@m1212e/rumble 0.27.0 → 0.27.4

package/out/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region \0rolldown/runtime.js
+// \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -20,23 +20,22 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-//#endregion
-const require_generate = require("./generate-D0CKBths.cjs");
+const require_generate = require("./generate-Btr_u0Lr.cjs");
 let drizzle_orm = require("drizzle-orm");
 let graphql = require("graphql");
 let es_toolkit = require("es-toolkit");
 let _opentelemetry_api = require("@opentelemetry/api");
 let _opentelemetry_semantic_conventions_incubating = require("@opentelemetry/semantic-conventions/incubating");
 let _pothos_tracing_opentelemetry = require("@pothos/tracing-opentelemetry");
+let drizzle_orm_mysql_core = require("drizzle-orm/mysql-core");
+let drizzle_orm_pg_core = require("drizzle-orm/pg-core");
+let drizzle_orm_sqlite_core = require("drizzle-orm/sqlite-core");
 let _escape_tech_graphql_armor = require("@escape.tech/graphql-armor");
 let _graphql_yoga_plugin_disable_introspection = require("@graphql-yoga/plugin-disable-introspection");
 let graphql_yoga = require("graphql-yoga");
 let drizzle_orm_casing = require("drizzle-orm/casing");
-let drizzle_orm_pg_core = require("drizzle-orm/pg-core");
-let drizzle_orm_mysql_core = require("drizzle-orm/mysql-core");
 let pluralize = require("pluralize");
 pluralize = __toESM(pluralize, 1);
-let drizzle_orm_sqlite_core = require("drizzle-orm/sqlite-core");
 let _pothos_core = require("@pothos/core");
 _pothos_core = __toESM(_pothos_core, 1);
 let _pothos_plugin_drizzle = require("@pothos/plugin-drizzle");
@@ -52,7 +51,7 @@ let dataloader = require("dataloader");
 dataloader = __toESM(dataloader, 1);
 let zod = require("zod");
 let libphonenumber_js = require("libphonenumber-js");
-//#region lib/types/rumbleError.ts
+// lib/types/rumbleError.ts
 /**
 * An error that gets raised by rumble whenever something does not go according to plan.
 * Mostly internals, configuration errors or other unexpected things.
@@ -69,8 +68,7 @@ var RumbleError = class extends Error {
 * E.g. the assert helpers issue these.
 */
 var RumbleErrorSafe = class extends graphql.GraphQLError {};
-//#endregion
-//#region lib/helpers/tableHelpers.ts
+// lib/helpers/tableHelpers.ts
 const indexCache = /* @__PURE__ */ new WeakMap();
 function buildIndex(db) {
 	const byTsName = /* @__PURE__ */ new Map();
@@ -139,8 +137,7 @@ function tableHelper({ db, table }) {
 		foundRelation: entry.foundRelation
 	};
 }
-//#endregion
-//#region lib/helpers/mergeFilters.ts
+// lib/helpers/mergeFilters.ts
 const EmptyFilter$1 = Symbol.for("drizzle:EmptyFilter");
 /**
 * Normalizes drizzle-orm's `EmptyFilter` sentinel to `undefined` so it's
@@ -184,8 +181,7 @@ function mergeFilters(filterA, filterB, mode = "AND") {
 		with: mergeRecords(filterA?.with, filterB?.with)
 	};
 }
-//#endregion
-//#region lib/helpers/sanitizeFilterValue.ts
+// lib/helpers/sanitizeFilterValue.ts
 const EmptyFilter = Symbol.for("drizzle:EmptyFilter");
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
@@ -198,17 +194,16 @@ function sanitizeFilterValue(value) {
 	if (isPlainObject(value)) return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeFilterValue(entry)]));
 	return value;
 }
-//#endregion
-//#region lib/abilityBuilder/keys.ts
+// lib/abilityBuilder/keys.ts
 const ACTION_FLAG_KEY = "__rumble_action";
 const columnFlagKey = (group) => `__rumble_columns_${group}`;
 const columnMaskKey = Symbol.for("rumble:columnMask");
 const columnVisibilityKey = Symbol.for("rumble:columnVisibility");
 const guardInputKey = Symbol.for("rumble:guardInput");
 const resolvedFilterKey = Symbol.for("rumble:resolvedFilter");
+const refreshAbilitiesKey = Symbol.for("rumble:refreshAbilities");
 const requestStateKey = Symbol.for("rumble:requestState");
-//#endregion
-//#region lib/abilityBuilder/requestState.ts
+// lib/abilityBuilder/requestState.ts
 function createRequestState() {
 	return {
 		masked: /* @__PURE__ */ new WeakMap(),
@@ -223,16 +218,7 @@ function attachRequestState(abilities, state) {
 function requestStateOf(abilities) {
 	return abilities?.[requestStateKey];
 }
-//#endregion
-//#region lib/abilityBuilder/columnMask.ts
-function referencesRelation(filter, relations) {
-	if (!filter || typeof filter !== "object") return false;
