@m1212e/rumble 0.27.0 → 0.27.4

package/out/index.mjs

@@ -1,18 +1,18 @@
-import { t as generateFromSchema } from "./generate-BySnFVve.mjs";
-import { One, aliasedTable, asc, count, desc, getTableColumns, getTableName, is, isTable, or, relationsFilterToSQL, sql } from "drizzle-orm";
+import { t as generateFromSchema } from "./generate-Dzf2klR2.mjs";
+import { One, asc, count, desc, getTableColumns, getTableName, is, isTable, or, relationsFilterToSQL, sql } from "drizzle-orm";
 import { GraphQLError, GraphQLScalarType, GraphQLSchema, Kind, execute as defaultExecute, getOperationAST, print, subscribe as defaultSubscribe } from "graphql";
 import { capitalize, cloneDeep, debounce, merge, once, toMerged } from "es-toolkit";
 import { SpanStatusCode, isSpanContextValid, trace } from "@opentelemetry/api";
 import { ATTR_GRAPHQL_DOCUMENT, ATTR_GRAPHQL_OPERATION_NAME, ATTR_GRAPHQL_OPERATION_TYPE } from "@opentelemetry/semantic-conventions/incubating";
 import { AttributeNames, SpanNames, createOpenTelemetryWrapper } from "@pothos/tracing-opentelemetry";
+import { MySqlEnumColumn, MySqlEnumObjectColumn, MySqlTable, getTableConfig, unionAll } from "drizzle-orm/mysql-core";
+import { PgColumn, PgEnumColumn, PgEnumObjectColumn, PgTable, getTableConfig as getTableConfig$1, isPgEnum, unionAll as unionAll$1 } from "drizzle-orm/pg-core";
+import { SQLiteTable, getTableConfig as getTableConfig$2, unionAll as unionAll$2 } from "drizzle-orm/sqlite-core";
 import { EnvelopArmorPlugin } from "@escape.tech/graphql-armor";
 import { useDisableIntrospection } from "@graphql-yoga/plugin-disable-introspection";
 import { createPubSub, createYoga } from "graphql-yoga";
 import { toCamelCase } from "drizzle-orm/casing";
-import { PgColumn, PgEnumColumn, PgEnumObjectColumn, PgTable, getTableConfig, isPgEnum } from "drizzle-orm/pg-core";
-import { MySqlEnumColumn, MySqlEnumObjectColumn, MySqlTable, getTableConfig as getTableConfig$1 } from "drizzle-orm/mysql-core";
 import pluralize from "pluralize";
-import { SQLiteTable, getTableConfig as getTableConfig$2 } from "drizzle-orm/sqlite-core";
 import SchemaBuilder, { BasePlugin, isThenable } from "@pothos/core";
 import DrizzlePlugin from "@pothos/plugin-drizzle";
 import SmartSubscriptionsPlugin, { subscribeOptionsFromIterator } from "@pothos/plugin-smart-subscriptions";
@@ -22,7 +22,7 @@ import { BigIntResolver, ByteResolver, DateResolver, DateTimeISOResolver, EmailA
 import DataLoader from "dataloader";
 import { z } from "zod";
 import { parsePhoneNumberFromString } from "libphonenumber-js";
-//#region lib/types/rumbleError.ts
+// lib/types/rumbleError.ts
 /**
 * An error that gets raised by rumble whenever something does not go according to plan.
 * Mostly internals, configuration errors or other unexpected things.
@@ -39,8 +39,7 @@ var RumbleError = class extends Error {
 * E.g. the assert helpers issue these.
 */
 var RumbleErrorSafe = class extends GraphQLError {};
-//#endregion
-//#region lib/helpers/tableHelpers.ts
+// lib/helpers/tableHelpers.ts
 const indexCache = /* @__PURE__ */ new WeakMap();
 function buildIndex(db) {
 	const byTsName = /* @__PURE__ */ new Map();
@@ -109,8 +108,7 @@ function tableHelper({ db, table }) {
 		foundRelation: entry.foundRelation
 	};
 }
-//#endregion
-//#region lib/helpers/mergeFilters.ts
+// lib/helpers/mergeFilters.ts
 const EmptyFilter$1 = Symbol.for("drizzle:EmptyFilter");
 /**
 * Normalizes drizzle-orm's `EmptyFilter` sentinel to `undefined` so it's
@@ -154,8 +152,7 @@ function mergeFilters(filterA, filterB, mode = "AND") {
 		with: mergeRecords(filterA?.with, filterB?.with)
 	};
 }
-//#endregion
-//#region lib/helpers/sanitizeFilterValue.ts
+// lib/helpers/sanitizeFilterValue.ts
 const EmptyFilter = Symbol.for("drizzle:EmptyFilter");
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
@@ -168,17 +165,16 @@ function sanitizeFilterValue(value) {
 	if (isPlainObject(value)) return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeFilterValue(entry)]));
 	return value;
 }
-//#endregion
-//#region lib/abilityBuilder/keys.ts
+// lib/abilityBuilder/keys.ts
 const ACTION_FLAG_KEY = "__rumble_action";
 const columnFlagKey = (group) => `__rumble_columns_${group}`;
 const columnMaskKey = Symbol.for("rumble:columnMask");
 const columnVisibilityKey = Symbol.for("rumble:columnVisibility");
 const guardInputKey = Symbol.for("rumble:guardInput");
 const resolvedFilterKey = Symbol.for("rumble:resolvedFilter");
+const refreshAbilitiesKey = Symbol.for("rumble:refreshAbilities");
 const requestStateKey = Symbol.for("rumble:requestState");
-//#endregion
-//#region lib/abilityBuilder/requestState.ts
