@zenstackhq/runtime 3.0.0-beta.7 → 3.0.0-beta.8

package/dist/plugins/policy/index.js

@@ -1,48 +1,13 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
-// src/plugins/policy/errors.ts
-var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
-  RejectedByPolicyReason2["NO_ACCESS"] = "no-access";
-  RejectedByPolicyReason2["CANNOT_READ_BACK"] = "cannot-read-back";
-  RejectedByPolicyReason2["OTHER"] = "other";
-  return RejectedByPolicyReason2;
-}({});
-var RejectedByPolicyError = class extends Error {
-  static {
-    __name(this, "RejectedByPolicyError");
-  }
-  model;
-  reason;
-  constructor(model, reason = "no-access", message) {
-    super(message ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
-  }
-};
-
-// src/plugins/policy/functions.ts
-import { invariant as invariant8 } from "@zenstackhq/common-helpers";
-import { ExpressionWrapper as ExpressionWrapper2, ValueNode as ValueNode4 } from "kysely";
+// src/client/client-impl.ts
+import { invariant as invariant11 } from "@zenstackhq/common-helpers";
+import { CompiledQuery, DefaultConnectionProvider, DefaultQueryExecutor as DefaultQueryExecutor2, Kysely, Log, sql as sql9, Transaction } from "kysely";
 
-// src/client/contract.ts
-var CRUD = [
-  "create",
-  "read",
-  "update",
-  "delete"
-];
-
-// src/client/kysely-utils.ts
-import { AliasNode, ColumnNode, ReferenceNode, TableNode } from "kysely";
-function extractFieldName(node) {
-  if (ReferenceNode.is(node) && ColumnNode.is(node.column)) {
-    return node.column.column.name;
-  } else if (ColumnNode.is(node)) {
-    return node.column.name;
-  } else {
-    return void 0;
-  }
-}
-__name(extractFieldName, "extractFieldName");
+// src/client/crud/operations/aggregate.ts
+import { sql as sql5 } from "kysely";
+import { match as match7 } from "ts-pattern";
 
 // src/client/query-utils.ts
 import { invariant } from "@zenstackhq/common-helpers";
@@ -134,7 +99,12 @@ var ExpressionUtils = {
 };
 
 // src/client/errors.ts
-var QueryError = class extends Error {
+var ZenStackError = class extends Error {
+  static {
+    __name(this, "ZenStackError");
+  }
+};
+var QueryError = class extends ZenStackError {
   static {
     __name(this, "QueryError");
   }
@@ -144,7 +114,7 @@ var QueryError = class extends Error {
     });
   }
 };
-var InternalError = class extends Error {
+var InternalError = class extends ZenStackError {
   static {
     __name(this, "InternalError");
   }
@@ -425,19 +395,31 @@ function aggregate(eb, expr2, op) {
 }
 __name(aggregate, "aggregate");
 
-// src/plugins/policy/policy-handler.ts
-import { invariant as invariant7 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode4, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode3, DeleteQueryNode, expressionBuilder as expressionBuilder3, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReturningNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql as sql4, TableNode as TableNode4, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
-import { match as match8 } from "ts-pattern";
+// src/client/crud/operations/base.ts
+import { createId } from "@paralleldrive/cuid2";
+import { invariant as invariant5, isPlainObject as isPlainObject3 } from "@zenstackhq/common-helpers";
+import { expressionBuilder as expressionBuilder2, sql as sql4 } from "kysely";
+import { nanoid } from "nanoid";
+import { match as match6 } from "ts-pattern";
+import { ulid } from "ulid";
+import * as uuid from "uuid";
 
-// src/client/crud/dialects/index.ts
-import { match as match5 } from "ts-pattern";
+// src/utils/clone.ts
+import { isPlainObject } from "@zenstackhq/common-helpers";
 
-// src/client/crud/dialects/postgresql.ts
-import { invariant as invariant3 } from "@zenstackhq/common-helpers";
-import Decimal from "decimal.js";
-import { sql as sql2 } from "kysely";
-import { match as match3 } from "ts-pattern";
+// src/utils/enumerate.ts
+function enumerate(x) {
+  if (x === null || x === void 0) {
+    return [];
+  } else if (Array.isArray(x)) {
+    return x;
+  } else {
+    return [
+      x
+    ];
+  }
+}
+__name(enumerate, "enumerate");
 
 // src/client/constants.ts
 var DELEGATE_JOINED_FIELD_PREFIX = "$delegate$";
@@ -454,26 +436,31 @@ var AGGREGATE_OPERATORS = [
   "_max"
 ];
 
-// src/client/crud/dialects/base-dialect.ts
-import { invariant as invariant2, isPlainObject } from "@zenstackhq/common-helpers";
-import { expressionBuilder, sql } from "kysely";
-import { match as match2, P } from "ts-pattern";
+// src/client/contract.ts
+var CRUD = [
+  "create",
+  "read",
+  "update",
+  "delete"
+];
+var CRUD_EXT = [
+  ...CRUD,
+  "post-update"
+];
 
-// src/utils/enumerate.ts
-function enumerate(x) {
-  if (x === null || x === void 0) {
-    return [];
-  } else if (Array.isArray(x)) {
-    return x;
-  } else {
-    return [
-      x
-    ];
-  }
-}
-__name(enumerate, "enumerate");
+// src/client/crud/dialects/index.ts
+import { match as match5 } from "ts-pattern";
+
+// src/client/crud/dialects/postgresql.ts
+import { invariant as invariant3 } from "@zenstackhq/common-helpers";
+import Decimal from "decimal.js";
+import { sql as sql2 } from "kysely";
+import { match as match3 } from "ts-pattern";
 
 // src/client/crud/dialects/base-dialect.ts
+import { invariant as invariant2, isPlainObject as isPlainObject2 } from "@zenstackhq/common-helpers";
+import { expressionBuilder, sql } from "kysely";
+import { match as match2, P } from "ts-pattern";
 var BaseCrudDialect = class {
   static {
     __name(this, "BaseCrudDialect");
@@ -752,7 +739,7 @@ var BaseCrudDialect = class {
     return eb(lhs, "=", rhs !== null && rhs !== void 0 ? this.transformPrimitive(rhs, type, false) : rhs);
   }
   buildStandardFilter(eb, type, payload, lhs, getRhs, recurse, throwIfInvalid = false, onlyForKeys = void 0, excludeKeys = []) {
-    if (payload === null || !isPlainObject(payload)) {
+    if (payload === null || !isPlainObject2(payload)) {
       return {
         conditions: [
           this.buildLiteralFilter(eb, lhs, type, payload)
@@ -1569,6 +1556,149 @@ function getCrudDialect(schema, options) {
 }
 __name(getCrudDialect, "getCrudDialect");
 
