@zenstackhq/runtime 3.0.0-beta.4 → 3.0.0-beta.6

package/dist/index.cjs

@@ -37,19 +37,20 @@ __export(src_exports, {
   QueryError: () => QueryError,
   ZenStackClient: () => ZenStackClient,
   definePlugin: () => definePlugin,
-  sql: () => import_kysely18.sql
+  sql: () => import_kysely19.sql
 });
 module.exports = __toCommonJS(src_exports);
 
 // src/client/client-impl.ts
-var import_common_helpers15 = require("@zenstackhq/common-helpers");
-var import_kysely17 = require("kysely");
+var import_common_helpers16 = require("@zenstackhq/common-helpers");
+var import_kysely18 = require("kysely");
 
 // src/client/crud/operations/aggregate.ts
-var import_kysely9 = require("kysely");
+var import_kysely11 = require("kysely");
 var import_ts_pattern10 = require("ts-pattern");
 
 // src/client/query-utils.ts
+var import_common_helpers = require("@zenstackhq/common-helpers");
 var import_ts_pattern = require("ts-pattern");
 
 // src/schema/expression.ts
@@ -228,10 +229,19 @@ function requireField(schema, modelOrType, field) {
 }
 __name(requireField, "requireField");
 function getIdFields(schema, model) {
-  const modelDef = requireModel(schema, model);
+  const modelDef = getModel(schema, model);
   return modelDef?.idFields;
 }
 __name(getIdFields, "getIdFields");
+function requireIdFields(schema, model) {
+  const modelDef = requireModel(schema, model);
+  const result = modelDef?.idFields;
+  if (!result) {
+    throw new InternalError(`Model "${model}" does not have ID field(s)`);
+  }
+  return result;
+}
+__name(requireIdFields, "requireIdFields");
 function getRelationForeignKeyFieldPairs(schema, model, relationField) {
   const fieldDef = requireField(schema, model, relationField);
   if (!fieldDef?.relation) {
@@ -345,7 +355,7 @@ function buildFieldRef(schema, model, field, options, eb, modelAlias, inlineComp
       throw new QueryError(`Computed field "${field}" implementation not provided for model "${model}"`);
     }
     return computer(eb, {
-      currentModel: modelAlias
+      modelAlias
     });
   }
 }
@@ -380,7 +390,7 @@ function buildJoinPairs(schema, model, modelAlias, relationField, relationModelA
 }
 __name(buildJoinPairs, "buildJoinPairs");
 function makeDefaultOrderBy(schema, model) {
-  const idFields = getIdFields(schema, model);
+  const idFields = requireIdFields(schema, model);
   return idFields.map((f) => ({
     [f]: "asc"
   }));
@@ -419,11 +429,17 @@ function getManyToManyRelation(schema, model, field) {
         "A"
       ];
     }
+    const modelIdFields = requireIdFields(schema, model);
+    (0, import_common_helpers.invariant)(modelIdFields.length === 1, "Only single-field ID is supported for many-to-many relation");
+    const otherIdFields = requireIdFields(schema, fieldDef.type);
+    (0, import_common_helpers.invariant)(otherIdFields.length === 1, "Only single-field ID is supported for many-to-many relation");
     return {
       parentFkName: orderedFK[0],
+      parentPKName: modelIdFields[0],
       otherModel: fieldDef.type,
       otherField: fieldDef.relation.opposite,
       otherFkName: orderedFK[1],
+      otherPKName: otherIdFields[0],
       joinTable: fieldDef.relation.name ? `_${fieldDef.relation.name}` : `_${sortedModelNames[0]}To${sortedModelNames[1]}`
     };
   } else {
@@ -462,7 +478,7 @@ function ensureArray(value) {
 }
 __name(ensureArray, "ensureArray");
 function extractIdFields(entity, schema, model) {
-  const idFields = getIdFields(schema, model);
+  const idFields = requireIdFields(schema, model);
   return extractFields(entity, idFields);
 }
 __name(extractIdFields, "extractIdFields");
@@ -499,36 +515,95 @@ __name(aggregate, "aggregate");
 
 // src/client/crud/operations/base.ts
 var import_cuid2 = require("@paralleldrive/cuid2");
-var import_common_helpers8 = require("@zenstackhq/common-helpers");
-var import_kysely8 = require("kysely");
+var import_common_helpers10 = require("@zenstackhq/common-helpers");
+var import_kysely10 = require("kysely");
 var import_nanoid = require("nanoid");
 var import_ts_pattern9 = require("ts-pattern");
 var import_ulid = require("ulid");
 var uuid = __toESM(require("uuid"), 1);
 
 // src/plugins/policy/errors.ts
+var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
+  RejectedByPolicyReason2["NO_ACCESS"] = "no-access";
+  RejectedByPolicyReason2["CANNOT_READ_BACK"] = "cannot-read-back";
+  RejectedByPolicyReason2["OTHER"] = "other";
+  return RejectedByPolicyReason2;
+}({});
 var RejectedByPolicyError = class extends Error {
   static {
     __name(this, "RejectedByPolicyError");
   }
   model;
   reason;
-  constructor(model, reason) {
-    super(reason ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
+  constructor(model, reason = "no-access", message) {
+    super(message ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
   }
 };
 
+// src/plugins/policy/functions.ts
+var import_common_helpers8 = require("@zenstackhq/common-helpers");
+var import_kysely9 = require("kysely");
+
+// src/client/contract.ts
+var TransactionIsolationLevel = /* @__PURE__ */ function(TransactionIsolationLevel2) {
+  TransactionIsolationLevel2["ReadUncommitted"] = "read uncommitted";
+  TransactionIsolationLevel2["ReadCommitted"] = "read committed";
+  TransactionIsolationLevel2["RepeatableRead"] = "repeatable read";
+  TransactionIsolationLevel2["Serializable"] = "serializable";
+  TransactionIsolationLevel2["Snapshot"] = "snapshot";
+  return TransactionIsolationLevel2;
+}({});
+var CRUD = [
+  "create",
+  "read",
+  "update",
+  "delete"
+];
+
+// src/client/kysely-utils.ts
+var import_kysely = require("kysely");
+function stripAlias(node) {
+  if (import_kysely.AliasNode.is(node)) {
+    return {
+      alias: node.alias,
+      node: node.node
+    };
+  } else {
+    return {
+      alias: void 0,
+      node
+    };
+  }
+}
+__name(stripAlias, "stripAlias");
+function extractModelName(node) {
+  const { node: innerNode } = stripAlias(node);
+  return import_kysely.TableNode.is(innerNode) ? innerNode.table.identifier.name : void 0;
+}
+__name(extractModelName, "extractModelName");
+function extractFieldName(node) {
+  if (import_kysely.ReferenceNode.is(node) && import_kysely.ColumnNode.is(node.column)) {
+    return node.column.column.name;
+  } else if (import_kysely.ColumnNode.is(node)) {
+    return node.column.name;
+  } else {
+    return void 0;
+  }
+}
+__name(extractFieldName, "extractFieldName");
+
 // src/plugins/policy/policy-handler.ts
-var import_common_helpers6 = require("@zenstackhq/common-helpers");
-var import_kysely7 = require("kysely");
+var import_common_helpers7 = require("@zenstackhq/common-helpers");
+var import_kysely8 = require("kysely");
 var import_ts_pattern8 = require("ts-pattern");
 
 // src/client/crud/dialects/index.ts
 var import_ts_pattern5 = require("ts-pattern");
 
 // src/client/crud/dialects/postgresql.ts
-var import_common_helpers2 = require("@zenstackhq/common-helpers");
-var import_kysely2 = require("kysely");
+var import_common_helpers3 = require("@zenstackhq/common-helpers");
+var import_decimal = __toESM(require("decimal.js"), 1);
+var import_kysely3 = require("kysely");
 var import_ts_pattern3 = require("ts-pattern");
 
 // src/client/constants.ts
@@ -553,8 +628,8 @@ var AGGREGATE_OPERATORS = [
 ];
 
 // src/client/crud/dialects/base-dialect.ts
-var import_common_helpers = require("@zenstackhq/common-helpers");
-var import_kysely = require("kysely");
+var import_common_helpers2 = require("@zenstackhq/common-helpers");
+var import_kysely2 = require("kysely");
 var import_ts_pattern2 = require("ts-pattern");
 
 // src/utils/enumerate.ts
@@ -585,6 +660,9 @@ var BaseCrudDialect = class {
   transformPrimitive(value, _type, _forArrayField) {
     return value;
   }
+  transformOutput(value, _type) {
+    return value;
+  }
   // #region common query builders
   buildSelectModel(eb, model, modelAlias) {
     const modelDef = requireModel(this.schema, model);
@@ -613,7 +691,7 @@ var BaseCrudDialect = class {
     if ("distinct" in args && args.distinct) {
       const distinct = ensureArray(args.distinct);
       if (this.supportsDistinctOn) {
-        result = result.distinctOn(distinct.map((f) => import_kysely.sql.ref(`${modelAlias}.${f}`)));
+        result = result.distinctOn(distinct.map((f) => import_kysely2.sql.ref(`${modelAlias}.${f}`)));
       } else {
         throw new QueryError(`"distinct" is not supported by "${this.schema.provider.type}" provider`);
       }
@@ -663,7 +741,7 @@ var BaseCrudDialect = class {
   buildCursorFilter(model, query, cursor, orderBy, negateOrderBy, modelAlias) {
     const _orderBy = orderBy ?? makeDefaultOrderBy(this.schema, model);
     const orderByItems = ensureArray(_orderBy).flatMap((obj) => Object.entries(obj));
-    const eb = (0, import_kysely.expressionBuilder)();
+    const eb = (0, import_kysely2.expressionBuilder)();
     const subQueryAlias = `${model}$cursor$sub`;
     const cursorFilter = this.buildFilter(eb, model, subQueryAlias, cursor);
     let result = query;
@@ -698,7 +776,7 @@ var BaseCrudDialect = class {
     if (payload === null) {
       const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, field);
       if (ownedByModel && !fieldDef.originModel) {
-        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely.sql.ref(`${modelAlias}.${fk}`), "is", null)));
+        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely2.sql.ref(`${modelAlias}.${fk}`), "is", null)));
       } else {
         return this.buildToOneRelationFilter(eb, model, modelAlias, field, fieldDef, {
           is: null
@@ -715,7 +793,7 @@ var BaseCrudDialect = class {
       joinAlias
     );
     const filterResultField = `${field}$filter`;
-    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
+    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
     const conditions = [];
     if ("is" in payload || "isNot" in payload) {
       if ("is" in payload) {
@@ -745,24 +823,26 @@ var BaseCrudDialect = class {
   }
   buildToManyRelationFilter(eb, model, modelAlias, field, fieldDef, payload) {
     if (payload === null) {
-      return eb(import_kysely.sql.ref(`${modelAlias}.${field}`), "is", null);
+      return eb(import_kysely2.sql.ref(`${modelAlias}.${field}`), "is", null);
     }
     const relationModel = fieldDef.type;
     const relationFilterSelectAlias = `${modelAlias}$${field}$filter`;
     const buildPkFkWhereRefs = /* @__PURE__ */ __name((eb2) => {
       const m2m = getManyToManyRelation(this.schema, model, field);
       if (m2m) {
-        const modelIdField = getIdFields(this.schema, model)[0];
-        const relationIdField = getIdFields(this.schema, relationModel)[0];
-        return eb2(import_kysely.sql.ref(`${relationFilterSelectAlias}.${relationIdField}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely.sql.ref(`${modelAlias}.${modelIdField}`)));
+        const modelIdFields = requireIdFields(this.schema, model);
+        (0, import_common_helpers2.invariant)(modelIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        const relationIdFields = requireIdFields(this.schema, relationModel);
+        (0, import_common_helpers2.invariant)(relationIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        return eb2(import_kysely2.sql.ref(`${relationFilterSelectAlias}.${relationIdFields[0]}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely2.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely2.sql.ref(`${modelAlias}.${modelIdFields[0]}`)));
       } else {
         const relationKeyPairs = getRelationForeignKeyFieldPairs(this.schema, model, field);
         let result2 = this.true(eb2);
         for (const { fk, pk } of relationKeyPairs.keyPairs) {
           if (relationKeyPairs.ownedByModel) {
-            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${modelAlias}.${fk}`), "=", import_kysely.sql.ref(`${relationFilterSelectAlias}.${pk}`)));
+            result2 = this.and(eb2, result2, eb2(import_kysely2.sql.ref(`${modelAlias}.${fk}`), "=", import_kysely2.sql.ref(`${relationFilterSelectAlias}.${pk}`)));
           } else {
-            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${modelAlias}.${pk}`), "=", import_kysely.sql.ref(`${relationFilterSelectAlias}.${fk}`)));
+            result2 = this.and(eb2, result2, eb2(import_kysely2.sql.ref(`${modelAlias}.${pk}`), "=", import_kysely2.sql.ref(`${relationFilterSelectAlias}.${fk}`)));
           }
         }
         return result2;
@@ -845,7 +925,7 @@ var BaseCrudDialect = class {
     return eb(lhs, "=", rhs !== null && rhs !== void 0 ? this.transformPrimitive(rhs, type, false) : rhs);
   }
   buildStandardFilter(eb, type, payload, lhs, getRhs, recurse, throwIfInvalid = false, onlyForKeys = void 0, excludeKeys = []) {
-    if (payload === null || !(0, import_common_helpers.isPlainObject)(payload)) {
+    if (payload === null || !(0, import_common_helpers2.isPlainObject)(payload)) {
       return {
         conditions: [
           this.buildLiteralFilter(eb, lhs, type, payload)
@@ -864,14 +944,14 @@ var BaseCrudDialect = class {
       }
       const rhs = Array.isArray(value) ? value.map(getRhs) : getRhs(value);
       const condition = (0, import_ts_pattern2.match)(op).with("equals", () => rhs === null ? eb(lhs, "is", null) : eb(lhs, "=", rhs)).with("in", () => {
-        (0, import_common_helpers.invariant)(Array.isArray(rhs), "right hand side must be an array");
+        (0, import_common_helpers2.invariant)(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.false(eb);
         } else {
           return eb(lhs, "in", rhs);
         }
       }).with("notIn", () => {
-        (0, import_common_helpers.invariant)(Array.isArray(rhs), "right hand side must be an array");
+        (0, import_common_helpers2.invariant)(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.true(eb);
         } else {
@@ -911,7 +991,7 @@ var BaseCrudDialect = class {
         if (key === "mode" || consumedKeys.includes(key)) {
           continue;
         }
-        const condition = (0, import_ts_pattern2.match)(key).with("contains", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`%${value}%`)) : eb(fieldRef, "like", import_kysely.sql.val(`%${value}%`))).with("startsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`${value}%`)) : eb(fieldRef, "like", import_kysely.sql.val(`${value}%`))).with("endsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`%${value}`)) : eb(fieldRef, "like", import_kysely.sql.val(`%${value}`))).otherwise(() => {
+        const condition = (0, import_ts_pattern2.match)(key).with("contains", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`%${value}%`)) : eb(fieldRef, "like", import_kysely2.sql.val(`%${value}%`))).with("startsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`${value}%`)) : eb(fieldRef, "like", import_kysely2.sql.val(`${value}%`))).with("endsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`%${value}`)) : eb(fieldRef, "like", import_kysely2.sql.val(`%${value}`))).otherwise(() => {
           throw new QueryError(`Invalid string filter key: ${key}`);
         });
         if (condition) {
@@ -923,16 +1003,16 @@ var BaseCrudDialect = class {
   }
   prepStringCasing(eb, value, mode) {
     if (!mode || mode === "default") {
-      return value === null ? value : import_kysely.sql.val(value);
+      return value === null ? value : import_kysely2.sql.val(value);
     }
     if (typeof value === "string") {
       return eb.fn("lower", [
-        import_kysely.sql.val(value)
+        import_kysely2.sql.val(value)
       ]);
     } else if (Array.isArray(value)) {
       return value.map((v) => this.prepStringCasing(eb, v, mode));
     } else {
-      return value === null ? null : import_kysely.sql.val(value);
+      return value === null ? null : import_kysely2.sql.val(value);
     }
   }
   buildNumberFilter(eb, fieldRef, type, payload) {
@@ -989,19 +1069,19 @@ var BaseCrudDialect = class {
           "_min",
           "_max"
         ].includes(field)) {
-          (0, import_common_helpers.invariant)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
+          (0, import_common_helpers2.invariant)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
           for (const [k, v] of Object.entries(value)) {
-            (0, import_common_helpers.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-            result = result.orderBy((eb) => aggregate(eb, this.fieldRef(model, k, eb, modelAlias), field), import_kysely.sql.raw(this.negateSort(v, negated)));
+            (0, import_common_helpers2.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+            result = result.orderBy((eb) => aggregate(eb, this.fieldRef(model, k, eb, modelAlias), field), import_kysely2.sql.raw(this.negateSort(v, negated)));
           }
           continue;
         }
         switch (field) {
           case "_count": {
-            (0, import_common_helpers.invariant)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
+            (0, import_common_helpers2.invariant)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
             for (const [k, v] of Object.entries(value)) {
-              (0, import_common_helpers.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-              result = result.orderBy((eb) => eb.fn.count(this.fieldRef(model, k, eb, modelAlias)), import_kysely.sql.raw(this.negateSort(v, negated)));
+              (0, import_common_helpers2.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+              result = result.orderBy((eb) => eb.fn.count(this.fieldRef(model, k, eb, modelAlias)), import_kysely2.sql.raw(this.negateSort(v, negated)));
             }
             continue;
           }
@@ -1010,11 +1090,11 @@ var BaseCrudDialect = class {
         }
         const fieldDef = requireField(this.schema, model, field);
         if (!fieldDef.relation) {
-          const fieldRef = this.fieldRef(model, field, (0, import_kysely.expressionBuilder)(), modelAlias);
+          const fieldRef = this.fieldRef(model, field, (0, import_kysely2.expressionBuilder)(), modelAlias);
           if (value === "asc" || value === "desc") {
             result = result.orderBy(fieldRef, this.negateSort(value, negated));
           } else if (value && typeof value === "object" && "nulls" in value && "sort" in value && (value.sort === "asc" || value.sort === "desc") && (value.nulls === "first" || value.nulls === "last")) {
-            result = result.orderBy(fieldRef, import_kysely.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
+            result = result.orderBy(fieldRef, import_kysely2.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
           }
         } else {
           const relationModel = fieldDef.type;
@@ -1023,13 +1103,13 @@ var BaseCrudDialect = class {
               throw new QueryError(`invalid orderBy value for field "${field}"`);
             }
             if ("_count" in value) {
-              (0, import_common_helpers.invariant)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
+              (0, import_common_helpers2.invariant)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
               const sort = this.negateSort(value._count, negated);
               result = result.orderBy((eb) => {
                 const subQueryAlias = `${modelAlias}$orderBy$${field}$count`;
                 let subQuery = this.buildSelectModel(eb, relationModel, subQueryAlias);
                 const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, subQueryAlias);
-                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
+                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
                 subQuery = subQuery.select(() => eb.fn.count(eb.lit(1)).as("_count"));
                 return subQuery;
               }, sort);
@@ -1037,7 +1117,7 @@ var BaseCrudDialect = class {
           } else {
             result = result.leftJoin(relationModel, (join) => {
               const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
-              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
+              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
             });
             result = this.buildOrderBy(result, fieldDef.type, relationModel, value, false, negated);
           }
@@ -1089,13 +1169,13 @@ var BaseCrudDialect = class {
     if (fieldDef.computed) {
       return query.select((eb) => this.fieldRef(model, field, eb, modelAlias).as(field));
     } else if (!fieldDef.originModel) {
-      return query.select(import_kysely.sql.ref(`${modelAlias}.${field}`).as(field));
+      return query.select(import_kysely2.sql.ref(`${modelAlias}.${field}`).as(field));
     } else {
       return this.buildSelectField(query, fieldDef.originModel, fieldDef.originModel, field);
     }
   }
   buildDelegateJoin(thisModel, thisModelAlias, otherModelAlias, query) {
-    const idFields = getIdFields(this.schema, thisModel);
+    const idFields = requireIdFields(this.schema, thisModel);
     query = query.leftJoin(otherModelAlias, (qb) => {
       for (const idField of idFields) {
         qb = qb.onRef(`${thisModelAlias}.${idField}`, "=", `${otherModelAlias}.${idField}`);
@@ -1117,10 +1197,16 @@ var BaseCrudDialect = class {
     for (const [field, value] of Object.entries(selections.select)) {
       const fieldDef = requireField(this.schema, model, field);
       const fieldModel = fieldDef.type;
-      const joinPairs = buildJoinPairs(this.schema, model, parentAlias, field, fieldModel);
-      let fieldCountQuery = eb.selectFrom(fieldModel).select(eb.fn.countAll().as(`_count$${field}`));
-      for (const [left, right] of joinPairs) {
-        fieldCountQuery = fieldCountQuery.whereRef(left, "=", right);
+      let fieldCountQuery;
+      const m2m = getManyToManyRelation(this.schema, model, field);
+      if (m2m) {
+        fieldCountQuery = eb.selectFrom(fieldModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.joinTable}.${m2m.otherFkName}`, "=", `${fieldModel}.${m2m.otherPKName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${parentAlias}.${m2m.parentPKName}`)).select(eb.fn.countAll().as(`_count$${field}`));
+      } else {
+        fieldCountQuery = eb.selectFrom(fieldModel).select(eb.fn.countAll().as(`_count$${field}`));
+        const joinPairs = buildJoinPairs(this.schema, model, parentAlias, field, fieldModel);
+        for (const [left, right] of joinPairs) {
+          fieldCountQuery = fieldCountQuery.whereRef(left, "=", right);
+        }
       }
       if (value && typeof value === "object" && "where" in value && value.where && typeof value.where === "object") {
         const filter = this.buildFilter(eb, fieldModel, fieldModel, value.where);
@@ -1200,6 +1286,9 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   static {
     __name(this, "PostgresCrudDialect");
   }
+  constructor(schema, options) {
+    super(schema, options);
+  }
   get provider() {
     return "postgresql";
   }
@@ -1214,9 +1303,41 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
         return value.map((v) => this.transformPrimitive(v, type, false));
       }
     } else {
-      return (0, import_ts_pattern3.match)(type).with("DateTime", () => value instanceof Date ? value : typeof value === "string" ? new Date(value) : value).with("Decimal", () => value !== null ? value.toString() : value).otherwise(() => value);
+      return (0, import_ts_pattern3.match)(type).with("DateTime", () => value instanceof Date ? value.toISOString() : typeof value === "string" ? new Date(value).toISOString() : value).with("Decimal", () => value !== null ? value.toString() : value).otherwise(() => value);
+    }
+  }
+  transformOutput(value, type) {
+    if (value === null || value === void 0) {
+      return value;
+    }
+    return (0, import_ts_pattern3.match)(type).with("DateTime", () => this.transformOutputDate(value)).with("Bytes", () => this.transformOutputBytes(value)).with("BigInt", () => this.transformOutputBigInt(value)).with("Decimal", () => this.transformDecimal(value)).otherwise(() => super.transformOutput(value, type));
+  }
+  transformOutputBigInt(value) {
+    if (typeof value === "bigint") {
+      return value;
+    }
+    (0, import_common_helpers3.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    return BigInt(value);
+  }
+  transformDecimal(value) {
+    if (value instanceof import_decimal.default) {
+      return value;
+    }
+    (0, import_common_helpers3.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal.default, `Expected string, number or Decimal, got ${typeof value}`);
+    return new import_decimal.default(value);
+  }
+  transformOutputDate(value) {
+    if (typeof value === "string") {
+      return new Date(value);
+    } else if (value instanceof Date && this.options.fixPostgresTimezone !== false) {
+      return new Date(value.getTime() - value.getTimezoneOffset() * 60 * 1e3);
+    } else {
+      return value;
     }
   }
+  transformOutputBytes(value) {
+    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
+  }
   buildRelationSelection(query, model, relationField, parentAlias, payload) {
     const relationResultName = `${parentAlias}$${relationField}`;
     const joinedQuery = this.buildRelationJSON(model, query, relationField, parentAlias, payload, relationResultName);
@@ -1247,14 +1368,14 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   buildRelationJoinFilter(query, model, relationField, relationModel, relationModelAlias, parentAlias) {
     const m2m = getManyToManyRelation(this.schema, model, relationField);
     if (m2m) {
-      const parentIds = getIdFields(this.schema, model);
-      const relationIds = getIdFields(this.schema, relationModel);
-      (0, import_common_helpers2.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      (0, import_common_helpers2.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      const parentIds = requireIdFields(this.schema, model);
+      const relationIds = requireIdFields(this.schema, relationModel);
+      (0, import_common_helpers3.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers3.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       query = query.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const joinPairs = buildJoinPairs(this.schema, model, parentAlias, relationField, relationModelAlias);
-      query = query.where((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
+      query = query.where((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely3.sql.ref(left), "=", import_kysely3.sql.ref(right)))));
     }
     return query;
   }
@@ -1262,9 +1383,9 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     qb = qb.select((eb) => {
       const objArgs = this.buildRelationObjectArgs(relationModel, relationModelAlias, eb, payload, parentResultName);
       if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely2.sql`jsonb_agg(jsonb_build_object(${import_kysely2.sql.join(objArgs)}))`, import_kysely2.sql`'[]'::jsonb`).as("$data");
+        return eb.fn.coalesce(import_kysely3.sql`jsonb_agg(jsonb_build_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`'[]'::jsonb`).as("$data");
       } else {
-        return import_kysely2.sql`jsonb_build_object(${import_kysely2.sql.join(objArgs)})`.as("$data");
+        return import_kysely3.sql`jsonb_build_object(${import_kysely3.sql.join(objArgs)})`.as("$data");
       }
     });
     return qb;
@@ -1275,13 +1396,13 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     const descendantModels = getDelegateDescendantModels(this.schema, relationModel);
     if (descendantModels.length > 0) {
       objArgs.push(...descendantModels.map((subModel) => [
-        import_kysely2.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
+        import_kysely3.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
         eb.ref(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`)
       ]).flatMap((v) => v));
     }
     if (payload === true || !payload.select) {
       objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-        import_kysely2.sql.lit(field),
+        import_kysely3.sql.lit(field),
         this.fieldRef(relationModel, field, eb, relationModelAlias, false)
       ]).flatMap((v) => v));
     } else if (payload.select) {
@@ -1289,14 +1410,14 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
         if (field === "_count") {
           const subJson = this.buildCountJson(relationModel, eb, relationModelAlias, value);
           return [
-            import_kysely2.sql.lit(field),
+            import_kysely3.sql.lit(field),
             subJson
           ];
         } else {
           const fieldDef = requireField(this.schema, relationModel, field);
           const fieldValue = fieldDef.relation ? eb.ref(`${parentResultName}$${field}.$data`) : this.fieldRef(relationModel, field, eb, relationModelAlias, false);
           return [
-            import_kysely2.sql.lit(field),
+            import_kysely3.sql.lit(field),
             fieldValue
           ];
         }
@@ -1304,7 +1425,7 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     }
     if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
       objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field]) => [
-        import_kysely2.sql.lit(field),
+        import_kysely3.sql.lit(field),
         // reference the synthesized JSON field
         eb.ref(`${parentResultName}$${field}.$data`)
       ]).flatMap((v) => v));
@@ -1334,7 +1455,7 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   }
   buildJsonObject(eb, value) {
     return eb.fn("jsonb_build_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely2.sql.lit(key),
+      import_kysely3.sql.lit(key),
       value2
     ]));
   }
@@ -1362,11 +1483,33 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   get supportInsertWithDefault() {
     return true;
   }
+  getFieldSqlType(fieldDef) {
+    if (fieldDef.relation) {
+      throw new QueryError("Cannot get SQL type of a relation field");
+    }
+    let result;
+    if (this.schema.enums?.[fieldDef.type]) {
+      result = "text";
+    } else {
+      result = (0, import_ts_pattern3.match)(fieldDef.type).with("String", () => "text").with("Boolean", () => "boolean").with("Int", () => "integer").with("BigInt", () => "bigint").with("Float", () => "double precision").with("Decimal", () => "decimal").with("DateTime", () => "timestamp").with("Bytes", () => "bytea").with("Json", () => "jsonb").otherwise(() => "text");
+    }
+    if (fieldDef.array) {
+      result += "[]";
+    }
+    return result;
+  }
+  getStringCasingBehavior() {
+    return {
+      supportsILike: true,
+      likeCaseSensitive: true
+    };
+  }
 };
 