+// lib/abilityBuilder/requestState.ts
 function createRequestState() {
 	return {
 		masked: /* @__PURE__ */ new WeakMap(),
@@ -193,16 +189,7 @@ function attachRequestState(abilities, state) {
 function requestStateOf(abilities) {
 	return abilities?.[requestStateKey];
 }
-//#endregion
-//#region lib/abilityBuilder/columnMask.ts
-function referencesRelation(filter, relations) {
-	if (!filter || typeof filter !== "object") return false;
-	return Object.entries(filter).some(([key, value]) => {
-		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
-		if (key === "NOT") return referencesRelation(value, relations);
-		return key in relations;
-	});
-}
+// lib/abilityBuilder/columnMask.ts
 function selectedColumns(columns, allColumns) {
 	if (!columns) return new Set(allColumns);
 	const entries = Object.entries(columns).filter(([, v]) => v !== void 0);
@@ -261,12 +248,7 @@ function conditionalGroups(rules, guaranteed) {
 function createColumnAccessResolver({ db, actions }, tableSchema) {
 	const allColumnNames = Object.keys(tableSchema.columns);
 	const primaryKeyNames = Object.keys(tableSchema.primaryKey);
-	const primaryKeyName = primaryKeyNames[0];
 	const toSQL = (table, wheres) => or(...wheres.map((where) => relationsFilterToSQL(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)));
-	const uncorrelated = (table, wheres, group) => {
-		const inner = aliasedTable(tableSchema.table, `rumble_columns_${group}`);
-		return sql`exists ${db.select({ pk: inner[primaryKeyName] }).from(inner).where(sql`${inner[primaryKeyName]} = ${table[primaryKeyName]} and (${toSQL(inner, wheres)})`)}`;
-	};
 	return function resolveColumnAccess(action, filters) {
 		const rules = filters.map((f) => ({
 			where: realWhere(f?.where),
@@ -297,11 +279,7 @@ function createColumnAccessResolver({ db, actions }, tableSchema) {
 		const actionIndex = sql.raw(String(actions.indexOf(action)));
 		const extras = { [ACTION_FLAG_KEY]: () => sql`${actionIndex}` };
 		groups.forEach(({ wheres }, group) => {
-			const relational = wheres.some((w) => referencesRelation(w, tableSchema.relations));
-			extras[mask.flags[group]] = (table) => {
-				const condition = relational ? uncorrelated(table, wheres, group) : toSQL(table, wheres);
-				return sql`case when ${condition} then 1 else 0 end`;
-			};
+			extras[mask.flags[group]] = (table) => sql`case when ${toSQL(table, wheres)} then 1 else 0 end`;
 		});
 		return {
 			columns,
@@ -384,8 +362,7 @@ function createColumnMasker({ actions }, tables) {
 		columnsHidden
 	};
 }
-//#endregion
-//#region lib/helpers/sqlTypes/types.ts
+// lib/helpers/sqlTypes/types.ts
 /**
 * Strips parameter suffixes like `(256)`, `(10,2)` and timezone modifiers
 * (`with time zone`, `without time zone`) from raw getSQLType() output so
@@ -492,8 +469,7 @@ function isBytesSQLTypeString(sqlType) {
 	return bytesSQLTypeStrings.includes(sqlType);
 }
 const UnknownTypeRumbleError = (sqlType, additionalInfo) => new RumbleError(`RumbleError: Unknown SQL type '${sqlType}'. Please open an issue (https://github.com/m1212e/rumble/issues) so it can be added. (${additionalInfo})`);
-//#endregion
-//#region lib/helpers/sqlTypes/distinctValuesFromSQLType.ts
+// lib/helpers/sqlTypes/distinctValuesFromSQLType.ts
 function createDistinctValuesFromSQLType(sqlType) {
 	if (isIntLikeSQLTypeString(sqlType)) return {
 		value1: 1,
@@ -529,8 +505,7 @@ function createDistinctValuesFromSQLType(sqlType) {
 	};
 	throw UnknownTypeRumbleError(sqlType, "Distinct");
 }
-//#endregion
-//#region lib/helpers/telemetry.ts
+// lib/helpers/telemetry.ts
 const SPAN_EXECUTE = SpanNames.EXECUTE;
 /** @pothos/tracing-opentelemetry's SpanNames enum has no subscribe member. */
 const SPAN_SUBSCRIBE = "graphql.subscribe";
@@ -554,6 +529,7 @@ const ATTR_ABILITIES_STATUS = "rumble.abilities.status";
 const ATTR_ABILITIES_STATIC = "rumble.abilities.static";
 const ATTR_ABILITIES_DYNAMIC = "rumble.abilities.dynamic";
 const ATTR_ABILITIES_TOTAL = "rumble.abilities.total";
+const ATTR_ABILITIES_RESOLVED = "rumble.abilities.resolved";
 const ATTR_FILTERS_TOTAL = "rumble.filters.total";
 const ATTR_FILTERS_ALLOWED = "rumble.filters.allowed";
 const ATTR_SUBSCRIPTION_EVENT_INDEX = "rumble.subscription.event_index";
@@ -704,8 +680,7 @@ function startTimer() {
 function durationMs(start) {
 	return Math.round((performance.now() - start) * 100) / 100;
 }
-//#endregion
-//#region lib/abilityBuilder/filterResponse.ts
+// lib/abilityBuilder/filterResponse.ts
 /**
 * The limit of a find many call. An injected merge limit wins unless the
 * ability limit is lower, otherwise the default limit caps the ability limit.