-	return Object.entries(filter).some(([key, value]) => {
-		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
-		if (key === "NOT") return referencesRelation(value, relations);
-		return key in relations;
-	});
-}
+// lib/abilityBuilder/columnMask.ts
 function selectedColumns(columns, allColumns) {
 	if (!columns) return new Set(allColumns);
 	const entries = Object.entries(columns).filter(([, v]) => v !== void 0);
@@ -291,12 +277,7 @@ function conditionalGroups(rules, guaranteed) {
 function createColumnAccessResolver({ db, actions }, tableSchema) {
 	const allColumnNames = Object.keys(tableSchema.columns);
 	const primaryKeyNames = Object.keys(tableSchema.primaryKey);
-	const primaryKeyName = primaryKeyNames[0];
 	const toSQL = (table, wheres) => (0, drizzle_orm.or)(...wheres.map((where) => (0, drizzle_orm.relationsFilterToSQL)(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)));
-	const uncorrelated = (table, wheres, group) => {
-		const inner = (0, drizzle_orm.aliasedTable)(tableSchema.table, `rumble_columns_${group}`);
-		return drizzle_orm.sql`exists ${db.select({ pk: inner[primaryKeyName] }).from(inner).where(drizzle_orm.sql`${inner[primaryKeyName]} = ${table[primaryKeyName]} and (${toSQL(inner, wheres)})`)}`;
-	};
 	return function resolveColumnAccess(action, filters) {
 		const rules = filters.map((f) => ({
 			where: realWhere(f?.where),
@@ -327,11 +308,7 @@ function createColumnAccessResolver({ db, actions }, tableSchema) {
 		const actionIndex = drizzle_orm.sql.raw(String(actions.indexOf(action)));
 		const extras = { [ACTION_FLAG_KEY]: () => drizzle_orm.sql`${actionIndex}` };
 		groups.forEach(({ wheres }, group) => {
-			const relational = wheres.some((w) => referencesRelation(w, tableSchema.relations));
-			extras[mask.flags[group]] = (table) => {
-				const condition = relational ? uncorrelated(table, wheres, group) : toSQL(table, wheres);
-				return drizzle_orm.sql`case when ${condition} then 1 else 0 end`;
-			};
+			extras[mask.flags[group]] = (table) => drizzle_orm.sql`case when ${toSQL(table, wheres)} then 1 else 0 end`;
 		});
 		return {
 			columns,
@@ -414,8 +391,7 @@ function createColumnMasker({ actions }, tables) {
 		columnsHidden
 	};
 }
-//#endregion
-//#region lib/helpers/sqlTypes/types.ts
+// lib/helpers/sqlTypes/types.ts
 /**
 * Strips parameter suffixes like `(256)`, `(10,2)` and timezone modifiers
 * (`with time zone`, `without time zone`) from raw getSQLType() output so
@@ -522,8 +498,7 @@ function isBytesSQLTypeString(sqlType) {
 	return bytesSQLTypeStrings.includes(sqlType);
 }
 const UnknownTypeRumbleError = (sqlType, additionalInfo) => new RumbleError(`RumbleError: Unknown SQL type '${sqlType}'. Please open an issue (https://github.com/m1212e/rumble/issues) so it can be added. (${additionalInfo})`);
-//#endregion
-//#region lib/helpers/sqlTypes/distinctValuesFromSQLType.ts
+// lib/helpers/sqlTypes/distinctValuesFromSQLType.ts
 function createDistinctValuesFromSQLType(sqlType) {
 	if (isIntLikeSQLTypeString(sqlType)) return {
 		value1: 1,
@@ -559,8 +534,7 @@ function createDistinctValuesFromSQLType(sqlType) {
 	};
 	throw UnknownTypeRumbleError(sqlType, "Distinct");
 }
-//#endregion
-//#region lib/helpers/telemetry.ts
+// lib/helpers/telemetry.ts
 const SPAN_EXECUTE = _pothos_tracing_opentelemetry.SpanNames.EXECUTE;
 /** @pothos/tracing-opentelemetry's SpanNames enum has no subscribe member. */
 const SPAN_SUBSCRIBE = "graphql.subscribe";
@@ -584,6 +558,7 @@ const ATTR_ABILITIES_STATUS = "rumble.abilities.status";
 const ATTR_ABILITIES_STATIC = "rumble.abilities.static";
 const ATTR_ABILITIES_DYNAMIC = "rumble.abilities.dynamic";
 const ATTR_ABILITIES_TOTAL = "rumble.abilities.total";
+const ATTR_ABILITIES_RESOLVED = "rumble.abilities.resolved";
 const ATTR_FILTERS_TOTAL = "rumble.filters.total";
 const ATTR_FILTERS_ALLOWED = "rumble.filters.allowed";
 const ATTR_SUBSCRIPTION_EVENT_INDEX = "rumble.subscription.event_index";
@@ -734,8 +709,7 @@ function startTimer() {
 function durationMs(start) {
 	return Math.round((performance.now() - start) * 100) / 100;
 }
-//#endregion
-//#region lib/abilityBuilder/filterResponse.ts
+// lib/abilityBuilder/filterResponse.ts
 /**
 * The limit of a find many call. An injected merge limit wins unless the
 * ability limit is lower, otherwise the default limit caps the ability limit.
