@m1212e/rumble 0.24.2 → 0.25.2

package/out/index.cjs

@@ -216,38 +216,76 @@ function mapNullFieldsToUndefined(obj) {
 }
 //#endregion
 //#region package.json
-var version = "0.24.2";
+var version = "0.25.2";
 //#endregion
-//#region lib/helpers/errorLogging.ts
-function hasMessage(error) {
-	return typeof error === "object" && error !== null && "message" in error;
-}
-function toLoggedException(error) {
-	if (hasMessage(error)) {
-		const gqlError = error;
-		return {
-			"exception.type": gqlError.constructor?.name ?? gqlError.name ?? "Error",
-			"exception.message": String(gqlError.message),
-			...gqlError.stack ? { "exception.stacktrace": gqlError.stack } : {},
-			...gqlError.path ? { path: gqlError.path } : {},
-			...gqlError.extensions && Object.keys(gqlError.extensions).length > 0 ? { extensions: gqlError.extensions } : {}
+//#region lib/helpers/tableHelpers.ts
+const indexCache = /* @__PURE__ */ new WeakMap();
+function buildIndex(db) {
+	const byTsName = /* @__PURE__ */ new Map();
+	const byDbName = /* @__PURE__ */ new Map();
+	const byTableRef = /* @__PURE__ */ new Map();
+	for (const [tsName, rawEntry] of Object.entries(db._.relations ?? {})) {
+		const entry = rawEntry;
+		const tableObj = entry.table;
+		if (!tableObj) continue;
+		const columns = (0, drizzle_orm.isTable)(tableObj) ? (0, drizzle_orm.getTableColumns)(tableObj) : {};
+		const primaryKey = Object.fromEntries(Object.entries(columns).filter(([, col]) => col.primary));
+		const dbName = (0, drizzle_orm.isTable)(tableObj) ? (0, drizzle_orm.getTableName)(tableObj) : entry.name ?? tsName;
+		const resolved = {
+			name: entry.name ?? tsName,
+			dbName,
+			table: tableObj,
+			columns,
+			primaryKey,
+			relations: entry.relations ?? {},
+			isTable: (0, drizzle_orm.isTable)(tableObj),
+			foundRelation: entry
 		};
+		byTsName.set(resolved.name, resolved);
+		byDbName.set(resolved.dbName, resolved);
+		byTableRef.set(tableObj, resolved);
 	}
 	return {
-		"exception.type": "UnknownError",
-		"exception.message": String(error)
+		byTsName,
+		byDbName,
+		byTableRef
 	};
 }
-/**
-* Every erroneous rumble log carries the same `errors` array shape,
-* whether it originates from a thrown exception (single-element array)
-* or a GraphQL `ExecutionResult.errors` list (multi-element array).
-*/
-function errorsLogField(errors) {
-	return { errors: errors.map(toLoggedException) };
+function getIndex(db) {
+	let idx = indexCache.get(db);
+	if (!idx) {
+		idx = buildIndex(db);
+		indexCache.set(db, idx);
+	}
+	return idx;
 }
-function errorLogField(error) {
-	return errorsLogField([error]);
+function tableHelper({ db, table }) {
+	const idx = getIndex(db);
+	let entry;
+	if (typeof table === "string") entry = idx.byTsName.get(table) ?? idx.byDbName.get(table);
+	else if (table && typeof table === "object") {
+		const t = table;
+		if (t.table) {
+			entry = idx.byTableRef.get(t.table);
+			if (!entry && t.name) entry = idx.byTsName.get(t.name) ?? idx.byDbName.get(t.name);
+		}
+		if (!entry) entry = idx.byTableRef.get(t);
+		if (!entry && (0, drizzle_orm.isTable)(t)) {
+			const dbName = (0, drizzle_orm.getTableName)(t);
+			entry = idx.byDbName.get(dbName);
+		}
+	}
+	if (!entry) throw new RumbleError(`Could not find schema for ${JSON.stringify(typeof table === "string" ? table : "<table-object>")}`);
+	return {
+		columns: entry.columns,
+		primaryKey: entry.primaryKey,
+		relations: entry.relations,
+		dbName: entry.dbName,
+		tsName: entry.name,
+		table: entry.table,
+		isTable: entry.isTable,
+		foundRelation: entry.foundRelation
+	};
 }
 //#endregion
 //#region lib/helpers/mergeFilters.ts
@@ -262,20 +300,36 @@ const EmptyFilter$1 = Symbol.for("drizzle:EmptyFilter");
 function realWhere(where) {
 	return where === EmptyFilter$1 ? void 0 : where;
 }
+function mergeWhere(a, b, mode) {
+	if (a && b) return mode === "OR" ? { OR: [a, b] } : { AND: [a, b] };
+	return mode === "OR" ? void 0 : a ?? b;
+}
+function mergeColumns(a, b) {
+	if (!a && !b) return void 0;
+	const result = {};
+	for (const [key, value] of [...Object.entries(a ?? {}), ...Object.entries(b ?? {})]) if (value === true) result[key] = true;
+	return result;
+}
+function mergeRecords(a, b) {
+	return a || b ? (0, es_toolkit.toMerged)(a ?? {}, b ?? {}) : void 0;
+}
+/**
+* Combines two limit/offset style bounds. For OR the looser bound wins (and a
+* missing side means unbounded), for AND the stricter bound wins.
+*/
+function mergeBound(a, b, mode, orPick) {
+	if (mode === "OR") return a === void 0 || b === void 0 ? void 0 : orPick(a, b);
+	return a || b ? Math.min(a ?? Infinity, b ?? Infinity) : void 0;
+}
 function mergeFilters(filterA, filterB, mode = "AND") {
-	const filterAWhere = realWhere(filterA?.where);
-	const filterBWhere = realWhere(filterB?.where);
 	return {
-		where: filterAWhere && filterBWhere ? mode === "OR" ? { OR: [filterAWhere, filterBWhere] } : { AND: [filterAWhere, filterBWhere] } : filterAWhere ?? filterBWhere,
-		columns: filterA?.columns || filterB?.columns ? new Set([Object.entries(filterA?.columns ?? {}), Object.entries(filterB?.columns ?? {})].flat().filter(([, v]) => v === true).map(([k]) => k)).entries().reduce((acc, [key]) => {
-			acc[key] = true;
-			return acc;
-		}, {}) : void 0,
-		extras: filterA?.extras || filterB?.extras ? (0, es_toolkit.toMerged)(filterA?.extras ?? {}, filterB?.extras ?? {}) : void 0,
-		orderBy: filterA?.orderBy || filterB?.orderBy ? (0, es_toolkit.toMerged)(filterA?.orderBy ?? {}, filterB?.orderBy ?? {}) : void 0,
-		limit: mode === "OR" ? filterA?.limit === void 0 || filterB?.limit === void 0 ? void 0 : Math.max(filterA.limit, filterB.limit) : filterA?.limit || filterB?.limit ? Math.min(filterA?.limit ?? Infinity, filterB?.limit ?? Infinity) : void 0,
-		offset: mode === "OR" ? filterA?.offset === void 0 || filterB?.offset === void 0 ? void 0 : Math.min(filterA.offset, filterB.offset) : filterA?.offset || filterB?.offset ? Math.min(filterA?.offset ?? Infinity, filterB?.offset ?? Infinity) : void 0,
-		with: filterA?.with || filterB?.with ? (0, es_toolkit.toMerged)(filterA?.with ?? {}, filterB?.with ?? {}) : void 0
+		where: mergeWhere(realWhere(filterA?.where), realWhere(filterB?.where), mode),
+		columns: mergeColumns(filterA?.columns, filterB?.columns),
+		extras: mergeRecords(filterA?.extras, filterB?.extras),
+		orderBy: mergeRecords(filterA?.orderBy, filterB?.orderBy),
+		limit: mergeBound(filterA?.limit, filterB?.limit, mode, Math.max),
+		offset: mergeBound(filterA?.offset, filterB?.offset, mode, Math.min),
+		with: mergeRecords(filterA?.with, filterB?.with)
 	};
 }
 //#endregion
@@ -293,6 +347,201 @@ function sanitizeFilterValue(value) {
 	return value;
 }
 //#endregion
+//#region lib/abilityBuilder/keys.ts
+const ACTION_FLAG_KEY = "__rumble_action";
+const columnFlagKey = (group) => `__rumble_columns_${group}`;
+const columnMaskKey = Symbol.for("rumble:columnMask");
+const resolvedFilterKey = Symbol.for("rumble:resolvedFilter");
+const requestStateKey = Symbol.for("rumble:requestState");
+//#endregion
+//#region lib/abilityBuilder/requestState.ts
+function createRequestState() {
+	return {
+		masked: /* @__PURE__ */ new WeakMap(),
+		actions: /* @__PURE__ */ new Map(),
+		filterLoaders: /* @__PURE__ */ new Map()
+	};
+}
+function attachRequestState(abilities, state) {
+	Object.defineProperty(abilities, requestStateKey, { value: state });
+}
+function requestStateOf(abilities) {
+	return abilities?.[requestStateKey];
+}
+//#endregion
+//#region lib/abilityBuilder/columnMask.ts
+function referencesRelation(filter, relations) {
+	if (!filter || typeof filter !== "object") return false;
+	return Object.entries(filter).some(([key, value]) => {
+		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
+		if (key === "NOT") return referencesRelation(value, relations);
+		return key in relations;
+	});
+}
+function selectedColumns(columns, allColumns) {
+	if (!columns) return new Set(allColumns);
+	const entries = Object.entries(columns).filter(([, v]) => v !== void 0);
+	if (entries.some(([, v]) => v)) return new Set(entries.filter(([, v]) => v).map(([k]) => k));
+	if (entries.length === 0) return /* @__PURE__ */ new Set();
+	return new Set(allColumns.filter((c) => columns[c] !== false));
+}
+function hiddenColumns(mask, matched, allColumns, primaryKey) {
+	let hidden = mask.hiddenPerMatch.get(matched);
+	if (!hidden) {
+		const columns = allColumns.filter((column) => !mask.guaranteed.has(column) && !mask.conditional.some((columns, group) => matched[group] === "1" && columns.has(column)));
+		hidden = {
+			cleared: columns.filter((c) => !primaryKey.includes(c)),
+			primaryKey: columns.some((c) => primaryKey.includes(c))
+		};
+		mask.hiddenPerMatch.set(matched, hidden);
+	}
+	return hidden;
+}
+const hasWhere = (where) => !!where && Object.keys(where).length > 0;
+/** Columns every returned row is allowed to expose. */
+function guaranteedColumns(rules, allColumnNames) {
+	const guaranteed = /* @__PURE__ */ new Set();
+	for (const rule of rules) {
+		if (hasWhere(rule.where)) continue;
+		for (const column of rule.columns) guaranteed.add(column);
+	}
+	for (const column of allColumnNames) if (rules.every((r) => r.columns.has(column))) guaranteed.add(column);
+	return guaranteed;
+}
+/**
+* Groups the conditional rules by the columns they grant on top of the
+* guaranteed ones. Each group gets its own flag.