@@ -770,16 +745,125 @@ function createFilterResponder({ db, defaultLimit }, tableSchema) {
 		return ret;
 	};
 }
-//#endregion
-//#region lib/abilityBuilder/queryFilter.ts
+// lib/abilityBuilder/queryFilter.ts
 function isDynamicQueryFilter(filter) {
 	return typeof filter === "function";
 }
 function isStaticQueryFilter(filter) {
 	return typeof filter !== "function";
 }
-//#endregion
-//#region lib/helpers/errorLogging.ts
+// lib/helpers/determineDialectFromSchema.ts
+const dialectCache = /* @__PURE__ */ new WeakMap();
+function determineDBDialectFromSchema(schema) {
+	const cached = dialectCache.get(schema);
+	if (cached) return cached;
+	const found = /* @__PURE__ */ new Set();
+	for (const table of Object.values(schema).map((t) => t.table)) {
+		if (!table || typeof table !== "object") continue;
+		if (is(table, PgTable)) found.add("postgres");
+		else if (is(table, MySqlTable)) found.add("mysql");
+		else if (is(table, SQLiteTable)) found.add("sqlite");
+	}
+	const dialects = Array.from(found);
+	if (dialects.length === 1) {
+		const only = dialects[0];
+		dialectCache.set(schema, only);
+		return only;
+	}
+	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
+	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
+}
+function isPostgresDB(db) {
+	return determineDBDialectFromSchema(db._.relations) === "postgres";
+}
+// lib/abilityBuilder/resolveRules.ts
+const DEFAULT_MAX_RESOLVED_IDS = 500;
+/**
+* Whether the where names a relation of the table, so it renders as (nested)
+* `exists` subqueries.
+*/
+function referencesRelation(filter, relations) {
+	if (!filter || typeof filter !== "object") return false;
+	return Object.entries(filter).some(([key, value]) => {
+		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
+		if (key === "NOT") return referencesRelation(value, relations);
+		return key in relations;
+	});
+}
+/**
+* Creates the function replacing the relational rules of a table by the
+* primary keys they match, resolved with one query per call.
+*
+* A relational rule ("the users whose delegation the caller supervises")
+* renders as a chain of correlated `exists` subqueries, once in the row filter
+* and once more in every column flag, at every place the table is nested in a
+* query. Planning such a statement costs the database tens of megabytes. For a
+* given caller the rule matches a fixed set of rows though, so this looks them
+* up once (`select pk from table where <rule>`) and the rule becomes
+* `pk in (...)`, which costs the planner nothing. Rules matching more than
+* `maxIds` rows stay relational, so broad rules do not turn into huge lists.
+*
+* Returns undefined when disabled or the table has no single primary key.
+*/
+function createRuleResolver(settings, tableSchema) {
+	const config = settings.resolveRelationalRules;
+	const primaryKeys = Object.keys(tableSchema.primaryKey);
+	if (!config?.enabled || primaryKeys.length !== 1) return void 0;
+	const maxIds = config.maxIds ?? DEFAULT_MAX_RESOLVED_IDS;
+	const primaryKeyName = primaryKeys[0];
+	const db = settings.db;
+	const table = tableSchema.table;
+	const dialect = determineDBDialectFromSchema(db._.relations);
+	const unionAll$3 = {
+		postgres: unionAll$1,
+		sqlite: unionAll$2,
+		mysql: unionAll
+	}[dialect];
+	const listFilter = (ids) => dialect === "postgres" ? { RAW: (aliased) => sql`${aliased[primaryKeyName]} = any(${sql.param(ids)})` } : { [primaryKeyName]: { in: ids } };
+	/** The primary keys matching the rule, tagged with the rule's index. */
+	const matches = (where, rule) => {
+		const limited = db.select({
+			pk: table[primaryKeyName],
+			rule: sql.raw(String(rule)).as("rule")
+		}).from(table).where(relationsFilterToSQL(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)).limit(maxIds + 1).as(`rumble_rule_${rule}`);
+		return db.select({
+			pk: limited.pk,
+			rule: limited.rule
+		}).from(limited);
+	};
+	const whereOf = (filter) => realWhere(filter?.where);
+	return async function resolveRules(filters) {
+		const relational = filters.flatMap((filter, index) => referencesRelation(whereOf(filter), tableSchema.relations) ? [index] : []);
+		if (relational.length === 0) return {
+			filters,
+			resolved: 0
+		};
+		const queries = relational.map((index) => matches(whereOf(filters[index]), index));
+		const rows = await (queries.length === 1 ? queries[0] : unionAll$3(...queries));
+		const idsPerRule = new Map(relational.map((index) => [index, []]));
+		for (const row of rows) idsPerRule.get(Number(row.rule)).push(row.pk);
+		let resolved = 0;
+		const result = [];
+		filters.forEach((filter, index) => {
+			const ids = idsPerRule.get(index);
+			if (!ids || ids.length > maxIds) {
+				result.push(filter);
+				return;
+			}
+			resolved++;
+			if (ids.length === 0) return;
+			result.push({
+				...filter,
+				where: listFilter(ids)
+			});
+		});
+		return {
+			filters: result,
+			resolved
+		};
+	};
+}
+// lib/helpers/errorLogging.ts
 function hasMessage(error) {
 	return typeof error === "object" && error !== null && "message" in error;
 }
@@ -810,8 +894,7 @@ function errorsLogField(errors) {
 function errorLogField(error) {
 	return errorsLogField([error]);
 }
-//#endregion
-//#region lib/abilityBuilder/telemetry.ts
+// lib/abilityBuilder/telemetry.ts
 const makeNothingRegisteredWarner = (config, logger) => debounce((model, action) => {
