allFields.map(([name, def], index) => {
+        const castedColumnRef = import_kysely8.sql`CAST(${eb.ref(`column${index + 1}`)} as ${import_kysely8.sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+        return import_kysely8.SelectionNode.create(castedColumnRef.toOperationNode());
+      })
+    };
+    const filter = this.buildPolicyFilter(model, void 0, "create");
     const preCreateCheck = {
       kind: "SelectQueryNode",
+      from: import_kysely8.FromNode.create([
+        import_kysely8.AliasNode.create(constTable, import_kysely8.IdentifierNode.create(model))
+      ]),
       selections: [
-        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(filter, import_kysely7.IdentifierNode.create("$condition")))
-      ]
+        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(import_kysely8.BinaryOperationNode.create(import_kysely8.FunctionNode.create("COUNT", [
+          import_kysely8.ValueNode.createImmediate(1)
+        ]), import_kysely8.OperatorNode.create(">"), import_kysely8.ValueNode.createImmediate(0)), import_kysely8.IdentifierNode.create("$condition")))
+      ],
+      where: import_kysely8.WhereNode.create(filter)
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
       throw new RejectedByPolicyError(model);
     }
   }
-  unwrapCreateValueRows(node, model, fields) {
-    if (import_kysely7.ValuesNode.is(node)) {
-      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields));
-    } else if (import_kysely7.PrimitiveValueListNode.is(node)) {
+  unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
+    if (import_kysely8.ValuesNode.is(node)) {
+      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields, isManyToManyJoinTable));
+    } else if (import_kysely8.PrimitiveValueListNode.is(node)) {
       return [
-        this.unwrapCreateValueRow(node.values, model, fields)
+        this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
       ];
     } else {
       throw new InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
     }
   }
-  unwrapCreateValueRow(data, model, fields) {
-    (0, import_common_helpers6.invariant)(data.length === fields.length, "data length must match fields length");
+  unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
+    (0, import_common_helpers7.invariant)(data.length === fields.length, "data length must match fields length");
     const result = [];
     for (let i = 0; i < data.length; i++) {
       const item = data[i];
-      const fieldDef = requireField(this.client.$schema, model, fields[i]);
       if (typeof item === "object" && item && "kind" in item) {
-        (0, import_common_helpers6.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
+        const fieldDef = requireField(this.client.$schema, model, fields[i]);
+        (0, import_common_helpers7.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
         result.push({
-          node: import_kysely7.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
+          node: import_kysely8.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
           raw: item.value
         });
       } else {
-        const value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        let value = item;
+        if (!isImplicitManyToManyJoinTable) {
+          const fieldDef = requireField(this.client.$schema, model, fields[i]);
+          value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        }
         if (Array.isArray(value)) {
           result.push({
-            node: import_kysely7.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
+            node: import_kysely8.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
             raw: value
           });
         } else {
           result.push({
-            node: import_kysely7.ValueNode.create(value),
+            node: import_kysely8.ValueNode.create(value),
             raw: value
           });
         }
@@ -2441,18 +2975,15 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     if (!this.isMutationQueryNode(node) || !node.returning) {
       return result;
     }
-    const table = this.getMutationModel(node);
-    if (!table) {
-      throw new InternalError(`Unable to get table name for query node: ${node}`);
-    }
-    const idConditions = this.buildIdConditions(table, result.rows);
-    const policyFilter = this.buildPolicyFilter(table, void 0, "read");
+    const { mutationModel } = this.getMutationModel(node);
+    const idConditions = this.buildIdConditions(mutationModel, result.rows);
+    const policyFilter = this.buildPolicyFilter(mutationModel, void 0, "read");
     const select = {
       kind: "SelectQueryNode",
-      from: import_kysely7.FromNode.create([
-        import_kysely7.TableNode.create(table)
+      from: import_kysely8.FromNode.create([
+        import_kysely8.TableNode.create(mutationModel)
       ]),
-      where: import_kysely7.WhereNode.create(conjunction(this.dialect, [
+      where: import_kysely8.WhereNode.create(conjunction(this.dialect, [
         idConditions,
         policyFilter
       ])),
@@ -2462,15 +2993,31 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     return selectResult;
   }
   buildIdConditions(table, rows) {
-    const idFields = getIdFields(this.client.$schema, table);
-    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely7.BinaryOperationNode.create(import_kysely7.ColumnNode.create(field), import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.create(row[field]))))));
+    const idFields = requireIdFields(this.client.$schema, table);
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely8.BinaryOperationNode.create(import_kysely8.ColumnNode.create(field), import_kysely8.OperatorNode.create("="), import_kysely8.ValueNode.create(row[field]))))));
