@vantreeseba/drizzle-graphql 15.1.2 → 15.1.3

package/README.md

@@ -249,6 +249,12 @@ Two details worth stating plainly:
 -   **Nothing changes below the schema.** An excluded column is still written by its
     default, still read by the primary-key and cursor machinery, and still usable by your
     own resolvers. Only the generated schema stops mentioning it.
+-   **A cursor carries the primary key in readable form.** A [cursor](#cursor-pagination)
+    is base64url JSON of the row's ordering values, and the primary key is always one of
+    them. Excluding the primary key removes the field, but anyone holding a cursor can still
+    decode the key's value. If the key itself must stay secret, wrap the cursors in your own
+    opaque or encrypted form. A `defaults.<table>.orderBy` that names an excluded column
+    throws at build time, because its values would ride along in every cursor too.
 
 Names that match nothing throw at build time, so renaming a column fails the build instead
 of quietly un-hiding it. Excluding a `NOT NULL` column with no default is allowed — the
@@ -291,6 +297,8 @@ narrow the scope, never widen it. It reaches every path that touches the table:
 | `postsAggregate`, `postsGroupBy` | counted over in-scope rows only |
 | `user.posts`, `user.postsAggregate` | scoped on both the batched and the eager (`with:`) path |
 | cursor pages | the keyset page is taken within the scope |
+| relation filters — `users(where: { posts: { some: … } })`, `none`, `every`, to-one, `.through()` | only in-scope posts can match, block `none` or fail `every` — on reads, aggregates, `groupBy`, and the `where` of updates and deletes |
+| `orderBy` through a to-one — `comments(orderBy: { post: { title: … } })` | an out-of-scope post sorts as `NULL` |
 | `updatePosts`, `updatePostsMany`, `deletePosts` | an out-of-scope row is simply not matched |
 | `upsertPosts` (conflict branch) | a conflicting row outside the scope is left alone, not taken over |
 | nested `connect` / `disconnect` / `set` | only in-scope rows can be attached or detached |
@@ -303,6 +311,11 @@ Two things it deliberately does not do:
 -   **It does not apply to a plain insert.** There is no existing row to filter. `contextValues`
     is the write-side half.
 
+A relation filter or an ordering through a relation sees exactly the rows the relation field
+would return. Through a `.through()` relation, the junction table's own `scope` and soft delete
+apply as well. A scope that returns a filter object is the server's own predicate, so the
+relations it reaches through are read without their targets' scopes.
+
 Returning `undefined` means *no restriction for this context*, so one hook can let an
 administrator through:
 
@@ -477,6 +490,8 @@ What a declared table gets:
 | `posts`, `postsSingle`, cursor pages | marked rows are not returned |
 | `postsAggregate`, `postsGroupBy` | counted over unmarked rows only |
 | `user.posts`, `user.postsAggregate` | hidden on both the batched and the eager (`with:`) path |
+| relation filters — `users(where: { posts: { some: {} } })`, `none`, `every`, `.through()` junctions | a marked post neither matches nor blocks `none`, with the same default as the relation field (see below) |
+| `orderBy` through a to-one | a marked target the relation field hides sorts as `NULL` |
 | `updatePosts`, `updatePostsMany`, a second `deletePosts` | a marked row is simply not matched |
 | nested `connect` / `disconnect` / `set` | a marked row cannot be attached or detached |
 | `CreatePostsInput`, `UpdatePostsInput` | the marker column is **removed** — only the mutations write it |
@@ -540,6 +555,10 @@ The `deleted` argument is generated on relation fields either way, so a request
 whichever default applies — `altKind(deleted: EXCLUDE)` under `'root'`, `altKind(deleted:
 INCLUDE)` under `'all'`.
 
+A relation filter (`items(where: { kind: { name: … } })`) and an `orderBy` through a to-one
+use the same default as the relation field, so they match and sort over exactly the rows the
+field shows. They take no `deleted` argument of their own.
+
 `scope` changes reads only. A nested `connect` / `disconnect` / `set` still refuses to attach a
 marked row under either setting, and the table's own writes are unaffected.
 
@@ -1495,6 +1514,12 @@ field, and passing it back as `after` resumes strictly after that row.
     millisecond JS `Date` that `mode: 'date'` reads it into, so the cursor carries the
     database's own text of the value instead, and rows a microsecond apart are still distinct
     pages
+-   A cursor is opaque by convention only. It is base64url-encoded JSON of the row's
+    ordering values, primary key included, so a client can decode it and read those values,
+    even for a primary key hidden by [`exclude`](#excluding-tables-and-columns). It is not
+    signed or encrypted. If the ordering values must stay private, wrap the cursor in your
+    own opaque or encrypted token before it leaves the server, and unwrap it on the way back
+    in
 -   A cursor is only valid under the ordering it was issued for — reusing it with a
     different `orderBy` (or a malformed/corrupted cursor) returns a `GraphQLError`
 -   `after` cannot be combined with `distinct`, with `matchFilterOrder`, or with an `orderBy`
@@ -2519,12 +2544,13 @@ import { resolveSelection, selectionToWith } from '@vantreeseba/drizzle-graphql'
 const rows = await resolveSelection(info, {
     db,
     table: 'Users',
+    context, // the resolver's context — required when the build configures `scope`
     where: { id: { eq: userId } },
     executor: tx, // defaults to `db`; pass a transaction to see its own writes
 })
 
 // Or just the `with:` tree, if you are building the query yourself.
-const withTree = selectionToWith(info, { db, table: 'Users' })
+const withTree = selectionToWith(info, { db, table: 'Users', context })
 const row = await tx.query.Users.findFirst({ where: { id: userId }, with: withTree })
 ```
 
@@ -2535,8 +2561,27 @@ relation they select, compiles each relation's `where` / `orderBy` / `limit` / `
 into its nested entry, and leaves `<relation>Aggregate` selections out — they are not
 `with:` entries. It returns `undefined` when the selection asks for no relations.
 
-`resolveSelection` additionally accepts `single`, `orderBy`, `limit`, `offset` and `after`,
-and returns the rows already remapped to their GraphQL transport forms.
+`resolveSelection` additionally accepts `single`, `orderBy`, `limit`, `offset`, `after` and
+`deleted`, and returns the rows already remapped to their GraphQL transport forms.
+
+Both apply the build's row policies the way the generated fields do, so an override is not a
+way around them. `resolveSelection` scopes and soft-delete-filters the root table, applies the
+table's `limits` and `defaults.orderBy` to the root list, and applies all four to every nested
+relation. `selectionToWith` applies them to the nested relations in the tree it returns. The
+root query you run with it is yours to scope.
+
+They find the build through the resolve info: the field's return type, the root table's type in
+the executing schema, or the parent type, whichever the build generated. That works for a schema
+assembled from `entities.types`, and for one a tool such as `mapSchema` rebuilt, because the
+build is found through each type's `extensions.drizzle`. Two things follow:
+
+-   **Pass `context`.** Scope hooks take the request context, which resolve info does not
+    carry. When the build configures `scope`, a call without `context` throws instead of
+    reading unscoped. Soft delete, limits and default ordering need no context.
+-   **Pass `info`, not a parsed tree, when one database has several builds.** A parsed
+    selection tree carries no type to find the build by. Over a database with exactly one
+    build, that build's policies apply. With several builds, the call throws if any of them
+    has policies, since picking one could apply the wrong policies.
 
 Both take the naming options the build used — `typeNameMapper`, `derivedTypeNameMapper`,
 `typeNamePrefix` and `typeNameSuffix`. The translation matches selections against the

package/dist/index.cjs

@@ -2007,6 +2007,13 @@ const extractUniqueKeyFilter = (table, tableName, fieldName, members, value) =>
 */
 const narrowedCtxCache = /* @__PURE__ */ new WeakMap();
 /**
+* One alias counter per build, shared by every table's narrowed context. A statement can
+* combine subqueries compiled from different contexts — a relation filter on one table whose
+* target's scope is a filter object reaching through another relation, say — and nested
+* subqueries that drew the same alias from two separate counters would shadow each other.
+*/
+const aliasCounters = /* @__PURE__ */ new WeakMap();
+/**
 * Narrows the build-scoped relation filter context to the table a resolver is filtering.
 *
 * Cached rather than rebuilt: the base carries the build's whole `tables` and `relationMap`,
@@ -2020,7 +2027,7 @@ const narrowedCtxCache = /* @__PURE__ */ new WeakMap();
 * aliases only ever have to be unique *within* one statement, which a number that never
 * repeats gives more surely than one that restarts.
 */
-const relationFilterCtx = (base, tableKey) => {
+const relationFilterCtx = (base, tableKey, scope) => {
 	if (!base) return;
 	let byTable = narrowedCtxCache.get(base);
 	if (!byTable) {
@@ -2029,13 +2036,33 @@ const relationFilterCtx = (base, tableKey) => {
 	}
 	let ctx = byTable.get(tableKey);
 	if (!ctx) {
+		let aliases = aliasCounters.get(base);
+		if (!aliases) {
+			aliases = { n: 0 };
+			aliasCounters.set(base, aliases);
+		}
 		ctx = {
 			...base,
-			tableKey
+			tableKey,
+			aliases
 		};
 		byTable.set(tableKey, ctx);
 	}
-	return ctx;
+	return scope ? {
+		...ctx,
+		scope
+	} : ctx;
+};
+/**
+* The row-policy predicate a subquery over a relation's target applies: the target's scope
+* and soft-delete condition, in the `deleted` mode the relation field defaults to — so a
+* relation filter or a relation ordering sees exactly the rows the relation field returns.
+*/
+const relationTargetPolicy = (ctx, relation, targetTableName, aliasedTarget) => {
+	const scope = ctx.scope;
+	if (!scope) return;
+	const mode = scope.relationDefault(targetTableName, (0, drizzle_orm.is)(relation, drizzle_orm.One) && relation.optional === false);
+	return scope.has(targetTableName, mode) ? scope.on(targetTableName, aliasedTarget, mode) : void 0;
 };
 /**
 * Correlates the parent row with the aliased target table using the relation's own join
@@ -2126,8 +2153,11 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	const throughTable = relation.throughTable;
 	let fromClause;
 	let joinCondition;
+	let junctionPolicy;
 	if (throughTable) {
 		const aliasedThrough = (0, drizzle_orm.aliasedTable)(throughTable, `dgql_rel_${aliases.n++}`);
+		const throughTableName = ctx.scope ? Object.keys(ctx.tables).find((name) => ctx.tables[name] === throughTable) : void 0;
+		if (throughTableName && ctx.scope.has(throughTableName)) junctionPolicy = ctx.scope.on(throughTableName, aliasedThrough);
 		const { correlation, junctionJoin } = buildThroughJoinConditions(parentTable, relation, aliasedThrough, aliasedTarget, relationName);
 		fromClause = drizzle_orm.sql`${(0, drizzle_orm.getTableAsAliasSQL)(aliasedTarget)} inner join ${(0, drizzle_orm.getTableAsAliasSQL)(aliasedThrough)} on ${junctionJoin}`;
 		joinCondition = correlation;
@@ -2137,6 +2167,7 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	}
 	const ownWhere = relationOwnWhere(relation);
 	const relationWhere = ownWhere ? (0, drizzle_orm.relationsFilterToSQL)(isRelationFilterReversed(relation) ? parentTable : aliasedTarget, ownWhere) : void 0;
+	const policy = (0, drizzle_orm.and)(relationTargetPolicy(ctx, relation, targetTableName, aliasedTarget), junctionPolicy);
 	const inner = innerFilters ? extractFilters(aliasedTarget, targetTableName, innerFilters, {
 		...ctx,
 		tableKey: targetTableName,
@@ -2144,9 +2175,9 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	}) : void 0;
 	if (mode === "every") {
 		if (!inner) return;
-		return drizzle_orm.sql`not exists (select 1 from ${fromClause} where ${(0, drizzle_orm.and)(joinCondition, relationWhere, (0, drizzle_orm.not)(inner))})`;
+		return drizzle_orm.sql`not exists (select 1 from ${fromClause} where ${(0, drizzle_orm.and)(joinCondition, relationWhere, policy, (0, drizzle_orm.not)(inner))})`;
 	}
-	const condition = (0, drizzle_orm.and)(joinCondition, relationWhere, inner);
+	const condition = (0, drizzle_orm.and)(joinCondition, relationWhere, policy, inner);
 	return mode === "none" ? drizzle_orm.sql`not exists (select 1 from ${fromClause} where ${condition})` : drizzle_orm.sql`exists (select 1 from ${fromClause} where ${condition})`;
 };
 /**
@@ -2672,12 +2703,14 @@ const extendRelationOrderChain = (parentTable, relationName, relEntry, ctx, chai
 	const joinCondition = buildRelationJoinCondition(parentTable, relation, aliasedTarget, relationName);
 	const ownWhere = relationOwnWhere(relation);
 	const relationWhere = ownWhere ? (0, drizzle_orm.relationsFilterToSQL)(isRelationFilterReversed(relation) ? parentTable : aliasedTarget, ownWhere) : void 0;
+	const policy = relationTargetPolicy(ctx, relation, relEntry.targetTableName, aliasedTarget);
 	return {
 		fromParts: [...chain?.fromParts ?? [], (0, drizzle_orm.getTableAsAliasSQL)(aliasedTarget)],
 		conditions: [
 			...chain?.conditions ?? [],
 			...joinCondition ? [joinCondition] : [],
-			...relationWhere ? [relationWhere] : []
+			...relationWhere ? [relationWhere] : [],
+			...policy ? [policy] : []
 		],
 		table: aliasedTarget
 	};
@@ -3907,10 +3940,10 @@ const extractRelationsParams = (relationMap, tables, tableName, info, typeName,
 		});
 		const relWhere = relationArgs?.where;
 		const relDeleted = relationArgs?.deleted ?? scope?.relationDefault(targetTableName, (0, drizzle_orm.is)(relEntry.relation, drizzle_orm.One) && relEntry.relation.optional === false);
-		thisRecord.where = relWhere || scope?.has(targetTableName, relDeleted) ? { RAW: (aliasedTable) => withScope(scope, targetTableName, aliasedTable, relWhere ? extractFilters(aliasedTable, relName, relWhere, relationFilterCtx(filterCtx, targetTableName)) : void 0, relDeleted) } : void 0;
+		thisRecord.where = relWhere || scope?.has(targetTableName, relDeleted) ? { RAW: (aliasedTable) => withScope(scope, targetTableName, aliasedTable, relWhere ? extractFilters(aliasedTable, relName, relWhere, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0, relDeleted) } : void 0;
 		const hasPagination = offset != null || limit != null;
 		const pkNames = targetPkNames ?? [];
-		thisRecord.orderBy = relationArgs?.orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, relationArgs.orderBy, relationFilterCtx(filterCtx, targetTableName), relWhere) : hasPagination && pkNames.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0;
+		thisRecord.orderBy = relationArgs?.orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, relationArgs.orderBy, relationFilterCtx(filterCtx, targetTableName, scope), relWhere) : hasPagination && pkNames.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0;
 		thisRecord.offset = offset;
 		thisRecord.limit = limit;
 		thisRecord.with = extractRelationsParams(relationMap, tables, targetTableName, field, relTypeName, options);
@@ -3968,7 +4001,7 @@ const runRelationalSelect = async (opts) => {
 			tableName,
 			distinct,
 			pkNames: pkNames ?? [],
-			where: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0, deleted),
+			where: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, deleted),
 			orderBy,
 			limit: single ? 1 : opts.limit,
 			offset
@@ -3983,8 +4016,8 @@ const runRelationalSelect = async (opts) => {
 			allRelations: filterCtx?.relationMap
 		}),
 		offset: distinctKeys ? void 0 : offset,
-		orderBy: distinctKeys ? (aliasedTable) => [...orderBy ? extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName), where) : [], ...primaryKeyOrderExprs(aliasedTable, pkNames)] : cursorEntries ? (aliasedTable) => cursorOrderExprs(aliasedTable, cursorEntries) : orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName), where) : needsDefaultOrder && pkNames?.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0,
-		where: distinctKeys ? { RAW: (aliasedTable) => primaryKeyRestriction(aliasedTable, pkNames, distinctKeys) } : where || cursorValues || scope?.has(tableName, deleted) ? { RAW: (aliasedTable) => withScope(scope, tableName, aliasedTable, (0, drizzle_orm.and)(where ? extractFilters(aliasedTable, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0, cursorValues ? buildCursorCondition(aliasedTable, cursorEntries, cursorValues, opts.nullOrdering ?? "nulls-smallest") : void 0), deleted) } : void 0,
+		orderBy: distinctKeys ? (aliasedTable) => [...orderBy ? extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName, scope), where) : [], ...primaryKeyOrderExprs(aliasedTable, pkNames)] : cursorEntries ? (aliasedTable) => cursorOrderExprs(aliasedTable, cursorEntries) : orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName, scope), where) : needsDefaultOrder && pkNames?.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0,
+		where: distinctKeys ? { RAW: (aliasedTable) => primaryKeyRestriction(aliasedTable, pkNames, distinctKeys) } : where || cursorValues || scope?.has(tableName, deleted) ? { RAW: (aliasedTable) => withScope(scope, tableName, aliasedTable, (0, drizzle_orm.and)(where ? extractFilters(aliasedTable, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, cursorValues ? buildCursorCondition(aliasedTable, cursorEntries, cursorValues, opts.nullOrdering ?? "nulls-smallest") : void 0), deleted) } : void 0,
 		with: relationMap[tableName] ? extractRelationsParams(relationMap, tables, tableName, parsedInfo, typeName, {
 			typeNameMapper,
 			filterCtx,
@@ -4566,7 +4599,7 @@ const generateWriteCount = ({ db, tableName, table, kind, setArgs, filterArgs, f
 				tableName,
 				table,
 				where,
-				relationCtx: relationFilterCtx(filterCtx, tableName),
+				relationCtx: relationFilterCtx(filterCtx, tableName, scope),
 				required: requireWhere,
 				deleted: hard ? "INCLUDE" : void 0
 			});
@@ -4972,7 +5005,7 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 			const executor = resolveExecutor(db, context);
 			const uniqueIds = [...new Set(parentIds)];
 			const scope = resolveScope(policies, context, filterCtx);
-			let whereCondition = withScope(scope, targetTableName, targetTable, (0, drizzle_orm.and)((0, drizzle_orm.inArray)(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0, cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0), deleted ?? defaultDeleted);
+			let whereCondition = withScope(scope, targetTableName, targetTable, (0, drizzle_orm.and)((0, drizzle_orm.inArray)(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0, cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0), deleted ?? defaultDeleted);
 			if (distinct) {
 				const keys = await selectDistinctKeys({
 					db: executor,
@@ -4997,10 +5030,10 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 				[PARENT_KEY]: groupCol
 			} : columns;
 			let rows;
-			if (limit != null || offset != null) rows = await batchedPaginatedRelationQuery(executor, targetTable, foreignCol, whereCondition, orderByArg, limit ?? null, offset ?? null, targetPkNames, selection, relationFilterCtx(filterCtx, targetTableName), whereArg, junction);
+			if (limit != null || offset != null) rows = await batchedPaginatedRelationQuery(executor, targetTable, foreignCol, whereCondition, orderByArg, limit ?? null, offset ?? null, targetPkNames, selection, relationFilterCtx(filterCtx, targetTableName, scope), whereArg, junction);
 			else {
 				let q = withJunction((selection ? executor.select(selection) : executor.select()).from(targetTable), junction, foreignCol).where(whereCondition);
-				const orderExprs = cursorEntries ? cursorOrderExprs(targetTable, cursorEntries) : orderByArg ? extractOrderBy(targetTable, orderByArg, relationFilterCtx(filterCtx, targetTableName), whereArg) : [];
+				const orderExprs = cursorEntries ? cursorOrderExprs(targetTable, cursorEntries) : orderByArg ? extractOrderBy(targetTable, orderByArg, relationFilterCtx(filterCtx, targetTableName, scope), whereArg) : [];
 				if (orderExprs.length) q = q.orderBy(...orderExprs);
 				rows = await q;
 			}
@@ -5680,6 +5713,7 @@ const resolveBuildConfig = (config, schema) => {
 			const normalized = {};
 			for (const [columnName, entry] of Object.entries(orderBy)) {
 				if (!columns[columnName]) throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy names '${columnName}', which is not a column of '${tableName}'.`);
+				if (config?.exclude?.columns?.[tableName]?.includes(columnName)) throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy names '${columnName}', which config.exclude.columns hides. A default ordering is encoded into every row's cursor, so it can only use columns the schema exposes.`);
 				const direction = typeof entry === "string" ? entry : entry?.direction;
 				if (direction !== "asc" && direction !== "desc") throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy.${columnName} must be 'asc', 'desc', or { direction, priority? }.`);
 				const priority = typeof entry === "string" ? void 0 : entry?.priority;
@@ -6060,7 +6094,8 @@ const generateAggregate = (db, tableName, table, typeName, fieldName, filterArgs
 				const request = parseAggregateRequest(info, target);
 				if (!Object.keys(request.selection).length) return {};
 				let query = resolveExecutor(db, context).select(request.selection).from(table);
-				const where = withScope(resolveScope(policies, context, filterCtx), tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0, args.deleted);
+				const scope = resolveScope(policies, context, filterCtx);
+				const where = withScope(scope, tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, args.deleted);
 				if (where) query = query.where(where);
 				const rows = await query;
 				return assembleAggregateRow(rows[0] ?? {}, request, target);
@@ -6137,7 +6172,8 @@ const createRelationAggregateFactory = (db, tables, cacheCtx, typeNameMapper, fi
 				const loader = getOrCreateLoader(context, loaderKey, async (parentIds) => {
 					const executor = resolveExecutor(db, context);
 					const uniqueIds = [...new Set(parentIds)];
-					const whereCondition = withScope(resolveScope(policies, context, filterCtx), targetTableName, targetTable, (0, drizzle_orm.and)((0, drizzle_orm.inArray)(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0), deleted ?? defaultDeleted);
+					const scope = resolveScope(policies, context, filterCtx);
+					const whereCondition = withScope(scope, targetTableName, targetTable, (0, drizzle_orm.and)((0, drizzle_orm.inArray)(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0), deleted ?? defaultDeleted);
 					const selected = executor.select({
 						[GROUP_KEY]: groupCol,
 						...request.selection
@@ -6353,7 +6389,8 @@ const generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs,
 					...request.selection
 				};
 				let query = resolveExecutor(db, context).select(selection).from(table);
-				const where = withScope(resolveScope(policies, context, filterCtx), tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0, args.deleted);
+				const scope = resolveScope(policies, context, filterCtx);
+				const where = withScope(scope, tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, args.deleted);
 				if (where) query = query.where(where);
 				query = query.groupBy(...keyColumns.map(([, column]) => column));
 				const havingCondition = buildHavingCondition(args.having, columns);
@@ -6392,6 +6429,54 @@ const generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs,
 	};
 };
 //#endregion
+//#region src/util/builders/common/build-registry.ts
+/**
+* Keyed by the `extensions.drizzle` object of every object type the build generated, rather
+* than by the type: a schema composed from `entities.types` keeps the types, and one rebuilt
+* by a schema-transforming tool (`mapSchema`, stitching) keeps their extensions.
+*/
+const runtimeByTypeMeta = /* @__PURE__ */ new WeakMap();
+/**
+* What is known about the builds of one drizzle instance, for a caller with no resolve info to
+* look its build up by. Only a lone build is kept — with two or more there is no telling which
+* one a selection belongs to — so rebuilding a schema repeatedly holds on to nothing extra.
+*/
+const buildsByDb = /* @__PURE__ */ new WeakMap();
+/** Whether a build changes what a read returns at all: a row policy, a limit or a default ordering. */
+const hasPolicies = (runtime) => !!(runtime.policies?.scope || runtime.policies?.defaultOrderBy || runtime.limits);
+/** Records a finished build against the object types it generated and the instance it read. */
+const registerBuildRuntime = (runtime, types) => {
+	for (const type of types) {
+		const meta = drizzleExtension(type);
+		if (meta) runtimeByTypeMeta.set(meta, runtime);
+	}
+	const previous = buildsByDb.get(runtime.db);
+	buildsByDb.set(runtime.db, previous ? {
+		count: previous.count + 1,
+		anyPolicies: previous.anyPolicies || hasPolicies(runtime)
+	} : {
+		count: 1,
+		only: runtime,
+		anyPolicies: hasPolicies(runtime)
+	});
+};
+/** The build that generated `type`, when one did. */
+const runtimeForType = (type) => {
+	const meta = type && typeof type === "object" ? drizzleExtension(type) : void 0;
+	return meta ? runtimeByTypeMeta.get(meta) : void 0;
+};
+/**
+* The build of `db` to use when no generated type identifies one: the only build, or none
+* when no build applies any policy. Throws when several builds exist and one of them would
+* change the read, since picking either could apply the wrong policies — or none.
+*/
+const runtimeForDb = (db, helper) => {
+	const builds = buildsByDb.get(db);
+	if (!builds) return;
+	if (builds.count === 1) return builds.only;
+	if (builds.anyPolicies) throw new Error(`Drizzle-GraphQL Error: ${helper} cannot tell which of the ${builds.count} schemas built over this database the selection belongs to, and at least one applies row policies (scope, softDelete, limits or defaults). Pass the resolver's \`info\` rather than a parsed selection tree, from a field whose type the build generated.`);
+};
+//#endregion
 //#region src/util/builders/nested-writes.ts
 const ALL_OPS = [
 	"create",
@@ -6884,7 +6969,7 @@ const createNestedWriteRuntime = (params) => {
 	* nothing is rejected: `connect: {}` would otherwise attach every row in the table.
 	*/
 	const conditionOf = (plan, filter, operation, scope) => {
-		const condition = extractFilters(plan.targetTable, plan.targetTableName, filter, relationFilterCtx(filterCtx, plan.targetTableName));
+		const condition = extractFilters(plan.targetTable, plan.targetTableName, filter, relationFilterCtx(filterCtx, plan.targetTableName, scope));
 		if (!condition) throw drizzleError(`Drizzle-GraphQL Error: '${operation}' on '${plan.relationName}' needs a filter that selects rows — it was given one that matches everything.`, { code: "DRIZZLE_NESTED_WRITE_INVALID" });
 		return withScope(scope, plan.targetTableName, plan.targetTable, condition);
 	};
@@ -7495,6 +7580,14 @@ const createSchemaBuilder = (adapter) => {
 			}
 			if (Object.keys(relResolvers).length > 0) fieldResolvers[tableName] = relResolvers;
 		}
+		registerBuildRuntime({
+			db: ctx.db,
+			filterCtx: ctx.filterCtx,
+			policies: ctx.policies,
+			scoped: !!ctx.tablePolicies?.scope,
+			limits: ctx.limits,
+			nullOrdering: adapter.nullOrdering
+		}, Object.values(ctx.outputs));
 		return {
 			queries: ctx.queries,
 			mutations: ctx.mutations,
@@ -7617,7 +7710,7 @@ const generateUpdate = (db, tableName, table, setArgs, filterArgs, fieldName, si
 		const input = stripContextValues(remapUpdateInput(set, table, tableName), policies?.contextValues?.(tableName));
 		if (!Object.keys(input).length) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
 		await before();
-		const relationCtx = relationFilterCtx(filterCtx, tableName);
+		const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 		const filters = scopedWhere({
 			scope,
 			tableName,
@@ -7663,7 +7756,7 @@ const generateUpdateMany$2 = (db, tableName, table, updateManyInput, fieldName,
 			if (!Object.keys(input).length) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
 			return {
 				set: input,
-				filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0)
+				filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0)
 			};
 		});
 		await executor.transaction(async (tx) => {
@@ -7706,7 +7799,7 @@ const generateDelete = (db, tableName, table, filterArgs, fieldName, single, req
 			const { where } = args;
 			const hard = canHardDelete && args.hard === true;
 			const scope = policies?.scope?.(context);
-			const relationCtx = relationFilterCtx(filterCtx, tableName);