+// src/client/crud/operations/count.ts
+import { sql as sql6 } from "kysely";
+
+// src/client/crud/operations/create.ts
+import { match as match8 } from "ts-pattern";
+
+// src/client/crud/operations/delete.ts
+import { match as match9 } from "ts-pattern";
+
+// src/client/crud/operations/group-by.ts
+import { expressionBuilder as expressionBuilder3 } from "kysely";
+import { match as match10 } from "ts-pattern";
+
+// src/client/crud/operations/update.ts
+import { match as match11 } from "ts-pattern";
+
+// src/client/crud/validator.ts
+import { invariant as invariant6 } from "@zenstackhq/common-helpers";
+import Decimal3 from "decimal.js";
+import stableStringify from "json-stable-stringify";
+import { match as match12, P as P2 } from "ts-pattern";
+import { z } from "zod";
+
+// src/utils/zod-utils.ts
+import { fromError as fromError3 } from "zod-validation-error/v3";
+import { fromError as fromError4 } from "zod-validation-error/v4";
+
+// src/client/executor/zenstack-query-executor.ts
+import { invariant as invariant8 } from "@zenstackhq/common-helpers";
+import { AndNode, DefaultQueryExecutor, DeleteQueryNode, InsertQueryNode, ReturningNode, SelectionNode as SelectionNode2, SingleConnectionProvider, TableNode as TableNode3, UpdateQueryNode, WhereNode } from "kysely";
+import { match as match13 } from "ts-pattern";
+
+// src/client/kysely-utils.ts
+import { AliasNode, ColumnNode, ReferenceNode, TableNode } from "kysely";
+function extractFieldName(node) {
+  if (ReferenceNode.is(node) && ColumnNode.is(node.column)) {
+    return node.column.column.name;
+  } else if (ColumnNode.is(node)) {
+    return node.column.name;
+  } else {
+    return void 0;
+  }
+}
+__name(extractFieldName, "extractFieldName");
+
+// src/client/executor/name-mapper.ts
+import { invariant as invariant7 } from "@zenstackhq/common-helpers";
+import { AliasNode as AliasNode2, ColumnNode as ColumnNode2, FromNode, IdentifierNode, OperationNodeTransformer, ReferenceNode as ReferenceNode2, SelectAllNode, SelectionNode, TableNode as TableNode2 } from "kysely";
+
+// src/client/functions.ts
+import { invariant as invariant9, lowerCaseFirst, upperCaseFirst } from "@zenstackhq/common-helpers";
+import { sql as sql7, ValueNode } from "kysely";
+import { match as match14 } from "ts-pattern";
+
+// src/client/helpers/schema-db-pusher.ts
+import { invariant as invariant10 } from "@zenstackhq/common-helpers";
+import { sql as sql8 } from "kysely";
+import toposort from "toposort";
+import { match as match15 } from "ts-pattern";
+
+// src/client/index.ts
+import { sql as sql10 } from "kysely";
+
+// src/plugins/policy/errors.ts
+var RejectedByPolicyReason = /* @__PURE__ */ function(RejectedByPolicyReason2) {
+  RejectedByPolicyReason2["NO_ACCESS"] = "no-access";
+  RejectedByPolicyReason2["CANNOT_READ_BACK"] = "cannot-read-back";
+  RejectedByPolicyReason2["OTHER"] = "other";
+  return RejectedByPolicyReason2;
+}({});
+var RejectedByPolicyError = class extends ZenStackError {
+  static {
+    __name(this, "RejectedByPolicyError");
+  }
+  model;
+  reason;
+  constructor(model, reason = "no-access", message) {
+    super(message ?? `Operation rejected by policy${model ? ": " + model : ""}`), this.model = model, this.reason = reason;
+  }
+};
+
+// src/plugins/policy/functions.ts
+import { invariant as invariant15 } from "@zenstackhq/common-helpers";
+import { ExpressionWrapper as ExpressionWrapper2, ValueNode as ValueNode5 } from "kysely";
+
+// src/plugins/policy/policy-handler.ts
+import { invariant as invariant14 } from "@zenstackhq/common-helpers";
+import { AliasNode as AliasNode5, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode4, DeleteQueryNode as DeleteQueryNode2, expressionBuilder as expressionBuilder5, ExpressionWrapper, FromNode as FromNode3, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode3, InsertQueryNode as InsertQueryNode2, OperationNodeTransformer as OperationNodeTransformer2, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReferenceNode as ReferenceNode5, ReturningNode as ReturningNode2, SelectAllNode as SelectAllNode2, SelectionNode as SelectionNode4, SelectQueryNode as SelectQueryNode2, sql as sql11, TableNode as TableNode6, UpdateQueryNode as UpdateQueryNode2, ValueListNode as ValueListNode2, ValueNode as ValueNode4, ValuesNode, WhereNode as WhereNode3 } from "kysely";
+import { match as match19 } from "ts-pattern";
+
+// src/utils/expression-utils.ts
+import { match as match16 } from "ts-pattern";
+var ExpressionVisitor = class {
+  static {
+    __name(this, "ExpressionVisitor");
+  }
+  visit(expr2) {
+    match16(expr2).with({
+      kind: "literal"
+    }, (e) => this.visitLiteral(e)).with({
+      kind: "array"
+    }, (e) => this.visitArray(e)).with({
+      kind: "field"
+    }, (e) => this.visitField(e)).with({
+      kind: "member"
+    }, (e) => this.visitMember(e)).with({
+      kind: "binary"
+    }, (e) => this.visitBinary(e)).with({
+      kind: "unary"
+    }, (e) => this.visitUnary(e)).with({
+      kind: "call"
+    }, (e) => this.visitCall(e)).with({
+      kind: "this"
+    }, (e) => this.visitThis(e)).with({
+      kind: "null"
+    }, (e) => this.visitNull(e)).exhaustive();
+  }
+  visitLiteral(_e) {
+  }
+  visitArray(e) {
+    e.items.forEach((item) => this.visit(item));
+  }
+  visitField(_e) {
+  }
+  visitMember(e) {
+    this.visit(e.receiver);
+  }
+  visitBinary(e) {
+    this.visit(e.left);
+    this.visit(e.right);
+  }
+  visitUnary(e) {
+    this.visit(e.operand);
+  }
+  visitCall(e) {
+    e.args?.forEach((arg) => this.visit(arg));
+  }
+  visitThis(_e) {
+  }
+  visitNull(_e) {
+  }
+};
+
 // src/utils/default-operation-node-visitor.ts
 import { OperationNodeVisitor } from "kysely";
 var DefaultOperationNodeVisitor = class extends OperationNodeVisitor {
@@ -1888,19 +2018,19 @@ var ColumnCollector = class extends DefaultOperationNodeVisitor {
 };
 
