@zenstackhq/runtime 3.0.0-beta.6 → 3.0.0-beta.8

package/dist/plugins/policy/index.cjs

@@ -37,48 +37,13 @@ __export(policy_exports, {
 });
 module.exports = __toCommonJS(policy_exports);
 
-// src/plugins/policy/errors.ts
-var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
-  RejectedByPolicyReason2["NO_ACCESS"] = "no-access";
-  RejectedByPolicyReason2["CANNOT_READ_BACK"] = "cannot-read-back";
-  RejectedByPolicyReason2["OTHER"] = "other";
-  return RejectedByPolicyReason2;
-}({});
-var RejectedByPolicyError = class extends Error {
-  static {
-    __name(this, "RejectedByPolicyError");
-  }
-  model;
-  reason;
-  constructor(model, reason = "no-access", message) {
-    super(message ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
-  }
-};
+// src/client/client-impl.ts
+var import_common_helpers12 = require("@zenstackhq/common-helpers");
+var import_kysely13 = require("kysely");
 
-// src/plugins/policy/functions.ts
-var import_common_helpers8 = require("@zenstackhq/common-helpers");
-var import_kysely9 = require("kysely");
-
-// src/client/contract.ts
-var CRUD = [
-  "create",
-  "read",
-  "update",
-  "delete"
-];
-
-// src/client/kysely-utils.ts
-var import_kysely = require("kysely");
-function extractFieldName(node) {
-  if (import_kysely.ReferenceNode.is(node) && import_kysely.ColumnNode.is(node.column)) {
-    return node.column.column.name;
-  } else if (import_kysely.ColumnNode.is(node)) {
-    return node.column.name;
-  } else {
-    return void 0;
-  }
-}
-__name(extractFieldName, "extractFieldName");
+// src/client/crud/operations/aggregate.ts
+var import_kysely5 = require("kysely");
+var import_ts_pattern7 = require("ts-pattern");
 
 // src/client/query-utils.ts
 var import_common_helpers = require("@zenstackhq/common-helpers");
@@ -170,7 +135,12 @@ var ExpressionUtils = {
 };
 
 // src/client/errors.ts
-var QueryError = class extends Error {
+var ZenStackError = class extends Error {
+  static {
+    __name(this, "ZenStackError");
+  }
+};
+var QueryError = class extends ZenStackError {
   static {
     __name(this, "QueryError");
   }
@@ -180,7 +150,7 @@ var QueryError = class extends Error {
     });
   }
 };
-var InternalError = class extends Error {
+var InternalError = class extends ZenStackError {
   static {
     __name(this, "InternalError");
   }
@@ -461,19 +431,31 @@ function aggregate(eb, expr2, op) {
 }
 __name(aggregate, "aggregate");
 
-// src/plugins/policy/policy-handler.ts
-var import_common_helpers7 = require("@zenstackhq/common-helpers");
-var import_kysely8 = require("kysely");
-var import_ts_pattern8 = require("ts-pattern");
+// src/client/crud/operations/base.ts
+var import_cuid2 = require("@paralleldrive/cuid2");
+var import_common_helpers6 = require("@zenstackhq/common-helpers");
+var import_kysely4 = require("kysely");
+var import_nanoid = require("nanoid");
+var import_ts_pattern6 = require("ts-pattern");
+var import_ulid = require("ulid");
+var uuid = __toESM(require("uuid"), 1);
 
-// src/client/crud/dialects/index.ts
-var import_ts_pattern5 = require("ts-pattern");
+// src/utils/clone.ts
+var import_common_helpers2 = require("@zenstackhq/common-helpers");
 
-// src/client/crud/dialects/postgresql.ts
-var import_common_helpers3 = require("@zenstackhq/common-helpers");
-var import_decimal = __toESM(require("decimal.js"), 1);
-var import_kysely3 = require("kysely");
-var import_ts_pattern3 = require("ts-pattern");
+// src/utils/enumerate.ts
+function enumerate(x) {
+  if (x === null || x === void 0) {
+    return [];
+  } else if (Array.isArray(x)) {
+    return x;
+  } else {
+    return [
+      x
+    ];
+  }
+}
+__name(enumerate, "enumerate");
 
 // src/client/constants.ts
 var DELEGATE_JOINED_FIELD_PREFIX = "$delegate$";
@@ -490,26 +472,31 @@ var AGGREGATE_OPERATORS = [
   "_max"
 ];
 
-// src/client/crud/dialects/base-dialect.ts
-var import_common_helpers2 = require("@zenstackhq/common-helpers");
-var import_kysely2 = require("kysely");
-var import_ts_pattern2 = require("ts-pattern");
+// src/client/contract.ts
+var CRUD = [
+  "create",
+  "read",
+  "update",
+  "delete"
+];
+var CRUD_EXT = [
+  ...CRUD,
+  "post-update"
+];
 
-// src/utils/enumerate.ts
-function enumerate(x) {
-  if (x === null || x === void 0) {
-    return [];
-  } else if (Array.isArray(x)) {
-    return x;
-  } else {
-    return [
-      x
-    ];
-  }
-}
-__name(enumerate, "enumerate");
+// src/client/crud/dialects/index.ts
+var import_ts_pattern5 = require("ts-pattern");
+
+// src/client/crud/dialects/postgresql.ts
+var import_common_helpers4 = require("@zenstackhq/common-helpers");
+var import_decimal = __toESM(require("decimal.js"), 1);
+var import_kysely2 = require("kysely");
+var import_ts_pattern3 = require("ts-pattern");
 