   }
   getMutationModel(node) {
-    const r = (0, import_ts_pattern8.match)(node).when(import_kysely7.InsertQueryNode.is, (node2) => getTableName(node2.into)).when(import_kysely7.UpdateQueryNode.is, (node2) => getTableName(node2.table)).when(import_kysely7.DeleteQueryNode.is, (node2) => {
+    const r = (0, import_ts_pattern8.match)(node).when(import_kysely8.InsertQueryNode.is, (node2) => ({
+      mutationModel: getTableName(node2.into),
+      alias: void 0
+    })).when(import_kysely8.UpdateQueryNode.is, (node2) => {
+      if (!node2.table) {
+        throw new QueryError("Update query must have a table");
+      }
+      const r2 = this.extractTableName(node2.table);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
+    }).when(import_kysely8.DeleteQueryNode.is, (node2) => {
       if (node2.from.froms.length !== 1) {
-        throw new InternalError("Only one from table is supported for delete");
+        throw new QueryError("Only one from table is supported for delete");
       }
-      return getTableName(node2.from.froms[0]);
+      const r2 = this.extractTableName(node2.from.froms[0]);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
     }).exhaustive();
     if (!r) {
       throw new InternalError(`Unable to get table name for query node: ${node}`);
@@ -2478,18 +3025,22 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     return r;
   }
   isCrudQueryNode(node) {
-    return import_kysely7.SelectQueryNode.is(node) || import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
+    return import_kysely8.SelectQueryNode.is(node) || import_kysely8.InsertQueryNode.is(node) || import_kysely8.UpdateQueryNode.is(node) || import_kysely8.DeleteQueryNode.is(node);
   }
   isMutationQueryNode(node) {
-    return import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
+    return import_kysely8.InsertQueryNode.is(node) || import_kysely8.UpdateQueryNode.is(node) || import_kysely8.DeleteQueryNode.is(node);
   }
-  buildPolicyFilter(model, alias, operation, thisEntity, thisEntityRaw) {
+  buildPolicyFilter(model, alias, operation) {
+    const m2mFilter = this.getModelPolicyFilterForManyToManyJoinTable(model, alias, operation);
+    if (m2mFilter) {
+      return m2mFilter;
+    }
     const policies = this.getModelPolicies(model, operation);
     if (policies.length === 0) {
       return falseNode(this.dialect);
     }
-    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
-    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     let combinedPolicy;
     if (allows.length === 0) {
       combinedPolicy = falseNode(this.dialect);
@@ -2505,102 +3056,59 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     }
     return combinedPolicy;
   }
-  transformSelectQuery(node) {
-    let whereNode = node.where;
-    node.from?.froms.forEach((from) => {
-      const extractResult = this.extractTableName(from);
-      if (extractResult) {
-        const { model, alias } = extractResult;
-        const filter = this.buildPolicyFilter(model, alias, "read");
-        whereNode = import_kysely7.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
-          whereNode.where,
-          filter
-        ]) : filter);
-      }
-    });
-    const baseResult = super.transformSelectQuery({
-      ...node,
-      where: void 0
-    });
-    return {
-      ...baseResult,
-      where: whereNode
-    };
-  }
-  transformInsertQuery(node) {
-    const result = super.transformInsertQuery(node);
-    if (!node.returning) {
-      return result;
-    }
-    if (this.onlyReturningId(node)) {
-      return result;
-    } else {
-      const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
-      return {
-        ...result,
-        returning: import_kysely7.ReturningNode.create(idFields.map((field) => import_kysely7.SelectionNode.create(import_kysely7.ColumnNode.create(field))))
-      };
-    }
-  }
-  transformUpdateQuery(node) {
-    const result = super.transformUpdateQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "update");
-    return {
-      ...result,
-      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
-  }
-  transformDeleteQuery(node) {
-    const result = super.transformDeleteQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "delete");
-    return {
-      ...result,
-      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
-  }
-  extractTableName(from) {
-    if (import_kysely7.TableNode.is(from)) {
+  extractTableName(node) {
+    if (import_kysely8.TableNode.is(node)) {
       return {
-        model: from.table.identifier.name
+        model: node.table.identifier.name
       };
     }
-    if (import_kysely7.AliasNode.is(from)) {
-      const inner = this.extractTableName(from.node);
+    if (import_kysely8.AliasNode.is(node)) {
+      const inner = this.extractTableName(node.node);
       if (!inner) {
         return void 0;
       }
       return {
         model: inner.model,
-        alias: import_kysely7.IdentifierNode.is(from.alias) ? from.alias.name : void 0
+        alias: import_kysely8.IdentifierNode.is(node.alias) ? node.alias.name : void 0
       };
     } else {
       return void 0;
     }
   }
-  transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw) {
-    return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
+  createPolicyFilterForFrom(node) {
+    if (!node) {
+      return void 0;
+    }
+    return this.createPolicyFilterForTables(node.froms);
+  }
+  createPolicyFilterForTables(tables) {
+    return tables.reduce((acc, table) => {
+      const extractResult = this.extractTableName(table);
+      if (extractResult) {
+        const { model, alias } = extractResult;
+        const filter = this.buildPolicyFilter(model, alias, "read");
+        return acc ? conjunction(this.dialect, [