 // src/plugins/policy/expression-transformer.ts
-import { invariant as invariant6 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode2, ColumnNode as ColumnNode2, expressionBuilder as expressionBuilder2, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode3, SelectionNode, SelectQueryNode, TableNode as TableNode3, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
-import { match as match7 } from "ts-pattern";
+import { invariant as invariant13 } from "@zenstackhq/common-helpers";
+import { AliasNode as AliasNode4, BinaryOperationNode as BinaryOperationNode2, ColumnNode as ColumnNode3, expressionBuilder as expressionBuilder4, FromNode as FromNode2, FunctionNode as FunctionNode2, IdentifierNode as IdentifierNode2, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode4, SelectionNode as SelectionNode3, SelectQueryNode, TableNode as TableNode5, ValueListNode, ValueNode as ValueNode3, WhereNode as WhereNode2 } from "kysely";
+import { match as match18 } from "ts-pattern";
 
 // src/plugins/policy/expression-evaluator.ts
-import { invariant as invariant5 } from "@zenstackhq/common-helpers";
-import { match as match6 } from "ts-pattern";
+import { invariant as invariant12 } from "@zenstackhq/common-helpers";
+import { match as match17 } from "ts-pattern";
 var ExpressionEvaluator = class {
   static {
     __name(this, "ExpressionEvaluator");
   }
   evaluate(expression, context) {
-    const result = match6(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
+    const result = match17(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
     return result ?? null;
   }
   evaluateCall(expr2, context) {
@@ -1911,7 +2041,7 @@ var ExpressionEvaluator = class {
     }
   }
   evaluateUnary(expr2, context) {
-    return match6(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
+    return match17(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
   }
   evaluateMember(expr2, context) {
     let val = this.evaluate(expr2.receiver, context);
@@ -1935,21 +2065,21 @@ var ExpressionEvaluator = class {
     }
     const left = this.evaluate(expr2.left, context);
     const right = this.evaluate(expr2.right, context);
-    return match6(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
+    return match17(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
-      invariant5(Array.isArray(_right), 'expected array for "in" operator');
+      invariant12(Array.isArray(_right), 'expected array for "in" operator');
       return _right.includes(left);
     }).exhaustive();
   }
   evaluateCollectionPredicate(expr2, context) {
     const op = expr2.op;
-    invariant5(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    invariant12(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
     if (!left) {
       return false;
     }
-    invariant5(Array.isArray(left), "expected array");
-    return match6(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
+    invariant12(Array.isArray(left), "expected array");
+    return match17(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
       ...context,
       thisValue: item
     }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
@@ -1963,21 +2093,21 @@ var ExpressionEvaluator = class {
 };
 
 // src/plugins/policy/utils.ts
-import { AliasNode as AliasNode2, AndNode, BinaryOperationNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode as ReferenceNode2, TableNode as TableNode2, UnaryOperationNode, ValueNode } from "kysely";
+import { AliasNode as AliasNode3, AndNode as AndNode2, BinaryOperationNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode as ReferenceNode3, TableNode as TableNode4, UnaryOperationNode, ValueNode as ValueNode2 } from "kysely";
 function trueNode(dialect) {
-  return ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
+  return ValueNode2.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
 }
 __name(trueNode, "trueNode");
 function falseNode(dialect) {
-  return ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
+  return ValueNode2.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
 }
 __name(falseNode, "falseNode");
 function isTrueNode(node) {
-  return ValueNode.is(node) && (node.value === true || node.value === 1);
+  return ValueNode2.is(node) && (node.value === true || node.value === 1);
 }
 __name(isTrueNode, "isTrueNode");
 function isFalseNode(node) {
-  return ValueNode.is(node) && (node.value === false || node.value === 0);
+  return ValueNode2.is(node) && (node.value === false || node.value === 0);
 }
 __name(isFalseNode, "isFalseNode");
 function conjunction(dialect, nodes) {
@@ -1994,7 +2124,7 @@ function conjunction(dialect, nodes) {
   if (items.length === 0) {
     return trueNode(dialect);
   }
-  return items.reduce((acc, node) => AndNode.create(wrapParensIf(acc, OrNode.is), wrapParensIf(node, OrNode.is)));
+  return items.reduce((acc, node) => AndNode2.create(wrapParensIf(acc, OrNode.is), wrapParensIf(node, OrNode.is)));
 }
 __name(conjunction, "conjunction");
 function disjunction(dialect, nodes) {
@@ -2011,7 +2141,7 @@ function disjunction(dialect, nodes) {
   if (items.length === 0) {
     return falseNode(dialect);
   }
-  return items.reduce((acc, node) => OrNode.create(wrapParensIf(acc, AndNode.is), wrapParensIf(node, AndNode.is)));
+  return items.reduce((acc, node) => OrNode.create(wrapParensIf(acc, AndNode2.is), wrapParensIf(node, AndNode2.is)));
 }
 __name(disjunction, "disjunction");
 function logicalNot(dialect, node) {
@@ -2021,7 +2151,7 @@ function logicalNot(dialect, node) {
   if (isFalseNode(node)) {
     return trueNode(dialect);
   }
-  return UnaryOperationNode.create(OperatorNode.create("not"), wrapParensIf(node, (n) => AndNode.is(n) || OrNode.is(n)));
+  return UnaryOperationNode.create(OperatorNode.create("not"), wrapParensIf(node, (n) => AndNode2.is(n) || OrNode.is(n)));
 }
 __name(logicalNot, "logicalNot");
 function wrapParensIf(node, predicate) {
@@ -2049,16 +2179,20 @@ function getTableName(node) {
   if (!node) {
     return node;
   }
-  if (TableNode2.is(node)) {
+  if (TableNode4.is(node)) {
     return node.table.identifier.name;
-  } else if (AliasNode2.is(node)) {
+  } else if (AliasNode3.is(node)) {
     return getTableName(node.node);
-  } else if (ReferenceNode2.is(node) && node.table) {
+  } else if (ReferenceNode3.is(node) && node.table) {
     return getTableName(node.table);
   }
   return void 0;
 }
 __name(getTableName, "getTableName");
+function isBeforeInvocation(expr2) {
+  return ExpressionUtils.isCall(expr2) && expr2.function === "before";
+}
+__name(isBeforeInvocation, "isBeforeInvocation");
 
