@vantreeseba/drizzle-graphql 15.1.1 → 15.1.3

package/dist/index.js

@@ -2,7 +2,7 @@ import { Column, One, SQL, Table, aliasedTable, and, arrayContains, arrayOverlap
 import { MySqlAsyncDatabase, MySqlDate, MySqlDateString, MySqlDateTime, MySqlDateTimeString, MySqlInt, MySqlSerial, MySqlTable, MySqlTimestamp, MySqlTimestampString, getTableConfig } from "drizzle-orm/mysql-core";
 import { PgAsyncDatabase, PgDate, PgDateString, PgInteger, PgSerial, PgTable, PgTimestamp, PgTimestampString, PgUUID, getTableConfig as getTableConfig$1 } from "drizzle-orm/pg-core";
 import { SQLiteAsyncDatabase, SQLiteInteger, SQLiteTable, SQLiteTimestamp, getTableConfig as getTableConfig$2 } from "drizzle-orm/sqlite-core";
-import { GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLInputObjectType, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLScalarType, GraphQLSchema, GraphQLString, Kind, getArgumentValues } from "graphql";
+import { GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLInputObjectType, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLScalarType, GraphQLSchema, GraphQLString, Kind, getArgumentValues, getNamedType } from "graphql";
 import { GraphQLDateTime, GraphQLJSON, GraphQLUUID } from "graphql-scalars";
 import pluralize from "pluralize";
 //#region src/util/builders/common/errors.ts
@@ -1983,6 +1983,13 @@ const extractUniqueKeyFilter = (table, tableName, fieldName, members, value) =>
 */
 const narrowedCtxCache = /* @__PURE__ */ new WeakMap();
 /**
+* One alias counter per build, shared by every table's narrowed context. A statement can
+* combine subqueries compiled from different contexts — a relation filter on one table whose
+* target's scope is a filter object reaching through another relation, say — and nested
+* subqueries that drew the same alias from two separate counters would shadow each other.
+*/
+const aliasCounters = /* @__PURE__ */ new WeakMap();
+/**
 * Narrows the build-scoped relation filter context to the table a resolver is filtering.
 *
 * Cached rather than rebuilt: the base carries the build's whole `tables` and `relationMap`,
@@ -1996,7 +2003,7 @@ const narrowedCtxCache = /* @__PURE__ */ new WeakMap();
 * aliases only ever have to be unique *within* one statement, which a number that never
 * repeats gives more surely than one that restarts.
 */
-const relationFilterCtx = (base, tableKey) => {
+const relationFilterCtx = (base, tableKey, scope) => {
 	if (!base) return;
 	let byTable = narrowedCtxCache.get(base);
 	if (!byTable) {
@@ -2005,13 +2012,33 @@ const relationFilterCtx = (base, tableKey) => {
 	}
 	let ctx = byTable.get(tableKey);
 	if (!ctx) {
+		let aliases = aliasCounters.get(base);
+		if (!aliases) {
+			aliases = { n: 0 };
+			aliasCounters.set(base, aliases);
+		}
 		ctx = {
 			...base,
-			tableKey
+			tableKey,
+			aliases
 		};
 		byTable.set(tableKey, ctx);
 	}
-	return ctx;
+	return scope ? {
+		...ctx,
+		scope
+	} : ctx;
+};
+/**
+* The row-policy predicate a subquery over a relation's target applies: the target's scope
+* and soft-delete condition, in the `deleted` mode the relation field defaults to — so a
+* relation filter or a relation ordering sees exactly the rows the relation field returns.
+*/
+const relationTargetPolicy = (ctx, relation, targetTableName, aliasedTarget) => {
+	const scope = ctx.scope;
+	if (!scope) return;
+	const mode = scope.relationDefault(targetTableName, is(relation, One) && relation.optional === false);
+	return scope.has(targetTableName, mode) ? scope.on(targetTableName, aliasedTarget, mode) : void 0;
 };
 /**
 * Correlates the parent row with the aliased target table using the relation's own join
@@ -2102,8 +2129,11 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	const throughTable = relation.throughTable;
 	let fromClause;
 	let joinCondition;
+	let junctionPolicy;
 	if (throughTable) {
 		const aliasedThrough = aliasedTable(throughTable, `dgql_rel_${aliases.n++}`);
+		const throughTableName = ctx.scope ? Object.keys(ctx.tables).find((name) => ctx.tables[name] === throughTable) : void 0;
+		if (throughTableName && ctx.scope.has(throughTableName)) junctionPolicy = ctx.scope.on(throughTableName, aliasedThrough);
 		const { correlation, junctionJoin } = buildThroughJoinConditions(parentTable, relation, aliasedThrough, aliasedTarget, relationName);
 		fromClause = sql`${getTableAsAliasSQL(aliasedTarget)} inner join ${getTableAsAliasSQL(aliasedThrough)} on ${junctionJoin}`;
 		joinCondition = correlation;
@@ -2113,6 +2143,7 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	}
 	const ownWhere = relationOwnWhere(relation);
 	const relationWhere = ownWhere ? relationsFilterToSQL(isRelationFilterReversed(relation) ? parentTable : aliasedTarget, ownWhere) : void 0;
+	const policy = and(relationTargetPolicy(ctx, relation, targetTableName, aliasedTarget), junctionPolicy);
 	const inner = innerFilters ? extractFilters(aliasedTarget, targetTableName, innerFilters, {
 		...ctx,
 		tableKey: targetTableName,
@@ -2120,9 +2151,9 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	}) : void 0;
 	if (mode === "every") {
 		if (!inner) return;
-		return sql`not exists (select 1 from ${fromClause} where ${and(joinCondition, relationWhere, not(inner))})`;
+		return sql`not exists (select 1 from ${fromClause} where ${and(joinCondition, relationWhere, policy, not(inner))})`;
 	}
-	const condition = and(joinCondition, relationWhere, inner);
+	const condition = and(joinCondition, relationWhere, policy, inner);
 	return mode === "none" ? sql`not exists (select 1 from ${fromClause} where ${condition})` : sql`exists (select 1 from ${fromClause} where ${condition})`;
 };
 /**
@@ -2394,8 +2425,8 @@ const columnEnumCache = /* @__PURE__ */ new WeakMap();
 * input field the enum would have typed, rather than emitting an empty enum, which is
 * invalid GraphQL.
