kitcn 0.16.1 → 0.17.0

package/dist/orm/index.js

@@ -1,7 +1,7 @@
 import { A as vectorIndex, B as ConvexColumnBuilder, C as RlsPolicy, D as rankIndex, E as index, F as arrayOf, I as custom, L as json, M as createSystemFields, N as integer, O as searchIndex, P as id, R as objectOf, S as TablePolymorphic, T as aggregateIndex, V as entityKind, _ as OrmSchemaRelations, a as deletion, b as TableDeleteConfig, c as Columns, d as OrmSchemaDefinition, f as OrmSchemaExtensionRelations, g as OrmSchemaOptions, h as OrmSchemaExtensions, i as convexTable, j as text, k as uniqueIndex, l as EnableRLS, m as OrmSchemaExtensionTriggers, o as discriminator, p as OrmSchemaExtensionTables, s as Brand, t as DirectAggregate, u as OrmContext, v as OrmSchemaTriggers, w as rlsPolicy, x as TableName, y as RlsPolicies, z as unionOf } from "../runtime-DmVSOe24.js";
 import { a as pretendRequired, i as pretend, n as deprecated } from "../validators-C7LelqTN.js";
-import { A as ne, C as inArray, D as like, E as isNull, F as notLike, I as or, L as startsWith, M as notBetween, N as notIlike, O as lt, P as notInArray, S as ilike, T as isNotNull, _ as endsWith, a as mergedStream, b as gt, c as isUnsetToken, d as arrayContained, f as arrayContains, g as contains, h as column, i as getIndexFields, j as not, k as lte, l as unsetToken, m as between, n as EmptyStream, o as stream, p as arrayOverlaps, r as QueryStream, s as streamIndexRange, t as getByIdWithOrmQueryFallback, u as and, v as eq, w as isFieldReference, x as gte, y as fieldRef } from "../query-context-B47_3n97.js";
-import { v } from "convex/values";
+import { A as like, B as or, C as gt, D as isFieldReference, E as inArray, F as not, I as notBetween, L as notIlike, M as lte, N as matchLikePattern, O as isNotNull, P as ne, R as notInArray, S as filterValuesEqual, T as ilike, V as startsWith, _ as contains, a as indexKeyWithinBounds, b as fieldRef, c as streamIndexRange, d as and, f as arrayContained, g as column, h as between, i as getIndexFields, j as lt, k as isNull, l as isUnsetToken, m as arrayOverlaps, n as EmptyStream, o as mergedStream, p as arrayContains, r as QueryStream, s as stream, t as getByIdWithOrmQueryFallback, u as unsetToken, v as endsWith, w as gte, x as filterValueInList, y as eq, z as notLike } from "../query-context-C90vNlc9.js";
+import { compareValues, v } from "convex/values";
 import { defineSchema as defineSchema$1, internalActionGeneric, internalMutationGeneric } from "convex/server";
 
 //#region src/orm/builders/bigint.ts
@@ -1188,23 +1188,7 @@ function splitReturningSelection(fields) {
 		countSelection
 	};
 }
-function matchLike(value, pattern, caseInsensitive) {
-	const targetValue = caseInsensitive ? value.toLowerCase() : value;
-	const targetPattern = caseInsensitive ? pattern.toLowerCase() : pattern;
-	if (targetPattern.startsWith("%") && targetPattern.endsWith("%")) {
-		const substring = targetPattern.slice(1, -1);
-		return targetValue.includes(substring);
-	}
-	if (targetPattern.startsWith("%")) {
-		const suffix = targetPattern.slice(1);
-		return targetValue.endsWith(suffix);
-	}
-	if (targetPattern.endsWith("%")) {
-		const prefix = targetPattern.slice(0, -1);
-		return targetValue.startsWith(prefix);
-	}
-	return targetValue === targetPattern;
-}
+const matchLike = matchLikePattern;
 function evaluateFilter(row, filter) {
 	if (filter.type === "binary") {
 		const [field, value] = filter.operands;
@@ -1240,14 +1224,14 @@ function evaluateFilter(row, filter) {
 			case "contains":
 				if (typeof fieldValue !== "string") return false;
 				return fieldValue.includes(value);
-			case "eq": return fieldValue === value;
-			case "ne": return fieldValue !== value;
+			case "eq": return filterValuesEqual(fieldValue, value);
+			case "ne": return !filterValuesEqual(fieldValue, value);
 			case "gt": return fieldValue > value;
 			case "gte": return fieldValue >= value;
 			case "lt": return fieldValue < value;
 			case "lte": return fieldValue <= value;
-			case "inArray": return value.includes(fieldValue);
-			case "notInArray": return !value.includes(fieldValue);
+			case "inArray": return filterValueInList(fieldValue, value);
+			case "notInArray": return !filterValueInList(fieldValue, value);
 			case "arrayContains":
 				if (!Array.isArray(fieldValue)) return false;
 				return value.every((item) => fieldValue.includes(item));
@@ -1335,12 +1319,14 @@ function evaluateCheckConstraintTriState(row, filter) {
 			case "inArray": {
 				const arr = compareValue;
 				if (!Array.isArray(arr)) return false;
-				return arr.includes(fieldValue);
+				if (arr.includes(fieldValue)) return true;
+				return arr.some(nullish) ? "unknown" : false;
 			}
 			case "notInArray": {
 				const arr = compareValue;
 				if (!Array.isArray(arr)) return false;
-				return !arr.includes(fieldValue);
+				if (arr.includes(fieldValue)) return false;
+				return arr.some(nullish) ? "unknown" : true;
 			}
 			case "arrayContains": {
 				if (!Array.isArray(fieldValue)) return false;
@@ -3629,6 +3615,17 @@ function policyApplies(policy, operation) {
 	const target = policy.for ?? "all";
 	return target === "all" || target === operation;
 }
+/**
+* SQL pseudo-roles always resolve to the calling user, so they apply to every
+* caller and never need a role resolver. Only `rlsRole()` values and bare role
+* names are matched against resolved roles.