 // src/plugins/policy/expression-transformer.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -2138,18 +2272,18 @@ var ExpressionTransformer = class {
   }
   mergeWhere(where, memberFilter) {
     if (!where) {
-      return WhereNode.create(memberFilter ?? trueNode(this.dialect));
+      return WhereNode2.create(memberFilter ?? trueNode(this.dialect));
     }
     if (!memberFilter) {
       return where;
     }
-    return WhereNode.create(conjunction(this.dialect, [
+    return WhereNode2.create(conjunction(this.dialect, [
       where.where,
       memberFilter
     ]));
   }
   _null() {
-    return ValueNode2.createImmediate(null);
+    return ValueNode3.createImmediate(null);
   }
   _binary(expr2, context) {
     if (expr2.op === "&&") {
@@ -2195,31 +2329,31 @@ var ExpressionTransformer = class {
     }
   }
   transformNullCheck(expr2, operator) {
-    invariant6(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
-    if (ValueNode2.is(expr2)) {
+    invariant13(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
+    if (ValueNode3.is(expr2)) {
       if (expr2.value === null) {
         return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
       } else {
         return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
       }
     } else {
-      return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+      return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode3.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode3.createImmediate(null));
     }
   }
   normalizeBinaryOperationOperands(expr2, context) {
     let normalizedLeft = expr2.left;
     if (this.isRelationField(expr2.left, context.model)) {
-      invariant6(ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
+      invariant13(ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
       const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
-      invariant6(leftRelDef, "failed to get relation field definition");
+      invariant13(leftRelDef, "failed to get relation field definition");
       const idFields = requireIdFields(this.schema, leftRelDef.type);
       normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
     }
     let normalizedRight = expr2.right;
     if (this.isRelationField(expr2.right, context.model)) {
-      invariant6(ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
+      invariant13(ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
       const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
-      invariant6(rightRelDef, "failed to get relation field definition");
+      invariant13(rightRelDef, "failed to get relation field definition");
       const idFields = requireIdFields(this.schema, rightRelDef.type);
       normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
     }
@@ -2229,21 +2363,21 @@ var ExpressionTransformer = class {
     };
   }
   transformCollectionPredicate(expr2, context) {
-    invariant6(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    invariant13(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
     if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
       const value = new ExpressionEvaluator().evaluate(expr2, {
         auth: this.auth
       });
       return this.transformValue(value, "Boolean");
     }
-    invariant6(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
+    invariant13(ExpressionUtils.isField(expr2.left) || ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
     const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
     if (fieldDef) {
-      invariant6(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
+      invariant13(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
-      invariant6(ExpressionUtils.isMember(expr2.left) && ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
+      invariant13(ExpressionUtils.isMember(expr2.left) && ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
       const fieldDef2 = requireField(this.schema, context.model, expr2.left.receiver.field);
       newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
@@ -2260,12 +2394,12 @@ var ExpressionTransformer = class {
       predicateFilter = logicalNot(this.dialect, predicateFilter);
     }
     const count = FunctionNode2.create("count", [
-      ValueNode2.createImmediate(1)
+      ValueNode3.createImmediate(1)
     ]);
-    const predicateResult = match7(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode2.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).exhaustive();
+    const predicateResult = match18(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode3.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode3.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode3.createImmediate(0))).exhaustive();
     return this.transform(expr2.left, {
       ...context,
-      memberSelect: SelectionNode.create(AliasNode3.create(predicateResult, IdentifierNode.create("$t"))),
+      memberSelect: SelectionNode3.create(AliasNode4.create(predicateResult, IdentifierNode2.create("$t"))),
       memberFilter: predicateFilter
     });
   }
@@ -2290,7 +2424,7 @@ var ExpressionTransformer = class {
         throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
-      invariant6(idFields.length > 0, "auth type model must have at least one id field");
+      invariant13(idFields.length > 0, "auth type model must have at least one id field");
       const conditions = idFields.map((fieldName) => ExpressionUtils.binary(ExpressionUtils.member(authExpr, [
         fieldName
       ]), "==", this.makeOrAppendMember(other, fieldName)));
@@ -2319,15 +2453,15 @@ var ExpressionTransformer = class {
     } else if (value === false) {
       return falseNode(this.dialect);
     } else {
-      return ValueNode2.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+      return ValueNode3.create(this.dialect.transformPrimitive(value, type, false) ?? null);
     }
   }
   _unary(expr2, context) {
-    invariant6(expr2.op === "!", 'only "!" operator is supported');
+    invariant13(expr2.op === "!", 'only "!" operator is supported');
     return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
-    const mappedOp = match7(op).with("==", () => "=").otherwise(() => op);
+    const mappedOp = match18(op).with("==", () => "=").otherwise(() => op);
     return OperatorNode2.create(mappedOp);
   }
   _call(expr2, context) {
@@ -2339,7 +2473,7 @@ var ExpressionTransformer = class {
     if (!func) {
       throw new QueryError(`Function not implemented: ${expr2.function}`);
     }
-    const eb = expressionBuilder2();
+    const eb = expressionBuilder4();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
       client: this.client,
       dialect: this.dialect,
@@ -2371,7 +2505,7 @@ var ExpressionTransformer = class {
       return this.transformCall(arg, context);
     }
     if (this.isAuthMember(arg)) {
-      const valNode = this.valueMemberAccess(context.auth, arg, this.authType);
+      const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
       return valNode ? eb.val(valNode.value) : eb.val(null);
     }
     throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
@@ -2380,7 +2514,12 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
-    invariant6(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    if (isBeforeInvocation(expr2.receiver)) {
+      invariant13(context.operation === "post-update", "before() can only be used in post-update policy");
+      invariant13(expr2.members.length === 1, "before() can only be followed by a scalar field access");
+      return ReferenceNode4.create(ColumnNode3.create(expr2.members[0]), TableNode5.create("$before"));
+    }
+    invariant13(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
     let members = expr2.members;
     let receiver;
     const { memberFilter, memberSelect, ...restContext } = context;
@@ -2395,7 +2534,7 @@ var ExpressionTransformer = class {
     } else {
       receiver = this.transform(expr2.receiver, restContext);
     }
-    invariant6(SelectQueryNode.is(receiver), "expected receiver to be select query");
+    invariant13(SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (ExpressionUtils.isField(expr2.receiver)) {
       const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
@@ -2424,11 +2563,10 @@ var ExpressionTransformer = class {
           alias: void 0
         });
         if (currNode) {
-          invariant6(SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
-              SelectionNode.create(AliasNode3.create(currNode, IdentifierNode.create(members[i + 1])))
+              SelectionNode3.create(AliasNode4.create(currNode, IdentifierNode2.create(members[i + 1])))
             ]
           };
         } else {
@@ -2441,21 +2579,21 @@ var ExpressionTransformer = class {
           };
         }
       } else {
-        invariant6(i === members.length - 1, "plain field access must be the last segment");
-        invariant6(!currNode, "plain field access must be the last segment");
-        currNode = ColumnNode2.create(member);
+        invariant13(i === members.length - 1, "plain field access must be the last segment");
+        invariant13(!currNode, "plain field access must be the last segment");
+        currNode = ColumnNode3.create(member);
       }
     }
     return {
       ...receiver,
       selections: [
-        SelectionNode.create(AliasNode3.create(currNode, IdentifierNode.create("$t")))
+        SelectionNode3.create(AliasNode4.create(currNode, IdentifierNode2.create("$t")))
       ]
     };
   }
   valueMemberAccess(receiver, expr2, receiverType) {
     if (!receiver) {
-      return ValueNode2.createImmediate(null);
+      return ValueNode3.createImmediate(null);
     }
     if (expr2.members.length !== 1) {
       throw new Error(`Only single member access is supported`);
@@ -2474,25 +2612,25 @@ var ExpressionTransformer = class {
     const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
     if (ownedByModel) {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode3.create(ColumnNode2.create(fk), TableNode3.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode3.create(ColumnNode2.create(pk), TableNode3.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode4.create(ColumnNode3.create(fk), TableNode5.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode4.create(ColumnNode3.create(pk), TableNode5.create(relationModel)))));
     } else {
-      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode3.create(ColumnNode2.create(pk), TableNode3.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode3.create(ColumnNode2.create(fk), TableNode3.create(relationModel)))));
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode4.create(ColumnNode3.create(pk), TableNode5.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode4.create(ColumnNode3.create(fk), TableNode5.create(relationModel)))));
     }
     return {
       kind: "SelectQueryNode",
-      from: FromNode.create([
-        TableNode3.create(relationModel)
+      from: FromNode2.create([
+        TableNode5.create(relationModel)
       ]),
-      where: WhereNode.create(condition)
+      where: WhereNode2.create(condition)
     };
   }
   transformManyToManyRelationAccess(m2m, context) {
-    const eb = expressionBuilder2();
+    const eb = expressionBuilder4();
     const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
     return relationQuery.toOperationNode();
   }
   createColumnRef(column, context) {
-    return ReferenceNode3.create(ColumnNode2.create(column), TableNode3.create(context.alias ?? context.model));
+    return ReferenceNode4.create(ColumnNode3.create(column), TableNode5.create(context.alias ?? context.model));
   }
   isAuthCall(value) {
     return ExpressionUtils.isCall(value) && value.function === "auth";
@@ -2501,7 +2639,7 @@ var ExpressionTransformer = class {
     return ExpressionUtils.isMember(expr2) && this.isAuthCall(expr2.receiver);
   }
   isNullNode(node) {
-    return ValueNode2.is(node) && node.value === null;
+    return ValueNode3.is(node) && node.value === null;
   }
   buildLogicalNot(result) {
     return ExpressionUtils.unary("!", result);
@@ -2599,7 +2737,7 @@ _ts_decorate([
 ], ExpressionTransformer.prototype, "_member", null);
 