 // src/client/crud/dialects/sqlite.ts
-var import_common_helpers3 = require("@zenstackhq/common-helpers");
-var import_kysely3 = require("kysely");
+var import_common_helpers4 = require("@zenstackhq/common-helpers");
+var import_decimal2 = __toESM(require("decimal.js"), 1);
+var import_kysely4 = require("kysely");
 var import_ts_pattern4 = require("ts-pattern");
 var SqliteCrudDialect = class extends BaseCrudDialect {
   static {
@@ -1385,10 +1528,58 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
       if (this.schema.typeDefs && type in this.schema.typeDefs) {
         return JSON.stringify(value);
       } else {
-        return (0, import_ts_pattern4.match)(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).with("Json", () => JSON.stringify(value)).otherwise(() => value);
+        return (0, import_ts_pattern4.match)(type).with("Boolean", () => value ? 1 : 0).with("DateTime", () => value instanceof Date ? value.toISOString() : typeof value === "string" ? new Date(value).toISOString() : value).with("Decimal", () => value.toString()).with("Bytes", () => Buffer.from(value)).with("Json", () => JSON.stringify(value)).otherwise(() => value);
       }
     }
   }
+  transformOutput(value, type) {
+    if (value === null || value === void 0) {
+      return value;
+    } else if (this.schema.typeDefs && type in this.schema.typeDefs) {
+      return this.transformOutputJson(value);
+    } else {
+      return (0, import_ts_pattern4.match)(type).with("Boolean", () => this.transformOutputBoolean(value)).with("DateTime", () => this.transformOutputDate(value)).with("Bytes", () => this.transformOutputBytes(value)).with("Decimal", () => this.transformOutputDecimal(value)).with("BigInt", () => this.transformOutputBigInt(value)).with("Json", () => this.transformOutputJson(value)).otherwise(() => super.transformOutput(value, type));
+    }
+  }
+  transformOutputDecimal(value) {
+    if (value instanceof import_decimal2.default) {
+      return value;
+    }
+    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal2.default, `Expected string, number or Decimal, got ${typeof value}`);
+    return new import_decimal2.default(value);
+  }
+  transformOutputBigInt(value) {
+    if (typeof value === "bigint") {
+      return value;
+    }
+    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    return BigInt(value);
+  }
+  transformOutputBoolean(value) {
+    return !!value;
+  }
+  transformOutputDate(value) {
+    if (typeof value === "number") {
+      return new Date(value);
+    } else if (typeof value === "string") {
+      return new Date(value);
+    } else {
+      return value;
+    }
+  }
+  transformOutputBytes(value) {
+    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
+  }
+  transformOutputJson(value) {
+    if (typeof value === "string") {
+      try {
+        return JSON.parse(value);
+      } catch (e) {
+        throw new QueryError("Invalid JSON returned", e);
+      }
+    }
+    return value;
+  }
   buildRelationSelection(query, model, relationField, parentAlias, payload) {
     return query.select((eb) => this.buildRelationJSON(model, eb, relationField, parentAlias, payload).as(relationField));
   }
@@ -1414,13 +1605,13 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
       const descendantModels = getDelegateDescendantModels(this.schema, relationModel);
       if (descendantModels.length > 0) {
         objArgs.push(...descendantModels.map((subModel) => [
-          import_kysely3.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
+          import_kysely4.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
           eb.ref(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`)
         ]).flatMap((v) => v));
       }
       if (payload === true || !payload.select) {
         objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-          import_kysely3.sql.lit(field),
+          import_kysely4.sql.lit(field),
           this.fieldRef(relationModel, field, eb, subQueryName, false)
         ]).flatMap((v) => v));
       } else if (payload.select) {
@@ -1428,7 +1619,7 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
           if (field === "_count") {
             const subJson = this.buildCountJson(relationModel, eb, `${parentAlias}$${relationField}`, value);
             return [
-              import_kysely3.sql.lit(field),
+              import_kysely4.sql.lit(field),
               subJson
             ];
           } else {
@@ -1436,12 +1627,12 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
             if (fieldDef.relation) {
               const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentAlias}$${relationField}`, value);
               return [
-                import_kysely3.sql.lit(field),
+                import_kysely4.sql.lit(field),
                 subJson
               ];
             } else {
               return [
-                import_kysely3.sql.lit(field),
+                import_kysely4.sql.lit(field),
                 this.fieldRef(relationModel, field, eb, subQueryName, false)
               ];
             }
@@ -1452,15 +1643,15 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
         objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field, value]) => {
           const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentAlias}$${relationField}`, value);
           return [
-            import_kysely3.sql.lit(field),
+            import_kysely4.sql.lit(field),
             subJson
           ];
         }).flatMap((v) => v));
       }
       if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely3.sql`json_group_array(json_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`json_array()`).as("$data");
+        return eb.fn.coalesce(import_kysely4.sql`json_group_array(json_object(${import_kysely4.sql.join(objArgs)}))`, import_kysely4.sql`json_array()`).as("$data");
       } else {
-        return import_kysely3.sql`json_object(${import_kysely3.sql.join(objArgs)})`.as("$data");
+        return import_kysely4.sql`json_object(${import_kysely4.sql.join(objArgs)})`.as("$data");
       }
     });
     return tbl;
@@ -1470,10 +1661,10 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
     const relationModel = fieldDef.type;
     const m2m = getManyToManyRelation(this.schema, model, relationField);
     if (m2m) {
-      const parentIds = getIdFields(this.schema, model);
-      const relationIds = getIdFields(this.schema, relationModel);
-      (0, import_common_helpers3.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      (0, import_common_helpers3.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      const parentIds = requireIdFields(this.schema, model);
+      const relationIds = requireIdFields(this.schema, relationModel);
+      (0, import_common_helpers4.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers4.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       selectModelQuery = selectModelQuery.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
@@ -1501,7 +1692,7 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
   }
   buildJsonObject(eb, value) {
     return eb.fn("json_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely3.sql.lit(key),
+      import_kysely4.sql.lit(key),
       value2
     ]));
   }
@@ -1525,6 +1716,24 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
   get supportInsertWithDefault() {
     return false;
   }
+  getFieldSqlType(fieldDef) {
+    if (fieldDef.relation) {
+      throw new QueryError("Cannot get SQL type of a relation field");
+    }
+    if (fieldDef.array) {
+      throw new QueryError("SQLite does not support scalar list type");
+    }
+    if (this.schema.enums?.[fieldDef.type]) {
+      return "text";
+    }
+    return (0, import_ts_pattern4.match)(fieldDef.type).with("String", () => "text").with("Boolean", () => "integer").with("Int", () => "integer").with("BigInt", () => "integer").with("Float", () => "real").with("Decimal", () => "decimal").with("DateTime", () => "numeric").with("Bytes", () => "blob").with("Json", () => "jsonb").otherwise(() => "text");
+  }
+  getStringCasingBehavior() {
+    return {
+      supportsILike: false,
+      likeCaseSensitive: false
+    };
+  }
 };
 
 // src/client/crud/dialects/index.ts
@@ -1534,8 +1743,8 @@ function getCrudDialect(schema, options) {
 __name(getCrudDialect, "getCrudDialect");
 
 // src/utils/default-operation-node-visitor.ts
-var import_kysely4 = require("kysely");
-var DefaultOperationNodeVisitor = class extends import_kysely4.OperationNodeVisitor {
+var import_kysely5 = require("kysely");
+var DefaultOperationNodeVisitor = class extends import_kysely5.OperationNodeVisitor {
   static {
     __name(this, "DefaultOperationNodeVisitor");
   }
@@ -1852,12 +2061,12 @@ var ColumnCollector = class extends DefaultOperationNodeVisitor {
 };
 
 // src/plugins/policy/expression-transformer.ts
-var import_common_helpers5 = require("@zenstackhq/common-helpers");
-var import_kysely6 = require("kysely");
+var import_common_helpers6 = require("@zenstackhq/common-helpers");
+var import_kysely7 = require("kysely");
 var import_ts_pattern7 = require("ts-pattern");
 
 // src/plugins/policy/expression-evaluator.ts
-var import_common_helpers4 = require("@zenstackhq/common-helpers");
+var import_common_helpers5 = require("@zenstackhq/common-helpers");
 var import_ts_pattern6 = require("ts-pattern");
 var ExpressionEvaluator = class {
   static {
@@ -1901,18 +2110,18 @@ var ExpressionEvaluator = class {
     const right = this.evaluate(expr2.right, context);
     return (0, import_ts_pattern6.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
-      (0, import_common_helpers4.invariant)(Array.isArray(_right), 'expected array for "in" operator');
+      (0, import_common_helpers5.invariant)(Array.isArray(_right), 'expected array for "in" operator');
       return _right.includes(left);
     }).exhaustive();
   }
   evaluateCollectionPredicate(expr2, context) {
     const op = expr2.op;
-    (0, import_common_helpers4.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    (0, import_common_helpers5.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
     if (!left) {
       return false;
     }
-    (0, import_common_helpers4.invariant)(Array.isArray(left), "expected array");
+    (0, import_common_helpers5.invariant)(Array.isArray(left), "expected array");
     return (0, import_ts_pattern6.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
       ...context,
       thisValue: item
@@ -1927,21 +2136,21 @@ var ExpressionEvaluator = class {
 };
 
