@zenstackhq/runtime 3.0.0-beta.6 → 3.0.0-beta.8

package/dist/index.js

@@ -11,7 +11,7 @@ import { CompiledQuery, DefaultConnectionProvider, DefaultQueryExecutor as Defau
 
 // src/client/crud/operations/aggregate.ts
 import { sql as sql6 } from "kysely";
-import { match as match10 } from "ts-pattern";
+import { match as match11 } from "ts-pattern";
 
 // src/client/query-utils.ts
 import { invariant } from "@zenstackhq/common-helpers";
@@ -116,7 +116,12 @@ function fieldsToSelectObject(fields) {
 __name(fieldsToSelectObject, "fieldsToSelectObject");
 
 // src/client/errors.ts
-var InputValidationError = class extends Error {
+var ZenStackError = class extends Error {
+  static {
+    __name(this, "ZenStackError");
+  }
+};
+var InputValidationError = class extends ZenStackError {
   static {
     __name(this, "InputValidationError");
   }
@@ -126,7 +131,7 @@ var InputValidationError = class extends Error {
     });
   }
 };
-var QueryError = class extends Error {
+var QueryError = class extends ZenStackError {
   static {
     __name(this, "QueryError");
   }
@@ -136,12 +141,12 @@ var QueryError = class extends Error {
     });
   }
 };
-var InternalError = class extends Error {
+var InternalError = class extends ZenStackError {
   static {
     __name(this, "InternalError");
   }
 };
-var NotFoundError = class extends Error {
+var NotFoundError = class extends ZenStackError {
   static {
     __name(this, "NotFoundError");
   }
@@ -482,7 +487,7 @@ import { createId } from "@paralleldrive/cuid2";
 import { invariant as invariant9, isPlainObject as isPlainObject3 } from "@zenstackhq/common-helpers";
 import { expressionBuilder as expressionBuilder4, sql as sql5 } from "kysely";
 import { nanoid } from "nanoid";
-import { match as match9 } from "ts-pattern";
+import { match as match10 } from "ts-pattern";
 import { ulid } from "ulid";
 import * as uuid from "uuid";
 
@@ -493,7 +498,7 @@ var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
   RejectedByPolicyReason2["OTHER"] = "other";
   return RejectedByPolicyReason2;
 }({});
-var RejectedByPolicyError = class extends Error {
+var RejectedByPolicyError = class extends ZenStackError {
   static {
     __name(this, "RejectedByPolicyError");
   }
@@ -523,6 +528,10 @@ var CRUD = [
   "update",
   "delete"
 ];
+var CRUD_EXT = [
+  ...CRUD,
+  "post-update"
+];
 
 // src/client/kysely-utils.ts
 import { AliasNode, ColumnNode, ReferenceNode, TableNode } from "kysely";
@@ -558,8 +567,8 @@ __name(extractFieldName, "extractFieldName");
 
 // src/plugins/policy/policy-handler.ts
 import { invariant as invariant7 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode4, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode3, DeleteQueryNode, expressionBuilder as expressionBuilder3, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReturningNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql as sql4, TableNode as TableNode4, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
-import { match as match8 } from "ts-pattern";
+import { AliasNode as AliasNode4, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode3, DeleteQueryNode, expressionBuilder as expressionBuilder3, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReferenceNode as ReferenceNode4, ReturningNode, SelectAllNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql as sql4, TableNode as TableNode4, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
+import { match as match9 } from "ts-pattern";
 
 // src/client/crud/dialects/index.ts
 import { match as match5 } from "ts-pattern";
@@ -1706,6 +1715,59 @@ function getCrudDialect(schema, options) {
 }
 __name(getCrudDialect, "getCrudDialect");
 
+// src/utils/expression-utils.ts
+import { match as match6 } from "ts-pattern";
+var ExpressionVisitor = class {
+  static {
+    __name(this, "ExpressionVisitor");
+  }
+  visit(expr2) {
+    match6(expr2).with({
+      kind: "literal"
+    }, (e) => this.visitLiteral(e)).with({
+      kind: "array"
+    }, (e) => this.visitArray(e)).with({
+      kind: "field"
+    }, (e) => this.visitField(e)).with({
+      kind: "member"
+    }, (e) => this.visitMember(e)).with({
+      kind: "binary"
+    }, (e) => this.visitBinary(e)).with({
+      kind: "unary"
+    }, (e) => this.visitUnary(e)).with({
+      kind: "call"
+    }, (e) => this.visitCall(e)).with({
+      kind: "this"
+    }, (e) => this.visitThis(e)).with({
+      kind: "null"
+    }, (e) => this.visitNull(e)).exhaustive();
+  }
+  visitLiteral(_e) {
+  }
+  visitArray(e) {
+    e.items.forEach((item) => this.visit(item));
+  }
+  visitField(_e) {
+  }
+  visitMember(e) {
+    this.visit(e.receiver);
+  }
+  visitBinary(e) {
+    this.visit(e.left);
+    this.visit(e.right);
+  }
+  visitUnary(e) {
+    this.visit(e.operand);
+  }
+  visitCall(e) {
+    e.args?.forEach((arg) => this.visit(arg));
+  }
+  visitThis(_e) {
+  }
+  visitNull(_e) {
+  }
+};
+
 // src/utils/default-operation-node-visitor.ts
 import { OperationNodeVisitor } from "kysely";
 var DefaultOperationNodeVisitor = class extends OperationNodeVisitor {
@@ -2027,17 +2089,17 @@ var ColumnCollector = class extends DefaultOperationNodeVisitor {
 // src/plugins/policy/expression-transformer.ts
 import { invariant as invariant6 } from "@zenstackhq/common-helpers";
 import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode2, ColumnNode as ColumnNode2, expressionBuilder as expressionBuilder2, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode3, SelectionNode, SelectQueryNode, TableNode as TableNode3, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
-import { match as match7 } from "ts-pattern";
+import { match as match8 } from "ts-pattern";
 