 */
-const generateColumnEnum = (table, enumName, description, predicate = () => true) => {
-	const cacheKey = `${enumName}\u0000${excludedColumnsKey(table)}`;
+const generateColumnEnum = (table, enumName, description, predicate = () => true, variant = "") => {
+	const cacheKey = `${enumName}\u0000${excludedColumnsKey(table)}\u0000${variant}`;
 	let tableCache = columnEnumCache.get(table);
 	const cached = tableCache?.get(cacheKey);
 	if (cached) return cached;
@@ -2455,6 +2486,9 @@ const conflictActionEnumType = (typeName) => sharedType(typeName, {
 * `ON DUPLICATE KEY UPDATE` fires on any unique key and takes no predicate, so offering
 * either there would mean silently ignoring it.
 *
+* `update` never offers a `contextValues` column: the server owns it, and the conflict
+* branch is an update, which must not hand the row to another owner.
+*
 * Returns `undefined` when the table has nothing to conflict on (`withTarget` dialects
 * only) — the caller then generates no upsert mutations for that table at all, rather than
 * an operation whose every call is a database error.
@@ -2462,12 +2496,13 @@ const conflictActionEnumType = (typeName) => sharedType(typeName, {
 const generateOnConflictInput = (params) => {
 	const { table, tableName, typeName, uniqueSets, tableFilters, withTarget, cacheCtx } = params;
 	const resolveName = cacheCtx.typeName;
+	const serverOwned = Object.keys(cacheCtx.contextValuesOf?.(tableName) ?? {}).sort();
 	const updateEnum = generateColumnEnum(table, resolveName({
 		kind: "columnEnum",
 		defaultName: `${typeName}UpdateColumn`,
 		table: tableName,
 		operation: "conflictUpdate"
-	}), `Columns of ${typeName} that an upsert can overwrite`);
+	}), `Columns of ${typeName} that an upsert can overwrite`, (_column, columnName) => !serverOwned.includes(columnName), serverOwned.join(","));
 	if (!updateEnum) return;
 	const fields = {
 		action: {
@@ -2477,11 +2512,11 @@ const generateOnConflictInput = (params) => {
 		},
 		update: {
 			type: new GraphQLList(new GraphQLNonNull(updateEnum)),
-			description: "Columns to overwrite on conflict. Defaults to every column the request supplied, minus the conflict target. Columns the request did not supply cannot be listed here — there would be no value to write."
+			description: `Columns to overwrite on conflict. Defaults to every column the request supplied, minus the ${withTarget ? "conflict target" : "primary key"}. Columns the request did not supply cannot be listed here — there would be no value to write.`
 		}
 	};
 	if (withTarget) {
-		const uniqueColumns = new Set(uniqueSets.flat());
+		const uniqueColumns = new Set(uniqueSets.flatMap((set) => set.columns));
 		const targetEnum = generateColumnEnum(table, resolveName({
 			kind: "columnEnum",
 			defaultName: `${typeName}ConflictTarget`,
@@ -2509,55 +2544,88 @@ const generateOnConflictInput = (params) => {
 	});
 };
 /**
-* Turns the request's `onConflict` argument and the rows it is inserting into the clause a
-* dialect should attach.
+* Turns the request's `onConflict` argument and the rows it is inserting into the
+* statements a dialect should run — one per run of consecutive rows that write the same
+* columns on conflict.
+*
+* The split is what keeps a partial row partial. A multi-row insert fills a key one row
+* left out with DEFAULT, and `excluded.<column>` would carry that default onto the existing
+* row, so rows that supply different columns cannot share a `SET` list. Splitting into
+* *consecutive* runs, rather than grouping, keeps the rows a caller gets back in the order
+* it sent them. A batch whose rows agree — the usual case — is still one statement.
 *
 * `excludedRef` names the row that failed to insert in the dialect's own terms
 * (`excluded.col` on PostgreSQL and SQLite, `values(col)` on MySQL), which is what makes a
 * batch upsert update each row with its own values instead of the last row's.
 *
+* Never written on conflict, even when supplied: the conflict target (it already matches);
+* the primary key on a dialect with no target (MySQL's conflict can be on another unique
+* key, and copying a generated id over the existing row's would move it); and `serverOwned`
+* — the `contextValues` columns, which an update never reassigns.
+*
 * An UPDATE with nothing left to write degrades to NOTHING: `DO UPDATE SET` with an empty
 * body is not valid SQL, and doing nothing is what the request asked for anyway.
 */
 const resolveConflictPlan = (params) => {
 	const { table, values, onConflict, pkNames, uniqueSets, excludedRef, withTarget, buildWhere } = params;
 	const columns = getColumns(table);
+	const serverOwned = new Set(params.serverOwned ?? []);
 	let target;
+	let targetWhere;
 	if (withTarget) {
 		const targetNames = onConflict?.target?.length ? onConflict.target : [...pkNames];
 		if (!targetNames.length) throw drizzleError("Unable to upsert: no conflict target was given and this table has no primary key. Pass onConflict.target.", { code: "DRIZZLE_INVALID_ON_CONFLICT" });
 		const requested = [...targetNames].sort().join(",");
-		if (!uniqueSets.some((set) => [...set].sort().join(",") === requested)) throw drizzleError(`Unable to upsert: [${targetNames.join(", ")}] is not a unique constraint on this table. Valid conflict targets: ${uniqueSets.map((set) => `[${set.join(", ")}]`).join(", ")}.`, { code: "DRIZZLE_INVALID_ON_CONFLICT" });