+*/
+function conditionalGroups(rules, guaranteed) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const rule of rules) {
+		if (!hasWhere(rule.where)) continue;
+		const additional = [...rule.columns].filter((c) => !guaranteed.has(c)).sort();
+		if (additional.length === 0) continue;
+		const key = additional.join(",");
+		const group = groups.get(key);
+		if (group) group.wheres.push(rule.where);
+		else groups.set(key, {
+			columns: new Set(additional),
+			wheres: [rule.where]
+		});
+	}
+	return [...groups.values()];
+}
+/**
+* Creates the resolver which turns the abilities of a table into the columns
+* to select and, if columns depend on the matched ability, extras flagging
+* per row which abilities matched plus the mask to decode them.
+*/
+function createColumnAccessResolver({ db, actions }, tableSchema) {
+	const allColumnNames = Object.keys(tableSchema.columns);
+	const primaryKeyNames = Object.keys(tableSchema.primaryKey);
+	const primaryKeyName = primaryKeyNames[0];
+	const toSQL = (table, wheres) => (0, drizzle_orm.or)(...wheres.map((where) => (0, drizzle_orm.relationsFilterToSQL)(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)));
+	const uncorrelated = (table, wheres, group) => {
+		const inner = (0, drizzle_orm.aliasedTable)(tableSchema.table, `rumble_columns_${group}`);
+		return drizzle_orm.sql`${table[primaryKeyName]} in (${db.select({ pk: inner[primaryKeyName] }).from(inner).where(toSQL(inner, wheres))})`;
+	};
+	return function resolveColumnAccess(action, filters) {
+		const rules = filters.map((f) => ({
+			where: realWhere(f?.where),
+			columns: selectedColumns(f?.columns, allColumnNames)
+		}));
+		const guaranteed = guaranteedColumns(rules, allColumnNames);
+		const groups = conditionalGroups(rules, guaranteed);
+		const selected = /* @__PURE__ */ new Set([...primaryKeyNames, ...rules.flatMap((r) => [...r.columns])]);
+		const columns = selected.size === allColumnNames.length ? void 0 : Object.fromEntries([...selected].map((c) => [c, true]));
+		if (guaranteed.size === allColumnNames.length) return {
+			columns,
+			extras: void 0,
+			mask: void 0
+		};
+		const mask = {
+			guaranteed,
+			conditional: groups.map((g) => g.columns),
+			flags: groups.map((_, group) => columnFlagKey(group)),
+			hiddenPerMatch: /* @__PURE__ */ new Map()
+		};
+		const actionIndex = drizzle_orm.sql.raw(String(actions.indexOf(action)));
+		const extras = { [ACTION_FLAG_KEY]: () => drizzle_orm.sql`${actionIndex}` };
+		groups.forEach(({ wheres }, group) => {
+			const relational = wheres.some((w) => referencesRelation(w, tableSchema.relations));
+			extras[mask.flags[group]] = (table) => {
+				const condition = relational ? uncorrelated(table, wheres, group) : toSQL(table, wheres);
+				return drizzle_orm.sql`case when ${condition} then 1 else 0 end`;
+			};
+		});
+		return {
+			columns,
+			extras,
+			mask
+		};
+	};
+}
+const isRow = (row) => !!row && typeof row === "object";
+function clearColumns(row, columns) {
+	for (let i = 0; i < columns.length; i++) {
+		const column = columns[i];
+		if (row[column] !== void 0) row[column] = void 0;
+	}
+}
+function matchedGroups(row, flags) {
+	let matched = "";
+	for (let i = 0; i < flags.length; i++) matched += Number(row[flags[i]]) === 1 ? "1" : "0";
+	return matched;
+}
+function maskRow(row, mask, hidden) {
+	if (row["__rumble_action"] !== void 0) row[ACTION_FLAG_KEY] = void 0;
+	clearColumns(row, mask.flags);
+	clearColumns(row, hidden.cleared);
+}
+/**
+* Creates the function hiding the columns of queried rows which the ability
+* that matched the row does not grant.