 // src/plugins/policy/policy-handler.ts
-var PolicyHandler = class extends OperationNodeTransformer {
+var PolicyHandler = class extends OperationNodeTransformer2 {
   static {
     __name(this, "PolicyHandler");
   }
@@ -2620,7 +2758,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return proceed(this.transformNode(node));
     }
     const { mutationModel } = this.getMutationModel(node);
-    if (InsertQueryNode.is(node)) {
+    if (InsertQueryNode2.is(node)) {
       const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
       let needCheckPreCreate = true;
       if (!isManyToManyJoinTable) {
@@ -2635,9 +2773,45 @@ var PolicyHandler = class extends OperationNodeTransformer {
         await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
       }
     }
+    const hasPostUpdatePolicies = UpdateQueryNode2.is(node) && this.hasPostUpdatePolicies(mutationModel);
+    let beforeUpdateInfo;
+    if (hasPostUpdatePolicies) {
+      beforeUpdateInfo = await this.loadBeforeUpdateEntities(mutationModel, node.where, proceed);
+    }
     const result = await proceed(this.transformNode(node));
+    if (hasPostUpdatePolicies && result.rows.length > 0) {
+      const idConditions = this.buildIdConditions(mutationModel, result.rows);
+      const postUpdateFilter = this.buildPolicyFilter(mutationModel, void 0, "post-update");
+      const eb = expressionBuilder5();
+      const beforeUpdateTable = beforeUpdateInfo ? {
+        kind: "SelectQueryNode",
+        from: FromNode3.create([
+          ParensNode2.create(ValuesNode.create(beforeUpdateInfo.rows.map((r) => PrimitiveValueListNode.create(beforeUpdateInfo.fields.map((f) => r[f])))))
+        ]),
+        selections: beforeUpdateInfo.fields.map((name, index) => {
+          const def = requireField(this.client.$schema, mutationModel, name);
+          const castedColumnRef = sql11`CAST(${eb.ref(`column${index + 1}`)} as ${sql11.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+          return SelectionNode4.create(castedColumnRef.toOperationNode());
+        })
+      } : void 0;
+      const postUpdateQuery = eb.selectFrom(mutationModel).select(() => [
+        eb(eb.fn("COUNT", [
+          eb.lit(1)
+        ]), "=", result.rows.length).as("$condition")
+      ]).where(() => new ExpressionWrapper(conjunction(this.dialect, [
+        idConditions,
+        postUpdateFilter
+      ]))).$if(!!beforeUpdateInfo, (qb) => qb.leftJoin(() => new ExpressionWrapper(beforeUpdateTable).as("$before"), (join) => {
+        const idFields = requireIdFields(this.client.$schema, mutationModel);
+        return idFields.reduce((acc, f) => acc.onRef(`${mutationModel}.${f}`, "=", `$before.${f}`), join);
+      }));
+      const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
+      if (!postUpdateResult.rows[0]?.$condition) {
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+      }
+    }
     if (!node.returning || this.onlyReturningId(node)) {
-      return result;
+      return this.postProcessMutationResult(result, node);
     } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
@@ -2646,12 +2820,74 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return readBackResult;
     }
   }
+  // correction to kysely mutation result may be needed because we might have added
+  // returning clause to the query and caused changes to the result shape
+  postProcessMutationResult(result, node) {
+    if (node.returning) {
+      return result;
+    } else {
+      return {
+        ...result,
+        rows: [],
+        numAffectedRows: result.numAffectedRows ?? BigInt(result.rows.length)
+      };
+    }
+  }
+  hasPostUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    return policies.length > 0;
+  }
+  async loadBeforeUpdateEntities(model, where, proceed) {
+    const beforeUpdateAccessFields = this.getFieldsAccessForBeforeUpdatePolicies(model);
+    if (!beforeUpdateAccessFields || beforeUpdateAccessFields.length === 0) {
+      return void 0;
+    }
+    const query = {
+      kind: "SelectQueryNode",
+      from: FromNode3.create([
+        TableNode6.create(model)
+      ]),
+      where,
+      selections: [
+        ...beforeUpdateAccessFields.map((f) => SelectionNode4.create(ColumnNode4.create(f)))
+      ]
+    };
+    const result = await proceed(query);
+    return {
+      fields: beforeUpdateAccessFields,
+      rows: result.rows
+    };
+  }
+  getFieldsAccessForBeforeUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    if (policies.length === 0) {
+      return void 0;
+    }
+    const fields = /* @__PURE__ */ new Set();
+    const fieldCollector = new class extends ExpressionVisitor {
+      visitMember(e) {
+        if (isBeforeInvocation(e.receiver)) {
+          invariant14(e.members.length === 1, "before() can only be followed by a scalar field access");
+          fields.add(e.members[0]);
+        }
+        super.visitMember(e);
+      }
+    }();
+    for (const policy of policies) {
+      fieldCollector.visit(policy.condition);
+    }
+    if (fields.size === 0) {
+      return void 0;
+    }
+    requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
+    return Array.from(fields).sort();
+  }
   // #region overrides
   transformSelectQuery(node) {
     let whereNode = this.transformNode(node.where);
     const policyFilter = this.createPolicyFilterForFrom(node.from);
     if (policyFilter) {
-      whereNode = WhereNode2.create(whereNode?.where ? conjunction(this.dialect, [
+      whereNode = WhereNode3.create(whereNode?.where ? conjunction(this.dialect, [
         whereNode.where,
         policyFilter
       ]) : policyFilter);
@@ -2673,17 +2909,17 @@ var PolicyHandler = class extends OperationNodeTransformer {
     const filter = this.buildPolicyFilter(table.model, table.alias, "read");
     const nestedSelect = {
       kind: "SelectQueryNode",
-      from: FromNode2.create([
+      from: FromNode3.create([
         node.table
       ]),
       selections: [
-        SelectionNode2.createSelectAll()
+        SelectionNode4.createSelectAll()
       ],
-      where: WhereNode2.create(filter)
+      where: WhereNode3.create(filter)
     };
     return {
       ...node,
-      table: AliasNode4.create(ParensNode2.create(nestedSelect), IdentifierNode2.create(table.alias ?? table.model))
+      table: AliasNode5.create(ParensNode2.create(nestedSelect), IdentifierNode3.create(table.alias ?? table.model))
     };
   }
   transformInsertQuery(node) {
@@ -2694,7 +2930,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       if (onConflict.updateWhere) {
         onConflict = {
           ...onConflict,
-          updateWhere: WhereNode2.create(conjunction(this.dialect, [
+          updateWhere: WhereNode3.create(conjunction(this.dialect, [
             onConflict.updateWhere.where,
             filter
           ]))
@@ -2702,7 +2938,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       } else {
         onConflict = {
           ...onConflict,
-          updateWhere: WhereNode2.create(filter)
+          updateWhere: WhereNode3.create(filter)
         };
       }
     }
@@ -2711,19 +2947,16 @@ var PolicyHandler = class extends OperationNodeTransformer {
       onConflict
     } : node;
     const result = super.transformInsertQuery(processedNode);
-    if (!node.returning) {
-      return result;
-    }
-    if (this.onlyReturningId(node)) {
-      return result;
-    } else {