+		const matched = uniqueSets.find((set) => [...set.columns].sort().join(",") === requested);
+		if (!matched) throw drizzleError(`Unable to upsert: [${targetNames.join(", ")}] is not a unique constraint on this table. Valid conflict targets: ${uniqueSets.map((set) => `[${set.columns.join(", ")}]`).join(", ")}.`, { code: "DRIZZLE_INVALID_ON_CONFLICT" });
 		target = targetNames.map((name) => columns[name]);
+		targetWhere = matched.where;
 	}
-	if ((onConflict?.action ?? "UPDATE") === "NOTHING") return {
+	const nothing = {
 		action: "NOTHING",
 		target,
+		targetWhere,
 		set: {},
 		setWhere: void 0
 	};
+	if ((onConflict?.action ?? "UPDATE") === "NOTHING") return [{
+		values,
+		plan: nothing
+	}];
 	const supplied = new Set(values.flatMap((row) => Object.keys(row)));
-	const targetNames = new Set(withTarget ? onConflict?.target?.length ? onConflict.target : pkNames : []);
-	let updateNames;
+	const neverWritten = new Set(withTarget && onConflict?.target?.length ? onConflict.target : pkNames);
+	let candidates;
 	if (onConflict?.update?.length) {
+		const owned = onConflict.update.filter((name) => serverOwned.has(name));
+		if (owned.length) throw drizzleError(`Unable to upsert: onConflict.update lists ${owned.join(", ")}, which the server sets and an update never overwrites.`, { code: "DRIZZLE_INVALID_ON_CONFLICT" });
 		const unsupplied = onConflict.update.filter((name) => !supplied.has(name));
 		if (unsupplied.length) throw drizzleError(`Unable to upsert: onConflict.update lists ${unsupplied.join(", ")}, which the values do not supply.`, { code: "DRIZZLE_INVALID_ON_CONFLICT" });
-		updateNames = onConflict.update;
-	} else updateNames = [...supplied].filter((name) => !targetNames.has(name));
-	if (!updateNames.length) return {
-		action: "NOTHING",
-		target,
-		set: {},
-		setWhere: void 0
-	};
-	const set = Object.fromEntries(updateNames.map((name) => [name, excludedRef(columns[name].name)]));
+		candidates = onConflict.update;
+	} else candidates = [...supplied].filter((name) => !neverWritten.has(name) && !serverOwned.has(name));
 	const setWhere = onConflict?.where && buildWhere ? buildWhere(onConflict.where) : void 0;
-	return {
+	const planFor = (updateNames) => updateNames.length ? {
 		action: "UPDATE",
 		target,
-		set,
+		targetWhere,
+		set: Object.fromEntries(updateNames.map((name) => [name, excludedRef(columns[name].name)])),
 		setWhere
-	};
+	} : nothing;
+	const batches = [];
+	for (const row of values) {
+		const updateNames = candidates.filter((name) => name in row);
+		const key = updateNames.join(",");
+		const last = batches[batches.length - 1];
+		if (last?.key === key) last.values.push(row);
+		else batches.push({
+			key,
+			values: [row],
+			plan: planFor(updateNames)
+		});
+	}
+	return batches.map(({ values: rows, plan }) => ({
+		values: rows,
+		plan
+	}));
 };
 /** `excluded.<column>` — PostgreSQL and SQLite name the rejected row this way. */
 const excludedColumnRef = (columnName) => sql`excluded.${sql.identifier(columnName)}`;
@@ -2611,12 +2679,14 @@ const extendRelationOrderChain = (parentTable, relationName, relEntry, ctx, chai
 	const joinCondition = buildRelationJoinCondition(parentTable, relation, aliasedTarget, relationName);
 	const ownWhere = relationOwnWhere(relation);
 	const relationWhere = ownWhere ? relationsFilterToSQL(isRelationFilterReversed(relation) ? parentTable : aliasedTarget, ownWhere) : void 0;
+	const policy = relationTargetPolicy(ctx, relation, relEntry.targetTableName, aliasedTarget);
 	return {
 		fromParts: [...chain?.fromParts ?? [], getTableAsAliasSQL(aliasedTarget)],
 		conditions: [
 			...chain?.conditions ?? [],
 			...joinCondition ? [joinCondition] : [],
-			...relationWhere ? [relationWhere] : []
+			...relationWhere ? [relationWhere] : [],
+			...policy ? [policy] : []
 		],
 		table: aliasedTarget
 	};
@@ -3001,9 +3071,9 @@ const primaryKeyOrderExprs = (table, pkNames) => {
 	return pkNames.map((n) => cols[n]).filter(Boolean).map((col) => asc(col));
 };
 /**
-* Every set of columns that uniquely identifies a row of `table`: the primary key first,
-* then each unique constraint and unique index, then each column declared `.unique()`
-* inline. Sets are property names (what GraphQL inputs use), not database column names.
+* Every set of columns that is unique on `table`: the primary key first, then each unique
+* constraint and unique index, then each column declared `.unique()` inline. Sets are
+* property names (what GraphQL inputs use), not database column names.
 *
 * `getTableConfig` is the dialect's own — the three dialects expose the same
 * `{ primaryKeys, uniqueConstraints, indexes }` shape but from different modules, so the
@@ -3012,9 +3082,13 @@ const primaryKeyOrderExprs = (table, pkNames) => {
 * Index entries whose columns are SQL expressions rather than plain columns are skipped:
 * an expression index is a valid conflict target in the database but cannot be named by a
 * column enum. Deduplicated, order-insensitive — a column that is both the primary key and
-* a unique constraint yields one set.
+* a unique constraint yields one set, and a set that is unique both outright and under a
+* partial index keeps the outright one.
+*
+* A partial unique index carries its predicate as `where`: it is a conflict target only
+* together with that predicate, and it does not make the set unique across the whole table.