 // src/plugins/policy/utils.ts
-var import_kysely5 = require("kysely");
+var import_kysely6 = require("kysely");
 function trueNode(dialect) {
-  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
+  return import_kysely6.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
 }
 __name(trueNode, "trueNode");
 function falseNode(dialect) {
-  return import_kysely5.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
+  return import_kysely6.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
 }
 __name(falseNode, "falseNode");
 function isTrueNode(node) {
-  return import_kysely5.ValueNode.is(node) && (node.value === true || node.value === 1);
+  return import_kysely6.ValueNode.is(node) && (node.value === true || node.value === 1);
 }
 __name(isTrueNode, "isTrueNode");
 function isFalseNode(node) {
-  return import_kysely5.ValueNode.is(node) && (node.value === false || node.value === 0);
+  return import_kysely6.ValueNode.is(node) && (node.value === false || node.value === 0);
 }
 __name(isFalseNode, "isFalseNode");
 function conjunction(dialect, nodes) {
@@ -1958,7 +2167,7 @@ function conjunction(dialect, nodes) {
   if (items.length === 0) {
     return trueNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely5.AndNode.create(wrapParensIf(acc, import_kysely5.OrNode.is), wrapParensIf(node, import_kysely5.OrNode.is)));
+  return items.reduce((acc, node) => import_kysely6.AndNode.create(wrapParensIf(acc, import_kysely6.OrNode.is), wrapParensIf(node, import_kysely6.OrNode.is)));
 }
 __name(conjunction, "conjunction");
 function disjunction(dialect, nodes) {
@@ -1975,7 +2184,7 @@ function disjunction(dialect, nodes) {
   if (items.length === 0) {
     return falseNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely5.OrNode.create(wrapParensIf(acc, import_kysely5.AndNode.is), wrapParensIf(node, import_kysely5.AndNode.is)));
+  return items.reduce((acc, node) => import_kysely6.OrNode.create(wrapParensIf(acc, import_kysely6.AndNode.is), wrapParensIf(node, import_kysely6.AndNode.is)));
 }
 __name(disjunction, "disjunction");
 function logicalNot(dialect, node) {
@@ -1985,11 +2194,11 @@ function logicalNot(dialect, node) {
   if (isFalseNode(node)) {
     return trueNode(dialect);
   }
-  return import_kysely5.UnaryOperationNode.create(import_kysely5.OperatorNode.create("not"), wrapParensIf(node, (n) => import_kysely5.AndNode.is(n) || import_kysely5.OrNode.is(n)));
+  return import_kysely6.UnaryOperationNode.create(import_kysely6.OperatorNode.create("not"), wrapParensIf(node, (n) => import_kysely6.AndNode.is(n) || import_kysely6.OrNode.is(n)));
 }
 __name(logicalNot, "logicalNot");
 function wrapParensIf(node, predicate) {
-  return predicate(node) ? import_kysely5.ParensNode.create(node) : node;
+  return predicate(node) ? import_kysely6.ParensNode.create(node) : node;
 }
 __name(wrapParensIf, "wrapParensIf");
 function buildIsFalse(node, dialect) {
@@ -1998,13 +2207,13 @@ function buildIsFalse(node, dialect) {
   } else if (isTrueNode(node)) {
     return falseNode(dialect);
   }
-  return import_kysely5.BinaryOperationNode.create(
+  return import_kysely6.BinaryOperationNode.create(
     // coalesce so null is treated as false
-    import_kysely5.FunctionNode.create("coalesce", [
+    import_kysely6.FunctionNode.create("coalesce", [
       node,
       falseNode(dialect)
     ]),
-    import_kysely5.OperatorNode.create("="),
+    import_kysely6.OperatorNode.create("="),
     falseNode(dialect)
   );
 }
@@ -2013,11 +2222,11 @@ function getTableName(node) {
   if (!node) {
     return node;
   }
-  if (import_kysely5.TableNode.is(node)) {
+  if (import_kysely6.TableNode.is(node)) {
     return node.table.identifier.name;
-  } else if (import_kysely5.AliasNode.is(node)) {
+  } else if (import_kysely6.AliasNode.is(node)) {
     return getTableName(node.node);
-  } else if (import_kysely5.ReferenceNode.is(node) && node.table) {
+  } else if (import_kysely6.ReferenceNode.is(node) && node.table) {
     return getTableName(node.table);
   }
   return void 0;
@@ -2050,16 +2259,21 @@ var ExpressionTransformer = class {
   static {
     __name(this, "ExpressionTransformer");
   }
-  schema;
-  clientOptions;
-  auth;
+  client;
   dialect;
-  constructor(schema, clientOptions, auth) {
-    this.schema = schema;
-    this.clientOptions = clientOptions;
-    this.auth = auth;
+  constructor(client) {
+    this.client = client;
     this.dialect = getCrudDialect(this.schema, this.clientOptions);
   }
+  get schema() {
+    return this.client.$schema;
+  }
+  get clientOptions() {
+    return this.client.$options;
+  }
+  get auth() {
+    return this.client.$auth;
+  }
   get authType() {
     if (!this.schema.authType) {
       throw new InternalError('Schema does not have an "authType" specified');
@@ -2077,7 +2291,7 @@ var ExpressionTransformer = class {
     return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
   }
   _array(expr2, context) {
-    return import_kysely6.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
+    return import_kysely7.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
     const fieldDef = requireField(this.schema, context.model, expr2.field);
@@ -2097,18 +2311,18 @@ var ExpressionTransformer = class {
   }
   mergeWhere(where, memberFilter) {
     if (!where) {
-      return import_kysely6.WhereNode.create(memberFilter ?? trueNode(this.dialect));
+      return import_kysely7.WhereNode.create(memberFilter ?? trueNode(this.dialect));
     }
     if (!memberFilter) {
       return where;
     }
-    return import_kysely6.WhereNode.create(conjunction(this.dialect, [
+    return import_kysely7.WhereNode.create(conjunction(this.dialect, [
       where.where,
       memberFilter
     ]));
   }
   _null() {
-    return import_kysely6.ValueNode.createImmediate(null);
+    return import_kysely7.ValueNode.createImmediate(null);
   }
   _binary(expr2, context) {
     if (expr2.op === "&&") {
@@ -2129,45 +2343,82 @@ var ExpressionTransformer = class {
     if (op === "?" || op === "!" || op === "^") {
       return this.transformCollectionPredicate(expr2, context);
     }
-    const left = this.transform(expr2.left, context);
-    const right = this.transform(expr2.right, context);
+    const { normalizedLeft, normalizedRight } = this.normalizeBinaryOperationOperands(expr2, context);
+    const left = this.transform(normalizedLeft, context);
+    const right = this.transform(normalizedRight, context);
     if (op === "in") {
       if (this.isNullNode(left)) {
         return this.transformValue(false, "Boolean");
       } else {
-        if (import_kysely6.ValueListNode.is(right)) {
-          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("in"), right);
+        if (import_kysely7.ValueListNode.is(right)) {
+          return import_kysely7.BinaryOperationNode.create(left, import_kysely7.OperatorNode.create("in"), right);
         } else {
-          return import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("="), import_kysely6.FunctionNode.create("any", [
+          return import_kysely7.BinaryOperationNode.create(left, import_kysely7.OperatorNode.create("="), import_kysely7.FunctionNode.create("any", [
             right
           ]));
         }
       }
     }
     if (this.isNullNode(right)) {
-      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is"), right) : import_kysely6.BinaryOperationNode.create(left, import_kysely6.OperatorNode.create("is not"), right);
+      return this.transformNullCheck(left, expr2.op);
     } else if (this.isNullNode(left)) {
-      return expr2.op === "==" ? import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is"), import_kysely6.ValueNode.createImmediate(null)) : import_kysely6.BinaryOperationNode.create(right, import_kysely6.OperatorNode.create("is not"), import_kysely6.ValueNode.createImmediate(null));
+      return this.transformNullCheck(right, expr2.op);
+    } else {
+      return import_kysely7.BinaryOperationNode.create(left, this.transformOperator(op), right);
+    }
+  }
+  transformNullCheck(expr2, operator) {
+    (0, import_common_helpers6.invariant)(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
+    if (import_kysely7.ValueNode.is(expr2)) {
+      if (expr2.value === null) {
+        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+      } else {
+        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+      }
+    } else {
+      return operator === "==" ? import_kysely7.BinaryOperationNode.create(expr2, import_kysely7.OperatorNode.create("is"), import_kysely7.ValueNode.createImmediate(null)) : import_kysely7.BinaryOperationNode.create(expr2, import_kysely7.OperatorNode.create("is not"), import_kysely7.ValueNode.createImmediate(null));
+    }
+  }
+  normalizeBinaryOperationOperands(expr2, context) {
+    let normalizedLeft = expr2.left;
+    if (this.isRelationField(expr2.left, context.model)) {
+      (0, import_common_helpers6.invariant)(ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      (0, import_common_helpers6.invariant)(leftRelDef, "failed to get relation field definition");
+      const idFields = requireIdFields(this.schema, leftRelDef.type);
+      normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
+    }
+    let normalizedRight = expr2.right;
+    if (this.isRelationField(expr2.right, context.model)) {
+      (0, import_common_helpers6.invariant)(ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      (0, import_common_helpers6.invariant)(rightRelDef, "failed to get relation field definition");
+      const idFields = requireIdFields(this.schema, rightRelDef.type);
+      normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
     }
-    return import_kysely6.BinaryOperationNode.create(left, this.transformOperator(op), right);
+    return {
+      normalizedLeft,
+      normalizedRight
+    };
   }
   transformCollectionPredicate(expr2, context) {
-    (0, import_common_helpers5.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    (0, import_common_helpers6.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
     if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
       const value = new ExpressionEvaluator().evaluate(expr2, {
         auth: this.auth
       });
       return this.transformValue(value, "Boolean");
     }
-    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
+    (0, import_common_helpers6.invariant)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
-    if (ExpressionUtils.isField(expr2.left)) {
-      const fieldDef = requireField(this.schema, context.model, expr2.left.field);
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    if (fieldDef) {
+      (0, import_common_helpers6.invariant)(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
-      (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.left.receiver));
-      const fieldDef = requireField(this.schema, context.model, expr2.left.receiver.field);
-      newContextModel = fieldDef.type;
+      (0, import_common_helpers6.invariant)(ExpressionUtils.isMember(expr2.left) && ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
+      const fieldDef2 = requireField(this.schema, context.model, expr2.left.receiver.field);
+      newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
         const memberDef = requireField(this.schema, newContextModel, member);
         newContextModel = memberDef.type;
@@ -2181,13 +2432,13 @@ var ExpressionTransformer = class {
     if (expr2.op === "!") {
       predicateFilter = logicalNot(this.dialect, predicateFilter);
     }
-    const count = import_kysely6.FunctionNode.create("count", [
-      import_kysely6.ValueNode.createImmediate(1)
+    const count = import_kysely7.FunctionNode.create("count", [
+      import_kysely7.ValueNode.createImmediate(1)
     ]);
-    const predicateResult = (0, import_ts_pattern7.match)(expr2.op).with("?", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create(">"), import_kysely6.ValueNode.createImmediate(0))).with("!", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).with("^", () => import_kysely6.BinaryOperationNode.create(count, import_kysely6.OperatorNode.create("="), import_kysely6.ValueNode.createImmediate(0))).exhaustive();
+    const predicateResult = (0, import_ts_pattern7.match)(expr2.op).with("?", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create(">"), import_kysely7.ValueNode.createImmediate(0))).with("!", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.createImmediate(0))).with("^", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.createImmediate(0))).exhaustive();
     return this.transform(expr2.left, {
       ...context,
-      memberSelect: import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(predicateResult, import_kysely6.IdentifierNode.create("$t"))),
+      memberSelect: import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(predicateResult, import_kysely7.IdentifierNode.create("$t"))),
       memberFilter: predicateFilter
     });
   }
@@ -2212,12 +2463,10 @@ var ExpressionTransformer = class {
         throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
-      (0, import_common_helpers5.invariant)(idFields.length > 0, "auth type model must have at least one id field");
+      (0, import_common_helpers6.invariant)(idFields.length > 0, "auth type model must have at least one id field");
       const conditions = idFields.map((fieldName) => ExpressionUtils.binary(ExpressionUtils.member(authExpr, [
         fieldName
-      ]), "==", ExpressionUtils.member(other, [
-        fieldName
-      ])));
+      ]), "==", this.makeOrAppendMember(other, fieldName)));
       let result = this.buildAnd(conditions);
       if (expr2.op === "!=") {
         result = this.buildLogicalNot(result);
@@ -2225,33 +2474,65 @@ var ExpressionTransformer = class {
       return this.transform(result, context);
     }
   }
+  makeOrAppendMember(other, fieldName) {
+    if (ExpressionUtils.isMember(other)) {
+      return ExpressionUtils.member(other.receiver, [
+        ...other.members,
+        fieldName
+      ]);
+    } else {
+      return ExpressionUtils.member(other, [
+        fieldName
+      ]);
+    }
+  }
   transformValue(value, type) {
-    return import_kysely6.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+    if (value === true) {
+      return trueNode(this.dialect);
+    } else if (value === false) {
+      return falseNode(this.dialect);
+    } else {
+      return import_kysely7.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+    }
   }
   _unary(expr2, context) {
-    (0, import_common_helpers5.invariant)(expr2.op === "!", 'only "!" operator is supported');
+    (0, import_common_helpers6.invariant)(expr2.op === "!", 'only "!" operator is supported');
     return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
     const mappedOp = (0, import_ts_pattern7.match)(op).with("==", () => "=").otherwise(() => op);
-    return import_kysely6.OperatorNode.create(mappedOp);
+    return import_kysely7.OperatorNode.create(mappedOp);
   }
   _call(expr2, context) {
     const result = this.transformCall(expr2, context);
     return result.toOperationNode();
   }
   transformCall(expr2, context) {
-    const func = this.clientOptions.functions?.[expr2.function];
+    const func = this.getFunctionImpl(expr2.function);
     if (!func) {
       throw new QueryError(`Function not implemented: ${expr2.function}`);
     }
-    const eb = (0, import_kysely6.expressionBuilder)();
+    const eb = (0, import_kysely7.expressionBuilder)();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
+      client: this.client,
       dialect: this.dialect,
       model: context.model,
+      modelAlias: context.alias ?? context.model,
       operation: context.operation
     });
   }
+  getFunctionImpl(functionName) {
+    let func = this.clientOptions.functions?.[functionName];
+    if (!func) {
+      for (const plugin of this.clientOptions.plugins ?? []) {
+        if (plugin.functions?.[functionName]) {
+          func = plugin.functions[functionName];
+          break;
+        }
+      }
+    }
+    return func;
+  }
   transformCallArg(eb, arg, context) {
     if (ExpressionUtils.isLiteral(arg)) {
       return eb.val(arg.value);
@@ -2272,23 +2553,22 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
-    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    (0, import_common_helpers6.invariant)(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
     let members = expr2.members;
     let receiver;
     const { memberFilter, memberSelect, ...restContext } = context;
     if (ExpressionUtils.isThis(expr2.receiver)) {
       if (expr2.members.length === 1) {
-        const fieldDef = requireField(this.schema, context.model, expr2.members[0]);
-        (0, import_common_helpers5.invariant)(!fieldDef.relation, "this.relation access should have been transformed into relation access");
-        return this.createColumnRef(expr2.members[0], restContext);
+        return this._field(ExpressionUtils.field(expr2.members[0]), context);
+      } else {
+        const firstMemberFieldDef = requireField(this.schema, context.model, expr2.members[0]);
+        receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
+        members = expr2.members.slice(1);
       }
-      const firstMemberFieldDef = requireField(this.schema, context.model, expr2.members[0]);
-      receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
-      members = expr2.members.slice(1);
     } else {
       receiver = this.transform(expr2.receiver, restContext);
     }
-    (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(receiver), "expected receiver to be select query");
+    (0, import_common_helpers6.invariant)(import_kysely7.SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (ExpressionUtils.isField(expr2.receiver)) {
       const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
@@ -2317,11 +2597,11 @@ var ExpressionTransformer = class {
           alias: void 0
         });
         if (currNode) {
-          (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(currNode), "expected select query node");
+          (0, import_common_helpers6.invariant)(import_kysely7.SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
-              import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create(members[i + 1])))
+              import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(currNode, import_kysely7.IdentifierNode.create(members[i + 1])))
             ]
           };
         } else {
@@ -2334,21 +2614,21 @@ var ExpressionTransformer = class {
           };
         }
       } else {
-        (0, import_common_helpers5.invariant)(i === members.length - 1, "plain field access must be the last segment");
-        (0, import_common_helpers5.invariant)(!currNode, "plain field access must be the last segment");
-        currNode = import_kysely6.ColumnNode.create(member);
+        (0, import_common_helpers6.invariant)(i === members.length - 1, "plain field access must be the last segment");
+        (0, import_common_helpers6.invariant)(!currNode, "plain field access must be the last segment");
+        currNode = import_kysely7.ColumnNode.create(member);
       }
     }
     return {
       ...receiver,
       selections: [
-        import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create("$t")))
+        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(currNode, import_kysely7.IdentifierNode.create("$t")))
       ]
     };
   }
   valueMemberAccess(receiver, expr2, receiverType) {
     if (!receiver) {
-      return import_kysely6.ValueNode.createImmediate(null);
+      return import_kysely7.ValueNode.createImmediate(null);
     }
     if (expr2.members.length !== 1) {
       throw new Error(`Only single member access is supported`);
@@ -2359,24 +2639,33 @@ var ExpressionTransformer = class {
     return this.transformValue(fieldValue, fieldDef.type);
   }
   transformRelationAccess(field, relationModel, context) {
+    const m2m = getManyToManyRelation(this.schema, context.model, field);
+    if (m2m) {
+      return this.transformManyToManyRelationAccess(m2m, context);
+    }
     const fromModel = context.model;
     const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
     if (ownedByModel) {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely7.BinaryOperationNode.create(import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(fk), import_kysely7.TableNode.create(context.alias ?? fromModel)), import_kysely7.OperatorNode.create("="), import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(pk), import_kysely7.TableNode.create(relationModel)))));
     } else {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely7.BinaryOperationNode.create(import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(pk), import_kysely7.TableNode.create(context.alias ?? fromModel)), import_kysely7.OperatorNode.create("="), import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(fk), import_kysely7.TableNode.create(relationModel)))));
     }
     return {
       kind: "SelectQueryNode",
-      from: import_kysely6.FromNode.create([
-        import_kysely6.TableNode.create(relationModel)
+      from: import_kysely7.FromNode.create([
+        import_kysely7.TableNode.create(relationModel)
       ]),
-      where: import_kysely6.WhereNode.create(condition)
+      where: import_kysely7.WhereNode.create(condition)
     };
   }
+  transformManyToManyRelationAccess(m2m, context) {
+    const eb = (0, import_kysely7.expressionBuilder)();
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    return relationQuery.toOperationNode();
+  }
   createColumnRef(column, context) {
-    return import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(column), import_kysely6.TableNode.create(context.alias ?? context.model));
+    return import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(column), import_kysely7.TableNode.create(context.alias ?? context.model));
   }
   isAuthCall(value) {
     return ExpressionUtils.isCall(value) && value.function === "auth";
@@ -2385,7 +2674,7 @@ var ExpressionTransformer = class {
     return ExpressionUtils.isMember(expr2) && this.isAuthCall(expr2.receiver);
   }
   isNullNode(node) {
-    return import_kysely6.ValueNode.is(node) && node.value === null;
+    return import_kysely7.ValueNode.is(node) && node.value === null;
   }
   buildLogicalNot(result) {
     return ExpressionUtils.unary("!", result);
@@ -2399,6 +2688,19 @@ var ExpressionTransformer = class {
       return conditions.reduce((acc, condition) => ExpressionUtils.binary(acc, "&&", condition));
     }
   }
+  isRelationField(expr2, model) {
+    const fieldDef = this.getFieldDefFromFieldRef(expr2, model);
+    return !!fieldDef?.relation;
+  }
+  getFieldDefFromFieldRef(expr2, model) {
+    if (ExpressionUtils.isField(expr2)) {
+      return requireField(this.schema, model, expr2.field);
+    } else if (ExpressionUtils.isMember(expr2) && expr2.members.length === 1 && ExpressionUtils.isThis(expr2.receiver)) {
+      return requireField(this.schema, model, expr2.members[0]);
+    } else {
+      return void 0;
+    }
+  }
 };
 _ts_decorate([
   expr("literal"),
@@ -2470,7 +2772,7 @@ _ts_decorate([
 ], ExpressionTransformer.prototype, "_member", null);
 