+*/
+const PSEUDO_ROLES = new Set([
+	"public",
+	"current_role",
+	"current_user",
+	"session_user"
+]);
 function flattenRoles(target) {
 	if (!target) return "public";
 	const roles = [];
@@ -3638,7 +3635,7 @@ function flattenRoles(target) {
 			value.forEach(visit);
 			return;
 		}
-		if (value === "public") {
+		if (typeof value === "string" && PSEUDO_ROLES.has(value)) {
 			hasPublic = true;
 			return;
 		}
@@ -3651,14 +3648,42 @@ function flattenRoles(target) {
 	visit(target);
 	return hasPublic ? "public" : roles;
 }
+function roleResolverRequiredError(policy, table, targetRoles) {
+	const roleList = targetRoles.map((role) => `'${role}'`).join(", ");
+	return /* @__PURE__ */ new Error(`RLS_ROLE_RESOLVER_REQUIRED: policy '${policy.name}' on table '${getTableName(table)}' targets role(s) ${roleList}, but no 'roleResolver' is configured. Pass 'rls.roleResolver' when creating the ORM database, or remove the policy's 'to' clause.`);
+}
+/**
+* A named-role policy cannot be evaluated without a role resolver. Validate
+* that from the table's policy set alone so the failure depends only on
+* configuration, never on whether the table currently holds matching rows.
+*/
+function assertRlsRolesResolvable(options) {
+	const { table, operation, rls } = options;
+	if (!isRlsEnabled(table)) return;
+	if (rls?.mode === "skip") return;
+	if (rls?.roleResolver) return;
+	for (const policy of getRlsPolicies(table)) {
+		if (!policyApplies(policy, operation)) continue;
+		const targetRoles = flattenRoles(policy.to);
+		if (targetRoles === "public") continue;
+		throw roleResolverRequiredError(policy, table, targetRoles);
+	}
+}
 function roleMatches(policy, rls) {
-	const resolver = rls?.roleResolver;
-	if (!resolver) return true;
-	const roles = resolver(rls?.ctx ?? {}) ?? [];
 	const targetRoles = flattenRoles(policy.to);
 	if (targetRoles === "public") return true;
+	const resolver = rls?.roleResolver;
+	const roles = resolver ? resolver(rls?.ctx ?? {}) ?? [] : [];
 	return targetRoles.some((role) => roles.includes(role));
 }
+/**
+* Policy expressions follow SQL RLS semantics: an expression that evaluates to
+* NULL/unknown is treated as false. A nullish document field or a nullish
+* context value therefore never satisfies a policy.
+*/
+function policyExpressionPasses(row, expression) {
+	return evaluateCheckConstraintTriState(row, expression) === true;
+}
 async function resolveExpression(policy, checkType, ctx, table) {
 	const candidate = checkType === "withCheck" ? policy.withCheck ?? policy.using : policy.using;
 	if (!candidate) return;
@@ -3668,6 +3693,11 @@ async function resolveExpression(policy, checkType, ctx, table) {
 async function evaluatePolicySet({ table, operation, checkType, row, rls }) {
 	if (!isRlsEnabled(table)) return true;
 	if (rls?.mode === "skip") return true;
+	assertRlsRolesResolvable({
+		table,
+		operation,
+		rls
+	});
 	const ctx = rls?.ctx ?? {};
 	const policies = getRlsPolicies(table).filter((policy) => policyApplies(policy, operation) && roleMatches(policy, rls));
 	if (policies.length === 0) return false;
@@ -3676,7 +3706,7 @@ async function evaluatePolicySet({ table, operation, checkType, row, rls }) {
 	let permissivePasses = false;
 	for (const policy of permissive) {
 		const expression = await resolveExpression(policy, checkType, ctx, table);
-		if (!expression || evaluateFilter(row, expression)) {
+		if (!expression || policyExpressionPasses(row, expression)) {
 			permissivePasses = true;
 			break;
 		}
@@ -3686,7 +3716,7 @@ async function evaluatePolicySet({ table, operation, checkType, row, rls }) {
 	for (const policy of restrictive) {
 		const expression = await resolveExpression(policy, checkType, ctx, table);
 		if (!expression) continue;
-		if (!evaluateFilter(row, expression)) return false;
+		if (!policyExpressionPasses(row, expression)) return false;
 	}
 	return true;
 }
@@ -3741,6 +3771,11 @@ async function evaluateUpdateDecision(options) {
 async function filterSelectRows(options) {
 	if (!isRlsEnabled(options.table)) return options.rows;
 	if (options.rls?.mode === "skip") return options.rows;
+	assertRlsRolesResolvable({
+		table: options.table,
+		operation: "select",
+		rls: options.rls
+	});
 	const rows = [];
 	for (const row of options.rows) if (await canSelectRow({
 		table: options.table,
@@ -4283,37 +4318,90 @@ const RELATION_COUNT_ERROR = {
 	NOT_INDEXED: "RELATION_COUNT_NOT_INDEXED",
 	FILTER_UNSUPPORTED: "RELATION_COUNT_FILTER_UNSUPPORTED"
 };
-var LimitedQueryStream = class LimitedQueryStream extends QueryStream {
-	constructor(inner, limit) {
+/**
+* Replays an already-read run of `[doc | null, indexKey]` entries.
+*
+* `narrow()` filters the buffer instead of re-issuing the read, so a stream
+* that had to be consumed to be sized is not consumed twice.