 // src/plugins/policy/expression-evaluator.ts
 import { invariant as invariant5 } from "@zenstackhq/common-helpers";
-import { match as match6 } from "ts-pattern";
+import { match as match7 } from "ts-pattern";
 var ExpressionEvaluator = class {
   static {
     __name(this, "ExpressionEvaluator");
   }
   evaluate(expression, context) {
-    const result = match6(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
+    const result = match7(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
     return result ?? null;
   }
   evaluateCall(expr2, context) {
@@ -2048,7 +2110,7 @@ var ExpressionEvaluator = class {
     }
   }
   evaluateUnary(expr2, context) {
-    return match6(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
+    return match7(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
   }
   evaluateMember(expr2, context) {
     let val = this.evaluate(expr2.receiver, context);
@@ -2072,7 +2134,7 @@ var ExpressionEvaluator = class {
     }
     const left = this.evaluate(expr2.left, context);
     const right = this.evaluate(expr2.right, context);
-    return match6(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
+    return match7(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
       invariant5(Array.isArray(_right), 'expected array for "in" operator');
       return _right.includes(left);
@@ -2086,7 +2148,7 @@ var ExpressionEvaluator = class {
       return false;
     }
     invariant5(Array.isArray(left), "expected array");
-    return match6(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
+    return match7(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
       ...context,
       thisValue: item
     }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
@@ -2196,6 +2258,10 @@ function getTableName(node) {
   return void 0;
 }
 __name(getTableName, "getTableName");
+function isBeforeInvocation(expr2) {
+  return ExpressionUtils.isCall(expr2) && expr2.function === "before";
+}
+__name(isBeforeInvocation, "isBeforeInvocation");
 