 // src/plugins/policy/policy-handler.ts
-var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
+var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
   static {
     __name(this, "PolicyHandler");
   }
@@ -2485,129 +2787,296 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
   }
   async handle(node, proceed) {
     if (!this.isCrudQueryNode(node)) {
-      throw new RejectedByPolicyError(void 0, "non-CRUD queries are not allowed");
+      throw new RejectedByPolicyError(void 0, RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
     }
     if (!this.isMutationQueryNode(node)) {
       return proceed(this.transformNode(node));
     }
-    let mutationRequiresTransaction = false;
-    const mutationModel = this.getMutationModel(node);
-    if (import_kysely7.InsertQueryNode.is(node)) {
-      const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
-      if (constCondition === false) {
-        throw new RejectedByPolicyError(mutationModel);
-      } else if (constCondition === void 0) {
-        mutationRequiresTransaction = true;
+    const { mutationModel } = this.getMutationModel(node);
+    if (import_kysely8.InsertQueryNode.is(node)) {
+      const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
+      let needCheckPreCreate = true;
+      if (!isManyToManyJoinTable) {
+        const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
+        if (constCondition === true) {
+          needCheckPreCreate = false;
+        } else if (constCondition === false) {
+          throw new RejectedByPolicyError(mutationModel);
+        }
+      }
+      if (needCheckPreCreate) {
+        await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
       }
     }
-    if (!mutationRequiresTransaction && !node.returning) {
-      return proceed(this.transformNode(node));
-    }
-    if (import_kysely7.InsertQueryNode.is(node)) {
-      await this.enforcePreCreatePolicy(node, proceed);
-    }
-    const transformedNode = this.transformNode(node);
-    const result = await proceed(transformedNode);
-    if (!this.onlyReturningId(node)) {
+    const result = await proceed(this.transformNode(node));
+    if (!node.returning || this.onlyReturningId(node)) {
+      return result;
+    } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
-        throw new RejectedByPolicyError(mutationModel, "result is not allowed to be read back");
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       }
       return readBackResult;
-    } else {
+    }
+  }
+  // #region overrides
+  transformSelectQuery(node) {
+    let whereNode = this.transformNode(node.where);
+    const policyFilter = this.createPolicyFilterForFrom(node.from);
+    if (policyFilter) {
+      whereNode = import_kysely8.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
+        whereNode.where,
+        policyFilter
+      ]) : policyFilter);
+    }
+    const baseResult = super.transformSelectQuery({
+      ...node,
+      where: void 0
+    });
+    return {
+      ...baseResult,
+      where: whereNode
+    };
+  }
+  transformJoin(node) {
+    const table = this.extractTableName(node.table);
+    if (!table) {
+      return super.transformJoin(node);
+    }
+    const filter = this.buildPolicyFilter(table.model, table.alias, "read");
+    const nestedSelect = {
+      kind: "SelectQueryNode",
+      from: import_kysely8.FromNode.create([
+        node.table
+      ]),
+      selections: [
+        import_kysely8.SelectionNode.createSelectAll()
+      ],
+      where: import_kysely8.WhereNode.create(filter)
+    };
+    return {
+      ...node,
+      table: import_kysely8.AliasNode.create(import_kysely8.ParensNode.create(nestedSelect), import_kysely8.IdentifierNode.create(table.alias ?? table.model))
+    };
+  }
+  transformInsertQuery(node) {
+    let onConflict = node.onConflict;
+    if (onConflict?.updates) {
+      const { mutationModel, alias } = this.getMutationModel(node);
+      const filter = this.buildPolicyFilter(mutationModel, alias, "update");
+      if (onConflict.updateWhere) {
+        onConflict = {
+          ...onConflict,
+          updateWhere: import_kysely8.WhereNode.create(conjunction(this.dialect, [
+            onConflict.updateWhere.where,
+            filter
+          ]))
+        };
+      } else {
+        onConflict = {
+          ...onConflict,
+          updateWhere: import_kysely8.WhereNode.create(filter)
+        };
+      }
+    }
+    const processedNode = onConflict ? {
+      ...node,
+      onConflict
+    } : node;
+    const result = super.transformInsertQuery(processedNode);
+    if (!node.returning) {
+      return result;
+    }
+    if (this.onlyReturningId(node)) {
       return result;
+    } else {
+      const { mutationModel } = this.getMutationModel(node);
+      const idFields = requireIdFields(this.client.$schema, mutationModel);
+      return {
+        ...result,
+        returning: import_kysely8.ReturningNode.create(idFields.map((field) => import_kysely8.SelectionNode.create(import_kysely8.ColumnNode.create(field))))
+      };
+    }
+  }
+  transformUpdateQuery(node) {
+    const result = super.transformUpdateQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "update");
+    if (node.from) {
+      const joinFilter = this.createPolicyFilterForFrom(node.from);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
     }
+    return {
+      ...result,
+      where: import_kysely8.WhereNode.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
   }
+  transformDeleteQuery(node) {
+    const result = super.transformDeleteQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "delete");
+    if (node.using) {
+      const joinFilter = this.createPolicyFilterForTables(node.using.tables);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    return {
+      ...result,
+      where: import_kysely8.WhereNode.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  // #endregion
+  // #region helpers
   onlyReturningId(node) {
     if (!node.returning) {
       return true;
     }
-    const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
+    const { mutationModel } = this.getMutationModel(node);
+    const idFields = requireIdFields(this.client.$schema, mutationModel);
     const collector = new ColumnCollector();
     const selectedColumns = collector.collect(node.returning);
     return selectedColumns.every((c) => idFields.includes(c));
   }
-  async enforcePreCreatePolicy(node, proceed) {
-    const model = this.getMutationModel(node);
+  async enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed) {
     const fields = node.columns?.map((c) => c.column.name) ?? [];
-    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, model, fields) : [
+    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, mutationModel, fields, isManyToManyJoinTable) : [
       []
     ];
     for (const values of valueRows) {
-      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), proceed);
+      if (isManyToManyJoinTable) {
+        await this.enforcePreCreatePolicyForManyToManyJoinTable(mutationModel, fields, values.map((v) => v.node), proceed);
+      } else {
+        await this.enforcePreCreatePolicyForOne(mutationModel, fields, values.map((v) => v.node), proceed);
+      }
+    }
+  }
+  async enforcePreCreatePolicyForManyToManyJoinTable(tableName, fields, values, proceed) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    (0, import_common_helpers7.invariant)(m2m);
+    (0, import_common_helpers7.invariant)(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
+    const aIndex = fields.indexOf("A");
+    const aNode = values[aIndex];
+    const bIndex = fields.indexOf("B");
+    const bNode = values[bIndex];
+    (0, import_common_helpers7.invariant)(import_kysely8.ValueNode.is(aNode) && import_kysely8.ValueNode.is(bNode), "A and B values must be ValueNode");
+    const aValue = aNode.value;
+    const bValue = bNode.value;
+    (0, import_common_helpers7.invariant)(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
+    (0, import_common_helpers7.invariant)(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
+    const eb = (0, import_kysely8.expressionBuilder)();
+    const filterA = this.buildPolicyFilter(m2m.firstModel, void 0, "update");
+    const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new import_kysely8.ExpressionWrapper(filterA).as("$t"));
+    const filterB = this.buildPolicyFilter(m2m.secondModel, void 0, "update");
+    const queryB = eb.selectFrom(m2m.secondModel).where(eb(eb.ref(`${m2m.secondModel}.${m2m.secondIdField}`), "=", bValue)).select(() => new import_kysely8.ExpressionWrapper(filterB).as("$t"));
+    const queryNode = {
+      kind: "SelectQueryNode",
+      selections: [
+        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(queryA.toOperationNode(), import_kysely8.IdentifierNode.create("$conditionA"))),
+        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(queryB.toOperationNode(), import_kysely8.IdentifierNode.create("$conditionB")))
+      ]
+    };
+    const result = await proceed(queryNode);
+    if (!result.rows[0]?.$conditionA) {
+      throw new RejectedByPolicyError(m2m.firstModel, RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+    }
+    if (!result.rows[0]?.$conditionB) {
+      throw new RejectedByPolicyError(m2m.secondModel, RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
     }
   }
   async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
-    const allFields = Object.keys(requireModel(this.client.$schema, model).fields);
+    const allFields = Object.entries(requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
     const allValues = [];
-    for (const fieldName of allFields) {
-      const index = fields.indexOf(fieldName);
+    for (const [name, _def] of allFields) {
+      const index = fields.indexOf(name);
       if (index >= 0) {
         allValues.push(values[index]);
       } else {
-        allValues.push(import_kysely7.ValueNode.createImmediate(null));
+        allValues.push(import_kysely8.ValueNode.createImmediate(null));
       }
     }
+    const eb = (0, import_kysely8.expressionBuilder)();
     const constTable = {
       kind: "SelectQueryNode",
-      from: import_kysely7.FromNode.create([
-        import_kysely7.AliasNode.create(import_kysely7.ParensNode.create(import_kysely7.ValuesNode.create([
-          import_kysely7.ValueListNode.create(allValues)
-        ])), import_kysely7.IdentifierNode.create("$t"))
+      from: import_kysely8.FromNode.create([
+        import_kysely8.AliasNode.create(import_kysely8.ParensNode.create(import_kysely8.ValuesNode.create([
+          import_kysely8.ValueListNode.create(allValues)
+        ])), import_kysely8.IdentifierNode.create("$t"))
       ]),
-      selections: allFields.map((field, index) => import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(import_kysely7.ColumnNode.create(`column${index + 1}`), import_kysely7.IdentifierNode.create(field))))
+      selections: allFields.map(([name, def], index) => {
+        const castedColumnRef = import_kysely8.sql`CAST(${eb.ref(`column${index + 1}`)} as ${import_kysely8.sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+        return import_kysely8.SelectionNode.create(castedColumnRef.toOperationNode());
+      })
     };
     const filter = this.buildPolicyFilter(model, void 0, "create");
     const preCreateCheck = {
       kind: "SelectQueryNode",
-      from: import_kysely7.FromNode.create([
-        import_kysely7.AliasNode.create(constTable, import_kysely7.IdentifierNode.create(model))
+      from: import_kysely8.FromNode.create([
+        import_kysely8.AliasNode.create(constTable, import_kysely8.IdentifierNode.create(model))
       ]),
       selections: [
-        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(import_kysely7.BinaryOperationNode.create(import_kysely7.FunctionNode.create("COUNT", [
-          import_kysely7.ValueNode.createImmediate(1)
-        ]), import_kysely7.OperatorNode.create(">"), import_kysely7.ValueNode.createImmediate(0)), import_kysely7.IdentifierNode.create("$condition")))
+        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(import_kysely8.BinaryOperationNode.create(import_kysely8.FunctionNode.create("COUNT", [
+          import_kysely8.ValueNode.createImmediate(1)
+        ]), import_kysely8.OperatorNode.create(">"), import_kysely8.ValueNode.createImmediate(0)), import_kysely8.IdentifierNode.create("$condition")))
       ],
-      where: import_kysely7.WhereNode.create(filter)
+      where: import_kysely8.WhereNode.create(filter)
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
       throw new RejectedByPolicyError(model);
     }
   }
-  unwrapCreateValueRows(node, model, fields) {
-    if (import_kysely7.ValuesNode.is(node)) {
-      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields));
-    } else if (import_kysely7.PrimitiveValueListNode.is(node)) {
+  unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
+    if (import_kysely8.ValuesNode.is(node)) {
+      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields, isManyToManyJoinTable));
+    } else if (import_kysely8.PrimitiveValueListNode.is(node)) {
       return [
-        this.unwrapCreateValueRow(node.values, model, fields)
+        this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
       ];
     } else {
       throw new InternalError(`Unexpected node kind: ${node.kind} for unwrapping create values`);
     }
   }
-  unwrapCreateValueRow(data, model, fields) {
-    (0, import_common_helpers6.invariant)(data.length === fields.length, "data length must match fields length");
+  unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
+    (0, import_common_helpers7.invariant)(data.length === fields.length, "data length must match fields length");
     const result = [];
     for (let i = 0; i < data.length; i++) {
       const item = data[i];
-      const fieldDef = requireField(this.client.$schema, model, fields[i]);
       if (typeof item === "object" && item && "kind" in item) {
-        (0, import_common_helpers6.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
+        const fieldDef = requireField(this.client.$schema, model, fields[i]);
+        (0, import_common_helpers7.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
         result.push({
-          node: import_kysely7.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
+          node: import_kysely8.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
           raw: item.value
         });
       } else {
-        const value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        let value = item;
+        if (!isImplicitManyToManyJoinTable) {
+          const fieldDef = requireField(this.client.$schema, model, fields[i]);
+          value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        }
         if (Array.isArray(value)) {
           result.push({
-            node: import_kysely7.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
+            node: import_kysely8.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
             raw: value
           });
         } else {
           result.push({
-            node: import_kysely7.ValueNode.create(value),
+            node: import_kysely8.ValueNode.create(value),
             raw: value
           });
         }
@@ -2643,18 +3112,15 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     if (!this.isMutationQueryNode(node) || !node.returning) {
       return result;
     }
-    const table = this.getMutationModel(node);
-    if (!table) {
-      throw new InternalError(`Unable to get table name for query node: ${node}`);
-    }
-    const idConditions = this.buildIdConditions(table, result.rows);
-    const policyFilter = this.buildPolicyFilter(table, void 0, "read");
+    const { mutationModel } = this.getMutationModel(node);
+    const idConditions = this.buildIdConditions(mutationModel, result.rows);
+    const policyFilter = this.buildPolicyFilter(mutationModel, void 0, "read");
     const select = {
       kind: "SelectQueryNode",
-      from: import_kysely7.FromNode.create([
-        import_kysely7.TableNode.create(table)
+      from: import_kysely8.FromNode.create([
+        import_kysely8.TableNode.create(mutationModel)
       ]),
-      where: import_kysely7.WhereNode.create(conjunction(this.dialect, [
+      where: import_kysely8.WhereNode.create(conjunction(this.dialect, [
         idConditions,
         policyFilter
       ])),
@@ -2664,143 +3130,122 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     return selectResult;
   }
   buildIdConditions(table, rows) {
-    const idFields = getIdFields(this.client.$schema, table);
-    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely7.BinaryOperationNode.create(import_kysely7.ColumnNode.create(field), import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.create(row[field]))))));
+    const idFields = requireIdFields(this.client.$schema, table);
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely8.BinaryOperationNode.create(import_kysely8.ColumnNode.create(field), import_kysely8.OperatorNode.create("="), import_kysely8.ValueNode.create(row[field]))))));
   }
   getMutationModel(node) {
-    const r = (0, import_ts_pattern8.match)(node).when(import_kysely7.InsertQueryNode.is, (node2) => getTableName(node2.into)).when(import_kysely7.UpdateQueryNode.is, (node2) => getTableName(node2.table)).when(import_kysely7.DeleteQueryNode.is, (node2) => {
+    const r = (0, import_ts_pattern8.match)(node).when(import_kysely8.InsertQueryNode.is, (node2) => ({
+      mutationModel: getTableName(node2.into),
+      alias: void 0
+    })).when(import_kysely8.UpdateQueryNode.is, (node2) => {
+      if (!node2.table) {
+        throw new QueryError("Update query must have a table");
+      }
+      const r2 = this.extractTableName(node2.table);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
+    }).when(import_kysely8.DeleteQueryNode.is, (node2) => {
       if (node2.from.froms.length !== 1) {
-        throw new InternalError("Only one from table is supported for delete");
+        throw new QueryError("Only one from table is supported for delete");
       }
-      return getTableName(node2.from.froms[0]);
+      const r2 = this.extractTableName(node2.from.froms[0]);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
     }).exhaustive();
     if (!r) {
-      throw new InternalError(`Unable to get table name for query node: ${node}`);
-    }
-    return r;
-  }
-  isCrudQueryNode(node) {
-    return import_kysely7.SelectQueryNode.is(node) || import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
-  }
-  isMutationQueryNode(node) {
-    return import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
-  }
-  buildPolicyFilter(model, alias, operation) {
-    const policies = this.getModelPolicies(model, operation);
-    if (policies.length === 0) {
-      return falseNode(this.dialect);
-    }
-    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
-    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
-    let combinedPolicy;
-    if (allows.length === 0) {
-      combinedPolicy = falseNode(this.dialect);
-    } else {
-      combinedPolicy = disjunction(this.dialect, allows);
-      if (denies.length !== 0) {
-        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
-        combinedPolicy = conjunction(this.dialect, [
-          combinedPolicy,
-          combinedDenies
-        ]);
-      }
-    }
-    return combinedPolicy;
-  }
-  transformSelectQuery(node) {
-    let whereNode = node.where;
-    node.from?.froms.forEach((from) => {
-      const extractResult = this.extractTableName(from);
-      if (extractResult) {
-        const { model, alias } = extractResult;
-        const filter = this.buildPolicyFilter(model, alias, "read");
-        whereNode = import_kysely7.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
-          whereNode.where,
-          filter
-        ]) : filter);
-      }
-    });
-    const baseResult = super.transformSelectQuery({
-      ...node,
-      where: void 0
-    });
-    return {
-      ...baseResult,
-      where: whereNode
-    };
-  }
-  transformInsertQuery(node) {
-    const result = super.transformInsertQuery(node);
-    if (!node.returning) {
-      return result;
-    }
-    if (this.onlyReturningId(node)) {
-      return result;
-    } else {
-      const idFields = getIdFields(this.client.$schema, this.getMutationModel(node));
-      return {
-        ...result,
-        returning: import_kysely7.ReturningNode.create(idFields.map((field) => import_kysely7.SelectionNode.create(import_kysely7.ColumnNode.create(field))))
-      };
+      throw new InternalError(`Unable to get table name for query node: ${node}`);
     }
+    return r;
   }
-  transformUpdateQuery(node) {
-    const result = super.transformUpdateQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "update");
-    return {
-      ...result,
-      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
+  isCrudQueryNode(node) {
+    return import_kysely8.SelectQueryNode.is(node) || import_kysely8.InsertQueryNode.is(node) || import_kysely8.UpdateQueryNode.is(node) || import_kysely8.DeleteQueryNode.is(node);
   }
-  transformDeleteQuery(node) {
-    const result = super.transformDeleteQuery(node);
-    const mutationModel = this.getMutationModel(node);
-    const filter = this.buildPolicyFilter(mutationModel, void 0, "delete");
-    return {
-      ...result,
-      where: import_kysely7.WhereNode.create(result.where ? conjunction(this.dialect, [
-        result.where.where,
-        filter
-      ]) : filter)
-    };
+  isMutationQueryNode(node) {
+    return import_kysely8.InsertQueryNode.is(node) || import_kysely8.UpdateQueryNode.is(node) || import_kysely8.DeleteQueryNode.is(node);
+  }
+  buildPolicyFilter(model, alias, operation) {
+    const m2mFilter = this.getModelPolicyFilterForManyToManyJoinTable(model, alias, operation);
+    if (m2mFilter) {
+      return m2mFilter;
+    }
+    const policies = this.getModelPolicies(model, operation);
+    if (policies.length === 0) {
+      return falseNode(this.dialect);
+    }
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    let combinedPolicy;
+    if (allows.length === 0) {
+      combinedPolicy = falseNode(this.dialect);
+    } else {
+      combinedPolicy = disjunction(this.dialect, allows);
+      if (denies.length !== 0) {
+        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+        combinedPolicy = conjunction(this.dialect, [
+          combinedPolicy,
+          combinedDenies
+        ]);
+      }
+    }
+    return combinedPolicy;
   }
-  extractTableName(from) {
-    if (import_kysely7.TableNode.is(from)) {
+  extractTableName(node) {
+    if (import_kysely8.TableNode.is(node)) {
       return {
-        model: from.table.identifier.name
+        model: node.table.identifier.name
       };
     }
-    if (import_kysely7.AliasNode.is(from)) {
-      const inner = this.extractTableName(from.node);
+    if (import_kysely8.AliasNode.is(node)) {
+      const inner = this.extractTableName(node.node);
       if (!inner) {
         return void 0;
       }
       return {
         model: inner.model,
-        alias: import_kysely7.IdentifierNode.is(from.alias) ? from.alias.name : void 0
+        alias: import_kysely8.IdentifierNode.is(node.alias) ? node.alias.name : void 0
       };
     } else {
       return void 0;
     }
   }
-  transformPolicyCondition(model, alias, operation, policy) {
-    return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
+  createPolicyFilterForFrom(node) {
+    if (!node) {
+      return void 0;
+    }
+    return this.createPolicyFilterForTables(node.froms);
+  }
+  createPolicyFilterForTables(tables) {
+    return tables.reduce((acc, table) => {
+      const extractResult = this.extractTableName(table);
+      if (extractResult) {
+        const { model, alias } = extractResult;
+        const filter = this.buildPolicyFilter(model, alias, "read");
+        return acc ? conjunction(this.dialect, [
+          acc,
+          filter
+        ]) : filter;
+      }
+      return acc;
+    }, void 0);
+  }
+  compilePolicyCondition(model, alias, operation, policy) {
+    return new ExpressionTransformer(this.client).transform(policy.condition, {
       model,
       alias,
       operation,
       auth: this.client.$auth
     });
   }
-  getModelPolicies(modelName, operation) {
-    const modelDef = requireModel(this.client.$schema, modelName);
+  getModelPolicies(model, operation) {
+    const modelDef = requireModel(this.client.$schema, model);
     const result = [];
     const extractOperations = /* @__PURE__ */ __name((expr2) => {
-      (0, import_common_helpers6.invariant)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
-      (0, import_common_helpers6.invariant)(typeof expr2.value === "string", "expecting a string literal");
+      (0, import_common_helpers7.invariant)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
+      (0, import_common_helpers7.invariant)(typeof expr2.value === "string", "expecting a string literal");
       return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
     }, "extractOperations");
     if (modelDef.attributes) {
@@ -2812,8 +3257,84 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     }
     return result;
   }
+  resolveManyToManyJoinTable(tableName) {
+    for (const model of Object.values(this.client.$schema.models)) {
+      for (const field of Object.values(model.fields)) {
+        const m2m = getManyToManyRelation(this.client.$schema, model.name, field.name);
+        if (m2m?.joinTable === tableName) {
+          const sortedRecord = [
+            {
+              model: model.name,
+              field: field.name
+            },
+            {
+              model: m2m.otherModel,
+              field: m2m.otherField
+            }
+          ].sort(this.manyToManySorter);
+          const firstIdFields = requireIdFields(this.client.$schema, sortedRecord[0].model);
+          const secondIdFields = requireIdFields(this.client.$schema, sortedRecord[1].model);
+          (0, import_common_helpers7.invariant)(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
+          return {
+            firstModel: sortedRecord[0].model,
+            firstField: sortedRecord[0].field,
+            firstIdField: firstIdFields[0],
+            secondModel: sortedRecord[1].model,
+            secondField: sortedRecord[1].field,
+            secondIdField: secondIdFields[0]
+          };
+        }
+      }
+    }
+    return void 0;
+  }
+  manyToManySorter(a, b) {
+    return a.model !== b.model ? a.model.localeCompare(b.model) : a.field.localeCompare(b.field);
+  }
+  isManyToManyJoinTable(tableName) {
+    return !!this.resolveManyToManyJoinTable(tableName);
+  }
+  getModelPolicyFilterForManyToManyJoinTable(tableName, alias, operation) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    if (!m2m) {
+      return void 0;
+    }
+    const checkForOperation = operation === "read" ? "read" : "update";
+    const eb = (0, import_kysely8.expressionBuilder)();
+    const joinTable = alias ?? tableName;
+    const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new import_kysely8.ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
+    const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new import_kysely8.ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
+    return eb.and([
+      aQuery,
+      bQuery
+    ]).toOperationNode();
+  }
 };
 
+// src/plugins/policy/functions.ts
+var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, operation }) => {
+  (0, import_common_helpers8.invariant)(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
+  const arg1Node = args[0].toOperationNode();
+  const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
+  if (arg2Node) {
+    (0, import_common_helpers8.invariant)(import_kysely9.ValueNode.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
+    (0, import_common_helpers8.invariant)(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+  }
+  const fieldName = extractFieldName(arg1Node);
+  (0, import_common_helpers8.invariant)(fieldName, 'Failed to extract field name from the first argument of "check" function');
+  const fieldDef = requireField(client.$schema, model, fieldName);
+  (0, import_common_helpers8.invariant)(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
+  (0, import_common_helpers8.invariant)(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
+  const relationModel = fieldDef.type;
+  const op = arg2Node ? arg2Node.value : operation;
+  const policyHandler = new PolicyHandler(client);
+  const joinPairs = buildJoinPairs(client.$schema, model, modelAlias, fieldName, relationModel);
+  const joinCondition = joinPairs.length === 1 ? eb(eb.ref(joinPairs[0][0]), "=", eb.ref(joinPairs[0][1])) : eb.and(joinPairs.map(([left, right]) => eb(eb.ref(left), "=", eb.ref(right))));
+  const policyCondition = policyHandler.buildPolicyFilter(relationModel, void 0, op);
+  const result = eb.selectFrom(relationModel).where(joinCondition).select(new import_kysely9.ExpressionWrapper(policyCondition).as("$condition"));
+  return result;
+}, "check");
+
 // src/plugins/policy/plugin.ts
 var PolicyPlugin = class {
   static {
@@ -2828,6 +3349,11 @@ var PolicyPlugin = class {
   get description() {
     return "Enforces access policies defined in the schema.";
   }
+  get functions() {
+    return {
+      check
+    };
+  }
   onKyselyQuery({
     query,
     client,
@@ -2844,13 +3370,13 @@ var PolicyPlugin = class {
 };
 
 // src/utils/clone.ts
-var import_common_helpers7 = require("@zenstackhq/common-helpers");
+var import_common_helpers9 = require("@zenstackhq/common-helpers");
 function clone(value) {
   if (Array.isArray(value)) {
     return value.map((v) => clone(v));
   }
   if (typeof value === "object") {
-    if (!value || !(0, import_common_helpers7.isPlainObject)(value)) {
+    if (!value || !(0, import_common_helpers9.isPlainObject)(value)) {
       return value;
     }
     const result = {};
@@ -2863,16 +3389,6 @@ function clone(value) {
 }
 __name(clone, "clone");
 
-// src/client/contract.ts
-var TransactionIsolationLevel = /* @__PURE__ */ function(TransactionIsolationLevel2) {
-  TransactionIsolationLevel2["ReadUncommitted"] = "read uncommitted";
-  TransactionIsolationLevel2["ReadCommitted"] = "read committed";
-  TransactionIsolationLevel2["RepeatableRead"] = "repeatable read";
-  TransactionIsolationLevel2["Serializable"] = "serializable";
-  TransactionIsolationLevel2["Snapshot"] = "snapshot";
-  return TransactionIsolationLevel2;
-}({});
-
 // src/client/crud/operations/base.ts
 var BaseOperationHandler = class {
   static {
@@ -2917,7 +3433,7 @@ var BaseOperationHandler = class {
     return getField(this.schema, model, field);
   }
   async exists(kysely, model, filter) {
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     const _filter = flattenCompoundUniqueFilters(this.schema, model, filter);
     const query = kysely.selectFrom(model).where((eb) => eb.and(_filter)).select(idFields.map((f) => kysely.dynamic.ref(f))).limit(1).modifyEnd(this.makeContextComment({
       model,
@@ -2926,7 +3442,7 @@ var BaseOperationHandler = class {
     return this.executeQueryTakeFirst(kysely, query, "exists");
   }
   async read(kysely, model, args) {
-    let query = this.dialect.buildSelectModel((0, import_kysely8.expressionBuilder)(), model, model);
+    let query = this.dialect.buildSelectModel((0, import_kysely10.expressionBuilder)(), model, model);
     if (args) {
       query = this.dialect.buildFilterSortTake(model, args, query, model);
     }
@@ -3005,7 +3521,7 @@ var BaseOperationHandler = class {
       if (!m2m) {
         const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, fromRelation?.model ?? "", fromRelation?.field ?? "");
         if (!ownedByModel) {
-          const parentFkFields = this.buildFkAssignments(fromRelation.model, fromRelation.field, fromRelation.ids);
+          const parentFkFields = await this.buildFkAssignments(kysely, fromRelation.model, fromRelation.field, fromRelation.ids);
           Object.assign(createFields, parentFkFields);
         } else {
           updateParent = /* @__PURE__ */ __name((entity) => {
@@ -3045,17 +3561,16 @@ var BaseOperationHandler = class {
       createFields = baseCreateResult.remainingFields;
     }
     const updatedData = this.fillGeneratedAndDefaultValues(modelDef, createFields);
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     const query = kysely.insertInto(model).$if(Object.keys(updatedData).length === 0, (qb) => qb.defaultValues()).$if(Object.keys(updatedData).length > 0, (qb) => qb.values(updatedData)).returning(idFields).modifyEnd(this.makeContextComment({
       model,
       operation: "create"
     }));
     const createdEntity = await this.executeQueryTakeFirst(kysely, query, "create");
     if (Object.keys(postCreateRelations).length > 0) {
-      const relationPromises = Object.entries(postCreateRelations).map(([field, subPayload]) => {
-        return this.processNoneOwnedRelationForCreate(kysely, model, field, subPayload, createdEntity);
-      });
-      await Promise.all(relationPromises);
+      for (const [field, subPayload] of Object.entries(postCreateRelations)) {
+        await this.processNoneOwnedRelationForCreate(kysely, model, field, subPayload, createdEntity);
+      }
     }
     if (fromRelation && m2m) {
       await this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, createdEntity, m2m.joinTable);
@@ -3077,7 +3592,7 @@ var BaseOperationHandler = class {
       }
     });
     const discriminatorField = getDiscriminatorField(this.schema, model);
-    (0, import_common_helpers8.invariant)(discriminatorField, `Base model "${model}" must have a discriminator field`);
+    (0, import_common_helpers10.invariant)(discriminatorField, `Base model "${model}" must have a discriminator field`);
     thisCreateFields[discriminatorField] = forModel;
     const baseEntity = await this.create(kysely, model, thisCreateFields, void 0, true);
     const idValues = extractIdFields(baseEntity, this.schema, model);
@@ -3087,14 +3602,24 @@ var BaseOperationHandler = class {
       remainingFields
     };
   }
-  buildFkAssignments(model, relationField, entity) {
+  async buildFkAssignments(kysely, model, relationField, entity) {
     const parentFkFields = {};
-    (0, import_common_helpers8.invariant)(relationField, "parentField must be defined if parentModel is defined");
-    (0, import_common_helpers8.invariant)(entity, "parentEntity must be defined if parentModel is defined");
+    (0, import_common_helpers10.invariant)(relationField, "parentField must be defined if parentModel is defined");
+    (0, import_common_helpers10.invariant)(entity, "parentEntity must be defined if parentModel is defined");
     const { keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
     for (const pair of keyPairs) {
       if (!(pair.pk in entity)) {
-        throw new QueryError(`Field "${pair.pk}" not found in parent created data`);
+        const extraRead = await this.readUnique(kysely, model, {
+          where: entity,
+          select: {
+            [pair.pk]: true
+          }
+        });
+        if (!extraRead) {
+          throw new QueryError(`Field "${pair.pk}" not found in parent created data`);
+        } else {
+          Object.assign(entity, extraRead);
+        }
       }
       Object.assign(parentFkFields, {
         [pair.fk]: entity[pair.pk]
@@ -3115,15 +3640,15 @@ var BaseOperationHandler = class {
         entity: rightEntity
       }
     ].sort((a, b) => (
-      // the implement m2m join table's "A", "B" fk fields' order is determined
+      // the implicit m2m join table's "A", "B" fk fields' order is determined
       // by model name's sort order, and when identical (for self-relations),
       // field name's sort order
       a.model !== b.model ? a.model.localeCompare(b.model) : a.field.localeCompare(b.field)
     ));
-    const firstIds = getIdFields(this.schema, sortedRecords[0].model);
-    const secondIds = getIdFields(this.schema, sortedRecords[1].model);
-    (0, import_common_helpers8.invariant)(firstIds.length === 1, "many-to-many relation must have exactly one id field");
-    (0, import_common_helpers8.invariant)(secondIds.length === 1, "many-to-many relation must have exactly one id field");
+    const firstIds = requireIdFields(this.schema, sortedRecords[0].model);
+    const secondIds = requireIdFields(this.schema, sortedRecords[1].model);
+    (0, import_common_helpers10.invariant)(firstIds.length === 1, "many-to-many relation must have exactly one id field");
+    (0, import_common_helpers10.invariant)(secondIds.length === 1, "many-to-many relation must have exactly one id field");
     if (action === "connect") {
       const result = await kysely.insertInto(joinTable).values({
         A: sortedRecords[0].entity[firstIds[0]],
@@ -3134,17 +3659,17 @@ var BaseOperationHandler = class {
       ]).doNothing()).execute();
       return result[0];
     } else {
-      const eb = (0, import_kysely8.expressionBuilder)();
+      const eb = (0, import_kysely10.expressionBuilder)();
       const result = await kysely.deleteFrom(joinTable).where(eb(`${joinTable}.A`, "=", sortedRecords[0].entity[firstIds[0]])).where(eb(`${joinTable}.B`, "=", sortedRecords[1].entity[secondIds[0]])).execute();
       return result[0];
     }
   }
   resetManyToManyRelation(kysely, model, field, parentIds) {
-    (0, import_common_helpers8.invariant)(Object.keys(parentIds).length === 1, "parentIds must have exactly one field");
+    (0, import_common_helpers10.invariant)(Object.keys(parentIds).length === 1, "parentIds must have exactly one field");
     const parentId = Object.values(parentIds)[0];
     const m2m = getManyToManyRelation(this.schema, model, field);
-    (0, import_common_helpers8.invariant)(m2m, "not a many-to-many relation");
-    const eb = (0, import_kysely8.expressionBuilder)();
+    (0, import_common_helpers10.invariant)(m2m, "not a many-to-many relation");
+    const eb = (0, import_kysely10.expressionBuilder)();
     return kysely.deleteFrom(m2m.joinTable).where(eb(`${m2m.joinTable}.${m2m.parentFkName}`, "=", parentId)).execute();
   }
   async processOwnedRelationForCreate(kysely, relationField, payload) {
@@ -3165,7 +3690,7 @@ var BaseOperationHandler = class {
         }
         case "connect": {
           const referencedPkFields = relationField.relation.references;
-          (0, import_common_helpers8.invariant)(referencedPkFields, "relation must have fields info");
+          (0, import_common_helpers10.invariant)(referencedPkFields, "relation must have fields info");
           const extractedFks = extractFields(subPayload, referencedPkFields);
           if (Object.keys(extractedFks).length === referencedPkFields.length) {
             result = extractedFks;
@@ -3197,10 +3722,9 @@ var BaseOperationHandler = class {
     }
     return result;
   }
-  processNoneOwnedRelationForCreate(kysely, contextModel, relationFieldName, payload, parentEntity) {
+  async processNoneOwnedRelationForCreate(kysely, contextModel, relationFieldName, payload, parentEntity) {
     const relationFieldDef = this.requireField(contextModel, relationFieldName);
     const relationModel = relationFieldDef.type;
-    const tasks = [];
     const fromRelationContext = {
       model: contextModel,
       field: relationFieldName,
@@ -3213,27 +3737,35 @@ var BaseOperationHandler = class {
       }
       switch (action) {
         case "create": {
-          tasks.push(...enumerate(subPayload).map((item) => this.create(kysely, relationModel, item, fromRelationContext)));
+          for (const item of enumerate(subPayload)) {
+            await this.create(kysely, relationModel, item, fromRelationContext);
+          }
           break;
         }
         case "createMany": {
-          (0, import_common_helpers8.invariant)(relationFieldDef.array, "relation must be an array for createMany");
-          tasks.push(this.createMany(kysely, relationModel, subPayload, false, fromRelationContext));
+          (0, import_common_helpers10.invariant)(relationFieldDef.array, "relation must be an array for createMany");
+          await this.createMany(kysely, relationModel, subPayload, false, fromRelationContext);
           break;
         }
         case "connect": {
-          tasks.push(this.connectRelation(kysely, relationModel, subPayload, fromRelationContext));
+          await this.connectRelation(kysely, relationModel, subPayload, fromRelationContext);
           break;
         }
         case "connectOrCreate": {
-          tasks.push(...enumerate(subPayload).map((item) => this.exists(kysely, relationModel, item.where).then((found) => !found ? this.create(kysely, relationModel, item.create, fromRelationContext) : this.connectRelation(kysely, relationModel, found, fromRelationContext))));
+          for (const item of enumerate(subPayload)) {
+            const found = await this.exists(kysely, relationModel, item.where);
+            if (!found) {
+              await this.create(kysely, relationModel, item.create, fromRelationContext);
+            } else {
+              await this.connectRelation(kysely, relationModel, found, fromRelationContext);
+            }
+          }
           break;
         }
         default:
           throw new QueryError(`Invalid relation action: ${action}`);
       }
     }
-    return Promise.all(tasks);
   }
   async createMany(kysely, model, input, returnData, fromRelation) {
     if (!input.data || Array.isArray(input.data) && input.data.length === 0) {
@@ -3254,7 +3786,7 @@ var BaseOperationHandler = class {
       const newItem = {};
       for (const [name, value] of Object.entries(item)) {
         const fieldDef = this.requireField(model, name);
-        (0, import_common_helpers8.invariant)(!fieldDef.relation, "createMany does not support relations");
+        (0, import_common_helpers10.invariant)(!fieldDef.relation, "createMany does not support relations");
         newItem[name] = this.dialect.transformPrimitive(value, fieldDef.type, !!fieldDef.array);
       }
       if (fromRelation) {
@@ -3304,7 +3836,7 @@ var BaseOperationHandler = class {
         count: Number(result.numAffectedRows)
       };
     } else {
-      const idFields = getIdFields(this.schema, model);
+      const idFields = requireIdFields(this.schema, model);
       const result = await query.returning(idFields).execute();
       return result;
     }
@@ -3313,7 +3845,7 @@ var BaseOperationHandler = class {
     const thisCreateRows = [];
     const remainingFieldRows = [];
     const discriminatorField = getDiscriminatorField(this.schema, model);
-    (0, import_common_helpers8.invariant)(discriminatorField, `Base model "${model}" must have a discriminator field`);
+    (0, import_common_helpers10.invariant)(discriminatorField, `Base model "${model}" must have a discriminator field`);
     for (const createFields of createRows) {
       const thisCreateFields = {};
       const remainingFields = {};
@@ -3409,7 +3941,7 @@ var BaseOperationHandler = class {
         }
       } else {
         const fromRelationFieldDef = this.requireField(fromRelation.model, fromRelation.field);
-        (0, import_common_helpers8.invariant)(fromRelationFieldDef.relation?.opposite);
+        (0, import_common_helpers10.invariant)(fromRelationFieldDef.relation?.opposite);
         parentWhere[fromRelationFieldDef.relation.opposite] = {
           some: fromRelation.ids
         };
@@ -3467,10 +3999,7 @@ var BaseOperationHandler = class {
           throw new QueryError(`Relation update not allowed for field "${field}"`);
         }
         if (!thisEntity) {
-          thisEntity = await this.readUnique(kysely, model, {
-            where: combinedWhere,
-            select: this.makeIdSelect(model)
-          });
+          thisEntity = await this.getEntityIds(kysely, model, combinedWhere);
           if (!thisEntity) {
             if (throwIfNotFound) {
               throw new NotFoundError(model);
@@ -3488,7 +4017,7 @@ var BaseOperationHandler = class {
     if (Object.keys(updateFields).length === 0) {
       return combinedWhere;
     } else {
-      const idFields = getIdFields(this.schema, model);
+      const idFields = requireIdFields(this.schema, model);
       const query = kysely.updateTable(model).where((eb) => this.dialect.buildFilter(eb, model, model, combinedWhere)).set(updateFields).returning(idFields).modifyEnd(this.makeContextComment({
         model,
         operation: "update"
@@ -3533,7 +4062,7 @@ var BaseOperationHandler = class {
     if (!filter || typeof filter !== "object") {
       return false;
     }
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     return idFields.length === Object.keys(filter).length && idFields.every((field) => field in filter);
   }
   async processBaseModelUpdate(kysely, model, where, updateFields, throwIfNotFound) {
@@ -3554,20 +4083,20 @@ var BaseOperationHandler = class {
     };
   }
   transformIncrementalUpdate(model, field, fieldDef, payload) {
-    (0, import_common_helpers8.invariant)(Object.keys(payload).length === 1, 'Only one of "set", "increment", "decrement", "multiply", or "divide" can be provided');
+    (0, import_common_helpers10.invariant)(Object.keys(payload).length === 1, 'Only one of "set", "increment", "decrement", "multiply", or "divide" can be provided');
     const key = Object.keys(payload)[0];
     const value = this.dialect.transformPrimitive(payload[key], fieldDef.type, false);
-    const eb = (0, import_kysely8.expressionBuilder)();
+    const eb = (0, import_kysely10.expressionBuilder)();
     const fieldRef = this.dialect.fieldRef(model, field, eb);
     return (0, import_ts_pattern9.match)(key).with("set", () => value).with("increment", () => eb(fieldRef, "+", value)).with("decrement", () => eb(fieldRef, "-", value)).with("multiply", () => eb(fieldRef, "*", value)).with("divide", () => eb(fieldRef, "/", value)).otherwise(() => {
       throw new InternalError(`Invalid incremental update operation: ${key}`);
     });
   }
   transformScalarListUpdate(model, field, fieldDef, payload) {
-    (0, import_common_helpers8.invariant)(Object.keys(payload).length === 1, 'Only one of "set", "push" can be provided');
+    (0, import_common_helpers10.invariant)(Object.keys(payload).length === 1, 'Only one of "set", "push" can be provided');
     const key = Object.keys(payload)[0];
     const value = this.dialect.transformPrimitive(payload[key], fieldDef.type, true);
-    const eb = (0, import_kysely8.expressionBuilder)();
+    const eb = (0, import_kysely10.expressionBuilder)();
     const fieldRef = this.dialect.fieldRef(model, field, eb);
     return (0, import_ts_pattern9.match)(key).with("set", () => value).with("push", () => {
       return eb(fieldRef, "||", eb.val(ensureArray(value)));
@@ -3579,7 +4108,7 @@ var BaseOperationHandler = class {
     return NUMERIC_FIELD_TYPES.includes(fieldDef.type) && !fieldDef.array;
   }
   makeContextComment(_context) {
-    return import_kysely8.sql``;
+    return import_kysely10.sql``;
   }
   async updateMany(kysely, model, where, data, limit, returnData, filterModel) {
     if (typeof data !== "object") {
@@ -3638,7 +4167,7 @@ var BaseOperationHandler = class {
         count: Number(result.numAffectedRows)
       };
     } else {
-      const idFields = getIdFields(this.schema, model);
+      const idFields = requireIdFields(this.schema, model);
       const result = await query.returning(idFields).execute();
       return result;
     }
@@ -3661,11 +4190,10 @@ var BaseOperationHandler = class {
     };
   }
   buildIdFieldRefs(kysely, model) {
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     return idFields.map((f) => kysely.dynamic.ref(`${model}.${f}`));
   }
   async processRelationUpdates(kysely, model, field, fieldDef, parentIds, args, throwIfNotFound) {
-    const tasks = [];
     const fieldModel = fieldDef.type;
     const fromRelationContext = {
       model,
@@ -3676,68 +4204,73 @@ var BaseOperationHandler = class {
     for (const [key, value] of Object.entries(args)) {
       switch (key) {
         case "create": {
-          (0, import_common_helpers8.invariant)(!Array.isArray(value) || fieldDef.array, "relation must be an array if create is an array");
-          tasks.push(...enumerate(value).map((item) => this.create(kysely, fieldModel, item, fromRelationContext)));
+          (0, import_common_helpers10.invariant)(!Array.isArray(value) || fieldDef.array, "relation must be an array if create is an array");
+          for (const item of enumerate(value)) {
+            await this.create(kysely, fieldModel, item, fromRelationContext);
+          }
           break;
         }
         case "createMany": {
-          (0, import_common_helpers8.invariant)(fieldDef.array, "relation must be an array for createMany");
-          tasks.push(this.createMany(kysely, fieldModel, value, false, fromRelationContext));
+          (0, import_common_helpers10.invariant)(fieldDef.array, "relation must be an array for createMany");
+          await this.createMany(kysely, fieldModel, value, false, fromRelationContext);
           break;
         }
         case "connect": {
-          tasks.push(this.connectRelation(kysely, fieldModel, value, fromRelationContext));
+          await this.connectRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "connectOrCreate": {
-          tasks.push(this.connectOrCreateRelation(kysely, fieldModel, value, fromRelationContext));
+          await this.connectOrCreateRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "disconnect": {
-          tasks.push(this.disconnectRelation(kysely, fieldModel, value, fromRelationContext));
+          await this.disconnectRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "set": {
-          (0, import_common_helpers8.invariant)(fieldDef.array, "relation must be an array");
-          tasks.push(this.setRelation(kysely, fieldModel, value, fromRelationContext));
+          (0, import_common_helpers10.invariant)(fieldDef.array, "relation must be an array");
+          await this.setRelation(kysely, fieldModel, value, fromRelationContext);
           break;
         }
         case "update": {
-          tasks.push(...enumerate(value).map((item) => {
+          for (const _item of enumerate(value)) {
+            const item = _item;
             let where;
             let data;
-            if ("where" in item) {
+            if ("data" in item && typeof item.data === "object") {
               where = item.where;
               data = item.data;
             } else {
               where = void 0;
               data = item;
             }
-            return this.update(kysely, fieldModel, where, data, fromRelationContext, true, throwIfNotFound);
-          }));
+            await this.update(kysely, fieldModel, where, data, fromRelationContext, true, throwIfNotFound);
+          }
           break;
         }
         case "upsert": {
-          tasks.push(...enumerate(value).map(async (item) => {
+          for (const _item of enumerate(value)) {
+            const item = _item;
             const updated = await this.update(kysely, fieldModel, item.where, item.update, fromRelationContext, true, false);
-            if (updated) {
-              return updated;
-            } else {
-              return this.create(kysely, fieldModel, item.create, fromRelationContext);
+            if (!updated) {
+              await this.create(kysely, fieldModel, item.create, fromRelationContext);
             }
-          }));
+          }
           break;
         }
         case "updateMany": {
-          tasks.push(...enumerate(value).map((item) => this.update(kysely, fieldModel, item.where, item.data, fromRelationContext, false, false)));
+          for (const _item of enumerate(value)) {
+            const item = _item;
+            await this.update(kysely, fieldModel, item.where, item.data, fromRelationContext, false, false);
+          }
           break;
         }
         case "delete": {
-          tasks.push(this.deleteRelation(kysely, fieldModel, value, fromRelationContext, true));
+          await this.deleteRelation(kysely, fieldModel, value, fromRelationContext, true);
           break;
         }
         case "deleteMany": {
-          tasks.push(this.deleteRelation(kysely, fieldModel, value, fromRelationContext, false));
+          await this.deleteRelation(kysely, fieldModel, value, fromRelationContext, false);
           break;
         }
         default: {
@@ -3745,7 +4278,6 @@ var BaseOperationHandler = class {
         }
       }
     }
-    await Promise.all(tasks);
     return fromRelationContext.parentUpdates;
   }
   // #region relation manipulation
@@ -3756,18 +4288,22 @@ var BaseOperationHandler = class {
     }
     const m2m = getManyToManyRelation(this.schema, fromRelation.model, fromRelation.field);
     if (m2m) {
-      const actions = _data.map(async (d) => {
+      const results = [];
+      for (const d of _data) {
         const ids = await this.getEntityIds(kysely, model, d);
-        return this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
-      });
-      const results = await Promise.all(actions);
+        if (!ids) {
+          throw new NotFoundError(model);
+        }
+        const r = await this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
+        results.push(r);
+      }
       if (_data.length > results.filter((r) => !!r).length) {
         throw new NotFoundError(model);
       }
     } else {
       const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, fromRelation.model, fromRelation.field);
       if (ownedByModel) {
-        (0, import_common_helpers8.invariant)(_data.length === 1, "only one entity can be connected");
+        (0, import_common_helpers10.invariant)(_data.length === 1, "only one entity can be connected");
         const target = await this.readUnique(kysely, model, {
           where: _data[0]
         });
@@ -3780,7 +4316,7 @@ var BaseOperationHandler = class {
       } else {
         const relationFieldDef = this.requireField(fromRelation.model, fromRelation.field);
         if (!relationFieldDef.array) {
-          const query2 = kysely.updateTable(model).where((eb) => eb.and(keyPairs.map(({ fk, pk }) => eb(import_kysely8.sql.ref(fk), "=", fromRelation.ids[pk])))).set(keyPairs.reduce((acc, { fk }) => ({
+          const query2 = kysely.updateTable(model).where((eb) => eb.and(keyPairs.map(({ fk, pk }) => eb(import_kysely10.sql.ref(fk), "=", fromRelation.ids[pk])))).set(keyPairs.reduce((acc, { fk }) => ({
             ...acc,
             [fk]: null
           }), {})).modifyEnd(this.makeContextComment({
@@ -3808,16 +4344,16 @@ var BaseOperationHandler = class {
     if (_data.length === 0) {
       return;
     }
-    return Promise.all(_data.map(async ({ where, create }) => {
+    for (const { where, create } of _data) {
       const existing = await this.exists(kysely, model, where);
       if (existing) {
-        return this.connectRelation(kysely, model, [
+        await this.connectRelation(kysely, model, [
           where
         ], fromRelation);
       } else {
-        return this.create(kysely, model, create, fromRelation);
+        await this.create(kysely, model, create, fromRelation);
       }
-    }));
+    }
   }
   async disconnectRelation(kysely, model, data, fromRelation) {
     let disconnectConditions = [];
@@ -3840,19 +4376,18 @@ var BaseOperationHandler = class {
     }
     const m2m = getManyToManyRelation(this.schema, fromRelation.model, fromRelation.field);
     if (m2m) {
-      const actions = disconnectConditions.map(async (d) => {
+      for (const d of disconnectConditions) {
         const ids = await this.getEntityIds(kysely, model, d);
         if (!ids) {
           return;
         }
-        return this.handleManyToManyRelation(kysely, "disconnect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
-      });
-      await Promise.all(actions);
+        await this.handleManyToManyRelation(kysely, "disconnect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
+      }
     } else {
       const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, fromRelation.model, fromRelation.field);
-      const eb = (0, import_kysely8.expressionBuilder)();
+      const eb = (0, import_kysely10.expressionBuilder)();
       if (ownedByModel) {
-        (0, import_common_helpers8.invariant)(disconnectConditions.length === 1, "only one entity can be disconnected");
+        (0, import_common_helpers10.invariant)(disconnectConditions.length === 1, "only one entity can be disconnected");
         const condition = disconnectConditions[0];
         if (condition === true) {
           for (const { fk } of keyPairs) {
@@ -3911,11 +4446,14 @@ var BaseOperationHandler = class {
     const m2m = getManyToManyRelation(this.schema, fromRelation.model, fromRelation.field);
     if (m2m) {
       await this.resetManyToManyRelation(kysely, fromRelation.model, fromRelation.field, fromRelation.ids);
-      const actions = _data.map(async (d) => {
+      const results = [];
+      for (const d of _data) {
         const ids = await this.getEntityIds(kysely, model, d);
-        return this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable);
-      });
-      const results = await Promise.all(actions);
+        if (!ids) {
+          throw new NotFoundError(model);
+        }
+        results.push(await this.handleManyToManyRelation(kysely, "connect", fromRelation.model, fromRelation.field, fromRelation.ids, m2m.otherModel, m2m.otherField, ids, m2m.joinTable));
+      }
       if (_data.length > results.filter((r) => !!r).length) {
         throw new NotFoundError(model);
       }
@@ -3981,7 +4519,7 @@ var BaseOperationHandler = class {
     if (m2m) {
       deleteFromModel = model;
       const fieldDef = this.requireField(fromRelation.model, fromRelation.field);
-      (0, import_common_helpers8.invariant)(fieldDef.relation?.opposite);
+      (0, import_common_helpers10.invariant)(fieldDef.relation?.opposite);
       deleteResult = await this.delete(kysely, model, {
         AND: [
           {
@@ -4005,7 +4543,7 @@ var BaseOperationHandler = class {
           throw new NotFoundError(fromRelation.model);
         }
         const fieldDef = this.requireField(fromRelation.model, fromRelation.field);
-        (0, import_common_helpers8.invariant)(fieldDef.relation?.opposite);
+        (0, import_common_helpers10.invariant)(fieldDef.relation?.opposite);
         deleteResult = await this.delete(kysely, model, {
           AND: [
             // filter for parent
@@ -4135,7 +4673,7 @@ var BaseOperationHandler = class {
   // reused the filter if it's a complete id filter (without extra fields)
   // otherwise, read the entity by the filter
   getEntityIds(kysely, model, uniqueFilter) {
-    const idFields = getIdFields(this.schema, model);
+    const idFields = requireIdFields(this.schema, model);
     if (
       // all id fields are provided
       idFields.every((f) => f in uniqueFilter && uniqueFilter[f] !== void 0) && // no non-id filter exists
@@ -4163,7 +4701,7 @@ var BaseOperationHandler = class {
       for (const [key, value] of Object.entries(args)) {
         if (value === void 0) {
           delete args[key];
-        } else if (value && (0, import_common_helpers8.isPlainObject)(value)) {
+        } else if (value && (0, import_common_helpers10.isPlainObject)(value)) {
           this.doNormalizeArgs(value);
         }
       }
@@ -4237,7 +4775,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
                 if (field === "_all") {
                   query = query.select((eb) => eb.cast(eb.fn.countAll(), "integer").as(`_count._all`));
                 } else {
-                  query = query.select((eb) => eb.cast(eb.fn.count(import_kysely9.sql.ref(`$sub.${field}`)), "integer").as(`${key}.${field}`));
+                  query = query.select((eb) => eb.cast(eb.fn.count(import_kysely11.sql.ref(`$sub.${field}`)), "integer").as(`${key}.${field}`));
                 }
               }
             });
@@ -4252,7 +4790,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
             if (val === true) {
               query = query.select((eb) => {
                 const fn = (0, import_ts_pattern10.match)(key).with("_sum", () => eb.fn.sum).with("_avg", () => eb.fn.avg).with("_max", () => eb.fn.max).with("_min", () => eb.fn.min).exhaustive();
-                return fn(import_kysely9.sql.ref(`$sub.${field}`)).as(`${key}.${field}`);
+                return fn(import_kysely11.sql.ref(`$sub.${field}`)).as(`${key}.${field}`);
               });
             }
           });
@@ -4299,7 +4837,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
 };
 