 // src/client/crud/dialects/base-dialect.ts
+var import_common_helpers3 = require("@zenstackhq/common-helpers");
+var import_kysely = require("kysely");
+var import_ts_pattern2 = require("ts-pattern");
 var BaseCrudDialect = class {
   static {
     __name(this, "BaseCrudDialect");
@@ -554,7 +541,7 @@ var BaseCrudDialect = class {
     if ("distinct" in args && args.distinct) {
       const distinct = ensureArray(args.distinct);
       if (this.supportsDistinctOn) {
-        result = result.distinctOn(distinct.map((f) => import_kysely2.sql.ref(`${modelAlias}.${f}`)));
+        result = result.distinctOn(distinct.map((f) => import_kysely.sql.ref(`${modelAlias}.${f}`)));
       } else {
         throw new QueryError(`"distinct" is not supported by "${this.schema.provider.type}" provider`);
       }
@@ -604,7 +591,7 @@ var BaseCrudDialect = class {
   buildCursorFilter(model, query, cursor, orderBy, negateOrderBy, modelAlias) {
     const _orderBy = orderBy ?? makeDefaultOrderBy(this.schema, model);
     const orderByItems = ensureArray(_orderBy).flatMap((obj) => Object.entries(obj));
-    const eb = (0, import_kysely2.expressionBuilder)();
+    const eb = (0, import_kysely.expressionBuilder)();
     const subQueryAlias = `${model}$cursor$sub`;
     const cursorFilter = this.buildFilter(eb, model, subQueryAlias, cursor);
     let result = query;
@@ -639,7 +626,7 @@ var BaseCrudDialect = class {
     if (payload === null) {
       const { ownedByModel, keyPairs } = getRelationForeignKeyFieldPairs(this.schema, model, field);
       if (ownedByModel && !fieldDef.originModel) {
-        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely2.sql.ref(`${modelAlias}.${fk}`), "is", null)));
+        return this.and(eb, ...keyPairs.map(({ fk }) => eb(import_kysely.sql.ref(`${modelAlias}.${fk}`), "is", null)));
       } else {
         return this.buildToOneRelationFilter(eb, model, modelAlias, field, fieldDef, {
           is: null
@@ -656,7 +643,7 @@ var BaseCrudDialect = class {
       joinAlias
     );
     const filterResultField = `${field}$filter`;
-    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
+    const joinSelect = eb.selectFrom(`${fieldDef.type} as ${joinAlias}`).where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right))))).select(() => eb.fn.count(eb.lit(1)).as(filterResultField));
     const conditions = [];
     if ("is" in payload || "isNot" in payload) {
       if ("is" in payload) {
@@ -686,7 +673,7 @@ var BaseCrudDialect = class {
   }
   buildToManyRelationFilter(eb, model, modelAlias, field, fieldDef, payload) {
     if (payload === null) {
-      return eb(import_kysely2.sql.ref(`${modelAlias}.${field}`), "is", null);
+      return eb(import_kysely.sql.ref(`${modelAlias}.${field}`), "is", null);
     }
     const relationModel = fieldDef.type;
     const relationFilterSelectAlias = `${modelAlias}$${field}$filter`;
@@ -694,18 +681,18 @@ var BaseCrudDialect = class {
       const m2m = getManyToManyRelation(this.schema, model, field);
       if (m2m) {
         const modelIdFields = requireIdFields(this.schema, model);
-        (0, import_common_helpers2.invariant)(modelIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        (0, import_common_helpers3.invariant)(modelIdFields.length === 1, "many-to-many relation must have exactly one id field");
         const relationIdFields = requireIdFields(this.schema, relationModel);
-        (0, import_common_helpers2.invariant)(relationIdFields.length === 1, "many-to-many relation must have exactly one id field");
-        return eb2(import_kysely2.sql.ref(`${relationFilterSelectAlias}.${relationIdFields[0]}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely2.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely2.sql.ref(`${modelAlias}.${modelIdFields[0]}`)));
+        (0, import_common_helpers3.invariant)(relationIdFields.length === 1, "many-to-many relation must have exactly one id field");
+        return eb2(import_kysely.sql.ref(`${relationFilterSelectAlias}.${relationIdFields[0]}`), "in", eb2.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(import_kysely.sql.ref(`${m2m.joinTable}.${m2m.parentFkName}`), "=", import_kysely.sql.ref(`${modelAlias}.${modelIdFields[0]}`)));
       } else {
         const relationKeyPairs = getRelationForeignKeyFieldPairs(this.schema, model, field);
         let result2 = this.true(eb2);
         for (const { fk, pk } of relationKeyPairs.keyPairs) {
           if (relationKeyPairs.ownedByModel) {
-            result2 = this.and(eb2, result2, eb2(import_kysely2.sql.ref(`${modelAlias}.${fk}`), "=", import_kysely2.sql.ref(`${relationFilterSelectAlias}.${pk}`)));
+            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${modelAlias}.${fk}`), "=", import_kysely.sql.ref(`${relationFilterSelectAlias}.${pk}`)));
           } else {
-            result2 = this.and(eb2, result2, eb2(import_kysely2.sql.ref(`${modelAlias}.${pk}`), "=", import_kysely2.sql.ref(`${relationFilterSelectAlias}.${fk}`)));
+            result2 = this.and(eb2, result2, eb2(import_kysely.sql.ref(`${modelAlias}.${pk}`), "=", import_kysely.sql.ref(`${relationFilterSelectAlias}.${fk}`)));
           }
         }
         return result2;
@@ -788,7 +775,7 @@ var BaseCrudDialect = class {
     return eb(lhs, "=", rhs !== null && rhs !== void 0 ? this.transformPrimitive(rhs, type, false) : rhs);
   }
   buildStandardFilter(eb, type, payload, lhs, getRhs, recurse, throwIfInvalid = false, onlyForKeys = void 0, excludeKeys = []) {
-    if (payload === null || !(0, import_common_helpers2.isPlainObject)(payload)) {
+    if (payload === null || !(0, import_common_helpers3.isPlainObject)(payload)) {
       return {
         conditions: [
           this.buildLiteralFilter(eb, lhs, type, payload)
@@ -807,14 +794,14 @@ var BaseCrudDialect = class {
       }
       const rhs = Array.isArray(value) ? value.map(getRhs) : getRhs(value);
       const condition = (0, import_ts_pattern2.match)(op).with("equals", () => rhs === null ? eb(lhs, "is", null) : eb(lhs, "=", rhs)).with("in", () => {
-        (0, import_common_helpers2.invariant)(Array.isArray(rhs), "right hand side must be an array");
+        (0, import_common_helpers3.invariant)(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.false(eb);
         } else {
           return eb(lhs, "in", rhs);
         }
       }).with("notIn", () => {
-        (0, import_common_helpers2.invariant)(Array.isArray(rhs), "right hand side must be an array");
+        (0, import_common_helpers3.invariant)(Array.isArray(rhs), "right hand side must be an array");
         if (rhs.length === 0) {
           return this.true(eb);
         } else {
@@ -854,7 +841,7 @@ var BaseCrudDialect = class {
         if (key === "mode" || consumedKeys.includes(key)) {
           continue;
         }
-        const condition = (0, import_ts_pattern2.match)(key).with("contains", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`%${value}%`)) : eb(fieldRef, "like", import_kysely2.sql.val(`%${value}%`))).with("startsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`${value}%`)) : eb(fieldRef, "like", import_kysely2.sql.val(`${value}%`))).with("endsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely2.sql.val(`%${value}`)) : eb(fieldRef, "like", import_kysely2.sql.val(`%${value}`))).otherwise(() => {
+        const condition = (0, import_ts_pattern2.match)(key).with("contains", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`%${value}%`)) : eb(fieldRef, "like", import_kysely.sql.val(`%${value}%`))).with("startsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`${value}%`)) : eb(fieldRef, "like", import_kysely.sql.val(`${value}%`))).with("endsWith", () => mode === "insensitive" ? eb(fieldRef, "ilike", import_kysely.sql.val(`%${value}`)) : eb(fieldRef, "like", import_kysely.sql.val(`%${value}`))).otherwise(() => {
           throw new QueryError(`Invalid string filter key: ${key}`);
         });
         if (condition) {
@@ -866,16 +853,16 @@ var BaseCrudDialect = class {
   }
   prepStringCasing(eb, value, mode) {
     if (!mode || mode === "default") {
-      return value === null ? value : import_kysely2.sql.val(value);
+      return value === null ? value : import_kysely.sql.val(value);
     }
     if (typeof value === "string") {
       return eb.fn("lower", [
-        import_kysely2.sql.val(value)
+        import_kysely.sql.val(value)
       ]);
     } else if (Array.isArray(value)) {
       return value.map((v) => this.prepStringCasing(eb, v, mode));
     } else {
-      return value === null ? null : import_kysely2.sql.val(value);
+      return value === null ? null : import_kysely.sql.val(value);
     }
   }
   buildNumberFilter(eb, fieldRef, type, payload) {
@@ -932,19 +919,19 @@ var BaseCrudDialect = class {
           "_min",
           "_max"
         ].includes(field)) {
-          (0, import_common_helpers2.invariant)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
+          (0, import_common_helpers3.invariant)(value && typeof value === "object", `invalid orderBy value for field "${field}"`);
           for (const [k, v] of Object.entries(value)) {
-            (0, import_common_helpers2.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-            result = result.orderBy((eb) => aggregate(eb, this.fieldRef(model, k, eb, modelAlias), field), import_kysely2.sql.raw(this.negateSort(v, negated)));
+            (0, import_common_helpers3.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+            result = result.orderBy((eb) => aggregate(eb, this.fieldRef(model, k, eb, modelAlias), field), import_kysely.sql.raw(this.negateSort(v, negated)));
           }
           continue;
         }
         switch (field) {
           case "_count": {
-            (0, import_common_helpers2.invariant)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
+            (0, import_common_helpers3.invariant)(value && typeof value === "object", 'invalid orderBy value for field "_count"');
             for (const [k, v] of Object.entries(value)) {
-              (0, import_common_helpers2.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
-              result = result.orderBy((eb) => eb.fn.count(this.fieldRef(model, k, eb, modelAlias)), import_kysely2.sql.raw(this.negateSort(v, negated)));
+              (0, import_common_helpers3.invariant)(v === "asc" || v === "desc", `invalid orderBy value for field "${field}"`);
+              result = result.orderBy((eb) => eb.fn.count(this.fieldRef(model, k, eb, modelAlias)), import_kysely.sql.raw(this.negateSort(v, negated)));
             }
             continue;
           }
@@ -953,11 +940,11 @@ var BaseCrudDialect = class {
         }
         const fieldDef = requireField(this.schema, model, field);
         if (!fieldDef.relation) {
-          const fieldRef = this.fieldRef(model, field, (0, import_kysely2.expressionBuilder)(), modelAlias);
+          const fieldRef = this.fieldRef(model, field, (0, import_kysely.expressionBuilder)(), modelAlias);
           if (value === "asc" || value === "desc") {
             result = result.orderBy(fieldRef, this.negateSort(value, negated));
           } else if (value && typeof value === "object" && "nulls" in value && "sort" in value && (value.sort === "asc" || value.sort === "desc") && (value.nulls === "first" || value.nulls === "last")) {
-            result = result.orderBy(fieldRef, import_kysely2.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
+            result = result.orderBy(fieldRef, import_kysely.sql.raw(`${this.negateSort(value.sort, negated)} nulls ${value.nulls}`));
           }
         } else {
           const relationModel = fieldDef.type;
@@ -966,13 +953,13 @@ var BaseCrudDialect = class {
               throw new QueryError(`invalid orderBy value for field "${field}"`);
             }
             if ("_count" in value) {
-              (0, import_common_helpers2.invariant)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
+              (0, import_common_helpers3.invariant)(value._count === "asc" || value._count === "desc", 'invalid orderBy value for field "_count"');
               const sort = this.negateSort(value._count, negated);
               result = result.orderBy((eb) => {
                 const subQueryAlias = `${modelAlias}$orderBy$${field}$count`;
                 let subQuery = this.buildSelectModel(eb, relationModel, subQueryAlias);
                 const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, subQueryAlias);
-                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
+                subQuery = subQuery.where(() => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
                 subQuery = subQuery.select(() => eb.fn.count(eb.lit(1)).as("_count"));
                 return subQuery;
               }, sort);
@@ -980,7 +967,7 @@ var BaseCrudDialect = class {
           } else {
             result = result.leftJoin(relationModel, (join) => {
               const joinPairs = buildJoinPairs(this.schema, model, modelAlias, field, relationModel);
-              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
+              return join.on((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely.sql.ref(left), "=", import_kysely.sql.ref(right)))));
             });
             result = this.buildOrderBy(result, fieldDef.type, relationModel, value, false, negated);
           }
@@ -1032,7 +1019,7 @@ var BaseCrudDialect = class {
     if (fieldDef.computed) {
       return query.select((eb) => this.fieldRef(model, field, eb, modelAlias).as(field));
     } else if (!fieldDef.originModel) {
-      return query.select(import_kysely2.sql.ref(`${modelAlias}.${field}`).as(field));
+      return query.select(import_kysely.sql.ref(`${modelAlias}.${field}`).as(field));
     } else {
       return this.buildSelectField(query, fieldDef.originModel, fieldDef.originModel, field);
     }
@@ -1179,14 +1166,14 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     if (typeof value === "bigint") {
       return value;
     }
-    (0, import_common_helpers3.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
     return BigInt(value);
   }
   transformDecimal(value) {
     if (value instanceof import_decimal.default) {
       return value;
     }
-    (0, import_common_helpers3.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal.default, `Expected string, number or Decimal, got ${typeof value}`);
+    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal.default, `Expected string, number or Decimal, got ${typeof value}`);
     return new import_decimal.default(value);
   }
   transformOutputDate(value) {
@@ -1233,12 +1220,12 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     if (m2m) {
       const parentIds = requireIdFields(this.schema, model);
       const relationIds = requireIdFields(this.schema, relationModel);
-      (0, import_common_helpers3.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      (0, import_common_helpers3.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers4.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers4.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       query = query.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const joinPairs = buildJoinPairs(this.schema, model, parentAlias, relationField, relationModelAlias);
-      query = query.where((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely3.sql.ref(left), "=", import_kysely3.sql.ref(right)))));
+      query = query.where((eb) => this.and(eb, ...joinPairs.map(([left, right]) => eb(import_kysely2.sql.ref(left), "=", import_kysely2.sql.ref(right)))));
     }
     return query;
   }
@@ -1246,9 +1233,9 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     qb = qb.select((eb) => {
       const objArgs = this.buildRelationObjectArgs(relationModel, relationModelAlias, eb, payload, parentResultName);
       if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely3.sql`jsonb_agg(jsonb_build_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`'[]'::jsonb`).as("$data");
+        return eb.fn.coalesce(import_kysely2.sql`jsonb_agg(jsonb_build_object(${import_kysely2.sql.join(objArgs)}))`, import_kysely2.sql`'[]'::jsonb`).as("$data");
       } else {
-        return import_kysely3.sql`jsonb_build_object(${import_kysely3.sql.join(objArgs)})`.as("$data");
+        return import_kysely2.sql`jsonb_build_object(${import_kysely2.sql.join(objArgs)})`.as("$data");
       }
     });
     return qb;
@@ -1259,13 +1246,13 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     const descendantModels = getDelegateDescendantModels(this.schema, relationModel);
     if (descendantModels.length > 0) {
       objArgs.push(...descendantModels.map((subModel) => [
-        import_kysely3.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
+        import_kysely2.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
         eb.ref(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`)
       ]).flatMap((v) => v));
     }
     if (payload === true || !payload.select) {
       objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-        import_kysely3.sql.lit(field),
+        import_kysely2.sql.lit(field),
         this.fieldRef(relationModel, field, eb, relationModelAlias, false)
       ]).flatMap((v) => v));
     } else if (payload.select) {
@@ -1273,14 +1260,14 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
         if (field === "_count") {
           const subJson = this.buildCountJson(relationModel, eb, relationModelAlias, value);
           return [
-            import_kysely3.sql.lit(field),
+            import_kysely2.sql.lit(field),
             subJson
           ];
         } else {
           const fieldDef = requireField(this.schema, relationModel, field);
           const fieldValue = fieldDef.relation ? eb.ref(`${parentResultName}$${field}.$data`) : this.fieldRef(relationModel, field, eb, relationModelAlias, false);
           return [
-            import_kysely3.sql.lit(field),
+            import_kysely2.sql.lit(field),
             fieldValue
           ];
         }
@@ -1288,7 +1275,7 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
     }
     if (typeof payload === "object" && payload.include && typeof payload.include === "object") {
       objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field]) => [
-        import_kysely3.sql.lit(field),
+        import_kysely2.sql.lit(field),
         // reference the synthesized JSON field
         eb.ref(`${parentResultName}$${field}.$data`)
       ]).flatMap((v) => v));
@@ -1318,7 +1305,7 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
   }
   buildJsonObject(eb, value) {
     return eb.fn("jsonb_build_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely3.sql.lit(key),
+      import_kysely2.sql.lit(key),
       value2
     ]));
   }
@@ -1370,9 +1357,9 @@ var PostgresCrudDialect = class extends BaseCrudDialect {
 };
 