+*/
+function createColumnMasker({ actions }, tables) {
+	const stateOf = (abilities) => requestStateOf(abilities);
+	const maskedActions = (abilities, table) => {
+		const { actions } = stateOf(abilities);
+		let used = actions.get(table);
+		if (!used) {
+			used = /* @__PURE__ */ new Set();
+			actions.set(table, used);
+		}
+		return used;
+	};
+	const primaryKeyHidden = (abilities, row) => stateOf(abilities).masked.get(row) === true;
+	const maskColumns = ({ table, action, abilities, entities }, start = 0) => {
+		const tableAbilities = abilities[table];
+		const { columns: columnNames, primaryKey } = tables.get(table);
+		const state = stateOf(abilities);
+		const used = maskedActions(abilities, table);
+		for (let i = start; i < entities.length; i++) {
+			const row = entities[i];
+			if (!isRow(row) || state.masked.has(row)) continue;
+			const rowAction = row["__rumble_action"] != null ? actions[Number(row[ACTION_FLAG_KEY])] : action;
+			used.add(rowAction);
+			const resolved = tableAbilities[resolvedFilterKey](rowAction);
+			if (!resolved) return tableAbilities.filter(rowAction).then(() => maskColumns({
+				table,
+				action,
+				abilities,
+				entities
+			}, i));
+			const mask = resolved[columnMaskKey];
+			if (!mask) continue;
+			const hidden = hiddenColumns(mask, matchedGroups(row, mask.flags), columnNames, primaryKey);
+			maskRow(row, mask, hidden);
+			state.masked.set(row, hidden.primaryKey);
+		}
+	};
+	return {
+		maskColumns,
+		maskedActions,
+		primaryKeyHidden
+	};
+}
+//#endregion
 //#region lib/helpers/sqlTypes/types.ts
 /**
 * Strips parameter suffixes like `(256)`, `(10,2)` and timezone modifiers
@@ -438,76 +687,6 @@ function createDistinctValuesFromSQLType(sqlType) {
 	throw UnknownTypeRumbleError(sqlType, "Distinct");
 }
 //#endregion
-//#region lib/helpers/tableHelpers.ts
-const indexCache = /* @__PURE__ */ new WeakMap();
-function buildIndex(db) {
-	const byTsName = /* @__PURE__ */ new Map();
-	const byDbName = /* @__PURE__ */ new Map();
-	const byTableRef = /* @__PURE__ */ new Map();
-	for (const [tsName, rawEntry] of Object.entries(db._.relations ?? {})) {
-		const entry = rawEntry;
-		const tableObj = entry.table;
-		if (!tableObj) continue;
-		const columns = (0, drizzle_orm.isTable)(tableObj) ? (0, drizzle_orm.getTableColumns)(tableObj) : {};
-		const primaryKey = Object.fromEntries(Object.entries(columns).filter(([, col]) => col.primary));
-		const dbName = (0, drizzle_orm.isTable)(tableObj) ? (0, drizzle_orm.getTableName)(tableObj) : entry.name ?? tsName;
-		const resolved = {
-			name: entry.name ?? tsName,
-			dbName,
-			table: tableObj,
-			columns,
-			primaryKey,
-			relations: entry.relations ?? {},
-			isTable: (0, drizzle_orm.isTable)(tableObj),
-			foundRelation: entry
-		};
-		byTsName.set(resolved.name, resolved);
-		byDbName.set(resolved.dbName, resolved);
-		byTableRef.set(tableObj, resolved);
-	}
-	return {
-		byTsName,
-		byDbName,
-		byTableRef
-	};
-}
-function getIndex(db) {
-	let idx = indexCache.get(db);
-	if (!idx) {
-		idx = buildIndex(db);
-		indexCache.set(db, idx);
-	}
-	return idx;
-}
-function tableHelper({ db, table }) {
-	const idx = getIndex(db);
-	let entry;
-	if (typeof table === "string") entry = idx.byTsName.get(table) ?? idx.byDbName.get(table);
-	else if (table && typeof table === "object") {
-		const t = table;
-		if (t.table) {
-			entry = idx.byTableRef.get(t.table);
-			if (!entry && t.name) entry = idx.byTsName.get(t.name) ?? idx.byDbName.get(t.name);
-		}
-		if (!entry) entry = idx.byTableRef.get(t);
-		if (!entry && (0, drizzle_orm.isTable)(t)) {
-			const dbName = (0, drizzle_orm.getTableName)(t);
-			entry = idx.byDbName.get(dbName);
-		}
-	}
-	if (!entry) throw new RumbleError(`Could not find schema for ${JSON.stringify(typeof table === "string" ? table : "<table-object>")}`);
-	return {
-		columns: entry.columns,
-		primaryKey: entry.primaryKey,
-		relations: entry.relations,
-		dbName: entry.dbName,
-		tsName: entry.name,
-		table: entry.table,
-		isTable: entry.isTable,
-		foundRelation: entry.foundRelation
-	};
-}
-//#endregion
 //#region lib/helpers/telemetry.ts
 const SPAN_EXECUTE = _pothos_tracing_opentelemetry.SpanNames.EXECUTE;
 /** @pothos/tracing-opentelemetry's SpanNames enum has no subscribe member. */
@@ -683,13 +862,161 @@ function durationMs(start) {
 	return Math.round((performance.now() - start) * 100) / 100;
 }
 //#endregion
-//#region lib/abilityBuilder.ts
+//#region lib/abilityBuilder/filterResponse.ts
+/**
+* The limit of a find many call. An injected merge limit wins unless the
+* ability limit is lower, otherwise the default limit caps the ability limit.
+*/
+function resolveLimit(abilityLimit, mergedLimit, defaultLimit) {
+	if (mergedLimit !== void 0 && (!abilityLimit || abilityLimit > mergedLimit)) return mergedLimit;
+	if (defaultLimit && (abilityLimit === void 0 || abilityLimit > defaultLimit)) return defaultLimit;
+	return abilityLimit ?? void 0;
+}
+/**
+* Creates the function packing resolved query filters into the object handed
+* out by `abilities.<table>.filter(...)`.
+*/
+function createFilterResponder({ db, defaultLimit }, tableSchema) {
+	const internalTransformer = (filters, mergedLimit) => {
+		const where = filters?.where;
+		const extras = filters?.extras;
+		const columns = filters?.columns;
+		const limit = require_lazy.lazy(() => resolveLimit(filters?.limit, mergedLimit, defaultLimit));
+		const sqlTransformedWhere = require_lazy.lazy(() => {
+			const casing = db._.session?.dialect?.casing;
+			return where ? (0, drizzle_orm.relationsFilterToSQL)(tableSchema.foundRelation.table, sanitizeFilterValue(where), tableSchema.relations, db._.relations, casing) : void 0;
+		});
+		return {
+			query: {
+				single: columns ? {
+					extras,
+					where: sanitizeFilterValue(where),
+					columns
+				} : {
+					extras,
+					where: sanitizeFilterValue(where)
+				},
+				many: columns ? {
+					extras,
+					where: sanitizeFilterValue(where),
+					columns,
+					get limit() {
+						return limit();
+					}
+				} : {
+					extras,
+					where: sanitizeFilterValue(where),
+					get limit() {
+						return limit();
+					}
+				}
+			},
+			sql: { get where() {
+				return sqlTransformedWhere();
+			} }
+		};
+	};
+	/**
+	* Packs the filters into a response object that can be applied for queries by the user
+	*/
+	return function transformToResponse(queryFilters, columnMask) {
+		const ret = internalTransformer(queryFilters);
+		ret.merge = (filters) => internalTransformer(mergeFilters(ret.query.many, filters), filters.limit);
+		ret[columnMaskKey] = columnMask;
+		return ret;
+	};
+}
+//#endregion
+//#region lib/abilityBuilder/queryFilter.ts
 function isDynamicQueryFilter(filter) {
 	return typeof filter === "function";
 }
 function isStaticQueryFilter(filter) {
 	return typeof filter !== "function";
 }
+//#endregion
+//#region lib/helpers/errorLogging.ts
+function hasMessage(error) {
+	return typeof error === "object" && error !== null && "message" in error;
+}
+function toLoggedException(error) {
+	if (hasMessage(error)) {
+		const gqlError = error;
+		return {
+			"exception.type": gqlError.constructor?.name ?? gqlError.name ?? "Error",
+			"exception.message": String(gqlError.message),
+			...gqlError.stack ? { "exception.stacktrace": gqlError.stack } : {},
+			...gqlError.path ? { path: gqlError.path } : {},
+			...gqlError.extensions && Object.keys(gqlError.extensions).length > 0 ? { extensions: gqlError.extensions } : {}
+		};
+	}
+	return {
+		"exception.type": "UnknownError",
+		"exception.message": String(error)
+	};
+}
+/**
+* Every erroneous rumble log carries the same `errors` array shape,
+* whether it originates from a thrown exception (single-element array)
+* or a GraphQL `ExecutionResult.errors` list (multi-element array).
+*/
+function errorsLogField(errors) {
+	return { errors: errors.map(toLoggedException) };
+}
+function errorLogField(error) {
+	return errorsLogField([error]);
+}
+//#endregion
+//#region lib/abilityBuilder/telemetry.ts
+const makeNothingRegisteredWarner = (config, logger) => (0, es_toolkit.debounce)((model, action) => {
+	const msg = `No abilities registered for ${model}/${action} — blocking everything. Register the ability or ignore this warning if intentional.`;
+	if (logger) logger.warn({
+		[ATTR_TABLE]: model,
+		[ATTR_ACTION]: action,
+		...traceCorrelationFields(config)
+	}, msg);
+	else console.warn(msg);
+}, 1e3);
+/**
+* Runs the preparation of the abilities of one table and action, reporting
+* the attributes it collects to the span and the logger.
+*/
+function traceAbilityPreparation({ otel, log, telemetryConfig }, tableName, action, assemble) {
+	const run = async (span) => {
+		const attributes = {
+			[ATTR_TABLE]: tableName,
+			[ATTR_ACTION]: action
+		};
+		try {
+			const result = await assemble(attributes);
+			log?.debug({
+				...attributes,
+				...traceCorrelationFields(telemetryConfig, span)
+			}, "abilities prepared");
+			return result;
+		} catch (error) {
+			recordSpanError(span, error);
+			log?.error({
+				...attributes,
+				...traceCorrelationFields(telemetryConfig, span),
+				...errorLogField(error)
+			}, "abilities failed");
+			throw error;
+		} finally {
+			span?.setAttributes(attributes);
+		}
+	};
+	if (otel?.enabled && otel.tracer) return otel.tracer.startActiveSpan(SPAN_ABILITIES_PREPARE, async (span) => {
+		try {
+			return await run(span);
+		} finally {
+			span.end();
+		}
+	});
+	return run();
+}
+//#endregion
+//#region lib/abilityBuilder/tableAbilities.ts
 /**
 * filter() is async. Without type checking (plain JS, `any`) a forgotten await would
 * hand the promise itself to drizzle
@@ -707,114 +1034,223 @@ function guardAgainstMissingAwait(promise) {
 	});
 	return promise;
 }
-const makeNothingRegisteredWarner = (config, logger) => (0, es_toolkit.debounce)((model, action) => {
-	const msg = `No abilities registered for ${model}/${action} — blocking everything. Register the ability or ignore this warning if intentional.`;
-	if (logger) logger.warn({
-		[ATTR_TABLE]: model,
-		[ATTR_ACTION]: action,
-		...traceCorrelationFields(config)
-	}, msg);
-	else console.warn(msg);
-}, 1e3);
+/**
+* A filter no row can match, since it requires the primary key to equal two
+* distinct values at once.
+*/
+function createBlockEverythingFilter(tableName, tableSchema) {
+	if (Object.keys(tableSchema.primaryKey).length === 0) throw new RumbleError(`No primary key found for entity ${tableName}`);
+	const [primaryKeyName, primaryKeyField] = Object.entries(tableSchema.primaryKey)[0];
+	const distinctValues = createDistinctValuesFromSQLType(primaryKeyField.getSQLType());
+	return { where: { AND: [{ [primaryKeyName]: distinctValues.value1 }, { [primaryKeyName]: distinctValues.value2 }] } };
+}
+/**
+* Creates the abilities of a single table, which resolve the registered
+* query filters for a request.
+*/
+const createTableAbilities = (settings, tableName, queryFilters) => {
+	const { db, actions } = settings;
+	const tableSchema = tableHelper({
+		db,
+		table: tableName
+	});
+	const withRestrictingWhere = (filter) => {
+		const where = realWhere(filter.where);
+		return !!where && Object.keys(where).length > 0 && (0, drizzle_orm.relationsFilterToSQL)(tableSchema.table, sanitizeFilterValue(where), tableSchema.relations, db._.relations) !== void 0 || where === void 0 ? filter : {
+			...filter,
+			where: void 0
+		};
+	};
+	const simpleQueryFilters = Object.fromEntries(actions.map((action) => {
+		const filters = queryFilters.get(action);
+		if (!filters || filters === "unrestricted") return [action, []];
+		return [action, filters.filter(isStaticQueryFilter).map(withRestrictingWhere)];
+	}));
+	const dynamicQueryFilters = Object.fromEntries(actions.map((action) => {
+		const filters = queryFilters.get(action);
+		if (!filters || filters === "unrestricted") return [action, []];
+		return [action, filters.filter(isDynamicQueryFilter)];
+	}));
+	const blockEverythingFilter = createBlockEverythingFilter(String(tableName), tableSchema);
+	const resolveColumnAccess = createColumnAccessResolver(settings, tableSchema);
+	const transformToResponse = createFilterResponder(settings, tableSchema);
+	const assembleAbilities = async (userContext, action, attributes) => {
+		const filters = queryFilters.get(action);
+		if (filters === "unrestricted") {
+			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
+			return transformToResponse();
+		}
+		if (!filters) {
+			attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
+			settings.warnNothingRegistered(String(tableName), action);
+			return transformToResponse(blockEverythingFilter);
+		}
+		const rawResults = await Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+		if (rawResults.includes("allow")) {
+			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
+			return transformToResponse();
+		}
+		const dynamicResults = rawResults.filter((r) => r !== void 0).map(withRestrictingWhere);
+		attributes[ATTR_ABILITIES_DYNAMIC] = dynamicResults.length;
+		attributes[ATTR_ABILITIES_STATIC] = simpleQueryFilters[action].length;
+		const allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
+		attributes[ATTR_ABILITIES_TOTAL] = allQueryFilters.length;
+		if (allQueryFilters.length === 0) {
+			attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
+			return transformToResponse(blockEverythingFilter);
+		}
+		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
+			return mergeFilters(a, b, "OR");
+		});
+		const { columns, extras, mask } = resolveColumnAccess(action, allQueryFilters);
+		if (columns) mergedFilters.columns = columns;
+		else delete mergedFilters.columns;
+		if (extras) mergedFilters.extras = {
+			...mergedFilters.extras,
+			...extras
+		};
+		attributes[ATTR_ABILITIES_STATUS] = "applied";
+		return transformToResponse(mergedFilters, mask);
+	};
+	return { withContext: (userContext) => {
+		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(userContext, action, attributes));
+		const cache = /* @__PURE__ */ new Map();
+		const resolved = /* @__PURE__ */ new Map();
+		const abilities = { filter: (action) => {
+			let prepared = cache.get(action);
+			if (!prepared) {
+				prepared = guardAgainstMissingAwait(prepare(action));
+				cache.set(action, prepared);
+				prepared.then((result) => resolved.set(action, result), () => {});
+			}
+			return prepared;
+		} };
+		abilities[resolvedFilterKey] = (action) => resolved.get(action);
+		return abilities;
+	} };
+};
+//#endregion
+//#region lib/abilityBuilder/tableBuilder.ts
+/**
+* Creates the registration API (allow/filter) of a single table.
+*/
+const createTableBuilder = ({ actions, isBuilt }) => {
+	const queryFilters = /* @__PURE__ */ new Map();
+	const runtimeFilters = /* @__PURE__ */ new Map();
+	for (const action of actions) if (!runtimeFilters.has(action)) runtimeFilters.set(action, []);
+	const registerFilter = (actions, prefetch) => ({ 
+	/**
+	* The actual filter function to apply. Returns the allowed values
+	*/
+by: (explicitFilter) => {
+		for (const action of actions) runtimeFilters.get(action).push(prefetch ? {
+			filter: explicitFilter,
+			prefetch
+		} : { filter: explicitFilter });
+	} });
+	return {
+		/**
+		* Allows to perform a specific action on a specific entity
+		*/
+		allow: (action) => {
+			if (isBuilt()) throw new RumbleError("You can't call allow() after the ability builder has been built. Please ensure that you register all abilities before accessing them.");
+			const actions = Array.isArray(action) ? action : [action];
+			const setUnrestrictedByThisCall = /* @__PURE__ */ new Set();
+			for (const action of actions) {
+				let filters = queryFilters.get(action);
+				if (!filters) {
+					filters = "unrestricted";
+					queryFilters.set(action, filters);
+					setUnrestrictedByThisCall.add(action);
+				}
+			}
+			return { 
+			/**
+			* Restricts the allowed actions to a filter
+			* @example
+			* ```ts
+			* abilityBuilder.users.allow(["read", "update", "delete"]).when(({ userId }) => ({
+			*    where: {
+			*      id: userId,
+			*    },
+			*  }));
+			* ```
+			*/
+when: (queryFilter) => {
+				for (const action of actions) {
+					if (queryFilters.get(action) === "unrestricted") {
+						if (setUnrestrictedByThisCall.has(action)) queryFilters.set(action, []);
+						else continue;
+					}
+					queryFilters.get(action).push(queryFilter);
+				}
+			} };
+		},
+		/**
+		* Allows to register an application level filter to restrict some results
+		* which were returned by a query
+		*/
+		filter: (action) => {
+			const actions = Array.isArray(action) ? action : [action];
+			return {
+				/**
+				* Allows to register an application level prefetch to fetch some data
+				* which could be useful for later filtering the results. The prefetch
+				* function will be called with the user context but unlike the actual
+				* filter function, it will not have access to the result of the query
+				* and therefore can be run in parallel with underlying query resolver.
+				* A typical use case is to fetch some data which is not directly
+				* related to the query but to the context only. So e.g. fetching the
+				* user's permissions from an external system and then later applying
+				* the filter based on those permissions.
+				*/
+				prefetch: (prefetch) => registerFilter(actions, prefetch),
+				...registerFilter(actions)
+			};
+		},
+		_: {
+			runtimeFilters,
+			queryFilters
+		}
+	};
+};
+//#endregion
+//#region lib/abilityBuilder/index.ts
 const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerConfig }) => {
 	const log = loggerConfig?.enabled ? loggerConfig.logger : void 0;
 	const telemetryConfig = {
 		otel,
 		logger: loggerConfig
 	};
-	const nothingRegisteredWarningLogger = makeNothingRegisteredWarner(telemetryConfig, log);
+	const settings = {
+		db,
+		actions,
+		defaultLimit,
+		otel,
+		telemetryConfig,
+		log,
+		warnNothingRegistered: makeNothingRegisteredWarner(telemetryConfig, log)
+	};
 	const tableRelationNames = Object.keys(db.query).filter((name) => tableHelper({
 		db,
 		table: name
 	}).isTable);
 	let hasBeenBuilt = false;
-	const createBuilderForTable = () => {
-		const queryFilters = /* @__PURE__ */ new Map();
-		const runtimeFilters = /* @__PURE__ */ new Map();
-		for (const action of actions) if (!runtimeFilters.has(action)) runtimeFilters.set(action, []);
-		return {
-			/**
-			* Allows to perform a specific action on a specific entity
-			*/
-			allow: (action) => {
-				if (hasBeenBuilt) throw new RumbleError("You can't call allow() after the ability builder has been built. Please ensure that you register all abilities before accessing them.");
-				const actions = Array.isArray(action) ? action : [action];
-				const setUnrestrictedByThisCall = /* @__PURE__ */ new Set();
-				for (const action of actions) {
-					let filters = queryFilters.get(action);
-					if (!filters) {
-						filters = "unrestricted";
-						queryFilters.set(action, filters);
-						setUnrestrictedByThisCall.add(action);
-					}
-				}
-				return { 
-				/**
-				* Restricts the allowed actions to a filter
-				* @example
-				* ```ts
-				* abilityBuilder.users.allow(["read", "update", "delete"]).when(({ userId }) => ({
-				*    where: {
-				*      id: userId,
-				*    },
-				*  }));
-				* ```
-				*/
-when: (queryFilter) => {
-					for (const action of actions) {
-						if (queryFilters.get(action) === "unrestricted") {
-							if (setUnrestrictedByThisCall.has(action)) queryFilters.set(action, []);
-							else continue;
-						}
-						queryFilters.get(action).push(queryFilter);
-					}
-				} };
-			},
-			/**
-			* Allows to register an application level filter to restrict some results
-			* which were returned by a query
-			*/
-			filter: (action) => {
-				const actions = Array.isArray(action) ? action : [action];
-				return {
-					/**
-					* Allows to register an application level prefetch to fetch some data
-					* which could be useful for later filtering the results. The prefetch
-					* function will be called with the user context but unlike the actual
-					* filter function, it will not have access to the result of the query
-					* and therefore can be run in parallel with underlying query resolver.
-					* A typical use case is to fetch some data which is not directly
-					* related to the query but to the context only. So e.g. fetching the
-					* user's permissions from an external system and then later applying
-					* the filter based on those permissions.
-					*/
-					prefetch: (prefetch) => {
-						return { 
-						/**
-						* The actual filter function to apply. Returns the allowed values
-						*/
-by: (explicitFilter) => {
-							for (const action of actions) runtimeFilters.get(action).push({
-								filter: explicitFilter,
-								prefetch
-							});
-						} };
-					},
-					/**
-					* The actual filter function to apply. Returns the allowed values
-					*/
-					by: (explicitFilter) => {
-						for (const action of actions) runtimeFilters.get(action).push({ filter: explicitFilter });
-					}
-				};
-			},
-			_: {
-				runtimeFilters,
-				queryFilters
-			}
-		};
-	};
-	const buildersPerTable = Object.fromEntries(tableRelationNames.map((tableName) => [tableName, createBuilderForTable()]));
+	const buildersPerTable = Object.fromEntries(tableRelationNames.map((tableName) => [tableName, createTableBuilder({
+		actions: settings.actions,
+		isBuilt: () => hasBeenBuilt
+	})]));
+	const { maskColumns, maskedActions, primaryKeyHidden } = createColumnMasker(settings, new Map(tableRelationNames.map((tableName) => {
+		const tableSchema = tableHelper({
+			db,
+			table: tableName
+		});
+		return [tableName, {
+			columns: Object.keys(tableSchema.columns),
+			primaryKey: Object.keys(tableSchema.primaryKey)
+		}];
+	})));
+	const readActionPerTable = /* @__PURE__ */ new Map();
 	return {
 		...buildersPerTable,
 		/**
@@ -822,247 +1258,28 @@ by: (explicitFilter) => {
 		* @ignore
 		*/
 		_: {
+			maskColumns: (input) => maskColumns(input),
+			/** The actions rows of the table were masked with in this request. */
+			maskedActions: (abilities, table) => maskedActions(abilities, table),
+			/** Whether masking in this request hid the primary key of the row. */
+			primaryKeyHidden: (abilities, row) => primaryKeyHidden(abilities, row),
+			registerReadAction(table, action) {
+				readActionPerTable.set(table, action);
+			},
+			readActionOf(table) {
+				return readActionPerTable.get(table) ?? "read";
+			},
 			registeredFilters({ action, table }) {
 				return buildersPerTable[table]._.runtimeFilters.get(action);
 			},
 			build() {
-				const createFilterForTable = (tableName) => {
-					const queryFilters = buildersPerTable[tableName]._.queryFilters;
-					const simpleQueryFilters = Object.fromEntries(actions.map((action) => {
-						const filters = queryFilters.get(action);
-						if (!filters || filters === "unrestricted") return [action, []];
-						return [action, filters.filter(isStaticQueryFilter)];
-					}));
-					const dynamicQueryFilters = Object.fromEntries(actions.map((action) => {
-						const filters = queryFilters.get(action);
-						if (!filters || filters === "unrestricted") return [action, []];
-						return [action, filters.filter(isDynamicQueryFilter)];
-					}));
-					const tableSchema = tableHelper({
-						db,
-						table: tableName
-					});
-					if (Object.keys(tableSchema.primaryKey).length === 0) throw new RumbleError(`No primary key found for entity ${String(tableName)}`);
-					const primaryKeyField = Object.values(tableSchema.primaryKey)[0];
-					const distinctValues = createDistinctValuesFromSQLType(primaryKeyField.getSQLType());
-					const blockEverythingFilter = { where: { AND: [{ [primaryKeyField.name]: distinctValues.value1 }, { [primaryKeyField.name]: distinctValues.value2 }] } };
-					/**
-					* Packs the filters into a response object that can be applied for queries by the user
-					*/
-					function transformToResponse(queryFilters) {
-						const internalTransformer = (filters, mergedLimit) => {
-							const limit = require_lazy.lazy(() => {
-								if (mergedLimit !== void 0) {
-									if (!filters?.limit) return mergedLimit;
-									if (filters.limit > mergedLimit) return mergedLimit;
-								}
-								let limit = filters?.limit;
-								if (defaultLimit && (limit === void 0 || limit > defaultLimit)) limit = defaultLimit;
-								return limit ?? void 0;
-							});
-							const sqlTransformedWhere = require_lazy.lazy(() => {
-								const casing = db._.session?.dialect?.casing;
-								return filters?.where ? (0, drizzle_orm.relationsFilterToSQL)(tableSchema.foundRelation.table, sanitizeFilterValue(filters.where), tableSchema.relations, db._.relations, casing) : void 0;
-							});
-							if (filters?.columns) return {
-								/**
-								* Query filters for the drizzle query API.
-								* @example
-								* ```ts
-								* author: t.relation("author", {
-								*  query: async (_args, ctx) => (await ctx.abilities.users.filter("read")).query.single,
-								* }),
-								* ´´´
-								*/
-								query: {
-									/**
-									* For find first calls
-									*/
-									single: {
-										extras: filters?.extras,
-										where: sanitizeFilterValue(filters?.where),
-										columns: filters?.columns
-									},
-									/**
-									* For find many calls
-									*/
-									many: {
-										extras: filters?.extras,
-										where: sanitizeFilterValue(filters?.where),
-										columns: filters?.columns,
-										get limit() {
-											return limit();
-										}
-									}
-								},
-								/**
-								* Query filters for the drizzle SQL API as used in e.g. updates.
-								* @example
-								*
-								* ```ts
-								* await db
-								*	.update(schema.users)
-								*	.set({
-								*	  name: args.newName,
-								* 	})
-								*	.where(
-								*	  and(
-								*	    eq(schema.users.id, args.userId),
-								*	    (await ctx.abilities.users.filter("update")).sql.where,
-								*	  ),
-								*	);
-								* ```
-								*
-								*/
-								sql: { get where() {
-									return sqlTransformedWhere();
-								} }
-							};
-							else return {
-								/**
-								* Query filters for the drizzle query API.
-								* @example
-								* ```ts
-								* author: t.relation("author", {
-								*  query: async (_args, ctx) => (await ctx.abilities.users.filter("read")).query.single,
-								* }),
-								* ´´´
-								*/
-								query: {
-									/**
-									* For find first calls
-									*/
-									single: {
-										extras: filters?.extras,
-										where: sanitizeFilterValue(filters?.where)
-									},
-									/**
-									* For find many calls
-									*/
-									many: {
-										extras: filters?.extras,
-										where: sanitizeFilterValue(filters?.where),
-										get limit() {
-											return limit();
-										}
-									}
-								},
-								/**
-								* Query filters for the drizzle SQL API as used in e.g. updates.
-								* @example
-								*
-								* ```ts
-								* await db
-								*	.update(schema.users)
-								*	.set({
-								*	  name: args.newName,
-								* 	})
-								*	.where(
-								*	  and(
-								*	    eq(schema.users.id, args.userId),
-								*	    (await ctx.abilities.users.filter("update")).sql.where,
-								*	  ),
-								*	);
-								* ```
-								*
-								*/
-								sql: { get where() {
-									return sqlTransformedWhere();
-								} }
-							};
-						};
-						const ret = internalTransformer(queryFilters);
-						/**
-						* Merges the current query filters with the provided filters for this call only
-						*/
-						function merge(p) {
-							const merged = mergeFilters(ret.query.many, p);
-							return internalTransformer(merged, p.limit);
-						}
-						ret.merge = merge;
-						return ret;
-					}
-					return { withContext: (userContext) => {
-						const prepare = (action) => {
-							const assembleAbilities = async (attributes) => {
-								const filters = queryFilters.get(action);
-								if (filters === "unrestricted") {
-									attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
-									return transformToResponse();
-								}
-								if (!filters) {
-									attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
-									nothingRegisteredWarningLogger(String(tableName), action);
-									return transformToResponse(blockEverythingFilter);
-								}
-								const rawResults = await Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
-								if (rawResults.includes("allow")) {
-									attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
-									return transformToResponse();
-								}
-								const dynamicResults = rawResults.filter((r) => r !== void 0);
-								attributes[ATTR_ABILITIES_DYNAMIC] = dynamicResults.length;
-								attributes[ATTR_ABILITIES_STATIC] = simpleQueryFilters[action].length;
-								const allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
-								attributes[ATTR_ABILITIES_TOTAL] = allQueryFilters.length;
-								if (allQueryFilters.length === 0) {
-									attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
-									return transformToResponse(blockEverythingFilter);
-								}
-								const mergedFilters = allQueryFilters.length === 1 ? allQueryFilters[0] : allQueryFilters.reduce((a, b) => {
-									return mergeFilters(a, b, "OR");
-								});
-								attributes[ATTR_ABILITIES_STATUS] = "applied";
-								return transformToResponse(mergedFilters);
-							};
-							const run = async (span) => {
-								const attributes = {
-									[ATTR_TABLE]: String(tableName),
-									[ATTR_ACTION]: action
-								};
-								try {
-									const result = await assembleAbilities(attributes);
-									log?.debug({
-										...attributes,
-										...traceCorrelationFields(telemetryConfig, span)
-									}, "abilities prepared");
-									return result;
-								} catch (error) {
-									recordSpanError(span, error);
-									log?.error({
-										...attributes,
-										...traceCorrelationFields(telemetryConfig, span),
-										...errorLogField(error)
-									}, "abilities failed");
-									throw error;
-								} finally {
-									span?.setAttributes(attributes);
-								}
-							};
-							if (otel?.enabled && otel.tracer) return otel.tracer.startActiveSpan(SPAN_ABILITIES_PREPARE, async (span) => {
-								try {
-									return await run(span);
-								} finally {
-									span.end();
-								}
-							});
-							return run();
-						};
-						const cache = /* @__PURE__ */ new Map();
-						return { filter: (action) => {
-							let prepared = cache.get(action);
-							if (!prepared) {
-								prepared = guardAgainstMissingAwait(prepare(action));
-								cache.set(action, prepared);
-							}
-							return prepared;
-						} };
-					} };
-				};
-				const abilitiesPerTable = Object.fromEntries(tableRelationNames.map((tableName) => [tableName, createFilterForTable(tableName)]));
+				const abilitiesPerTable = Object.fromEntries(tableRelationNames.map((tableName) => [tableName, createTableAbilities(settings, tableName, buildersPerTable[tableName]._.queryFilters)]));
 				hasBeenBuilt = true;
 				return (ctx) => {
-					return Object.fromEntries(tableRelationNames.map((tableName) => [tableName, abilitiesPerTable[tableName].withContext(ctx)]));
+					const state = createRequestState();
+					const abilities = Object.fromEntries(tableRelationNames.map((tableName) => [tableName, abilitiesPerTable[tableName].withContext(ctx)]));
+					attachRequestState(abilities, state);
+					return abilities;
 				};
 			}
 		}
@@ -1886,7 +2103,8 @@ async function initSearchIfApplicable(input) {
 */
 function adjustQueryArgsForSearch({ search, args, tableSchema, abilities }) {
 	if (search?.enabled && args.search && args.search.length > 0) {
-		const columnsToSearch = (abilities.query.many.columns ? Object.entries(tableSchema.columns).filter(([key]) => abilities.query.many.columns[key]) : Object.entries(tableSchema.columns)).filter(([_key, col]) => isStringLikeSQLTypeString(col.getSQLType()) || isIDLikeSQLTypeString(col.getSQLType()));
+		const columnMask = abilities[columnMaskKey];
+		const columnsToSearch = (columnMask ? Object.entries(tableSchema.columns).filter(([key]) => columnMask.guaranteed.has(key)) : Object.entries(tableSchema.columns)).filter(([_key, col]) => isStringLikeSQLTypeString(col.getSQLType()) || isIDLikeSQLTypeString(col.getSQLType()));
 		const searchParam = drizzle_orm.sql`${args.search}`;
 		args.extras = { search_distance: (table) => drizzle_orm.sql`${drizzle_orm.sql.join(columnsToSearch.map(([key]) => {
 			return drizzle_orm.sql`COALESCE((${table[key]}::TEXT <-> ${searchParam}), 1)`;
@@ -1944,14 +2162,15 @@ const createObjectImplementer = ({ db, search, otel, logger: loggerConfig, schem
 			db,
 			table
 		});
+		abilityBuilder._.registerReadAction(table, readAction);
 		if (Object.keys(tableSchema.primaryKey).length === 0) warn(`Could not find primary key for ${String(table)}. Cannot register subscriptions!`, { [ATTR_TABLE]: String(table) });
-		const primaryKey = Object.values(tableSchema.primaryKey)[0];
+		const primaryKeyName = Object.keys(tableSchema.primaryKey)[0];
 		const { registerOnInstance } = makePubSubInstance({ table });
 		return schemaBuilder.drizzleObject(table, {
 			name: refName ?? (0, es_toolkit.capitalize)(String(table)),
 			subscribe: (subscriptions, element, _context) => {
-				if (!primaryKey) return;
-				const primaryKeyValue = element[primaryKey.name];
+				if (!primaryKeyName) return;
+				const primaryKeyValue = element[primaryKeyName];
 				if (!primaryKeyValue) {
 					warn(`Could not find primary key value for element on ${String(table)}. Cannot register subscription!`, { [ATTR_TABLE]: String(table) });
 					return;
@@ -1966,6 +2185,16 @@ const createObjectImplementer = ({ db, search, otel, logger: loggerConfig, schem
 				table,
 				action: readAction
 			}),
+			maskColumns: ({ context, entities, action }) => abilityBuilder._.maskColumns({
+				table,
+				action: action ?? readAction,
+				abilities: context.abilities,
+				entities
+			}),
+			maskPrimaryKeys: {
+				fields: Object.keys(tableSchema.primaryKey),
+				isHidden: (context, row) => abilityBuilder._.primaryKeyHidden(context.abilities, row)
+			},
 			fields: (t) => {
 				const columns = tableSchema.columns;
 				const configMap = /* @__PURE__ */ new Map();
@@ -2201,7 +2430,7 @@ const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: logge
 			db,
 			table
 		});
-		const primaryKeyField = Object.values(tableSchema.primaryKey)[0];
+		const primaryKeyName = Object.keys(tableSchema.primaryKey)[0];
 		const { registerOnInstance } = makePubSubInstance({ table });
 		const pluralName = pluralize.default.plural(String(table));
 		const singularName = pluralize.default.singular(String(table));
@@ -2229,6 +2458,7 @@ const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: logge
 					type: [table],
 					nullable: false,
 					smartSubscription: true,
+					maskColumnsAction: listAction,
 					description: `List all ${pluralName}`,
 					subscribe: (subscriptions, _root, _args, _ctx, _info) => {
 						registerOnInstance({
@@ -2276,11 +2506,12 @@ const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: logge
 					type: table,
 					nullable: false,
 					smartSubscription: true,
+					maskColumnsAction: readAction,
 					description: `Get a single ${singularName} by ID`,
 					args: { id: t.arg.id({ required: true }) },
 					resolve: async (query, _root, args, ctx, _info) => {
 						deepSetProto(args);
-						const filter = (await ctx.abilities[table].filter(readAction)).merge({ where: { [primaryKeyField.name]: args.id } }).query.single;
+						const filter = (await ctx.abilities[table].filter(readAction)).merge({ where: { [primaryKeyName]: args.id } }).query.single;
 						const queryArgs = query(filter);
 						if (filter.columns) queryArgs.columns = filter.columns;
 						return findFirst ? findFirst({
@@ -2548,6 +2779,108 @@ function implementDefaultWhereInputArgs(schemaBuilder) {
 	}) });
 }
 //#endregion
+//#region lib/helpers/objectTypeOptions.ts
+function objectTypeOptionsOfField(buildCache, fieldConfig) {
+	const type = fieldConfig.type;
+	const ref = type.kind === "List" ? type.type.kind === "Object" ? type.type.ref : void 0 : type.kind === "Object" ? type.ref : void 0;
+	if (!ref) return void 0;
+	return buildCache.getTypeConfig(ref, "Object").pothosOptions;
+}
+//#endregion
+//#region lib/helpers/registerPlugin.ts
+const registered = /* @__PURE__ */ new Set();
+function registerPluginOnce(name, plugin) {
+	if (registered.has(name)) return;
+	_pothos_core.default.allowPluginReRegistration = true;
+	_pothos_core.default.registerPlugin(name, plugin);
+	registered.add(name);
+}
+//#endregion
+//#region lib/columnMaskPlugin/maskTypes.ts
+const maskColumnsKey = "maskColumns";
+const maskColumnsActionKey = "maskColumnsAction";
+const maskPrimaryKeysKey = "maskPrimaryKeys";
+const columnMaskPluginName = "ColumnMaskPlugin";
+//#endregion
+//#region lib/columnMaskPlugin/columnMaskPlugin.ts
+var ColumnMaskPlugin = class extends _pothos_core.BasePlugin {
+	wrapResolve(resolver, fieldConfig) {
+		return this.maskResult(this.maskPrimaryKey(resolver, fieldConfig), fieldConfig);
+	}
+	maskPrimaryKey(resolver, fieldConfig) {
+		const primaryKeys = this.buildCache.getTypeConfig(fieldConfig.parentType).pothosOptions[maskPrimaryKeysKey];
+		if (!primaryKeys?.fields.includes(fieldConfig.name)) return resolver;
+		return (parent, args, context, info) => primaryKeys.isHidden(context, parent) ? null : resolver(parent, args, context, info);
+	}
+	maskResult(resolver, fieldConfig) {
+		const maskColumns = objectTypeOptionsOfField(this.buildCache, fieldConfig)?.[maskColumnsKey];
+		if (!maskColumns) return resolver;
+		const action = fieldConfig.pothosOptions[maskColumnsActionKey];
+		const mask = (value, context) => {
+			if (value == null) return value;
+			if (Array.isArray(value) && value.some(_pothos_core.isThenable)) return Promise.all(value).then((rows) => mask(rows, context));
+			const pending = maskColumns({
+				context,
+				entities: Array.isArray(value) ? value : [value],
+				action
+			});
+			return pending ? pending.then(() => value) : value;
+		};
+		return (parent, args, context, info) => {
+			const resolved = resolver(parent, args, context, info);
+			return (0, _pothos_core.isThenable)(resolved) ? resolved.then((value) => mask(value, context)) : mask(resolved, context);
+		};
+	}
+};
+function registerColumnMaskPlugin() {
+	registerPluginOnce(columnMaskPluginName, ColumnMaskPlugin);
+}
+//#endregion
+//#region lib/helpers/abilityAwareClient.ts
+function createAbilityAwareClient({ db, abilityBuilder }) {
+	return (context) => {
+		const apis = /* @__PURE__ */ new Map();
+		const query = new Proxy(db.query, { get(target, table, receiver) {
+			const api = Reflect.get(target, table, receiver);
+			if (typeof table !== "string" || !context.abilities?.[table]) return api;
+			let wrapped = apis.get(table);
+			if (!wrapped) {
+				wrapped = Object.create(api, { findMany: { value: async (config = {}) => {
+					const masked = abilityBuilder._.maskedActions(context.abilities, table);
+					const actions = masked.size ? [...masked] : [abilityBuilder._.readActionOf(table)];
+					return (await Promise.all(actions.map(async (action) => {
+						const ability = (await context.abilities[table].filter(action)).query.many;
+						const { where, extras } = mergeFilters({
+							where: config.where,
+							extras: config.extras
+						}, {
+							where: ability.where,
+							extras: ability.extras
+						});
+						const rows = await api.findMany({
+							...config,
+							where,
+							extras
+						});
+						await abilityBuilder._.maskColumns({
+							table,
+							action,
+							abilities: context.abilities,
+							entities: rows
+						});
+						return rows;
+					}))).flat();
+				} } });
+				apis.set(table, wrapped);
+			}
+			return wrapped;
+		} });
+		return new Proxy(db, { get(target, prop, receiver) {
+			return prop === "query" ? query : Reflect.get(target, prop, receiver);
+		} });
+	};
+}
+//#endregion
 //#region lib/runtimeFiltersPlugin/filterTypes.ts
 const pluginName = "RuntimeFiltersPlugin";
 //#endregion
@@ -2558,14 +2891,9 @@ var RuntimeFiltersPlugin = class extends _pothos_core.BasePlugin {
 	tracerEnabled;
 	logger;
 	telemetryConfig = {};
-	filterLoaders = /* @__PURE__ */ new WeakMap();
 	getLoader(context, filter) {
-		let perContext = this.filterLoaders.get(context);
-		if (!perContext) {
-			perContext = /* @__PURE__ */ new Map();
-			this.filterLoaders.set(context, perContext);
-		}
-		let loader = perContext.get(filter);
+		const loaders = requestStateOf(context.abilities)?.filterLoaders ?? /* @__PURE__ */ new Map();
+		let loader = loaders.get(filter);
 		if (!loader) {
 			const prefetchPromise = filter.prefetch ? filter.prefetch({ context }) : void 0;
 			loader = new dataloader.default(async (entities) => {
@@ -2578,7 +2906,7 @@ var RuntimeFiltersPlugin = class extends _pothos_core.BasePlugin {
 				const allowedSet = new Set(allowed);
 				return entities.map((entity) => allowedSet.has(entity) ? entity : null);
 			}, { cache: false });
-			perContext.set(filter, loader);
+			loaders.set(filter, loader);
 		}
 		return loader;
 	}
@@ -2593,14 +2921,11 @@ var RuntimeFiltersPlugin = class extends _pothos_core.BasePlugin {
 		return typeConfig;
 	}
 	wrapResolve(resolver, fieldConfig) {
-		return async (parent, args, context, info) => {
-			let filters;
-			const fieldType = fieldConfig?.type;
-			if (fieldType.kind === "List") filters = fieldType.type?.ref.currentConfig.pothosOptions[applyFiltersKey];
-			else if (fieldType.kind === "Object") filters = fieldType.ref.currentConfig.pothosOptions[applyFiltersKey];
-			if (!filters || !Array.isArray(filters) || filters.length === 0) return resolver(parent, args, context, info);
+		const filters = objectTypeOptionsOfField(this.buildCache, fieldConfig)?.[applyFiltersKey];
+		if (!filters) return resolver;
+		const allFilters = Array.isArray(filters) ? filters : [filters];
+		const applyFilters = async (parent, args, context, info) => {
 			const runFilters = async (span) => {
-				const allFilters = Array.isArray(filters) ? filters : [filters];
 				span?.setAttribute(ATTR_FILTERS_TOTAL, allFilters.length);
 				const loaders = allFilters.map((filter) => this.getLoader(context, filter));
 				let resolved;
@@ -2655,15 +2980,11 @@ var RuntimeFiltersPlugin = class extends _pothos_core.BasePlugin {
 				throw error;
 			}
 		};
+		return (parent, args, context, info) => allFilters.length === 0 ? resolver(parent, args, context, info) : applyFilters(parent, args, context, info);
 	}
 };
-let registered = false;
 function registerRuntimeFiltersPlugin() {
-	if (!registered) {
-		_pothos_core.default.allowPluginReRegistration = true;
-		_pothos_core.default.registerPlugin(pluginName, RuntimeFiltersPlugin);
-		registered = true;
-	}
+	registerPluginOnce(pluginName, RuntimeFiltersPlugin);
 }
 //#endregion
 //#region lib/scalars/addressValidation.ts
@@ -2794,9 +3115,13 @@ function implementDefaultAddressTypes(schemaBuilder) {
 //#endregion
 //#region lib/scalars/emailAddress.ts
 /**
-* Validates an email address using graphql-scalars' own format check, then lowercases it.
+* Validates an email address using graphql-scalars' own format check, then lowercases it, exactly
+* as the `EmailAddress` scalar does. Exported for values that do not arrive as GraphQL input,
+* such as OIDC claims.
