@m1212e/rumble 0.24.2 → 0.25.2

package/out/index.d.cts

@@ -1,8 +1,12 @@
 import { GraphQLError, GraphQLSchema } from "graphql";
-import { Table } from "drizzle-orm";
+import { SQL, Table } from "drizzle-orm";
 import { MySqlAsyncDatabase } from "drizzle-orm/mysql-core";
 import { PgAsyncDatabase } from "drizzle-orm/pg-core";
 import { SQLiteAsyncDatabase } from "drizzle-orm/sqlite-core";
+import { Tracer } from "@opentelemetry/api";
+import SchemaBuilder from "@pothos/core";
+import { TracingWrapperOptions } from "@pothos/tracing-opentelemetry";
+import { YogaServerOptions, createPubSub } from "graphql-yoga";
 import { IncomingMessage, RequestListener, ServerResponse } from "node:http";
 import { Http2ServerRequest, Http2ServerResponse } from "node:http2";
 import { Socket } from "node:net";
@@ -10,10 +14,7 @@ import "@whatwg-node/fetch";
 import { EnvelopArmorPlugin } from "@escape.tech/graphql-armor";
 import { useSofa } from "@m1212e/sofa-api";
 import { ServerOptions } from "graphql-ws";
-import { YogaServerOptions, createPubSub } from "graphql-yoga";
-import { Tracer } from "@opentelemetry/api";
-import SchemaBuilder from "@pothos/core";
-import { TracingWrapperOptions } from "@pothos/tracing-opentelemetry";
+import { PhoneNumber } from "libphonenumber-js";
 //#endregion
 //#region lib/helpers/asserts.d.ts
 /**
@@ -170,6 +171,25 @@ type DrizzleQueryFunctionInput<DB extends DrizzleInstance, QueryField extends ke
  */
 type DrizzleTableValueType<DB extends DrizzleInstance, QueryField extends keyof DrizzleQueryFunction<DB>> = NonNullable<Awaited<ReturnType<DrizzleQueryFunction<DB>[QueryField]["findFirst"]>>>;
 //#endregion
+//#region lib/abilityBuilder/queryFilter.d.ts
+/**
+ * Static, non changing query filter input type for a specific table
+ */
+type StaticQueryFilter<DB extends DrizzleInstance, Table extends keyof DrizzleQueryFunction<DB>, Filter extends DrizzleQueryFunctionInput<DB, Table>> = Filter;
+/**
+ * Dynamic, context based query filter input type for a specific table
+ */
+type DynamicQueryFilter<DB extends DrizzleInstance, Table extends keyof DrizzleQueryFunction<DB>, Filter extends DrizzleQueryFunctionInput<DB, Table>, Context> = (context: Context) => StaticQueryFilter<DB, Table, Filter> | undefined | "allow" | Promise<StaticQueryFilter<DB, Table, Filter> | undefined | "allow">;
+/**
+ * Combined query filter type for a specific table. May be static or dynamic.
+ */
+type QueryFilter<DB extends DrizzleInstance, Table extends keyof DrizzleQueryFunction<DB>, Filter extends DrizzleQueryFunctionInput<DB, Table>, Context> = StaticQueryFilter<DB, Table, Filter> | DynamicQueryFilter<DB, Table, Filter, Context>;
+/**
+ * The query filters registered per action. "unrestricted" when a bare allow()
+ * granted the action without conditions.
+ */
+type QueryFilterRegistry<UserContext extends Record<string, any>, DB extends DrizzleInstance, Action extends string, TableName extends keyof DrizzleQueryFunction<DB>> = Map<Action, QueryFilter<DB, TableName, DrizzleQueryFunctionInput<DB, TableName>, UserContext>[] | "unrestricted">;
+//#endregion
 //#region lib/runtimeFiltersPlugin/filterTypes.d.ts
 type Prefetch<Context, ReturnType> = (params: {
   context: Context;
@@ -184,6 +204,240 @@ type FilterPrefetchCombo<Context, FilteredEntityType, PrefetchReturnType = never
   prefetch?: Prefetch<Context, PrefetchReturnType>;
 };
 //#endregion
+//#region lib/types/rumbleInput.d.ts
+interface RumbleLogger {
+  info(obj: Record<string, unknown>, msg: string): void;
+  warn(obj: Record<string, unknown>, msg: string): void;
+  error(obj: Record<string, unknown>, msg: string): void;
+  debug(obj: Record<string, unknown>, msg: string): void;
+  child(bindings: Record<string, unknown>): RumbleLogger;
+}
+type CustomRumblePothosConfig = Omit<ConstructorParameters<typeof SchemaBuilder>[0], "smartSubscriptions" | "drizzle" | "validation">;
+type RumbleInput<UserContext extends Record<string, any>, DB extends DrizzleInstance, RequestEvent extends Record<string, any>, Action extends string, PothosConfig extends CustomRumblePothosConfig, Schema extends Record<string, any> = Record<string, any>> = {
+  /**
+   * Your drizzle database instance
+   */
+  db: DB;
+  /**
+   * The drizzle schema object (the same one passed to `defineRelations`).