 // src/client/crud/dialects/sqlite.ts
-var import_common_helpers4 = require("@zenstackhq/common-helpers");
+var import_common_helpers5 = require("@zenstackhq/common-helpers");
 var import_decimal2 = __toESM(require("decimal.js"), 1);
-var import_kysely4 = require("kysely");
+var import_kysely3 = require("kysely");
 var import_ts_pattern4 = require("ts-pattern");
 var SqliteCrudDialect = class extends BaseCrudDialect {
   static {
@@ -1408,14 +1395,14 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
     if (value instanceof import_decimal2.default) {
       return value;
     }
-    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal2.default, `Expected string, number or Decimal, got ${typeof value}`);
+    (0, import_common_helpers5.invariant)(typeof value === "string" || typeof value === "number" || value instanceof import_decimal2.default, `Expected string, number or Decimal, got ${typeof value}`);
     return new import_decimal2.default(value);
   }
   transformOutputBigInt(value) {
     if (typeof value === "bigint") {
       return value;
     }
-    (0, import_common_helpers4.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
+    (0, import_common_helpers5.invariant)(typeof value === "string" || typeof value === "number", `Expected string or number, got ${typeof value}`);
     return BigInt(value);
   }
   transformOutputBoolean(value) {
@@ -1468,13 +1455,13 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
       const descendantModels = getDelegateDescendantModels(this.schema, relationModel);
       if (descendantModels.length > 0) {
         objArgs.push(...descendantModels.map((subModel) => [
-          import_kysely4.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
+          import_kysely3.sql.lit(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`),
           eb.ref(`${DELEGATE_JOINED_FIELD_PREFIX}${subModel.name}`)
         ]).flatMap((v) => v));
       }
       if (payload === true || !payload.select) {
         objArgs.push(...Object.entries(relationModelDef.fields).filter(([, value]) => !value.relation).filter(([name]) => !(typeof payload === "object" && payload.omit?.[name] === true)).map(([field]) => [
-          import_kysely4.sql.lit(field),
+          import_kysely3.sql.lit(field),
           this.fieldRef(relationModel, field, eb, subQueryName, false)
         ]).flatMap((v) => v));
       } else if (payload.select) {
@@ -1482,7 +1469,7 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
           if (field === "_count") {
             const subJson = this.buildCountJson(relationModel, eb, `${parentAlias}$${relationField}`, value);
             return [
-              import_kysely4.sql.lit(field),
+              import_kysely3.sql.lit(field),
               subJson
             ];
           } else {
@@ -1490,12 +1477,12 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
             if (fieldDef.relation) {
               const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentAlias}$${relationField}`, value);
               return [
-                import_kysely4.sql.lit(field),
+                import_kysely3.sql.lit(field),
                 subJson
               ];
             } else {
               return [
-                import_kysely4.sql.lit(field),
+                import_kysely3.sql.lit(field),
                 this.fieldRef(relationModel, field, eb, subQueryName, false)
               ];
             }
@@ -1506,15 +1493,15 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
         objArgs.push(...Object.entries(payload.include).filter(([, value]) => value).map(([field, value]) => {
           const subJson = this.buildRelationJSON(relationModel, eb, field, `${parentAlias}$${relationField}`, value);
           return [
-            import_kysely4.sql.lit(field),
+            import_kysely3.sql.lit(field),
             subJson
           ];
         }).flatMap((v) => v));
       }
       if (relationFieldDef.array) {
-        return eb.fn.coalesce(import_kysely4.sql`json_group_array(json_object(${import_kysely4.sql.join(objArgs)}))`, import_kysely4.sql`json_array()`).as("$data");
+        return eb.fn.coalesce(import_kysely3.sql`json_group_array(json_object(${import_kysely3.sql.join(objArgs)}))`, import_kysely3.sql`json_array()`).as("$data");
       } else {
-        return import_kysely4.sql`json_object(${import_kysely4.sql.join(objArgs)})`.as("$data");
+        return import_kysely3.sql`json_object(${import_kysely3.sql.join(objArgs)})`.as("$data");
       }
     });
     return tbl;
@@ -1526,8 +1513,8 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
     if (m2m) {
       const parentIds = requireIdFields(this.schema, model);
       const relationIds = requireIdFields(this.schema, relationModel);
-      (0, import_common_helpers4.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
-      (0, import_common_helpers4.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers5.invariant)(parentIds.length === 1, "many-to-many relation must have exactly one id field");
+      (0, import_common_helpers5.invariant)(relationIds.length === 1, "many-to-many relation must have exactly one id field");
       selectModelQuery = selectModelQuery.where((eb) => eb(eb.ref(`${relationModelAlias}.${relationIds[0]}`), "in", eb.selectFrom(m2m.joinTable).select(`${m2m.joinTable}.${m2m.otherFkName}`).whereRef(`${parentAlias}.${parentIds[0]}`, "=", `${m2m.joinTable}.${m2m.parentFkName}`)));
     } else {
       const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, model, relationField);
@@ -1555,7 +1542,7 @@ var SqliteCrudDialect = class extends BaseCrudDialect {
   }
   buildJsonObject(eb, value) {
     return eb.fn("json_object", Object.entries(value).flatMap(([key, value2]) => [
-      import_kysely4.sql.lit(key),
+      import_kysely3.sql.lit(key),
       value2
     ]));
   }
@@ -1605,9 +1592,152 @@ function getCrudDialect(schema, options) {
 }
 __name(getCrudDialect, "getCrudDialect");
 
+// src/client/crud/operations/count.ts
+var import_kysely6 = require("kysely");
+
+// src/client/crud/operations/create.ts
+var import_ts_pattern8 = require("ts-pattern");
+
+// src/client/crud/operations/delete.ts
+var import_ts_pattern9 = require("ts-pattern");
+
+// src/client/crud/operations/group-by.ts
+var import_kysely7 = require("kysely");
+var import_ts_pattern10 = require("ts-pattern");
+
+// src/client/crud/operations/update.ts
+var import_ts_pattern11 = require("ts-pattern");
+
+// src/client/crud/validator.ts
+var import_common_helpers7 = require("@zenstackhq/common-helpers");
+var import_decimal3 = __toESM(require("decimal.js"), 1);
+var import_json_stable_stringify = __toESM(require("json-stable-stringify"), 1);
+var import_ts_pattern12 = require("ts-pattern");
+var import_zod = require("zod");
+
+// src/utils/zod-utils.ts
+var import_v3 = require("zod-validation-error/v3");
+var import_v4 = require("zod-validation-error/v4");
+
+// src/client/executor/zenstack-query-executor.ts
+var import_common_helpers9 = require("@zenstackhq/common-helpers");
+var import_kysely10 = require("kysely");
+var import_ts_pattern13 = require("ts-pattern");
+
+// src/client/kysely-utils.ts
+var import_kysely8 = require("kysely");
+function extractFieldName(node) {
+  if (import_kysely8.ReferenceNode.is(node) && import_kysely8.ColumnNode.is(node.column)) {
+    return node.column.column.name;
+  } else if (import_kysely8.ColumnNode.is(node)) {
+    return node.column.name;
+  } else {
+    return void 0;
+  }
+}
+__name(extractFieldName, "extractFieldName");
+
+// src/client/executor/name-mapper.ts
+var import_common_helpers8 = require("@zenstackhq/common-helpers");
+var import_kysely9 = require("kysely");
+
+// src/client/functions.ts
+var import_common_helpers10 = require("@zenstackhq/common-helpers");
+var import_kysely11 = require("kysely");
+var import_ts_pattern14 = require("ts-pattern");
+
+// src/client/helpers/schema-db-pusher.ts
+var import_common_helpers11 = require("@zenstackhq/common-helpers");
+var import_kysely12 = require("kysely");
+var import_toposort = __toESM(require("toposort"), 1);
+var import_ts_pattern15 = require("ts-pattern");
+
+// src/client/index.ts
+var import_kysely14 = require("kysely");
+
+// src/plugins/policy/errors.ts
+var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
+  RejectedByPolicyReason2["NO_ACCESS"] = "no-access";
+  RejectedByPolicyReason2["CANNOT_READ_BACK"] = "cannot-read-back";
+  RejectedByPolicyReason2["OTHER"] = "other";
+  return RejectedByPolicyReason2;
+}({});
+var RejectedByPolicyError = class extends ZenStackError {
+  static {
+    __name(this, "RejectedByPolicyError");
+  }
+  model;
+  reason;
+  constructor(model, reason = "no-access", message) {
+    super(message ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
+  }
+};
+
+// src/plugins/policy/functions.ts
+var import_common_helpers16 = require("@zenstackhq/common-helpers");
+var import_kysely19 = require("kysely");
+
+// src/plugins/policy/policy-handler.ts
+var import_common_helpers15 = require("@zenstackhq/common-helpers");
+var import_kysely18 = require("kysely");
+var import_ts_pattern19 = require("ts-pattern");
+
+// src/utils/expression-utils.ts
+var import_ts_pattern16 = require("ts-pattern");
+var ExpressionVisitor = class {
+  static {
+    __name(this, "ExpressionVisitor");
+  }
+  visit(expr2) {
+    (0, import_ts_pattern16.match)(expr2).with({
+      kind: "literal"
+    }, (e) => this.visitLiteral(e)).with({
+      kind: "array"
+    }, (e) => this.visitArray(e)).with({
+      kind: "field"
+    }, (e) => this.visitField(e)).with({
+      kind: "member"
+    }, (e) => this.visitMember(e)).with({
+      kind: "binary"
+    }, (e) => this.visitBinary(e)).with({
+      kind: "unary"
+    }, (e) => this.visitUnary(e)).with({
+      kind: "call"
+    }, (e) => this.visitCall(e)).with({
+      kind: "this"
+    }, (e) => this.visitThis(e)).with({
+      kind: "null"
+    }, (e) => this.visitNull(e)).exhaustive();
+  }
+  visitLiteral(_e) {
+  }
+  visitArray(e) {
+    e.items.forEach((item) => this.visit(item));
+  }
+  visitField(_e) {
+  }
+  visitMember(e) {
+    this.visit(e.receiver);
+  }
+  visitBinary(e) {
+    this.visit(e.left);
+    this.visit(e.right);
+  }
+  visitUnary(e) {
+    this.visit(e.operand);
+  }
+  visitCall(e) {
+    e.args?.forEach((arg) => this.visit(arg));
+  }
+  visitThis(_e) {
+  }
+  visitNull(_e) {
+  }
+};
+
 // src/utils/default-operation-node-visitor.ts
-var import_kysely5 = require("kysely");
-var DefaultOperationNodeVisitor = class extends import_kysely5.OperationNodeVisitor {
+var import_kysely15 = require("kysely");
+var DefaultOperationNodeVisitor = class extends import_kysely15.OperationNodeVisitor {
   static {
     __name(this, "DefaultOperationNodeVisitor");
   }
@@ -1924,19 +2054,19 @@ var ColumnCollector = class extends DefaultOperationNodeVisitor {
 };
 