+*/
+var BufferedQueryStream = class BufferedQueryStream extends QueryStream {
+	constructor(entries, order, indexFields, equalityIndexFilter) {
 		super();
-		this.inner = inner;
-		this.limit = limit;
+		this.entries = entries;
+		this.order = order;
+		this.indexFields = indexFields;
+		this.equalityIndexFilter = equalityIndexFilter;
 	}
 	iterWithKeys() {
-		const iterable = this.inner.iterWithKeys();
-		const max = this.limit;
+		const entries = this.entries;
 		return { [Symbol.asyncIterator]() {
-			const iterator = iterable[Symbol.asyncIterator]();
-			let seen = 0;
-			return { async next() {
-				if (seen >= max) return {
+			let index = 0;
+			return { next() {
+				if (index >= entries.length) return Promise.resolve({
 					done: true,
 					value: void 0
-				};
-				const next = await iterator.next();
-				if (!next.done) seen += 1;
-				return next;
+				});
+				const value = entries[index];
+				index += 1;
+				return Promise.resolve({
+					done: false,
+					value
+				});
 			} };
 		} };
 	}
 	narrow(indexBounds) {
-		return new LimitedQueryStream(this.inner.narrow(indexBounds), this.limit);
+		return new BufferedQueryStream(this.entries.filter(([, indexKey]) => indexKeyWithinBounds(indexKey, indexBounds)), this.order, this.indexFields, this.equalityIndexFilter);
+	}
+	getOrder() {
+		return this.order;
+	}
+	getIndexFields() {
+		return this.indexFields;
+	}
+	getEqualityIndexFilter() {
+		return this.equalityIndexFilter;
+	}
+};
+const PIPELINE_LIMIT_ORDINAL_FIELD = "__kitcn_limit_ordinal";
+/** Cap a stream at its first `limit` matching documents without eager reads. */
+var LimitedMatchesQueryStream = class LimitedMatchesQueryStream extends QueryStream {
+	constructor(inner, limit, priorMatches = 0) {
+		super();
+		this.inner = inner;
+		this.limit = limit;
+		this.priorMatches = priorMatches;
+	}
+	iterWithKeys() {
+		const inner = this.inner;
+		const limit = this.limit;
+		const priorMatches = this.priorMatches;
+		return { async *[Symbol.asyncIterator]() {
+			let matched = priorMatches;
+			if (matched >= limit) return;
+			for await (const [doc, indexKey] of inner.iterWithKeys()) {
+				if (doc !== null) matched += 1;
+				yield [doc, [...indexKey, matched]];
+				if (matched >= limit) return;
+			}
+		} };
+	}
+	narrow(indexBounds) {
+		const innerFieldCount = this.inner.getIndexFields().length;
+		const ordinal = (this.getOrder() === "asc" ? indexBounds.lowerBound : indexBounds.upperBound)[innerFieldCount];
+		const priorMatches = typeof ordinal === "number" && Number.isInteger(ordinal) && ordinal >= 0 ? Math.max(this.priorMatches, ordinal) : this.priorMatches;
+		return new LimitedMatchesQueryStream(this.inner.narrow({
+			lowerBound: indexBounds.lowerBound.slice(0, innerFieldCount),
+			lowerBoundInclusive: indexBounds.lowerBoundInclusive,
+			upperBound: indexBounds.upperBound.slice(0, innerFieldCount),
+			upperBoundInclusive: indexBounds.upperBoundInclusive
+		}), this.limit, priorMatches);
 	}
 	getOrder() {
 		return this.inner.getOrder();
 	}
 	getIndexFields() {
-		return this.inner.getIndexFields();
+		return [...this.inner.getIndexFields(), PIPELINE_LIMIT_ORDINAL_FIELD];
 	}
 	getEqualityIndexFilter() {
 		return this.inner.getEqualityIndexFilter();
@@ -4468,7 +4556,7 @@ var GelRelationalQuery = class extends QueryPromise {
 		return first ?? null;
 	}
 	async _applyRlsSelectFilter(rows, tableConfig) {
-		if (!rows.length || !tableConfig) return rows;
+		if (!tableConfig) return rows;
 		return await filterSelectRows({
 			table: tableConfig.table,
 			rows,
@@ -4532,21 +4620,7 @@ var GelRelationalQuery = class extends QueryPromise {
 		return Object.values(this.schema).find((table) => table.name === dbName);
 	}
 	_matchLike(value, pattern, caseInsensitive) {
-		const targetValue = caseInsensitive ? value.toLowerCase() : value;
-		const targetPattern = caseInsensitive ? pattern.toLowerCase() : pattern;
-		if (targetPattern.startsWith("%") && targetPattern.endsWith("%")) {
-			const substring = targetPattern.slice(1, -1);
-			return targetValue.includes(substring);
-		}
-		if (targetPattern.startsWith("%")) {
-			const suffix = targetPattern.slice(1);
-			return targetValue.endsWith(suffix);
-		}
-		if (targetPattern.endsWith("%")) {
-			const prefix = targetPattern.slice(0, -1);
-			return targetValue.startsWith(prefix);
-		}
-		return targetValue === targetPattern;
+		return matchLikePattern(value, pattern, caseInsensitive);
 	}
 	/**
 	* True when the expression can be fully enforced by Convex's own `.filter()`.