+   */
+  schema: Schema;
+  /**
+   * A function for providing context for each request based on the incoming HTTP Request.
+   * The type of the parameter equals the HTTPRequest type of your chosen server.
+   */
+  context?: ((event: RequestEvent) => Promise<UserContext> | UserContext) | undefined;
+  /**
+   * The actions that are available
+   */
+  actions?: Action[];
+  /**
+   * Customization for subscriptions. See https://the-guild.dev/graphql/yoga-server/docs/features/subscriptions#distributed-pubsub-for-production
+   */
+  subscriptions?: Parameters<typeof createPubSub>;
+  /**
+   * Options passed along to the pothos schema builder.
+   */
+  pothosConfig?: PothosConfig;
+  /**
+   * Limits the returned amount when querying lists. Set to null to disable.
+   * @default 100
+   */
+  defaultLimit?: number | undefined | null;
+  /**
+   * rumble supports fuzzy search for the query helpers. This enables the users of your API to search for entities via fuzzy search inputs.
+   * This currently only is supported by postgres databases and will fail if enabled on other dialects.
+   *
+   * Please note that this will install the pg_trgm extension on startup if your database does not have it already installed.
+   * https://www.postgresql.org/docs/current/pgtrgm.html
+   */
+  search?: {
+    /**
+     * Whether search is enabled
+     */
+    enabled?: boolean;
+    /**
+     * The cuttoff factor to reduce the amount of returned results.
+     * Defaults to 0.3. Lower values will return more results.
+     */
+    threshold?: number;
+    /**
+     * Will perform a local
+     * SET cpu_operator_cost = x;
+     * for search queries. This can help to make the planner
+     * use a potential index scan instead of a sequential scan.
+     * This will not affect queries that are not using the search feature.
+     */
+    cpu_operator_cost?: number;
+  } | undefined;
+  /**
+   * rumble can set up otel tracing if you want to. This will provide details of execution time and outcome to the provided tracer. See https://pothos-graphql.dev/docs/plugins/tracing#install for more information.
+   *
+   * The emitted spans and attributes are identical for every transport, so an
+   * operation served via GraphQL, the SOFA REST adapter or WebSockets produces
+   * the same trace shape (see `rumble.transport` to tell them apart).
+   */
+  otel?: {
+    /**
+     * Whether otel tracing should be enabled. This will create a tracer if none is provided.
+     */
+    enabled?: boolean;
+    /**
+     * The tracer to use. If enabled is true and no tracer is provided, a tracer will be created.
+     */
+    tracer?: Tracer;
+    /**
+     * You can pass options to the tracing wrapper
+     */
+    options?: TracingWrapperOptions<unknown>;
+    /**
+     * Whether the operation source is attached to operation spans as
+     * `graphql.document`.
+     *
+     * Keep in mind that a document can carry inline argument literals, so this
+     * may contain user data.
+     * @default true
+     */
+    includeDocument?: boolean;
+    /**
+     * Whether the incoming operation variables are attached to operation spans
+     * as `graphql.variables.<name>` attributes.
+     *
+     * Variables regularly carry personal data, so you can turn this off
+     * entirely (`false`) or pass a function to redact or drop single entries
+     * before they leave the process.
+     *
+     * @example
+     * ```ts
+     * otel: {
+     *   enabled: true,
+     *   includeVariables: ({ password, ...rest }) => rest,
+     * }
+     * ```
+     * @default true
+     */
+    includeVariables?: boolean | ((variables: Record<string, unknown>) => Record<string, unknown> | undefined);
+  };
+  /**
+   * Structured logging for rumble internals. Pass a pino (or compatible) logger instance.