 // src/plugins/policy/expression-transformer.ts
-var import_common_helpers6 = require("@zenstackhq/common-helpers");
-var import_kysely7 = require("kysely");
-var import_ts_pattern7 = require("ts-pattern");
+var import_common_helpers14 = require("@zenstackhq/common-helpers");
+var import_kysely17 = require("kysely");
+var import_ts_pattern18 = require("ts-pattern");
 
 // src/plugins/policy/expression-evaluator.ts
-var import_common_helpers5 = require("@zenstackhq/common-helpers");
-var import_ts_pattern6 = require("ts-pattern");
+var import_common_helpers13 = require("@zenstackhq/common-helpers");
+var import_ts_pattern17 = require("ts-pattern");
 var ExpressionEvaluator = class {
   static {
     __name(this, "ExpressionEvaluator");
   }
   evaluate(expression, context) {
-    const result = (0, import_ts_pattern6.match)(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
+    const result = (0, import_ts_pattern17.match)(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
     return result ?? null;
   }
   evaluateCall(expr2, context) {
@@ -1947,7 +2077,7 @@ var ExpressionEvaluator = class {
     }
   }
   evaluateUnary(expr2, context) {
-    return (0, import_ts_pattern6.match)(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
+    return (0, import_ts_pattern17.match)(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
   }
   evaluateMember(expr2, context) {
     let val = this.evaluate(expr2.receiver, context);
@@ -1971,21 +2101,21 @@ var ExpressionEvaluator = class {
     }
     const left = this.evaluate(expr2.left, context);
     const right = this.evaluate(expr2.right, context);
-    return (0, import_ts_pattern6.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
+    return (0, import_ts_pattern17.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
-      (0, import_common_helpers5.invariant)(Array.isArray(_right), 'expected array for "in" operator');
+      (0, import_common_helpers13.invariant)(Array.isArray(_right), 'expected array for "in" operator');
       return _right.includes(left);
     }).exhaustive();
   }
   evaluateCollectionPredicate(expr2, context) {
     const op = expr2.op;
-    (0, import_common_helpers5.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    (0, import_common_helpers13.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
     if (!left) {
       return false;
     }
-    (0, import_common_helpers5.invariant)(Array.isArray(left), "expected array");
-    return (0, import_ts_pattern6.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
+    (0, import_common_helpers13.invariant)(Array.isArray(left), "expected array");
+    return (0, import_ts_pattern17.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
       ...context,
       thisValue: item
     }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
@@ -1999,21 +2129,21 @@ var ExpressionEvaluator = class {
 };
 
 // src/plugins/policy/utils.ts
-var import_kysely6 = require("kysely");
+var import_kysely16 = require("kysely");
 function trueNode(dialect) {
-  return import_kysely6.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
+  return import_kysely16.ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
 }
 __name(trueNode, "trueNode");
 function falseNode(dialect) {
-  return import_kysely6.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
+  return import_kysely16.ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
 }
 __name(falseNode, "falseNode");
 function isTrueNode(node) {
-  return import_kysely6.ValueNode.is(node) && (node.value === true || node.value === 1);
+  return import_kysely16.ValueNode.is(node) && (node.value === true || node.value === 1);
 }
 __name(isTrueNode, "isTrueNode");
 function isFalseNode(node) {
-  return import_kysely6.ValueNode.is(node) && (node.value === false || node.value === 0);
+  return import_kysely16.ValueNode.is(node) && (node.value === false || node.value === 0);
 }
 __name(isFalseNode, "isFalseNode");
 function conjunction(dialect, nodes) {
@@ -2030,7 +2160,7 @@ function conjunction(dialect, nodes) {
   if (items.length === 0) {
     return trueNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely6.AndNode.create(wrapParensIf(acc, import_kysely6.OrNode.is), wrapParensIf(node, import_kysely6.OrNode.is)));
+  return items.reduce((acc, node) => import_kysely16.AndNode.create(wrapParensIf(acc, import_kysely16.OrNode.is), wrapParensIf(node, import_kysely16.OrNode.is)));
 }
 __name(conjunction, "conjunction");
 function disjunction(dialect, nodes) {
@@ -2047,7 +2177,7 @@ function disjunction(dialect, nodes) {
   if (items.length === 0) {
     return falseNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely6.OrNode.create(wrapParensIf(acc, import_kysely6.AndNode.is), wrapParensIf(node, import_kysely6.AndNode.is)));
+  return items.reduce((acc, node) => import_kysely16.OrNode.create(wrapParensIf(acc, import_kysely16.AndNode.is), wrapParensIf(node, import_kysely16.AndNode.is)));
 }
 __name(disjunction, "disjunction");
 function logicalNot(dialect, node) {
@@ -2057,11 +2187,11 @@ function logicalNot(dialect, node) {
   if (isFalseNode(node)) {
     return trueNode(dialect);
   }
-  return import_kysely6.UnaryOperationNode.create(import_kysely6.OperatorNode.create("not"), wrapParensIf(node, (n) => import_kysely6.AndNode.is(n) || import_kysely6.OrNode.is(n)));
+  return import_kysely16.UnaryOperationNode.create(import_kysely16.OperatorNode.create("not"), wrapParensIf(node, (n) => import_kysely16.AndNode.is(n) || import_kysely16.OrNode.is(n)));
 }
 __name(logicalNot, "logicalNot");
 function wrapParensIf(node, predicate) {
-  return predicate(node) ? import_kysely6.ParensNode.create(node) : node;
+  return predicate(node) ? import_kysely16.ParensNode.create(node) : node;
 }
 __name(wrapParensIf, "wrapParensIf");
 function buildIsFalse(node, dialect) {
@@ -2070,13 +2200,13 @@ function buildIsFalse(node, dialect) {
   } else if (isTrueNode(node)) {
     return falseNode(dialect);
   }
-  return import_kysely6.BinaryOperationNode.create(
+  return import_kysely16.BinaryOperationNode.create(
     // coalesce so null is treated as false
-    import_kysely6.FunctionNode.create("coalesce", [
+    import_kysely16.FunctionNode.create("coalesce", [
       node,
       falseNode(dialect)
     ]),
-    import_kysely6.OperatorNode.create("="),
+    import_kysely16.OperatorNode.create("="),
     falseNode(dialect)
   );
 }
@@ -2085,16 +2215,20 @@ function getTableName(node) {
   if (!node) {
     return node;
   }
-  if (import_kysely6.TableNode.is(node)) {
+  if (import_kysely16.TableNode.is(node)) {
     return node.table.identifier.name;
-  } else if (import_kysely6.AliasNode.is(node)) {
+  } else if (import_kysely16.AliasNode.is(node)) {
     return getTableName(node.node);
-  } else if (import_kysely6.ReferenceNode.is(node) && node.table) {
+  } else if (import_kysely16.ReferenceNode.is(node) && node.table) {
     return getTableName(node.table);
   }
   return void 0;
 }
 __name(getTableName, "getTableName");
+function isBeforeInvocation(expr2) {
+  return ExpressionUtils.isCall(expr2) && expr2.function === "before";
+}
+__name(isBeforeInvocation, "isBeforeInvocation");
 