 // src/plugins/policy/expression-transformer.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -2399,7 +2465,7 @@ var ExpressionTransformer = class {
     const count = FunctionNode2.create("count", [
       ValueNode2.createImmediate(1)
     ]);
-    const predicateResult = match7(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode2.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).exhaustive();
+    const predicateResult = match8(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode2.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).exhaustive();
     return this.transform(expr2.left, {
       ...context,
       memberSelect: SelectionNode.create(AliasNode3.create(predicateResult, IdentifierNode.create("$t"))),
@@ -2464,7 +2530,7 @@ var ExpressionTransformer = class {
     return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
-    const mappedOp = match7(op).with("==", () => "=").otherwise(() => op);
+    const mappedOp = match8(op).with("==", () => "=").otherwise(() => op);
     return OperatorNode2.create(mappedOp);
   }
   _call(expr2, context) {
@@ -2508,7 +2574,7 @@ var ExpressionTransformer = class {
       return this.transformCall(arg, context);
     }
     if (this.isAuthMember(arg)) {
-      const valNode = this.valueMemberAccess(context.auth, arg, this.authType);
+      const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
       return valNode ? eb.val(valNode.value) : eb.val(null);
     }
     throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
@@ -2517,6 +2583,11 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
+    if (isBeforeInvocation(expr2.receiver)) {
+      invariant6(context.operation === "post-update", "before() can only be used in post-update policy");
+      invariant6(expr2.members.length === 1, "before() can only be followed by a scalar field access");
+      return ReferenceNode3.create(ColumnNode2.create(expr2.members[0]), TableNode3.create("$before"));
+    }
     invariant6(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
     let members = expr2.members;
     let receiver;
@@ -2561,7 +2632,6 @@ var ExpressionTransformer = class {
           alias: void 0
         });
         if (currNode) {
-          invariant6(SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
@@ -2772,9 +2842,45 @@ var PolicyHandler = class extends OperationNodeTransformer {
         await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
       }
     }
+    const hasPostUpdatePolicies = UpdateQueryNode.is(node) && this.hasPostUpdatePolicies(mutationModel);
+    let beforeUpdateInfo;
+    if (hasPostUpdatePolicies) {
+      beforeUpdateInfo = await this.loadBeforeUpdateEntities(mutationModel, node.where, proceed);
+    }
     const result = await proceed(this.transformNode(node));
+    if (hasPostUpdatePolicies && result.rows.length > 0) {
+      const idConditions = this.buildIdConditions(mutationModel, result.rows);
+      const postUpdateFilter = this.buildPolicyFilter(mutationModel, void 0, "post-update");
+      const eb = expressionBuilder3();
+      const beforeUpdateTable = beforeUpdateInfo ? {
+        kind: "SelectQueryNode",
+        from: FromNode2.create([
+          ParensNode2.create(ValuesNode.create(beforeUpdateInfo.rows.map((r) => PrimitiveValueListNode.create(beforeUpdateInfo.fields.map((f) => r[f])))))
+        ]),
+        selections: beforeUpdateInfo.fields.map((name, index) => {
+          const def = requireField(this.client.$schema, mutationModel, name);
+          const castedColumnRef = sql4`CAST(${eb.ref(`column${index + 1}`)} as ${sql4.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+          return SelectionNode2.create(castedColumnRef.toOperationNode());
+        })
+      } : void 0;
+      const postUpdateQuery = eb.selectFrom(mutationModel).select(() => [
+        eb(eb.fn("COUNT", [
+          eb.lit(1)
+        ]), "=", result.rows.length).as("$condition")
+      ]).where(() => new ExpressionWrapper(conjunction(this.dialect, [
+        idConditions,
+        postUpdateFilter
+      ]))).$if(!!beforeUpdateInfo, (qb) => qb.leftJoin(() => new ExpressionWrapper(beforeUpdateTable).as("$before"), (join) => {
+        const idFields = requireIdFields(this.client.$schema, mutationModel);
+        return idFields.reduce((acc, f) => acc.onRef(`${mutationModel}.${f}`, "=", `$before.${f}`), join);
+      }));
+      const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
+      if (!postUpdateResult.rows[0]?.$condition) {
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+      }
+    }
     if (!node.returning || this.onlyReturningId(node)) {
-      return result;
+      return this.postProcessMutationResult(result, node);
     } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
@@ -2783,6 +2889,68 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return readBackResult;
     }
   }
+  // correction to kysely mutation result may be needed because we might have added
+  // returning clause to the query and caused changes to the result shape
+  postProcessMutationResult(result, node) {
+    if (node.returning) {
+      return result;
+    } else {
+      return {
+        ...result,
+        rows: [],
+        numAffectedRows: result.numAffectedRows ?? BigInt(result.rows.length)
+      };
+    }
+  }
+  hasPostUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    return policies.length > 0;
+  }
+  async loadBeforeUpdateEntities(model, where, proceed) {
+    const beforeUpdateAccessFields = this.getFieldsAccessForBeforeUpdatePolicies(model);
+    if (!beforeUpdateAccessFields || beforeUpdateAccessFields.length === 0) {
+      return void 0;
+    }
+    const query = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        TableNode4.create(model)
+      ]),
+      where,
+      selections: [
+        ...beforeUpdateAccessFields.map((f) => SelectionNode2.create(ColumnNode3.create(f)))
+      ]
+    };
+    const result = await proceed(query);
+    return {
+      fields: beforeUpdateAccessFields,
+      rows: result.rows
+    };
+  }
+  getFieldsAccessForBeforeUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    if (policies.length === 0) {
+      return void 0;
+    }
+    const fields = /* @__PURE__ */ new Set();
+    const fieldCollector = new class extends ExpressionVisitor {
+      visitMember(e) {
+        if (isBeforeInvocation(e.receiver)) {
+          invariant7(e.members.length === 1, "before() can only be followed by a scalar field access");
+          fields.add(e.members[0]);
+        }
+        super.visitMember(e);
+      }
+    }();
+    for (const policy of policies) {
+      fieldCollector.visit(policy.condition);
+    }
+    if (fields.size === 0) {
+      return void 0;
+    }
+    requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
+    return Array.from(fields).sort();
+  }
   // #region overrides
   transformSelectQuery(node) {
     let whereNode = this.transformNode(node.where);
@@ -2848,19 +3016,16 @@ var PolicyHandler = class extends OperationNodeTransformer {
       onConflict
     } : node;
     const result = super.transformInsertQuery(processedNode);
-    if (!node.returning) {
-      return result;
-    }
-    if (this.onlyReturningId(node)) {
-      return result;
-    } else {
+    let returning = result.returning;
+    if (returning) {
       const { mutationModel } = this.getMutationModel(node);
       const idFields = requireIdFields(this.client.$schema, mutationModel);
-      return {
-        ...result,
-        returning: ReturningNode.create(idFields.map((field) => SelectionNode2.create(ColumnNode3.create(field))))
-      };
+      returning = ReturningNode.create(idFields.map((f) => SelectionNode2.create(ColumnNode3.create(f))));
     }
+    return {
+      ...result,
+      returning
+    };
   }
   transformUpdateQuery(node) {
     const result = super.transformUpdateQuery(node);
@@ -2875,12 +3040,18 @@ var PolicyHandler = class extends OperationNodeTransformer {
         ]);
       }
     }
+    let returning = result.returning;
+    if (returning || this.hasPostUpdatePolicies(mutationModel)) {
+      const idFields = requireIdFields(this.client.$schema, mutationModel);
+      returning = ReturningNode.create(idFields.map((f) => SelectionNode2.create(ColumnNode3.create(f))));
+    }
     return {
       ...result,
       where: WhereNode2.create(result.where ? conjunction(this.dialect, [
         result.where.where,
         filter
-      ]) : filter)
+      ]) : filter),
+      returning
     };
   }
   transformDeleteQuery(node) {
@@ -2912,6 +3083,14 @@ var PolicyHandler = class extends OperationNodeTransformer {
     }
     const { mutationModel } = this.getMutationModel(node);
     const idFields = requireIdFields(this.client.$schema, mutationModel);
+    if (node.returning.selections.some((s) => SelectAllNode.is(s.selection))) {
+      const modelDef = requireModel(this.client.$schema, mutationModel);
+      if (Object.keys(modelDef.fields).some((f) => !idFields.includes(f))) {
+        return false;
+      } else {
+        return true;
+      }
+    }
     const collector = new ColumnCollector();
     const selectedColumns = collector.collect(node.returning);
     return selectedColumns.every((c) => idFields.includes(c));
@@ -3095,10 +3274,10 @@ var PolicyHandler = class extends OperationNodeTransformer {
   }
   buildIdConditions(table, rows) {
     const idFields = requireIdFields(this.client.$schema, table);
-    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ColumnNode3.create(field), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ReferenceNode4.create(ColumnNode3.create(field), TableNode4.create(table)), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
   }
   getMutationModel(node) {
-    const r = match8(node).when(InsertQueryNode.is, (node2) => ({
+    const r = match9(node).when(InsertQueryNode.is, (node2) => ({
       mutationModel: getTableName(node2.into),
       alias: void 0
     })).when(UpdateQueryNode.is, (node2) => {
@@ -3137,23 +3316,24 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return m2mFilter;
     }
     const policies = this.getModelPolicies(model, operation);
-    if (policies.length === 0) {
-      return falseNode(this.dialect);
-    }
     const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     let combinedPolicy;
     if (allows.length === 0) {
-      combinedPolicy = falseNode(this.dialect);
+      if (operation === "post-update") {
+        combinedPolicy = trueNode(this.dialect);
+      } else {
+        combinedPolicy = falseNode(this.dialect);
+      }
     } else {
       combinedPolicy = disjunction(this.dialect, allows);
-      if (denies.length !== 0) {
-        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
-        combinedPolicy = conjunction(this.dialect, [
-          combinedPolicy,
-          combinedDenies
-        ]);
-      }
+    }
+    if (denies.length !== 0) {
+      const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+      combinedPolicy = conjunction(this.dialect, [
+        combinedPolicy,
+        combinedDenies
+      ]);
     }
     return combinedPolicy;
   }
@@ -3200,8 +3380,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
     return new ExpressionTransformer(this.client).transform(policy.condition, {
       model,
       alias,
-      operation,
-      auth: this.client.$auth
+      operation
     });
   }
   getModelPolicies(model, operation) {
@@ -3217,7 +3396,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
         kind: attr.name === "@@allow" ? "allow" : "deny",
         operations: extractOperations(attr.args[0].value),
         condition: attr.args[1].value
-      })).filter((policy) => policy.operations.includes("all") || policy.operations.includes(operation)));
+      })).filter((policy) => operation !== "post-update" && policy.operations.includes("all") || policy.operations.includes(operation)));
     }
     return result;
   }
@@ -3318,18 +3497,9 @@ var PolicyPlugin = class {
       check
     };
   }
-  onKyselyQuery({
-    query,
-    client,
-    proceed
-    /*, transaction*/
-  }) {
+  onKyselyQuery({ query, client, proceed }) {
     const handler = new PolicyHandler(client);
-    return handler.handle(
-      query,
-      proceed
-      /*, transaction*/
-    );
+    return handler.handle(query, proceed);
   }
 };
 