+   * When enabled, rumble emits structured log entries for GraphQL operations, ability checks,
+   * and runtime filter applications — queryable by level and field in Loki or similar.
+   */
+  logger?: {
+    /**
+     * Whether structured logging should be enabled.
+     */
+    enabled?: boolean;
+    /**
+     * The logger instance to use. Must satisfy the RumbleLogger interface (pino satisfies this).
+     */
+    logger: RumbleLogger;
+    /**
+     * When both logger and otel are enabled, inject `trace_id`, `span_id` and `trace_flags`
+     * fields into every log entry emitted during a GraphQL operation. Useful for correlating
+     * log lines with traces in backends like Jaeger or Grafana Tempo.
+     * @default true
+     */
+    injectTraceId?: boolean;
+    /**
+     * Whether the incoming operation variables are attached to the operation
+     * start log entry as a `graphql.variables` object.
+     *
+     * Variables regularly carry personal data, so you can turn this off
+     * entirely (`false`) or pass a function to redact or drop single entries
+     * before they are logged.
+     *
+     * @example
+     * ```ts
+     * logger: {
+     *   enabled: true,
+     *   logger: pino(),
+     *   includeVariables: ({ password, ...rest }) => rest,
+     * }
+     * ```
+     * @default true
+     */
+    includeVariables?: boolean | ((variables: Record<string, unknown>) => Record<string, unknown> | undefined);
+  };
+  /**
+   * Configures `@pothos/plugin-validation`, which rumble installs by default to power
+   * `Address`/`AddressInput`'s country-aware validation (see `implementDefaultAddressTypes`).
+   */
+  validation?: NonNullable<ConstructorParameters<typeof SchemaBuilder>[0]>["validation"];
+};
+//#endregion
+//#region lib/abilityBuilder/columnMask.d.ts
+type MaskColumnsInput<DB extends DrizzleInstance, Action extends string> = {
+  table: TableRelationNames<DB>;
+  action: Action;
+  abilities: Record<string, any>;
+  entities: unknown[];
+};
+//#endregion
+//#region lib/abilityBuilder/filterResponse.d.ts
+type FindFirstConfig<DB extends DrizzleInstance, TableName extends TableRelationNames<DB>> = NonNullable<Parameters<DB["query"][TableName]["findFirst"]>[0]>;
+type FindManyConfig<DB extends DrizzleInstance, TableName extends TableRelationNames<DB>> = NonNullable<Parameters<DB["query"][TableName]["findMany"]>[0]>;
+/**
+ * The query filters of an ability, as handed out by
+ * `abilities.<table>.filter(...)`.
+ *
+ * `columns` and `extras` are set at runtime but left out of the types on
+ * purpose: a visible, loosely typed extras makes drizzle infer `{}` as the row
+ * type of findFirst/findMany, and the column flag is an internal detail anyway.
+ */
+type AbilityFilter<DB extends DrizzleInstance, TableName extends TableRelationNames<DB>> = {
+  /**
+   * Query filters for the drizzle query API.
+   * @example
+   * ```ts
+   * author: t.relation("author", {
+   *  query: async (_args, ctx) => (await ctx.abilities.users.filter("read")).query.single,
+   * }),
+   * ```
+   */
+  query: {
+    /**
+     * For find first calls
+     */
+    single: Pick<FindFirstConfig<DB, TableName>, "where">;
+    /**
+     * For find many calls
+     */
+    many: Pick<FindManyConfig<DB, TableName>, "where" | "limit">;
+  };
+  /**
+   * Query filters for the drizzle SQL API as used in e.g. updates.
+   * @example
+   *
+   * ```ts
+   * await db
+   *	.update(schema.users)
+   *	.set({
+   *	  name: args.newName,
+   * 	})
+   *	.where(
+   *	  and(
+   *	    eq(schema.users.id, args.userId),
+   *	    (await ctx.abilities.users.filter("update")).sql.where,
+   *	  ),
+   *	);
+   * ```
+   *
+   */
+  sql: {
+    readonly where: SQL | undefined;
+  };
+};
+/**
+ * What `abilities.<table>.filter(...)` resolves to.