 // src/plugins/policy/expression-transformer.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -2154,7 +2288,7 @@ var ExpressionTransformer = class {
     return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
   }
   _array(expr2, context) {
-    return import_kysely7.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
+    return import_kysely17.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
     const fieldDef = requireField(this.schema, context.model, expr2.field);
@@ -2174,18 +2308,18 @@ var ExpressionTransformer = class {
   }
   mergeWhere(where, memberFilter) {
     if (!where) {
-      return import_kysely7.WhereNode.create(memberFilter ?? trueNode(this.dialect));
+      return import_kysely17.WhereNode.create(memberFilter ?? trueNode(this.dialect));
     }
     if (!memberFilter) {
       return where;
     }
-    return import_kysely7.WhereNode.create(conjunction(this.dialect, [
+    return import_kysely17.WhereNode.create(conjunction(this.dialect, [
       where.where,
       memberFilter
     ]));
   }
   _null() {
-    return import_kysely7.ValueNode.createImmediate(null);
+    return import_kysely17.ValueNode.createImmediate(null);
   }
   _binary(expr2, context) {
     if (expr2.op === "&&") {
@@ -2213,10 +2347,10 @@ var ExpressionTransformer = class {
       if (this.isNullNode(left)) {
         return this.transformValue(false, "Boolean");
       } else {
-        if (import_kysely7.ValueListNode.is(right)) {
-          return import_kysely7.BinaryOperationNode.create(left, import_kysely7.OperatorNode.create("in"), right);
+        if (import_kysely17.ValueListNode.is(right)) {
+          return import_kysely17.BinaryOperationNode.create(left, import_kysely17.OperatorNode.create("in"), right);
         } else {
-          return import_kysely7.BinaryOperationNode.create(left, import_kysely7.OperatorNode.create("="), import_kysely7.FunctionNode.create("any", [
+          return import_kysely17.BinaryOperationNode.create(left, import_kysely17.OperatorNode.create("="), import_kysely17.FunctionNode.create("any", [
             right
           ]));
         }
@@ -2227,35 +2361,35 @@ var ExpressionTransformer = class {
     } else if (this.isNullNode(left)) {
       return this.transformNullCheck(right, expr2.op);
     } else {
-      return import_kysely7.BinaryOperationNode.create(left, this.transformOperator(op), right);
+      return import_kysely17.BinaryOperationNode.create(left, this.transformOperator(op), right);
     }
   }
   transformNullCheck(expr2, operator) {
-    (0, import_common_helpers6.invariant)(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
-    if (import_kysely7.ValueNode.is(expr2)) {
+    (0, import_common_helpers14.invariant)(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
+    if (import_kysely17.ValueNode.is(expr2)) {
       if (expr2.value === null) {
         return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
       } else {
         return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
       }
     } else {
-      return operator === "==" ? import_kysely7.BinaryOperationNode.create(expr2, import_kysely7.OperatorNode.create("is"), import_kysely7.ValueNode.createImmediate(null)) : import_kysely7.BinaryOperationNode.create(expr2, import_kysely7.OperatorNode.create("is not"), import_kysely7.ValueNode.createImmediate(null));
+      return operator === "==" ? import_kysely17.BinaryOperationNode.create(expr2, import_kysely17.OperatorNode.create("is"), import_kysely17.ValueNode.createImmediate(null)) : import_kysely17.BinaryOperationNode.create(expr2, import_kysely17.OperatorNode.create("is not"), import_kysely17.ValueNode.createImmediate(null));
     }
   }
   normalizeBinaryOperationOperands(expr2, context) {
     let normalizedLeft = expr2.left;
     if (this.isRelationField(expr2.left, context.model)) {
-      (0, import_common_helpers6.invariant)(ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
+      (0, import_common_helpers14.invariant)(ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
       const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
-      (0, import_common_helpers6.invariant)(leftRelDef, "failed to get relation field definition");
+      (0, import_common_helpers14.invariant)(leftRelDef, "failed to get relation field definition");
       const idFields = requireIdFields(this.schema, leftRelDef.type);
       normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
     }
     let normalizedRight = expr2.right;
     if (this.isRelationField(expr2.right, context.model)) {
-      (0, import_common_helpers6.invariant)(ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
+      (0, import_common_helpers14.invariant)(ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
       const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
-      (0, import_common_helpers6.invariant)(rightRelDef, "failed to get relation field definition");
+      (0, import_common_helpers14.invariant)(rightRelDef, "failed to get relation field definition");
       const idFields = requireIdFields(this.schema, rightRelDef.type);
       normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
     }
@@ -2265,21 +2399,21 @@ var ExpressionTransformer = class {
     };
   }
   transformCollectionPredicate(expr2, context) {
-    (0, import_common_helpers6.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    (0, import_common_helpers14.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
     if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
       const value = new ExpressionEvaluator().evaluate(expr2, {
         auth: this.auth
       });
       return this.transformValue(value, "Boolean");
     }
-    (0, import_common_helpers6.invariant)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
+    (0, import_common_helpers14.invariant)(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
     const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
     if (fieldDef) {
-      (0, import_common_helpers6.invariant)(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
+      (0, import_common_helpers14.invariant)(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
-      (0, import_common_helpers6.invariant)(ExpressionUtils.isMember(expr2.left) && ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
+      (0, import_common_helpers14.invariant)(ExpressionUtils.isMember(expr2.left) && ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
       const fieldDef2 = requireField(this.schema, context.model, expr2.left.receiver.field);
       newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
@@ -2295,13 +2429,13 @@ var ExpressionTransformer = class {
     if (expr2.op === "!") {
       predicateFilter = logicalNot(this.dialect, predicateFilter);
     }
-    const count = import_kysely7.FunctionNode.create("count", [
-      import_kysely7.ValueNode.createImmediate(1)
+    const count = import_kysely17.FunctionNode.create("count", [
+      import_kysely17.ValueNode.createImmediate(1)
     ]);
-    const predicateResult = (0, import_ts_pattern7.match)(expr2.op).with("?", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create(">"), import_kysely7.ValueNode.createImmediate(0))).with("!", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.createImmediate(0))).with("^", () => import_kysely7.BinaryOperationNode.create(count, import_kysely7.OperatorNode.create("="), import_kysely7.ValueNode.createImmediate(0))).exhaustive();
+    const predicateResult = (0, import_ts_pattern18.match)(expr2.op).with("?", () => import_kysely17.BinaryOperationNode.create(count, import_kysely17.OperatorNode.create(">"), import_kysely17.ValueNode.createImmediate(0))).with("!", () => import_kysely17.BinaryOperationNode.create(count, import_kysely17.OperatorNode.create("="), import_kysely17.ValueNode.createImmediate(0))).with("^", () => import_kysely17.BinaryOperationNode.create(count, import_kysely17.OperatorNode.create("="), import_kysely17.ValueNode.createImmediate(0))).exhaustive();
     return this.transform(expr2.left, {
       ...context,
-      memberSelect: import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(predicateResult, import_kysely7.IdentifierNode.create("$t"))),
+      memberSelect: import_kysely17.SelectionNode.create(import_kysely17.AliasNode.create(predicateResult, import_kysely17.IdentifierNode.create("$t"))),
       memberFilter: predicateFilter
     });
   }
@@ -2326,7 +2460,7 @@ var ExpressionTransformer = class {
         throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
-      (0, import_common_helpers6.invariant)(idFields.length > 0, "auth type model must have at least one id field");
+      (0, import_common_helpers14.invariant)(idFields.length > 0, "auth type model must have at least one id field");
       const conditions = idFields.map((fieldName) => ExpressionUtils.binary(ExpressionUtils.member(authExpr, [
         fieldName
       ]), "==", this.makeOrAppendMember(other, fieldName)));
@@ -2355,16 +2489,16 @@ var ExpressionTransformer = class {
     } else if (value === false) {
       return falseNode(this.dialect);
     } else {
-      return import_kysely7.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+      return import_kysely17.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
     }
   }
   _unary(expr2, context) {
-    (0, import_common_helpers6.invariant)(expr2.op === "!", 'only "!" operator is supported');
+    (0, import_common_helpers14.invariant)(expr2.op === "!", 'only "!" operator is supported');
     return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
-    const mappedOp = (0, import_ts_pattern7.match)(op).with("==", () => "=").otherwise(() => op);
-    return import_kysely7.OperatorNode.create(mappedOp);
+    const mappedOp = (0, import_ts_pattern18.match)(op).with("==", () => "=").otherwise(() => op);
+    return import_kysely17.OperatorNode.create(mappedOp);
   }
   _call(expr2, context) {
     const result = this.transformCall(expr2, context);
@@ -2375,7 +2509,7 @@ var ExpressionTransformer = class {
     if (!func) {
       throw new QueryError(`Function not implemented: ${expr2.function}`);
     }
-    const eb = (0, import_kysely7.expressionBuilder)();
+    const eb = (0, import_kysely17.expressionBuilder)();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
       client: this.client,
       dialect: this.dialect,
@@ -2407,7 +2541,7 @@ var ExpressionTransformer = class {
       return this.transformCall(arg, context);
     }
     if (this.isAuthMember(arg)) {
-      const valNode = this.valueMemberAccess(context.auth, arg, this.authType);
+      const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
       return valNode ? eb.val(valNode.value) : eb.val(null);
     }
     throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
@@ -2416,7 +2550,12 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
-    (0, import_common_helpers6.invariant)(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    if (isBeforeInvocation(expr2.receiver)) {
+      (0, import_common_helpers14.invariant)(context.operation === "post-update", "before() can only be used in post-update policy");
+      (0, import_common_helpers14.invariant)(expr2.members.length === 1, "before() can only be followed by a scalar field access");
+      return import_kysely17.ReferenceNode.create(import_kysely17.ColumnNode.create(expr2.members[0]), import_kysely17.TableNode.create("$before"));
+    }
+    (0, import_common_helpers14.invariant)(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
     let members = expr2.members;
     let receiver;
     const { memberFilter, memberSelect, ...restContext } = context;
@@ -2431,7 +2570,7 @@ var ExpressionTransformer = class {
     } else {
       receiver = this.transform(expr2.receiver, restContext);
     }
-    (0, import_common_helpers6.invariant)(import_kysely7.SelectQueryNode.is(receiver), "expected receiver to be select query");
+    (0, import_common_helpers14.invariant)(import_kysely17.SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (ExpressionUtils.isField(expr2.receiver)) {
       const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
@@ -2460,11 +2599,10 @@ var ExpressionTransformer = class {
           alias: void 0
         });
         if (currNode) {
-          (0, import_common_helpers6.invariant)(import_kysely7.SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
-              import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(currNode, import_kysely7.IdentifierNode.create(members[i + 1])))
+              import_kysely17.SelectionNode.create(import_kysely17.AliasNode.create(currNode, import_kysely17.IdentifierNode.create(members[i + 1])))
             ]
           };
         } else {
@@ -2477,21 +2615,21 @@ var ExpressionTransformer = class {
           };
         }
       } else {
-        (0, import_common_helpers6.invariant)(i === members.length - 1, "plain field access must be the last segment");
-        (0, import_common_helpers6.invariant)(!currNode, "plain field access must be the last segment");
-        currNode = import_kysely7.ColumnNode.create(member);
+        (0, import_common_helpers14.invariant)(i === members.length - 1, "plain field access must be the last segment");
+        (0, import_common_helpers14.invariant)(!currNode, "plain field access must be the last segment");
+        currNode = import_kysely17.ColumnNode.create(member);
       }
     }
     return {
       ...receiver,
       selections: [
-        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(currNode, import_kysely7.IdentifierNode.create("$t")))
+        import_kysely17.SelectionNode.create(import_kysely17.AliasNode.create(currNode, import_kysely17.IdentifierNode.create("$t")))
       ]
     };
   }
   valueMemberAccess(receiver, expr2, receiverType) {
     if (!receiver) {
-      return import_kysely7.ValueNode.createImmediate(null);
+      return import_kysely17.ValueNode.createImmediate(null);
     }
     if (expr2.members.length !== 1) {
       throw new Error(`Only single member access is supported`);
@@ -2510,25 +2648,25 @@ var ExpressionTransformer = class {
     const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
     if (ownedByModel) {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely7.BinaryOperationNode.create(import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(fk), import_kysely7.TableNode.create(context.alias ?? fromModel)), import_kysely7.OperatorNode.create("="), import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(pk), import_kysely7.TableNode.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely17.BinaryOperationNode.create(import_kysely17.ReferenceNode.create(import_kysely17.ColumnNode.create(fk), import_kysely17.TableNode.create(context.alias ?? fromModel)), import_kysely17.OperatorNode.create("="), import_kysely17.ReferenceNode.create(import_kysely17.ColumnNode.create(pk), import_kysely17.TableNode.create(relationModel)))));
     } else {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely7.BinaryOperationNode.create(import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(pk), import_kysely7.TableNode.create(context.alias ?? fromModel)), import_kysely7.OperatorNode.create("="), import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(fk), import_kysely7.TableNode.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely17.BinaryOperationNode.create(import_kysely17.ReferenceNode.create(import_kysely17.ColumnNode.create(pk), import_kysely17.TableNode.create(context.alias ?? fromModel)), import_kysely17.OperatorNode.create("="), import_kysely17.ReferenceNode.create(import_kysely17.ColumnNode.create(fk), import_kysely17.TableNode.create(relationModel)))));
     }
     return {
       kind: "SelectQueryNode",
-      from: import_kysely7.FromNode.create([
-        import_kysely7.TableNode.create(relationModel)
+      from: import_kysely17.FromNode.create([
+        import_kysely17.TableNode.create(relationModel)
       ]),
-      where: import_kysely7.WhereNode.create(condition)
+      where: import_kysely17.WhereNode.create(condition)
     };
   }
   transformManyToManyRelationAccess(m2m, context) {
-    const eb = (0, import_kysely7.expressionBuilder)();
+    const eb = (0, import_kysely17.expressionBuilder)();
     const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
     return relationQuery.toOperationNode();
   }
   createColumnRef(column, context) {
-    return import_kysely7.ReferenceNode.create(import_kysely7.ColumnNode.create(column), import_kysely7.TableNode.create(context.alias ?? context.model));
+    return import_kysely17.ReferenceNode.create(import_kysely17.ColumnNode.create(column), import_kysely17.TableNode.create(context.alias ?? context.model));
   }
   isAuthCall(value) {
     return ExpressionUtils.isCall(value) && value.function === "auth";
@@ -2537,7 +2675,7 @@ var ExpressionTransformer = class {
     return ExpressionUtils.isMember(expr2) && this.isAuthCall(expr2.receiver);
   }
   isNullNode(node) {
-    return import_kysely7.ValueNode.is(node) && node.value === null;
+    return import_kysely17.ValueNode.is(node) && node.value === null;
   }
   buildLogicalNot(result) {
     return ExpressionUtils.unary("!", result);
@@ -2635,7 +2773,7 @@ _ts_decorate([
 ], ExpressionTransformer.prototype, "_member", null);
 