 // src/client/crud/operations/count.ts
-var import_kysely10 = require("kysely");
+var import_kysely12 = require("kysely");
 var CountOperationHandler = class extends BaseOperationHandler {
   static {
     __name(this, "CountOperationHandler");
@@ -4323,7 +4861,7 @@ var CountOperationHandler = class extends BaseOperationHandler {
       return subQuery.as(subQueryName);
     });
     if (parsedArgs?.select && typeof parsedArgs.select === "object") {
-      query = query.select((eb) => Object.keys(parsedArgs.select).map((key) => key === "_all" ? eb.cast(eb.fn.countAll(), "integer").as("_all") : eb.cast(eb.fn.count(import_kysely10.sql.ref(`${subQueryName}.${key}`)), "integer").as(key)));
+      query = query.select((eb) => Object.keys(parsedArgs.select).map((key) => key === "_all" ? eb.cast(eb.fn.countAll(), "integer").as("_all") : eb.cast(eb.fn.count(import_kysely12.sql.ref(`${subQueryName}.${key}`)), "integer").as(key)));
       const result = await this.executeQuery(this.kysely, query, "count");
       return result.rows[0];
     } else {
@@ -4359,7 +4897,7 @@ var CreateOperationHandler = class extends BaseOperationHandler {
       });
     });
     if (!result && this.hasPolicyEnabled) {
-      throw new RejectedByPolicyError(this.model, `result is not allowed to be read back`);
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, `result is not allowed to be read back`);
     }
     return result;
   }
@@ -4405,15 +4943,15 @@ var DeleteOperationHandler = class extends BaseOperationHandler {
       omit: args.omit,
       where: args.where
     });
-    if (!existing) {
-      throw new NotFoundError(this.model);
-    }
     await this.safeTransaction(async (tx) => {
       const result = await this.delete(tx, this.model, args.where);
       if (result.count === 0) {
         throw new NotFoundError(this.model);
       }
     });
+    if (!existing && this.hasPolicyEnabled) {
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+    }
     return existing;
   }
   async runDeleteMany(args) {
@@ -4447,7 +4985,7 @@ var FindOperationHandler = class extends BaseOperationHandler {
 };
 
 // src/client/crud/operations/group-by.ts
-var import_kysely11 = require("kysely");
+var import_kysely13 = require("kysely");
 var import_ts_pattern13 = require("ts-pattern");
 var GroupByOperationHandler = class extends BaseOperationHandler {
   static {
@@ -4469,7 +5007,7 @@ var GroupByOperationHandler = class extends BaseOperationHandler {
       subQuery = this.dialect.buildOrderBy(subQuery, this.model, this.model, void 0, skip !== void 0 || take !== void 0, negateOrderBy);
       return subQuery.as("$sub");
     });
-    const fieldRef = /* @__PURE__ */ __name((field) => this.dialect.fieldRef(this.model, field, (0, import_kysely11.expressionBuilder)(), "$sub"), "fieldRef");
+    const fieldRef = /* @__PURE__ */ __name((field) => this.dialect.fieldRef(this.model, field, (0, import_kysely13.expressionBuilder)(), "$sub"), "fieldRef");
     const bys = typeof parsedArgs.by === "string" ? [
       parsedArgs.by
     ] : parsedArgs.by;
@@ -4584,7 +5122,7 @@ var UpdateOperationHandler = class extends BaseOperationHandler {
     });
     if (!readBackResult) {
       if (this.hasPolicyEnabled) {
-        throw new RejectedByPolicyError(this.model, "result is not allowed to be read back");
+        throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       } else {
         return null;
       }
@@ -4601,16 +5139,24 @@ var UpdateOperationHandler = class extends BaseOperationHandler {
     if (!args) {
       return [];
     }
-    return this.safeTransaction(async (tx) => {
-      const updateResult = await this.updateMany(tx, this.model, args.where, args.data, args.limit, true);
-      return this.read(tx, this.model, {
+    const { readBackResult, updateResult } = await this.safeTransaction(async (tx) => {
+      const updateResult2 = await this.updateMany(tx, this.model, args.where, args.data, args.limit, true);
+      const readBackResult2 = await this.read(tx, this.model, {
         select: args.select,
         omit: args.omit,
         where: {
-          OR: updateResult.map((item) => getIdValues(this.schema, this.model, item))
+          OR: updateResult2.map((item) => getIdValues(this.schema, this.model, item))
         }
       });
+      return {
+        readBackResult: readBackResult2,
+        updateResult: updateResult2
+      };
     });
+    if (readBackResult.length < updateResult.length && this.hasPolicyEnabled) {
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+    }
+    return readBackResult;
   }
   async runUpsert(args) {
     const result = await this.safeTransaction(async (tx) => {
@@ -4626,18 +5172,32 @@ var UpdateOperationHandler = class extends BaseOperationHandler {
       });
     });
     if (!result && this.hasPolicyEnabled) {
-      throw new RejectedByPolicyError(this.model, "result is not allowed to be read back");
+      throw new RejectedByPolicyError(this.model, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
     }
     return result;
   }
 };
 
 // src/client/crud/validator.ts
-var import_common_helpers9 = require("@zenstackhq/common-helpers");
-var import_decimal = __toESM(require("decimal.js"), 1);
+var import_common_helpers11 = require("@zenstackhq/common-helpers");
+var import_decimal3 = __toESM(require("decimal.js"), 1);
 var import_json_stable_stringify = __toESM(require("json-stable-stringify"), 1);
 var import_ts_pattern15 = require("ts-pattern");
 var import_zod = require("zod");
+
+// src/utils/zod-utils.ts
+var import_v3 = require("zod-validation-error/v3");
+var import_v4 = require("zod-validation-error/v4");
+function formatError(error) {
+  if ("_zod" in error) {
+    return (0, import_v4.fromError)(error).toString();
+  } else {
+    return (0, import_v3.fromError)(error).toString();
+  }
+}
+__name(formatError, "formatError");
+
+// src/client/crud/validator.ts
 var InputValidator = class {
   static {
     __name(this, "InputValidator");
@@ -4699,7 +5259,7 @@ var InputValidator = class {
     }
     const { error } = schema.safeParse(args);
     if (error) {
-      throw new InputValidationError(`Invalid ${operation} args: ${error.message}`, error);
+      throw new InputValidationError(`Invalid ${operation} args: ${formatError(error)}`, error);
     }
     return args;
   }
@@ -4743,7 +5303,7 @@ var InputValidator = class {
         import_zod.z.bigint()
       ])).with("Decimal", () => import_zod.z.union([
         import_zod.z.number(),
-        import_zod.z.instanceof(import_decimal.default),
+        import_zod.z.instanceof(import_decimal3.default),
         import_zod.z.string()
       ])).with("DateTime", () => import_zod.z.union([
         import_zod.z.date(),
@@ -4758,7 +5318,7 @@ var InputValidator = class {
       return schema;
     }
     const typeDef = this.schema.typeDefs?.[type];
-    (0, import_common_helpers9.invariant)(typeDef, `Type definition "${type}" not found in schema`);
+    (0, import_common_helpers11.invariant)(typeDef, `Type definition "${type}" not found in schema`);
     schema = import_zod.z.object(Object.fromEntries(Object.entries(typeDef.fields).map(([field, def]) => {
       let fieldSchema = this.makePrimitiveSchema(def.type);
       if (def.array) {
@@ -4826,7 +5386,7 @@ var InputValidator = class {
       for (const uniqueField of uniqueFields) {
         if ("defs" in uniqueField) {
           fields[uniqueField.name] = import_zod.z.object(Object.fromEntries(Object.entries(uniqueField.defs).map(([key, def]) => {
-            (0, import_common_helpers9.invariant)(!def.relation, "unique field cannot be a relation");
+            (0, import_common_helpers11.invariant)(!def.relation, "unique field cannot be a relation");
             let fieldSchema;
             const enumDef = getEnum(this.schema, def.type);
             if (enumDef) {
@@ -5032,9 +5592,16 @@ var InputValidator = class {
         fields[field] = import_zod.z.boolean().optional();
       }
     }
+    const _countSchema = this.makeCountSelectionSchema(modelDef);
+    if (_countSchema) {
+      fields["_count"] = _countSchema;
+    }
+    return import_zod.z.strictObject(fields);
+  }
+  makeCountSelectionSchema(modelDef) {
     const toManyRelations = Object.values(modelDef.fields).filter((def) => def.relation && def.array);
     if (toManyRelations.length > 0) {
-      fields["_count"] = import_zod.z.union([
+      return import_zod.z.union([
         import_zod.z.literal(true),
         import_zod.z.strictObject({
           select: import_zod.z.strictObject(toManyRelations.reduce((acc, fieldDef) => ({
@@ -5048,8 +5615,9 @@ var InputValidator = class {
           }), {}))
         })
       ]).optional();
+    } else {
+      return void 0;
     }
-    return import_zod.z.strictObject(fields);
   }
   makeRelationSelectIncludeSchema(fieldDef) {
     let objSchema = import_zod.z.strictObject({
@@ -5096,6 +5664,10 @@ var InputValidator = class {
         fields[field] = this.makeRelationSelectIncludeSchema(fieldDef).optional();
       }
     }
+    const _countSchema = this.makeCountSelectionSchema(modelDef);
+    if (_countSchema) {
+      fields["_count"] = _countSchema;
+    }
     return import_zod.z.strictObject(fields);
   }
   makeOrderBySchema(model, withRelation, WithAggregation) {
@@ -5162,13 +5734,15 @@ var InputValidator = class {
   // #region Create
   makeCreateSchema(model) {
     const dataSchema = this.makeCreateDataSchema(model, false);
-    const schema = import_zod.z.strictObject({
+    let schema = import_zod.z.strictObject({
       data: dataSchema,
       select: this.makeSelectSchema(model).optional(),
       include: this.makeIncludeSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeCreateManySchema(model) {
     return this.makeCreateManyDataSchema(model, []).optional();
@@ -5293,11 +5867,11 @@ var InputValidator = class {
         fields["delete"] = this.makeDeleteRelationDataSchema(fieldType, array, true).optional();
       }
       fields["update"] = array ? this.orArray(import_zod.z.strictObject({
-        where: this.makeWhereSchema(fieldType, true),
+        where: this.makeWhereSchema(fieldType, true).optional(),
         data: this.makeUpdateDataSchema(fieldType, withoutFields)
       }), true).optional() : import_zod.z.union([
         import_zod.z.strictObject({
-          where: this.makeWhereSchema(fieldType, true),
+          where: this.makeWhereSchema(fieldType, true).optional(),
           data: this.makeUpdateDataSchema(fieldType, withoutFields)
         }),
         this.makeUpdateDataSchema(fieldType, withoutFields)
@@ -5357,14 +5931,16 @@ var InputValidator = class {
   // #endregion
   // #region Update
   makeUpdateSchema(model) {
-    const schema = import_zod.z.strictObject({
+    let schema = import_zod.z.strictObject({
       where: this.makeWhereSchema(model, true),
       data: this.makeUpdateDataSchema(model),
       select: this.makeSelectSchema(model).optional(),
       include: this.makeIncludeSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeUpdateManySchema(model) {
     return import_zod.z.strictObject({
@@ -5375,14 +5951,15 @@ var InputValidator = class {
   }
   makeUpdateManyAndReturnSchema(model) {
     const base = this.makeUpdateManySchema(model);
-    const result = base.extend({
+    let schema = base.extend({
       select: this.makeSelectSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectOmitMutuallyExclusive(result);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeUpsertSchema(model) {
-    const schema = import_zod.z.strictObject({
+    let schema = import_zod.z.strictObject({
       where: this.makeWhereSchema(model, true),
       create: this.makeCreateDataSchema(model, false),
       update: this.makeUpdateDataSchema(model),
@@ -5390,7 +5967,9 @@ var InputValidator = class {
       include: this.makeIncludeSchema(model).optional(),
       omit: this.makeOmitSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeUpdateDataSchema(model, withoutFields = [], withoutRelationFields = false) {
     const uncheckedVariantFields = {};
@@ -5467,12 +6046,14 @@ var InputValidator = class {
   // #endregion
   // #region Delete
   makeDeleteSchema(model) {
-    const schema = import_zod.z.strictObject({
+    let schema = import_zod.z.strictObject({
       where: this.makeWhereSchema(model, true),
       select: this.makeSelectSchema(model).optional(),
       include: this.makeIncludeSchema(model).optional()
     });
-    return this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectIncludeMutuallyExclusive(schema);
+    schema = this.refineForSelectOmitMutuallyExclusive(schema);
+    return schema;
   }
   makeDeleteManySchema(model) {
     return import_zod.z.object({
@@ -5822,31 +6403,14 @@ function performanceNow() {
 __name(performanceNow, "performanceNow");
 