@@ -4612,14 +4686,14 @@ var GelRelationalQuery = class extends QueryPromise {
 				case "contains":
 					if (typeof fieldValue !== "string") return false;
 					return fieldValue.includes(normalizedValue);
-				case "eq": return fieldValue === normalizedValue;
-				case "ne": return fieldValue !== normalizedValue;
+				case "eq": return filterValuesEqual(fieldValue, normalizedValue);
+				case "ne": return !filterValuesEqual(fieldValue, normalizedValue);
 				case "gt": return fieldValue > comparableValue;
 				case "gte": return fieldValue >= comparableValue;
 				case "lt": return fieldValue < comparableValue;
 				case "lte": return fieldValue <= comparableValue;
-				case "inArray": return normalizedValue.includes(fieldValue);
-				case "notInArray": return !normalizedValue.includes(fieldValue);
+				case "inArray": return filterValueInList(fieldValue, normalizedValue);
+				case "notInArray": return !filterValueInList(fieldValue, normalizedValue);
 				case "arrayContains":
 					if (!Array.isArray(fieldValue)) return false;
 					return normalizedValue.every((item) => fieldValue.includes(item));
@@ -4667,8 +4741,8 @@ var GelRelationalQuery = class extends QueryPromise {
 		if (this._isPlaceholder(filter) || this._isSQLWrapper(filter)) throw new Error("SQL placeholders are not supported in Convex filters.");
 		if (filter instanceof Date) return fieldValue === filter.getTime();
 		if (filter === null || typeof filter !== "object" || Array.isArray(filter)) {
-			if (fieldName) return fieldValue === this._normalizeComparableValue(fieldName, filter);
-			return fieldValue === filter;
+			if (fieldName) return filterValuesEqual(fieldValue, this._normalizeComparableValue(fieldName, filter));
+			return filterValuesEqual(fieldValue, filter);
 		}
 		const entries = Object.entries(filter);
 		if (!entries.length) return true;
@@ -4701,7 +4775,7 @@ var GelRelationalQuery = class extends QueryPromise {
 						continue;
 					}
 					const normalized = fieldName ? this._normalizeComparableValue(fieldName, value) : value;
-					results.push(normalized.includes(fieldValue));
+					results.push(filterValueInList(fieldValue, normalized));
 					continue;
 				}
 				case "notIn": {
@@ -4710,7 +4784,7 @@ var GelRelationalQuery = class extends QueryPromise {
 						continue;
 					}
 					const normalized = fieldName ? this._normalizeComparableValue(fieldName, value) : value;
-					results.push(!normalized.includes(fieldValue));
+					results.push(!filterValueInList(fieldValue, normalized));
 					continue;
 				}
 				case "arrayContains":
@@ -4784,10 +4858,10 @@ var GelRelationalQuery = class extends QueryPromise {
 					results.push(fieldValue.includes(value));
 					continue;
 				case "eq":
-					results.push(fieldValue === (fieldName ? this._normalizeComparableValue(fieldName, value) : value));
+					results.push(filterValuesEqual(fieldValue, fieldName ? this._normalizeComparableValue(fieldName, value) : value));
 					continue;
 				case "ne":
-					results.push(fieldValue !== (fieldName ? this._normalizeComparableValue(fieldName, value) : value));
+					results.push(!filterValuesEqual(fieldValue, fieldName ? this._normalizeComparableValue(fieldName, value) : value));
 					continue;
 				case "gt":
 					results.push(fieldValue > (fieldName ? this._normalizeComparableValue(fieldName, value) : value));
@@ -5255,6 +5329,67 @@ var GelRelationalQuery = class extends QueryPromise {
 			row[config.alias] = nested;
 		}
 	}
+	/**
+	* Validate role-scoped policies for every table this read plan touches before
+	* relations are loaded. Relation loaders skip work when a parent page is
+	* empty, so per-row evaluation alone would make a misconfigured table fail
+	* only once it holds rows. Mirrors the `_loadRelations` depth budget so the
+	* plan walked here matches the plan that would be executed.
+	*/
+	_assertRlsSelectPlan(withConfig, tableConfig, edges, depth, maxDepth) {
+		assertRlsRolesResolvable({
+			table: tableConfig.table,
+			operation: "select",
+			rls: this.rls
+		});
+		if (!withConfig || depth >= maxDepth) return;
+		for (const [relationName, relationConfig] of Object.entries(withConfig)) {
+			if (relationName === "_count") {
+				this._assertRelationCountRlsPlan(relationConfig, edges);
+				continue;
+			}
+			const edge = edges.find((entry) => entry.edgeName === relationName);
+			if (!edge) continue;
+			if (edge.through) {
+				const throughTableConfig = this._getTableConfigByDbName(edge.through.table);
+				if (throughTableConfig) assertRlsRolesResolvable({
+					table: throughTableConfig.table,
+					operation: "select",
+					rls: this.rls
+				});
+			}
+			const targetTableConfig = this._getTableConfigByDbName(edge.targetTable);
+			if (!targetTableConfig) continue;
+			let nestedWith;
+			if (relationConfig && typeof relationConfig === "object") {
+				const configuredWith = relationConfig.with;
+				if (this._isRecord(configuredWith)) nestedWith = { ...configuredWith };
+				const relationWhere = relationConfig.where;
+				if (relationWhere && typeof relationWhere !== "function") {
+					const filterWith = this._buildFilterWithConfig(relationWhere, targetTableConfig);
+					if (Object.keys(filterWith).length > 0) if (nestedWith) this._mergeWithConfig(nestedWith, filterWith);
+					else nestedWith = filterWith;
+				}
+			}
+			this._assertRlsSelectPlan(nestedWith, targetTableConfig, this._getTargetTableEdges(edge.targetTable), depth + 1, maxDepth);
+		}
+	}
+	_assertRelationCountRlsPlan(relationCountConfig, edges) {
+		if (!this._isRecord(relationCountConfig)) return;
+		for (const [relationName, relationSelection] of Object.entries(relationCountConfig)) {
+			if (relationSelection === void 0 || relationSelection === false) continue;
+			const edge = edges.find((entry) => entry.edgeName === relationName);
+			if (!edge) continue;
+			const where = this._coerceRelationCountWhere(relationName, relationSelection);
+			if (edge.through) {
+				const throughTableConfig = this._getTableConfigByDbName(edge.through.table);
+				if (throughTableConfig) ensureCountAllowedForRls(throughTableConfig, this.rls?.mode);
+				if (this._isEmptyWhere(where) || where === void 0) continue;
+			}
+			const targetTableConfig = this._getTableConfigByDbName(edge.targetTable);
+			if (targetTableConfig) ensureCountAllowedForRls(targetTableConfig, this.rls?.mode);
+		}
+	}
 	async _finalizeRows(rows) {
 		const polymorphicState = this._resolvePolymorphicFinalizeState();
 		const requestedWith = this.config.with;
@@ -5263,6 +5398,7 @@ var GelRelationalQuery = class extends QueryPromise {
 		const extrasConfig = this.config.extras;
 		const resolvedExtras = typeof extrasConfig === "function" ? extrasConfig(tableColumns) : extrasConfig;
 		if (polymorphicState) this._assertPolymorphicAliasCollisions(polymorphicState.configs, requestedWith, resolvedExtras);
+		this._assertRlsSelectPlan(effectiveWith, this.tableConfig, this.edgeMetadata, 0, 3);
 		let rowsWithRelations = rows;
 		if (effectiveWith) rowsWithRelations = await this._loadRelations(rowsWithRelations, effectiveWith, 0, 3, this.edgeMetadata, this.tableConfig);
 		if (polymorphicState) this._synthesizePolymorphicRows(rowsWithRelations, polymorphicState.configs);
@@ -5357,6 +5493,33 @@ var GelRelationalQuery = class extends QueryPromise {
 		}
 		throw new Error(`${context} where callback must return a filter expression or predicate(...).`);
 	}
+	/**
+	* Read an id-only `where` through the primary key instead of scanning for it.