 // src/plugins/policy/policy-handler.ts
-var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
+var PolicyHandler = class extends import_kysely18.OperationNodeTransformer {
   static {
     __name(this, "PolicyHandler");
   }
@@ -2656,7 +2794,7 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       return proceed(this.transformNode(node));
     }
     const { mutationModel } = this.getMutationModel(node);
-    if (import_kysely8.InsertQueryNode.is(node)) {
+    if (import_kysely18.InsertQueryNode.is(node)) {
       const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
       let needCheckPreCreate = true;
       if (!isManyToManyJoinTable) {
@@ -2671,9 +2809,45 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
         await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
       }
     }
+    const hasPostUpdatePolicies = import_kysely18.UpdateQueryNode.is(node) && this.hasPostUpdatePolicies(mutationModel);
+    let beforeUpdateInfo;
+    if (hasPostUpdatePolicies) {
+      beforeUpdateInfo = await this.loadBeforeUpdateEntities(mutationModel, node.where, proceed);
+    }
     const result = await proceed(this.transformNode(node));
+    if (hasPostUpdatePolicies && result.rows.length > 0) {
+      const idConditions = this.buildIdConditions(mutationModel, result.rows);
+      const postUpdateFilter = this.buildPolicyFilter(mutationModel, void 0, "post-update");
+      const eb = (0, import_kysely18.expressionBuilder)();
+      const beforeUpdateTable = beforeUpdateInfo ? {
+        kind: "SelectQueryNode",
+        from: import_kysely18.FromNode.create([
+          import_kysely18.ParensNode.create(import_kysely18.ValuesNode.create(beforeUpdateInfo.rows.map((r) => import_kysely18.PrimitiveValueListNode.create(beforeUpdateInfo.fields.map((f) => r[f])))))
+        ]),
+        selections: beforeUpdateInfo.fields.map((name, index) => {
+          const def = requireField(this.client.$schema, mutationModel, name);
+          const castedColumnRef = import_kysely18.sql`CAST(${eb.ref(`column${index + 1}`)} as ${import_kysely18.sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+          return import_kysely18.SelectionNode.create(castedColumnRef.toOperationNode());
+        })
+      } : void 0;
+      const postUpdateQuery = eb.selectFrom(mutationModel).select(() => [
+        eb(eb.fn("COUNT", [
+          eb.lit(1)
+        ]), "=", result.rows.length).as("$condition")
+      ]).where(() => new import_kysely18.ExpressionWrapper(conjunction(this.dialect, [
+        idConditions,
+        postUpdateFilter
+      ]))).$if(!!beforeUpdateInfo, (qb) => qb.leftJoin(() => new import_kysely18.ExpressionWrapper(beforeUpdateTable).as("$before"), (join) => {
+        const idFields = requireIdFields(this.client.$schema, mutationModel);
+        return idFields.reduce((acc, f) => acc.onRef(`${mutationModel}.${f}`, "=", `$before.${f}`), join);
+      }));
+      const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
+      if (!postUpdateResult.rows[0]?.$condition) {
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+      }
+    }
     if (!node.returning || this.onlyReturningId(node)) {
-      return result;
+      return this.postProcessMutationResult(result, node);
     } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
@@ -2682,12 +2856,74 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       return readBackResult;
     }
   }
+  // correction to kysely mutation result may be needed because we might have added
+  // returning clause to the query and caused changes to the result shape
+  postProcessMutationResult(result, node) {
+    if (node.returning) {
+      return result;
+    } else {
+      return {
+        ...result,
+        rows: [],
+        numAffectedRows: result.numAffectedRows ?? BigInt(result.rows.length)
+      };
+    }
+  }
+  hasPostUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    return policies.length > 0;
+  }
+  async loadBeforeUpdateEntities(model, where, proceed) {
+    const beforeUpdateAccessFields = this.getFieldsAccessForBeforeUpdatePolicies(model);
+    if (!beforeUpdateAccessFields || beforeUpdateAccessFields.length === 0) {
+      return void 0;
+    }
+    const query = {
+      kind: "SelectQueryNode",
+      from: import_kysely18.FromNode.create([
+        import_kysely18.TableNode.create(model)
+      ]),
+      where,
+      selections: [
+        ...beforeUpdateAccessFields.map((f) => import_kysely18.SelectionNode.create(import_kysely18.ColumnNode.create(f)))
+      ]
+    };
+    const result = await proceed(query);
+    return {
+      fields: beforeUpdateAccessFields,
+      rows: result.rows
+    };
+  }
+  getFieldsAccessForBeforeUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    if (policies.length === 0) {
+      return void 0;
+    }
+    const fields = /* @__PURE__ */ new Set();
+    const fieldCollector = new class extends ExpressionVisitor {
+      visitMember(e) {
+        if (isBeforeInvocation(e.receiver)) {
+          (0, import_common_helpers15.invariant)(e.members.length === 1, "before() can only be followed by a scalar field access");
+          fields.add(e.members[0]);
+        }
+        super.visitMember(e);
+      }
+    }();
+    for (const policy of policies) {
+      fieldCollector.visit(policy.condition);
+    }
+    if (fields.size === 0) {
+      return void 0;
+    }
+    requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
+    return Array.from(fields).sort();
+  }
   // #region overrides
   transformSelectQuery(node) {
     let whereNode = this.transformNode(node.where);
     const policyFilter = this.createPolicyFilterForFrom(node.from);
     if (policyFilter) {
-      whereNode = import_kysely8.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
+      whereNode = import_kysely18.WhereNode.create(whereNode?.where ? conjunction(this.dialect, [
         whereNode.where,
         policyFilter
       ]) : policyFilter);
@@ -2709,17 +2945,17 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     const filter = this.buildPolicyFilter(table.model, table.alias, "read");
     const nestedSelect = {
       kind: "SelectQueryNode",
-      from: import_kysely8.FromNode.create([
+      from: import_kysely18.FromNode.create([
         node.table
       ]),
       selections: [
-        import_kysely8.SelectionNode.createSelectAll()
+        import_kysely18.SelectionNode.createSelectAll()
       ],
-      where: import_kysely8.WhereNode.create(filter)
+      where: import_kysely18.WhereNode.create(filter)
     };
     return {
       ...node,
-      table: import_kysely8.AliasNode.create(import_kysely8.ParensNode.create(nestedSelect), import_kysely8.IdentifierNode.create(table.alias ?? table.model))
+      table: import_kysely18.AliasNode.create(import_kysely18.ParensNode.create(nestedSelect), import_kysely18.IdentifierNode.create(table.alias ?? table.model))
     };
   }
   transformInsertQuery(node) {
@@ -2730,7 +2966,7 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       if (onConflict.updateWhere) {
         onConflict = {
           ...onConflict,
-          updateWhere: import_kysely8.WhereNode.create(conjunction(this.dialect, [
+          updateWhere: import_kysely18.WhereNode.create(conjunction(this.dialect, [
             onConflict.updateWhere.where,
             filter
           ]))
@@ -2738,7 +2974,7 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       } else {
         onConflict = {
           ...onConflict,
-          updateWhere: import_kysely8.WhereNode.create(filter)
+          updateWhere: import_kysely18.WhereNode.create(filter)
         };
       }
     }
@@ -2747,19 +2983,16 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       onConflict
     } : node;
     const result = super.transformInsertQuery(processedNode);
-    if (!node.returning) {
-      return result;
-    }
-    if (this.onlyReturningId(node)) {
-      return result;
-    } else {
+    let returning = result.returning;
+    if (returning) {
       const { mutationModel } = this.getMutationModel(node);
       const idFields = requireIdFields(this.client.$schema, mutationModel);
-      return {
-        ...result,
-        returning: import_kysely8.ReturningNode.create(idFields.map((field) => import_kysely8.SelectionNode.create(import_kysely8.ColumnNode.create(field))))
-      };
+      returning = import_kysely18.ReturningNode.create(idFields.map((f) => import_kysely18.SelectionNode.create(import_kysely18.ColumnNode.create(f))));
     }
+    return {
+      ...result,
+      returning
+    };
   }
   transformUpdateQuery(node) {
     const result = super.transformUpdateQuery(node);
@@ -2774,12 +3007,18 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
         ]);
       }
     }
+    let returning = result.returning;
+    if (returning || this.hasPostUpdatePolicies(mutationModel)) {
+      const idFields = requireIdFields(this.client.$schema, mutationModel);
+      returning = import_kysely18.ReturningNode.create(idFields.map((f) => import_kysely18.SelectionNode.create(import_kysely18.ColumnNode.create(f))));
+    }
     return {
       ...result,
-      where: import_kysely8.WhereNode.create(result.where ? conjunction(this.dialect, [
+      where: import_kysely18.WhereNode.create(result.where ? conjunction(this.dialect, [
         result.where.where,
         filter
-      ]) : filter)
+      ]) : filter),
+      returning
     };
   }
   transformDeleteQuery(node) {
@@ -2797,7 +3036,7 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     }
     return {
       ...result,
-      where: import_kysely8.WhereNode.create(result.where ? conjunction(this.dialect, [
+      where: import_kysely18.WhereNode.create(result.where ? conjunction(this.dialect, [
         result.where.where,
         filter
       ]) : filter)
@@ -2811,6 +3050,14 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     }
     const { mutationModel } = this.getMutationModel(node);
     const idFields = requireIdFields(this.client.$schema, mutationModel);
+    if (node.returning.selections.some((s) => import_kysely18.SelectAllNode.is(s.selection))) {
+      const modelDef = requireModel(this.client.$schema, mutationModel);
+      if (Object.keys(modelDef.fields).some((f) => !idFields.includes(f))) {
+        return false;
+      } else {
+        return true;
+      }
+    }
     const collector = new ColumnCollector();
     const selectedColumns = collector.collect(node.returning);
     return selectedColumns.every((c) => idFields.includes(c));
@@ -2830,27 +3077,27 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
   }
   async enforcePreCreatePolicyForManyToManyJoinTable(tableName, fields, values, proceed) {
     const m2m = this.resolveManyToManyJoinTable(tableName);
-    (0, import_common_helpers7.invariant)(m2m);
-    (0, import_common_helpers7.invariant)(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
+    (0, import_common_helpers15.invariant)(m2m);
+    (0, import_common_helpers15.invariant)(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
     const aIndex = fields.indexOf("A");
     const aNode = values[aIndex];
     const bIndex = fields.indexOf("B");
     const bNode = values[bIndex];
-    (0, import_common_helpers7.invariant)(import_kysely8.ValueNode.is(aNode) && import_kysely8.ValueNode.is(bNode), "A and B values must be ValueNode");
+    (0, import_common_helpers15.invariant)(import_kysely18.ValueNode.is(aNode) && import_kysely18.ValueNode.is(bNode), "A and B values must be ValueNode");
     const aValue = aNode.value;
     const bValue = bNode.value;
-    (0, import_common_helpers7.invariant)(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
-    (0, import_common_helpers7.invariant)(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
-    const eb = (0, import_kysely8.expressionBuilder)();
+    (0, import_common_helpers15.invariant)(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
+    (0, import_common_helpers15.invariant)(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
+    const eb = (0, import_kysely18.expressionBuilder)();
     const filterA = this.buildPolicyFilter(m2m.firstModel, void 0, "update");
-    const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new import_kysely8.ExpressionWrapper(filterA).as("$t"));
+    const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new import_kysely18.ExpressionWrapper(filterA).as("$t"));
     const filterB = this.buildPolicyFilter(m2m.secondModel, void 0, "update");
-    const queryB = eb.selectFrom(m2m.secondModel).where(eb(eb.ref(`${m2m.secondModel}.${m2m.secondIdField}`), "=", bValue)).select(() => new import_kysely8.ExpressionWrapper(filterB).as("$t"));
+    const queryB = eb.selectFrom(m2m.secondModel).where(eb(eb.ref(`${m2m.secondModel}.${m2m.secondIdField}`), "=", bValue)).select(() => new import_kysely18.ExpressionWrapper(filterB).as("$t"));
     const queryNode = {
       kind: "SelectQueryNode",
       selections: [
-        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(queryA.toOperationNode(), import_kysely8.IdentifierNode.create("$conditionA"))),
-        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(queryB.toOperationNode(), import_kysely8.IdentifierNode.create("$conditionB")))
+        import_kysely18.SelectionNode.create(import_kysely18.AliasNode.create(queryA.toOperationNode(), import_kysely18.IdentifierNode.create("$conditionA"))),
+        import_kysely18.SelectionNode.create(import_kysely18.AliasNode.create(queryB.toOperationNode(), import_kysely18.IdentifierNode.create("$conditionB")))