@@ -800,16 +774,125 @@ function createFilterResponder({ db, defaultLimit }, tableSchema) {
 		return ret;
 	};
 }
-//#endregion
-//#region lib/abilityBuilder/queryFilter.ts
+// lib/abilityBuilder/queryFilter.ts
 function isDynamicQueryFilter(filter) {
 	return typeof filter === "function";
 }
 function isStaticQueryFilter(filter) {
 	return typeof filter !== "function";
 }
-//#endregion
-//#region lib/helpers/errorLogging.ts
+// lib/helpers/determineDialectFromSchema.ts
+const dialectCache = /* @__PURE__ */ new WeakMap();
+function determineDBDialectFromSchema(schema) {
+	const cached = dialectCache.get(schema);
+	if (cached) return cached;
+	const found = /* @__PURE__ */ new Set();
+	for (const table of Object.values(schema).map((t) => t.table)) {
+		if (!table || typeof table !== "object") continue;
+		if ((0, drizzle_orm.is)(table, drizzle_orm_pg_core.PgTable)) found.add("postgres");
+		else if ((0, drizzle_orm.is)(table, drizzle_orm_mysql_core.MySqlTable)) found.add("mysql");
+		else if ((0, drizzle_orm.is)(table, drizzle_orm_sqlite_core.SQLiteTable)) found.add("sqlite");
+	}
+	const dialects = Array.from(found);
+	if (dialects.length === 1) {
+		const only = dialects[0];
+		dialectCache.set(schema, only);
+		return only;
+	}
+	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
+	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
+}
+function isPostgresDB(db) {
+	return determineDBDialectFromSchema(db._.relations) === "postgres";
+}
+// lib/abilityBuilder/resolveRules.ts
+const DEFAULT_MAX_RESOLVED_IDS = 500;
+/**
+* Whether the where names a relation of the table, so it renders as (nested)
+* `exists` subqueries.
+*/
+function referencesRelation(filter, relations) {
+	if (!filter || typeof filter !== "object") return false;
+	return Object.entries(filter).some(([key, value]) => {
+		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
+		if (key === "NOT") return referencesRelation(value, relations);
+		return key in relations;
+	});
+}
+/**
+* Creates the function replacing the relational rules of a table by the
+* primary keys they match, resolved with one query per call.
+*
+* A relational rule ("the users whose delegation the caller supervises")
+* renders as a chain of correlated `exists` subqueries, once in the row filter
+* and once more in every column flag, at every place the table is nested in a
+* query. Planning such a statement costs the database tens of megabytes. For a
+* given caller the rule matches a fixed set of rows though, so this looks them
+* up once (`select pk from table where <rule>`) and the rule becomes
+* `pk in (...)`, which costs the planner nothing. Rules matching more than
+* `maxIds` rows stay relational, so broad rules do not turn into huge lists.
+*
+* Returns undefined when disabled or the table has no single primary key.
+*/
+function createRuleResolver(settings, tableSchema) {
+	const config = settings.resolveRelationalRules;
+	const primaryKeys = Object.keys(tableSchema.primaryKey);
+	if (!config?.enabled || primaryKeys.length !== 1) return void 0;
+	const maxIds = config.maxIds ?? DEFAULT_MAX_RESOLVED_IDS;
+	const primaryKeyName = primaryKeys[0];
+	const db = settings.db;
+	const table = tableSchema.table;
+	const dialect = determineDBDialectFromSchema(db._.relations);
+	const unionAll = {
+		postgres: drizzle_orm_pg_core.unionAll,
+		sqlite: drizzle_orm_sqlite_core.unionAll,
+		mysql: drizzle_orm_mysql_core.unionAll
+	}[dialect];
+	const listFilter = (ids) => dialect === "postgres" ? { RAW: (aliased) => drizzle_orm.sql`${aliased[primaryKeyName]} = any(${drizzle_orm.sql.param(ids)})` } : { [primaryKeyName]: { in: ids } };
+	/** The primary keys matching the rule, tagged with the rule's index. */
+	const matches = (where, rule) => {
+		const limited = db.select({
+			pk: table[primaryKeyName],
+			rule: drizzle_orm.sql.raw(String(rule)).as("rule")
+		}).from(table).where((0, drizzle_orm.relationsFilterToSQL)(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)).limit(maxIds + 1).as(`rumble_rule_${rule}`);
+		return db.select({
+			pk: limited.pk,
+			rule: limited.rule
+		}).from(limited);
+	};
+	const whereOf = (filter) => realWhere(filter?.where);
+	return async function resolveRules(filters) {
+		const relational = filters.flatMap((filter, index) => referencesRelation(whereOf(filter), tableSchema.relations) ? [index] : []);
+		if (relational.length === 0) return {
+			filters,
+			resolved: 0
+		};
+		const queries = relational.map((index) => matches(whereOf(filters[index]), index));
+		const rows = await (queries.length === 1 ? queries[0] : unionAll(...queries));
+		const idsPerRule = new Map(relational.map((index) => [index, []]));
+		for (const row of rows) idsPerRule.get(Number(row.rule)).push(row.pk);
+		let resolved = 0;
+		const result = [];
+		filters.forEach((filter, index) => {
+			const ids = idsPerRule.get(index);
+			if (!ids || ids.length > maxIds) {
+				result.push(filter);
+				return;
+			}
+			resolved++;
+			if (ids.length === 0) return;
+			result.push({
+				...filter,
+				where: listFilter(ids)
+			});
+		});
+		return {
+			filters: result,
+			resolved
+		};
+	};
+}
+// lib/helpers/errorLogging.ts
 function hasMessage(error) {
 	return typeof error === "object" && error !== null && "message" in error;
 }
@@ -840,8 +923,7 @@ function errorsLogField(errors) {
 function errorLogField(error) {
 	return errorsLogField([error]);
 }
-//#endregion
-//#region lib/abilityBuilder/telemetry.ts