 	const msg = `No abilities registered for ${model}/${action} — blocking everything. Register the ability or ignore this warning if intentional.`;
 	if (logger) logger.warn({
@@ -859,8 +942,7 @@ function traceAbilityPreparation({ otel, log, telemetryConfig }, tableName, acti
 	});
 	return run();
 }
-//#endregion
-//#region lib/abilityBuilder/tableAbilities.ts
+// lib/abilityBuilder/tableAbilities.ts
 /**
 * filter() is async. Without type checking (plain JS, `any`) a forgotten await would
 * hand the promise itself to drizzle
@@ -918,7 +1000,23 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 	const blockEverythingFilter = createBlockEverythingFilter(String(tableName), tableSchema);
 	const resolveColumnAccess = createColumnAccessResolver(settings, tableSchema);
 	const transformToResponse = createFilterResponder(settings, tableSchema);
-	const assembleAbilities = async (userContext, action, attributes) => {
+	const resolveRules = createRuleResolver(settings, tableSchema);
+	const evaluateDynamicFilters = (userContext, action) => Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+	/** The response for the rules applying to the caller: their OR, columns and flags. */
+	const respondWithFilters = (action, allQueryFilters) => {
+		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
+			return mergeFilters(a, b, "OR");
+		});
+		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
+		if (columns) mergedFilters.columns = columns;
+		else delete mergedFilters.columns;
+		if (extras) mergedFilters.extras = {
+			...mergedFilters.extras,
+			...extras
+		};
+		return transformToResponse(mergedFilters, mask, visibility);
+	};
+	const assembleAbilities = async (action, attributes, evaluate) => {
 		const filters = queryFilters.get(action);
 		if (filters === "unrestricted") {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
@@ -929,7 +1027,7 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			settings.warnNothingRegistered(String(tableName), action);
 			return transformToResponse(blockEverythingFilter);
 		}
-		const rawResults = await Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+		const rawResults = await evaluate();
 		if (rawResults.includes("allow")) {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
 			return transformToResponse();
@@ -937,28 +1035,32 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 		const dynamicResults = rawResults.filter((r) => r !== void 0).map(withRestrictingWhere);
 		attributes[ATTR_ABILITIES_DYNAMIC] = dynamicResults.length;
 		attributes[ATTR_ABILITIES_STATIC] = simpleQueryFilters[action].length;
-		const allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
+		let allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
 		attributes[ATTR_ABILITIES_TOTAL] = allQueryFilters.length;
+		if (resolveRules && allQueryFilters.length > 0) {
+			const resolution = await resolveRules(allQueryFilters);
+			allQueryFilters = resolution.filters;
+			attributes[ATTR_ABILITIES_RESOLVED] = resolution.resolved;
+		}
 		if (allQueryFilters.length === 0) {
 			attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
 			return transformToResponse(blockEverythingFilter);
 		}
-		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
-			return mergeFilters(a, b, "OR");
-		});
-		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
-		if (columns) mergedFilters.columns = columns;
-		else delete mergedFilters.columns;
-		if (extras) mergedFilters.extras = {
-			...mergedFilters.extras,
-			...extras
-		};
 		attributes[ATTR_ABILITIES_STATUS] = "applied";
-		return transformToResponse(mergedFilters, mask, visibility);
+		return respondWithFilters(action, allQueryFilters);
 	};
 	return { withContext: (userContext) => {
-		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(userContext, action, attributes));
-		const cache = /* @__PURE__ */ new Map();
+		const evaluated = /* @__PURE__ */ new Map();
+		const evaluate = (action) => {
+			let results = evaluated.get(action);
+			if (!results) {
+				results = evaluateDynamicFilters(userContext, action);
+				evaluated.set(action, results);
+			}
+			return results;
+		};
+		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(action, attributes, () => evaluate(action)));
+		let cache = /* @__PURE__ */ new Map();
 		const resolved = /* @__PURE__ */ new Map();
 		const abilities = { filter: (action) => {
 			let prepared = cache.get(action);
@@ -970,11 +1072,13 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			return prepared;
 		} };
 		abilities[resolvedFilterKey] = (action) => resolved.get(action);
+		abilities[refreshAbilitiesKey] = () => {
+			if (resolveRules) cache = /* @__PURE__ */ new Map();
+		};
 		return abilities;
 	} };
 };
-//#endregion
-//#region lib/abilityBuilder/inputGuard.ts
+// lib/abilityBuilder/inputGuard.ts
 /** The ts names of the columns a relation joins on, on either side. */
 function relationColumnKeys(db, table, columns) {
 	const known = tableHelper({
@@ -1107,8 +1211,7 @@ async function relationExposure(abilities, table, action, columns) {
 	const guard = abilities[guardInputKey];
 	return guard ? guard.exposed(table, action, columns) : [];
 }
-//#endregion
-//#region lib/abilityBuilder/tableBuilder.ts
+// lib/abilityBuilder/tableBuilder.ts
 /**
 * Creates the registration API (allow/filter) of a single table.
 */
@@ -1192,9 +1295,20 @@ when: (queryFilter) => {
 		}
 	};
 };
-//#endregion
-//#region lib/abilityBuilder/index.ts
-const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerConfig }) => {
+// lib/abilityBuilder/refresh.ts
+/**
+* Starts a new snapshot of the resolved relational rules of every table, see
+* `resolveRelationalRules`. Rumble calls this whenever a root field starts to
+* resolve. Call it yourself in a resolver that writes rows and then reads them
+* through a table whose rules it already resolved before the write. A no-op
+* unless rules are resolved.
+*/
+function refreshAbilities(abilities) {
+	if (!abilities) return;
+	for (const table of Object.values(abilities)) table?.[refreshAbilitiesKey]?.();
+}
+// lib/abilityBuilder/index.ts
+const createAbilityBuilder = ({ db, actions, defaultLimit, resolveRelationalRules, otel, logger: loggerConfig }) => {
 	const log = loggerConfig?.enabled ? loggerConfig.logger : void 0;
 	const telemetryConfig = {
 		otel,
@@ -1204,6 +1318,7 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 		db,
 		actions,
 		defaultLimit,
+		resolveRelationalRules,
 		otel,
 		telemetryConfig,
 		log,
@@ -1270,8 +1385,7 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 		}
 	};
 };
-//#endregion
-//#region lib/helpers/asserts.ts
+// lib/helpers/asserts.ts
 /**
 *
 * Helper function to map a drizzle findFirst query result,
@@ -1350,8 +1464,7 @@ const assertFirstEntryExists = (value) => {
 	if (!v) throw new RumbleErrorSafe("Value not found but required (firstEntry)");
 	return v;
 };
-//#endregion
-//#region lib/helpers/mapNullFieldsToUndefined.ts
+// lib/helpers/mapNullFieldsToUndefined.ts
 /**
 * Helper to map null fields to undefined
 * @param obj The object to map
@@ -1413,11 +1526,9 @@ where: { id: user.id },
 function mapNullFieldsToUndefined(obj) {
 	return Object.fromEntries(Object.entries(obj).map(([key, value]) => [key, value === null ? void 0 : value]));
 }
-//#endregion
-//#region package.json
-var version = "0.27.0";
-//#endregion
-//#region lib/args/orderArg.ts
+// package.json
+var version = "0.27.4";
+// lib/args/orderArg.ts
 const makeDefaultName$1 = (dbName) => `${capitalize(toCamelCase(dbName.toString()))}OrderInputArgument`;
 const createOrderArgImplementer = ({ db, schemaBuilder }) => {
 	const referenceStorage = /* @__PURE__ */ new Map();
@@ -1448,8 +1559,7 @@ const createOrderArgImplementer = ({ db, schemaBuilder }) => {
 	};
 	return orderArgImplementer;
 };
-//#endregion
-//#region lib/enum.ts
+// lib/enum.ts
 /**
 * Checks if a column is a database enum column (Postgres or MySQL).
 */
@@ -1509,8 +1619,7 @@ const createEnumImplementer = ({ schema, schemaBuilder }) => {
 	};
 	return enumImplementer;
 };
-//#endregion
-//#region lib/helpers/sqlTypes/mapSQLTypeToTSType.ts
+// lib/helpers/sqlTypes/mapSQLTypeToTSType.ts
 function mapSQLTypeToGraphQLType({ sqlType, fieldName }) {
 	if (/^enum\(/.test(sqlType)) return "String";
 	const normalized = normalizeSQLType(sqlType);
@@ -1532,8 +1641,7 @@ function mapSQLTypeToGraphQLType({ sqlType, fieldName }) {
 	if (ret !== void 0) return ret;
 	throw UnknownTypeRumbleError(sqlType, "SQL to GQL");
 }
-//#endregion
-//#region lib/args/whereArg.ts
+// lib/args/whereArg.ts
 const makeDefaultName = (dbName) => `${capitalize(toCamelCase(dbName.toString()))}WhereInputArgument`;
 const createWhereArgImplementer = ({ db, schemaBuilder, enumImplementer }) => {
 	const referenceStorage = /* @__PURE__ */ new Map();
@@ -1758,8 +1866,7 @@ const createWhereArgImplementer = ({ db, schemaBuilder, enumImplementer }) => {
 	};
 	return whereArgImplementer;
 };
-//#endregion
-//#region lib/client/client.ts
+// lib/client/client.ts
 const clientCreatorImplementer = ({ builtSchema }) => {
 	const clientCreator = async ({ apiUrl, outputPath, rumbleImportPath, useExternalUrqlClient, removeExisting, forceReactivity, autoIncludeIdField = false }) => {