+*
+* @throws RumbleErrorSafe if the value is not a valid email address
 */
-const normalize$1 = (value) => {
+const normalizeEmailAddress = (value) => {
 	try {
 		return graphql_scalars.EmailAddressResolver.parseValue(value).toLowerCase();
 	} catch (error) {
@@ -2807,23 +3132,28 @@ const EmailAddressResolver = new graphql.GraphQLScalarType({
 	name: "EmailAddress",
 	description: `${graphql_scalars.EmailAddressResolver.description} Lowercased.`,
 	specifiedByURL: graphql_scalars.EmailAddressResolver.specifiedByURL,
-	serialize: normalize$1,
-	parseValue: normalize$1,
+	serialize: normalizeEmailAddress,
+	parseValue: normalizeEmailAddress,
 	parseLiteral(ast) {
 		if (ast.kind !== graphql.Kind.STRING) throw new RumbleErrorSafe(`Can only validate strings as email addresses but got a: ${ast.kind}`);
-		return normalize$1(ast.value);
+		return normalizeEmailAddress(ast.value);
 	}
 });
 //#endregion
 //#region lib/scalars/personName.ts
 const MAX_LENGTH = 200;
 const NAME_REGEX = /^[\p{L}\p{M}]+(?:(?:[ '-]|\.\x20?)[\p{L}\p{M}]+)*\.?$/u;
+const APOSTROPHE_VARIANTS = /[\u2018\u2019\u02BC\u00B4\u0060]/gu;
+const HYPHEN_VARIANTS = /[\u2010-\u2015\u2212]/gu;
 /**
-* Normalizes and validates a person's name.
+* Normalizes and validates a person's name, exactly as the `PersonName` scalar does. Exported
+* for values that do not arrive as GraphQL input, such as OIDC claims.
+*
+* @throws RumbleErrorSafe if the value is not a valid name
 */
-const normalize = (value) => {
+const normalizePersonName = (value) => {
 	if (typeof value !== "string") throw new RumbleErrorSafe(`Name value is not a string: ${value}`);
-	const normalized = value.normalize("NFC").replace(/[\p{Cc}\p{Cf}]/gu, "").replace(/\p{Zs}+/gu, " ").trim().replace(/([-'])\1+/gu, "$1").replace(/^[-']+|[-']+$/gu, "").trim();
+	const normalized = value.normalize("NFC").replace(/[\p{Cc}\p{Cf}]/gu, "").replace(APOSTROPHE_VARIANTS, "'").replace(HYPHEN_VARIANTS, "-").replace(/\p{Zs}+/gu, " ").trim().replace(/ ?- ?/gu, "-").replace(/([-'])\1+/gu, "$1").replace(/^[-']+|[-']+$/gu, "").trim();
 	if (normalized.length === 0) throw new RumbleErrorSafe("Name must not be empty.");
 	if (normalized.length > MAX_LENGTH) throw new RumbleErrorSafe(`Name must not be longer than ${MAX_LENGTH} characters.`);
 	if (!NAME_REGEX.test(normalized)) throw new RumbleErrorSafe(`Invalid name: ${value}. Names may only contain letters and the separators space, apostrophe, hyphen and period, and may not start with or repeat a separator.`);
@@ -2831,12 +3161,12 @@ const normalize = (value) => {
 };
 const PersonNameResolver = new graphql.GraphQLScalarType({
 	name: "PersonName",
-	description: "A person's name. Unicode letters from any script are allowed, along with space, apostrophe, hyphen and period as separators between name parts. The value is Unicode NFC normalized, has invisible/control characters stripped, has its whitespace collapsed, and has unambiguous typos (a doubled or stray leading/trailing hyphen/apostrophe) silently corrected rather than rejected.",
-	serialize: normalize,
-	parseValue: normalize,
+	description: "A person's name. Unicode letters from any script are allowed, along with space, apostrophe, hyphen and period as separators between name parts. The value is Unicode NFC normalized, has invisible/control characters stripped, has its whitespace collapsed, and has unambiguous typos (typographic apostrophe or dash variants, spaces around a hyphen, a doubled or stray leading/trailing hyphen/apostrophe) silently corrected rather than rejected.",
+	serialize: normalizePersonName,
+	parseValue: normalizePersonName,
 	parseLiteral(ast) {
 		if (ast.kind !== graphql.Kind.STRING) throw new RumbleErrorSafe(`Can only validate strings as names but got a: ${ast.kind}`);
-		return normalize(ast.value);
+		return normalizePersonName(ast.value);
 	}
 });
 //#endregion
@@ -2844,9 +3174,12 @@ const PersonNameResolver = new graphql.GraphQLScalarType({
 /**
 * Parses and validates a phone number using libphonenumber-js (Google's phone number metadata),
 * which checks real per-country validity (length, area code plausibility, ...) rather than just
-* the E.164 shape.
+* the E.164 shape. This is what the `PhoneNumber` scalar does with its input; exported for values
+* that do not arrive as GraphQL input. `.number` of the result is the E.164 form.
+*
+* @throws RumbleErrorSafe if the value is not a valid phone number
 */
-const parse = (value) => {
+const parsePhoneNumber = (value) => {
 	if (typeof value !== "string") throw new RumbleErrorSafe(`Phone number value is not a string: ${value}`);
 	const phoneNumber = (0, libphonenumber_js.parsePhoneNumberFromString)(value);
 	if (!phoneNumber?.isValid()) throw new RumbleErrorSafe(`Invalid phone number: ${value}. Please provide a valid phone number including its country calling code, e.g. +4915123456789.`);
@@ -2862,26 +3195,28 @@ const serialize = (value) => {
 		if (!phoneNumber.isValid()) throw new RumbleErrorSafe(`Invalid phone number: ${phoneNumber.number}`);
 		return phoneNumber.number;
 	}
-	return parse(value).number;
+	return parsePhoneNumber(value).number;
 };
 const PhoneNumberResolver = new graphql.GraphQLScalarType({
 	name: "PhoneNumber",
 	description: "A phone number, validated using real per-country validity rules and represented as a parsed libphonenumber-js PhoneNumber. On the wire it is transported as the E.164 format (https://en.wikipedia.org/wiki/E.164), e.g. +4915123456789. The country calling code is required.",
 	serialize,
-	parseValue: parse,
+	parseValue: parsePhoneNumber,
 	parseLiteral(ast) {
 		if (ast.kind !== graphql.Kind.STRING) throw new RumbleErrorSafe(`Can only validate strings as phone numbers but got a: ${ast.kind}`);
-		return parse(ast.value);
+		return parsePhoneNumber(ast.value);
 	}
 });
 //#endregion
 //#region lib/schemaBuilder.ts
-const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validation }) => {
+const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validation, abilityBuilder }) => {
 	const createSpan = otel?.enabled && otel.tracer ? (0, _pothos_tracing_opentelemetry.createOpenTelemetryWrapper)(otel.tracer, otel.options) : void 0;
 	registerRuntimeFiltersPlugin();
+	registerColumnMaskPlugin();
 	const schemaBuilder = new _pothos_core.default({
 		...pothosConfig,
 		plugins: [
+			columnMaskPluginName,
 			pluginName,
 			_pothos_plugin_drizzle.default,
 			_pothos_plugin_smart_subscriptions.default,
@@ -2890,13 +3225,19 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validatio
 			...pothosConfig?.plugins ?? []
 		],
 		drizzle: {
-			client: db,
+			client: createAbilityAwareClient({
+				db,
+				abilityBuilder
+			}),
 			relations: db._.relations,
 			getTableConfig(table) {
-				const columns = (0, drizzle_orm.isTable)(table) ? Object.values((0, drizzle_orm.getTableColumns)(table)) : [];
+				if ((0, drizzle_orm.is)(table, drizzle_orm_pg_core.PgTable)) return (0, drizzle_orm_pg_core.getTableConfig)(table);
+				if ((0, drizzle_orm.is)(table, drizzle_orm_mysql_core.MySqlTable)) return (0, drizzle_orm_mysql_core.getTableConfig)(table);
+				if ((0, drizzle_orm.is)(table, drizzle_orm_sqlite_core.SQLiteTable)) return (0, drizzle_orm_sqlite_core.getTableConfig)(table);
 				return {
-					columns,
-					primaryKeys: columns.filter((v) => v.primary)
+					columns: (0, drizzle_orm.isTable)(table) ? Object.values((0, drizzle_orm.getTableColumns)(table)) : [],
+					primaryKeys: [],
+					uniqueConstraints: []
 				};
 			}
 		},
@@ -3015,7 +3356,8 @@ export const r = rumble({
 	const { makePubSubInstance, pubsub } = createPubSubInstance({ ...rumbleInput });
 	const { schemaBuilder } = createSchemaBuilder({
 		...rumbleInput,
-		pubsub
+		pubsub,
+		abilityBuilder
 	});
 	const enum_ = createEnumImplementer({
 		...rumbleInput,
@@ -3284,6 +3626,9 @@ exports.RumbleErrorSafe = RumbleErrorSafe;
 exports.assertFindFirstExists = assertFindFirstExists;
 exports.assertFirstEntryExists = assertFirstEntryExists;
 exports.mapNullFieldsToUndefined = mapNullFieldsToUndefined;
+exports.normalizeEmailAddress = normalizeEmailAddress;
+exports.normalizePersonName = normalizePersonName;
+exports.parsePhoneNumber = parsePhoneNumber;
 exports.rumble = rumble;
 
 //# sourceMappingURL=index.cjs.map