+    let returning = result.returning;
+    if (returning) {
       const { mutationModel } = this.getMutationModel(node);
       const idFields = requireIdFields(this.client.$schema, mutationModel);
-      return {
-        ...result,
-        returning: ReturningNode.create(idFields.map((field) => SelectionNode2.create(ColumnNode3.create(field))))
-      };
+      returning = ReturningNode2.create(idFields.map((f) => SelectionNode4.create(ColumnNode4.create(f))));
     }
+    return {
+      ...result,
+      returning
+    };
   }
   transformUpdateQuery(node) {
     const result = super.transformUpdateQuery(node);
@@ -2738,12 +2971,18 @@ var PolicyHandler = class extends OperationNodeTransformer {
         ]);
       }
     }
+    let returning = result.returning;
+    if (returning || this.hasPostUpdatePolicies(mutationModel)) {
+      const idFields = requireIdFields(this.client.$schema, mutationModel);
+      returning = ReturningNode2.create(idFields.map((f) => SelectionNode4.create(ColumnNode4.create(f))));
+    }
     return {
       ...result,
-      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+      where: WhereNode3.create(result.where ? conjunction(this.dialect, [
         result.where.where,
         filter
-      ]) : filter)
+      ]) : filter),
+      returning
     };
   }
   transformDeleteQuery(node) {
@@ -2761,7 +3000,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
     }
     return {
       ...result,
-      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+      where: WhereNode3.create(result.where ? conjunction(this.dialect, [
         result.where.where,
         filter
       ]) : filter)
@@ -2775,6 +3014,14 @@ var PolicyHandler = class extends OperationNodeTransformer {
     }
     const { mutationModel } = this.getMutationModel(node);
     const idFields = requireIdFields(this.client.$schema, mutationModel);
+    if (node.returning.selections.some((s) => SelectAllNode2.is(s.selection))) {
+      const modelDef = requireModel(this.client.$schema, mutationModel);
+      if (Object.keys(modelDef.fields).some((f) => !idFields.includes(f))) {
+        return false;
+      } else {
+        return true;
+      }
+    }
     const collector = new ColumnCollector();
     const selectedColumns = collector.collect(node.returning);
     return selectedColumns.every((c) => idFields.includes(c));
@@ -2794,18 +3041,18 @@ var PolicyHandler = class extends OperationNodeTransformer {
   }
   async enforcePreCreatePolicyForManyToManyJoinTable(tableName, fields, values, proceed) {
     const m2m = this.resolveManyToManyJoinTable(tableName);
-    invariant7(m2m);
-    invariant7(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
+    invariant14(m2m);
+    invariant14(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
     const aIndex = fields.indexOf("A");
     const aNode = values[aIndex];
     const bIndex = fields.indexOf("B");
     const bNode = values[bIndex];
-    invariant7(ValueNode3.is(aNode) && ValueNode3.is(bNode), "A and B values must be ValueNode");
+    invariant14(ValueNode4.is(aNode) && ValueNode4.is(bNode), "A and B values must be ValueNode");
     const aValue = aNode.value;
     const bValue = bNode.value;
-    invariant7(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
-    invariant7(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
-    const eb = expressionBuilder3();
+    invariant14(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
+    invariant14(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
+    const eb = expressionBuilder5();
     const filterA = this.buildPolicyFilter(m2m.firstModel, void 0, "update");
     const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new ExpressionWrapper(filterA).as("$t"));
     const filterB = this.buildPolicyFilter(m2m.secondModel, void 0, "update");
@@ -2813,8 +3060,8 @@ var PolicyHandler = class extends OperationNodeTransformer {
     const queryNode = {
       kind: "SelectQueryNode",
       selections: [
-        SelectionNode2.create(AliasNode4.create(queryA.toOperationNode(), IdentifierNode2.create("$conditionA"))),
-        SelectionNode2.create(AliasNode4.create(queryB.toOperationNode(), IdentifierNode2.create("$conditionB")))
+        SelectionNode4.create(AliasNode5.create(queryA.toOperationNode(), IdentifierNode3.create("$conditionA"))),
+        SelectionNode4.create(AliasNode5.create(queryB.toOperationNode(), IdentifierNode3.create("$conditionB")))
       ]
     };
     const result = await proceed(queryNode);
@@ -2833,34 +3080,34 @@ var PolicyHandler = class extends OperationNodeTransformer {
       if (index >= 0) {
         allValues.push(values[index]);
       } else {
-        allValues.push(ValueNode3.createImmediate(null));
+        allValues.push(ValueNode4.createImmediate(null));
       }
     }
-    const eb = expressionBuilder3();
+    const eb = expressionBuilder5();
     const constTable = {
       kind: "SelectQueryNode",
-      from: FromNode2.create([
-        AliasNode4.create(ParensNode2.create(ValuesNode.create([
+      from: FromNode3.create([
+        AliasNode5.create(ParensNode2.create(ValuesNode.create([
           ValueListNode2.create(allValues)
-        ])), IdentifierNode2.create("$t"))
+        ])), IdentifierNode3.create("$t"))
       ]),
       selections: allFields.map(([name, def], index) => {
-        const castedColumnRef = sql4`CAST(${eb.ref(`column${index + 1}`)} as ${sql4.raw(this.dialect.getFieldSqlType(def))})`.as(name);
-        return SelectionNode2.create(castedColumnRef.toOperationNode());
+        const castedColumnRef = sql11`CAST(${eb.ref(`column${index + 1}`)} as ${sql11.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+        return SelectionNode4.create(castedColumnRef.toOperationNode());
       })
     };
     const filter = this.buildPolicyFilter(model, void 0, "create");
     const preCreateCheck = {
       kind: "SelectQueryNode",
-      from: FromNode2.create([
-        AliasNode4.create(constTable, IdentifierNode2.create(model))
+      from: FromNode3.create([
+        AliasNode5.create(constTable, IdentifierNode3.create(model))
       ]),
       selections: [
-        SelectionNode2.create(AliasNode4.create(BinaryOperationNode3.create(FunctionNode3.create("COUNT", [
-          ValueNode3.createImmediate(1)
-        ]), OperatorNode3.create(">"), ValueNode3.createImmediate(0)), IdentifierNode2.create("$condition")))
+        SelectionNode4.create(AliasNode5.create(BinaryOperationNode3.create(FunctionNode3.create("COUNT", [
+          ValueNode4.createImmediate(1)
+        ]), OperatorNode3.create(">"), ValueNode4.createImmediate(0)), IdentifierNode3.create("$condition")))
       ],
-      where: WhereNode2.create(filter)
+      where: WhereNode3.create(filter)
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
@@ -2879,15 +3126,15 @@ var PolicyHandler = class extends OperationNodeTransformer {
     }
   }
   unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
-    invariant7(data.length === fields.length, "data length must match fields length");
+    invariant14(data.length === fields.length, "data length must match fields length");
     const result = [];
     for (let i = 0; i < data.length; i++) {
       const item = data[i];
       if (typeof item === "object" && item && "kind" in item) {
         const fieldDef = requireField(this.client.$schema, model, fields[i]);
