Your data model. A working backend.

const response = await post(
	`mutation ($input: SignUpInput!) {
		signUp(input: $input) { token expiresAt user { name } }
	}`,
	{
		input: {
			email: 'ada@example.com',
			password: 'correct horse',
			name: 'Ada',
		},
	},
)
const { token } = signedUp.parse(await response.json()).data.signUp
const bearer = { authorization: `Bearer ${token}` }
expect(await viewer(bearer)).toEqual({ data: { viewer: { name: 'Ada' } } })
expect(await viewer({})).toEqual({ data: { viewer: null } })

const response = await post(
	`mutation ($input: SignInInput!) { signIn(input: $input) { user { name } } }`,
	{ input: { email: 'ada@example.com', password: 'correct horse' } },
)
const set = response.headers.get('set-cookie') ?? ''
expect(set).toMatch(
	/^ultimabase_session=.+; Max-Age=\d+; Path=\/; HttpOnly; SameSite=Lax$/,
)
// A browser sends it back by itself.
const cookie = { cookie: set.split(';')[0] ?? '' }
expect(await viewer(cookie)).toEqual({ data: { viewer: { name: 'Ada' } } })

// signOut ends the session and clears the cookie.
const out = await post('mutation { signOut }', {}, cookie)
expect(await out.json()).toEqual({ data: { signOut: true } })
expect(out.headers.get('set-cookie')).toMatch(
	/^ultimabase_session=; Max-Age=0/,
)
// A stale cookie is anonymous, so the browser can sign in again.
expect(await viewer(cookie)).toEqual({ data: { viewer: null } })

const mug = await Product.findUniqueOrThrow(
	{
		where: { sku: 'MUG-001' },
		select: { label: true, priceIn: { currency: 'USD' } },
	},
	{ as: master },
)
expect(mug).toEqual({
	label: 'Mug (MUG-001)',
	priceIn: { amount: '13.20', currency: 'USD' },
})

const author = await Author.findUniqueOrThrow(
	{
		where: { id: ursula.id },
		include: {
			books: {
				orderBy: { title: 'asc' },
				take: 10,
				include: { publisher: true, tags: true },
			},
		},
	},
	{ as: master },
)
expect(author.books.map((book) => book.title)).toEqual([
	'The Dispossessed',
	'The Lathe of Heaven',
])
expect(author.books[0]?.publisher.name).toBe('Ace')

import { PublicError, defineFunction, master, transaction } from 'ultimabase'
import { z } from 'zod'
import { Account } from './models.ts'

export const transfer = defineFunction({
	name: 'transfer',
	input: z.object({ from: z.string(), to: z.string(), amount: z.int().min(1) }),
	run: async ({ input, caller }) => {
		// NOT_FOUND unless the caller owns the account.
		await Account.findUniqueOrThrow(
			{ where: { id: input.from } },
			{ as: caller },
		)
		const as = { as: master }
		await transaction(async () => {
			// The update locks the row: a second transfer waits for this one.
			const from = await Account.update(
				{
					where: { id: input.from },
					data: { balance: { decrement: input.amount } },
				},
				as,
			)
			if (from.balance < 0) {
				// Throwing rolls back the decrement.
				throw new PublicError('INSUFFICIENT_FUNDS', 'The balance is too low.')
			}
			await Account.update(
				{
					where: { id: input.to },
					data: { balance: { increment: input.amount } },
				},
				as,
			)
		})
	},
}).with({ access: ({ caller }) => caller.kind === 'user' })

await transfer.run({ from, to, amount: 30 }, ada)
expect(await balances()).toEqual([70, 30])

await expect(
	transfer.run({ from, to, amount: 130 }, ada),
).rejects.toMatchObject({ code: 'INSUFFICIENT_FUNDS' })
// The decrement was undone.
expect(await balances()).toEqual([100, 0])