 // src/client/executor/zenstack-query-executor.ts
-var import_common_helpers11 = require("@zenstackhq/common-helpers");
-var import_kysely14 = require("kysely");
+var import_common_helpers13 = require("@zenstackhq/common-helpers");
+var import_kysely15 = require("kysely");
 var import_ts_pattern16 = require("ts-pattern");
 
-// src/client/executor/kysely-utils.ts
-var import_kysely12 = require("kysely");
-function stripAlias(node) {
-  if (import_kysely12.AliasNode.is(node)) {
-    return {
-      alias: node.alias,
-      node: node.node
-    };
-  } else {
-    return {
-      alias: void 0,
-      node
-    };
-  }
-}
-__name(stripAlias, "stripAlias");
-
 // src/client/executor/name-mapper.ts
-var import_common_helpers10 = require("@zenstackhq/common-helpers");
-var import_kysely13 = require("kysely");
-var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
+var import_common_helpers12 = require("@zenstackhq/common-helpers");
+var import_kysely14 = require("kysely");
+var QueryNameMapper = class extends import_kysely14.OperationNodeTransformer {
   static {
     __name(this, "QueryNameMapper");
   }
@@ -5888,7 +6452,7 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
       })) : void 0;
       return {
         ...super.transformSelectQuery(node),
-        from: import_kysely13.FromNode.create(processedFroms.map((f) => f.node)),
+        from: import_kysely14.FromNode.create(processedFroms.map((f) => f.node)),
         joins,
         selections: this.processSelectQuerySelections(node)
       };
@@ -5914,7 +6478,7 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
     };
   }
   transformReference(node) {
-    if (!import_kysely13.ColumnNode.is(node.column)) {
+    if (!import_kysely14.ColumnNode.is(node.column)) {
       return super.transformReference(node);
     }
     const scope = this.resolveFieldFromScopes(node.column.column.name, node.table?.table.identifier.name);
@@ -5922,12 +6486,12 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
       const mappedFieldName = this.mapFieldName(scope.model, node.column.column.name);
       let mappedTableName = node.table?.table.identifier.name;
       if (mappedTableName) {
-        if (scope.alias && import_kysely13.IdentifierNode.is(scope.alias) && scope.alias.name === mappedTableName) {
+        if (scope.alias && import_kysely14.IdentifierNode.is(scope.alias) && scope.alias.name === mappedTableName) {
         } else if (scope.model === mappedTableName) {
           mappedTableName = this.mapTableName(scope.model);
         }
       }
-      return import_kysely13.ReferenceNode.create(import_kysely13.ColumnNode.create(mappedFieldName), mappedTableName ? import_kysely13.TableNode.create(mappedTableName) : void 0);
+      return import_kysely14.ReferenceNode.create(import_kysely14.ColumnNode.create(mappedFieldName), mappedTableName ? import_kysely14.TableNode.create(mappedTableName) : void 0);
     } else {
       return super.transformReference(node);
     }
@@ -5938,14 +6502,14 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
       return super.transformColumn(node);
     }
     const mappedName = this.mapFieldName(scope.model, node.column.name);
-    return import_kysely13.ColumnNode.create(mappedName);
+    return import_kysely14.ColumnNode.create(mappedName);
   }
   transformUpdateQuery(node) {
     if (!node.table) {
       return super.transformUpdateQuery(node);
     }
     const { alias, node: innerTable } = stripAlias(node.table);
-    if (!innerTable || !import_kysely13.TableNode.is(innerTable)) {
+    if (!innerTable || !import_kysely14.TableNode.is(innerTable)) {
       return super.transformUpdateQuery(node);
     }
     return this.withScope({
@@ -5963,14 +6527,14 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
     const scopes = node.from.froms.map((node2) => {
       const { alias, node: innerNode } = stripAlias(node2);
       return {
-        model: this.extractModelName(innerNode),
+        model: extractModelName(innerNode),
         alias,
         namesMapped: false
       };
     });
     const froms = node.from.froms.map((from) => {
       const { alias, node: innerNode } = stripAlias(from);
-      if (import_kysely13.TableNode.is(innerNode)) {
+      if (import_kysely14.TableNode.is(innerNode)) {
         return this.wrapAlias(this.processTableRef(innerNode), alias);
       } else {
         return super.transformNode(from);
@@ -5979,7 +6543,7 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
     return this.withScopes(scopes, () => {
       return {
         ...super.transformDeleteQuery(node),
-        from: import_kysely13.FromNode.create(froms)
+        from: import_kysely14.FromNode.create(froms)
       };
     });
   }
@@ -5988,24 +6552,24 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
   processSelectQuerySelections(node) {
     const selections = [];
     for (const selection of node.selections ?? []) {
-      if (import_kysely13.SelectAllNode.is(selection.selection)) {
+      if (import_kysely14.SelectAllNode.is(selection.selection)) {
         const scope = this.scopes[this.scopes.length - 1];
         if (scope?.model && !scope.namesMapped) {
           selections.push(...this.createSelectAllFields(scope.model, scope.alias));
         } else {
           selections.push(super.transformSelection(selection));
         }
-      } else if (import_kysely13.ReferenceNode.is(selection.selection) || import_kysely13.ColumnNode.is(selection.selection)) {
+      } else if (import_kysely14.ReferenceNode.is(selection.selection) || import_kysely14.ColumnNode.is(selection.selection)) {
         const transformed = this.transformNode(selection.selection);
-        if (import_kysely13.AliasNode.is(transformed)) {
-          selections.push(import_kysely13.SelectionNode.create(transformed));
+        if (import_kysely14.AliasNode.is(transformed)) {
+          selections.push(import_kysely14.SelectionNode.create(transformed));
         } else {
-          const origFieldName = this.extractFieldName(selection.selection);
-          const fieldName = this.extractFieldName(transformed);
+          const origFieldName = extractFieldName(selection.selection);
+          const fieldName = extractFieldName(transformed);
           if (fieldName !== origFieldName) {
-            selections.push(import_kysely13.SelectionNode.create(this.wrapAlias(transformed, origFieldName ? import_kysely13.IdentifierNode.create(origFieldName) : void 0)));
+            selections.push(import_kysely14.SelectionNode.create(this.wrapAlias(transformed, origFieldName ? import_kysely14.IdentifierNode.create(origFieldName) : void 0)));
           } else {
-            selections.push(import_kysely13.SelectionNode.create(transformed));
+            selections.push(import_kysely14.SelectionNode.create(transformed));
           }
         }
       } else {
@@ -6019,7 +6583,7 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
       const scope = this.scopes[i];
       if (qualifier) {
         if (scope.alias) {
-          if (scope.alias && import_kysely13.IdentifierNode.is(scope.alias) && scope.alias.name === qualifier) {
+          if (scope.alias && import_kysely14.IdentifierNode.is(scope.alias) && scope.alias.name === qualifier) {
             return scope;
           } else {
             continue;
@@ -6065,16 +6629,16 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
     }
   }
   wrapAlias(node, alias) {
-    return alias ? import_kysely13.AliasNode.create(node, alias) : node;
+    return alias ? import_kysely14.AliasNode.create(node, alias) : node;
   }
   processTableRef(node) {
     if (!node) {
       return node;
     }
-    if (!import_kysely13.TableNode.is(node)) {
+    if (!import_kysely14.TableNode.is(node)) {
       return super.transformNode(node);
     }
-    return import_kysely13.TableNode.create(this.mapTableName(node.table.identifier.name));
+    return import_kysely14.TableNode.create(this.mapTableName(node.table.identifier.name));
   }
   getMappedName(def) {
     const mapAttr = def.attributes?.find((attr) => attr.name === "@@map" || attr.name === "@map");
@@ -6110,14 +6674,14 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
   // convert a "from" node to a nested query if there are columns with name mapping
   processSelectTable(node) {
     const { alias, node: innerNode } = stripAlias(node);
-    if (innerNode && import_kysely13.TableNode.is(innerNode)) {
+    if (innerNode && import_kysely14.TableNode.is(innerNode)) {
       const modelName = innerNode.table.identifier.name;
       const mappedName = this.mapTableName(modelName);
-      const finalAlias = alias ?? (mappedName !== modelName ? import_kysely13.IdentifierNode.create(modelName) : void 0);
+      const finalAlias = alias ?? (mappedName !== modelName ? import_kysely14.IdentifierNode.create(modelName) : void 0);
       return {
-        node: this.wrapAlias(import_kysely13.TableNode.create(mappedName), finalAlias),
+        node: this.wrapAlias(import_kysely14.TableNode.create(mappedName), finalAlias),
         scope: {
-          alias: alias ?? import_kysely13.IdentifierNode.create(modelName),
+          alias: alias ?? import_kysely14.IdentifierNode.create(modelName),
           model: modelName,
           namesMapped: !this.hasMappedColumns(modelName)
         }
@@ -6137,12 +6701,12 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
     const modelDef = requireModel(this.schema, model);
     return this.getModelFields(modelDef).map((fieldDef) => {
       const columnName = this.mapFieldName(model, fieldDef.name);
-      const columnRef = import_kysely13.ReferenceNode.create(import_kysely13.ColumnNode.create(columnName), alias && import_kysely13.IdentifierNode.is(alias) ? import_kysely13.TableNode.create(alias.name) : void 0);
+      const columnRef = import_kysely14.ReferenceNode.create(import_kysely14.ColumnNode.create(columnName), alias && import_kysely14.IdentifierNode.is(alias) ? import_kysely14.TableNode.create(alias.name) : void 0);
       if (columnName !== fieldDef.name) {
-        const aliased = import_kysely13.AliasNode.create(columnRef, import_kysely13.IdentifierNode.create(fieldDef.name));
-        return import_kysely13.SelectionNode.create(aliased);
+        const aliased = import_kysely14.AliasNode.create(columnRef, import_kysely14.IdentifierNode.create(fieldDef.name));
+        return import_kysely14.SelectionNode.create(aliased);
       } else {
-        return import_kysely13.SelectionNode.create(columnRef);
+        return import_kysely14.SelectionNode.create(columnRef);
       }
     });
   }
@@ -6152,57 +6716,44 @@ var QueryNameMapper = class extends import_kysely13.OperationNodeTransformer {
   processSelections(selections) {
     const result = [];
     selections.forEach((selection) => {
-      if (import_kysely13.SelectAllNode.is(selection.selection)) {
+      if (import_kysely14.SelectAllNode.is(selection.selection)) {
         const processed = this.processSelectAll(selection.selection);
         if (Array.isArray(processed)) {
-          result.push(...processed.map((s) => import_kysely13.SelectionNode.create(s)));
+          result.push(...processed.map((s) => import_kysely14.SelectionNode.create(s)));
         } else {
-          result.push(import_kysely13.SelectionNode.create(processed));
+          result.push(import_kysely14.SelectionNode.create(processed));
         }
       } else {
-        result.push(import_kysely13.SelectionNode.create(this.processSelection(selection.selection)));
+        result.push(import_kysely14.SelectionNode.create(this.processSelection(selection.selection)));
       }
     });
     return result;
   }
   processSelection(node) {
     let alias;
-    if (!import_kysely13.AliasNode.is(node)) {
-      alias = this.extractFieldName(node);
+    if (!import_kysely14.AliasNode.is(node)) {
+      alias = extractFieldName(node);
     }
     const result = super.transformNode(node);
-    return this.wrapAlias(result, alias ? import_kysely13.IdentifierNode.create(alias) : void 0);
+    return this.wrapAlias(result, alias ? import_kysely14.IdentifierNode.create(alias) : void 0);
   }
   processSelectAll(node) {
     const scope = this.scopes[this.scopes.length - 1];
-    (0, import_common_helpers10.invariant)(scope);
+    (0, import_common_helpers12.invariant)(scope);
     if (!scope.model || !this.hasMappedColumns(scope.model)) {
       return super.transformSelectAll(node);
     }
     const modelDef = requireModel(this.schema, scope.model);
     return this.getModelFields(modelDef).map((fieldDef) => {
       const columnName = this.mapFieldName(modelDef.name, fieldDef.name);
-      const columnRef = import_kysely13.ReferenceNode.create(import_kysely13.ColumnNode.create(columnName));
-      return columnName !== fieldDef.name ? this.wrapAlias(columnRef, import_kysely13.IdentifierNode.create(fieldDef.name)) : columnRef;
+      const columnRef = import_kysely14.ReferenceNode.create(import_kysely14.ColumnNode.create(columnName));
+      return columnName !== fieldDef.name ? this.wrapAlias(columnRef, import_kysely14.IdentifierNode.create(fieldDef.name)) : columnRef;
     });
   }
-  extractModelName(node) {
-    const { node: innerNode } = stripAlias(node);
-    return import_kysely13.TableNode.is(innerNode) ? innerNode.table.identifier.name : void 0;
-  }
-  extractFieldName(node) {
-    if (import_kysely13.ReferenceNode.is(node) && import_kysely13.ColumnNode.is(node.column)) {
-      return node.column.column.name;
-    } else if (import_kysely13.ColumnNode.is(node)) {
-      return node.column.name;
-    } else {
-      return void 0;
-    }
-  }
 };
 