-        invariant7(item.kind === "ValueNode", "expecting a ValueNode");
+        invariant14(item.kind === "ValueNode", "expecting a ValueNode");
         result.push({
-          node: ValueNode3.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
+          node: ValueNode4.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
           raw: item.value
         });
       } else {
@@ -2903,7 +3150,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
           });
         } else {
           result.push({
-            node: ValueNode3.create(value),
+            node: ValueNode4.create(value),
             raw: value
           });
         }
@@ -2944,10 +3191,10 @@ var PolicyHandler = class extends OperationNodeTransformer {
     const policyFilter = this.buildPolicyFilter(mutationModel, void 0, "read");
     const select = {
       kind: "SelectQueryNode",
-      from: FromNode2.create([
-        TableNode4.create(mutationModel)
+      from: FromNode3.create([
+        TableNode6.create(mutationModel)
       ]),
-      where: WhereNode2.create(conjunction(this.dialect, [
+      where: WhereNode3.create(conjunction(this.dialect, [
         idConditions,
         policyFilter
       ])),
@@ -2958,13 +3205,13 @@ var PolicyHandler = class extends OperationNodeTransformer {
   }
   buildIdConditions(table, rows) {
     const idFields = requireIdFields(this.client.$schema, table);
-    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ColumnNode3.create(field), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ReferenceNode5.create(ColumnNode4.create(field), TableNode6.create(table)), OperatorNode3.create("="), ValueNode4.create(row[field]))))));
   }
   getMutationModel(node) {
-    const r = match8(node).when(InsertQueryNode.is, (node2) => ({
+    const r = match19(node).when(InsertQueryNode2.is, (node2) => ({
       mutationModel: getTableName(node2.into),
       alias: void 0
-    })).when(UpdateQueryNode.is, (node2) => {
+    })).when(UpdateQueryNode2.is, (node2) => {
       if (!node2.table) {
         throw new QueryError("Update query must have a table");
       }
@@ -2973,7 +3220,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
         mutationModel: r2.model,
         alias: r2.alias
       } : void 0;
-    }).when(DeleteQueryNode.is, (node2) => {
+    }).when(DeleteQueryNode2.is, (node2) => {
       if (node2.from.froms.length !== 1) {
         throw new QueryError("Only one from table is supported for delete");
       }
@@ -2989,10 +3236,10 @@ var PolicyHandler = class extends OperationNodeTransformer {
     return r;
   }
   isCrudQueryNode(node) {
-    return SelectQueryNode2.is(node) || InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+    return SelectQueryNode2.is(node) || InsertQueryNode2.is(node) || UpdateQueryNode2.is(node) || DeleteQueryNode2.is(node);
   }
   isMutationQueryNode(node) {
-    return InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+    return InsertQueryNode2.is(node) || UpdateQueryNode2.is(node) || DeleteQueryNode2.is(node);
   }
   buildPolicyFilter(model, alias, operation) {
     const m2mFilter = this.getModelPolicyFilterForManyToManyJoinTable(model, alias, operation);
@@ -3000,40 +3247,41 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return m2mFilter;
     }
     const policies = this.getModelPolicies(model, operation);
-    if (policies.length === 0) {
-      return falseNode(this.dialect);
-    }
     const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
     let combinedPolicy;
     if (allows.length === 0) {
-      combinedPolicy = falseNode(this.dialect);
+      if (operation === "post-update") {
+        combinedPolicy = trueNode(this.dialect);
+      } else {
+        combinedPolicy = falseNode(this.dialect);
+      }
     } else {
       combinedPolicy = disjunction(this.dialect, allows);
-      if (denies.length !== 0) {
-        const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
-        combinedPolicy = conjunction(this.dialect, [
-          combinedPolicy,
-          combinedDenies
-        ]);
-      }
+    }
+    if (denies.length !== 0) {
+      const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+      combinedPolicy = conjunction(this.dialect, [
+        combinedPolicy,
+        combinedDenies
+      ]);
     }
     return combinedPolicy;
   }
   extractTableName(node) {
-    if (TableNode4.is(node)) {
+    if (TableNode6.is(node)) {
       return {
         model: node.table.identifier.name
       };
     }
-    if (AliasNode4.is(node)) {
+    if (AliasNode5.is(node)) {
       const inner = this.extractTableName(node.node);
       if (!inner) {
         return void 0;
       }
       return {
         model: inner.model,
-        alias: IdentifierNode2.is(node.alias) ? node.alias.name : void 0
+        alias: IdentifierNode3.is(node.alias) ? node.alias.name : void 0
       };
     } else {
       return void 0;
@@ -3063,16 +3311,15 @@ var PolicyHandler = class extends OperationNodeTransformer {
     return new ExpressionTransformer(this.client).transform(policy.condition, {
       model,
       alias,
-      operation,
-      auth: this.client.$auth
+      operation
     });
   }
   getModelPolicies(model, operation) {
     const modelDef = requireModel(this.client.$schema, model);
     const result = [];
     const extractOperations = /* @__PURE__ */ __name((expr2) => {
-      invariant7(ExpressionUtils.isLiteral(expr2), "expecting a literal");
-      invariant7(typeof expr2.value === "string", "expecting a string literal");
+      invariant14(ExpressionUtils.isLiteral(expr2), "expecting a literal");
+      invariant14(typeof expr2.value === "string", "expecting a string literal");
       return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
     }, "extractOperations");
     if (modelDef.attributes) {
@@ -3080,7 +3327,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
         kind: attr.name === "@@allow" ? "allow" : "deny",
         operations: extractOperations(attr.args[0].value),
         condition: attr.args[1].value
-      })).filter((policy) => policy.operations.includes("all") || policy.operations.includes(operation)));
+      })).filter((policy) => operation !== "post-update" && policy.operations.includes("all") || policy.operations.includes(operation)));
     }
     return result;
   }
@@ -3101,7 +3348,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
           ].sort(this.manyToManySorter);
           const firstIdFields = requireIdFields(this.client.$schema, sortedRecord[0].model);
           const secondIdFields = requireIdFields(this.client.$schema, sortedRecord[1].model);
-          invariant7(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
+          invariant14(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
           return {
             firstModel: sortedRecord[0].model,
             firstField: sortedRecord[0].field,
@@ -3127,7 +3374,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return void 0;
     }
     const checkForOperation = operation === "read" ? "read" : "update";
-    const eb = expressionBuilder3();
+    const eb = expressionBuilder5();
     const joinTable = alias ?? tableName;
     const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
     const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
@@ -3140,18 +3387,18 @@ var PolicyHandler = class extends OperationNodeTransformer {
 