@@ -3870,7 +4040,7 @@ var BaseOperationHandler = class {
   }
   evalGenerator(defaultValue) {
     if (ExpressionUtils.isCall(defaultValue)) {
-      return match9(defaultValue.function).with("cuid", () => createId()).with("uuid", () => defaultValue.args?.[0] && ExpressionUtils.isLiteral(defaultValue.args?.[0]) && defaultValue.args[0].value === 7 ? uuid.v7() : uuid.v4()).with("nanoid", () => defaultValue.args?.[0] && ExpressionUtils.isLiteral(defaultValue.args[0]) && typeof defaultValue.args[0].value === "number" ? nanoid(defaultValue.args[0].value) : nanoid()).with("ulid", () => ulid()).otherwise(() => void 0);
+      return match10(defaultValue.function).with("cuid", () => createId()).with("uuid", () => defaultValue.args?.[0] && ExpressionUtils.isLiteral(defaultValue.args?.[0]) && defaultValue.args[0].value === 7 ? uuid.v7() : uuid.v4()).with("nanoid", () => defaultValue.args?.[0] && ExpressionUtils.isLiteral(defaultValue.args[0]) && typeof defaultValue.args[0].value === "number" ? nanoid(defaultValue.args[0].value) : nanoid()).with("ulid", () => ulid()).otherwise(() => void 0);
     } else if (ExpressionUtils.isMember(defaultValue) && ExpressionUtils.isCall(defaultValue.receiver) && defaultValue.receiver.function === "auth") {
       let val = this.client.$auth;
       for (const member of defaultValue.members) {
@@ -4052,7 +4222,7 @@ var BaseOperationHandler = class {
     const value = this.dialect.transformPrimitive(payload[key], fieldDef.type, false);
     const eb = expressionBuilder4();
     const fieldRef = this.dialect.fieldRef(model, field, eb);
-    return match9(key).with("set", () => value).with("increment", () => eb(fieldRef, "+", value)).with("decrement", () => eb(fieldRef, "-", value)).with("multiply", () => eb(fieldRef, "*", value)).with("divide", () => eb(fieldRef, "/", value)).otherwise(() => {
+    return match10(key).with("set", () => value).with("increment", () => eb(fieldRef, "+", value)).with("decrement", () => eb(fieldRef, "-", value)).with("multiply", () => eb(fieldRef, "*", value)).with("divide", () => eb(fieldRef, "/", value)).otherwise(() => {
       throw new InternalError(`Invalid incremental update operation: ${key}`);
     });
   }
@@ -4062,7 +4232,7 @@ var BaseOperationHandler = class {
     const value = this.dialect.transformPrimitive(payload[key], fieldDef.type, true);
     const eb = expressionBuilder4();
     const fieldRef = this.dialect.fieldRef(model, field, eb);
-    return match9(key).with("set", () => value).with("push", () => {
+    return match10(key).with("set", () => value).with("push", () => {
       return eb(fieldRef, "||", eb.val(ensureArray(value)));
     }).otherwise(() => {
       throw new InternalError(`Invalid array update operation: ${key}`);
@@ -4132,8 +4302,9 @@ var BaseOperationHandler = class {
       };
     } else {
       const idFields = requireIdFields(this.schema, model);
-      const result = await query.returning(idFields).execute();
-      return result;
+      const finalQuery = query.returning(idFields);
+      const result = await this.executeQuery(kysely, finalQuery, "update");
+      return result.rows;
     }
   }
   async processBaseModelUpdateMany(kysely, model, where, updateFields, filterModel) {
@@ -4753,7 +4924,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
           Object.entries(value).forEach(([field, val]) => {
             if (val === true) {
               query = query.select((eb) => {
-                const fn = match10(key).with("_sum", () => eb.fn.sum).with("_avg", () => eb.fn.avg).with("_max", () => eb.fn.max).with("_min", () => eb.fn.min).exhaustive();
+                const fn = match11(key).with("_sum", () => eb.fn.sum).with("_avg", () => eb.fn.avg).with("_max", () => eb.fn.max).with("_min", () => eb.fn.min).exhaustive();
                 return fn(sql6.ref(`$sub.${field}`)).as(`${key}.${field}`);
               });
             }
@@ -4786,7 +4957,7 @@ var AggregateOperationHandler = class extends BaseOperationHandler {
             val = parseFloat(val);
           } else {
             if (op === "_sum" || op === "_min" || op === "_max") {
-              val = match10(type).with("Int", () => parseInt(value, 10)).with("BigInt", () => BigInt(value)).with("Float", () => parseFloat(value)).with("Decimal", () => parseFloat(value)).otherwise(() => value);
+              val = match11(type).with("Int", () => parseInt(value, 10)).with("BigInt", () => BigInt(value)).with("Float", () => parseFloat(value)).with("Decimal", () => parseFloat(value)).otherwise(() => value);
             }
           }
         }
@@ -4837,14 +5008,14 @@ var CountOperationHandler = class extends BaseOperationHandler {
 };
 
 // src/client/crud/operations/create.ts
-import { match as match11 } from "ts-pattern";
+import { match as match12 } from "ts-pattern";
 var CreateOperationHandler = class extends BaseOperationHandler {
   static {
     __name(this, "CreateOperationHandler");
   }
   async handle(operation, args) {
     const normalizedArgs = this.normalizeArgs(args);
-    return match11(operation).with("create", () => this.runCreate(this.inputValidator.validateCreateArgs(this.model, normalizedArgs))).with("createMany", () => {
+    return match12(operation).with("create", () => this.runCreate(this.inputValidator.validateCreateArgs(this.model, normalizedArgs))).with("createMany", () => {
       return this.runCreateMany(this.inputValidator.validateCreateManyArgs(this.model, normalizedArgs));
     }).with("createManyAndReturn", () => {
       return this.runCreateManyAndReturn(this.inputValidator.validateCreateManyAndReturnArgs(this.model, normalizedArgs));
@@ -4891,14 +5062,14 @@ var CreateOperationHandler = class extends BaseOperationHandler {
 };
 