 		if (process.env.NODE_ENV !== "development") console.warn(`Running rumble client generation in non development mode. Are you sure this is correct? Called with arguments: ${JSON.stringify({
@@ -1783,8 +1890,7 @@ const clientCreatorImplementer = ({ builtSchema }) => {
 	};
 	return clientCreator;
 };
-//#endregion
-//#region lib/context.ts
+// lib/context.ts
 const createContextFunction = ({ context: makeUserContext, abilityBuilder }) => {
 	const builtAbilityBuilder = once(() => abilityBuilder._.build());
 	return async (req) => {
@@ -1795,8 +1901,7 @@ const createContextFunction = ({ context: makeUserContext, abilityBuilder }) =>
 		};
 	};
 };
-//#endregion
-//#region lib/helpers/protoMapper.ts
+// lib/helpers/protoMapper.ts
 function deepSetProto(obj, proto = Object.prototype, seen = /* @__PURE__ */ new WeakSet()) {
 	if (obj === null || typeof obj !== "object") return;
 	if (seen.has(obj)) return;
@@ -1810,8 +1915,7 @@ function deepSetProto(obj, proto = Object.prototype, seen = /* @__PURE__ */ new
 	Object.setPrototypeOf(obj, proto);
 	for (const key of Object.keys(obj)) deepSetProto(obj[key], proto, seen);
 }
-//#endregion
-//#region lib/countQuery.ts
+// lib/countQuery.ts
 const createCountQueryImplementer = ({ db, schemaBuilder, whereArgImplementer, makePubSubInstance }) => {
 	return ({ table, listAction = "read", isAllowed }) => {
 		const WhereArg = whereArgImplementer({ table });
@@ -1851,8 +1955,7 @@ const createCountQueryImplementer = ({ db, schemaBuilder, whereArgImplementer, m
 		});
 	};
 };
-//#endregion
-//#region lib/helpers/sofaOpenAPIWebhookDocs.ts
+// lib/helpers/sofaOpenAPIWebhookDocs.ts
 const sofaOpenAPIWebhookDocs = {
 	paths: {
 		"/webhook": { post: {
@@ -1936,8 +2039,7 @@ const sofaOpenAPIWebhookDocs = {
 		}
 	} }
 };
-//#endregion
-//#region lib/helpers/tracing.ts
+// lib/helpers/tracing.ts
 function isAsyncIterable(value) {
 	return typeof value === "object" && value !== null && Symbol.asyncIterator in value;
 }
@@ -2125,8 +2227,7 @@ function buildTracedSubscribe(subscribeFn, rumbleInput, transport) {
 		});
 	};
 }
-//#endregion
-//#region lib/helpers/sqlTypes/mapDrizzleTypeToGraphQlType.ts
+// lib/helpers/sqlTypes/mapDrizzleTypeToGraphQlType.ts
 function buildPothosResponseTypeFromGraphQLType({ builder, sqlType, fieldName, nullable, isArray }) {
 	const gqlType = mapSQLTypeToGraphQLType({
 		sqlType,
@@ -2174,33 +2275,7 @@ function buildPothosResponseTypeFromGraphQLType({ builder, sqlType, fieldName, n
 		default: throw new RumbleError(`Unsupported object type ${gqlType} for column ${fieldName}`);
 	}
 }
-//#endregion
-//#region lib/helpers/determineDialectFromSchema.ts
-const dialectCache = /* @__PURE__ */ new WeakMap();
-function determineDBDialectFromSchema(schema) {
-	const cached = dialectCache.get(schema);
-	if (cached) return cached;
-	const found = /* @__PURE__ */ new Set();
-	for (const table of Object.values(schema).map((t) => t.table)) {
-		if (!table || typeof table !== "object") continue;
-		if (is(table, PgTable)) found.add("postgres");
-		else if (is(table, MySqlTable)) found.add("mysql");
-		else if (is(table, SQLiteTable)) found.add("sqlite");
-	}
-	const dialects = Array.from(found);
-	if (dialects.length === 1) {
-		const only = dialects[0];
-		dialectCache.set(schema, only);
-		return only;
-	}
-	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
-	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
-}
-function isPostgresDB(db) {
-	return determineDBDialectFromSchema(db._.relations) === "postgres";
-}
-//#endregion
-//#region lib/search.ts
+// lib/search.ts
 async function initSearchIfApplicable(input) {
 	const log = input.logger?.enabled ? input.logger.logger : void 0;
 	if (!isPostgresDB(input.db)) {
@@ -2260,8 +2335,7 @@ function adjustQueryArgsForSearch({ search, args, tableSchema, abilities }) {
 		}), sql.raw(" OR "))})` }] };
 	}
 }
-//#endregion