 */
-const getUniqueColumnSets = (table, getTableConfig) => {
+const getUniqueTargets = (table, getTableConfig) => {
 	const cols = visibleColumns(table);
 	const propNameByColumnName = new Map(Object.entries(cols).map(([propName, col]) => [col.name, propName]));
 	const toPropNames = (columnNames) => {
@@ -3026,25 +3100,40 @@ const getUniqueColumnSets = (table, getTableConfig) => {
 		}
 		return propNames.length ? propNames : void 0;
 	};
+	const whole = (columns) => columns ? { columns } : void 0;
 	const config = getTableConfig(table);
 	const candidates = [
-		Object.entries(cols).filter(([, col]) => col.primary).map(([propName]) => propName),
-		...config.primaryKeys.map((pk) => toPropNames(pk.columns.map((c) => c.name))),
-		...(config.uniqueConstraints ?? []).map((uc) => toPropNames(uc.columns.map((c) => c.name))),
-		...(config.indexes ?? []).filter((index) => index.config.unique).map((index) => toPropNames(index.config.columns.map((c) => c?.name))),
-		...Object.entries(cols).filter(([, col]) => col.isUnique).map(([propName]) => [propName])
+		whole(Object.entries(cols).filter(([, col]) => col.primary).map(([propName]) => propName)),
+		...config.primaryKeys.map((pk) => whole(toPropNames(pk.columns.map((c) => c.name)))),
+		...(config.uniqueConstraints ?? []).map((uc) => whole(toPropNames(uc.columns.map((c) => c.name)))),
+		...(config.indexes ?? []).filter((index) => index.config.unique).map((index) => {
+			const columns = toPropNames(index.config.columns.map((c) => c?.name));
+			return columns ? {
+				columns,
+				...index.config.where ? { where: index.config.where } : {}
+			} : void 0;
+		}),
+		...Object.entries(cols).filter(([, col]) => col.isUnique).map(([propName]) => ({ columns: [propName] }))
 	];
-	const seen = /* @__PURE__ */ new Set();
-	const sets = [];
-	for (const set of candidates) {
-		if (!set?.length) continue;
-		const key = [...set].sort().join(",");
-		if (seen.has(key)) continue;
-		seen.add(key);
-		sets.push(set);
+	const byKey = /* @__PURE__ */ new Map();
+	for (const candidate of candidates) {
+		if (!candidate?.columns.length) continue;
+		const key = [...candidate.columns].sort().join(",");
+		const seen = byKey.get(key);
+		if (!seen) byKey.set(key, candidate);
+		else if (seen.where && !candidate.where) byKey.set(key, { columns: seen.columns });
 	}
-	return sets;
+	return [...byKey.values()];
 };
+/**
+* The column sets that identify at most one row of `table` — {@link getUniqueTargets}
+* without the partial unique indexes, which only constrain the rows their predicate
+* matches (a soft-deleted duplicate is allowed), and so do not.
+*
+* Pass `{ partial: true }` to keep them, for callers that only need to know a set is
+* unique among the rows that matter.
+*/
+const getUniqueColumnSets = (table, getTableConfig, options = {}) => getUniqueTargets(table, getTableConfig).filter((target) => options.partial || !target.where).map((target) => target.columns);
 //#endregion
 //#region src/util/builders/common/distinct.ts
 /**
@@ -3827,10 +3916,10 @@ const extractRelationsParams = (relationMap, tables, tableName, info, typeName,
 		});
 		const relWhere = relationArgs?.where;
 		const relDeleted = relationArgs?.deleted ?? scope?.relationDefault(targetTableName, is(relEntry.relation, One) && relEntry.relation.optional === false);
-		thisRecord.where = relWhere || scope?.has(targetTableName, relDeleted) ? { RAW: (aliasedTable) => withScope(scope, targetTableName, aliasedTable, relWhere ? extractFilters(aliasedTable, relName, relWhere, relationFilterCtx(filterCtx, targetTableName)) : void 0, relDeleted) } : void 0;
+		thisRecord.where = relWhere || scope?.has(targetTableName, relDeleted) ? { RAW: (aliasedTable) => withScope(scope, targetTableName, aliasedTable, relWhere ? extractFilters(aliasedTable, relName, relWhere, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0, relDeleted) } : void 0;
 		const hasPagination = offset != null || limit != null;
 		const pkNames = targetPkNames ?? [];
-		thisRecord.orderBy = relationArgs?.orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, relationArgs.orderBy, relationFilterCtx(filterCtx, targetTableName), relWhere) : hasPagination && pkNames.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0;
+		thisRecord.orderBy = relationArgs?.orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, relationArgs.orderBy, relationFilterCtx(filterCtx, targetTableName, scope), relWhere) : hasPagination && pkNames.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0;
 		thisRecord.offset = offset;
 		thisRecord.limit = limit;
 		thisRecord.with = extractRelationsParams(relationMap, tables, targetTableName, field, relTypeName, options);
@@ -3888,7 +3977,7 @@ const runRelationalSelect = async (opts) => {
 			tableName,
 			distinct,
 			pkNames: pkNames ?? [],
-			where: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0, deleted),
+			where: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, deleted),
 			orderBy,
 			limit: single ? 1 : opts.limit,
 			offset
@@ -3903,8 +3992,8 @@ const runRelationalSelect = async (opts) => {
 			allRelations: filterCtx?.relationMap
 		}),
 		offset: distinctKeys ? void 0 : offset,
-		orderBy: distinctKeys ? (aliasedTable) => [...orderBy ? extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName), where) : [], ...primaryKeyOrderExprs(aliasedTable, pkNames)] : cursorEntries ? (aliasedTable) => cursorOrderExprs(aliasedTable, cursorEntries) : orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName), where) : needsDefaultOrder && pkNames?.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0,
-		where: distinctKeys ? { RAW: (aliasedTable) => primaryKeyRestriction(aliasedTable, pkNames, distinctKeys) } : where || cursorValues || scope?.has(tableName, deleted) ? { RAW: (aliasedTable) => withScope(scope, tableName, aliasedTable, and(where ? extractFilters(aliasedTable, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0, cursorValues ? buildCursorCondition(aliasedTable, cursorEntries, cursorValues, opts.nullOrdering ?? "nulls-smallest") : void 0), deleted) } : void 0,
+		orderBy: distinctKeys ? (aliasedTable) => [...orderBy ? extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName, scope), where) : [], ...primaryKeyOrderExprs(aliasedTable, pkNames)] : cursorEntries ? (aliasedTable) => cursorOrderExprs(aliasedTable, cursorEntries) : orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName, scope), where) : needsDefaultOrder && pkNames?.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0,
+		where: distinctKeys ? { RAW: (aliasedTable) => primaryKeyRestriction(aliasedTable, pkNames, distinctKeys) } : where || cursorValues || scope?.has(tableName, deleted) ? { RAW: (aliasedTable) => withScope(scope, tableName, aliasedTable, and(where ? extractFilters(aliasedTable, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, cursorValues ? buildCursorCondition(aliasedTable, cursorEntries, cursorValues, opts.nullOrdering ?? "nulls-smallest") : void 0), deleted) } : void 0,
 		with: relationMap[tableName] ? extractRelationsParams(relationMap, tables, tableName, parsedInfo, typeName, {
 			typeNameMapper,
 			filterCtx,
@@ -4486,7 +4575,7 @@ const generateWriteCount = ({ db, tableName, table, kind, setArgs, filterArgs, f
 				tableName,
 				table,
 				where,
-				relationCtx: relationFilterCtx(filterCtx, tableName),
+				relationCtx: relationFilterCtx(filterCtx, tableName, scope),
 				required: requireWhere,
 				deleted: hard ? "INCLUDE" : void 0
 			});
@@ -4674,6 +4763,19 @@ const keysFromWhere = (where, primaryKey) => {
 	return none;
 };
 /**
+* Whether an upsert's `onConflict` leaves the primary-key values in `values` naming exactly
+* the rows it writes. It does not when the conflict is detected on another unique key — the
+* row updated is whichever one holds that key, not the one the supplied primary key names —
+* nor when conflicting rows can be skipped: `action: NOTHING`, or a `where` guard.