 // src/client/crud/operations/delete.ts
-import { match as match12 } from "ts-pattern";
+import { match as match13 } from "ts-pattern";
 var DeleteOperationHandler = class extends BaseOperationHandler {
   static {
     __name(this, "DeleteOperationHandler");
   }
   async handle(operation, args) {
     const normalizedArgs = this.normalizeArgs(args);
-    return match12(operation).with("delete", () => this.runDelete(this.inputValidator.validateDeleteArgs(this.model, normalizedArgs))).with("deleteMany", () => this.runDeleteMany(this.inputValidator.validateDeleteManyArgs(this.model, normalizedArgs))).exhaustive();
+    return match13(operation).with("delete", () => this.runDelete(this.inputValidator.validateDeleteArgs(this.model, normalizedArgs))).with("deleteMany", () => this.runDeleteMany(this.inputValidator.validateDeleteManyArgs(this.model, normalizedArgs))).exhaustive();
   }
   async runDelete(args) {
     const existing = await this.readUnique(this.kysely, this.model, {
@@ -4950,7 +5121,7 @@ var FindOperationHandler = class extends BaseOperationHandler {
 
 // src/client/crud/operations/group-by.ts
 import { expressionBuilder as expressionBuilder5 } from "kysely";
-import { match as match13 } from "ts-pattern";
+import { match as match14 } from "ts-pattern";
 var GroupByOperationHandler = class extends BaseOperationHandler {
   static {
     __name(this, "GroupByOperationHandler");
@@ -5044,7 +5215,7 @@ var GroupByOperationHandler = class extends BaseOperationHandler {
             val = parseFloat(val);
           } else {
             if (op === "_sum" || op === "_min" || op === "_max") {
-              val = match13(type).with("Int", () => parseInt(value, 10)).with("BigInt", () => BigInt(value)).with("Float", () => parseFloat(value)).with("Decimal", () => parseFloat(value)).otherwise(() => value);
+              val = match14(type).with("Int", () => parseInt(value, 10)).with("BigInt", () => BigInt(value)).with("Float", () => parseFloat(value)).with("Decimal", () => parseFloat(value)).otherwise(() => value);
             }
           }
         }
@@ -5059,14 +5230,14 @@ var GroupByOperationHandler = class extends BaseOperationHandler {
 };
 
 // src/client/crud/operations/update.ts
-import { match as match14 } from "ts-pattern";
+import { match as match15 } from "ts-pattern";
 var UpdateOperationHandler = class extends BaseOperationHandler {
   static {
     __name(this, "UpdateOperationHandler");
   }
   async handle(operation, args) {
     const normalizedArgs = this.normalizeArgs(args);
-    return match14(operation).with("update", () => this.runUpdate(this.inputValidator.validateUpdateArgs(this.model, normalizedArgs))).with("updateMany", () => this.runUpdateMany(this.inputValidator.validateUpdateManyArgs(this.model, normalizedArgs))).with("updateManyAndReturn", () => this.runUpdateManyAndReturn(this.inputValidator.validateUpdateManyAndReturnArgs(this.model, normalizedArgs))).with("upsert", () => this.runUpsert(this.inputValidator.validateUpsertArgs(this.model, normalizedArgs))).exhaustive();
+    return match15(operation).with("update", () => this.runUpdate(this.inputValidator.validateUpdateArgs(this.model, normalizedArgs))).with("updateMany", () => this.runUpdateMany(this.inputValidator.validateUpdateManyArgs(this.model, normalizedArgs))).with("updateManyAndReturn", () => this.runUpdateManyAndReturn(this.inputValidator.validateUpdateManyAndReturnArgs(this.model, normalizedArgs))).with("upsert", () => this.runUpsert(this.inputValidator.validateUpsertArgs(this.model, normalizedArgs))).exhaustive();
   }
   async runUpdate(args) {
     const readBackResult = await this.safeTransaction(async (tx) => {
@@ -5146,7 +5317,7 @@ var UpdateOperationHandler = class extends BaseOperationHandler {
 import { invariant as invariant10 } from "@zenstackhq/common-helpers";
 import Decimal3 from "decimal.js";
 import stableStringify from "json-stable-stringify";
-import { match as match15, P as P2 } from "ts-pattern";
+import { match as match16, P as P2 } from "ts-pattern";
 import { z } from "zod";
 
 // src/utils/zod-utils.ts
@@ -5262,7 +5433,7 @@ var InputValidator = class {
     if (this.schema.typeDefs && type in this.schema.typeDefs) {
       return this.makeTypeDefSchema(type);
     } else {
-      return match15(type).with("String", () => z.string()).with("Int", () => z.number().int()).with("Float", () => z.number()).with("Boolean", () => z.boolean()).with("BigInt", () => z.union([
+      return match16(type).with("String", () => z.string()).with("Int", () => z.number().int()).with("Float", () => z.number()).with("Boolean", () => z.boolean()).with("BigInt", () => z.union([
         z.number().int(),
         z.bigint()
       ])).with("Decimal", () => z.union([
@@ -5423,7 +5594,7 @@ var InputValidator = class {
     if (this.schema.typeDefs && type in this.schema.typeDefs) {
       return this.makeTypeDefFilterSchema(type, optional);
     }
-    return match15(type).with("String", () => this.makeStringFilterSchema(optional, withAggregations)).with(P2.union("Int", "Float", "Decimal", "BigInt"), (type2) => this.makeNumberFilterSchema(this.makePrimitiveSchema(type2), optional, withAggregations)).with("Boolean", () => this.makeBooleanFilterSchema(optional, withAggregations)).with("DateTime", () => this.makeDateTimeFilterSchema(optional, withAggregations)).with("Bytes", () => this.makeBytesFilterSchema(optional, withAggregations)).with("Json", () => z.any()).with("Unsupported", () => z.never()).exhaustive();
+    return match16(type).with("String", () => this.makeStringFilterSchema(optional, withAggregations)).with(P2.union("Int", "Float", "Decimal", "BigInt"), (type2) => this.makeNumberFilterSchema(this.makePrimitiveSchema(type2), optional, withAggregations)).with("Boolean", () => this.makeBooleanFilterSchema(optional, withAggregations)).with("DateTime", () => this.makeDateTimeFilterSchema(optional, withAggregations)).with("Bytes", () => this.makeBytesFilterSchema(optional, withAggregations)).with("Json", () => z.any()).with("Unsupported", () => z.never()).exhaustive();
   }
   makeTypeDefFilterSchema(_type, _optional) {
     return z.never();
@@ -6369,11 +6540,11 @@ __name(performanceNow, "performanceNow");
 // src/client/executor/zenstack-query-executor.ts
 import { invariant as invariant12 } from "@zenstackhq/common-helpers";
 import { AndNode as AndNode2, DefaultQueryExecutor, DeleteQueryNode as DeleteQueryNode2, InsertQueryNode as InsertQueryNode2, ReturningNode as ReturningNode2, SelectionNode as SelectionNode4, SingleConnectionProvider, TableNode as TableNode6, UpdateQueryNode as UpdateQueryNode2, WhereNode as WhereNode3 } from "kysely";
-import { match as match16 } from "ts-pattern";
+import { match as match17 } from "ts-pattern";
 