-//#region lib/object.ts
+// lib/object.ts
 const isProbablyAConfigObject = (t) => {
 	if (typeof t !== "object") return false;
 	if (Object.keys(t).some((k) => [
@@ -2489,8 +2563,7 @@ const createObjectImplementer = ({ db, search, otel, logger: loggerConfig, schem
 		});
 	};
 };
-//#endregion
-//#region lib/pubsub.ts
+// lib/pubsub.ts
 const SUBSCRIPTION_NOTIFIER_RUMBLE_PREFIX = "RUMBLE_SUBSCRIPTION_NOTIFICATION";
 const SUBSCRIPTION_NOTIFIER_REMOVED = "REMOVED";
 const SUBSCRIPTION_NOTIFIER_UPDATED = "UPDATED";
@@ -2565,8 +2638,7 @@ const createPubSubInstance = ({ subscriptions }) => {
 		makePubSubInstance
 	};
 };
-//#endregion
-//#region lib/query.ts
+// lib/query.ts
 const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: loggerConfig, whereArgImplementer, orderArgImplementer, makePubSubInstance }) => {
 	const registeredQueryFieldNames = /* @__PURE__ */ new Set();
 	const telemetryConfig = {
@@ -2681,8 +2753,7 @@ const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: logge
 		});
 	};
 };
-//#endregion
-//#region lib/args/whereArgsImplementer.ts
+// lib/args/whereArgsImplementer.ts
 function implementDefaultWhereInputArgs(schemaBuilder) {
 	const IntWhereInputArgument = schemaBuilder.inputRef("IntWhereInputArgument").implement({ fields: (t) => ({
 		eq: t.int(),
@@ -2934,16 +3005,14 @@ function implementDefaultWhereInputArgs(schemaBuilder) {
 		NOT: t.field({ type: DateTimeWhereInputArgument })
 	}) });
 }
-//#endregion
-//#region lib/helpers/objectTypeOptions.ts
+// lib/helpers/objectTypeOptions.ts
 function objectTypeOptionsOfField(buildCache, fieldConfig) {
 	const type = fieldConfig.type;
 	const ref = type.kind === "List" ? type.type.kind === "Object" ? type.type.ref : void 0 : type.kind === "Object" ? type.ref : void 0;
 	if (!ref) return void 0;
 	return buildCache.getTypeConfig(ref, "Object").pothosOptions;
 }
-//#endregion
-//#region lib/helpers/registerPlugin.ts
+// lib/helpers/registerPlugin.ts
 const registered = /* @__PURE__ */ new Set();
 function registerPluginOnce(name, plugin) {
 	if (registered.has(name)) return;
@@ -2951,15 +3020,13 @@ function registerPluginOnce(name, plugin) {
 	SchemaBuilder.registerPlugin(name, plugin);
 	registered.add(name);
 }
-//#endregion
-//#region lib/columnMaskPlugin/maskTypes.ts
+// lib/columnMaskPlugin/maskTypes.ts
 const maskColumnsKey = "maskColumns";
 const maskColumnsActionKey = "maskColumnsAction";
 const maskPrimaryKeysKey = "maskPrimaryKeys";
 const maskRelationsKey = "maskRelations";
 const columnMaskPluginName = "ColumnMaskPlugin";
-//#endregion
-//#region lib/columnMaskPlugin/columnMaskPlugin.ts
+// lib/columnMaskPlugin/columnMaskPlugin.ts
 var ColumnMaskPlugin = class extends BasePlugin {
 	wrapResolve(resolver, fieldConfig) {
 		return this.maskResult(this.maskRelation(this.maskPrimaryKey(resolver, fieldConfig), fieldConfig), fieldConfig);
@@ -2998,8 +3065,7 @@ var ColumnMaskPlugin = class extends BasePlugin {
 function registerColumnMaskPlugin() {
 	registerPluginOnce(columnMaskPluginName, ColumnMaskPlugin);
 }
-//#endregion
-//#region lib/helpers/abilityAwareClient.ts
+// lib/helpers/abilityAwareClient.ts
 function createAbilityAwareClient({ db, abilityBuilder }) {
 	return (context) => {
 		const apis = /* @__PURE__ */ new Map();
@@ -3043,11 +3109,31 @@ function createAbilityAwareClient({ db, abilityBuilder }) {
 		} });
 	};
 }
-//#endregion
-//#region lib/runtimeFiltersPlugin/filterTypes.ts
+// lib/refreshAbilitiesPlugin/refreshAbilitiesPlugin.ts
+const refreshAbilitiesPluginName = "RefreshAbilitiesPlugin";
+/**
+* Starts a new snapshot of the resolved relational rules whenever a root
+* field (query, mutation or subscription event) starts to resolve, see
+* `resolveRelationalRules`. A mutation's second root field sees what the first
+* wrote, and a live query refetching sees the rows related to the caller by
+* now. A no-op unless rules are resolved.