+// lib/abilityBuilder/telemetry.ts
 const makeNothingRegisteredWarner = (config, logger) => (0, es_toolkit.debounce)((model, action) => {
 	const msg = `No abilities registered for ${model}/${action} — blocking everything. Register the ability or ignore this warning if intentional.`;
 	if (logger) logger.warn({
@@ -889,8 +971,7 @@ function traceAbilityPreparation({ otel, log, telemetryConfig }, tableName, acti
 	});
 	return run();
 }
-//#endregion
-//#region lib/abilityBuilder/tableAbilities.ts
+// lib/abilityBuilder/tableAbilities.ts
 /**
 * filter() is async. Without type checking (plain JS, `any`) a forgotten await would
 * hand the promise itself to drizzle
@@ -948,7 +1029,23 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 	const blockEverythingFilter = createBlockEverythingFilter(String(tableName), tableSchema);
 	const resolveColumnAccess = createColumnAccessResolver(settings, tableSchema);
 	const transformToResponse = createFilterResponder(settings, tableSchema);
-	const assembleAbilities = async (userContext, action, attributes) => {
+	const resolveRules = createRuleResolver(settings, tableSchema);
+	const evaluateDynamicFilters = (userContext, action) => Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+	/** The response for the rules applying to the caller: their OR, columns and flags. */
+	const respondWithFilters = (action, allQueryFilters) => {
+		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
+			return mergeFilters(a, b, "OR");
+		});
+		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
+		if (columns) mergedFilters.columns = columns;
+		else delete mergedFilters.columns;
+		if (extras) mergedFilters.extras = {
+			...mergedFilters.extras,
+			...extras
+		};
+		return transformToResponse(mergedFilters, mask, visibility);
+	};
+	const assembleAbilities = async (action, attributes, evaluate) => {
 		const filters = queryFilters.get(action);
 		if (filters === "unrestricted") {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
@@ -959,7 +1056,7 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			settings.warnNothingRegistered(String(tableName), action);
 			return transformToResponse(blockEverythingFilter);
 		}
-		const rawResults = await Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+		const rawResults = await evaluate();
 		if (rawResults.includes("allow")) {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
 			return transformToResponse();
@@ -967,28 +1064,32 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 		const dynamicResults = rawResults.filter((r) => r !== void 0).map(withRestrictingWhere);
 		attributes[ATTR_ABILITIES_DYNAMIC] = dynamicResults.length;
 		attributes[ATTR_ABILITIES_STATIC] = simpleQueryFilters[action].length;
-		const allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
+		let allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
 		attributes[ATTR_ABILITIES_TOTAL] = allQueryFilters.length;
+		if (resolveRules && allQueryFilters.length > 0) {
+			const resolution = await resolveRules(allQueryFilters);
+			allQueryFilters = resolution.filters;
+			attributes[ATTR_ABILITIES_RESOLVED] = resolution.resolved;
+		}
 		if (allQueryFilters.length === 0) {
 			attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
 			return transformToResponse(blockEverythingFilter);
 		}
-		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
-			return mergeFilters(a, b, "OR");
-		});
-		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
-		if (columns) mergedFilters.columns = columns;
-		else delete mergedFilters.columns;
-		if (extras) mergedFilters.extras = {
-			...mergedFilters.extras,
-			...extras
-		};
 		attributes[ATTR_ABILITIES_STATUS] = "applied";
-		return transformToResponse(mergedFilters, mask, visibility);
+		return respondWithFilters(action, allQueryFilters);
 	};
 	return { withContext: (userContext) => {
-		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(userContext, action, attributes));
-		const cache = /* @__PURE__ */ new Map();
+		const evaluated = /* @__PURE__ */ new Map();
+		const evaluate = (action) => {
+			let results = evaluated.get(action);
+			if (!results) {
+				results = evaluateDynamicFilters(userContext, action);
+				evaluated.set(action, results);
+			}
+			return results;
+		};
+		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(action, attributes, () => evaluate(action)));
+		let cache = /* @__PURE__ */ new Map();
 		const resolved = /* @__PURE__ */ new Map();
 		const abilities = { filter: (action) => {
 			let prepared = cache.get(action);
@@ -1000,11 +1101,13 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			return prepared;
 		} };
 		abilities[resolvedFilterKey] = (action) => resolved.get(action);
+		abilities[refreshAbilitiesKey] = () => {
+			if (resolveRules) cache = /* @__PURE__ */ new Map();
+		};
 		return abilities;
 	} };
 };
-//#endregion
-//#region lib/abilityBuilder/inputGuard.ts
+// lib/abilityBuilder/inputGuard.ts
 /** The ts names of the columns a relation joins on, on either side. */
 function relationColumnKeys(db, table, columns) {
 	const known = tableHelper({
@@ -1137,8 +1240,7 @@ async function relationExposure(abilities, table, action, columns) {
 	const guard = abilities[guardInputKey];
 	return guard ? guard.exposed(table, action, columns) : [];
 }
-//#endregion
-//#region lib/abilityBuilder/tableBuilder.ts
+// lib/abilityBuilder/tableBuilder.ts
 /**
 * Creates the registration API (allow/filter) of a single table.