       ]
     };
     const result = await proceed(queryNode);
@@ -2869,34 +3116,34 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       if (index >= 0) {
         allValues.push(values[index]);
       } else {
-        allValues.push(import_kysely8.ValueNode.createImmediate(null));
+        allValues.push(import_kysely18.ValueNode.createImmediate(null));
       }
     }
-    const eb = (0, import_kysely8.expressionBuilder)();
+    const eb = (0, import_kysely18.expressionBuilder)();
     const constTable = {
       kind: "SelectQueryNode",
-      from: import_kysely8.FromNode.create([
-        import_kysely8.AliasNode.create(import_kysely8.ParensNode.create(import_kysely8.ValuesNode.create([
-          import_kysely8.ValueListNode.create(allValues)
-        ])), import_kysely8.IdentifierNode.create("$t"))
+      from: import_kysely18.FromNode.create([
+        import_kysely18.AliasNode.create(import_kysely18.ParensNode.create(import_kysely18.ValuesNode.create([
+          import_kysely18.ValueListNode.create(allValues)
+        ])), import_kysely18.IdentifierNode.create("$t"))
       ]),
       selections: allFields.map(([name, def], index) => {
-        const castedColumnRef = import_kysely8.sql`CAST(${eb.ref(`column${index + 1}`)} as ${import_kysely8.sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
-        return import_kysely8.SelectionNode.create(castedColumnRef.toOperationNode());
+        const castedColumnRef = import_kysely18.sql`CAST(${eb.ref(`column${index + 1}`)} as ${import_kysely18.sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+        return import_kysely18.SelectionNode.create(castedColumnRef.toOperationNode());
       })
     };
     const filter = this.buildPolicyFilter(model, void 0, "create");
     const preCreateCheck = {
       kind: "SelectQueryNode",
-      from: import_kysely8.FromNode.create([
-        import_kysely8.AliasNode.create(constTable, import_kysely8.IdentifierNode.create(model))
+      from: import_kysely18.FromNode.create([
+        import_kysely18.AliasNode.create(constTable, import_kysely18.IdentifierNode.create(model))
       ]),
       selections: [
-        import_kysely8.SelectionNode.create(import_kysely8.AliasNode.create(import_kysely8.BinaryOperationNode.create(import_kysely8.FunctionNode.create("COUNT", [
-          import_kysely8.ValueNode.createImmediate(1)
-        ]), import_kysely8.OperatorNode.create(">"), import_kysely8.ValueNode.createImmediate(0)), import_kysely8.IdentifierNode.create("$condition")))
+        import_kysely18.SelectionNode.create(import_kysely18.AliasNode.create(import_kysely18.BinaryOperationNode.create(import_kysely18.FunctionNode.create("COUNT", [
+          import_kysely18.ValueNode.createImmediate(1)
+        ]), import_kysely18.OperatorNode.create(">"), import_kysely18.ValueNode.createImmediate(0)), import_kysely18.IdentifierNode.create("$condition")))
       ],
-      where: import_kysely8.WhereNode.create(filter)
+      where: import_kysely18.WhereNode.create(filter)
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
@@ -2904,9 +3151,9 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     }
   }
   unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
-    if (import_kysely8.ValuesNode.is(node)) {
+    if (import_kysely18.ValuesNode.is(node)) {
       return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields, isManyToManyJoinTable));
-    } else if (import_kysely8.PrimitiveValueListNode.is(node)) {
+    } else if (import_kysely18.PrimitiveValueListNode.is(node)) {
       return [
         this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
       ];
@@ -2915,15 +3162,15 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     }
   }
   unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
-    (0, import_common_helpers7.invariant)(data.length === fields.length, "data length must match fields length");
+    (0, import_common_helpers15.invariant)(data.length === fields.length, "data length must match fields length");
     const result = [];
     for (let i = 0; i < data.length; i++) {
       const item = data[i];
       if (typeof item === "object" && item && "kind" in item) {
         const fieldDef = requireField(this.client.$schema, model, fields[i]);
-        (0, import_common_helpers7.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
+        (0, import_common_helpers15.invariant)(item.kind === "ValueNode", "expecting a ValueNode");
         result.push({
-          node: import_kysely8.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
+          node: import_kysely18.ValueNode.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
           raw: item.value
         });
       } else {
@@ -2934,12 +3181,12 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
         }
         if (Array.isArray(value)) {
           result.push({
-            node: import_kysely8.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
+            node: import_kysely18.RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
             raw: value
           });
         } else {
           result.push({
-            node: import_kysely8.ValueNode.create(value),
+            node: import_kysely18.ValueNode.create(value),
             raw: value
           });
         }
@@ -2980,10 +3227,10 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     const policyFilter = this.buildPolicyFilter(mutationModel, void 0, "read");
     const select = {
       kind: "SelectQueryNode",
-      from: import_kysely8.FromNode.create([
-        import_kysely8.TableNode.create(mutationModel)
+      from: import_kysely18.FromNode.create([
+        import_kysely18.TableNode.create(mutationModel)
       ]),
-      where: import_kysely8.WhereNode.create(conjunction(this.dialect, [
+      where: import_kysely18.WhereNode.create(conjunction(this.dialect, [
         idConditions,
         policyFilter
       ])),
@@ -2994,13 +3241,13 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
   }
   buildIdConditions(table, rows) {
     const idFields = requireIdFields(this.client.$schema, table);
-    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely8.BinaryOperationNode.create(import_kysely8.ColumnNode.create(field), import_kysely8.OperatorNode.create("="), import_kysely8.ValueNode.create(row[field]))))));
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => import_kysely18.BinaryOperationNode.create(import_kysely18.ReferenceNode.create(import_kysely18.ColumnNode.create(field), import_kysely18.TableNode.create(table)), import_kysely18.OperatorNode.create("="), import_kysely18.ValueNode.create(row[field]))))));
   }
   getMutationModel(node) {
-    const r = (0, import_ts_pattern8.match)(node).when(import_kysely8.InsertQueryNode.is, (node2) => ({
+    const r = (0, import_ts_pattern19.match)(node).when(import_kysely18.InsertQueryNode.is, (node2) => ({
       mutationModel: getTableName(node2.into),
       alias: void 0
-    })).when(import_kysely8.UpdateQueryNode.is, (node2) => {
+    })).when(import_kysely18.UpdateQueryNode.is, (node2) => {
       if (!node2.table) {
         throw new QueryError("Update query must have a table");
       }
@@ -3009,7 +3256,7 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
         mutationModel: r2.model,
         alias: r2.alias
       } : void 0;
-    }).when(import_kysely8.DeleteQueryNode.is, (node2) => {
+    }).when(import_kysely18.DeleteQueryNode.is, (node2) => {
       if (node2.from.froms.length !== 1) {
         throw new QueryError("Only one from table is supported for delete");
       }
@@ -3025,10 +3272,10 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     return r;
   }
   isCrudQueryNode(node) {
-    return import_kysely8.SelectQueryNode.is(node) || import_kysely8.InsertQueryNode.is(node) || import_kysely8.UpdateQueryNode.is(node) || import_kysely8.DeleteQueryNode.is(node);
+    return import_kysely18.SelectQueryNode.is(node) || import_kysely18.InsertQueryNode.is(node) || import_kysely18.UpdateQueryNode.is(node) || import_kysely18.DeleteQueryNode.is(node);
   }
   isMutationQueryNode(node) {
-    return import_kysely8.InsertQueryNode.is(node) || import_kysely8.UpdateQueryNode.is(node) || import_kysely8.DeleteQueryNode.is(node);
+    return import_kysely18.InsertQueryNode.is(node) || import_kysely18.UpdateQueryNode.is(node) || import_kysely18.DeleteQueryNode.is(node);
   }
   buildPolicyFilter(model, alias, operation) {
     const m2mFilter = this.getModelPolicyFilterForManyToManyJoinTable(model, alias, operation);
@@ -3036,40 +3283,41 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       return m2mFilter;
     }
     const policies = this.getModelPolicies(model, operation);
-    if (policies.length === 0) {
-      return falseNode(this.dialect);
-    }
     const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     let combinedPolicy;
     if (allows.length === 0) {
-      combinedPolicy = falseNode(this.dialect);
+      if (operation === "post-update") {
+        combinedPolicy = trueNode(this.dialect);
+      } else {
+        combinedPolicy = falseNode(this.dialect);
+      }
     } else {
       combinedPolicy = disjunction(this.dialect, allows);
-      if (denies.length !== 0) {
-        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
-        combinedPolicy = conjunction(this.dialect, [
-          combinedPolicy,
-          combinedDenies
-        ]);
-      }
+    }
+    if (denies.length !== 0) {
+      const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+      combinedPolicy = conjunction(this.dialect, [
+        combinedPolicy,
+        combinedDenies
+      ]);
     }
     return combinedPolicy;
   }
   extractTableName(node) {
-    if (import_kysely8.TableNode.is(node)) {
+    if (import_kysely18.TableNode.is(node)) {
       return {
         model: node.table.identifier.name
       };
     }
-    if (import_kysely8.AliasNode.is(node)) {
+    if (import_kysely18.AliasNode.is(node)) {
       const inner = this.extractTableName(node.node);
       if (!inner) {
         return void 0;
       }
       return {
         model: inner.model,
-        alias: import_kysely8.IdentifierNode.is(node.alias) ? node.alias.name : void 0
+        alias: import_kysely18.IdentifierNode.is(node.alias) ? node.alias.name : void 0
       };
     } else {
       return void 0;
@@ -3099,16 +3347,15 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
     return new ExpressionTransformer(this.client).transform(policy.condition, {
       model,
       alias,
-      operation,
-      auth: this.client.$auth
+      operation
     });
   }
   getModelPolicies(model, operation) {
     const modelDef = requireModel(this.client.$schema, model);
     const result = [];
     const extractOperations = /* @__PURE__ */ __name((expr2) => {
-      (0, import_common_helpers7.invariant)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
-      (0, import_common_helpers7.invariant)(typeof expr2.value === "string", "expecting a string literal");
+      (0, import_common_helpers15.invariant)(ExpressionUtils.isLiteral(expr2), "expecting a literal");
+      (0, import_common_helpers15.invariant)(typeof expr2.value === "string", "expecting a string literal");
       return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
     }, "extractOperations");
     if (modelDef.attributes) {
@@ -3116,7 +3363,7 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
         kind: attr.name === "@@allow" ? "allow" : "deny",
         operations: extractOperations(attr.args[0].value),
         condition: attr.args[1].value
-      })).filter((policy) => policy.operations.includes("all") || policy.operations.includes(operation)));
+      })).filter((policy) => operation !== "post-update" && policy.operations.includes("all") || policy.operations.includes(operation)));
     }
     return result;
   }
@@ -3137,7 +3384,7 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
           ].sort(this.manyToManySorter);
           const firstIdFields = requireIdFields(this.client.$schema, sortedRecord[0].model);
           const secondIdFields = requireIdFields(this.client.$schema, sortedRecord[1].model);
-          (0, import_common_helpers7.invariant)(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
+          (0, import_common_helpers15.invariant)(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
           return {
             firstModel: sortedRecord[0].model,
             firstField: sortedRecord[0].field,
@@ -3163,10 +3410,10 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
       return void 0;
     }
     const checkForOperation = operation === "read" ? "read" : "update";
-    const eb = (0, import_kysely8.expressionBuilder)();
+    const eb = (0, import_kysely18.expressionBuilder)();
     const joinTable = alias ?? tableName;
-    const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new import_kysely8.ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
-    const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new import_kysely8.ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
+    const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new import_kysely18.ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
+    const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new import_kysely18.ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
     return eb.and([
       aQuery,
       bQuery
@@ -3176,25 +3423,25 @@ var PolicyHandler = class extends import_kysely8.OperationNodeTransformer {
 