 // src/client/executor/zenstack-query-executor.ts
-var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14.DefaultQueryExecutor {
+var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely15.DefaultQueryExecutor {
   static {
     __name(this, "ZenStackQueryExecutor");
   }
@@ -6258,13 +6809,13 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14
   }
   getMutationInfo(queryNode) {
     const model = this.getMutationModel(queryNode);
-    const { action, where } = (0, import_ts_pattern16.match)(queryNode).when(import_kysely14.InsertQueryNode.is, () => ({
+    const { action, where } = (0, import_ts_pattern16.match)(queryNode).when(import_kysely15.InsertQueryNode.is, () => ({
       action: "create",
       where: void 0
-    })).when(import_kysely14.UpdateQueryNode.is, (node) => ({
+    })).when(import_kysely15.UpdateQueryNode.is, (node) => ({
       action: "update",
       where: node.where
-    })).when(import_kysely14.DeleteQueryNode.is, (node) => ({
+    })).when(import_kysely15.DeleteQueryNode.is, (node) => ({
       action: "delete",
       where: node.where
     })).exhaustive();
@@ -6292,11 +6843,11 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14
             result
           };
         }
-        if ((import_kysely14.InsertQueryNode.is(query) || import_kysely14.UpdateQueryNode.is(query)) && this.hasEntityMutationPluginsWithAfterMutationHooks) {
+        if ((import_kysely15.InsertQueryNode.is(query) || import_kysely15.UpdateQueryNode.is(query)) && this.hasEntityMutationPluginsWithAfterMutationHooks) {
           query = {
             ...query,
-            returning: import_kysely14.ReturningNode.create([
-              import_kysely14.SelectionNode.createSelectAll()
+            returning: import_kysely15.ReturningNode.create([
+              import_kysely15.SelectionNode.createSelectAll()
             ])
           };
         }
@@ -6313,7 +6864,7 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14
         const mutationInfo = this.getMutationInfo(finalQuery);
         let beforeMutationEntities;
         const loadBeforeMutationEntities = /* @__PURE__ */ __name(async () => {
-          if (beforeMutationEntities === void 0 && (import_kysely14.UpdateQueryNode.is(query) || import_kysely14.DeleteQueryNode.is(query))) {
+          if (beforeMutationEntities === void 0 && (import_kysely15.UpdateQueryNode.is(query) || import_kysely15.DeleteQueryNode.is(query))) {
             beforeMutationEntities = await this.loadEntities(mutationInfo.model, mutationInfo.where, connection);
           }
           return beforeMutationEntities;
@@ -6355,7 +6906,7 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14
     }
   }
   createClientForConnection(connection, inTx) {
-    const innerExecutor = this.withConnectionProvider(new import_kysely14.SingleConnectionProvider(connection));
+    const innerExecutor = this.withConnectionProvider(new import_kysely15.SingleConnectionProvider(connection));
     innerExecutor.suppressMutationHooks = true;
     const innerClient = this.client.withExecutor(innerExecutor);
     if (inTx) {
@@ -6373,7 +6924,7 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14
     return (this.client.$options.plugins ?? []).some((plugin) => plugin.onEntityMutation?.runAfterMutationWithinTransaction);
   }
   isMutationNode(queryNode) {
-    return import_kysely14.InsertQueryNode.is(queryNode) || import_kysely14.UpdateQueryNode.is(queryNode) || import_kysely14.DeleteQueryNode.is(queryNode);
+    return import_kysely15.InsertQueryNode.is(queryNode) || import_kysely15.UpdateQueryNode.is(queryNode) || import_kysely15.DeleteQueryNode.is(queryNode);
   }
   withPlugin(plugin) {
     return new _ZenStackQueryExecutor(this.client, this.driver, this.compiler, this.adapter, this.connectionProvider, [
@@ -6402,18 +6953,18 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14
     return newExecutor;
   }
   getMutationModel(queryNode) {
-    return (0, import_ts_pattern16.match)(queryNode).when(import_kysely14.InsertQueryNode.is, (node) => {
-      (0, import_common_helpers11.invariant)(node.into, "InsertQueryNode must have an into clause");
+    return (0, import_ts_pattern16.match)(queryNode).when(import_kysely15.InsertQueryNode.is, (node) => {
+      (0, import_common_helpers13.invariant)(node.into, "InsertQueryNode must have an into clause");
       return node.into.table.identifier.name;
-    }).when(import_kysely14.UpdateQueryNode.is, (node) => {
-      (0, import_common_helpers11.invariant)(node.table, "UpdateQueryNode must have a table");
+    }).when(import_kysely15.UpdateQueryNode.is, (node) => {
+      (0, import_common_helpers13.invariant)(node.table, "UpdateQueryNode must have a table");
       const { node: tableNode } = stripAlias(node.table);
-      (0, import_common_helpers11.invariant)(import_kysely14.TableNode.is(tableNode), "UpdateQueryNode must use a TableNode");
+      (0, import_common_helpers13.invariant)(import_kysely15.TableNode.is(tableNode), "UpdateQueryNode must use a TableNode");
       return tableNode.table.identifier.name;
-    }).when(import_kysely14.DeleteQueryNode.is, (node) => {
-      (0, import_common_helpers11.invariant)(node.from.froms.length === 1, "Delete query must have exactly one from table");
+    }).when(import_kysely15.DeleteQueryNode.is, (node) => {
+      (0, import_common_helpers13.invariant)(node.from.froms.length === 1, "Delete query must have exactly one from table");
       const { node: tableNode } = stripAlias(node.from.froms[0]);
-      (0, import_common_helpers11.invariant)(import_kysely14.TableNode.is(tableNode), "DeleteQueryNode must use a TableNode");
+      (0, import_common_helpers13.invariant)(import_kysely15.TableNode.is(tableNode), "DeleteQueryNode must use a TableNode");
       return tableNode.table.identifier.name;
     }).otherwise((node) => {
       throw new InternalError(`Invalid query node: ${node}`);
@@ -6487,9 +7038,9 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends import_kysely14
   }
   andNodes(condition1, condition2) {
     if (condition1 && condition2) {
-      return import_kysely14.WhereNode.create(import_kysely14.AndNode.create(condition1, condition2));
+      return import_kysely15.WhereNode.create(import_kysely15.AndNode.create(condition1, condition2));
     } else if (condition1) {
-      return import_kysely14.WhereNode.create(condition1);
+      return import_kysely15.WhereNode.create(condition1);
     } else {
       return condition2;
     }
@@ -6511,53 +7062,58 @@ __export(functions_exports, {
   search: () => search,
   startsWith: () => startsWith
 });
-var import_common_helpers12 = require("@zenstackhq/common-helpers");
-var import_kysely15 = require("kysely");
+var import_common_helpers14 = require("@zenstackhq/common-helpers");
+var import_kysely16 = require("kysely");
 var import_ts_pattern17 = require("ts-pattern");
-var contains = /* @__PURE__ */ __name((eb, args) => {
-  const [field, search2, caseInsensitive = false] = args;
-  if (!field) {
-    throw new Error('"field" parameter is required');
-  }
-  if (!search2) {
-    throw new Error('"search" parameter is required');
-  }
-  const searchExpr = eb.fn("CONCAT", [
-    import_kysely15.sql.lit("%"),
-    search2,
-    import_kysely15.sql.lit("%")
-  ]);
-  return eb(field, caseInsensitive ? "ilike" : "like", searchExpr);
-}, "contains");
+var contains = /* @__PURE__ */ __name((eb, args, context) => textMatch(eb, args, context, "contains"), "contains");
 var search = /* @__PURE__ */ __name((_eb, _args) => {
   throw new Error(`"search" function is not implemented yet`);
 }, "search");
-var startsWith = /* @__PURE__ */ __name((eb, args) => {
-  const [field, search2] = args;
-  if (!field) {
-    throw new Error('"field" parameter is required');
-  }
-  if (!search2) {
-    throw new Error('"search" parameter is required');
-  }
-  return eb(field, "like", eb.fn("CONCAT", [
-    search2,
-    import_kysely15.sql.lit("%")
-  ]));
-}, "startsWith");
-var endsWith = /* @__PURE__ */ __name((eb, args) => {
-  const [field, search2] = args;
+var startsWith = /* @__PURE__ */ __name((eb, args, context) => textMatch(eb, args, context, "startsWith"), "startsWith");
+var endsWith = /* @__PURE__ */ __name((eb, args, context) => textMatch(eb, args, context, "endsWith"), "endsWith");
+var textMatch = /* @__PURE__ */ __name((eb, args, { dialect }, method) => {
+  const [field, search2, caseInsensitive = void 0] = args;
   if (!field) {
     throw new Error('"field" parameter is required');
   }
   if (!search2) {
     throw new Error('"search" parameter is required');
   }
-  return eb(field, "like", eb.fn("CONCAT", [
-    import_kysely15.sql.lit("%"),
-    search2
-  ]));
-}, "endsWith");
+  const casingBehavior = dialect.getStringCasingBehavior();
+  const caseInsensitiveValue = readBoolean(caseInsensitive, false);
+  let op;
+  let fieldExpr = field;
+  let searchExpr = search2;
+  if (caseInsensitiveValue) {
+    if (casingBehavior.supportsILike) {
+      op = "ilike";
+    } else {
+      op = "like";
+      if (casingBehavior.likeCaseSensitive === true) {
+        fieldExpr = eb.fn("LOWER", [
+          fieldExpr
+        ]);
+        searchExpr = eb.fn("LOWER", [
+          searchExpr
+        ]);
+      }
+    }
+  } else {
+    op = "like";
+  }
+  searchExpr = (0, import_ts_pattern17.match)(method).with("contains", () => eb.fn("CONCAT", [
+    import_kysely16.sql.lit("%"),
+    import_kysely16.sql`CAST(${searchExpr} as text)`,
+    import_kysely16.sql.lit("%")
+  ])).with("startsWith", () => eb.fn("CONCAT", [
+    import_kysely16.sql`CAST(${searchExpr} as text)`,
+    import_kysely16.sql.lit("%")
+  ])).with("endsWith", () => eb.fn("CONCAT", [
+    import_kysely16.sql.lit("%"),
+    import_kysely16.sql`CAST(${searchExpr} as text)`
+  ])).exhaustive();
+  return eb(fieldExpr, op, searchExpr);
+}, "textMatch");
 var has = /* @__PURE__ */ __name((eb, args) => {
   const [field, search2] = args;
   if (!field) {
@@ -6595,18 +7151,16 @@ var isEmpty = /* @__PURE__ */ __name((eb, args, { dialect }) => {
   if (!field) {
     throw new Error('"field" parameter is required');
   }
-  return eb(dialect.buildArrayLength(eb, field), "=", import_kysely15.sql.lit(0));
+  return eb(dialect.buildArrayLength(eb, field), "=", import_kysely16.sql.lit(0));
 }, "isEmpty");
-var now = /* @__PURE__ */ __name((eb, _args, { dialect }) => {
-  return (0, import_ts_pattern17.match)(dialect.provider).with("postgresql", () => eb.fn("now")).with("sqlite", () => import_kysely15.sql.raw("CURRENT_TIMESTAMP")).exhaustive();
-}, "now");
+var now = /* @__PURE__ */ __name(() => import_kysely16.sql.raw("CURRENT_TIMESTAMP"), "now");
 var currentModel = /* @__PURE__ */ __name((_eb, args, { model }) => {
   let result = model;
   const [casing] = args;
   if (casing) {
     result = processCasing(casing, result, model);
   }
-  return import_kysely15.sql.lit(result);
+  return import_kysely16.sql.lit(result);
 }, "currentModel");
 var currentOperation = /* @__PURE__ */ __name((_eb, args, { operation }) => {
   let result = operation;
@@ -6614,21 +7168,30 @@ var currentOperation = /* @__PURE__ */ __name((_eb, args, { operation }) => {
   if (casing) {
     result = processCasing(casing, result, operation);
   }
-  return import_kysely15.sql.lit(result);
+  return import_kysely16.sql.lit(result);
 }, "currentOperation");
 function processCasing(casing, result, model) {
   const opNode = casing.toOperationNode();
-  (0, import_common_helpers12.invariant)(import_kysely15.ValueNode.is(opNode) && typeof opNode.value === "string", '"casting" parameter must be a string value');
-  result = (0, import_ts_pattern17.match)(opNode.value).with("original", () => model).with("upper", () => result.toUpperCase()).with("lower", () => result.toLowerCase()).with("capitalize", () => (0, import_common_helpers12.upperCaseFirst)(result)).with("uncapitalize", () => (0, import_common_helpers12.lowerCaseFirst)(result)).otherwise(() => {
+  (0, import_common_helpers14.invariant)(import_kysely16.ValueNode.is(opNode) && typeof opNode.value === "string", '"casting" parameter must be a string value');
+  result = (0, import_ts_pattern17.match)(opNode.value).with("original", () => model).with("upper", () => result.toUpperCase()).with("lower", () => result.toLowerCase()).with("capitalize", () => (0, import_common_helpers14.upperCaseFirst)(result)).with("uncapitalize", () => (0, import_common_helpers14.lowerCaseFirst)(result)).otherwise(() => {
     throw new Error(`Invalid casing value: ${opNode.value}. Must be "original", "upper", "lower", "capitalize", or "uncapitalize".`);
   });
   return result;
 }
 __name(processCasing, "processCasing");
+function readBoolean(expr2, defaultValue) {
+  if (expr2 === void 0) {
+    return defaultValue;
+  }
+  const opNode = expr2.toOperationNode();
+  (0, import_common_helpers14.invariant)(import_kysely16.ValueNode.is(opNode), "expression must be a literal value");
+  return !!opNode.value;
+}
+__name(readBoolean, "readBoolean");
 
 // src/client/helpers/schema-db-pusher.ts
-var import_common_helpers13 = require("@zenstackhq/common-helpers");
-var import_kysely16 = require("kysely");
+var import_common_helpers15 = require("@zenstackhq/common-helpers");
+var import_kysely17 = require("kysely");
 var import_toposort = __toESM(require("toposort"), 1);
 var import_ts_pattern18 = require("ts-pattern");
 var SchemaDbPusher = class {
@@ -6649,7 +7212,8 @@ var SchemaDbPusher = class {
           await createEnum.execute();
         }
       }
-      const sortedModels = this.sortModels(this.schema.models);
+      const models = Object.values(this.schema.models).filter((m) => !m.isView);
+      const sortedModels = this.sortModels(models);
       for (const modelDef of sortedModels) {
         const createTable = this.createModelTable(tx, modelDef);
         await createTable.execute();
@@ -6658,7 +7222,7 @@ var SchemaDbPusher = class {
   }
   sortModels(models) {
     const graph = [];
-    for (const model of Object.values(models)) {
+    for (const model of models) {
       let added = false;
       if (model.baseModel) {
         const baseDef = requireModel(this.schema, model.baseModel);
@@ -6743,7 +7307,7 @@ var SchemaDbPusher = class {
   }
   addUniqueConstraint(table, modelDef) {
     for (const [key, value] of Object.entries(modelDef.uniqueFields)) {
-      (0, import_common_helpers13.invariant)(typeof value === "object", "expecting an object");
+      (0, import_common_helpers15.invariant)(typeof value === "object", "expecting an object");
       if ("type" in value) {
         const fieldDef = modelDef.fields[key];
         if (fieldDef.unique) {
@@ -6766,7 +7330,7 @@ var SchemaDbPusher = class {
       if (fieldDef.default !== void 0) {
         if (typeof fieldDef.default === "object" && "kind" in fieldDef.default) {
           if (ExpressionUtils.isCall(fieldDef.default) && fieldDef.default.function === "now") {
-            col = col.defaultTo(import_kysely16.sql`CURRENT_TIMESTAMP`);
+            col = col.defaultTo(import_kysely17.sql`CURRENT_TIMESTAMP`);
           }
         } else {
           col = col.defaultTo(fieldDef.default);
@@ -6786,7 +7350,7 @@ var SchemaDbPusher = class {
   }
   mapFieldType(fieldDef) {
     if (this.schema.enums?.[fieldDef.type]) {
-      return this.schema.provider.type === "postgresql" ? import_kysely16.sql.ref(fieldDef.type) : "text";
+      return this.schema.provider.type === "postgresql" ? import_kysely17.sql.ref(fieldDef.type) : "text";
     }
     if (this.isAutoIncrement(fieldDef) && this.schema.provider.type === "postgresql") {
       return "serial";
@@ -6799,7 +7363,7 @@ var SchemaDbPusher = class {
       throw new Error(`Unsupported field type: ${type}`);
     });
     if (fieldDef.array) {
-      return import_kysely16.sql.raw(`${result}[]`);
+      return import_kysely17.sql.raw(`${result}[]`);
     } else {
       return result;
     }
@@ -6811,7 +7375,7 @@ var SchemaDbPusher = class {
     return fieldDef.default && ExpressionUtils.isCall(fieldDef.default) && fieldDef.default.function === "autoincrement";
   }
   addForeignKeyConstraint(table, model, fieldName, fieldDef) {
-    (0, import_common_helpers13.invariant)(fieldDef.relation, "field must be a relation");
+    (0, import_common_helpers15.invariant)(fieldDef.relation, "field must be a relation");
     if (!fieldDef.relation.fields || !fieldDef.relation.references) {
       return table;
     }
@@ -6868,16 +7432,15 @@ function valueToPromise(thing) {
 __name(valueToPromise, "valueToPromise");
 
 // src/client/result-processor.ts
-var import_common_helpers14 = require("@zenstackhq/common-helpers");
-var import_decimal2 = __toESM(require("decimal.js"), 1);
-var import_ts_pattern19 = require("ts-pattern");
 var ResultProcessor = class {
   static {
     __name(this, "ResultProcessor");
   }
   schema;
-  constructor(schema) {
+  dialect;
+  constructor(schema, options) {
     this.schema = schema;
+    this.dialect = getCrudDialect(schema, options);
   }
   processResult(data, model, args) {
     const result = this.doProcessResult(data, model);
@@ -6906,7 +7469,7 @@ var ResultProcessor = class {
       }
       if (key.startsWith(DELEGATE_JOINED_FIELD_PREFIX)) {
         if (value) {
-          const subRow = this.transformJson(value);
+          const subRow = this.dialect.transformOutput(value, "Json");
           const subModel = key.slice(DELEGATE_JOINED_FIELD_PREFIX.length);
           const idValues = getIdValues(this.schema, subModel, subRow);
           if (Object.values(idValues).some((v) => v === null || v === void 0)) {
@@ -6940,10 +7503,10 @@ var ResultProcessor = class {
   processFieldValue(value, fieldDef) {
     const type = fieldDef.type;
     if (Array.isArray(value)) {
-      value.forEach((v, i) => value[i] = this.transformScalar(v, type));
+      value.forEach((v, i) => value[i] = this.dialect.transformOutput(v, type));
       return value;
     } else {
-      return this.transformScalar(value, type);
+      return this.dialect.transformOutput(value, type);
     }
   }
   processRelation(value, fieldDef) {
@@ -6957,42 +7520,6 @@ var ResultProcessor = class {
     }
     return this.doProcessResult(relationData, fieldDef.type);
   }
-  transformScalar(value, type) {
-    if (this.schema.typeDefs && type in this.schema.typeDefs) {
-      return this.transformJson(value);
-    } else {
-      return (0, import_ts_pattern19.match)(type).with("Boolean", () => this.transformBoolean(value)).with("DateTime", () => this.transformDate(value)).with("Bytes", () => this.transformBytes(value)).with("Decimal", () => this.transformDecimal(value)).with("BigInt", () => this.transformBigInt(value)).with("Json", () => this.transformJson(value)).otherwise(() => value);
-    }
-  }
-  transformDecimal(value) {
-    if (value instanceof import_decimal2.default) {
-      return value;
-    }
-    (0, import_common_helpers14.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal2.default, `Expected string, number or Decimal, got ${typeof value}`);
-    return new import_decimal2.default(value);
-  }
-  transformBigInt(value) {
-    if (typeof value === "bigint") {
-      return value;
-    }
-    (0, import_common_helpers14.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
-    return BigInt(value);
-  }
-  transformBoolean(value) {
-    return !!value;
-  }
-  transformDate(value) {
-    if (typeof value === "number") {
-      return new Date(value);
-    } else if (typeof value === "string") {
-      return new Date(Date.parse(value));
-    } else {
-      return value;
-    }
-  }
-  transformBytes(value) {
-    return Buffer.isBuffer(value) ? Uint8Array.from(value) : value;
-  }
   fixReversedResult(data, model, args) {
     if (!data) {
       return;
@@ -7017,12 +7544,6 @@ var ResultProcessor = class {
       }
     }
   }
-  transformJson(value) {
-    return (0, import_ts_pattern19.match)(this.schema.provider.type).with("sqlite", () => {
-      (0, import_common_helpers14.invariant)(typeof value === "string", "Expected string, got " + typeof value);
-      return JSON.parse(value);
-    }).otherwise(() => value);
-  }
 };
 
 // src/client/client-impl.ts
@@ -7045,7 +7566,7 @@ var ClientImpl = class _ClientImpl {
     this.schema = schema;
     this.options = options;
     this.$schema = schema;
-    this.$options = options ?? {};
+    this.$options = options;
     this.$options.functions = {
       ...functions_exports,
       ...this.$options.functions
@@ -7053,15 +7574,15 @@ var ClientImpl = class _ClientImpl {
     if (baseClient) {
       this.kyselyProps = {
         ...baseClient.kyselyProps,
-        executor: executor ?? new ZenStackQueryExecutor(this, baseClient.kyselyProps.driver, baseClient.kyselyProps.dialect.createQueryCompiler(), baseClient.kyselyProps.dialect.createAdapter(), new import_kysely17.DefaultConnectionProvider(baseClient.kyselyProps.driver))
+        executor: executor ?? new ZenStackQueryExecutor(this, baseClient.kyselyProps.driver, baseClient.kyselyProps.dialect.createQueryCompiler(), baseClient.kyselyProps.dialect.createAdapter(), new import_kysely18.DefaultConnectionProvider(baseClient.kyselyProps.driver))
       };
       this.kyselyRaw = baseClient.kyselyRaw;
       this.auth = baseClient.auth;
     } else {
-      const driver = new ZenStackDriver(options.dialect.createDriver(), new import_kysely17.Log(this.$options.log ?? []));
+      const driver = new ZenStackDriver(options.dialect.createDriver(), new import_kysely18.Log(this.$options.log ?? []));
       const compiler = options.dialect.createQueryCompiler();
       const adapter = options.dialect.createAdapter();
-      const connectionProvider = new import_kysely17.DefaultConnectionProvider(driver);
+      const connectionProvider = new import_kysely18.DefaultConnectionProvider(driver);
       this.kyselyProps = {
         config: {
           dialect: options.dialect,
@@ -7071,12 +7592,12 @@ var ClientImpl = class _ClientImpl {
         driver,
         executor: executor ?? new ZenStackQueryExecutor(this, driver, compiler, adapter, connectionProvider)
       };
-      this.kyselyRaw = new import_kysely17.Kysely({
+      this.kyselyRaw = new import_kysely18.Kysely({
         ...this.kyselyProps,
-        executor: new import_kysely17.DefaultQueryExecutor(compiler, adapter, connectionProvider, [])
+        executor: new import_kysely18.DefaultQueryExecutor(compiler, adapter, connectionProvider, [])
       });
     }
-    this.kysely = new import_kysely17.Kysely(this.kyselyProps);
+    this.kysely = new import_kysely18.Kysely(this.kyselyProps);
     return createClientProxy(this);
   }
   get $qb() {
@@ -7096,7 +7617,7 @@ var ClientImpl = class _ClientImpl {
   }
   // implementation
   async $transaction(input, options) {
-    (0, import_common_helpers15.invariant)(typeof input === "function" || Array.isArray(input) && input.every((p) => p.then && p.cb), "Invalid transaction input, expected a function or an array of ZenStackPromise");
+    (0, import_common_helpers16.invariant)(typeof input === "function" || Array.isArray(input) && input.every((p) => p.then && p.cb), "Invalid transaction input, expected a function or an array of ZenStackPromise");
     if (typeof input === "function") {
       return this.interactiveTransaction(input, options);
     } else {
@@ -7105,7 +7626,7 @@ var ClientImpl = class _ClientImpl {
   }
   forceTransaction() {
     if (!this.kysely.isTransaction) {
-      this.kysely = new import_kysely17.Transaction(this.kyselyProps);
+      this.kysely = new import_kysely18.Transaction(this.kyselyProps);
     }
   }
   async interactiveTransaction(callback, options) {
@@ -7212,7 +7733,7 @@ var ClientImpl = class _ClientImpl {
   }
   $executeRaw(query, ...values) {
     return createZenStackPromise(async () => {
-      const result = await (0, import_kysely17.sql)(query, ...values).execute(this.kysely);
+      const result = await (0, import_kysely18.sql)(query, ...values).execute(this.kysely);
       return Number(result.numAffectedRows ?? 0);
     });
   }
@@ -7225,7 +7746,7 @@ var ClientImpl = class _ClientImpl {
   }
   $queryRaw(query, ...values) {
     return createZenStackPromise(async () => {
-      const result = await (0, import_kysely17.sql)(query, ...values).execute(this.kysely);
+      const result = await (0, import_kysely18.sql)(query, ...values).execute(this.kysely);
       return result.rows;
     });
   }
@@ -7237,7 +7758,7 @@ var ClientImpl = class _ClientImpl {
     });
   }
   createRawCompiledQuery(query, values) {
-    const q = import_kysely17.CompiledQuery.raw(query, values);
+    const q = import_kysely18.CompiledQuery.raw(query, values);
     return {
       ...q,
       $raw: true
@@ -7246,7 +7767,7 @@ var ClientImpl = class _ClientImpl {
 };
 function createClientProxy(client) {
   const inputValidator = new InputValidator(client.$schema);
-  const resultProcessor = new ResultProcessor(client.$schema);
+  const resultProcessor = new ResultProcessor(client.$schema, client.$options);
   return new Proxy(client, {
     get: /* @__PURE__ */ __name((target, prop, receiver) => {
       if (typeof prop === "string" && prop.startsWith("$")) {
@@ -7364,7 +7885,7 @@ function definePlugin(plugin) {
 __name(definePlugin, "definePlugin");
 
 // src/client/index.ts
-var import_kysely18 = require("kysely");
+var import_kysely19 = require("kysely");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   InputValidationError,