fix(policy): use dialect.fieldRef for post-update before-join on id fields

The post-update policy check joins the current table with a VALUES
table ($before) on id fields. When an id field has @db.Uuid, the raw
column is uuid while the VALUES table casts to text, causing a type
mismatch. Use dialect.fieldRef() for both sides of the join so the
uuid column gets cast to text.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ymc9

packages/plugins/policy/src/policy-handler.ts

@@ -311,7 +311,18 @@ export class PolicyHandler<Schema extends SchemaDef> extends OperationNodeTransf
                     () => new ExpressionWrapper(beforeUpdateTable!).as('$before'),
                     (join) => {
                         const idFields = QueryUtils.requireIdFields(this.client.$schema, model);
-                        return idFields.reduce((acc, f) => acc.onRef(`${model}.${f}`, '=', `$before.${f}`), join);
+                        const eb = expressionBuilder<any, any>();
+                        return idFields.reduce(
+                            (acc, f) =>
+                                acc.on(() =>
+                                    eb(
+                                        this.dialect.fieldRef(model, f, model, false),
+                                        '=',
+                                        this.dialect.fieldRef(model, f, '$before', false),
+                                    ),
+                                ),
+                            join,
+                        );
                     },
                 ),
             );

tests/regression/test/issue-2394.test.ts

@@ -21,4 +21,24 @@ model Foo {
         await db.$unuseAll().foo.create({ data: { x: uuid() } });
         await expect(db.foo.findMany()).toResolveTruthy();
     });
+
+    it('works with post-update policies', async () => {
+        const db = await createPolicyTestClient(
+            `
+model ExchangeRequest {
+  id     String @id @default(dbgenerated("gen_random_uuid()")) @db.Uuid
+  status String
+
+  @@allow('all', true)
+  @@deny('post-update', before().status == status)  // triggers buildValuesTableSelect
+}
+`,
+            { provider: 'postgresql', usePrismaPush: true, debug: true },
+        );
+
+        const request = await db.exchangeRequest.create({ data: { status: 'pending' } });
+        await expect(
+            db.exchangeRequest.update({ where: { id: request.id }, data: { status: 'done' } }),
+        ).toResolveTruthy();
+    });
 });