+	*
+	* The where-clause compiler is built from declared indexes only, and `_id` is
+	* never one of them, so an `id` filter can never be index-selected: it lands
+	* in the post-filters and the stream walks the creation-time index until it
+	* happens on the row. `db.get()` reads exactly the rows asked for, so the ids
+	* are fetched directly and replayed as a creation-time-ordered stream — the
+	* order the scan would have produced, so stage order and cursors are the same.
+	*
+	* Returns null when something else already owns the read: a pinned index, an
+	* index the compiler did select, a `where(predicate)`, or an `orderBy` that
+	* walks a different index.
+	*/
+	async _buildIdLookupStream(params) {
+		const { configuredIndex, idLookup, order, queryConfig, wherePredicate } = params;
+		if (!idLookup || wherePredicate || configuredIndex?.name || queryConfig.index) return null;
+		const primaryOrder = queryConfig.order?.[0];
+		if (primaryOrder && primaryOrder.field !== INTERNAL_CREATION_TIME_FIELD) return null;
+		const ids = idLookup.kind === "in" ? Array.from(new Map(idLookup.ids.map((id) => [String(id), id])).values()) : [idLookup.id];
+		const rows = (await this._mapWithConcurrency(ids, async (id) => {
+			return this._getById(this.tableConfig.name, id);
+		})).filter((row) => !!row);
+		rows.sort((a, b) => compareValues(a[INTERNAL_CREATION_TIME_FIELD], b[INTERNAL_CREATION_TIME_FIELD]) || compareValues(a[INTERNAL_ID_FIELD], b[INTERNAL_ID_FIELD]));
+		if (order === "desc") rows.reverse();
+		return new BufferedQueryStream(rows.map((row) => [row, [row[INTERNAL_CREATION_TIME_FIELD], row[INTERNAL_ID_FIELD]]]), order, [INTERNAL_CREATION_TIME_FIELD, INTERNAL_ID_FIELD], []);
+	}
 	_buildBasePipelineStream(queryConfig, wherePredicate, configuredIndex) {
 		const schemaDefinition = this._getSchemaDefinitionOrThrow();
 		let streamQuery = stream(this.db, schemaDefinition).query(this.tableConfig.name);
@@ -5437,11 +5600,18 @@ var GelRelationalQuery = class extends QueryPromise {
 		const targetFields = edge.cardinality === "one" ? edge.targetFields.length > 0 ? edge.targetFields : ["_id"] : edge.targetFields.length > 0 ? edge.targetFields : [edge.fieldName];
 		const targetTableConfig = this._getTableConfigByDbName(edge.targetTable);
 		if (!targetTableConfig) throw new Error(`Pipeline flatMap target table '${edge.targetTable}' not found.`);
+		assertRlsRolesResolvable({
+			table: targetTableConfig.table,
+			operation: "select",
+			rls: this.rls
+		});
 		const strict = this.tableConfig.strict !== false;
 		const indexName = targetFields.length === 1 && targetFields[0] === "_id" ? "by_id" : findRelationIndex(targetTableConfig.table, targetFields, `${this.tableConfig.name}.${relationName}`, edge.targetTable, strict, this.allowFullScan);
 		const outerOrder = sourceStream.getOrder();
 		const schemaDefinition = this._getSchemaDefinitionOrThrow();
 		const innerIndexFields = getIndexFields(edge.targetTable, indexName ?? "by_creation_time" ?? "by_creation_time", schemaDefinition);
+		if (stage.limit !== void 0 && (!Number.isInteger(stage.limit) || stage.limit < 1)) throw new Error("pipeline.flatMap.limit must be a positive integer");
+		const mappedIndexFields = stage.limit === void 0 ? innerIndexFields : [...innerIndexFields, PIPELINE_LIMIT_ORDINAL_FIELD];
 		const stageWherePredicate = this._buildTableFilterPredicate(stage.where, targetTableConfig);
 		this._assertWhereIndexRequirement({
 			where: stage.where,
@@ -5451,21 +5621,21 @@ var GelRelationalQuery = class extends QueryPromise {
 		});
 		return sourceStream.flatMap(async (parent) => {
 			const values = sourceFields.map((field) => parent[field]);
-			if (values.some((value) => value === null || value === void 0)) return new EmptyStream(outerOrder, innerIndexFields);
+			if (values.some((value) => value === null || value === void 0)) return new EmptyStream(outerOrder, mappedIndexFields);
 			let inner = stream(this.db, schemaDefinition).query(edge.targetTable);
 			if (indexName) inner = inner.withIndex(indexName, (q) => this._applyEqBounds(q, targetFields, values));
 			inner = inner.order(outerOrder);
 			if (stageWherePredicate) inner = inner.filterWith(stageWherePredicate);
-			if (stage.limit !== void 0) {
-				if (!Number.isInteger(stage.limit) || stage.limit < 1) throw new Error("pipeline.flatMap.limit must be a positive integer");
-				inner = new LimitedQueryStream(inner, stage.limit);
-			}
+			if (isRlsEnabled(targetTableConfig.table)) inner = inner.filterWith(async (row) => {
+				return (await this._applyRlsSelectFilter([row], targetTableConfig)).length === 1;
+			});
+			if (stage.limit !== void 0) inner = new LimitedMatchesQueryStream(inner, stage.limit);
 			if (stage.includeParent ?? true) inner = inner.map(async (child) => ({
 				parent,
 				child
 			}));
 			return inner;
-		}, innerIndexFields);
+		}, mappedIndexFields);
 	}
 	async _applyPipelineStages(baseStream, pipeline) {
 		let streamQuery = baseStream;
@@ -6451,8 +6621,11 @@ var GelRelationalQuery = class extends QueryPromise {
 			if (vectorSearchConfig) throw new Error("pageByKey cannot be combined with vectorSearch.");
 			if (pipeline) throw new Error("pageByKey cannot be combined with pipeline.");
 		}
+		const preflightWith = this._resolveWithVariantsState(config.with, this._resolvePolymorphicFinalizeState()).effectiveWith;
+		this._assertRlsSelectPlan(preflightWith, this.tableConfig, this.edgeMetadata, 0, 3);
+		if (whereFilter) this._assertRlsSelectPlan(this._buildFilterWithConfig(whereFilter, this.tableConfig), this.tableConfig, this.edgeMetadata, 0, 3);
 		const idLookup = this._extractIdOnlyWhere(whereFilter);
-		if (idLookup && !vectorSearchConfig && !searchConfig && !wherePredicate && !isCursorPaginated && configuredIndex === void 0) {
+		if (idLookup && !vectorSearchConfig && !searchConfig && !wherePredicate && !isCursorPaginated && !pipeline && !pageByKey && endCursor === void 0 && configuredIndex === void 0) {
 			const orderSpecs = this._orderBySpecs(config.orderBy);
 			const offset = config.offset ?? 0;
 			if (offset !== void 0 && typeof offset !== "number") throw new Error("Only numeric offset is supported in kitcn ORM.");
@@ -6467,7 +6640,7 @@ var GelRelationalQuery = class extends QueryPromise {
 			const selectedRows = await this._finalizeRows(rows);
 			return this._returnSelectedRows(selectedRows);
 		}
-		const queryConfig = this._toConvexQuery(whereExpressionFromCallback);
+		const queryConfig = this._toConvexQuery(whereExpressionFromCallback, configuredIndex);
 		if (!searchConfig && !vectorSearchConfig && wherePredicate !== void 0 && !configuredIndex?.name) throw new Error("This where() with predicate(...) requires .withIndex(name, range?). Add .withIndex(...) before findMany/findFirst.");
 		if (pageByKey) {
 			const schemaDefinition = this._getSchemaDefinitionOrThrow();
@@ -6505,7 +6678,23 @@ var GelRelationalQuery = class extends QueryPromise {
 					if (!pipeline?.interleaveBy || pipeline.interleaveBy.length === 0) throw new Error("pipeline.interleaveBy is required when pipeline.union has multiple sources.");
 					streamQuery = mergedStream(streams, pipeline.interleaveBy.map((field) => this._normalizePublicFieldName(field)));
 				}
-			} else streamQuery = this._buildBasePipelineStream(queryConfig, wherePredicate, configuredIndex);
+			} else {
+				if (isCursorPaginated && maxScan !== void 0 && idLookup?.kind === "in") throw new Error("An id IN pipeline cannot use maxScan because creation-order replay requires reading the complete ID list.");
+				streamQuery = await this._buildIdLookupStream({
+					configuredIndex,
+					idLookup,
+					order: fallbackOrder,
+					queryConfig,
+					wherePredicate
+				}) ?? this._buildBasePipelineStream(queryConfig, wherePredicate, configuredIndex);
+			}
+			const rootRlsEnabled = isRlsEnabled(this.tableConfig.table);
+			if (rootRlsEnabled) {
+				await this._applyRlsSelectFilter([], this.tableConfig);
+				streamQuery = streamQuery.filterWith(async (row) => {
+					return (await this._applyRlsSelectFilter([row], this.tableConfig)).length === 1;
+				});
+			}
 			if (pipeline) streamQuery = await this._applyPipelineStages(streamQuery, pipeline);
 			if (isCursorPaginated) {
 				const paginationResult = await streamQuery.paginate({
@@ -6515,7 +6704,7 @@ var GelRelationalQuery = class extends QueryPromise {
 					maxScan
 				});
 				return {
-					page: await this._finalizeRows(await this._applyRlsSelectFilter(paginationResult.page, this.tableConfig)),
+					page: await this._finalizeRows(rootRlsEnabled ? paginationResult.page : await this._applyRlsSelectFilter(paginationResult.page, this.tableConfig)),
 					continueCursor: paginationResult.continueCursor,
 					isDone: paginationResult.isDone,
 					pageStatus: paginationResult.pageStatus,
@@ -6527,7 +6716,7 @@ var GelRelationalQuery = class extends QueryPromise {
 			const limit = this._resolveNonPaginatedLimit(config);
 			let rows = limit === void 0 ? await streamQuery.collect() : await streamQuery.take(offset > 0 ? offset + limit : limit);
 			if (offset > 0) rows = rows.slice(offset);
-			rows = await this._applyRlsSelectFilter(rows, this.tableConfig);
+			if (!rootRlsEnabled) rows = await this._applyRlsSelectFilter(rows, this.tableConfig);
 			const selectedRows = await this._finalizeRows(rows);
 			return this._returnSelectedRows(selectedRows);
 		}
@@ -6633,7 +6822,7 @@ var GelRelationalQuery = class extends QueryPromise {
 			const orderField = primaryOrder.field;
 			if (orderField === "_creationTime") query = query.order(primaryOrder.direction);
 			else {
-				const orderIndex = getIndexes(this.tableConfig.table).find((idx) => idx.fields.includes(orderField)) ?? this.edgeMetadata.find((idx) => idx.indexFields.includes(orderField));
+				const orderIndex = getIndexes(this.tableConfig.table).find((idx) => idx.fields[0] === orderField) ?? this.edgeMetadata.find((idx) => idx.indexFields[0] === orderField);
 				if (orderIndex) {
 					orderIndexName = "indexName" in orderIndex ? orderIndex.indexName : orderIndex.name;
 					query = query.withIndex(orderIndexName, (q) => q);
@@ -6715,7 +6904,7 @@ var GelRelationalQuery = class extends QueryPromise {
 			if (queryConfig.postFilters.length > 0) rows = rows.filter((row) => queryConfig.postFilters.every((filter) => this._evaluatePostFetchFilter(row, filter)));
 			rows = await this._applyRlsSelectFilter(rows, this.tableConfig);
 			if (whereFilter) rows = await this._applyRelationsFilterToRows(rows, this.tableConfig, whereFilter, this.edgeMetadata, 0, 3, this.config.with);
-			if (usePostFetchSort && postFetchOrders.length > 0) rows = rows.sort((a, b) => this._compareByOrderSpecs(a, b, postFetchOrders));
+			if (postFetchOrders.length > 0) rows = rows.sort((a, b) => this._compareByOrderSpecs(a, b, postFetchOrders));