 // src/client/executor/name-mapper.ts
 import { invariant as invariant11 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode5, ColumnNode as ColumnNode4, FromNode as FromNode3, IdentifierNode as IdentifierNode3, OperationNodeTransformer as OperationNodeTransformer2, ReferenceNode as ReferenceNode4, SelectAllNode, SelectionNode as SelectionNode3, TableNode as TableNode5 } from "kysely";
+import { AliasNode as AliasNode5, ColumnNode as ColumnNode4, FromNode as FromNode3, IdentifierNode as IdentifierNode3, OperationNodeTransformer as OperationNodeTransformer2, ReferenceNode as ReferenceNode5, SelectAllNode as SelectAllNode2, SelectionNode as SelectionNode3, TableNode as TableNode5 } from "kysely";
 var QueryNameMapper = class extends OperationNodeTransformer2 {
   static {
     __name(this, "QueryNameMapper");
@@ -6455,7 +6626,7 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
           mappedTableName = this.mapTableName(scope.model);
         }
       }
-      return ReferenceNode4.create(ColumnNode4.create(mappedFieldName), mappedTableName ? TableNode5.create(mappedTableName) : void 0);
+      return ReferenceNode5.create(ColumnNode4.create(mappedFieldName), mappedTableName ? TableNode5.create(mappedTableName) : void 0);
     } else {
       return super.transformReference(node);
     }
@@ -6516,14 +6687,14 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
   processSelectQuerySelections(node) {
     const selections = [];
     for (const selection of node.selections ?? []) {
-      if (SelectAllNode.is(selection.selection)) {
+      if (SelectAllNode2.is(selection.selection)) {
         const scope = this.scopes[this.scopes.length - 1];
         if (scope?.model && !scope.namesMapped) {
           selections.push(...this.createSelectAllFields(scope.model, scope.alias));
         } else {
           selections.push(super.transformSelection(selection));
         }
-      } else if (ReferenceNode4.is(selection.selection) || ColumnNode4.is(selection.selection)) {
+      } else if (ReferenceNode5.is(selection.selection) || ColumnNode4.is(selection.selection)) {
         const transformed = this.transformNode(selection.selection);
         if (AliasNode5.is(transformed)) {
           selections.push(SelectionNode3.create(transformed));
@@ -6665,7 +6836,7 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
     const modelDef = requireModel(this.schema, model);
     return this.getModelFields(modelDef).map((fieldDef) => {
       const columnName = this.mapFieldName(model, fieldDef.name);
-      const columnRef = ReferenceNode4.create(ColumnNode4.create(columnName), alias && IdentifierNode3.is(alias) ? TableNode5.create(alias.name) : void 0);
+      const columnRef = ReferenceNode5.create(ColumnNode4.create(columnName), alias && IdentifierNode3.is(alias) ? TableNode5.create(alias.name) : void 0);
       if (columnName !== fieldDef.name) {
         const aliased = AliasNode5.create(columnRef, IdentifierNode3.create(fieldDef.name));
         return SelectionNode3.create(aliased);
@@ -6680,7 +6851,7 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
   processSelections(selections) {
     const result = [];
     selections.forEach((selection) => {
-      if (SelectAllNode.is(selection.selection)) {
+      if (SelectAllNode2.is(selection.selection)) {
         const processed = this.processSelectAll(selection.selection);
         if (Array.isArray(processed)) {
           result.push(...processed.map((s) => SelectionNode3.create(s)));
@@ -6710,7 +6881,7 @@ var QueryNameMapper = class extends OperationNodeTransformer2 {
     const modelDef = requireModel(this.schema, scope.model);
     return this.getModelFields(modelDef).map((fieldDef) => {
       const columnName = this.mapFieldName(modelDef.name, fieldDef.name);
-      const columnRef = ReferenceNode4.create(ColumnNode4.create(columnName));
+      const columnRef = ReferenceNode5.create(ColumnNode4.create(columnName));
       return columnName !== fieldDef.name ? this.wrapAlias(columnRef, IdentifierNode3.create(fieldDef.name)) : columnRef;
     });
   }
@@ -6737,13 +6908,37 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends DefaultQueryExe
   get options() {
     return this.client.$options;
   }
-  async executeQuery(compiledQuery, queryId) {
+  executeQuery(compiledQuery, queryId) {
     const queryParams = compiledQuery.$raw ? compiledQuery.parameters : void 0;
-    const result = await this.proceedQueryWithKyselyInterceptors(compiledQuery.query, queryParams, queryId.queryId);
-    return result.result;
+    return this.provideConnection(async (connection) => {
+      let startedTx = false;
+      try {
+        if (this.isMutationNode(compiledQuery.query) && !this.driver.isTransactionConnection(connection)) {
+          await this.driver.beginTransaction(connection, {
+            isolationLevel: TransactionIsolationLevel.RepeatableRead
+          });
+          startedTx = true;
+        }
+        const result = await this.proceedQueryWithKyselyInterceptors(connection, compiledQuery.query, queryParams, queryId.queryId);
+        if (startedTx) {
+          await this.driver.commitTransaction(connection);
+        }
+        return result;
+      } catch (err) {
+        if (startedTx) {
+          await this.driver.rollbackTransaction(connection);
+        }
+        if (err instanceof ZenStackError) {
+          throw err;
+        } else {
+          const message = `Failed to execute query: ${err}, sql: ${compiledQuery?.sql}`;
+          throw new QueryError(message, err);
+        }
+      }
+    });
   }
-  async proceedQueryWithKyselyInterceptors(queryNode, parameters, queryId) {
-    let proceed = /* @__PURE__ */ __name((q) => this.proceedQuery(q, parameters, queryId), "proceed");
+  async proceedQueryWithKyselyInterceptors(connection, queryNode, parameters, queryId) {
+    let proceed = /* @__PURE__ */ __name((q) => this.proceedQuery(connection, q, parameters, queryId), "proceed");
     const hooks = [];
     for (const plugin of this.client.$options.plugins ?? []) {
       if (plugin.onKyselyQuery) {
@@ -6753,19 +6948,14 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends DefaultQueryExe