 // src/plugins/policy/functions.ts
 var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, operation }) => {
-  invariant8(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
+  invariant15(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
   const arg1Node = args[0].toOperationNode();
   const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
   if (arg2Node) {
-    invariant8(ValueNode4.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
-    invariant8(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+    invariant15(ValueNode5.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
+    invariant15(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
   }
   const fieldName = extractFieldName(arg1Node);
-  invariant8(fieldName, 'Failed to extract field name from the first argument of "check" function');
+  invariant15(fieldName, 'Failed to extract field name from the first argument of "check" function');
   const fieldDef = requireField(client.$schema, model, fieldName);
-  invariant8(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
-  invariant8(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
+  invariant15(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
+  invariant15(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
   const relationModel = fieldDef.type;
   const op = arg2Node ? arg2Node.value : operation;
   const policyHandler = new PolicyHandler(client);
@@ -3181,18 +3428,9 @@ var PolicyPlugin = class {
       check
     };
   }
-  onKyselyQuery({
-    query,
-    client,
-    proceed
-    /*, transaction*/
-  }) {
+  onKyselyQuery({ query, client, proceed }) {
     const handler = new PolicyHandler(client);
-    return handler.handle(
-      query,
-      proceed
-      /*, transaction*/
-    );
+    return handler.handle(query, proceed);
   }
 };
 export {