+ */
+type AbilityFilterResponse<DB extends DrizzleInstance, TableName extends TableRelationNames<DB>> = AbilityFilter<DB, TableName> & {
+  /**
+   * Merges the current query filters with the provided filters for this call only
+   */
+  merge: (filters: NonNullable<DrizzleQueryFunctionInput<DB, TableName>>) => AbilityFilter<DB, TableName>;
+};
+//#endregion
 //#region lib/scalars/address.d.ts
 /**
  * The shape of a postal address, modeled after the OIDC `address` claim
@@ -4401,168 +4655,6 @@ type RouteWithTypesOpts<TServerContext, TMethod extends HTTPMethod, TPath extend
 };
 type ExtractPathParamsWithPattern<TPath extends string> = Pipe<TPath, [Strings.Split<'/'>, Tuples.Filter<Strings.StartsWith<':'>>, Tuples.Map<Strings.Trim<':'>>, Tuples.ToUnion]>;
 //#endregion
-//#region lib/types/rumbleInput.d.ts
-interface RumbleLogger {
-  info(obj: Record<string, unknown>, msg: string): void;
-  warn(obj: Record<string, unknown>, msg: string): void;
-  error(obj: Record<string, unknown>, msg: string): void;
-  debug(obj: Record<string, unknown>, msg: string): void;
-  child(bindings: Record<string, unknown>): RumbleLogger;
-}
-type CustomRumblePothosConfig = Omit<ConstructorParameters<typeof SchemaBuilder>[0], "smartSubscriptions" | "drizzle" | "validation">;
-type RumbleInput<UserContext extends Record<string, any>, DB extends DrizzleInstance, RequestEvent extends Record<string, any>, Action extends string, PothosConfig extends CustomRumblePothosConfig, Schema extends Record<string, any> = Record<string, any>> = {
-  /**
-   * Your drizzle database instance
-   */
-  db: DB;
-  /**
-   * The drizzle schema object (the same one passed to `defineRelations`).
-   */
-  schema: Schema;
-  /**
-   * A function for providing context for each request based on the incoming HTTP Request.
-   * The type of the parameter equals the HTTPRequest type of your chosen server.
-   */
-  context?: ((event: RequestEvent) => Promise<UserContext> | UserContext) | undefined;
-  /**
-   * The actions that are available
-   */
-  actions?: Action[];
-  /**
-   * Customization for subscriptions. See https://the-guild.dev/graphql/yoga-server/docs/features/subscriptions#distributed-pubsub-for-production
-   */
-  subscriptions?: Parameters<typeof createPubSub>;
-  /**
-   * Options passed along to the pothos schema builder.
-   */
-  pothosConfig?: PothosConfig;
-  /**
-   * Limits the returned amount when querying lists. Set to null to disable.
-   * @default 100
-   */
-  defaultLimit?: number | undefined | null;
-  /**
-   * rumble supports fuzzy search for the query helpers. This enables the users of your API to search for entities via fuzzy search inputs.
-   * This currently only is supported by postgres databases and will fail if enabled on other dialects.
-   *
-   * Please note that this will install the pg_trgm extension on startup if your database does not have it already installed.
-   * https://www.postgresql.org/docs/current/pgtrgm.html
-   */
-  search?: {
-    /**
-     * Whether search is enabled
-     */
-    enabled?: boolean;
-    /**
-     * The cuttoff factor to reduce the amount of returned results.
-     * Defaults to 0.3. Lower values will return more results.
-     */
-    threshold?: number;
-    /**
-     * Will perform a local
-     * SET cpu_operator_cost = x;
-     * for search queries. This can help to make the planner
-     * use a potential index scan instead of a sequential scan.
-     * This will not affect queries that are not using the search feature.
-     */
-    cpu_operator_cost?: number;
-  } | undefined;
-  /**
-   * rumble can set up otel tracing if you want to. This will provide details of execution time and outcome to the provided tracer. See https://pothos-graphql.dev/docs/plugins/tracing#install for more information.
-   *
-   * The emitted spans and attributes are identical for every transport, so an
-   * operation served via GraphQL, the SOFA REST adapter or WebSockets produces
-   * the same trace shape (see `rumble.transport` to tell them apart).