+          acc,
+          filter
+        ]) : filter;
+      }
+      return acc;
+    }, void 0);
+  }
+  compilePolicyCondition(model, alias, operation, policy) {
+    return new ExpressionTransformer(this.client).transform(policy.condition, {
       model,
       alias,
       operation,
-      thisEntity,
-      thisEntityRaw,
       auth: this.client.$auth
     });
   }
-  getModelPolicies(modelName, operation) {
-    const modelDef = requireModel(this.client.$schema, modelName);
+  getModelPolicies(model, operation) {
+    const modelDef = requireModel(this.client.$schema, model);
     const result = [];
     const extractOperations = /* @__PURE__ */ __name((expr2) => {
-      (0, import_common_helpers6.invariant)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
-      (0, import_common_helpers6.invariant)(typeof expr2.value === "string", "expecting a string literal");
+      (0, import_common_helpers7.invariant)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
+      (0, import_common_helpers7.invariant)(typeof expr2.value === "string", "expecting a string literal");
       return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
     }, "extractOperations");
     if (modelDef.attributes) {
@@ -2612,8 +3120,84 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     }
     return result;
   }
+  resolveManyToManyJoinTable(tableName) {
+    for (const model of Object.values(this.client.$schema.models)) {
+      for (const field of Object.values(model.fields)) {
+        const m2m = getManyToManyRelation(this.client.$schema, model.name, field.name);
+        if (m2m?.joinTable === tableName) {
+          const sortedRecord = [
+            {
+              model: model.name,
+              field: field.name
+            },
+            {
+              model: m2m.otherModel,
+              field: m2m.otherField
+            }
+          ].sort(this.manyToManySorter);
+          const firstIdFields = requireIdFields(this.client.$schema, sortedRecord[0].model);
+          const secondIdFields = requireIdFields(this.client.$schema, sortedRecord[1].model);
+          (0, import_common_helpers7.invariant)(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
+          return {
+            firstModel: sortedRecord[0].model,
+            firstField: sortedRecord[0].field,
+            firstIdField: firstIdFields[0],
+            secondModel: sortedRecord[1].model,
+            secondField: sortedRecord[1].field,
+            secondIdField: secondIdFields[0]
+          };
+        }
+      }
+    }
+    return void 0;
+  }
+  manyToManySorter(a, b) {
+    return a.model !== b.model ? a.model.localeCompare(b.model) : a.field.localeCompare(b.field);
+  }
+  isManyToManyJoinTable(tableName) {
+    return !!this.resolveManyToManyJoinTable(tableName);
+  }
+  getModelPolicyFilterForManyToManyJoinTable(tableName, alias, operation) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    if (!m2m) {
+      return void 0;
+    }
+    const checkForOperation = operation === "read" ? "read" : "update";
+    const eb = (0, import_kysely8.expressionBuilder)();
+    const joinTable = alias ?? tableName;
+    const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new import_kysely8.ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
+    const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new import_kysely8.ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
+    return eb.and([
+      aQuery,
+      bQuery
+    ]).toOperationNode();
+  }
 };
 
+// src/plugins/policy/functions.ts
+var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, operation }) => {
+  (0, import_common_helpers8.invariant)(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
+  const arg1Node = args[0].toOperationNode();
+  const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
+  if (arg2Node) {
+    (0, import_common_helpers8.invariant)(import_kysely9.ValueNode.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
+    (0, import_common_helpers8.invariant)(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+  }
+  const fieldName = extractFieldName(arg1Node);
+  (0, import_common_helpers8.invariant)(fieldName, 'Failed to extract field name from the first argument of "check" function');
+  const fieldDef = requireField(client.$schema, model, fieldName);
+  (0, import_common_helpers8.invariant)(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
+  (0, import_common_helpers8.invariant)(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
+  const relationModel = fieldDef.type;
+  const op = arg2Node ? arg2Node.value : operation;
+  const policyHandler = new PolicyHandler(client);
+  const joinPairs = buildJoinPairs(client.$schema, model, modelAlias, fieldName, relationModel);
+  const joinCondition = joinPairs.length === 1 ? eb(eb.ref(joinPairs[0][0]), "=", eb.ref(joinPairs[0][1])) : eb.and(joinPairs.map(([left, right]) => eb(eb.ref(left), "=", eb.ref(right))));
+  const policyCondition = policyHandler.buildPolicyFilter(relationModel, void 0, op);
+  const result = eb.selectFrom(relationModel).where(joinCondition).select(new import_kysely9.ExpressionWrapper(policyCondition).as("$condition"));
+  return result;
+}, "check");
+
 // src/plugins/policy/plugin.ts
 var PolicyPlugin = class {
   static {
@@ -2628,6 +3212,11 @@ var PolicyPlugin = class {
   get description() {
     return "Enforces access policies defined in the schema.";
   }
+  get functions() {
+    return {
+      check
+    };
+  }
   onKyselyQuery({
     query,
     client,
@@ -2645,6 +3234,7 @@ var PolicyPlugin = class {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   PolicyPlugin,
-  RejectedByPolicyError
+  RejectedByPolicyError,
+  RejectedByPolicyReason
 });
 //# sourceMappingURL=index.cjs.map