+*/
+const conflictsOnKeyAlone = (onConflict, primaryKey) => {
+	if (!onConflict || typeof onConflict !== "object") return true;
+	const { target, action, where } = onConflict;
+	if (action === "NOTHING" || where !== void 0 && where !== null) return false;
+	if (!Array.isArray(target) || !target.length) return true;
+	return [...target].sort().join(",") === [...primaryKey].sort().join(",");
+};
+/**
 * The rows a generated field's arguments are about, as primary-key values.
 *
 * The row identity of a mutation lives in a different argument for every operation —
@@ -4709,7 +4811,7 @@ const identifyRows = (field, args) => {
 			table,
 			primaryKey,
 			rows: rows.filter((row) => !!row),
-			complete: entries.length > 0 && rows.every(Boolean)
+			complete: entries.length > 0 && rows.every(Boolean) && (meta.operation !== "upsert" || conflictsOnKeyAlone(args?.["onConflict"], primaryKey))
 		};
 	}
 	if (targetArg === "updates") {
@@ -4879,7 +4981,7 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 			const executor = resolveExecutor(db, context);
 			const uniqueIds = [...new Set(parentIds)];
 			const scope = resolveScope(policies, context, filterCtx);
-			let whereCondition = withScope(scope, targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0, cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0), deleted ?? defaultDeleted);
+			let whereCondition = withScope(scope, targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0, cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0), deleted ?? defaultDeleted);
 			if (distinct) {
 				const keys = await selectDistinctKeys({
 					db: executor,
@@ -4904,10 +5006,10 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 				[PARENT_KEY]: groupCol
 			} : columns;
 			let rows;
-			if (limit != null || offset != null) rows = await batchedPaginatedRelationQuery(executor, targetTable, foreignCol, whereCondition, orderByArg, limit ?? null, offset ?? null, targetPkNames, selection, relationFilterCtx(filterCtx, targetTableName), whereArg, junction);
+			if (limit != null || offset != null) rows = await batchedPaginatedRelationQuery(executor, targetTable, foreignCol, whereCondition, orderByArg, limit ?? null, offset ?? null, targetPkNames, selection, relationFilterCtx(filterCtx, targetTableName, scope), whereArg, junction);
 			else {
 				let q = withJunction((selection ? executor.select(selection) : executor.select()).from(targetTable), junction, foreignCol).where(whereCondition);
-				const orderExprs = cursorEntries ? cursorOrderExprs(targetTable, cursorEntries) : orderByArg ? extractOrderBy(targetTable, orderByArg, relationFilterCtx(filterCtx, targetTableName), whereArg) : [];
+				const orderExprs = cursorEntries ? cursorOrderExprs(targetTable, cursorEntries) : orderByArg ? extractOrderBy(targetTable, orderByArg, relationFilterCtx(filterCtx, targetTableName, scope), whereArg) : [];
 				if (orderExprs.length) q = q.orderBy(...orderExprs);
 				rows = await q;
 			}
@@ -5587,6 +5689,7 @@ const resolveBuildConfig = (config, schema) => {
 			const normalized = {};
 			for (const [columnName, entry] of Object.entries(orderBy)) {
 				if (!columns[columnName]) throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy names '${columnName}', which is not a column of '${tableName}'.`);
+				if (config?.exclude?.columns?.[tableName]?.includes(columnName)) throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy names '${columnName}', which config.exclude.columns hides. A default ordering is encoded into every row's cursor, so it can only use columns the schema exposes.`);
 				const direction = typeof entry === "string" ? entry : entry?.direction;
 				if (direction !== "asc" && direction !== "desc") throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy.${columnName} must be 'asc', 'desc', or { direction, priority? }.`);
 				const priority = typeof entry === "string" ? void 0 : entry?.priority;
@@ -5967,7 +6070,8 @@ const generateAggregate = (db, tableName, table, typeName, fieldName, filterArgs
 				const request = parseAggregateRequest(info, target);
 				if (!Object.keys(request.selection).length) return {};
 				let query = resolveExecutor(db, context).select(request.selection).from(table);
-				const where = withScope(resolveScope(policies, context, filterCtx), tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0, args.deleted);
+				const scope = resolveScope(policies, context, filterCtx);
+				const where = withScope(scope, tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, args.deleted);
 				if (where) query = query.where(where);
 				const rows = await query;
 				return assembleAggregateRow(rows[0] ?? {}, request, target);
@@ -6044,7 +6148,8 @@ const createRelationAggregateFactory = (db, tables, cacheCtx, typeNameMapper, fi
 				const loader = getOrCreateLoader(context, loaderKey, async (parentIds) => {
 					const executor = resolveExecutor(db, context);
 					const uniqueIds = [...new Set(parentIds)];
-					const whereCondition = withScope(resolveScope(policies, context, filterCtx), targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0), deleted ?? defaultDeleted);
+					const scope = resolveScope(policies, context, filterCtx);
+					const whereCondition = withScope(scope, targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0), deleted ?? defaultDeleted);
 					const selected = executor.select({
 						[GROUP_KEY]: groupCol,
 						...request.selection
@@ -6260,7 +6365,8 @@ const generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs,
 					...request.selection
 				};
 				let query = resolveExecutor(db, context).select(selection).from(table);
-				const where = withScope(resolveScope(policies, context, filterCtx), tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0, args.deleted);
+				const scope = resolveScope(policies, context, filterCtx);
+				const where = withScope(scope, tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, args.deleted);
 				if (where) query = query.where(where);
 				query = query.groupBy(...keyColumns.map(([, column]) => column));
 				const havingCondition = buildHavingCondition(args.having, columns);
@@ -6299,6 +6405,54 @@ const generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs,
 	};
 };
 //#endregion
+//#region src/util/builders/common/build-registry.ts
+/**
+* Keyed by the `extensions.drizzle` object of every object type the build generated, rather
+* than by the type: a schema composed from `entities.types` keeps the types, and one rebuilt
+* by a schema-transforming tool (`mapSchema`, stitching) keeps their extensions.
+*/
+const runtimeByTypeMeta = /* @__PURE__ */ new WeakMap();
+/**
+* What is known about the builds of one drizzle instance, for a caller with no resolve info to
+* look its build up by. Only a lone build is kept — with two or more there is no telling which
+* one a selection belongs to — so rebuilding a schema repeatedly holds on to nothing extra.
+*/
+const buildsByDb = /* @__PURE__ */ new WeakMap();
+/** Whether a build changes what a read returns at all: a row policy, a limit or a default ordering. */
+const hasPolicies = (runtime) => !!(runtime.policies?.scope || runtime.policies?.defaultOrderBy || runtime.limits);
+/** Records a finished build against the object types it generated and the instance it read. */
+const registerBuildRuntime = (runtime, types) => {
+	for (const type of types) {
+		const meta = drizzleExtension(type);
+		if (meta) runtimeByTypeMeta.set(meta, runtime);
+	}
+	const previous = buildsByDb.get(runtime.db);
+	buildsByDb.set(runtime.db, previous ? {
+		count: previous.count + 1,
+		anyPolicies: previous.anyPolicies || hasPolicies(runtime)
+	} : {
+		count: 1,
+		only: runtime,
+		anyPolicies: hasPolicies(runtime)
+	});
+};
+/** The build that generated `type`, when one did. */
+const runtimeForType = (type) => {
+	const meta = type && typeof type === "object" ? drizzleExtension(type) : void 0;
+	return meta ? runtimeByTypeMeta.get(meta) : void 0;
+};
+/**
+* The build of `db` to use when no generated type identifies one: the only build, or none
+* when no build applies any policy. Throws when several builds exist and one of them would
+* change the read, since picking either could apply the wrong policies — or none.
+*/
+const runtimeForDb = (db, helper) => {
+	const builds = buildsByDb.get(db);
+	if (!builds) return;
+	if (builds.count === 1) return builds.only;
+	if (builds.anyPolicies) throw new Error(`Drizzle-GraphQL Error: ${helper} cannot tell which of the ${builds.count} schemas built over this database the selection belongs to, and at least one applies row policies (scope, softDelete, limits or defaults). Pass the resolver's \`info\` rather than a parsed selection tree, from a field whose type the build generated.`);
+};
+//#endregion
 //#region src/util/builders/nested-writes.ts
 const ALL_OPS = [
 	"create",
@@ -6791,7 +6945,7 @@ const createNestedWriteRuntime = (params) => {
 	* nothing is rejected: `connect: {}` would otherwise attach every row in the table.
 	*/
 	const conditionOf = (plan, filter, operation, scope) => {
-		const condition = extractFilters(plan.targetTable, plan.targetTableName, filter, relationFilterCtx(filterCtx, plan.targetTableName));
+		const condition = extractFilters(plan.targetTable, plan.targetTableName, filter, relationFilterCtx(filterCtx, plan.targetTableName, scope));
 		if (!condition) throw drizzleError(`Drizzle-GraphQL Error: '${operation}' on '${plan.relationName}' needs a filter that selects rows — it was given one that matches everything.`, { code: "DRIZZLE_NESTED_WRITE_INVALID" });
 		return withScope(scope, plan.targetTableName, plan.targetTable, condition);
 	};
@@ -7186,7 +7340,7 @@ const createSchemaBuilder = (adapter) => {
 			uniqueKeysOf: (tableName) => uniqueKeys[tableName]
 		};
 		adapter.preflight?.(db, options);
-		const nestedPlans = features.nestedWrites ? buildNestedWritePlans(tables, namedRelations, (target) => uniqueColumnSets(target), (target) => primaryKeyPropNames(target), extractRelationJoinColumns, (junction) => schemaEntries.find(([, value]) => value === junction)?.[0]) : void 0;
+		const nestedPlans = features.nestedWrites ? buildNestedWritePlans(tables, namedRelations, (target) => getUniqueColumnSets(target, adapter.getTableConfig, { partial: true }), (target) => primaryKeyPropNames(target), extractRelationJoinColumns, (junction) => schemaEntries.find(([, value]) => value === junction)?.[0]) : void 0;
 		if (nestedPlans) {
 			const omitted = gateNestedWritePlans(nestedPlans, featureOf, (tableName) => excludedTables.has(tableName));
 			if (omitted.length) {
@@ -7402,6 +7556,14 @@ const createSchemaBuilder = (adapter) => {
 			}
 			if (Object.keys(relResolvers).length > 0) fieldResolvers[tableName] = relResolvers;
 		}
+		registerBuildRuntime({
+			db: ctx.db,
+			filterCtx: ctx.filterCtx,
+			policies: ctx.policies,
+			scoped: !!ctx.tablePolicies?.scope,
+			limits: ctx.limits,
+			nullOrdering: adapter.nullOrdering
+		}, Object.values(ctx.outputs));
 		return {
 			queries: ctx.queries,
 			mutations: ctx.mutations,
@@ -7474,20 +7636,33 @@ const generateUpsert = (db, tableName, table, baseType, onConflictType, fieldNam
 			}
 		},
 		run: async ({ executor, args, context, before, after }) => {
-			const input = applyContextValuesAll(single ? [remapFromGraphQLSingleInput(args.values, table)] : remapFromGraphQLArrayInput(args.values, table), policies?.contextValues?.(tableName), context);
+			const contextColumns = policies?.contextValues?.(tableName);
+			const input = applyContextValuesAll(single ? [remapFromGraphQLSingleInput(args.values, table)] : remapFromGraphQLArrayInput(args.values, table), contextColumns, context);
 			if (!input.length) throw drizzleError("No values were provided!", { code: "DRIZZLE_NO_VALUES" });
 			await before();
-			const plan = resolveConflictPlan({
+			const batches = resolveConflictPlan({
 				table,
 				values: input,
 				onConflict: args.onConflict,
 				pkNames,
 				uniqueSets: [],
 				excludedRef: mysqlValuesColumnRef,
-				withTarget: false
+				withTarget: false,
+				serverOwned: Object.keys(contextColumns ?? {})
+			});
+			const requestedNothing = args.onConflict?.action === "NOTHING";
+			const runBatch = async (target, { values, plan }) => {
+				if (plan.action === "NOTHING" && !requestedNothing) {
+					const columns = getColumns(table);
+					const keyName = pkNames[0] ?? Object.keys(columns)[0];
+					await target.insert(table).values(values).onDuplicateKeyUpdate({ set: { [keyName]: sql`${sql.identifier(columns[keyName].name)}` } });
+				} else if (plan.action === "NOTHING") await target.insert(table).ignore().values(values);
+				else await target.insert(table).values(values).onDuplicateKeyUpdate({ set: plan.set });
+			};
+			if (batches.length === 1) await runBatch(executor, batches[0]);
+			else await executor.transaction(async (tx) => {
+				for (const batch of batches) await runBatch(tx, batch);
 			});
-			if (plan.action === "NOTHING") await executor.insert(table).ignore().values(input);
-			else await executor.insert(table).values(input).onDuplicateKeyUpdate({ set: plan.set });
 			await after();
 			return isSuccess;
 		}
@@ -7511,7 +7686,7 @@ const generateUpdate = (db, tableName, table, setArgs, filterArgs, fieldName, si
 		const input = stripContextValues(remapUpdateInput(set, table, tableName), policies?.contextValues?.(tableName));
 		if (!Object.keys(input).length) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
 		await before();
-		const relationCtx = relationFilterCtx(filterCtx, tableName);
+		const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 		const filters = scopedWhere({
 			scope,
 			tableName,
@@ -7557,7 +7732,7 @@ const generateUpdateMany$2 = (db, tableName, table, updateManyInput, fieldName,
 			if (!Object.keys(input).length) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
 			return {
 				set: input,
-				filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0)
+				filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0)
 			};
 		});
 		await executor.transaction(async (tx) => {
@@ -7600,7 +7775,7 @@ const generateDelete = (db, tableName, table, filterArgs, fieldName, single, req
 			const { where } = args;
 			const hard = canHardDelete && args.hard === true;
 			const scope = policies?.scope?.(context);
-			const relationCtx = relationFilterCtx(filterCtx, tableName);
+			const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 			const filters = scopedWhere({
 				scope,
 				tableName,
@@ -7933,7 +8108,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 				});
 				const returning = withHookReturning(nestedEntries ? nested.withJoinColumns(tableName, mergedOps(nestedEntries), { ...columns }, table) : columns);
 				const runUpsert = async (target, values) => {
-					const plan = resolveConflictPlan({
+					const batches = resolveConflictPlan({
 						table,
 						values,
 						onConflict: args.onConflict,
@@ -7941,16 +8116,29 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 						uniqueSets,
 						excludedRef: excludedColumnRef,
 						withTarget: true,
-						buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName))
+						serverOwned: Object.keys(contextColumns ?? {}),
+						buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope))
 					});
-					let query = target.insert(table).values(values).returning(returning);
-					const setWhere = withScope(scope, tableName, table, plan.setWhere);
-					query = plan.action === "NOTHING" ? query.onConflictDoNothing(plan.target ? { target: plan.target } : void 0) : query.onConflictDoUpdate({
-						target: plan.target,
-						set: plan.set,
-						setWhere
+					const runBatch = async (executor, { values: rows, plan }) => {
+						let query = executor.insert(table).values(rows).returning(returning);
+						const setWhere = withScope(scope, tableName, table, plan.setWhere);
+						query = plan.action === "NOTHING" ? query.onConflictDoNothing(plan.target ? {
+							target: plan.target,
+							where: plan.targetWhere
+						} : void 0) : query.onConflictDoUpdate({
+							target: plan.target,
+							targetWhere: plan.targetWhere,
+							set: plan.set,
+							setWhere
+						});
+						return await query;
+					};
+					if (batches.length === 1) return runBatch(target, batches[0]);
+					return target.transaction(async (tx) => {
+						const rows = [];
+						for (const batch of batches) rows.push(...await runBatch(tx, batch));
+						return rows;
 					});
-					return await query;
 				};
 				const written = nestedEntries ? await writeWithNestedOps({
 					executor,
@@ -8011,7 +8199,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 				const nestedOps = entry && nested.hasOps(entry.ops) ? entry.ops : void 0;
 				const input = stripContextValues(remapUpdateInput(entry ? entry.columns : set, table, tableName), policies?.contextValues?.(tableName));
 				if (!Object.keys(input).length && !nestedOps) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
-				const relationCtx = relationFilterCtx(filterCtx, tableName);
+				const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 				const filters = scopedWhere({
 					scope,
 					tableName,
@@ -8090,7 +8278,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 				await before();
 				const parsedInfo = parseResolveInfo(info, { deep: true });
 				const columns = extractSelectedColumnsFromTreeSQLFormat(parsedInfo.fieldsByTypeName[applyObjectTypeName(typeName, tableName, resolveName)], table, selectionCtx);
-				const relationCtx = relationFilterCtx(filterCtx, tableName);
+				const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 				const filters = scopedWhere({
 					scope,
 					tableName,
@@ -8130,7 +8318,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 */
 const createSchemaDataGenerator = (adapter) => {
 	const primaryKeyPropNames = adapter.primaryKeyPropNames;
-	const uniqueColumnSets = (table) => getUniqueColumnSets(table, adapter.getTableConfig);
+	const uniqueTargets = (table) => getUniqueTargets(table, adapter.getTableConfig);
 	const { generateInsert, generateUpsert, generateUpdate, generateDelete } = buildWriteResolvers(primaryKeyPropNames);
 	const { prepareBuild, forEachTable, finalizeBuild } = createSchemaBuilder(adapter);
 	return (db, schema, relations, options) => {
@@ -8171,7 +8359,7 @@ const createSchemaDataGenerator = (adapter) => {
 				single: true,
 				conflictDoNothing
 			}) : void 0;
-			const uniqueSets = tableFeatures.upsert ? uniqueColumnSets(schema[tableName]) : [];
+			const uniqueSets = tableFeatures.upsert ? uniqueTargets(schema[tableName]) : [];
 			const onConflictInput = tableFeatures.upsert ? generateOnConflictInput({
 				table: schema[tableName],
 				tableName,
@@ -8541,7 +8729,7 @@ const createUpdateManyGenerator = (primaryKeyPropNames, runBatch = runUpdateMany
 					return {
 						set: input,
 						ops,
-						filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0)
+						filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0)
 					};
 				});
 				const anyNested = entries.some((entry) => entry.ops);
@@ -8711,6 +8899,36 @@ const namingRuleOf = (options) => resolveGeneratedTypeNames({
 	typeNameSuffix: options.typeNameSuffix
 });
 /**
+* The build whose policies the read applies. Looked up through the generated types the
+* resolve info reaches — the field's return type, the root table's type in the executing
+* schema, the parent type — so a resolver over a generated type finds its own build. Without
+* resolve info (a parsed tree was passed), the instance's only build is used.
+*/
+const runtimeFor = (info, db, typeName, helper) => {
+	if (!("fieldsByTypeName" in info)) {
+		const candidates = [
+			info.returnType ? getNamedType(info.returnType) : void 0,
+			info.schema?.getType(typeName),
+			info.parentType
+		];
+		for (const candidate of candidates) {
+			const runtime = runtimeForType(candidate);
+			if (runtime && runtime.db === db) return runtime;
+		}
+	}
+	return runtimeForDb(db, helper);
+};
+/**
+* The request's row policies under `runtime`, bound to the context the caller passed. A build
+* with `scope` hooks cannot be read without that context: the hooks would be called with
+* nothing, and running the read unscoped is the leak the option exists to prevent.
+*/
+const scopeFor = (runtime, options, helper) => {
+	if (!runtime?.policies?.scope) return;
+	if (runtime.scoped && !("context" in options)) throw new Error(`Drizzle-GraphQL Error: the schema this selection belongs to configures \`scope\`, so ${helper} needs the request context to apply it. Pass the resolver's context as the \`context\` option.`);
+	return runtime.policies.scope(options.context);
+};
+/**
 * Reads the parsed selection tree out of a resolver's `info`, resolving fragments and
 * inline fragments. Accepts an already-parsed tree so a caller that has one (or is chaining
 * these helpers) does not pay for the walk twice.
@@ -8737,6 +8955,10 @@ const parseInfo = (info) => {
 * const row = await tx.query.Users.findFirst({ where: { id: { eq } }, with: withTree });
 * ```
 *
+* Every nested entry carries the build's row policies — `scope`, `softDelete`, `limits` and
+* `defaults.orderBy` — exactly as the generated `with:` clause does. The build is found
+* through the resolve info; pass `context` when it configures `scope`.
+*
 * Returns `undefined` when the selection asks for no relations, which is the value the
 * query builder wants for "no `with` clause".
 */
@@ -8746,11 +8968,16 @@ const selectionToWith = (info, options) => {
 	const { tables, relationMap, filterCtx } = contextFor(db);
 	if (!tables[table]) throw new Error(`Drizzle-GraphQL Error: '${table}' is not a table in the Drizzle schema.`);
 	if (!relationMap[table]) return;
+	const typeName = resolveObjectTypeName(table, typeNameMapper, resolveName);
+	const runtime = runtimeFor(info, db, typeName, "selectionToWith");
 	const parsed = parseInfo(info);
-	const params = extractRelationsParams(relationMap, tables, table, parsed, resolveObjectTypeName(table, typeNameMapper, resolveName), {
+	const params = extractRelationsParams(relationMap, tables, table, parsed, typeName, {
 		typeNameMapper,
-		filterCtx,
-		resolveName
+		filterCtx: runtime?.filterCtx ?? filterCtx,
+		resolveName,
+		scope: scopeFor(runtime, options, "selectionToWith"),
+		limits: runtime?.limits,
+		defaultOrderBy: runtime?.policies?.defaultOrderBy
 	});
 	return params && Object.keys(params).length ? params : void 0;
 };
@@ -8762,14 +8989,16 @@ const selectionToWith = (info, options) => {
 * This is what an override usually wants after it has done its own work:
 *
 * ```ts
-* const rows = await resolveSelection(info, { db, table: 'Users', where, executor: tx });
+* const rows = await resolveSelection(info, { db, table: 'Users', context, where, executor: tx });
 * ```
 *
 * Relation arguments and aggregate fields keep behaving as they do in the generated schema,
-* because it is the generated schema's own code path.
+* because it is the generated schema's own code path. So do the build's row policies: the
+* root table and every nested relation are scoped and soft-delete-filtered, and the limit
+* policy and default ordering apply. Pass `context` when the build configures `scope`.
 */
 const resolveSelection = async (info, options) => {
-	const { db, table: tableName, typeNameMapper, executor, single = false, where, orderBy, limit, offset, after } = options;
+	const { db, table: tableName, typeNameMapper, executor, single = false, where, orderBy, limit, offset, after, deleted } = options;
 	const resolveName = namingRuleOf(options);
 	const { tables, relationMap, filterCtx, primaryKeyOf } = contextFor(db);
 	const table = tables[tableName];
@@ -8779,25 +9008,34 @@ const resolveSelection = async (info, options) => {
 	const source = executor ?? db;
 	const queryBase = source.query?.[tableName];
 	if (!queryBase) throw new Error(`Drizzle-GraphQL Error: the executor passed to resolveSelection has no relational query builder for '${tableName}'.`);
+	const typeName = resolveObjectTypeName(tableName, typeNameMapper, resolveName);
+	const runtime = runtimeFor(info, db, typeName, "resolveSelection");
+	const scope = scopeFor(runtime, options, "resolveSelection");
+	const defaultOrderBy = runtime?.policies?.defaultOrderBy;
 	return runRelationalSelect({
 		queryBase,
 		tables,
 		tableName,
 		table,
 		relationMap,
-		typeName: resolveObjectTypeName(tableName, typeNameMapper, resolveName),
+		typeName,
 		typeNameMapper,
 		resolveName,
 		parsedInfo,
 		single,
 		where,
-		orderBy,
-		limit,
+		orderBy: withDefaultOrderBy({ orderBy }, tableName, defaultOrderBy).orderBy,
+		limit: single ? limit : applyLimitPolicy(limit, runtime?.limits?.(tableName)),
 		offset,
 		after,
-		filterCtx,
+		filterCtx: runtime?.filterCtx ?? filterCtx,
 		pkNames: primaryKeyOf(tableName),
-		db: source
+		db: source,
+		scope,
+		deleted,
+		limits: runtime?.limits,
+		defaultOrderBy,
+		nullOrdering: runtime?.nullOrdering
 	});
 };
 //#endregion