-   */
-  otel?: {
-    /**
-     * Whether otel tracing should be enabled. This will create a tracer if none is provided.
-     */
-    enabled?: boolean;
-    /**
-     * The tracer to use. If enabled is true and no tracer is provided, a tracer will be created.
-     */
-    tracer?: Tracer;
-    /**
-     * You can pass options to the tracing wrapper
-     */
-    options?: TracingWrapperOptions<unknown>;
-    /**
-     * Whether the operation source is attached to operation spans as
-     * `graphql.document`.
-     *
-     * Keep in mind that a document can carry inline argument literals, so this
-     * may contain user data.
-     * @default true
-     */
-    includeDocument?: boolean;
-    /**
-     * Whether the incoming operation variables are attached to operation spans
-     * as `graphql.variables.<name>` attributes.
-     *
-     * Variables regularly carry personal data, so you can turn this off
-     * entirely (`false`) or pass a function to redact or drop single entries
-     * before they leave the process.
-     *
-     * @example
-     * ```ts
-     * otel: {
-     *   enabled: true,
-     *   includeVariables: ({ password, ...rest }) => rest,
-     * }
-     * ```
-     * @default true
-     */
-    includeVariables?: boolean | ((variables: Record<string, unknown>) => Record<string, unknown> | undefined);
-  };
-  /**
-   * Structured logging for rumble internals. Pass a pino (or compatible) logger instance.
-   * When enabled, rumble emits structured log entries for GraphQL operations, ability checks,
-   * and runtime filter applications — queryable by level and field in Loki or similar.
-   */
-  logger?: {
-    /**
-     * Whether structured logging should be enabled.
-     */
-    enabled?: boolean;
-    /**
-     * The logger instance to use. Must satisfy the RumbleLogger interface (pino satisfies this).
-     */
-    logger: RumbleLogger;
-    /**
-     * When both logger and otel are enabled, inject `trace_id`, `span_id` and `trace_flags`
-     * fields into every log entry emitted during a GraphQL operation. Useful for correlating
-     * log lines with traces in backends like Jaeger or Grafana Tempo.
-     * @default true
-     */
-    injectTraceId?: boolean;
-    /**
-     * Whether the incoming operation variables are attached to the operation
-     * start log entry as a `graphql.variables` object.
-     *
-     * Variables regularly carry personal data, so you can turn this off
-     * entirely (`false`) or pass a function to redact or drop single entries
-     * before they are logged.
-     *
-     * @example
-     * ```ts
-     * logger: {
-     *   enabled: true,
-     *   logger: pino(),
-     *   includeVariables: ({ password, ...rest }) => rest,
-     * }
-     * ```
-     * @default true
-     */
-    includeVariables?: boolean | ((variables: Record<string, unknown>) => Record<string, unknown> | undefined);
-  };
-  /**
-   * Configures `@pothos/plugin-validation`, which rumble installs by default to power
-   * `Address`/`AddressInput`'s country-aware validation (see `implementDefaultAddressTypes`).
-   */
-  validation?: NonNullable<ConstructorParameters<typeof SchemaBuilder>[0]>["validation"];
-};
-//#endregion
 //#region lib/rumble.d.ts
 export declare const rumble: <UserContext extends Record<string, any>, DB extends DrizzleInstance, RequestEvent extends Record<string, any>, PothosConfig extends CustomRumblePothosConfig, Schema extends Record<string, any>, Action extends string = "delete" | "read" | "update">(rumbleInput: RumbleInput<UserContext, DB, RequestEvent, Action, PothosConfig> & {
   schema: Schema;
@@ -4585,44 +4677,31 @@ export declare const rumble: <UserContext extends Record<string, any>, DB extend
        */
   abilityBuilder: { [key in TableRelationNames<DB>]: {
     allow: (action: Action | Action[]) => {
-      when: (queryFilter: ((context: UserContext) => "allow" | Promise<"allow" | DrizzleQueryFunctionInput<DB, key> | undefined> | DrizzleQueryFunctionInput<DB, key> | undefined) | DrizzleQueryFunctionInput<DB, key>) => void;
+      when: (queryFilter: QueryFilter<DB, key, DrizzleQueryFunctionInput<DB, key>, UserContext>) => void;
     };
     filter: (action: Action | Action[]) => {
+      by: (explicitFilter: Filter<UserContext, DrizzleTableValueType<DB, key>, never>) => void;
       prefetch: <PrefetchReturnType>(prefetch: Prefetch<UserContext, PrefetchReturnType>) => {
         by: (explicitFilter: Filter<UserContext, DrizzleTableValueType<DB, key>, PrefetchReturnType>) => void;
       };
-      by: (explicitFilter: Filter<UserContext, DrizzleTableValueType<DB, key>>) => void;
     };
     _: {
       runtimeFilters: Map<Action, FilterPrefetchCombo<UserContext, any, any>[]>;