     for (const hook of hooks) {
       const _proceed = proceed;
       proceed = /* @__PURE__ */ __name(async (query) => {
-        const _p = /* @__PURE__ */ __name(async (q) => {
-          const r = await _proceed(q);
-          return r.result;
-        }, "_p");
+        const _p = /* @__PURE__ */ __name((q) => _proceed(q), "_p");
         const hookResult = await hook({
           client: this.client,
           schema: this.client.$schema,
           query,
           proceed: _p
         });
-        return {
-          result: hookResult
-        };
+        return hookResult;
       }, "proceed");
     }
     const result = await proceed(queryNode);
@@ -6773,7 +6963,7 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends DefaultQueryExe
   }
   getMutationInfo(queryNode) {
     const model = this.getMutationModel(queryNode);
-    const { action, where } = match16(queryNode).when(InsertQueryNode2.is, () => ({
+    const { action, where } = match17(queryNode).when(InsertQueryNode2.is, () => ({
       action: "create",
       where: void 0
     })).when(UpdateQueryNode2.is, (node) => ({
@@ -6789,85 +6979,54 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends DefaultQueryExe
       where
     };
   }
-  async proceedQuery(query, parameters, queryId) {
+  async proceedQuery(connection, query, parameters, queryId) {
     let compiled;
-    try {
-      return await this.provideConnection(async (connection) => {
-        if (this.suppressMutationHooks || !this.isMutationNode(query) || !this.hasEntityMutationPlugins) {
-          const finalQuery2 = this.nameMapper.transformNode(query);
-          compiled = this.compileQuery(finalQuery2);
-          if (parameters) {
-            compiled = {
-              ...compiled,
-              parameters
-            };
-          }
-          const result = await connection.executeQuery(compiled);
-          return {
-            result
-          };
-        }
-        if ((InsertQueryNode2.is(query) || UpdateQueryNode2.is(query)) && this.hasEntityMutationPluginsWithAfterMutationHooks) {
-          query = {
-            ...query,
-            returning: ReturningNode2.create([
-              SelectionNode4.createSelectAll()
-            ])
-          };
-        }
-        const finalQuery = this.nameMapper.transformNode(query);
-        compiled = this.compileQuery(finalQuery);
-        if (parameters) {
-          compiled = {
-            ...compiled,
-            parameters
-          };
-        }
-        const currentlyInTx = this.driver.isTransactionConnection(connection);
-        const connectionClient = this.createClientForConnection(connection, currentlyInTx);
-        const mutationInfo = this.getMutationInfo(finalQuery);
-        let beforeMutationEntities;
-        const loadBeforeMutationEntities = /* @__PURE__ */ __name(async () => {
-          if (beforeMutationEntities === void 0 && (UpdateQueryNode2.is(query) || DeleteQueryNode2.is(query))) {
-            beforeMutationEntities = await this.loadEntities(mutationInfo.model, mutationInfo.where, connection);
-          }
-          return beforeMutationEntities;
-        }, "loadBeforeMutationEntities");
-        await this.callBeforeMutationHooks(finalQuery, mutationInfo, loadBeforeMutationEntities, connectionClient, queryId);
-        const shouldCreateTx = this.hasPluginRequestingAfterMutationWithinTransaction && !this.driver.isTransactionConnection(connection);
-        if (!shouldCreateTx) {
-          const result = await connection.executeQuery(compiled);
-          if (!this.driver.isTransactionConnection(connection)) {
-            await this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "all", queryId);
-          } else {
-            await this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "inTx", queryId);
-            this.driver.registerTransactionCommitCallback(connection, () => this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "outTx", queryId));
-          }
-          return {
-            result
-          };
-        } else {
-          await this.driver.beginTransaction(connection, {
-            isolationLevel: TransactionIsolationLevel.ReadCommitted
-          });
-          try {
-            const result = await connection.executeQuery(compiled);
-            await this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "inTx", queryId);
-            await this.driver.commitTransaction(connection);
-            await this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "outTx", queryId);
-            return {
-              result
-            };
-          } catch (err) {
-            await this.driver.rollbackTransaction(connection);
-            throw err;
-          }
-        }
-      });
-    } catch (err) {
-      const message = `Failed to execute query: ${err}, sql: ${compiled?.sql}`;
-      throw new QueryError(message, err);
+    if (this.suppressMutationHooks || !this.isMutationNode(query) || !this.hasEntityMutationPlugins) {
+      const finalQuery2 = this.nameMapper.transformNode(query);
+      compiled = this.compileQuery(finalQuery2);
+      if (parameters) {
+        compiled = {
+          ...compiled,
+          parameters
+        };
+      }
+      return connection.executeQuery(compiled);
     }
+    if ((InsertQueryNode2.is(query) || UpdateQueryNode2.is(query)) && this.hasEntityMutationPluginsWithAfterMutationHooks) {
+      query = {
+        ...query,
+        returning: ReturningNode2.create([
+          SelectionNode4.createSelectAll()
+        ])
+      };
+    }
+    const finalQuery = this.nameMapper.transformNode(query);
+    compiled = this.compileQuery(finalQuery);
+    if (parameters) {
+      compiled = {
+        ...compiled,
+        parameters
+      };
+    }
+    const currentlyInTx = this.driver.isTransactionConnection(connection);
+    const connectionClient = this.createClientForConnection(connection, currentlyInTx);
+    const mutationInfo = this.getMutationInfo(finalQuery);
+    let beforeMutationEntities;
+    const loadBeforeMutationEntities = /* @__PURE__ */ __name(async () => {