 			const offset = config.offset ?? 0;
 			if (typeof offset !== "number") throw new Error("Only numeric offset is supported in kitcn ORM.");
 			const limit = this._resolveNonPaginatedLimit(config);
@@ -6769,6 +6958,7 @@ var GelRelationalQuery = class extends QueryPromise {
 				const schemaDefinition = this.schema[OrmSchemaDefinition];
 				if (!schemaDefinition) throw new Error("Pagination with maxScan requires defineSchema(). Ensure defineSchema(tables) was used with the same tables object passed to defineRelations.");
 				let streamQuery = stream(this.db, schemaDefinition).query(this.tableConfig.name);
+				if (configuredIndex?.name) streamQuery = streamQuery.withIndex(configuredIndex.name, configuredIndex.range ? configuredIndex.range : (q) => q);
 				if (queryConfig.order && primaryOrder) {
 					if (needsPostFetchSortForPrimary) {
 						if (strict) throw new Error(`Pagination: Field '${primaryOrder.field}' has no index. Add an index or disable strict.`);
@@ -6903,7 +7093,7 @@ var GelRelationalQuery = class extends QueryPromise {
 	* Convert query config to Convex query parameters
 	* Phase 4 implementation with WhereClauseCompiler
 	*/
-	_toConvexQuery(whereExpressionOverride) {
+	_toConvexQuery(whereExpressionOverride, configuredIndex) {
 		const config = this.config;
 		const tableIndexes = getIndexes(this.tableConfig.table).map((index) => ({
 			indexName: index.name,
@@ -6912,12 +7102,20 @@ var GelRelationalQuery = class extends QueryPromise {
 		const compiler = new WhereClauseCompiler(this.tableConfig.table.tableName, tableIndexes);
 		let whereExpression = whereExpressionOverride;
 		if (!whereExpression && config.where && typeof config.where !== "function") whereExpression = this._buildFilterExpression(config.where, this.tableConfig);
-		const compiled = compiler.compile(whereExpression);
+		const planned = compiler.compile(whereExpression);
+		const plannedUsesIndex = !!planned.selectedIndex && (planned.indexFilters.length > 0 || planned.probeFilters.length > 0);
+		const compiled = !configuredIndex?.name || !plannedUsesIndex || planned.selectedIndex?.indexName === configuredIndex.name && !configuredIndex.range ? planned : {
+			strategy: "none",
+			selectedIndex: null,
+			indexFilters: [],
+			probeFilters: [],
+			postFilters: whereExpression ? [whereExpression] : []
+		};
 		const result = {
 			table: this.tableConfig.table.tableName,
 			strategy: compiled.strategy,
-			probeFilters: compiled.probeFilters,
-			postFilters: compiled.postFilters
+			probeFilters: [...compiled.probeFilters],
+			postFilters: [...compiled.postFilters]
 		};
 		if (compiled.selectedIndex && (compiled.indexFilters.length > 0 || compiled.probeFilters.length > 0)) result.index = {
 			name: compiled.selectedIndex.indexName,
@@ -7403,6 +7601,7 @@ var GelRelationalQuery = class extends QueryPromise {
 		if (!targetTableConfig) throw new Error(`Relation '${relationName}' target table '${edge.targetTable}' not found.`);
 		const relationDefinition = tableConfig.relations[relationName];
 		const strict = tableConfig.strict !== false;
+		const hasPostFetchTargetFilter = this.rls?.mode !== "skip" && isRlsEnabled(targetTableConfig.table) || Boolean(relationDefinition?.where) || Boolean(relationConfig && typeof relationConfig === "object" && "where" in relationConfig && relationConfig.where);
 		let orderSpecs = [];
 		if (relationConfig && typeof relationConfig === "object" && "orderBy" in relationConfig) {
 			let orderByValue = relationConfig.orderBy;
@@ -7423,17 +7622,34 @@ var GelRelationalQuery = class extends QueryPromise {
 			if (effectivePerParentLimit !== void 0) result = result.slice(0, effectivePerParentLimit);
 			return result;
 		};
+		const applyPostFetchTargetFilters = async (candidateTargets) => {
+			let filteredTargets = await this._applyRlsSelectFilter(candidateTargets, targetTableConfig);
+			if (relationDefinition?.where) filteredTargets = filteredTargets.filter((target) => this._evaluateTableFilter(target, targetTableConfig, relationDefinition.where));
+			if (relationConfig && typeof relationConfig === "object" && "where" in relationConfig) {
+				const whereFilter = relationConfig.where;
+				if (typeof whereFilter === "function") {
+					const whereExpression = this._resolveWhereCallbackExpression(whereFilter, targetTableConfig, { context: "relation" });
+					if (whereExpression && !this._isPredicateWhereClause(whereExpression)) filteredTargets = filteredTargets.filter((target) => this._evaluatePostFetchFilter(target, whereExpression));
+				} else if (whereFilter) {
+					const targetEdges = this._getTargetTableEdges(edge.targetTable);
+					filteredTargets = await this._applyRelationsFilterToRows(filteredTargets, targetTableConfig, whereFilter, targetEdges, depth + 1, maxDepth, relationConfig.with);
+				}
+			}
+			return filteredTargets;
+		};
 		let targets = [];
 		let throughBySourceKey;
+		let targetFiltersApplied = false;
 		if (edge.through) {
 			const throughTableConfig = this._getTableConfigByDbName(edge.through.table);
 			if (!throughTableConfig) throw new Error(`Relation '${relationName}' through table '${edge.through.table}' not found.`);
 			const throughIndexName = findRelationIndex(throughTableConfig.table, edge.through.sourceFields, `${tableConfig.name}.${relationName}`, edge.through.table, strict, this.allowFullScan);
 			const entries = Array.from(sourceKeyMap.entries());