-      queryFilters: Map<Action, "unrestricted" | (((context: UserContext) => "allow" | Promise<"allow" | DrizzleQueryFunctionInput<DB, key> | undefined> | DrizzleQueryFunctionInput<DB, key> | undefined) | DrizzleQueryFunctionInput<DB, key>)[]>;
+      queryFilters: QueryFilterRegistry<UserContext, DB, Action, key>;
     };
   }; } & {
     _: {
+      maskColumns: (input: MaskColumnsInput<DB, Action>) => void | Promise<void>;
+      maskedActions: (abilities: object, table: TableRelationNames<DB>) => Set<Action>;
+      primaryKeyHidden: (abilities: object, row: object) => boolean;
+      registerReadAction(table: TableRelationNames<DB>, action: Action): void;
+      readActionOf(table: TableRelationNames<DB>): Action;
       registeredFilters({ action, table }: {
         table: TableRelationNames<DB>;
         action: Action;
       }): Filter<UserContext, DrizzleTableValueType<DB, TableRelationNames<DB>>>[];
       build(): (ctx: UserContext) => { [key in TableRelationNames<DB>]: {
-        filter: (action: Action) => Promise<{
-          query: {
-            single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-            many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-          };
-          sql: {
-            readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-          };
-        } & {
-          merge: (p: NonNullable<DrizzleQueryFunctionInput<DB, key>>) => {
-            query: {
-              single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-              many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-            };
-            sql: {
-              readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-            };
-          };
-        }>;
+        filter: (action: Action) => Promise<AbilityFilterResponse<DB, key>>;
       }; };
     };
   };
@@ -4632,25 +4711,7 @@ export declare const rumble: <UserContext extends Record<string, any>, DB extend
   schemaBuilder: PothosSchemaTypes.SchemaBuilder<PothosSchemaTypes.ExtendDefaultTypes<{
     Context: Awaited<UserContext & {
       abilities: { [key in TableRelationNames<DB>]: {
-        filter: (action: Action) => Promise<{
-          query: {
-            single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-            many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-          };
-          sql: {
-            readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-          };
-        } & {
-          merge: (p: NonNullable<DrizzleQueryFunctionInput<DB, key>>) => {
-            query: {
-              single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-              many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-            };
-            sql: {
-              readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-            };
-          };
-        }>;
+        filter: (action: Action) => Promise<AbilityFilterResponse<DB, key>>;
       }; };
     }>;
     DrizzleRelations: DB["_"]["relations"];
@@ -4790,25 +4851,7 @@ export declare const rumble: <UserContext extends Record<string, any>, DB extend
     adjust?: ((t: import("@pothos/plugin-drizzle").DrizzleObjectFieldBuilder<PothosSchemaTypes.ExtendDefaultTypes<{
       Context: Awaited<UserContext & {
         abilities: { [key in TableRelationNames<DB>]: {
-          filter: (action: Action) => Promise<{
-            query: {
-              single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-              many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-            };
-            sql: {
-              readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-            };
-          } & {
-            merge: (p: NonNullable<DrizzleQueryFunctionInput<DB, key>>) => {
-              query: {
-                single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-                many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-              };
-              sql: {
-                readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-              };
-            };
-          }>;
+          filter: (action: Action) => Promise<AbilityFilterResponse<DB, key>>;
         }; };
       }>;
       DrizzleRelations: DB["_"]["relations"];
@@ -4887,25 +4930,7 @@ export declare const rumble: <UserContext extends Record<string, any>, DB extend
   }) => import("@pothos/plugin-drizzle").DrizzleObjectRef<PothosSchemaTypes.ExtendDefaultTypes<{
     Context: Awaited<UserContext & {
       abilities: { [key in TableRelationNames<DB>]: {
-        filter: (action: Action) => Promise<{
-          query: {
-            single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-            many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-          };