+      if (beforeMutationEntities === void 0 && (UpdateQueryNode2.is(query) || DeleteQueryNode2.is(query))) {
+        beforeMutationEntities = await this.loadEntities(mutationInfo.model, mutationInfo.where, connection);
+      }
+      return beforeMutationEntities;
+    }, "loadBeforeMutationEntities");
+    await this.callBeforeMutationHooks(finalQuery, mutationInfo, loadBeforeMutationEntities, connectionClient, queryId);
+    const result = await connection.executeQuery(compiled);
+    if (!this.driver.isTransactionConnection(connection)) {
+      await this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "all", queryId);
+    } else {
+      await this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "inTx", queryId);
+      this.driver.registerTransactionCommitCallback(connection, () => this.callAfterMutationHooks(result, finalQuery, mutationInfo, connectionClient, "outTx", queryId));
+    }
+    return result;
   }
   createClientForConnection(connection, inTx) {
     const innerExecutor = this.withConnectionProvider(new SingleConnectionProvider(connection));
@@ -6884,9 +7043,6 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends DefaultQueryExe
   get hasEntityMutationPluginsWithAfterMutationHooks() {
     return (this.client.$options.plugins ?? []).some((plugin) => plugin.onEntityMutation?.afterEntityMutation);
   }
-  get hasPluginRequestingAfterMutationWithinTransaction() {
-    return (this.client.$options.plugins ?? []).some((plugin) => plugin.onEntityMutation?.runAfterMutationWithinTransaction);
-  }
   isMutationNode(queryNode) {
     return InsertQueryNode2.is(queryNode) || UpdateQueryNode2.is(queryNode) || DeleteQueryNode2.is(queryNode);
   }
@@ -6917,7 +7073,7 @@ var ZenStackQueryExecutor = class _ZenStackQueryExecutor extends DefaultQueryExe
     return newExecutor;
   }
   getMutationModel(queryNode) {
-    return match16(queryNode).when(InsertQueryNode2.is, (node) => {
+    return match17(queryNode).when(InsertQueryNode2.is, (node) => {
       invariant12(node.into, "InsertQueryNode must have an into clause");
       return node.into.table.identifier.name;
     }).when(UpdateQueryNode2.is, (node) => {
@@ -7028,7 +7184,7 @@ __export(functions_exports, {
 });
 import { invariant as invariant13, lowerCaseFirst, upperCaseFirst } from "@zenstackhq/common-helpers";
 import { sql as sql8, ValueNode as ValueNode5 } from "kysely";
-import { match as match17 } from "ts-pattern";
+import { match as match18 } from "ts-pattern";
 var contains = /* @__PURE__ */ __name((eb, args, context) => textMatch(eb, args, context, "contains"), "contains");
 var search = /* @__PURE__ */ __name((_eb, _args) => {
   throw new Error(`"search" function is not implemented yet`);
@@ -7065,7 +7221,7 @@ var textMatch = /* @__PURE__ */ __name((eb, args, { dialect }, method) => {
   } else {
     op = "like";
   }
-  searchExpr = match17(method).with("contains", () => eb.fn("CONCAT", [
+  searchExpr = match18(method).with("contains", () => eb.fn("CONCAT", [
     sql8.lit("%"),
     sql8`CAST(${searchExpr} as text)`,
     sql8.lit("%")
@@ -7137,7 +7293,7 @@ var currentOperation = /* @__PURE__ */ __name((_eb, args, { operation }) => {
 function processCasing(casing, result, model) {
   const opNode = casing.toOperationNode();
   invariant13(ValueNode5.is(opNode) && typeof opNode.value === "string", '"casting" parameter must be a string value');
-  result = match17(opNode.value).with("original", () => model).with("upper", () => result.toUpperCase()).with("lower", () => result.toLowerCase()).with("capitalize", () => upperCaseFirst(result)).with("uncapitalize", () => lowerCaseFirst(result)).otherwise(() => {
+  result = match18(opNode.value).with("original", () => model).with("upper", () => result.toUpperCase()).with("lower", () => result.toLowerCase()).with("capitalize", () => upperCaseFirst(result)).with("uncapitalize", () => lowerCaseFirst(result)).otherwise(() => {
     throw new Error(`Invalid casing value: ${opNode.value}. Must be "original", "upper", "lower", "capitalize", or "uncapitalize".`);
   });
   return result;
@@ -7157,7 +7313,7 @@ __name(readBoolean, "readBoolean");
 import { invariant as invariant14 } from "@zenstackhq/common-helpers";
 import { sql as sql9 } from "kysely";
 import toposort from "toposort";
-import { match as match18 } from "ts-pattern";
+import { match as match19 } from "ts-pattern";
 var SchemaDbPusher = class {
   static {
     __name(this, "SchemaDbPusher");
@@ -7323,7 +7479,7 @@ var SchemaDbPusher = class {
       return "jsonb";
     }
     const type = fieldDef.type;
-    const result = match18(type).with("String", () => "text").with("Boolean", () => "boolean").with("Int", () => "integer").with("Float", () => "real").with("BigInt", () => "bigint").with("Decimal", () => "decimal").with("DateTime", () => "timestamp").with("Bytes", () => this.schema.provider.type === "postgresql" ? "bytea" : "blob").with("Json", () => "jsonb").otherwise(() => {
+    const result = match19(type).with("String", () => "text").with("Boolean", () => "boolean").with("Int", () => "integer").with("Float", () => "real").with("BigInt", () => "bigint").with("Decimal", () => "decimal").with("DateTime", () => "timestamp").with("Bytes", () => this.schema.provider.type === "postgresql" ? "bytea" : "blob").with("Json", () => "jsonb").otherwise(() => {
       throw new Error(`Unsupported field type: ${type}`);
     });
     if (fieldDef.array) {
@@ -7357,7 +7513,7 @@ var SchemaDbPusher = class {
     return table;
   }
   mapCascadeAction(action) {
-    return match18(action).with("SetNull", () => "set null").with("Cascade", () => "cascade").with("Restrict", () => "restrict").with("NoAction", () => "no action").with("SetDefault", () => "set default").exhaustive();
+    return match19(action).with("SetNull", () => "set null").with("Cascade", () => "cascade").with("Restrict", () => "restrict").with("NoAction", () => "no action").with("SetDefault", () => "set default").exhaustive();
   }
 };
 
@@ -7856,6 +8012,7 @@ export {
   NotFoundError,
   QueryError,
   ZenStackClient,
+  ZenStackError,
   definePlugin,
   sql11 as sql
 };