 */
@@ -1222,9 +1324,20 @@ when: (queryFilter) => {
 		}
 	};
 };
-//#endregion
-//#region lib/abilityBuilder/index.ts
-const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerConfig }) => {
+// lib/abilityBuilder/refresh.ts
+/**
+* Starts a new snapshot of the resolved relational rules of every table, see
+* `resolveRelationalRules`. Rumble calls this whenever a root field starts to
+* resolve. Call it yourself in a resolver that writes rows and then reads them
+* through a table whose rules it already resolved before the write. A no-op
+* unless rules are resolved.
+*/
+function refreshAbilities(abilities) {
+	if (!abilities) return;
+	for (const table of Object.values(abilities)) table?.[refreshAbilitiesKey]?.();
+}
+// lib/abilityBuilder/index.ts
+const createAbilityBuilder = ({ db, actions, defaultLimit, resolveRelationalRules, otel, logger: loggerConfig }) => {
 	const log = loggerConfig?.enabled ? loggerConfig.logger : void 0;
 	const telemetryConfig = {
 		otel,
@@ -1234,6 +1347,7 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 		db,
 		actions,
 		defaultLimit,
+		resolveRelationalRules,
 		otel,
 		telemetryConfig,
 		log,
@@ -1300,8 +1414,7 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 		}
 	};
 };
-//#endregion
-//#region lib/helpers/asserts.ts
+// lib/helpers/asserts.ts
 /**
 *
 * Helper function to map a drizzle findFirst query result,
@@ -1380,8 +1493,7 @@ const assertFirstEntryExists = (value) => {
 	if (!v) throw new RumbleErrorSafe("Value not found but required (firstEntry)");
 	return v;
 };
-//#endregion
-//#region lib/helpers/mapNullFieldsToUndefined.ts
+// lib/helpers/mapNullFieldsToUndefined.ts
 /**
 * Helper to map null fields to undefined
 * @param obj The object to map
@@ -1443,11 +1555,9 @@ where: { id: user.id },
 function mapNullFieldsToUndefined(obj) {
 	return Object.fromEntries(Object.entries(obj).map(([key, value]) => [key, value === null ? void 0 : value]));
 }
-//#endregion
-//#region package.json
-var version = "0.27.0";
-//#endregion
-//#region lib/args/orderArg.ts
+// package.json
+var version = "0.27.4";
+// lib/args/orderArg.ts
 const makeDefaultName$1 = (dbName) => `${(0, es_toolkit.capitalize)((0, drizzle_orm_casing.toCamelCase)(dbName.toString()))}OrderInputArgument`;
 const createOrderArgImplementer = ({ db, schemaBuilder }) => {
 	const referenceStorage = /* @__PURE__ */ new Map();
@@ -1478,8 +1588,7 @@ const createOrderArgImplementer = ({ db, schemaBuilder }) => {
 	};
 	return orderArgImplementer;
 };
-//#endregion
-//#region lib/enum.ts
+// lib/enum.ts
 /**
 * Checks if a column is a database enum column (Postgres or MySQL).
 */
@@ -1539,8 +1648,7 @@ const createEnumImplementer = ({ schema, schemaBuilder }) => {
 	};
 	return enumImplementer;
 };
-//#endregion
-//#region lib/helpers/sqlTypes/mapSQLTypeToTSType.ts
+// lib/helpers/sqlTypes/mapSQLTypeToTSType.ts
 function mapSQLTypeToGraphQLType({ sqlType, fieldName }) {
 	if (/^enum\(/.test(sqlType)) return "String";
 	const normalized = normalizeSQLType(sqlType);
@@ -1562,8 +1670,7 @@ function mapSQLTypeToGraphQLType({ sqlType, fieldName }) {
 	if (ret !== void 0) return ret;
 	throw UnknownTypeRumbleError(sqlType, "SQL to GQL");
 }
-//#endregion
-//#region lib/args/whereArg.ts
+// lib/args/whereArg.ts
 const makeDefaultName = (dbName) => `${(0, es_toolkit.capitalize)((0, drizzle_orm_casing.toCamelCase)(dbName.toString()))}WhereInputArgument`;
 const createWhereArgImplementer = ({ db, schemaBuilder, enumImplementer }) => {
 	const referenceStorage = /* @__PURE__ */ new Map();
@@ -1788,8 +1895,7 @@ const createWhereArgImplementer = ({ db, schemaBuilder, enumImplementer }) => {
 	};
 	return whereArgImplementer;
 };
-//#endregion
-//#region lib/client/client.ts
+// lib/client/client.ts
 const clientCreatorImplementer = ({ builtSchema }) => {
 	const clientCreator = async ({ apiUrl, outputPath, rumbleImportPath, useExternalUrqlClient, removeExisting, forceReactivity, autoIncludeIdField = false }) => {