-          sql: {
-            readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-          };
-        } & {
-          merge: (p: NonNullable<DrizzleQueryFunctionInput<DB, key>>) => {
-            query: {
-              single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-              many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-            };
-            sql: {
-              readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-            };
-          };
-        }>;
+        filter: (action: Action) => Promise<AbilityFilterResponse<DB, key>>;
       }; };
     }>;
     DrizzleRelations: DB["_"]["relations"];
@@ -4995,25 +5020,7 @@ export declare const rumble: <UserContext extends Record<string, any>, DB extend
   })) => PothosSchemaTypes.InputObjectRef<PothosSchemaTypes.ExtendDefaultTypes<{
     Context: Awaited<UserContext & {
       abilities: { [key in TableRelationNames<DB>]: {
-        filter: (action: Action) => Promise<{
-          query: {
-            single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-            many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-          };
-          sql: {
-            readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-          };
-        } & {
-          merge: (p: NonNullable<DrizzleQueryFunctionInput<DB, key>>) => {
-            query: {
-              single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-              many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-            };
-            sql: {
-              readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-            };
-          };
-        }>;
+        filter: (action: Action) => Promise<AbilityFilterResponse<DB, key>>;
       }; };
     }>;
     DrizzleRelations: DB["_"]["relations"];
@@ -5133,25 +5140,7 @@ export declare const rumble: <UserContext extends Record<string, any>, DB extend
   })) => PothosSchemaTypes.EnumRef<PothosSchemaTypes.ExtendDefaultTypes<{
     Context: Awaited<UserContext & {
       abilities: { [key in TableRelationNames<DB>]: {
-        filter: (action: Action) => Promise<{
-          query: {
-            single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-            many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-          };
-          sql: {
-            readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-          };
-        } & {
-          merge: (p: NonNullable<DrizzleQueryFunctionInput<DB, key>>) => {
-            query: {
-              single: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findFirst"]>[0]>>, "where">;
-              many: Pick<NonNullable<NonNullable<Parameters<DB["query"][key]["findMany"]>[0]>>, "limit" | "where">;
-            };
-            sql: {
-              readonly where: import("drizzle-orm").SQL<unknown> | undefined;
-            };
-          };
-        }>;
+        filter: (action: Action) => Promise<AbilityFilterResponse<DB, key>>;
       }; };
     }>;
     DrizzleRelations: DB["_"]["relations"];
@@ -5244,6 +5233,36 @@ export declare const rumble: <UserContext extends Record<string, any>, DB extend
   buildSchema: () => GraphQLSchema;
 };
 //#endregion
+//#region lib/scalars/emailAddress.d.ts
+/**
+ * Validates an email address using graphql-scalars' own format check, then lowercases it, exactly
+ * as the `EmailAddress` scalar does. Exported for values that do not arrive as GraphQL input,
+ * such as OIDC claims.
+ *
+ * @throws RumbleErrorSafe if the value is not a valid email address
+ */
+export declare const normalizeEmailAddress: (value: unknown) => string;
+//#endregion
+//#region lib/scalars/personName.d.ts
+/**
+ * Normalizes and validates a person's name, exactly as the `PersonName` scalar does. Exported
+ * for values that do not arrive as GraphQL input, such as OIDC claims.
+ *
+ * @throws RumbleErrorSafe if the value is not a valid name
+ */
+export declare const normalizePersonName: (value: unknown) => string;
+//#endregion
+//#region lib/scalars/phoneNumber.d.ts
+/**
+ * Parses and validates a phone number using libphonenumber-js (Google's phone number metadata),
+ * which checks real per-country validity (length, area code plausibility, ...) rather than just
+ * the E.164 shape. This is what the `PhoneNumber` scalar does with its input; exported for values
+ * that do not arrive as GraphQL input. `.number` of the result is the E.164 form.
+ *
+ * @throws RumbleErrorSafe if the value is not a valid phone number
+ */
+export declare const parsePhoneNumber: (value: unknown) => PhoneNumber;
+//#endregion
 //#region lib/types/rumbleError.d.ts
 /**
  * An error that gets raised by rumble whenever something does not go according to plan.