 // src/plugins/policy/functions.ts
 var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, operation }) => {
-  (0, import_common_helpers8.invariant)(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
+  (0, import_common_helpers16.invariant)(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
   const arg1Node = args[0].toOperationNode();
   const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
   if (arg2Node) {
-    (0, import_common_helpers8.invariant)(import_kysely9.ValueNode.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
-    (0, import_common_helpers8.invariant)(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+    (0, import_common_helpers16.invariant)(import_kysely19.ValueNode.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
+    (0, import_common_helpers16.invariant)(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
   }
   const fieldName = extractFieldName(arg1Node);
-  (0, import_common_helpers8.invariant)(fieldName, 'Failed to extract field name from the first argument of "check" function');
+  (0, import_common_helpers16.invariant)(fieldName, 'Failed to extract field name from the first argument of "check" function');
   const fieldDef = requireField(client.$schema, model, fieldName);
-  (0, import_common_helpers8.invariant)(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
-  (0, import_common_helpers8.invariant)(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
+  (0, import_common_helpers16.invariant)(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
+  (0, import_common_helpers16.invariant)(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
   const relationModel = fieldDef.type;
   const op = arg2Node ? arg2Node.value : operation;
   const policyHandler = new PolicyHandler(client);
   const joinPairs = buildJoinPairs(client.$schema, model, modelAlias, fieldName, relationModel);
   const joinCondition = joinPairs.length === 1 ? eb(eb.ref(joinPairs[0][0]), "=", eb.ref(joinPairs[0][1])) : eb.and(joinPairs.map(([left, right]) => eb(eb.ref(left), "=", eb.ref(right))));
   const policyCondition = policyHandler.buildPolicyFilter(relationModel, void 0, op);
-  const result = eb.selectFrom(relationModel).where(joinCondition).select(new import_kysely9.ExpressionWrapper(policyCondition).as("$condition"));
+  const result = eb.selectFrom(relationModel).where(joinCondition).select(new import_kysely19.ExpressionWrapper(policyCondition).as("$condition"));
   return result;
 }, "check");
 
@@ -3217,18 +3464,9 @@ var PolicyPlugin = class {
       check
     };
   }
-  onKyselyQuery({
-    query,
-    client,
-    proceed
-    /*, transaction*/
-  }) {
+  onKyselyQuery({ query, client, proceed }) {
     const handler = new PolicyHandler(client);
-    return handler.handle(
-      query,
-      proceed
-      /*, transaction*/
-    );
+    return handler.handle(query, proceed);
   }
 };
 // Annotate the CommonJS export names for ESM import in node: