@zenstackhq/runtime 3.0.0-beta.4 → 3.0.0-beta.5

package/dist/index.js

@@ -6,14 +6,15 @@ var __export = (target, all) => {
 };
 
 // src/client/client-impl.ts
-import { invariant as invariant14 } from "@zenstackhq/common-helpers";
-import { CompiledQuery, DefaultConnectionProvider, DefaultQueryExecutor as DefaultQueryExecutor2, Kysely, Log, sql as sql9, Transaction } from "kysely";
+import { invariant as invariant15 } from "@zenstackhq/common-helpers";
+import { CompiledQuery, DefaultConnectionProvider, DefaultQueryExecutor as DefaultQueryExecutor2, Kysely, Log, sql as sql10, Transaction } from "kysely";
 
 // src/client/crud/operations/aggregate.ts
-import { sql as sql5 } from "kysely";
+import { sql as sql6 } from "kysely";
 import { match as match10 } from "ts-pattern";
 
 // src/client/query-utils.ts
+import { invariant } from "@zenstackhq/common-helpers";
 import { match } from "ts-pattern";
 
 // src/schema/expression.ts
@@ -192,10 +193,19 @@ function requireField(schema, modelOrType, field) {
 }
 __name(requireField, "requireField");
 function getIdFields(schema, model) {
-  const modelDef = requireModel(schema, model);
+  const modelDef = getModel(schema, model);
   return modelDef?.idFields;
 }
 __name(getIdFields, "getIdFields");
+function requireIdFields(schema, model) {
+  const modelDef = requireModel(schema, model);
+  const result = modelDef?.idFields;
+  if (!result) {
+    throw new InternalError(`Model "${model}" does not have ID field(s)`);
+  }
+  return result;
+}
+__name(requireIdFields, "requireIdFields");
 function getRelationForeignKeyFieldPairs(schema, model, relationField) {
   const fieldDef = requireField(schema, model, relationField);
   if (!fieldDef?.relation) {
@@ -309,7 +319,7 @@ function buildFieldRef(schema, model, field, options, eb, modelAlias, inlineComp
       throw new QueryError(`Computed field "${field}" implementation not provided for model "${model}"`);
     }
     return computer(eb, {
-      currentModel: modelAlias
+      modelAlias
     });
   }
 }
@@ -344,7 +354,7 @@ function buildJoinPairs(schema, model, modelAlias, relationField, relationModelA
 }
 __name(buildJoinPairs, "buildJoinPairs");
 function makeDefaultOrderBy(schema, model) {
-  const idFields = getIdFields(schema, model);
+  const idFields = requireIdFields(schema, model);
   return idFields.map((f) => ({
     [f]: "asc"
   }));
@@ -383,11 +393,17 @@ function getManyToManyRelation(schema, model, field) {
         "A"
       ];
     }
+    const modelIdFields = requireIdFields(schema, model);
+    invariant(modelIdFields.length === 1, "Only single-field ID is supported for many-to-many relation");
+    const otherIdFields = requireIdFields(schema, fieldDef.type);
+    invariant(otherIdFields.length === 1, "Only single-field ID is supported for many-to-many relation");
     return {
       parentFkName: orderedFK[0],
+      parentPKName: modelIdFields[0],
       otherModel: fieldDef.type,
       otherField: fieldDef.relation.opposite,
       otherFkName: orderedFK[1],
+      otherPKName: otherIdFields[0],
       joinTable: fieldDef.relation.name ? `_${fieldDef.relation.name}` : `_${sortedModelNames[0]}To${sortedModelNames[1]}`
     };
   } else {
@@ -426,7 +442,7 @@ function ensureArray(value) {
 }
 __name(ensureArray, "ensureArray");
 function extractIdFields(entity, schema, model) {
-  const idFields = getIdFields(schema, model);
+  const idFields = requireIdFields(schema, model);
   return extractFields(entity, idFields);
 }
 __name(extractIdFields, "extractIdFields");
@@ -463,35 +479,94 @@ __name(aggregate, "aggregate");
 
 // src/client/crud/operations/base.ts
 import { createId } from "@paralleldrive/cuid2";
-import { invariant as invariant7, isPlainObject as isPlainObject3 } from "@zenstackhq/common-helpers";
-import { expressionBuilder as expressionBuilder3, sql as sql4 } from "kysely";
+import { invariant as invariant9, isPlainObject as isPlainObject3 } from "@zenstackhq/common-helpers";
+import { expressionBuilder as expressionBuilder4, sql as sql5 } from "kysely";
 import { nanoid } from "nanoid";
 import { match as match9 } from "ts-pattern";
 import { ulid } from "ulid";
 import * as uuid from "uuid";
 
 // src/plugins/policy/errors.ts
+var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
+  RejectedByPolicyReason2["NO_ACCESS"] = "no-access";
+  RejectedByPolicyReason2["CANNOT_READ_BACK"] = "cannot-read-back";
+  RejectedByPolicyReason2["OTHER"] = "other";
+  return RejectedByPolicyReason2;
+}({});
 var RejectedByPolicyError = class extends Error {
   static {
     __name(this, "RejectedByPolicyError");
   }
   model;
   reason;
-  constructor(model, reason) {
-    super(reason ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
+  constructor(model, reason = "no-access", message) {
+    super(message ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
   }
 };
 
+// src/plugins/policy/functions.ts
+import { invariant as invariant8 } from "@zenstackhq/common-helpers";
+import { ExpressionWrapper as ExpressionWrapper2, ValueNode as ValueNode4 } from "kysely";
+
+// src/client/contract.ts
+var TransactionIsolationLevel = /* @__PURE__ */ function(TransactionIsolationLevel2) {
+  TransactionIsolationLevel2["ReadUncommitted"] = "read uncommitted";
+  TransactionIsolationLevel2["ReadCommitted"] = "read committed";
+  TransactionIsolationLevel2["RepeatableRead"] = "repeatable read";
+  TransactionIsolationLevel2["Serializable"] = "serializable";
+  TransactionIsolationLevel2["Snapshot"] = "snapshot";
+  return TransactionIsolationLevel2;
+}({});
+var CRUD = [
+  "create",
+  "read",
+  "update",
+  "delete"
+];
+
+// src/client/kysely-utils.ts
+import { AliasNode, ColumnNode, ReferenceNode, TableNode } from "kysely";
+function stripAlias(node) {
+  if (AliasNode.is(node)) {
+    return {
+      alias: node.alias,
+      node: node.node
+    };
+  } else {
+    return {
+      alias: void 0,
+      node
+    };
+  }
+}
+__name(stripAlias, "stripAlias");
+function extractModelName(node) {
+  const { node: innerNode } = stripAlias(node);
+  return TableNode.is(innerNode) ? innerNode.table.identifier.name : void 0;
+}
+__name(extractModelName, "extractModelName");
+function extractFieldName(node) {
+  if (ReferenceNode.is(node) && ColumnNode.is(node.column)) {
+    return node.column.column.name;
+  } else if (ColumnNode.is(node)) {
+    return node.column.name;
+  } else {
+    return void 0;
+  }
+}
+__name(extractFieldName, "extractFieldName");
+
 // src/plugins/policy/policy-handler.ts
-import { invariant as invariant6 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode2, DeleteQueryNode, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReturningNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, TableNode as TableNode3, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
+import { invariant as invariant7 } from "@zenstackhq/common-helpers";
+import { AliasNode as AliasNode4, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode3, DeleteQueryNode, expressionBuilder as expressionBuilder3, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReturningNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql as sql4, TableNode as TableNode4, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
 import { match as match8 } from "ts-pattern";
 
 // src/client/crud/dialects/index.ts
 import { match as match5 } from "ts-pattern";
 
 // src/client/crud/dialects/postgresql.ts
-import { invariant as invariant2 } from "@zenstackhq/common-helpers";
+import { invariant as invariant3 } from "@zenstackhq/common-helpers";
+import Decimal from "decimal.js";
 import { sql as sql2 } from "kysely";
 import { match as match3 } from "ts-pattern";
 
@@ -517,7 +592,7 @@ var AGGREGATE_OPERATORS = [
 ];
 
 // src/client/crud/dialects/base-dialect.ts
-import { invariant, isPlainObject } from "@zenstackhq/common-helpers";
+import { invariant as invariant2, isPlainObject } from "@zenstackhq/common-helpers";
 import { expressionBuilder, sql } from "kysely";
 import { match as match2, P } from "ts-pattern";
 
@@ -549,6 +624,9 @@ var BaseCrudDialect = class {
   transformPrimitive(value, _type, _forArrayField) {
     return value;
   }
+  transformOutput(value, _type) {
+    return value;
+  }
   // #region common query builders
   buildSelectModel(eb, model, modelAlias) {
     const modelDef = requireModel(this.schema, model);
@@ -716,9 +794,11 @@ var BaseCrudDialect = class {
     const buildPkFkWhereRefs = /* @__PURE__ */ __name((eb2) => {
       const m2m = getManyToManyRelation(this.schema, model, field);
       if (m2m) {
-        const modelIdField = getIdFields(this.schema, model)[0];
-        const relationIdField = getIdFields(this.schema, relationModel)[0];
-        return eb2(sql.ref(`${relationFilterSelectAlias}.${relationIdField}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", sql.ref(`${modelAlias}.${modelIdField}`)));
+        const modelIdFields = requireIdFields(this.schema, model);
+        invariant2(modelIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        const relationIdFields = requireIdFields(this.schema, relationModel);
+        invariant2(relationIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        return eb2(sql.ref(`${relationFilterSelectAlias}.${relationIdFields[0]}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", sql.ref(`${modelAlias}.${modelIdFields[0]}`)));
       } else {
         const relationKeyPairs = getRelationForeignKeyFieldPairs(this.schema, model, field);
         let result2 = this.true(eb2);
@@ -828,14 +908,14 @@ var BaseCrudDialect = class {
       }
       const rhs = Array.isArray(value) ? value.map(getRhs) : getRhs(value);
       const condition = match2(op).with("equals", () => rhs === null ? eb(lhs, "is", null) : eb(lhs, "=", rhs)).with("in", () => {
-        invariant(Array.isArray(rhs), "right hand side must be an array");
+        invariant2(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.false(eb);
         } else {
           return eb(lhs, "in", rhs);
         }
       }).with("notIn", () => {
-        invariant(Array.isArray(rhs), "right hand side must be an array");
+        invariant2(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.true(eb);
         } else {
@@ -953,18 +1033,18 @@ var BaseCrudDialect = class {
           "_min",
           "_max"
         ].includes(field)) {
-          invariant(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
+          invariant2(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
           for (const [k, v] of Object.entries(value)) {
-            invariant(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+            invariant2(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
             result = result.orderBy((eb) => aggregate(eb, this.fieldRef(model, k, eb, modelAlias), field), sql.raw(this.negateSort(v, negated)));
           }
           continue;
         }
         switch (field) {
           case "_count": {
-            invariant(value && typeof value === "object", 'invalid orderBy value for field "_count"');
+            invariant2(value && typeof value === "object", 'invalid orderBy value for field "_count"');
             for (const [k, v] of Object.entries(value)) {
-              invariant(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+              invariant2(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
               result = result.orderBy((eb) => eb.fn.count(this.fieldRef(model, k, eb, modelAlias)), sql.raw(this.negateSort(v, negated)));
             }
             continue;
@@ -987,7 +1067,7 @@ var BaseCrudDialect = class {
               throw new QueryError(`invalid orderBy value for field "${field}"`);
             }
             if ("_count" in value) {
-              invariant(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
+              invariant2(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
               const sort = this.negateSort(value._count, negated);
               result = result.orderBy((eb) => {
                 const subQueryAlias = `${modelAlias}$orderBy$${field}$count`;
@@ -1059,7 +1139,7 @@ var BaseCrudDialect = class {
     }
   }
   buildDelegateJoin(thisModel, thisModelAlias, otherModelAlias, query) {
-    const idFields = getIdFields(this.schema, thisModel);
+    const idFields = requireIdFields(this.schema, thisModel);
     query = query.leftJoin(otherModelAlias, (qb) => {
       for (const idField of idFields) {
         qb = qb.onRef(`${thisModelAlias}.${idField}`, "=", `${otherModelAlias}.${idField}`);
@@ -1081,10 +1161,16 @@ var BaseCrudDialect = class {
     for (const [field, value] of Object.entries(selections.select)) {
       const fieldDef = requireField(this.schema, model, field);
       const fieldModel = fieldDef.type;
-      const joinPairs = buildJoinPairs(this.schema, model, parentAlias, field, fieldModel);
-      let fieldCountQuery = eb.selectFrom(fieldModel).select(eb.fn.countAll().as(`_count$${field}`));
-      for (const [left, right] of joinPairs) {
-        fieldCountQuery = fieldCountQuery.whereRef(left, "=", right);
+      let fieldCountQuery;
+      const m2m = getManyToManyRelation(this.schema, model, field);
+      if (m2m) {
+        fieldCountQuery = eb.selectFrom(fieldModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.joinTable}.${m2m.otherFkName}`, "=", `${fieldModel}.${m2m.otherPKName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${parentAlias}.${m2m.parentPKName}`)).select(eb.fn.countAll().as(`_count$${field}`));
+      } else {
+        fieldCountQuery = eb.selectFrom(fieldModel).select(eb.fn.countAll().as(`_count$${field}`));
+        const joinPairs = buildJoinPairs(this.schema, model, parentAlias, field, fieldModel);
+        for (const [left, right] of joinPairs) {
+          fieldCountQuery = fieldCountQuery.whereRef(left, "=", right);
+        }
       }
       if (value && typeof value === "object" && "where" in value && value.where && typeof value.where === "object") {
         const filter = this.buildFilter(eb, fieldModel, fieldModel, value.where);
@@ -1164,6 +1250,9 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   static {
     __name(this, "PostgresCrudDialect");
   }
+  constructor(schema, options) {
+    super(schema, options);
+  }
   get provider() {
     return "postgresql";
   }
@@ -1178,9 +1267,41 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
         return value.map((v) => this.transformPrimitive(v, type, false));
       }
     } else {
-      return match3(type).with("DateTime", () => value instanceof Date ? value : typeof value === "string" ? new Date(value) : value).with("Decimal", () => value !== null ? value.toString() : value).otherwise(() => value);
+      return match3(type).with("DateTime", () => value instanceof Date ? value.toISOString() : typeof value === "string" ? new Date(value).toISOString() : value).with("Decimal", () => value !== null ? value.toString() : value).otherwise(() => value);
+    }
+  }
+  transformOutput(value, type) {
+    if (value === null || value === void 0) {
+      return value;
+    }
+    return match3(type).with("DateTime", () => this.transformOutputDate(value)).with("Bytes", () => this.transformOutputBytes(value)).with("BigInt", () => this.transformOutputBigInt(value)).with("Decimal", () => this.transformDecimal(value)).otherwise(() => super.transformOutput(value, type));
+  }
+  transformOutputBigInt(value) {
+    if (typeof value === "bigint") {
+      return value;
+    }
+    invariant3(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    return BigInt(value);
+  }
+  transformDecimal(value) {
+    if (value instanceof Decimal) {
+      return value;
+    }
+    invariant3(typeof value === "string" || typeof value === "number" || value instanceof Decimal, `Expected string, number or Decimal, got ${typeof value}`);
+    return new Decimal(value);
+  }
+  transformOutputDate(value) {
+    if (typeof value === "string") {
+      return new Date(value);
+    } else if (value instanceof Date && this.options.fixPostgresTimezone !== false) {
+      return new Date(value.getTime() - value.getTimezoneOffset() * 60 * 1e3);
+    } else {
+      return value;
     }
   }
+  transformOutputBytes(value) {
+    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
+  }
   buildRelationSelection(query, model, relationField, parentAlias, payload) {
     const relationResultName = `${parentAlias}$${relationField}`;
     const joinedQuery = this.buildRelationJSON(model, query, relationField, parentAlias, payload, relationResultName);
@@ -1211,10 +1332,10 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   buildRelationJoinFilter(query, model, relationField, relationModel, relationModelAlias, parentAlias) {
     const m2m = getManyToManyRelation(this.schema, model, relationField);
     if (m2m) {
-      const parentIds = getIdFields(this.schema, model);
-      const relationIds = getIdFields(this.schema, relationModel);
-      invariant2(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      invariant2(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      const parentIds = requireIdFields(this.schema, model);
+      const relationIds = requireIdFields(this.schema, relationModel);
+      invariant3(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      invariant3(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       query = query.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const joinPairs = buildJoinPairs(this.schema, model, parentAlias, relationField, relationModelAlias);
@@ -1326,10 +1447,32 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   get supportInsertWithDefault() {
     return true;
   }
+  getFieldSqlType(fieldDef) {
+    if (fieldDef.relation) {
+      throw new QueryError("Cannot get SQL type of a relation field");
+    }
+    let result;
+    if (this.schema.enums?.[fieldDef.type]) {
+      result = "text";
+    } else {
+      result = match3(fieldDef.type).with("String", () => "text").with("Boolean", () => "boolean").with("Int", () => "integer").with("BigInt", () => "bigint").with("Float", () => "double precision").with("Decimal", () => "decimal").with("DateTime", () => "timestamp").with("Bytes", () => "bytea").with("Json", () => "jsonb").otherwise(() => "text");
+    }
+    if (fieldDef.array) {
+      result += "[]";
+    }
+    return result;
+  }
+  getStringCasingBehavior() {
+    return {
+      supportsILike: true,
+      likeCaseSensitive: true
+    };
+  }
 };
 
 // src/client/crud/dialects/sqlite.ts
-import { invariant as invariant3 } from "@zenstackhq/common-helpers";
+import { invariant as invariant4 } from "@zenstackhq/common-helpers";
+import Decimal2 from "decimal.js";
 import { sql as sql3 } from "kysely";
 import { match as match4 } from "ts-pattern";
 var SqliteCrudDialect = class extends BaseCrudDialect {
@@ -1349,10 +1492,58 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
       if (this.schema.typeDefs && type in this.schema.typeDefs) {
         return JSON.stringify(value);
       } else {
-        return match4(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).with("Json", () => JSON.stringify(value)).otherwise(() => value);
+        return match4(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : typeof value === "string" ? new Date(value).toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).with("Json", () => JSON.stringify(value)).otherwise(() => value);
       }
     }
   }
+  transformOutput(value, type) {
+    if (value === null || value === void 0) {
+      return value;
+    } else if (this.schema.typeDefs && type in this.schema.typeDefs) {
+      return this.transformOutputJson(value);
+    } else {
+      return match4(type).with("Boolean", () => this.transformOutputBoolean(value)).with("DateTime", () => this.transformOutputDate(value)).with("Bytes", () => this.transformOutputBytes(value)).with("Decimal", () => this.transformOutputDecimal(value)).with("BigInt", () => this.transformOutputBigInt(value)).with("Json", () => this.transformOutputJson(value)).otherwise(() => super.transformOutput(value, type));
+    }
+  }
+  transformOutputDecimal(value) {
+    if (value instanceof Decimal2) {
+      return value;
+    }
+    invariant4(typeof value === "string" || typeof value === "number" || value instanceof Decimal2, `Expected string, number or Decimal, got ${typeof value}`);
+    return new Decimal2(value);
+  }
+  transformOutputBigInt(value) {
+    if (typeof value === "bigint") {
+      return value;
+    }
+    invariant4(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    return BigInt(value);
+  }
+  transformOutputBoolean(value) {
+    return !!value;
+  }
+  transformOutputDate(value) {
+    if (typeof value === "number") {
+      return new Date(value);
+    } else if (typeof value === "string") {
+      return new Date(value);
+    } else {
+      return value;
+    }
+  }
+  transformOutputBytes(value) {
+    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
+  }
+  transformOutputJson(value) {
+    if (typeof value === "string") {
+      try {
+        return JSON.parse(value);
+      } catch (e) {
+        throw new QueryError("Invalid JSON returned", e);
+      }
+    }
+    return value;
+  }
   buildRelationSelection(query, model, relationField, parentAlias, payload) {
     return query.select((eb) => this.buildRelationJSON(model, eb, relationField, parentAlias, payload).as(relationField));
   }
@@ -1434,10 +1625,10 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
     const relationModel = fieldDef.type;
     const m2m = getManyToManyRelation(this.schema, model, relationField);
     if (m2m) {
-      const parentIds = getIdFields(this.schema, model);
-      const relationIds = getIdFields(this.schema, relationModel);
-      invariant3(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      invariant3(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      const parentIds = requireIdFields(this.schema, model);
+      const relationIds = requireIdFields(this.schema, relationModel);
+      invariant4(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      invariant4(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       selectModelQuery = selectModelQuery.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
@@ -1489,6 +1680,24 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
   get supportInsertWithDefault() {
     return false;
   }
+  getFieldSqlType(fieldDef) {
+    if (fieldDef.relation) {
+      throw new QueryError("Cannot get SQL type of a relation field");
+    }
+    if (fieldDef.array) {
+      throw new QueryError("SQLite does not support scalar list type");
+    }
+    if (this.schema.enums?.[fieldDef.type]) {
+      return "text";
+    }
+    return match4(fieldDef.type).with("String", () => "text").with("Boolean", () => "integer").with("Int", () => "integer").with("BigInt", () => "integer").with("Float", () => "real").with("Decimal", () => "decimal").with("DateTime", () => "numeric").with("Bytes", () => "blob").with("Json", () => "jsonb").otherwise(() => "text");
+  }
+  getStringCasingBehavior() {
+    return {
+      supportsILike: false,
+      likeCaseSensitive: false
+    };
+  }
 };
 
 // src/client/crud/dialects/index.ts
@@ -1816,12 +2025,12 @@ var ColumnCollector = class extends DefaultOperationNodeVisitor {
 };
 
 // src/plugins/policy/expression-transformer.ts
-import { invariant as invariant5 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode2, BinaryOperationNode as BinaryOperationNode2, ColumnNode, expressionBuilder as expressionBuilder2, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode2, SelectionNode, SelectQueryNode, TableNode as TableNode2, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
+import { invariant as invariant6 } from "@zenstackhq/common-helpers";
+import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode2, ColumnNode as ColumnNode2, expressionBuilder as expressionBuilder2, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode3, SelectionNode, SelectQueryNode, TableNode as TableNode3, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
 import { match as match7 } from "ts-pattern";
 
 // src/plugins/policy/expression-evaluator.ts
-import { invariant as invariant4 } from "@zenstackhq/common-helpers";
+import { invariant as invariant5 } from "@zenstackhq/common-helpers";
 import { match as match6 } from "ts-pattern";
 var ExpressionEvaluator = class {
   static {
@@ -1865,18 +2074,18 @@ var ExpressionEvaluator = class {
     const right = this.evaluate(expr2.right, context);
     return match6(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
-      invariant4(Array.isArray(_right), 'expected array for "in" operator');
+      invariant5(Array.isArray(_right), 'expected array for "in" operator');
       return _right.includes(left);
     }).exhaustive();
   }
   evaluateCollectionPredicate(expr2, context) {
     const op = expr2.op;
-    invariant4(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    invariant5(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
     if (!left) {
       return false;
     }
-    invariant4(Array.isArray(left), "expected array");
+    invariant5(Array.isArray(left), "expected array");
     return match6(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
       ...context,
       thisValue: item
@@ -1891,7 +2100,7 @@ var ExpressionEvaluator = class {
 };
 
 // src/plugins/policy/utils.ts
-import { AliasNode, AndNode, BinaryOperationNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode, TableNode, UnaryOperationNode, ValueNode } from "kysely";
+import { AliasNode as AliasNode2, AndNode, BinaryOperationNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode as ReferenceNode2, TableNode as TableNode2, UnaryOperationNode, ValueNode } from "kysely";
 function trueNode(dialect) {
   return ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
 }
@@ -1977,11 +2186,11 @@ function getTableName(node) {
   if (!node) {
     return node;
   }
-  if (TableNode.is(node)) {
+  if (TableNode2.is(node)) {
     return node.table.identifier.name;
-  } else if (AliasNode.is(node)) {
+  } else if (AliasNode2.is(node)) {
     return getTableName(node.node);
-  } else if (ReferenceNode.is(node) && node.table) {
+  } else if (ReferenceNode2.is(node) && node.table) {
     return getTableName(node.table);
   }
   return void 0;
@@ -2014,16 +2223,21 @@ var ExpressionTransformer = class {
   static {
     __name(this, "ExpressionTransformer");
   }
-  schema;
-  clientOptions;
-  auth;
+  client;
   dialect;
-  constructor(schema, clientOptions, auth) {
-    this.schema = schema;
-    this.clientOptions = clientOptions;
-    this.auth = auth;
+  constructor(client) {
+    this.client = client;
     this.dialect = getCrudDialect(this.schema, this.clientOptions);
   }
+  get schema() {
+    return this.client.$schema;
+  }
+  get clientOptions() {
+    return this.client.$options;
+  }
+  get auth() {
+    return this.client.$auth;
+  }
   get authType() {
     if (!this.schema.authType) {
       throw new InternalError('Schema does not have an "authType" specified');
@@ -2093,8 +2307,9 @@ var ExpressionTransformer = class {
     if (op === "?" || op === "!" || op === "^") {
       return this.transformCollectionPredicate(expr2, context);
     }
-    const left = this.transform(expr2.left, context);
-    const right = this.transform(expr2.right, context);
+    const { normalizedLeft, normalizedRight } = this.normalizeBinaryOperationOperands(expr2, context);
+    const left = this.transform(normalizedLeft, context);
+    const right = this.transform(normalizedRight, context);
     if (op === "in") {
       if (this.isNullNode(left)) {
         return this.transformValue(false, "Boolean");
@@ -2109,29 +2324,65 @@ var ExpressionTransformer = class {
       }
     }
     if (this.isNullNode(right)) {
-      return expr2.op === "==" ? BinaryOperationNode2.create(left, OperatorNode2.create("is"), right) : BinaryOperationNode2.create(left, OperatorNode2.create("is not"), right);
+      return this.transformNullCheck(left, expr2.op);
     } else if (this.isNullNode(left)) {
-      return expr2.op === "==" ? BinaryOperationNode2.create(right, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(right, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+      return this.transformNullCheck(right, expr2.op);
+    } else {
+      return BinaryOperationNode2.create(left, this.transformOperator(op), right);
     }
-    return BinaryOperationNode2.create(left, this.transformOperator(op), right);
+  }
+  transformNullCheck(expr2, operator) {
+    invariant6(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
+    if (ValueNode2.is(expr2)) {
+      if (expr2.value === null) {
+        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+      } else {
+        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+      }
+    } else {
+      return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+    }
+  }
+  normalizeBinaryOperationOperands(expr2, context) {
+    let normalizedLeft = expr2.left;
+    if (this.isRelationField(expr2.left, context.model)) {
+      invariant6(ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      invariant6(leftRelDef, "failed to get relation field definition");
+      const idFields = requireIdFields(this.schema, leftRelDef.type);
+      normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
+    }
+    let normalizedRight = expr2.right;
+    if (this.isRelationField(expr2.right, context.model)) {
+      invariant6(ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      invariant6(rightRelDef, "failed to get relation field definition");
+      const idFields = requireIdFields(this.schema, rightRelDef.type);
+      normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
+    }
+    return {
+      normalizedLeft,
+      normalizedRight
+    };
   }
   transformCollectionPredicate(expr2, context) {
-    invariant5(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    invariant6(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
     if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
       const value = new ExpressionEvaluator().evaluate(expr2, {
         auth: this.auth
       });
       return this.transformValue(value, "Boolean");
     }
-    invariant5(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
+    invariant6(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
-    if (ExpressionUtils.isField(expr2.left)) {
-      const fieldDef = requireField(this.schema, context.model, expr2.left.field);
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    if (fieldDef) {
+      invariant6(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
-      invariant5(ExpressionUtils.isField(expr2.left.receiver));
-      const fieldDef = requireField(this.schema, context.model, expr2.left.receiver.field);
-      newContextModel = fieldDef.type;
+      invariant6(ExpressionUtils.isMember(expr2.left) && ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
+      const fieldDef2 = requireField(this.schema, context.model, expr2.left.receiver.field);
+      newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
         const memberDef = requireField(this.schema, newContextModel, member);
         newContextModel = memberDef.type;
@@ -2151,7 +2402,7 @@ var ExpressionTransformer = class {
     const predicateResult = match7(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode2.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).exhaustive();
     return this.transform(expr2.left, {
       ...context,
-      memberSelect: SelectionNode.create(AliasNode2.create(predicateResult, IdentifierNode.create("$t"))),
+      memberSelect: SelectionNode.create(AliasNode3.create(predicateResult, IdentifierNode.create("$t"))),
       memberFilter: predicateFilter
     });
   }
@@ -2176,12 +2427,10 @@ var ExpressionTransformer = class {
         throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
-      invariant5(idFields.length > 0, "auth type model must have at least one id field");
+      invariant6(idFields.length > 0, "auth type model must have at least one id field");
       const conditions = idFields.map((fieldName) => ExpressionUtils.binary(ExpressionUtils.member(authExpr, [
         fieldName
-      ]), "==", ExpressionUtils.member(other, [
-        fieldName
-      ])));
+      ]), "==", this.makeOrAppendMember(other, fieldName)));
       let result = this.buildAnd(conditions);
       if (expr2.op === "!=") {
         result = this.buildLogicalNot(result);
@@ -2189,11 +2438,29 @@ var ExpressionTransformer = class {
       return this.transform(result, context);
     }
   }
+  makeOrAppendMember(other, fieldName) {
+    if (ExpressionUtils.isMember(other)) {
+      return ExpressionUtils.member(other.receiver, [
+        ...other.members,
+        fieldName
+      ]);
+    } else {
+      return ExpressionUtils.member(other, [
+        fieldName
+      ]);
+    }
+  }
   transformValue(value, type) {
-    return ValueNode2.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+    if (value === true) {
+      return trueNode(this.dialect);
+    } else if (value === false) {
+      return falseNode(this.dialect);
+    } else {
+      return ValueNode2.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+    }
   }
   _unary(expr2, context) {
-    invariant5(expr2.op === "!", 'only "!" operator is supported');
+    invariant6(expr2.op === "!", 'only "!" operator is supported');
     return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
@@ -2205,17 +2472,31 @@ var ExpressionTransformer = class {
     return result.toOperationNode();
   }
   transformCall(expr2, context) {
-    const func = this.clientOptions.functions?.[expr2.function];
+    const func = this.getFunctionImpl(expr2.function);
     if (!func) {
       throw new QueryError(`Function not implemented: ${expr2.function}`);
     }
     const eb = expressionBuilder2();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
+      client: this.client,
       dialect: this.dialect,
       model: context.model,
+      modelAlias: context.alias ?? context.model,
       operation: context.operation
     });
   }
+  getFunctionImpl(functionName) {
+    let func = this.clientOptions.functions?.[functionName];
+    if (!func) {
+      for (const plugin of this.clientOptions.plugins ?? []) {
+        if (plugin.functions?.[functionName]) {
+          func = plugin.functions[functionName];
+          break;
+        }
+      }
+    }
+    return func;
+  }
   transformCallArg(eb, arg, context) {
     if (ExpressionUtils.isLiteral(arg)) {
       return eb.val(arg.value);
@@ -2236,23 +2517,22 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
-    invariant5(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    invariant6(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
     let members = expr2.members;
     let receiver;
     const { memberFilter, memberSelect, ...restContext } = context;
     if (ExpressionUtils.isThis(expr2.receiver)) {
       if (expr2.members.length === 1) {
-        const fieldDef = requireField(this.schema, context.model, expr2.members[0]);
-        invariant5(!fieldDef.relation, "this.relation access should have been transformed into relation access");
-        return this.createColumnRef(expr2.members[0], restContext);
+        return this._field(ExpressionUtils.field(expr2.members[0]), context);
+      } else {
+        const firstMemberFieldDef = requireField(this.schema, context.model, expr2.members[0]);
+        receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
+        members = expr2.members.slice(1);
       }
-      const firstMemberFieldDef = requireField(this.schema, context.model, expr2.members[0]);
-      receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
-      members = expr2.members.slice(1);
     } else {
       receiver = this.transform(expr2.receiver, restContext);
     }
-    invariant5(SelectQueryNode.is(receiver), "expected receiver to be select query");
+    invariant6(SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (ExpressionUtils.isField(expr2.receiver)) {
       const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
@@ -2281,11 +2561,11 @@ var ExpressionTransformer = class {
           alias: void 0
         });
         if (currNode) {
-          invariant5(SelectQueryNode.is(currNode), "expected select query node");
+          invariant6(SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
-              SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create(members[i + 1])))
+              SelectionNode.create(AliasNode3.create(currNode, IdentifierNode.create(members[i + 1])))
             ]
           };
         } else {
@@ -2298,15 +2578,15 @@ var ExpressionTransformer = class {
           };
         }
       } else {
-        invariant5(i === members.length - 1, "plain field access must be the last segment");
-        invariant5(!currNode, "plain field access must be the last segment");
-        currNode = ColumnNode.create(member);
+        invariant6(i === members.length - 1, "plain field access must be the last segment");
+        invariant6(!currNode, "plain field access must be the last segment");
+        currNode = ColumnNode2.create(member);
       }
     }
     return {
       ...receiver,
       selections: [
-        SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create("$t")))
+        SelectionNode.create(AliasNode3.create(currNode, IdentifierNode.create("$t")))
       ]
     };
   }
@@ -2323,24 +2603,33 @@ var ExpressionTransformer = class {
     return this.transformValue(fieldValue, fieldDef.type);
   }
   transformRelationAccess(field, relationModel, context) {
+    const m2m = getManyToManyRelation(this.schema, context.model, field);
+    if (m2m) {
+      return this.transformManyToManyRelationAccess(m2m, context);
+    }
     const fromModel = context.model;
     const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
     if (ownedByModel) {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode3.create(ColumnNode2.create(fk), TableNode3.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode3.create(ColumnNode2.create(pk), TableNode3.create(relationModel)))));
     } else {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode3.create(ColumnNode2.create(pk), TableNode3.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode3.create(ColumnNode2.create(fk), TableNode3.create(relationModel)))));
     }
     return {
       kind: "SelectQueryNode",
       from: FromNode.create([
-        TableNode2.create(relationModel)
+        TableNode3.create(relationModel)
       ]),
       where: WhereNode.create(condition)
     };
   }
+  transformManyToManyRelationAccess(m2m, context) {
+    const eb = expressionBuilder2();
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    return relationQuery.toOperationNode();
+  }
   createColumnRef(column, context) {
-    return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(context.alias ?? context.model));
+    return ReferenceNode3.create(ColumnNode2.create(column), TableNode3.create(context.alias ?? context.model));
   }
   isAuthCall(value) {
     return ExpressionUtils.isCall(value) && value.function === "auth";
@@ -2363,6 +2652,19 @@ var ExpressionTransformer = class {
       return conditions.reduce((acc, condition) => ExpressionUtils.binary(acc, "&&", condition));
     }
   }
+  isRelationField(expr2, model) {
+    const fieldDef = this.getFieldDefFromFieldRef(expr2, model);
+    return !!fieldDef?.relation;
+  }
+  getFieldDefFromFieldRef(expr2, model) {
+    if (ExpressionUtils.isField(expr2)) {
+      return requireField(this.schema, model, expr2.field);
+    } else if (ExpressionUtils.isMember(expr2) && expr2.members.length === 1 && ExpressionUtils.isThis(expr2.receiver)) {
+      return requireField(this.schema, model, expr2.members[0]);
+    } else {
+      return void 0;
+    }
+  }
 };
 _ts_decorate([
   expr("literal"),
@@ -2449,86 +2751,249 @@ var PolicyHandler = class extends OperationNodeTransformer {
   }
   async handle(node, proceed) {
     if (!this.isCrudQueryNode(node)) {
-      throw new RejectedByPolicyError(void 0, "non-CRUD queries are not allowed");
+      throw new RejectedByPolicyError(void 0, RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
     }
     if (!this.isMutationQueryNode(node)) {
       return proceed(this.transformNode(node));
     }
-    let mutationRequiresTransaction = false;
-    const mutationModel = this.getMutationModel(node);
+    const { mutationModel } = this.getMutationModel(node);
     if (InsertQueryNode.is(node)) {
-      const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
-      if (constCondition === false) {
-        throw new RejectedByPolicyError(mutationModel);
-      } else if (constCondition === void 0) {
-        mutationRequiresTransaction = true;
+      const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
+      let needCheckPreCreate = true;
+      if (!isManyToManyJoinTable) {
+        const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
+        if (constCondition === true) {
+          needCheckPreCreate = false;
+        } else if (constCondition === false) {
+          throw new RejectedByPolicyError(mutationModel);
+        }
+      }
+      if (needCheckPreCreate) {
+        await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
       }
     }
-    if (!mutationRequiresTransaction && !node.returning) {
-      return proceed(this.transformNode(node));
-    }
-    if (InsertQueryNode.is(node)) {
-      await this.enforcePreCreatePolicy(node, proceed);
-    }
-    const transformedNode = this.transformNode(node);
-    const result = await proceed(transformedNode);
-    if (!this.onlyReturningId(node)) {
+    const result = await proceed(this.transformNode(node));
+    if (!node.returning || this.onlyReturningId(node)) {
+      return result;
+    } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
-        throw new RejectedByPolicyError(mutationModel, "result is not allowed to be read back");
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       }
       return readBackResult;
-    } else {
+    }
+  }
+  // #region overrides
+  transformSelectQuery(node) {
+    let whereNode = this.transformNode(node.where);
+    const policyFilter = this.createPolicyFilterForFrom(node.from);
+    if (policyFilter) {
+      whereNode = WhereNode2.create(whereNode?.where ? conjunction(this.dialect, [
+        whereNode.where,
+        policyFilter
+      ]) : policyFilter);
+    }
+    const baseResult = super.transformSelectQuery({
+      ...node,
+      where: void 0
+    });
+    return {
+      ...baseResult,
+      where: whereNode
+    };
+  }
+  transformJoin(node) {
+    const table = this.extractTableName(node.table);
+    if (!table) {
+      return super.transformJoin(node);
+    }
+    const filter = this.buildPolicyFilter(table.model, table.alias, "read");
+    const nestedSelect = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        node.table
+      ]),
+      selections: [
+        SelectionNode2.createSelectAll()
+      ],
+      where: WhereNode2.create(filter)
+    };
+    return {
+      ...node,
+      table: AliasNode4.create(ParensNode2.create(nestedSelect), IdentifierNode2.create(table.alias ?? table.model))
+    };
+  }
+  transformInsertQuery(node) {
+    let onConflict = node.onConflict;
+    if (onConflict?.updates) {
+      const { mutationModel, alias } = this.getMutationModel(node);
+      const filter = this.buildPolicyFilter(mutationModel, alias, "update");
+      if (onConflict.updateWhere) {
+        onConflict = {
+          ...onConflict,
+          updateWhere: WhereNode2.create(conjunction(this.dialect, [
+            onConflict.updateWhere.where,
+            filter
+          ]))
+        };
+      } else {
+        onConflict = {
+          ...onConflict,
+          updateWhere: WhereNode2.create(filter)
+        };
+      }
+    }
+    const processedNode = onConflict ? {
+      ...node,
+      onConflict
+    } : node;
+    const result = super.transformInsertQuery(processedNode);
+    if (!node.returning) {
       return result;
     }
+    if (this.onlyReturningId(node)) {
+      return result;
+    } else {
+      const { mutationModel } = this.getMutationModel(node);
+      const idFields = requireIdFields(this.client.$schema, mutationModel);
+      return {
+        ...result,
+        returning: ReturningNode.create(idFields.map((field) => SelectionNode2.create(ColumnNode3.create(field))))
+      };
+    }
   }
+  transformUpdateQuery(node) {
+    const result = super.transformUpdateQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "update");
+    if (node.from) {
+      const joinFilter = this.createPolicyFilterForFrom(node.from);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  transformDeleteQuery(node) {
+    const result = super.transformDeleteQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "delete");
+    if (node.using) {
+      const joinFilter = this.createPolicyFilterForTables(node.using.tables);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  // #endregion
+  // #region helpers
   onlyReturningId(node) {
     if (!node.returning) {
       return true;
     }
-    const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
+    const { mutationModel } = this.getMutationModel(node);
+    const idFields = requireIdFields(this.client.$schema, mutationModel);
     const collector = new ColumnCollector();
     const selectedColumns = collector.collect(node.returning);
     return selectedColumns.every((c) => idFields.includes(c));
   }
-  async enforcePreCreatePolicy(node, proceed) {
-    const model = this.getMutationModel(node);
+  async enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed) {
     const fields = node.columns?.map((c) => c.column.name) ?? [];
-    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, model, fields) : [
+    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, mutationModel, fields, isManyToManyJoinTable) : [
       []
     ];
     for (const values of valueRows) {
-      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), proceed);
+      if (isManyToManyJoinTable) {
+        await this.enforcePreCreatePolicyForManyToManyJoinTable(mutationModel, fields, values.map((v) => v.node), proceed);
+      } else {
+        await this.enforcePreCreatePolicyForOne(mutationModel, fields, values.map((v) => v.node), proceed);
+      }
+    }
+  }
+  async enforcePreCreatePolicyForManyToManyJoinTable(tableName, fields, values, proceed) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    invariant7(m2m);
+    invariant7(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
+    const aIndex = fields.indexOf("A");
+    const aNode = values[aIndex];
+    const bIndex = fields.indexOf("B");
+    const bNode = values[bIndex];
+    invariant7(ValueNode3.is(aNode) && ValueNode3.is(bNode), "A and B values must be ValueNode");
+    const aValue = aNode.value;
+    const bValue = bNode.value;
+    invariant7(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
+    invariant7(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
+    const eb = expressionBuilder3();
+    const filterA = this.buildPolicyFilter(m2m.firstModel, void 0, "update");
+    const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new ExpressionWrapper(filterA).as("$t"));
+    const filterB = this.buildPolicyFilter(m2m.secondModel, void 0, "update");
+    const queryB = eb.selectFrom(m2m.secondModel).where(eb(eb.ref(`${m2m.secondModel}.${m2m.secondIdField}`), "=", bValue)).select(() => new ExpressionWrapper(filterB).as("$t"));
+    const queryNode = {
+      kind: "SelectQueryNode",
+      selections: [
+        SelectionNode2.create(AliasNode4.create(queryA.toOperationNode(), IdentifierNode2.create("$conditionA"))),
+        SelectionNode2.create(AliasNode4.create(queryB.toOperationNode(), IdentifierNode2.create("$conditionB")))
+      ]
+    };
+    const result = await proceed(queryNode);
+    if (!result.rows[0]?.$conditionA) {
+      throw new RejectedByPolicyError(m2m.firstModel, RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+    }
+    if (!result.rows[0]?.$conditionB) {
+      throw new RejectedByPolicyError(m2m.secondModel, RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
     }
   }
   async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
-    const allFields = Object.keys(requireModel(this.client.$schema, model).fields);
+    const allFields = Object.entries(requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
     const allValues = [];
-    for (const fieldName of allFields) {
-      const index = fields.indexOf(fieldName);
+    for (const [name, _def] of allFields) {
+      const index = fields.indexOf(name);
       if (index >= 0) {
         allValues.push(values[index]);
       } else {
         allValues.push(ValueNode3.createImmediate(null));
       }
     }
+    const eb = expressionBuilder3();
     const constTable = {
       kind: "SelectQueryNode",
       from: FromNode2.create([
-        AliasNode3.create(ParensNode2.create(ValuesNode.create([
+        AliasNode4.create(ParensNode2.create(ValuesNode.create([
           ValueListNode2.create(allValues)
         ])), IdentifierNode2.create("$t"))
       ]),
-      selections: allFields.map((field, index) => SelectionNode2.create(AliasNode3.create(ColumnNode2.create(`column${index + 1}`), IdentifierNode2.create(field))))
+      selections: allFields.map(([name, def], index) => {
+        const castedColumnRef = sql4`CAST(${eb.ref(`column${index + 1}`)} as ${sql4.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+        return SelectionNode2.create(castedColumnRef.toOperationNode());
+      })
     };
     const filter = this.buildPolicyFilter(model, void 0, "create");
     const preCreateCheck = {
       kind: "SelectQueryNode",
       from: FromNode2.create([
-        AliasNode3.create(constTable, IdentifierNode2.create(model))
+        AliasNode4.create(constTable, IdentifierNode2.create(model))
       ]),
       selections: [
-        SelectionNode2.create(AliasNode3.create(BinaryOperationNode3.create(FunctionNode3.create("COUNT", [
+        SelectionNode2.create(AliasNode4.create(BinaryOperationNode3.create(FunctionNode3.create("COUNT", [
           ValueNode3.createImmediate(1)
         ]), OperatorNode3.create(">"), ValueNode3.createImmediate(0)), IdentifierNode2.create("$condition")))
       ],
@@ -2539,31 +3004,35 @@ var PolicyHandler = class extends OperationNodeTransformer {
       throw new RejectedByPolicyError(model);
     }
   }
-  unwrapCreateValueRows(node, model, fields) {
+  unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
     if (ValuesNode.is(node)) {
-      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields));
+      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields, isManyToManyJoinTable));
     } else if (PrimitiveValueListNode.is(node)) {
       return [
-        this.unwrapCreateValueRow(node.values, model, fields)
+        this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
       ];
     } else {
       throw new InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
     }
   }
-  unwrapCreateValueRow(data, model, fields) {
-    invariant6(data.length === fields.length, "data length must match fields length");
+  unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
+    invariant7(data.length === fields.length, "data length must match fields length");
     const result = [];
     for (let i = 0; i < data.length; i++) {
       const item = data[i];
-      const fieldDef = requireField(this.client.$schema, model, fields[i]);
       if (typeof item === "object" && item && "kind" in item) {
-        invariant6(item.kind === "ValueNode", "expecting a ValueNode");
+        const fieldDef = requireField(this.client.$schema, model, fields[i]);
+        invariant7(item.kind === "ValueNode", "expecting a ValueNode");
         result.push({
           node: ValueNode3.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
           raw: item.value
         });
       } else {
-        const value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        let value = item;
+        if (!isImplicitManyToManyJoinTable) {
+          const fieldDef = requireField(this.client.$schema, model, fields[i]);
+          value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        }
         if (Array.isArray(value)) {
           result.push({
             node: RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
@@ -2607,16 +3076,13 @@ var PolicyHandler = class extends OperationNodeTransformer {
     if (!this.isMutationQueryNode(node) || !node.returning) {
       return result;
     }
-    const table = this.getMutationModel(node);
-    if (!table) {
-      throw new InternalError(`Unable to get table name for query node: ${node}`);
-    }
-    const idConditions = this.buildIdConditions(table, result.rows);
-    const policyFilter = this.buildPolicyFilter(table, void 0, "read");
+    const { mutationModel } = this.getMutationModel(node);
+    const idConditions = this.buildIdConditions(mutationModel, result.rows);
+    const policyFilter = this.buildPolicyFilter(mutationModel, void 0, "read");
     const select = {
       kind: "SelectQueryNode",
       from: FromNode2.create([
-        TableNode3.create(table)
+        TableNode4.create(mutationModel)
       ]),
       where: WhereNode2.create(conjunction(this.dialect, [
         idConditions,
@@ -2628,15 +3094,31 @@ var PolicyHandler = class extends OperationNodeTransformer {
     return selectResult;
   }
   buildIdConditions(table, rows) {
-    const idFields = getIdFields(this.client.$schema, table);
-    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ColumnNode2.create(field), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
+    const idFields = requireIdFields(this.client.$schema, table);
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ColumnNode3.create(field), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
   }
   getMutationModel(node) {
-    const r = match8(node).when(InsertQueryNode.is, (node2) => getTableName(node2.into)).when(UpdateQueryNode.is, (node2) => getTableName(node2.table)).when(DeleteQueryNode.is, (node2) => {
+    const r = match8(node).when(InsertQueryNode.is, (node2) => ({
+      mutationModel: getTableName(node2.into),
+      alias: void 0
+    })).when(UpdateQueryNode.is, (node2) => {
+      if (!node2.table) {
+        throw new QueryError("Update query must have a table");
+      }
+      const r2 = this.extractTableName(node2.table);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
+    }).when(DeleteQueryNode.is, (node2) => {
       if (node2.from.froms.length !== 1) {
-        throw new InternalError("Only one from table is supported for delete");
+        throw new QueryError("Only one from table is supported for delete");
       }
-      return getTableName(node2.from.froms[0]);
+      const r2 = this.extractTableName(node2.from.froms[0]);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
     }).exhaustive();
     if (!r) {
       throw new InternalError(`Unable to get table name for query node: ${node}`);
@@ -2650,12 +3132,16 @@ var PolicyHandler = class extends OperationNodeTransformer {
     return InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
   }
   buildPolicyFilter(model, alias, operation) {
+    const m2mFilter = this.getModelPolicyFilterForManyToManyJoinTable(model, alias, operation);
+    if (m2mFilter) {
+      return m2mFilter;
+    }
     const policies = this.getModelPolicies(model, operation);
     if (policies.length === 0) {
       return falseNode(this.dialect);
     }
-    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
-    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     let combinedPolicy;
     if (allows.length === 0) {
       combinedPolicy = falseNode(this.dialect);
@@ -2671,100 +3157,59 @@ var PolicyHandler = class extends OperationNodeTransformer {
     }
     return combinedPolicy;
   }
-  transformSelectQuery(node) {
-    let whereNode = node.where;
-    node.from?.froms.forEach((from) => {
-      const extractResult = this.extractTableName(from);
-      if (extractResult) {
-        const { model, alias } = extractResult;
-        const filter = this.buildPolicyFilter(model, alias, "read");
-        whereNode = WhereNode2.create(whereNode?.where ? conjunction(this.dialect, [
-          whereNode.where,
-          filter
-        ]) : filter);
-      }
-    });
-    const baseResult = super.transformSelectQuery({
-      ...node,
-      where: void 0
-    });
-    return {
-      ...baseResult,
-      where: whereNode
-    };
-  }
-  transformInsertQuery(node) {
-    const result = super.transformInsertQuery(node);
-    if (!node.returning) {
-      return result;
-    }
-    if (this.onlyReturningId(node)) {
-      return result;
-    } else {
-      const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
-      return {
-        ...result,
-        returning: ReturningNode.create(idFields.map((field) => SelectionNode2.create(ColumnNode2.create(field))))
-      };
-    }
-  }
-  transformUpdateQuery(node) {
-    const result = super.transformUpdateQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "update");
-    return {
-      ...result,
-      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
-  }
-  transformDeleteQuery(node) {
-    const result = super.transformDeleteQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "delete");
-    return {
-      ...result,
-      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
-  }
-  extractTableName(from) {
-    if (TableNode3.is(from)) {
+  extractTableName(node) {
+    if (TableNode4.is(node)) {
       return {
-        model: from.table.identifier.name
+        model: node.table.identifier.name
       };
     }
-    if (AliasNode3.is(from)) {
-      const inner = this.extractTableName(from.node);
+    if (AliasNode4.is(node)) {
+      const inner = this.extractTableName(node.node);
       if (!inner) {
         return void 0;
       }
       return {
         model: inner.model,
-        alias: IdentifierNode2.is(from.alias) ? from.alias.name : void 0
+        alias: IdentifierNode2.is(node.alias) ? node.alias.name : void 0
       };
     } else {
       return void 0;
     }
   }
-  transformPolicyCondition(model, alias, operation, policy) {
-    return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
+  createPolicyFilterForFrom(node) {
+    if (!node) {
+      return void 0;
+    }
+    return this.createPolicyFilterForTables(node.froms);
+  }
+  createPolicyFilterForTables(tables) {
+    return tables.reduce((acc, table) => {
+      const extractResult = this.extractTableName(table);
+      if (extractResult) {
+        const { model, alias } = extractResult;
+        const filter = this.buildPolicyFilter(model, alias, "read");
+        return acc ? conjunction(this.dialect, [
+          acc,
+          filter
+        ]) : filter;
+      }
+      return acc;
+    }, void 0);
+  }
+  compilePolicyCondition(model, alias, operation, policy) {
+    return new ExpressionTransformer(this.client).transform(policy.condition, {
       model,
       alias,
       operation,
       auth: this.client.$auth
     });
   }
-  getModelPolicies(modelName, operation) {
-    const modelDef = requireModel(this.client.$schema, modelName);
+  getModelPolicies(model, operation) {
+    const modelDef = requireModel(this.client.$schema, model);
     const result = [];
     const extractOperations = /* @__PURE__ */ __name((expr2) => {
-      invariant6(ExpressionUtils.isLiteral(expr2), "expecting a literal");
-      invariant6(typeof expr2.value === "string", "expecting a string literal");
+      invariant7(ExpressionUtils.isLiteral(expr2), "expecting a literal");
+      invariant7(typeof expr2.value === "string", "expecting a string literal");
       return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
     }, "extractOperations");
     if (modelDef.attributes) {
@@ -2776,8 +3221,84 @@ var PolicyHandler = class extends OperationNodeTransformer {
     }
     return result;
   }
+  resolveManyToManyJoinTable(tableName) {
+    for (const model of Object.values(this.client.$schema.models)) {
+      for (const field of Object.values(model.fields)) {
+        const m2m = getManyToManyRelation(this.client.$schema, model.name, field.name);
+        if (m2m?.joinTable === tableName) {
+          const sortedRecord = [
+            {
+              model: model.name,
+              field: field.name
+            },
+            {
+              model: m2m.otherModel,
+              field: m2m.otherField
+            }
+          ].sort(this.manyToManySorter);
+          const firstIdFields = requireIdFields(this.client.$schema, sortedRecord[0].model);
+          const secondIdFields = requireIdFields(this.client.$schema, sortedRecord[1].model);
+          invariant7(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
+          return {
+            firstModel: sortedRecord[0].model,
+            firstField: sortedRecord[0].field,
+            firstIdField: firstIdFields[0],
+            secondModel: sortedRecord[1].model,
+            secondField: sortedRecord[1].field,
+            secondIdField: secondIdFields[0]
+          };
+        }
+      }
+    }
+    return void 0;
+  }
+  manyToManySorter(a, b) {
+    return a.model !== b.model ? a.model.localeCompare(b.model) : a.field.localeCompare(b.field);
+  }
+  isManyToManyJoinTable(tableName) {
+    return !!this.resolveManyToManyJoinTable(tableName);
+  }
+  getModelPolicyFilterForManyToManyJoinTable(tableName, alias, operation) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    if (!m2m) {
+      return void 0;
+    }
+    const checkForOperation = operation === "read" ? "read" : "update";
+    const eb = expressionBuilder3();
+    const joinTable = alias ?? tableName;
+    const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
+    const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
+    return eb.and([
+      aQuery,
+      bQuery
+    ]).toOperationNode();
+  }
 };
 
+// src/plugins/policy/functions.ts
+var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, operation }) => {
+  invariant8(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
+  const arg1Node = args[0].toOperationNode();
+  const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
+  if (arg2Node) {
+    invariant8(ValueNode4.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
+    invariant8(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+  }
+  const fieldName = extractFieldName(arg1Node);
+  invariant8(fieldName, 'Failed to extract field name from the first argument of "check" function');
+  const fieldDef = requireField(client.$schema, model, fieldName);
+  invariant8(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
+  invariant8(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
+  const relationModel = fieldDef.type;
+  const op = arg2Node ? arg2Node.value : operation;
+  const policyHandler = new PolicyHandler(client);
+  const joinPairs = buildJoinPairs(client.$schema, model, modelAlias, fieldName, relationModel);
+  const joinCondition = joinPairs.length === 1 ? eb(eb.ref(joinPairs[0][0]), "=", eb.ref(joinPairs[0][1])) : eb.and(joinPairs.map(([left, right]) => eb(eb.ref(left), "=", eb.ref(right))));
+  const policyCondition = policyHandler.buildPolicyFilter(relationModel, void 0, op);
+  const result = eb.selectFrom(relationModel).where(joinCondition).select(new ExpressionWrapper2(policyCondition).as("$condition"));
+  return result;
+}, "check");
+
 // src/plugins/policy/plugin.ts
 var PolicyPlugin = class {
   static {
@@ -2792,6 +3313,11 @@ var PolicyPlugin = class {
   get description() {
     return "Enforces access policies defined in the schema.";
   }
+  get functions() {
+    return {
+      check
+    };
+  }
   onKyselyQuery({
     query,
     client,
@@ -2827,16 +3353,6 @@ function clone(value) {
 }
 __name(clone, "clone");
 
-// src/client/contract.ts
-var TransactionIsolationLevel = /* @__PURE__ */ function(TransactionIsolationLevel2) {
-  TransactionIsolationLevel2["ReadUncommitted"] = "read uncommitted";
-  TransactionIsolationLevel2["ReadCommitted"] = "read committed";
-  TransactionIsolationLevel2["RepeatableRead"] = "repeatable read";
-  TransactionIsolationLevel2["Serializable"] = "serializable";
-  TransactionIsolationLevel2["Snapshot"] = "snapshot";
-  return TransactionIsolationLevel2;
-}({});
-
 // src/client/crud/operations/base.ts
 var BaseOperationHandler = class {
   static {
@@ -2881,7 +3397,7 @@ var BaseOperationHandler = class {
     return getField(this.schema, model, field);
   }
   async exists(kysely, model, filter) {
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     const _filter = flattenCompoundUniqueFilters(this.schema, model, filter);
     const query = kysely.selectFrom(model).where((eb) => eb.and(_filter)).select(idFields.map((f) => kysely.dynamic.ref(f))).limit(1).modifyEnd(this.makeContextComment({
       model,
@@ -2890,7 +3406,7 @@ var BaseOperationHandler = class {
     return this.executeQueryTakeFirst(kysely, query, "exists");
   }
   async read(kysely, model, args) {
-    let query = this.dialect.buildSelectModel(expressionBuilder3(), model, model);
+    let query = this.dialect.buildSelectModel(expressionBuilder4(), model, model);
     if (args) {
       query = this.dialect.buildFilterSortTake(model, args, query, model);
     }
@@ -2969,7 +3485,7 @@ var BaseOperationHandler = class {
       if (!m2m) {
         const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, fromRelation?.model ?? "", fromRelation?.field ?? "");
         if (!ownedByModel) {
-          const parentFkFields = this.buildFkAssignments(fromRelation.model, fromRelation.field, fromRelation.ids);
+          const parentFkFields = await this.buildFkAssignments(kysely, fromRelation.model, fromRelation.field, fromRelation.ids);
           Object.assign(createFields, parentFkFields);
         } else {
           updateParent = /* @__PURE__ */ __name((entity) => {
@@ -3009,17 +3525,16 @@ var BaseOperationHandler = class {
       createFields = baseCreateResult.remainingFields;
     }
     const updatedData = this.fillGeneratedAndDefaultValues(modelDef, createFields);
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     const query = kysely.insertInto(model).$if(Object.keys(updatedData).length === 0, (qb) => qb.defaultValues()).$if(Object.keys(updatedData).length > 0, (qb) => qb.values(updatedData)).returning(idFields).modifyEnd(this.makeContextComment({
       model,
       operation: "create"
     }));
     const createdEntity = await this.executeQueryTakeFirst(kysely, query, "create");
     if (Object.keys(postCreateRelations).length > 0) {
-      const relationPromises = Object.entries(postCreateRelations).map(([field, subPayload]) => {
-        return this.processNoneOwnedRelationForCreate(kysely, model, field, subPayload, createdEntity);
-      });
-      await Promise.all(relationPromises);
+      for (const [field, subPayload] of Object.entries(postCreateRelations)) {
+        await this.processNoneOwnedRelationForCreate(kysely, model, field, subPayload, createdEntity);
+      }
     }
     if (fromRelation && m2m) {
       await this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, createdEntity, m2m.joinTable);
@@ -3041,7 +3556,7 @@ var BaseOperationHandler = class {
       }
     });
     const discriminatorField = getDiscriminatorField(this.schema, model);
-    invariant7(discriminatorField, `Base model "${model}" must have a discriminator field`);
+    invariant9(discriminatorField, `Base model "${model}" must have a discriminator field`);
     thisCreateFields[discriminatorField] = forModel;
     const baseEntity = await this.create(kysely, model, thisCreateFields, void 0, true);
     const idValues = extractIdFields(baseEntity, this.schema, model);
@@ -3051,14 +3566,24 @@ var BaseOperationHandler = class {
       remainingFields
     };
   }
-  buildFkAssignments(model, relationField, entity) {
+  async buildFkAssignments(kysely, model, relationField, entity) {
     const parentFkFields = {};
-    invariant7(relationField, "parentField must be defined if parentModel is defined");
-    invariant7(entity, "parentEntity must be defined if parentModel is defined");
+    invariant9(relationField, "parentField must be defined if parentModel is defined");
+    invariant9(entity, "parentEntity must be defined if parentModel is defined");
     const { keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
     for (const pair of keyPairs) {
       if (!(pair.pk in entity)) {
-        throw new QueryError(`Field "${pair.pk}" not found in parent created data`);
+        const extraRead = await this.readUnique(kysely, model, {
+          where: entity,
+          select: {
+            [pair.pk]: true
+          }
+        });
+        if (!extraRead) {
+          throw new QueryError(`Field "${pair.pk}" not found in parent created data`);
+        } else {
+          Object.assign(entity, extraRead);
+        }
       }
       Object.assign(parentFkFields, {
         [pair.fk]: entity[pair.pk]
@@ -3079,15 +3604,15 @@ var BaseOperationHandler = class {
         entity: rightEntity
       }
     ].sort((a, b) => (
-      // the implement m2m join table's "A", "B" fk fields' order is determined
+      // the implicit m2m join table's "A", "B" fk fields' order is determined
       // by model name's sort order, and when identical (for self-relations),
       // field name's sort order
       a.model !== b.model ? a.model.localeCompare(b.model) : a.field.localeCompare(b.field)
     ));
-    const firstIds = getIdFields(this.schema, sortedRecords[0].model);
-    const secondIds = getIdFields(this.schema, sortedRecords[1].model);
-    invariant7(firstIds.length === 1, "many-to-many relation must have exactly one id field");
-    invariant7(secondIds.length === 1, "many-to-many relation must have exactly one id field");
+    const firstIds = requireIdFields(this.schema, sortedRecords[0].model);
+    const secondIds = requireIdFields(this.schema, sortedRecords[1].model);
+    invariant9(firstIds.length === 1, "many-to-many relation must have exactly one id field");
+    invariant9(secondIds.length === 1, "many-to-many relation must have exactly one id field");
     if (action === "connect") {
       const result = await kysely.insertInto(joinTable).values({
         A: sortedRecords[0].entity[firstIds[0]],
@@ -3098,17 +3623,17 @@ var BaseOperationHandler = class {
       ]).doNothing()).execute();
       return result[0];
     } else {
-      const eb = expressionBuilder3();
+      const eb = expressionBuilder4();
       const result = await kysely.deleteFrom(joinTable).where(eb(`${joinTable}.A`, "=", sortedRecords[0].entity[firstIds[0]])).where(eb(`${joinTable}.B`, "=", sortedRecords[1].entity[secondIds[0]])).execute();
       return result[0];
     }
   }
   resetManyToManyRelation(kysely, model, field, parentIds) {
-    invariant7(Object.keys(parentIds).length === 1, "parentIds must have exactly one field");
+    invariant9(Object.keys(parentIds).length === 1, "parentIds must have exactly one field");
     const parentId = Object.values(parentIds)[0];
     const m2m = getManyToManyRelation(this.schema, model, field);
-    invariant7(m2m, "not a many-to-many relation");
-    const eb = expressionBuilder3();
+    invariant9(m2m, "not a many-to-many relation");
+    const eb = expressionBuilder4();
     return kysely.deleteFrom(m2m.joinTable).where(eb(`${m2m.joinTable}.${m2m.parentFkName}`, "=", parentId)).execute();
   }
   async processOwnedRelationForCreate(kysely, relationField, payload) {
@@ -3129,7 +3654,7 @@ var BaseOperationHandler = class {
         }
         case "connect": {
           const referencedPkFields = relationField.relation.references;
-          invariant7(referencedPkFields, "relation must have fields info");
+          invariant9(referencedPkFields, "relation must have fields info");
           const extractedFks = extractFields(subPayload, referencedPkFields);
           if (Object.keys(extractedFks).length === referencedPkFields.length) {
             result = extractedFks;
@@ -3161,10 +3686,9 @@ var BaseOperationHandler = class {
     }
     return result;
   }
-  processNoneOwnedRelationForCreate(kysely, contextModel, relationFieldName, payload, parentEntity) {
+  async processNoneOwnedRelationForCreate(kysely, contextModel, relationFieldName, payload, parentEntity) {
     const relationFieldDef = this.requireField(contextModel, relationFieldName);
     const relationModel = relationFieldDef.type;
-    const tasks = [];
     const fromRelationContext = {
       model: contextModel,
       field: relationFieldName,
@@ -3177,27 +3701,35 @@ var BaseOperationHandler = class {
       }
       switch (action) {
         case "create": {
-          tasks.push(...enumerate(subPayload).map((item) => this.create(kysely, relationModel, item, fromRelationContext)));
+          for (const item of enumerate(subPayload)) {
+            await this.create(kysely, relationModel, item, fromRelationContext);
+          }
           break;
         }
         case "createMany": {
-          invariant7(relationFieldDef.array, "relation must be an array for createMany");
-          tasks.push(this.createMany(kysely, relationModel, subPayload, false, fromRelationContext));
+          invariant9(relationFieldDef.array, "relation must be an array for createMany");
+          await this.createMany(kysely, relationModel, subPayload, false, fromRelationContext);
           break;
         }
         case "connect": {
-          tasks.push(this.connectRelation(kysely, relationModel, subPayload, fromRelationContext));
+          await this.connectRelation(kysely, relationModel, subPayload, fromRelationContext);
           break;
         }
         case "connectOrCreate": {
-          tasks.push(...enumerate(subPayload).map((item) => this.exists(kysely, relationModel, item.where).then((found) => !found ? this.create(kysely, relationModel, item.create, fromRelationContext) : this.connectRelation(kysely, relationModel, found, fromRelationContext))));
+          for (const item of enumerate(subPayload)) {
+            const found = await this.exists(kysely, relationModel, item.where);
+            if (!found) {
+              await this.create(kysely, relationModel, item.create, fromRelationContext);
+            } else {
+              await this.connectRelation(kysely, relationModel, found, fromRelationContext);
+            }
+          }
           break;
         }
         default:
           throw new QueryError(`Invalid relation action: ${action}`);
       }
     }
-    return Promise.all(tasks);
   }
   async createMany(kysely, model, input, returnData, fromRelation) {
     if (!input.data || Array.isArray(input.data) && input.data.length === 0) {
@@ -3218,7 +3750,7 @@ var BaseOperationHandler = class {
       const newItem = {};
       for (const [name, value] of Object.entries(item)) {
         const fieldDef = this.requireField(model, name);
-        invariant7(!fieldDef.relation, "createMany does not support relations");
+        invariant9(!fieldDef.relation, "createMany does not support relations");
         newItem[name] = this.dialect.transformPrimitive(value, fieldDef.type, !!fieldDef.array);
       }
       if (fromRelation) {
@@ -3268,7 +3800,7 @@ var BaseOperationHandler = class {
         count: Number(result.numAffectedRows)
       };
     } else {
-      const idFields = getIdFields(this.schema, model);
+      const idFields = requireIdFields(this.schema, model);
       const result = await query.returning(idFields).execute();
       return result;
     }
@@ -3277,7 +3809,7 @@ var BaseOperationHandler = class {
     const thisCreateRows = [];
     const remainingFieldRows = [];
     const discriminatorField = getDiscriminatorField(this.schema, model);
-    invariant7(discriminatorField, `Base model "${model}" must have a discriminator field`);
+    invariant9(discriminatorField, `Base model "${model}" must have a discriminator field`);
     for (const createFields of createRows) {
       const thisCreateFields = {};
       const remainingFields = {};
@@ -3373,7 +3905,7 @@ var BaseOperationHandler = class {
         }
       } else {
         const fromRelationFieldDef = this.requireField(fromRelation.model, fromRelation.field);
-        invariant7(fromRelationFieldDef.relation?.opposite);
+        invariant9(fromRelationFieldDef.relation?.opposite);
         parentWhere[fromRelationFieldDef.relation.opposite] = {
           some: fromRelation.ids
         };
@@ -3431,10 +3963,7 @@ var BaseOperationHandler = class {
           throw new QueryError(`Relation update not allowed for field "${field}"`);
         }
         if (!thisEntity) {
-          thisEntity = await this.readUnique(kysely, model, {
-            where: combinedWhere,
-            select: this.makeIdSelect(model)
-          });
+          thisEntity = await this.getEntityIds(kysely, model, combinedWhere);
           if (!thisEntity) {
             if (throwIfNotFound) {
               throw new NotFoundError(model);
@@ -3452,7 +3981,7 @@ var BaseOperationHandler = class {
     if (Object.keys(updateFields).length === 0) {
       return combinedWhere;
     } else {
-      const idFields = getIdFields(this.schema, model);
+      const idFields = requireIdFields(this.schema, model);
       const query = kysely.updateTable(model).where((eb) => this.dialect.buildFilter(eb, model, model, combinedWhere)).set(updateFields).returning(idFields).modifyEnd(this.makeContextComment({
         model,
         operation: "update"
@@ -3497,7 +4026,7 @@ var BaseOperationHandler = class {
     if (!filter || typeof filter !== "object") {
       return false;
     }
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     return idFields.length === Object.keys(filter).length && idFields.every((field) => field in filter);
   }
   async processBaseModelUpdate(kysely, model, where, updateFields, throwIfNotFound) {
@@ -3518,20 +4047,20 @@ var BaseOperationHandler = class {
     };
   }
   transformIncrementalUpdate(model, field, fieldDef, payload) {
-    invariant7(Object.keys(payload).length === 1, 'Only one of "set", "increment", "decrement", "multiply", or "divide" can be provided');
+    invariant9(Object.keys(payload).length === 1, 'Only one of "set", "increment", "decrement", "multiply", or "divide" can be provided');
     const key = Object.keys(payload)[0];
     const value = this.dialect.transformPrimitive(payload[key], fieldDef.type, false);
-    const eb = expressionBuilder3();
+    const eb = expressionBuilder4();
     const fieldRef = this.dialect.fieldRef(model, field, eb);
     return match9(key).with("set", () => value).with("increment", () => eb(fieldRef, "+", value)).with("decrement", () => eb(fieldRef, "-", value)).with("multiply", () => eb(fieldRef, "*", value)).with("divide", () => eb(fieldRef, "/", value)).otherwise(() => {
       throw new InternalError(`Invalid incremental update operation: ${key}`);
     });
   }
   transformScalarListUpdate(model, field, fieldDef, payload) {
-    invariant7(Object.keys(payload).length === 1, 'Only one of "set", "push" can be provided');
+    invariant9(Object.keys(payload).length === 1, 'Only one of "set", "push" can be provided');
     const key = Object.keys(payload)[0];
     const value = this.dialect.transformPrimitive(payload[key], fieldDef.type, true);
-    const eb = expressionBuilder3();
+    const eb = expressionBuilder4();
     const fieldRef = this.dialect.fieldRef(model, field, eb);
     return match9(key).with("set", () => value).with("push", () => {
       return eb(fieldRef, "||", eb.val(ensureArray(value)));
@@ -3543,7 +4072,7 @@ var BaseOperationHandler = class {
     return NUMERIC_FIELD_TYPES.includes(fieldDef.type) && !fieldDef.array;
   }
   makeContextComment(_context) {
-    return sql4``;
+    return sql5``;
   }
   async updateMany(kysely, model, where, data, limit, returnData, filterModel) {
     if (typeof data !== "object") {
@@ -3602,7 +4131,7 @@ var BaseOperationHandler = class {
         count: Number(result.numAffectedRows)
       };
     } else {
-      const idFields = getIdFields(this.schema, model);
+      const idFields = requireIdFields(this.schema, model);
       const result = await query.returning(idFields).execute();
       return result;
     }
@@ -3625,11 +4154,10 @@ var BaseOperationHandler = class {
     };
   }
   buildIdFieldRefs(kysely, model) {
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     return idFields.map((f) => kysely.dynamic.ref(`${model}.${f}`));
   }
   async processRelationUpdates(kysely, model, field, fieldDef, parentIds, args, throwIfNotFound) {
-    const tasks = [];
     const fieldModel = fieldDef.type;
     const fromRelationContext = {
       model,
@@ -3640,68 +4168,73 @@ var BaseOperationHandler = class {
     for (const [key, value] of Object.entries(args)) {
       switch (key) {
         case "create": {
-          invariant7(!Array.isArray(value) || fieldDef.array, "relation must be an array if create is an array");
-          tasks.push(...enumerate(value).map((item) => this.create(kysely, fieldModel, item, fromRelationContext)));
+          invariant9(!Array.isArray(value) || fieldDef.array, "relation must be an array if create is an array");
+          for (const item of enumerate(value)) {
+            await this.create(kysely, fieldModel, item, fromRelationContext);
+          }
           break;
         }
         case "createMany": {
-          invariant7(fieldDef.array, "relation must be an array for createMany");
-          tasks.push(this.createMany(kysely, fieldModel, value, false, fromRelationContext));
+          invariant9(fieldDef.array, "relation must be an array for createMany");
+          await this.createMany(kysely, fieldModel, value, false, fromRelationContext);
           break;
         }
         case "connect": {
-          tasks.push(this.connectRelation(kysely, fieldModel, value, fromRelationContext));
+          await this.connectRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "connectOrCreate": {
-          tasks.push(this.connectOrCreateRelation(kysely, fieldModel, value, fromRelationContext));
+          await this.connectOrCreateRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "disconnect": {
-          tasks.push(this.disconnectRelation(kysely, fieldModel, value, fromRelationContext));
+          await this.disconnectRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "set": {
-          invariant7(fieldDef.array, "relation must be an array");
-          tasks.push(this.setRelation(kysely, fieldModel, value, fromRelationContext));
+          invariant9(fieldDef.array, "relation must be an array");
+          await this.setRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "update": {
-          tasks.push(...enumerate(value).map((item) => {
+          for (const _item of enumerate(value)) {
+            const item = _item;
             let where;
             let data;
-            if ("where" in item) {
+            if ("data" in item && typeof item.data === "object") {
               where = item.where;
               data = item.data;
             } else {
               where = void 0;
               data = item;
             }
-            return this.update(kysely, fieldModel, where, data, fromRelationContext, true, throwIfNotFound);
-          }));
+            await this.update(kysely, fieldModel, where, data, fromRelationContext, true, throwIfNotFound);
+          }
           break;
         }
         case "upsert": {
-          tasks.push(...enumerate(value).map(async (item) => {
+          for (const _item of enumerate(value)) {
+            const item = _item;
             const updated = await this.update(kysely, fieldModel, item.where, item.update, fromRelationContext, true, false);
-            if (updated) {
-              return updated;
-            } else {
-              return this.create(kysely, fieldModel, item.create, fromRelationContext);
+            if (!updated) {
+              await this.create(kysely, fieldModel, item.create, fromRelationContext);
             }
-          }));
+          }
           break;
         }
         case "updateMany": {
-          tasks.push(...enumerate(value).map((item) => this.update(kysely, fieldModel, item.where, item.data, fromRelationContext, false, false)));
+          for (const _item of enumerate(value)) {
+            const item = _item;
+            await this.update(kysely, fieldModel, item.where, item.data, fromRelationContext, false, false);
+          }
           break;
         }
         case "delete": {
-          tasks.push(this.deleteRelation(kysely, fieldModel, value, fromRelationContext, true));
+          await this.deleteRelation(kysely, fieldModel, value, fromRelationContext, true);
           break;
         }
         case "deleteMany": {
-          tasks.push(this.deleteRelation(kysely, fieldModel, value, fromRelationContext, false));
+          await this.deleteRelation(kysely, fieldModel, value, fromRelationContext, false);
           break;
         }
         default: {
@@ -3709,7 +4242,6 @@ var BaseOperationHandler = class {
         }
       }
     }
-    await Promise.all(tasks);
     return fromRelationContext.parentUpdates;
   }
   // #region relation manipulation
@@ -3720,18 +4252,22 @@ var BaseOperationHandler = class {
     }
     const m2m = getManyToManyRelation(this.schema, fromRelation.model, fromRelation.field);
     if (m2m) {
-      const actions = _data.map(async (d) => {
+      const results = [];
+      for (const d of _data) {
         const ids = await this.getEntityIds(kysely, model, d);
-        return this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
-      });
-      const results = await Promise.all(actions);
+        if (!ids) {
+          throw new NotFoundError(model);
+        }
+        const r = await this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
+        results.push(r);
+      }
       if (_data.length > results.filter((r) => !!r).length) {
         throw new NotFoundError(model);
       }
     } else {
       const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, fromRelation.model, fromRelation.field);
       if (ownedByModel) {
-        invariant7(_data.length === 1, "only one entity can be connected");
+        invariant9(_data.length === 1, "only one entity can be connected");
         const target = await this.readUnique(kysely, model, {
           where: _data[0]
         });
@@ -3744,7 +4280,7 @@ var BaseOperationHandler = class {
       } else {
         const relationFieldDef = this.requireField(fromRelation.model, fromRelation.field);
         if (!relationFieldDef.array) {
-          const query2 = kysely.updateTable(model).where((eb) => eb.and(keyPairs.map(({ fk, pk }) => eb(sql4.ref(fk), "=", fromRelation.ids[pk])))).set(keyPairs.reduce((acc, { fk }) => ({
+          const query2 = kysely.updateTable(model).where((eb) => eb.and(keyPairs.map(({ fk, pk }) => eb(sql5.ref(fk), "=", fromRelation.ids[pk])))).set(keyPairs.reduce((acc, { fk }) => ({
             ...acc,
             [fk]: null
           }), {})).modifyEnd(this.makeContextComment({
@@ -3772,16 +4308,16 @@ var BaseOperationHandler = class {
     if (_data.length === 0) {
       return;
     }
-    return Promise.all(_data.map(async ({ where, create }) => {
+    for (const { where, create } of _data) {
       const existing = await this.exists(kysely, model, where);
       if (existing) {
-        return this.connectRelation(kysely, model, [
+        await this.connectRelation(kysely, model, [
           where
         ], fromRelation);
       } else {
-        return this.create(kysely, model, create, fromRelation);
+        await this.create(kysely, model, create, fromRelation);
       }
-    }));
+    }
   }
   async disconnectRelation(kysely, model, data, fromRelation) {
     let disconnectConditions = [];
@@ -3804,19 +4340,18 @@ var BaseOperationHandler = class {
     }
     const m2m = getManyToManyRelation(this.schema, fromRelation.model, fromRelation.field);
     if (m2m) {
-      const actions = disconnectConditions.map(async (d) => {
+      for (const d of disconnectConditions) {
         const ids = await this.getEntityIds(kysely, model, d);
         if (!ids) {
           return;
         }
-        return this.handleManyToManyRelation(kysely, "disconnect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
-      });
-      await Promise.all(actions);
+        await this.handleManyToManyRelation(kysely, "disconnect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
+      }
     } else {
       const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, fromRelation.model, fromRelation.field);
-      const eb = expressionBuilder3();
+      const eb = expressionBuilder4();
       if (ownedByModel) {
-        invariant7(disconnectConditions.length === 1, "only one entity can be disconnected");
+        invariant9(disconnectConditions.length === 1, "only one entity can be disconnected");
         const condition = disconnectConditions[0];
         if (condition === true) {
           for (const { fk } of keyPairs) {
@@ -3875,11 +4410,14 @@ var BaseOperationHandler = class {
     const m2m = getManyToManyRelation(this.schema, fromRelation.model, fromRelation.field);
     if (m2m) {
       await this.resetManyToManyRelation(kysely, fromRelation.model, fromRelation.field, fromRelation.ids);
-      const actions = _data.map(async (d) => {
+      const results = [];
+      for (const d of _data) {
         const ids = await this.getEntityIds(kysely, model, d);
-        return this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
-      });
-      const results = await Promise.all(actions);
+        if (!ids) {
+          throw new NotFoundError(model);
+        }
+        results.push(await this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable));
+      }
       if (_data.length > results.filter((r) => !!r).length) {
         throw new NotFoundError(model);
       }
@@ -3945,7 +4483,7 @@ var BaseOperationHandler = class {
     if (m2m) {
       deleteFromModel = model;
       const fieldDef = this.requireField(fromRelation.model, fromRelation.field);
-      invariant7(fieldDef.relation?.opposite);
+      invariant9(fieldDef.relation?.opposite);
       deleteResult = await this.delete(kysely, model, {
         AND: [
           {
@@ -3969,7 +4507,7 @@ var BaseOperationHandler = class {
           throw new NotFoundError(fromRelation.model);
         }
         const fieldDef = this.requireField(fromRelation.model, fromRelation.field);
-        invariant7(fieldDef.relation?.opposite);
+        invariant9(fieldDef.relation?.opposite);
         deleteResult = await this.delete(kysely, model, {
           AND: [
             // filter for parent
@@ -4099,7 +4637,7 @@ var BaseOperationHandler = class {
   // reused the filter if it's a complete id filter (without extra fields)
   // otherwise, read the entity by the filter
   getEntityIds(kysely, model, uniqueFilter) {
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     if (
       // all id fields are provided
       idFields.every((f) => f in uniqueFilter && uniqueFilter[f] !== void 0) && // no non-id filter exists
@@ -4201,7 +4739,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
                 if (field === "_all") {
                   query = query.select((eb) => eb.cast(eb.fn.countAll(), "integer").as(`_count._all`));
                 } else {
-                  query = query.select((eb) => eb.cast(eb.fn.count(sql5.ref(`$sub.${field}`)), "integer").as(`${key}.${field}`));
+                  query = query.select((eb) => eb.cast(eb.fn.count(sql6.ref(`$sub.${field}`)), "integer").as(`${key}.${field}`));
                 }
               }
             });
@@ -4216,7 +4754,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
             if (val === true) {
               query = query.select((eb) => {
                 const fn = match10(key).with("_sum", () => eb.fn.sum).with("_avg", () => eb.fn.avg).with("_max", () => eb.fn.max).with("_min", () => eb.fn.min).exhaustive();
-                return fn(sql5.ref(`$sub.${field}`)).as(`${key}.${field}`);
+                return fn(sql6.ref(`$sub.${field}`)).as(`${key}.${field}`);
               });
             }
           });
@@ -4263,7 +4801,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
 };
 
 // src/client/crud/operations/count.ts
-import { sql as sql6 } from "kysely";
+import { sql as sql7 } from "kysely";
 var CountOperationHandler = class extends BaseOperationHandler {
   static {
     __name(this, "CountOperationHandler");
@@ -4287,7 +4825,7 @@ var CountOperationHandler = class extends BaseOperationHandler {
       return subQuery.as(subQueryName);
     });
     if (parsedArgs?.select && typeof parsedArgs.select === "object") {
-      query = query.select((eb) => Object.keys(parsedArgs.select).map((key) => key === "_all" ? eb.cast(eb.fn.countAll(), "integer").as("_all") : eb.cast(eb.fn.count(sql6.ref(`${subQueryName}.${key}`)), "integer").as(key)));
+      query = query.select((eb) => Object.keys(parsedArgs.select).map((key) => key === "_all" ? eb.cast(eb.fn.countAll(), "integer").as("_all") : eb.cast(eb.fn.count(sql7.ref(`${subQueryName}.${key}`)), "integer").as(key)));
       const result = await this.executeQuery(this.kysely, query, "count");
       return result.rows[0];
     } else {
@@ -4323,7 +4861,7 @@ var CreateOperationHandler = class extends BaseOperationHandler {
       });
     });
     if (!result && this.hasPolicyEnabled) {
-      throw new RejectedByPolicyError(this.model, `result is not allowed to be read back`);
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, `result is not allowed to be read back`);
     }
     return result;
   }
@@ -4369,15 +4907,15 @@ var DeleteOperationHandler = class extends BaseOperationHandler {
       omit: args.omit,
       where: args.where
     });
-    if (!existing) {
-      throw new NotFoundError(this.model);
-    }
     await this.safeTransaction(async (tx) => {
       const result = await this.delete(tx, this.model, args.where);
       if (result.count === 0) {
         throw new NotFoundError(this.model);
       }
     });
+    if (!existing && this.hasPolicyEnabled) {
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+    }
     return existing;
   }
   async runDeleteMany(args) {
@@ -4411,7 +4949,7 @@ var FindOperationHandler = class extends BaseOperationHandler {
 };
 
 // src/client/crud/operations/group-by.ts
-import { expressionBuilder as expressionBuilder4 } from "kysely";
+import { expressionBuilder as expressionBuilder5 } from "kysely";
 import { match as match13 } from "ts-pattern";
 var GroupByOperationHandler = class extends BaseOperationHandler {
   static {
@@ -4433,7 +4971,7 @@ var GroupByOperationHandler = class extends BaseOperationHandler {
       subQuery = this.dialect.buildOrderBy(subQuery, this.model, this.model, void 0, skip !== void 0 || take !== void 0, negateOrderBy);
       return subQuery.as("$sub");
     });
-    const fieldRef = /* @__PURE__ */ __name((field) => this.dialect.fieldRef(this.model, field, expressionBuilder4(), "$sub"), "fieldRef");
+    const fieldRef = /* @__PURE__ */ __name((field) => this.dialect.fieldRef(this.model, field, expressionBuilder5(), "$sub"), "fieldRef");
     const bys = typeof parsedArgs.by === "string" ? [
       parsedArgs.by
     ] : parsedArgs.by;
@@ -4548,7 +5086,7 @@ var UpdateOperationHandler = class extends BaseOperationHandler {
     });
     if (!readBackResult) {
       if (this.hasPolicyEnabled) {
-        throw new RejectedByPolicyError(this.model, "result is not allowed to be read back");
+        throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       } else {
         return null;
       }
@@ -4565,16 +5103,24 @@ var UpdateOperationHandler = class extends BaseOperationHandler {
     if (!args) {
       return [];
     }
-    return this.safeTransaction(async (tx) => {
-      const updateResult = await this.updateMany(tx, this.model, args.where, args.data, args.limit, true);
-      return this.read(tx, this.model, {
+    const { readBackResult, updateResult } = await this.safeTransaction(async (tx) => {
+      const updateResult2 = await this.updateMany(tx, this.model, args.where, args.data, args.limit, true);
+      const readBackResult2 = await this.read(tx, this.model, {
         select: args.select,
         omit: args.omit,
         where: {
-          OR: updateResult.map((item) => getIdValues(this.schema, this.model, item))
+          OR: updateResult2.map((item) => getIdValues(this.schema, this.model, item))
         }
       });
+      return {
+        readBackResult: readBackResult2,
+        updateResult: updateResult2
+      };
     });
+    if (readBackResult.length < updateResult.length && this.hasPolicyEnabled) {
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+    }
+    return readBackResult;
   }
   async runUpsert(args) {
     const result = await this.safeTransaction(async (tx) => {
@@ -4590,18 +5136,32 @@ var UpdateOperationHandler = class extends BaseOperationHandler {
       });
     });
     if (!result && this.hasPolicyEnabled) {
-      throw new RejectedByPolicyError(this.model, "result is not allowed to be read back");
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
     }
     return result;
   }
 };
 
 // src/client/crud/validator.ts
-import { invariant as invariant8 } from "@zenstackhq/common-helpers";
-import Decimal from "decimal.js";
+import { invariant as invariant10 } from "@zenstackhq/common-helpers";
+import Decimal3 from "decimal.js";
 import stableStringify from "json-stable-stringify";
 import { match as match15, P as P2 } from "ts-pattern";
 import { z } from "zod";
+
+// src/utils/zod-utils.ts
+import { fromError as fromError3 } from "zod-validation-error/v3";
+import { fromError as fromError4 } from "zod-validation-error/v4";
+function formatError(error) {
+  if ("_zod" in error) {
+    return fromError4(error).toString();
+  } else {
+    return fromError3(error).toString();
+  }
+}
+__name(formatError, "formatError");
+
+// src/client/crud/validator.ts
 var InputValidator = class {
   static {
     __name(this, "InputValidator");
@@ -4663,7 +5223,7 @@ var InputValidator = class {
     }
     const { error } = schema.safeParse(args);
     if (error) {
-      throw new InputValidationError(`Invalid ${operation} args: ${error.message}`, error);
+      throw new InputValidationError(`Invalid ${operation} args: ${formatError(error)}`, error);
     }
     return args;
   }
@@ -4707,7 +5267,7 @@ var InputValidator = class {
         z.bigint()
       ])).with("Decimal", () => z.union([
         z.number(),
-        z.instanceof(Decimal),
+        z.instanceof(Decimal3),
         z.string()
       ])).with("DateTime", () => z.union([
         z.date(),
@@ -4722,7 +5282,7 @@ var InputValidator = class {
       return schema;
     }
     const typeDef = this.schema.typeDefs?.[type];
-    invariant8(typeDef, `Type definition "${type}" not found in schema`);
+    invariant10(typeDef, `Type definition "${type}" not found in schema`);
     schema = z.object(Object.fromEntries(Object.entries(typeDef.fields).map(([field, def]) => {
       let fieldSchema = this.makePrimitiveSchema(def.type);
       if (def.array) {
@@ -4790,7 +5350,7 @@ var InputValidator = class {
       for (const uniqueField of uniqueFields) {
         if ("defs" in uniqueField) {
           fields[uniqueField.name] = z.object(Object.fromEntries(Object.entries(uniqueField.defs).map(([key, def]) => {
-            invariant8(!def.relation, "unique field cannot be a relation");
+            invariant10(!def.relation, "unique field cannot be a relation");
             let fieldSchema;
             const enumDef = getEnum(this.schema, def.type);
             if (enumDef) {
@@ -4996,9 +5556,16 @@ var InputValidator = class {
         fields[field] = z.boolean().optional();
       }
     }
+    const _countSchema = this.makeCountSelectionSchema(modelDef);
+    if (_countSchema) {
+      fields["_count"] = _countSchema;
+    }
+    return z.strictObject(fields);
+  }
+  makeCountSelectionSchema(modelDef) {
     const toManyRelations = Object.values(modelDef.fields).filter((def) => def.relation && def.array);
     if (toManyRelations.length > 0) {
-      fields["_count"] = z.union([
+      return z.union([
         z.literal(true),
         z.strictObject({
           select: z.strictObject(toManyRelations.reduce((acc, fieldDef) => ({
@@ -5012,8 +5579,9 @@ var InputValidator = class {
           }), {}))
         })
       ]).optional();
+    } else {
+      return void 0;
     }
-    return z.strictObject(fields);
   }
   makeRelationSelectIncludeSchema(fieldDef) {
     let objSchema = z.strictObject({
@@ -5060,6 +5628,10 @@ var InputValidator = class {
         fields[field] = this.makeRelationSelectIncludeSchema(fieldDef).optional();
       }
     }
+    const _countSchema = this.makeCountSelectionSchema(modelDef);
+    if (_countSchema) {
+      fields["_count"] = _countSchema;
+    }
     return z.strictObject(fields);
   }
   makeOrderBySchema(model, withRelation, WithAggregation) {
@@ -5126,13 +5698,15 @@ var InputValidator = class {
   // #region Create
   makeCreateSchema(model) {
     const dataSchema = this.makeCreateDataSchema(model, false);
-    const schema = z.strictObject({
+    let schema = z.strictObject({
       data: dataSchema,
       select: this.makeSelectSchema(model).optional(),
       include: this.makeIncludeSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeCreateManySchema(model) {
     return this.makeCreateManyDataSchema(model, []).optional();
@@ -5257,11 +5831,11 @@ var InputValidator = class {
         fields["delete"] = this.makeDeleteRelationDataSchema(fieldType, array, true).optional();
       }
       fields["update"] = array ? this.orArray(z.strictObject({
-        where: this.makeWhereSchema(fieldType, true),
+        where: this.makeWhereSchema(fieldType, true).optional(),
         data: this.makeUpdateDataSchema(fieldType, withoutFields)
       }), true).optional() : z.union([
         z.strictObject({
-          where: this.makeWhereSchema(fieldType, true),
+          where: this.makeWhereSchema(fieldType, true).optional(),
           data: this.makeUpdateDataSchema(fieldType, withoutFields)
         }),
         this.makeUpdateDataSchema(fieldType, withoutFields)
@@ -5321,14 +5895,16 @@ var InputValidator = class {
   // #endregion
   // #region Update
   makeUpdateSchema(model) {
-    const schema = z.strictObject({
+    let schema = z.strictObject({
       where: this.makeWhereSchema(model, true),
       data: this.makeUpdateDataSchema(model),
       select: this.makeSelectSchema(model).optional(),
       include: this.makeIncludeSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeUpdateManySchema(model) {
     return z.strictObject({
@@ -5339,14 +5915,15 @@ var InputValidator = class {
   }
   makeUpdateManyAndReturnSchema(model) {
     const base = this.makeUpdateManySchema(model);
-    const result = base.extend({
+    let schema = base.extend({
       select: this.makeSelectSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectOmitMutuallyExclusive(result);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeUpsertSchema(model) {
-    const schema = z.strictObject({
+    let schema = z.strictObject({
       where: this.makeWhereSchema(model, true),
       create: this.makeCreateDataSchema(model, false),
       update: this.makeUpdateDataSchema(model),
@@ -5354,7 +5931,9 @@ var InputValidator = class {
       include: this.makeIncludeSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeUpdateDataSchema(model, withoutFields = [], withoutRelationFields = false) {
     const uncheckedVariantFields = {};
@@ -5431,12 +6010,14 @@ var InputValidator = class {
   // #endregion
   // #region Delete
   makeDeleteSchema(model) {
-    const schema = z.strictObject({
+    let schema = z.strictObject({
       where: this.makeWhereSchema(model, true),
       select: this.makeSelectSchema(model).optional(),
       include: this.makeIncludeSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeDeleteManySchema(model) {
     return z.object({
@@ -5786,30 +6367,13 @@ function performanceNow() {
 __name(performanceNow, "performanceNow");
 
 // src/client/executor/zenstack-query-executor.ts
-import { invariant as invariant10 } from "@zenstackhq/common-helpers";
-import { AndNode as AndNode2, DefaultQueryExecutor, DeleteQueryNode as DeleteQueryNode2, InsertQueryNode as InsertQueryNode2, ReturningNode as ReturningNode2, SelectionNode as SelectionNode4, SingleConnectionProvider, TableNode as TableNode5, UpdateQueryNode as UpdateQueryNode2, WhereNode as WhereNode3 } from "kysely";
+import { invariant as invariant12 } from "@zenstackhq/common-helpers";
+import { AndNode as AndNode2, DefaultQueryExecutor, DeleteQueryNode as DeleteQueryNode2, InsertQueryNode as InsertQueryNode2, ReturningNode as ReturningNode2, SelectionNode as SelectionNode4, SingleConnectionProvider, TableNode as TableNode6, UpdateQueryNode as UpdateQueryNode2, WhereNode as WhereNode3 } from "kysely";
 import { match as match16 } from "ts-pattern";
 
-// src/client/executor/kysely-utils.ts
-import { AliasNode as AliasNode4 } from "kysely";
-function stripAlias(node) {
-  if (AliasNode4.is(node)) {
-    return {
-      alias: node.alias,
-      node: node.node
-    };
-  } else {
-    return {
-      alias: void 0,
-      node
-    };
-  }
-}
-__name(stripAlias, "stripAlias");
-
 // src/client/executor/name-mapper.ts
-import { invariant as invariant9 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode5, ColumnNode as ColumnNode3, FromNode as FromNode3, IdentifierNode as IdentifierNode3, OperationNodeTransformer as OperationNodeTransformer2, ReferenceNode as ReferenceNode3, SelectAllNode, SelectionNode as SelectionNode3, TableNode as TableNode4 } from "kysely";
+import { invariant as invariant11 } from "@zenstackhq/common-helpers";
+import { AliasNode as AliasNode5, ColumnNode as ColumnNode4, FromNode as FromNode3, IdentifierNode as IdentifierNode3, OperationNodeTransformer as OperationNodeTransformer2, ReferenceNode as ReferenceNode4, SelectAllNode, SelectionNode as SelectionNode3, TableNode as TableNode5 } from "kysely";
 var QueryNameMapper = class extends OperationNodeTransformer2 {
   static {
     __name(this, "QueryNameMapper");
@@ -5878,7 +6442,7 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
     };
   }
   transformReference(node) {
-    if (!ColumnNode3.is(node.column)) {
+    if (!ColumnNode4.is(node.column)) {
       return super.transformReference(node);
     }
     const scope = this.resolveFieldFromScopes(node.column.column.name, node.table?.table.identifier.name);
@@ -5891,7 +6455,7 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
           mappedTableName = this.mapTableName(scope.model);
         }
       }
-      return ReferenceNode3.create(ColumnNode3.create(mappedFieldName), mappedTableName ? TableNode4.create(mappedTableName) : void 0);
+      return ReferenceNode4.create(ColumnNode4.create(mappedFieldName), mappedTableName ? TableNode5.create(mappedTableName) : void 0);
     } else {
       return super.transformReference(node);
     }
@@ -5902,14 +6466,14 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
       return super.transformColumn(node);
     }
     const mappedName = this.mapFieldName(scope.model, node.column.name);
-    return ColumnNode3.create(mappedName);
+    return ColumnNode4.create(mappedName);
   }
   transformUpdateQuery(node) {
     if (!node.table) {
       return super.transformUpdateQuery(node);
     }
     const { alias, node: innerTable } = stripAlias(node.table);
-    if (!innerTable || !TableNode4.is(innerTable)) {
+    if (!innerTable || !TableNode5.is(innerTable)) {
       return super.transformUpdateQuery(node);
     }
     return this.withScope({
@@ -5927,14 +6491,14 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
     const scopes = node.from.froms.map((node2) => {
       const { alias, node: innerNode } = stripAlias(node2);
       return {
-        model: this.extractModelName(innerNode),
+        model: extractModelName(innerNode),
         alias,
         namesMapped: false
       };
     });
     const froms = node.from.froms.map((from) => {
       const { alias, node: innerNode } = stripAlias(from);
-      if (TableNode4.is(innerNode)) {
+      if (TableNode5.is(innerNode)) {
         return this.wrapAlias(this.processTableRef(innerNode), alias);
       } else {
         return super.transformNode(from);
@@ -5959,13 +6523,13 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
         } else {
           selections.push(super.transformSelection(selection));
         }
-      } else if (ReferenceNode3.is(selection.selection) || ColumnNode3.is(selection.selection)) {
+      } else if (ReferenceNode4.is(selection.selection) || ColumnNode4.is(selection.selection)) {
         const transformed = this.transformNode(selection.selection);
         if (AliasNode5.is(transformed)) {
           selections.push(SelectionNode3.create(transformed));
         } else {
-          const origFieldName = this.extractFieldName(selection.selection);
-          const fieldName = this.extractFieldName(transformed);
+          const origFieldName = extractFieldName(selection.selection);
+          const fieldName = extractFieldName(transformed);
           if (fieldName !== origFieldName) {
             selections.push(SelectionNode3.create(this.wrapAlias(transformed, origFieldName ? IdentifierNode3.create(origFieldName) : void 0)));
           } else {
@@ -6035,10 +6599,10 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
     if (!node) {
       return node;
     }
-    if (!TableNode4.is(node)) {
+    if (!TableNode5.is(node)) {
       return super.transformNode(node);
     }
-    return TableNode4.create(this.mapTableName(node.table.identifier.name));
+    return TableNode5.create(this.mapTableName(node.table.identifier.name));
   }
   getMappedName(def) {
     const mapAttr = def.attributes?.find((attr) => attr.name === "@@map" || attr.name === "@map");
@@ -6074,12 +6638,12 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
   // convert a "from" node to a nested query if there are columns with name mapping
   processSelectTable(node) {
     const { alias, node: innerNode } = stripAlias(node);
-    if (innerNode && TableNode4.is(innerNode)) {
+    if (innerNode && TableNode5.is(innerNode)) {
       const modelName = innerNode.table.identifier.name;
       const mappedName = this.mapTableName(modelName);
       const finalAlias = alias ?? (mappedName !== modelName ? IdentifierNode3.create(modelName) : void 0);
       return {
-        node: this.wrapAlias(TableNode4.create(mappedName), finalAlias),
+        node: this.wrapAlias(TableNode5.create(mappedName), finalAlias),
         scope: {
           alias: alias ?? IdentifierNode3.create(modelName),
           model: modelName,
@@ -6101,7 +6665,7 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
     const modelDef = requireModel(this.schema, model);
     return this.getModelFields(modelDef).map((fieldDef) => {
       const columnName = this.mapFieldName(model, fieldDef.name);
-      const columnRef = ReferenceNode3.create(ColumnNode3.create(columnName), alias && IdentifierNode3.is(alias) ? TableNode4.create(alias.name) : void 0);
+      const columnRef = ReferenceNode4.create(ColumnNode4.create(columnName), alias && IdentifierNode3.is(alias) ? TableNode5.create(alias.name) : void 0);
       if (columnName !== fieldDef.name) {
         const aliased = AliasNode5.create(columnRef, IdentifierNode3.create(fieldDef.name));
         return SelectionNode3.create(aliased);
@@ -6132,37 +6696,24 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
   processSelection(node) {
     let alias;
     if (!AliasNode5.is(node)) {
-      alias = this.extractFieldName(node);
+      alias = extractFieldName(node);
     }
     const result = super.transformNode(node);
     return this.wrapAlias(result, alias ? IdentifierNode3.create(alias) : void 0);
   }
   processSelectAll(node) {
     const scope = this.scopes[this.scopes.length - 1];
-    invariant9(scope);
+    invariant11(scope);
     if (!scope.model || !this.hasMappedColumns(scope.model)) {
       return super.transformSelectAll(node);
     }
     const modelDef = requireModel(this.schema, scope.model);
     return this.getModelFields(modelDef).map((fieldDef) => {
       const columnName = this.mapFieldName(modelDef.name, fieldDef.name);
-      const columnRef = ReferenceNode3.create(ColumnNode3.create(columnName));
+      const columnRef = ReferenceNode4.create(ColumnNode4.create(columnName));
       return columnName !== fieldDef.name ? this.wrapAlias(columnRef, IdentifierNode3.create(fieldDef.name)) : columnRef;
     });
   }
-  extractModelName(node) {
-    const { node: innerNode } = stripAlias(node);
-    return TableNode4.is(innerNode) ? innerNode.table.identifier.name : void 0;
-  }
-  extractFieldName(node) {
-    if (ReferenceNode3.is(node) && ColumnNode3.is(node.column)) {
-      return node.column.column.name;
-    } else if (ColumnNode3.is(node)) {
-      return node.column.name;
-    } else {
-      return void 0;
-    }
-  }
 };
 
 // src/client/executor/zenstack-query-executor.ts
@@ -6367,17 +6918,17 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends DefaultQueryExe
   }
   getMutationModel(queryNode) {
     return match16(queryNode).when(InsertQueryNode2.is, (node) => {
-      invariant10(node.into, "InsertQueryNode must have an into clause");
+      invariant12(node.into, "InsertQueryNode must have an into clause");
       return node.into.table.identifier.name;
     }).when(UpdateQueryNode2.is, (node) => {
-      invariant10(node.table, "UpdateQueryNode must have a table");
+      invariant12(node.table, "UpdateQueryNode must have a table");
       const { node: tableNode } = stripAlias(node.table);
-      invariant10(TableNode5.is(tableNode), "UpdateQueryNode must use a TableNode");
+      invariant12(TableNode6.is(tableNode), "UpdateQueryNode must use a TableNode");
       return tableNode.table.identifier.name;
     }).when(DeleteQueryNode2.is, (node) => {
-      invariant10(node.from.froms.length === 1, "Delete query must have exactly one from table");
+      invariant12(node.from.froms.length === 1, "Delete query must have exactly one from table");
       const { node: tableNode } = stripAlias(node.from.froms[0]);
-      invariant10(TableNode5.is(tableNode), "DeleteQueryNode must use a TableNode");
+      invariant12(TableNode6.is(tableNode), "DeleteQueryNode must use a TableNode");
       return tableNode.table.identifier.name;
     }).otherwise((node) => {
       throw new InternalError(`Invalid query node: ${node}`);
@@ -6475,53 +7026,58 @@ __export(functions_exports, {
   search: () => search,
   startsWith: () => startsWith
 });
-import { invariant as invariant11, lowerCaseFirst, upperCaseFirst } from "@zenstackhq/common-helpers";
-import { sql as sql7, ValueNode as ValueNode4 } from "kysely";
+import { invariant as invariant13, lowerCaseFirst, upperCaseFirst } from "@zenstackhq/common-helpers";
+import { sql as sql8, ValueNode as ValueNode5 } from "kysely";
 import { match as match17 } from "ts-pattern";
-var contains = /* @__PURE__ */ __name((eb, args) => {
-  const [field, search2, caseInsensitive = false] = args;
-  if (!field) {
-    throw new Error('"field" parameter is required');
-  }
-  if (!search2) {
-    throw new Error('"search" parameter is required');
-  }
-  const searchExpr = eb.fn("CONCAT", [
-    sql7.lit("%"),
-    search2,
-    sql7.lit("%")
-  ]);
-  return eb(field, caseInsensitive ? "ilike" : "like", searchExpr);
-}, "contains");
+var contains = /* @__PURE__ */ __name((eb, args, context) => textMatch(eb, args, context, "contains"), "contains");
 var search = /* @__PURE__ */ __name((_eb, _args) => {
   throw new Error(`"search" function is not implemented yet`);
 }, "search");
-var startsWith = /* @__PURE__ */ __name((eb, args) => {
-  const [field, search2] = args;
-  if (!field) {
-    throw new Error('"field" parameter is required');
-  }
-  if (!search2) {
-    throw new Error('"search" parameter is required');
-  }
-  return eb(field, "like", eb.fn("CONCAT", [
-    search2,
-    sql7.lit("%")
-  ]));
-}, "startsWith");
-var endsWith = /* @__PURE__ */ __name((eb, args) => {
-  const [field, search2] = args;
+var startsWith = /* @__PURE__ */ __name((eb, args, context) => textMatch(eb, args, context, "startsWith"), "startsWith");
+var endsWith = /* @__PURE__ */ __name((eb, args, context) => textMatch(eb, args, context, "endsWith"), "endsWith");
+var textMatch = /* @__PURE__ */ __name((eb, args, { dialect }, method) => {
+  const [field, search2, caseInsensitive = void 0] = args;
   if (!field) {
     throw new Error('"field" parameter is required');
   }
   if (!search2) {
     throw new Error('"search" parameter is required');
   }
-  return eb(field, "like", eb.fn("CONCAT", [
-    sql7.lit("%"),
-    search2
-  ]));
-}, "endsWith");
+  const casingBehavior = dialect.getStringCasingBehavior();
+  const caseInsensitiveValue = readBoolean(caseInsensitive, false);
+  let op;
+  let fieldExpr = field;
+  let searchExpr = search2;
+  if (caseInsensitiveValue) {
+    if (casingBehavior.supportsILike) {
+      op = "ilike";
+    } else {
+      op = "like";
+      if (casingBehavior.likeCaseSensitive === true) {
+        fieldExpr = eb.fn("LOWER", [
+          fieldExpr
+        ]);
+        searchExpr = eb.fn("LOWER", [
+          searchExpr
+        ]);
+      }
+    }
+  } else {
+    op = "like";
+  }
+  searchExpr = match17(method).with("contains", () => eb.fn("CONCAT", [
+    sql8.lit("%"),
+    sql8`CAST(${searchExpr} as text)`,
+    sql8.lit("%")
+  ])).with("startsWith", () => eb.fn("CONCAT", [
+    sql8`CAST(${searchExpr} as text)`,
+    sql8.lit("%")
+  ])).with("endsWith", () => eb.fn("CONCAT", [
+    sql8.lit("%"),
+    sql8`CAST(${searchExpr} as text)`
+  ])).exhaustive();
+  return eb(fieldExpr, op, searchExpr);
+}, "textMatch");
 var has = /* @__PURE__ */ __name((eb, args) => {
   const [field, search2] = args;
   if (!field) {
@@ -6559,18 +7115,16 @@ var isEmpty = /* @__PURE__ */ __name((eb, args, { dialect }) => {
   if (!field) {
     throw new Error('"field" parameter is required');
   }
-  return eb(dialect.buildArrayLength(eb, field), "=", sql7.lit(0));
+  return eb(dialect.buildArrayLength(eb, field), "=", sql8.lit(0));
 }, "isEmpty");
-var now = /* @__PURE__ */ __name((eb, _args, { dialect }) => {
-  return match17(dialect.provider).with("postgresql", () => eb.fn("now")).with("sqlite", () => sql7.raw("CURRENT_TIMESTAMP")).exhaustive();
-}, "now");
+var now = /* @__PURE__ */ __name(() => sql8.raw("CURRENT_TIMESTAMP"), "now");
 var currentModel = /* @__PURE__ */ __name((_eb, args, { model }) => {
   let result = model;
   const [casing] = args;
   if (casing) {
     result = processCasing(casing, result, model);
   }
-  return sql7.lit(result);
+  return sql8.lit(result);
 }, "currentModel");
 var currentOperation = /* @__PURE__ */ __name((_eb, args, { operation }) => {
   let result = operation;
@@ -6578,21 +7132,30 @@ var currentOperation = /* @__PURE__ */ __name((_eb, args, { operation }) => {
   if (casing) {
     result = processCasing(casing, result, operation);
   }
-  return sql7.lit(result);
+  return sql8.lit(result);
 }, "currentOperation");
 function processCasing(casing, result, model) {
   const opNode = casing.toOperationNode();
-  invariant11(ValueNode4.is(opNode) && typeof opNode.value === "string", '"casting" parameter must be a string value');
+  invariant13(ValueNode5.is(opNode) && typeof opNode.value === "string", '"casting" parameter must be a string value');
   result = match17(opNode.value).with("original", () => model).with("upper", () => result.toUpperCase()).with("lower", () => result.toLowerCase()).with("capitalize", () => upperCaseFirst(result)).with("uncapitalize", () => lowerCaseFirst(result)).otherwise(() => {
     throw new Error(`Invalid casing value: ${opNode.value}. Must be "original", "upper", "lower", "capitalize", or "uncapitalize".`);
   });
   return result;
 }
 __name(processCasing, "processCasing");
+function readBoolean(expr2, defaultValue) {
+  if (expr2 === void 0) {
+    return defaultValue;
+  }
+  const opNode = expr2.toOperationNode();
+  invariant13(ValueNode5.is(opNode), "expression must be a literal value");
+  return !!opNode.value;
+}
+__name(readBoolean, "readBoolean");
 
 // src/client/helpers/schema-db-pusher.ts
-import { invariant as invariant12 } from "@zenstackhq/common-helpers";
-import { sql as sql8 } from "kysely";
+import { invariant as invariant14 } from "@zenstackhq/common-helpers";
+import { sql as sql9 } from "kysely";
 import toposort from "toposort";
 import { match as match18 } from "ts-pattern";
 var SchemaDbPusher = class {
@@ -6613,7 +7176,8 @@ var SchemaDbPusher = class {
           await createEnum.execute();
         }
       }
-      const sortedModels = this.sortModels(this.schema.models);
+      const models = Object.values(this.schema.models).filter((m) => !m.isView);
+      const sortedModels = this.sortModels(models);
       for (const modelDef of sortedModels) {
         const createTable = this.createModelTable(tx, modelDef);
         await createTable.execute();
@@ -6622,7 +7186,7 @@ var SchemaDbPusher = class {
   }
   sortModels(models) {
     const graph = [];
-    for (const model of Object.values(models)) {
+    for (const model of models) {
       let added = false;
       if (model.baseModel) {
         const baseDef = requireModel(this.schema, model.baseModel);
@@ -6707,7 +7271,7 @@ var SchemaDbPusher = class {
   }
   addUniqueConstraint(table, modelDef) {
     for (const [key, value] of Object.entries(modelDef.uniqueFields)) {
-      invariant12(typeof value === "object", "expecting an object");
+      invariant14(typeof value === "object", "expecting an object");
       if ("type" in value) {
         const fieldDef = modelDef.fields[key];
         if (fieldDef.unique) {
@@ -6730,7 +7294,7 @@ var SchemaDbPusher = class {
       if (fieldDef.default !== void 0) {
         if (typeof fieldDef.default === "object" && "kind" in fieldDef.default) {
           if (ExpressionUtils.isCall(fieldDef.default) && fieldDef.default.function === "now") {
-            col = col.defaultTo(sql8`CURRENT_TIMESTAMP`);
+            col = col.defaultTo(sql9`CURRENT_TIMESTAMP`);
           }
         } else {
           col = col.defaultTo(fieldDef.default);
@@ -6750,7 +7314,7 @@ var SchemaDbPusher = class {
   }
   mapFieldType(fieldDef) {
     if (this.schema.enums?.[fieldDef.type]) {
-      return this.schema.provider.type === "postgresql" ? sql8.ref(fieldDef.type) : "text";
+      return this.schema.provider.type === "postgresql" ? sql9.ref(fieldDef.type) : "text";
     }
     if (this.isAutoIncrement(fieldDef) && this.schema.provider.type === "postgresql") {
       return "serial";
@@ -6763,7 +7327,7 @@ var SchemaDbPusher = class {
       throw new Error(`Unsupported field type: ${type}`);
     });
     if (fieldDef.array) {
-      return sql8.raw(`${result}[]`);
+      return sql9.raw(`${result}[]`);
     } else {
       return result;
     }
@@ -6775,7 +7339,7 @@ var SchemaDbPusher = class {
     return fieldDef.default && ExpressionUtils.isCall(fieldDef.default) && fieldDef.default.function === "autoincrement";
   }
   addForeignKeyConstraint(table, model, fieldName, fieldDef) {
-    invariant12(fieldDef.relation, "field must be a relation");
+    invariant14(fieldDef.relation, "field must be a relation");
     if (!fieldDef.relation.fields || !fieldDef.relation.references) {
       return table;
     }
@@ -6832,16 +7396,15 @@ function valueToPromise(thing) {
 __name(valueToPromise, "valueToPromise");
 
 // src/client/result-processor.ts
-import { invariant as invariant13 } from "@zenstackhq/common-helpers";
-import Decimal2 from "decimal.js";
-import { match as match19 } from "ts-pattern";
 var ResultProcessor = class {
   static {
     __name(this, "ResultProcessor");
   }
   schema;
-  constructor(schema) {
+  dialect;
+  constructor(schema, options) {
     this.schema = schema;
+    this.dialect = getCrudDialect(schema, options);
   }
   processResult(data, model, args) {
     const result = this.doProcessResult(data, model);
@@ -6870,7 +7433,7 @@ var ResultProcessor = class {
       }
       if (key.startsWith(DELEGATE_JOINED_FIELD_PREFIX)) {
         if (value) {
-          const subRow = this.transformJson(value);
+          const subRow = this.dialect.transformOutput(value, "Json");
           const subModel = key.slice(DELEGATE_JOINED_FIELD_PREFIX.length);
           const idValues = getIdValues(this.schema, subModel, subRow);
           if (Object.values(idValues).some((v) => v === null || v === void 0)) {
@@ -6904,10 +7467,10 @@ var ResultProcessor = class {
   processFieldValue(value, fieldDef) {
     const type = fieldDef.type;
     if (Array.isArray(value)) {
-      value.forEach((v, i) => value[i] = this.transformScalar(v, type));
+      value.forEach((v, i) => value[i] = this.dialect.transformOutput(v, type));
       return value;
     } else {
-      return this.transformScalar(value, type);
+      return this.dialect.transformOutput(value, type);
     }
   }
   processRelation(value, fieldDef) {
@@ -6921,42 +7484,6 @@ var ResultProcessor = class {
     }
     return this.doProcessResult(relationData, fieldDef.type);
   }
-  transformScalar(value, type) {
-    if (this.schema.typeDefs && type in this.schema.typeDefs) {
-      return this.transformJson(value);
-    } else {
-      return match19(type).with("Boolean", () => this.transformBoolean(value)).with("DateTime", () => this.transformDate(value)).with("Bytes", () => this.transformBytes(value)).with("Decimal", () => this.transformDecimal(value)).with("BigInt", () => this.transformBigInt(value)).with("Json", () => this.transformJson(value)).otherwise(() => value);
-    }
-  }
-  transformDecimal(value) {
-    if (value instanceof Decimal2) {
-      return value;
-    }
-    invariant13(typeof value === "string" || typeof value === "number" || value instanceof Decimal2, `Expected string, number or Decimal, got ${typeof value}`);
-    return new Decimal2(value);
-  }
-  transformBigInt(value) {
-    if (typeof value === "bigint") {
-      return value;
-    }
-    invariant13(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
-    return BigInt(value);
-  }
-  transformBoolean(value) {
-    return !!value;
-  }
-  transformDate(value) {
-    if (typeof value === "number") {
-      return new Date(value);
-    } else if (typeof value === "string") {
-      return new Date(Date.parse(value));
-    } else {
-      return value;
-    }
-  }
-  transformBytes(value) {
-    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
-  }
   fixReversedResult(data, model, args) {
     if (!data) {
       return;
@@ -6981,12 +7508,6 @@ var ResultProcessor = class {
       }
     }
   }
-  transformJson(value) {
-    return match19(this.schema.provider.type).with("sqlite", () => {
-      invariant13(typeof value === "string", "Expected string, got " + typeof value);
-      return JSON.parse(value);
-    }).otherwise(() => value);
-  }
 };
 
 // src/client/client-impl.ts
@@ -7009,7 +7530,7 @@ var ClientImpl = class _ClientImpl {
     this.schema = schema;
     this.options = options;
     this.$schema = schema;
-    this.$options = options ?? {};
+    this.$options = options;
     this.$options.functions = {
       ...functions_exports,
       ...this.$options.functions
@@ -7060,7 +7581,7 @@ var ClientImpl = class _ClientImpl {
   }
   // implementation
   async $transaction(input, options) {
-    invariant14(typeof input === "function" || Array.isArray(input) && input.every((p) => p.then && p.cb), "Invalid transaction input, expected a function or an array of ZenStackPromise");
+    invariant15(typeof input === "function" || Array.isArray(input) && input.every((p) => p.then && p.cb), "Invalid transaction input, expected a function or an array of ZenStackPromise");
     if (typeof input === "function") {
       return this.interactiveTransaction(input, options);
     } else {
@@ -7176,7 +7697,7 @@ var ClientImpl = class _ClientImpl {
   }
   $executeRaw(query, ...values) {
     return createZenStackPromise(async () => {
-      const result = await sql9(query, ...values).execute(this.kysely);
+      const result = await sql10(query, ...values).execute(this.kysely);
       return Number(result.numAffectedRows ?? 0);
     });
   }
@@ -7189,7 +7710,7 @@ var ClientImpl = class _ClientImpl {
   }
   $queryRaw(query, ...values) {
     return createZenStackPromise(async () => {
-      const result = await sql9(query, ...values).execute(this.kysely);
+      const result = await sql10(query, ...values).execute(this.kysely);
       return result.rows;
     });
   }
@@ -7210,7 +7731,7 @@ var ClientImpl = class _ClientImpl {
 };
 function createClientProxy(client) {
   const inputValidator = new InputValidator(client.$schema);
-  const resultProcessor = new ResultProcessor(client.$schema);
+  const resultProcessor = new ResultProcessor(client.$schema, client.$options);
   return new Proxy(client, {
     get: /* @__PURE__ */ __name((target, prop, receiver) => {
       if (typeof prop === "string" && prop.startsWith("$")) {
@@ -7328,7 +7849,7 @@ function definePlugin(plugin) {
 __name(definePlugin, "definePlugin");
 
 // src/client/index.ts
-import { sql as sql10 } from "kysely";
+import { sql as sql11 } from "kysely";
 export {
   InputValidationError,
   InternalError,
@@ -7336,6 +7857,6 @@ export {
   QueryError,
   ZenStackClient,
   definePlugin,
-  sql10 as sql
+  sql11 as sql
 };
 //# sourceMappingURL=index.js.map