 		if (process.env.NODE_ENV !== "development") console.warn(`Running rumble client generation in non development mode. Are you sure this is correct? Called with arguments: ${JSON.stringify({
@@ -1813,8 +1919,7 @@ const clientCreatorImplementer = ({ builtSchema }) => {
 	};
 	return clientCreator;
 };
-//#endregion
-//#region lib/context.ts
+// lib/context.ts
 const createContextFunction = ({ context: makeUserContext, abilityBuilder }) => {
 	const builtAbilityBuilder = (0, es_toolkit.once)(() => abilityBuilder._.build());
 	return async (req) => {
@@ -1825,8 +1930,7 @@ const createContextFunction = ({ context: makeUserContext, abilityBuilder }) =>
 		};
 	};
 };
-//#endregion
-//#region lib/helpers/protoMapper.ts
+// lib/helpers/protoMapper.ts
 function deepSetProto(obj, proto = Object.prototype, seen = /* @__PURE__ */ new WeakSet()) {
 	if (obj === null || typeof obj !== "object") return;
 	if (seen.has(obj)) return;
@@ -1840,8 +1944,7 @@ function deepSetProto(obj, proto = Object.prototype, seen = /* @__PURE__ */ new
 	Object.setPrototypeOf(obj, proto);
 	for (const key of Object.keys(obj)) deepSetProto(obj[key], proto, seen);
 }
-//#endregion
-//#region lib/countQuery.ts
+// lib/countQuery.ts
 const createCountQueryImplementer = ({ db, schemaBuilder, whereArgImplementer, makePubSubInstance }) => {
 	return ({ table, listAction = "read", isAllowed }) => {
 		const WhereArg = whereArgImplementer({ table });
@@ -1881,8 +1984,7 @@ const createCountQueryImplementer = ({ db, schemaBuilder, whereArgImplementer, m
 		});
 	};
 };
-//#endregion
-//#region lib/helpers/sofaOpenAPIWebhookDocs.ts
+// lib/helpers/sofaOpenAPIWebhookDocs.ts
 const sofaOpenAPIWebhookDocs = {
 	paths: {
 		"/webhook": { post: {
@@ -1966,8 +2068,7 @@ const sofaOpenAPIWebhookDocs = {
 		}
 	} }
 };
-//#endregion
-//#region lib/helpers/tracing.ts
+// lib/helpers/tracing.ts
 function isAsyncIterable(value) {
 	return typeof value === "object" && value !== null && Symbol.asyncIterator in value;
 }
@@ -2155,8 +2256,7 @@ function buildTracedSubscribe(subscribeFn, rumbleInput, transport) {
 		});
 	};
 }
-//#endregion
-//#region lib/helpers/sqlTypes/mapDrizzleTypeToGraphQlType.ts
+// lib/helpers/sqlTypes/mapDrizzleTypeToGraphQlType.ts
 function buildPothosResponseTypeFromGraphQLType({ builder, sqlType, fieldName, nullable, isArray }) {
 	const gqlType = mapSQLTypeToGraphQLType({
 		sqlType,
@@ -2204,33 +2304,7 @@ function buildPothosResponseTypeFromGraphQLType({ builder, sqlType, fieldName, n
 		default: throw new RumbleError(`Unsupported object type ${gqlType} for column ${fieldName}`);
 	}
 }
-//#endregion
-//#region lib/helpers/determineDialectFromSchema.ts
-const dialectCache = /* @__PURE__ */ new WeakMap();
-function determineDBDialectFromSchema(schema) {
-	const cached = dialectCache.get(schema);
-	if (cached) return cached;
-	const found = /* @__PURE__ */ new Set();
-	for (const table of Object.values(schema).map((t) => t.table)) {
-		if (!table || typeof table !== "object") continue;
-		if ((0, drizzle_orm.is)(table, drizzle_orm_pg_core.PgTable)) found.add("postgres");
-		else if ((0, drizzle_orm.is)(table, drizzle_orm_mysql_core.MySqlTable)) found.add("mysql");
-		else if ((0, drizzle_orm.is)(table, drizzle_orm_sqlite_core.SQLiteTable)) found.add("sqlite");
-	}
-	const dialects = Array.from(found);
-	if (dialects.length === 1) {
-		const only = dialects[0];
-		dialectCache.set(schema, only);
-		return only;
-	}
-	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
-	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
-}
-function isPostgresDB(db) {
-	return determineDBDialectFromSchema(db._.relations) === "postgres";
-}
-//#endregion
-//#region lib/search.ts
+// lib/search.ts
 async function initSearchIfApplicable(input) {
 	const log = input.logger?.enabled ? input.logger.logger : void 0;
 	if (!isPostgresDB(input.db)) {
@@ -2290,8 +2364,7 @@ function adjustQueryArgsForSearch({ search, args, tableSchema, abilities }) {
 		}), drizzle_orm.sql.raw(" OR "))})` }] };
 	}
 }
-//#endregion
-//#region lib/object.ts
+// lib/object.ts
 const isProbablyAConfigObject = (t) => {
 	if (typeof t !== "object") return false;
 	if (Object.keys(t).some((k) => [
@@ -2519,8 +2592,7 @@ const createObjectImplementer = ({ db, search, otel, logger: loggerConfig, schem
 		});
 	};
 };
-//#endregion
-//#region lib/pubsub.ts
+// lib/pubsub.ts
 const SUBSCRIPTION_NOTIFIER_RUMBLE_PREFIX = "RUMBLE_SUBSCRIPTION_NOTIFICATION";
 const SUBSCRIPTION_NOTIFIER_REMOVED = "REMOVED";
 const SUBSCRIPTION_NOTIFIER_UPDATED = "UPDATED";
@@ -2595,8 +2667,7 @@ const createPubSubInstance = ({ subscriptions }) => {
 		makePubSubInstance
 	};
 };
-//#endregion
-//#region lib/query.ts
+// lib/query.ts
 const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: loggerConfig, whereArgImplementer, orderArgImplementer, makePubSubInstance }) => {
 	const registeredQueryFieldNames = /* @__PURE__ */ new Set();
 	const telemetryConfig = {
@@ -2711,8 +2782,7 @@ const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: logge
 		});
 	};
 };
-//#endregion
-//#region lib/args/whereArgsImplementer.ts
+// lib/args/whereArgsImplementer.ts
 function implementDefaultWhereInputArgs(schemaBuilder) {
 	const IntWhereInputArgument = schemaBuilder.inputRef("IntWhereInputArgument").implement({ fields: (t) => ({
 		eq: t.int(),
@@ -2964,16 +3034,14 @@ function implementDefaultWhereInputArgs(schemaBuilder) {
 		NOT: t.field({ type: DateTimeWhereInputArgument })
 	}) });
 }
-//#endregion
-//#region lib/helpers/objectTypeOptions.ts
+// lib/helpers/objectTypeOptions.ts
 function objectTypeOptionsOfField(buildCache, fieldConfig) {
 	const type = fieldConfig.type;
 	const ref = type.kind === "List" ? type.type.kind === "Object" ? type.type.ref : void 0 : type.kind === "Object" ? type.ref : void 0;
 	if (!ref) return void 0;
 	return buildCache.getTypeConfig(ref, "Object").pothosOptions;
 }
-//#endregion
-//#region lib/helpers/registerPlugin.ts
+// lib/helpers/registerPlugin.ts
 const registered = /* @__PURE__ */ new Set();
 function registerPluginOnce(name, plugin) {
 	if (registered.has(name)) return;
@@ -2981,15 +3049,13 @@ function registerPluginOnce(name, plugin) {
 	_pothos_core.default.registerPlugin(name, plugin);
 	registered.add(name);
 }
-//#endregion
-//#region lib/columnMaskPlugin/maskTypes.ts
+// lib/columnMaskPlugin/maskTypes.ts
 const maskColumnsKey = "maskColumns";
 const maskColumnsActionKey = "maskColumnsAction";
 const maskPrimaryKeysKey = "maskPrimaryKeys";
 const maskRelationsKey = "maskRelations";
 const columnMaskPluginName = "ColumnMaskPlugin";
-//#endregion
-//#region lib/columnMaskPlugin/columnMaskPlugin.ts
+// lib/columnMaskPlugin/columnMaskPlugin.ts
 var ColumnMaskPlugin = class extends _pothos_core.BasePlugin {
 	wrapResolve(resolver, fieldConfig) {
 		return this.maskResult(this.maskRelation(this.maskPrimaryKey(resolver, fieldConfig), fieldConfig), fieldConfig);
@@ -3028,8 +3094,7 @@ var ColumnMaskPlugin = class extends _pothos_core.BasePlugin {
 function registerColumnMaskPlugin() {
 	registerPluginOnce(columnMaskPluginName, ColumnMaskPlugin);
 }
-//#endregion
-//#region lib/helpers/abilityAwareClient.ts
+// lib/helpers/abilityAwareClient.ts
 function createAbilityAwareClient({ db, abilityBuilder }) {
 	return (context) => {
 		const apis = /* @__PURE__ */ new Map();
@@ -3073,11 +3138,31 @@ function createAbilityAwareClient({ db, abilityBuilder }) {
 		} });
 	};
 }
-//#endregion
-//#region lib/runtimeFiltersPlugin/filterTypes.ts
+// lib/refreshAbilitiesPlugin/refreshAbilitiesPlugin.ts
+const refreshAbilitiesPluginName = "RefreshAbilitiesPlugin";
+/**
+* Starts a new snapshot of the resolved relational rules whenever a root
+* field (query, mutation or subscription event) starts to resolve, see
+* `resolveRelationalRules`. A mutation's second root field sees what the first
+* wrote, and a live query refetching sees the rows related to the caller by
+* now. A no-op unless rules are resolved.
+*/
+var RefreshAbilitiesPlugin = class extends _pothos_core.BasePlugin {
+	wrapResolve(resolver, fieldConfig) {
+		const { kind } = this.buildCache.getTypeConfig(fieldConfig.parentType);
+		if (kind !== "Query" && kind !== "Mutation" && kind !== "Subscription") return resolver;
+		return (parent, args, context, info) => {
+			refreshAbilities(context?.abilities);
+			return resolver(parent, args, context, info);
+		};
+	}
+};
+function registerRefreshAbilitiesPlugin() {
+	registerPluginOnce(refreshAbilitiesPluginName, RefreshAbilitiesPlugin);
+}
+// lib/runtimeFiltersPlugin/filterTypes.ts
 const pluginName = "RuntimeFiltersPlugin";
-//#endregion
-//#region lib/runtimeFiltersPlugin/runtimeFiltersPlugin.ts
+// lib/runtimeFiltersPlugin/runtimeFiltersPlugin.ts
 const applyFiltersKey = "applyFilters";
 var RuntimeFiltersPlugin = class extends _pothos_core.BasePlugin {
 	tracer;
@@ -3179,8 +3264,7 @@ var RuntimeFiltersPlugin = class extends _pothos_core.BasePlugin {
 function registerRuntimeFiltersPlugin() {
 	registerPluginOnce(pluginName, RuntimeFiltersPlugin);
 }
-//#endregion
-//#region lib/scalars/addressData.ts
+// lib/scalars/addressData.ts
 /*! Address data derived from Google's Address Data Service (https://github.com/google/libaddressinput),
 * licensed under CC-BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
 * Changes: reduced to required fields, postal code patterns and examples, and regions with
@@ -8992,8 +9076,7 @@ const addressData = {
 	},
 	ZW: { require: "AC" }
 };
-//#endregion
-//#region lib/scalars/addressValidation.ts
+// lib/scalars/addressValidation.ts
 const REQUIRED_FIELD_PATHS = {
 	A: "streetAddress",
 	C: "locality",
@@ -9123,8 +9206,7 @@ const addressValidationSchema = zod.z.object({
 		message: issue.message
 	});
 });
-//#endregion
-//#region lib/scalars/address.ts
+// lib/scalars/address.ts
 function implementDefaultAddressTypes(schemaBuilder) {
 	return {
 		Address: schemaBuilder.objectRef("Address").implement({
@@ -9150,8 +9232,7 @@ function implementDefaultAddressTypes(schemaBuilder) {
 		})
 	};
 }
-//#endregion
-//#region lib/scalars/emailAddress.ts
+// lib/scalars/emailAddress.ts
 /**
 * Validates an email address using graphql-scalars' own format check, then lowercases it, exactly
 * as the `EmailAddress` scalar does. Exported for values that do not arrive as GraphQL input,
@@ -9177,8 +9258,7 @@ const EmailAddressResolver = new graphql.GraphQLScalarType({
 		return normalizeEmailAddress(ast.value);
 	}
 });
-//#endregion
-//#region lib/scalars/personName.ts
+// lib/scalars/personName.ts
 const MAX_LENGTH = 200;
 const NAME_REGEX = /^[\p{L}\p{M}]+(?:(?:[ '-]|\.\x20?)[\p{L}\p{M}]+)*\.?$/u;
 const APOSTROPHE_VARIANTS = /[\u2018\u2019\u02BC\u00B4\u0060]/gu;
@@ -9207,8 +9287,7 @@ const PersonNameResolver = new graphql.GraphQLScalarType({
 		return normalizePersonName(ast.value);
 	}
 });
-//#endregion
-//#region lib/scalars/phoneNumber.ts
+// lib/scalars/phoneNumber.ts
 /**
 * Parses and validates a phone number using libphonenumber-js (Google's phone number metadata),
 * which checks real per-country validity (length, area code plausibility, ...) rather than just
@@ -9245,16 +9324,17 @@ const PhoneNumberResolver = new graphql.GraphQLScalarType({
 		return parsePhoneNumber(ast.value);
 	}
 });
-//#endregion
-//#region lib/schemaBuilder.ts
+// lib/schemaBuilder.ts
 const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validation, abilityBuilder }) => {
 	const createSpan = otel?.enabled && otel.tracer ? (0, _pothos_tracing_opentelemetry.createOpenTelemetryWrapper)(otel.tracer, otel.options) : void 0;
 	registerRuntimeFiltersPlugin();
 	registerColumnMaskPlugin();
+	registerRefreshAbilitiesPlugin();
 	const schemaBuilder = new _pothos_core.default({
 		...pothosConfig,
 		plugins: [
 			columnMaskPluginName,
+			refreshAbilitiesPluginName,
 			pluginName,
 			_pothos_plugin_drizzle.default,
 			_pothos_plugin_smart_subscriptions.default,
@@ -9330,8 +9410,7 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validatio
 	schemaBuilder.mutationType({});
 	return { schemaBuilder };
 };
-//#endregion
-//#region lib/rumble.ts
+// lib/rumble.ts
 /**
 * Mirrors sofa's own default error handler: it derives the HTTP status from
 * `extensions.http` and returns the errors as JSON. rumble only adds telemetry
@@ -9659,7 +9738,6 @@ export const r = rumble({
 		buildSchema: builtSchema
 	};
 };
-//#endregion
 exports.RumbleError = RumbleError;
 exports.RumbleErrorSafe = RumbleErrorSafe;
 exports.addressChecks = addressChecks;
@@ -9677,6 +9755,7 @@ exports.normalizeAddress = normalizeAddress;
 exports.normalizeEmailAddress = normalizeEmailAddress;
 exports.normalizePersonName = normalizePersonName;
 exports.parsePhoneNumber = parsePhoneNumber;
+exports.refreshAbilities = refreshAbilities;
 exports.rumble = rumble;
 exports.validateAddress = validateAddress;