 			const throughRowsPerSource = await this._mapWithConcurrency(entries, async ([key, values]) => {
+				const query = this._queryByFields(this.db.query(edge.through.table), edge.through.sourceFields, values, throughIndexName);
 				return {
 					key,
-					rows: await this._queryByFields(this.db.query(edge.through.table), edge.through.sourceFields, values, throughIndexName).collect()
+					rows: await this._applyRlsSelectFilter(await query.collect(), throughTableConfig)
 				};
 			});
 			throughBySourceKey = /* @__PURE__ */ new Map();
@@ -7470,27 +7686,30 @@ var GelRelationalQuery = class extends QueryPromise {
 		} else {
 			const indexName = findRelationIndex(targetTableConfig.table, targetFields, `${tableConfig.name}.${relationName}`, edge.targetTable, strict, this.allowFullScan);
 			const entries = Array.from(sourceKeyMap.entries());
+			const streamPostFetchTargetFilters = orderSpecs.length === 0 && hasPostFetchTargetFilter && effectivePerParentLimit !== void 0;
+			targetFiltersApplied = streamPostFetchTargetFilters;
 			targets = (await this._mapWithConcurrency(entries, async ([, values]) => {
 				const query = this._queryByFields(this.db.query(edge.targetTable), targetFields, values, indexName);
-				if (orderSpecs.length === 0 && effectivePerParentLimit !== void 0) {
+				if (orderSpecs.length === 0 && !hasPostFetchTargetFilter && effectivePerParentLimit !== void 0) {
 					const fetchLimit = (perParentOffset ?? 0) + (effectivePerParentLimit ?? 0);
 					return await query.take(fetchLimit);
 				}
+				if (streamPostFetchTargetFilters) {
+					const visibleTargets = [];
+					const fetchLimit = Math.max(perParentOffset ?? 0, 0) + (effectivePerParentLimit ?? 0);
+					for await (const target of query) {
+						const filtered = await applyPostFetchTargetFilters([target]);
+						if (filtered.length > 0) {
+							visibleTargets.push(filtered[0]);
+							if (visibleTargets.length >= fetchLimit) break;
+						}
+					}
+					return visibleTargets;
+				}
 				return await query.collect();
 			})).flat();
 		}
-		targets = await this._applyRlsSelectFilter(targets, targetTableConfig);
-		if (relationDefinition?.where) targets = targets.filter((target) => this._evaluateTableFilter(target, targetTableConfig, relationDefinition.where));
-		if (relationConfig && typeof relationConfig === "object" && "where" in relationConfig) {
-			const whereFilter = relationConfig.where;
-			if (typeof whereFilter === "function") {
-				const whereExpression = this._resolveWhereCallbackExpression(whereFilter, targetTableConfig, { context: "relation" });
-				if (whereExpression && !this._isPredicateWhereClause(whereExpression)) targets = targets.filter((target) => this._evaluatePostFetchFilter(target, whereExpression));
-			} else if (whereFilter) {
-				const targetEdges = this._getTargetTableEdges(edge.targetTable);
-				targets = await this._applyRelationsFilterToRows(targets, targetTableConfig, whereFilter, targetEdges, depth + 1, maxDepth, relationConfig.with);
-			}
-		}
+		if (!targetFiltersApplied) targets = await applyPostFetchTargetFilters(targets);
 		if (orderSpecs.length > 0) targets.sort((a, b) => this._compareByOrderSpecs(a, b, orderSpecs));
 		if (relationConfig && typeof relationConfig === "object" && "with" in relationConfig) {
 			const targetTableEdges = this._getTargetTableEdges(edge.targetTable);
@@ -7742,6 +7961,12 @@ var ConvexDeleteBuilder = class extends QueryPromise {
 			if (!allowFullScan) throw new Error("update/delete without where() requires allowFullScan: true.");
 			if (strict) console.warn("update/delete without where() is running with allowFullScan: true.");
 		}
+		const rls = ormContext?.rls;
+		assertRlsRolesResolvable({
+			table: this.table,
+			operation: "delete",
+			rls
+		});
 		let rows;
 		let continueCursor = null;
 		let isDone = true;
@@ -7843,7 +8068,6 @@ var ConvexDeleteBuilder = class extends QueryPromise {
 		if (this.whereExpression) rows = rows.filter((row) => evaluateFilter(row, this.whereExpression));
 		const results = [];
 		let numAffected = 0;
-		const rls = ormContext?.rls;
 		const foreignKeyGraph = ormContext?.foreignKeyGraph;
 		if (!foreignKeyGraph) throw new Error("Foreign key actions require orm.db(ctx) configured from createOrm({ schema, ... }).");
 		const cascadeMode = this.cascadeMode ?? (deleteMode === "soft" || deleteMode === "scheduled" ? "soft" : "hard");
@@ -8873,6 +9097,12 @@ var ConvexUpdateBuilder = class extends QueryPromise {
 			if (!allowFullScan) throw new Error("update/delete without where() requires allowFullScan: true.");
 			if (strict) console.warn("update/delete without where() is running with allowFullScan: true.");
 		}
+		const rls = ormContext?.rls;
+		assertRlsRolesResolvable({
+			table: this.table,
+			operation: "update",
+			rls
+		});
 		const onUpdateSet = {};
 		for (const [columnName, builder] of Object.entries(getTableColumns$2(this.table))) {
 			if (columnName in normalizedSetValues) continue;
@@ -8984,7 +9214,6 @@ var ConvexUpdateBuilder = class extends QueryPromise {
 			maxRows
 		});
 		if (this.whereExpression) rows = rows.filter((row) => evaluateFilter(row, this.whereExpression));
-		const rls = ormContext?.rls;
 		const foreignKeyGraph = ormContext?.foreignKeyGraph;
 		if (!foreignKeyGraph) throw new Error("Foreign key actions require orm.db(ctx) configured from createOrm({ schema, ... }).");
 		const updates = await Promise.all(rows.map(async (row) => {