+*/
+var RefreshAbilitiesPlugin = class extends BasePlugin {
+	wrapResolve(resolver, fieldConfig) {
+		const { kind } = this.buildCache.getTypeConfig(fieldConfig.parentType);
+		if (kind !== "Query" && kind !== "Mutation" && kind !== "Subscription") return resolver;
+		return (parent, args, context, info) => {
+			refreshAbilities(context?.abilities);
+			return resolver(parent, args, context, info);
+		};
+	}
+};
+function registerRefreshAbilitiesPlugin() {
+	registerPluginOnce(refreshAbilitiesPluginName, RefreshAbilitiesPlugin);
+}
+// lib/runtimeFiltersPlugin/filterTypes.ts
 const pluginName = "RuntimeFiltersPlugin";
-//#endregion
-//#region lib/runtimeFiltersPlugin/runtimeFiltersPlugin.ts
+// lib/runtimeFiltersPlugin/runtimeFiltersPlugin.ts
 const applyFiltersKey = "applyFilters";
 var RuntimeFiltersPlugin = class extends BasePlugin {
 	tracer;
@@ -3149,8 +3235,7 @@ var RuntimeFiltersPlugin = class extends BasePlugin {
 function registerRuntimeFiltersPlugin() {
 	registerPluginOnce(pluginName, RuntimeFiltersPlugin);
 }
-//#endregion
-//#region lib/scalars/addressData.ts
+// lib/scalars/addressData.ts
 /*! Address data derived from Google's Address Data Service (https://github.com/google/libaddressinput),
 * licensed under CC-BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
 * Changes: reduced to required fields, postal code patterns and examples, and regions with
@@ -8962,8 +9047,7 @@ const addressData = {
 	},
 	ZW: { require: "AC" }
 };
-//#endregion
-//#region lib/scalars/addressValidation.ts
+// lib/scalars/addressValidation.ts
 const REQUIRED_FIELD_PATHS = {
 	A: "streetAddress",
 	C: "locality",
@@ -9093,8 +9177,7 @@ const addressValidationSchema = z.object({
 		message: issue.message
 	});
 });
-//#endregion
-//#region lib/scalars/address.ts
+// lib/scalars/address.ts
 function implementDefaultAddressTypes(schemaBuilder) {
 	return {
 		Address: schemaBuilder.objectRef("Address").implement({
@@ -9120,8 +9203,7 @@ function implementDefaultAddressTypes(schemaBuilder) {
 		})
 	};
 }
-//#endregion
-//#region lib/scalars/emailAddress.ts
+// lib/scalars/emailAddress.ts
 /**
 * Validates an email address using graphql-scalars' own format check, then lowercases it, exactly
 * as the `EmailAddress` scalar does. Exported for values that do not arrive as GraphQL input,
@@ -9147,8 +9229,7 @@ const EmailAddressResolver$1 = new GraphQLScalarType({
 		return normalizeEmailAddress(ast.value);
 	}
 });
-//#endregion
-//#region lib/scalars/personName.ts
+// lib/scalars/personName.ts
 const MAX_LENGTH = 200;
 const NAME_REGEX = /^[\p{L}\p{M}]+(?:(?:[ '-]|\.\x20?)[\p{L}\p{M}]+)*\.?$/u;
 const APOSTROPHE_VARIANTS = /[\u2018\u2019\u02BC\u00B4\u0060]/gu;
@@ -9177,8 +9258,7 @@ const PersonNameResolver = new GraphQLScalarType({
 		return normalizePersonName(ast.value);
 	}
 });
-//#endregion
-//#region lib/scalars/phoneNumber.ts
+// lib/scalars/phoneNumber.ts
 /**
 * Parses and validates a phone number using libphonenumber-js (Google's phone number metadata),
 * which checks real per-country validity (length, area code plausibility, ...) rather than just
@@ -9215,16 +9295,17 @@ const PhoneNumberResolver = new GraphQLScalarType({
 		return parsePhoneNumber(ast.value);
 	}
 });
-//#endregion
-//#region lib/schemaBuilder.ts
+// lib/schemaBuilder.ts
 const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validation, abilityBuilder }) => {
 	const createSpan = otel?.enabled && otel.tracer ? createOpenTelemetryWrapper(otel.tracer, otel.options) : void 0;
 	registerRuntimeFiltersPlugin();
 	registerColumnMaskPlugin();
+	registerRefreshAbilitiesPlugin();
 	const schemaBuilder = new SchemaBuilder({
 		...pothosConfig,
 		plugins: [
 			columnMaskPluginName,
+			refreshAbilitiesPluginName,
 			pluginName,
 			DrizzlePlugin,
 			SmartSubscriptionsPlugin,
@@ -9239,8 +9320,8 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validatio
 			}),
 			relations: db._.relations,
 			getTableConfig(table) {
-				if (is(table, PgTable)) return getTableConfig(table);
-				if (is(table, MySqlTable)) return getTableConfig$1(table);
+				if (is(table, PgTable)) return getTableConfig$1(table);
+				if (is(table, MySqlTable)) return getTableConfig(table);
 				if (is(table, SQLiteTable)) return getTableConfig$2(table);
 				return {
 					columns: isTable(table) ? Object.values(getTableColumns(table)) : [],
@@ -9300,8 +9381,7 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validatio
 	schemaBuilder.mutationType({});
 	return { schemaBuilder };
 };
-//#endregion
-//#region lib/rumble.ts
+// lib/rumble.ts
 /**
 * Mirrors sofa's own default error handler: it derives the HTTP status from
 * `extensions.http` and returns the errors as JSON. rumble only adds telemetry
@@ -9629,7 +9709,6 @@ export const r = rumble({
 		buildSchema: builtSchema
 	};
 };
-//#endregion
-export { RumbleError, RumbleErrorSafe, addressChecks, addressData, addressValidationSchema, assertFindFirstExists, assertFirstEntryExists, checkPostalCode, checkRegion, checkRequiredFields, findRegionCode, guardFilterInput, mapNullFieldsToUndefined, normalizeAddress, normalizeEmailAddress, normalizePersonName, parsePhoneNumber, rumble, validateAddress };
+export { RumbleError, RumbleErrorSafe, addressChecks, addressData, addressValidationSchema, assertFindFirstExists, assertFirstEntryExists, checkPostalCode, checkRegion, checkRequiredFields, findRegionCode, guardFilterInput, mapNullFieldsToUndefined, normalizeAddress, normalizeEmailAddress, normalizePersonName, parsePhoneNumber, refreshAbilities, rumble, validateAddress };
 
 //# sourceMappingURL=index.mjs.map