+			const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 			const filters = scopedWhere({
 				scope,
 				tableName,
@@ -8048,7 +8141,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 						excludedRef: excludedColumnRef,
 						withTarget: true,
 						serverOwned: Object.keys(contextColumns ?? {}),
-						buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName))
+						buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope))
 					});
 					const runBatch = async (executor, { values: rows, plan }) => {
 						let query = executor.insert(table).values(rows).returning(returning);
@@ -8130,7 +8223,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 				const nestedOps = entry && nested.hasOps(entry.ops) ? entry.ops : void 0;
 				const input = stripContextValues(remapUpdateInput(entry ? entry.columns : set, table, tableName), policies?.contextValues?.(tableName));
 				if (!Object.keys(input).length && !nestedOps) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
-				const relationCtx = relationFilterCtx(filterCtx, tableName);
+				const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 				const filters = scopedWhere({
 					scope,
 					tableName,
@@ -8209,7 +8302,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 				await before();
 				const parsedInfo = parseResolveInfo(info, { deep: true });
 				const columns = extractSelectedColumnsFromTreeSQLFormat(parsedInfo.fieldsByTypeName[applyObjectTypeName(typeName, tableName, resolveName)], table, selectionCtx);
-				const relationCtx = relationFilterCtx(filterCtx, tableName);
+				const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 				const filters = scopedWhere({
 					scope,
 					tableName,
@@ -8660,7 +8753,7 @@ const createUpdateManyGenerator = (primaryKeyPropNames, runBatch = runUpdateMany
 					return {
 						set: input,
 						ops,
-						filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0)
+						filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0)
 					};
 				});
 				const anyNested = entries.some((entry) => entry.ops);
@@ -8830,6 +8923,36 @@ const namingRuleOf = (options) => resolveGeneratedTypeNames({
 	typeNameSuffix: options.typeNameSuffix
 });
 /**
+* The build whose policies the read applies. Looked up through the generated types the
+* resolve info reaches — the field's return type, the root table's type in the executing
+* schema, the parent type — so a resolver over a generated type finds its own build. Without
+* resolve info (a parsed tree was passed), the instance's only build is used.
+*/
+const runtimeFor = (info, db, typeName, helper) => {
+	if (!("fieldsByTypeName" in info)) {
+		const candidates = [
+			info.returnType ? (0, graphql.getNamedType)(info.returnType) : void 0,
+			info.schema?.getType(typeName),
+			info.parentType
+		];
+		for (const candidate of candidates) {
+			const runtime = runtimeForType(candidate);
+			if (runtime && runtime.db === db) return runtime;
+		}
+	}
+	return runtimeForDb(db, helper);
+};
+/**
+* The request's row policies under `runtime`, bound to the context the caller passed. A build
+* with `scope` hooks cannot be read without that context: the hooks would be called with
+* nothing, and running the read unscoped is the leak the option exists to prevent.
+*/
+const scopeFor = (runtime, options, helper) => {
+	if (!runtime?.policies?.scope) return;
+	if (runtime.scoped && !("context" in options)) throw new Error(`Drizzle-GraphQL Error: the schema this selection belongs to configures \`scope\`, so ${helper} needs the request context to apply it. Pass the resolver's context as the \`context\` option.`);
+	return runtime.policies.scope(options.context);
+};
+/**
 * Reads the parsed selection tree out of a resolver's `info`, resolving fragments and
 * inline fragments. Accepts an already-parsed tree so a caller that has one (or is chaining
 * these helpers) does not pay for the walk twice.
@@ -8856,6 +8979,10 @@ const parseInfo = (info) => {
 * const row = await tx.query.Users.findFirst({ where: { id: { eq } }, with: withTree });
 * ```
 *
+* Every nested entry carries the build's row policies — `scope`, `softDelete`, `limits` and
+* `defaults.orderBy` — exactly as the generated `with:` clause does. The build is found
+* through the resolve info; pass `context` when it configures `scope`.
+*
 * Returns `undefined` when the selection asks for no relations, which is the value the
 * query builder wants for "no `with` clause".
 */
@@ -8865,11 +8992,16 @@ const selectionToWith = (info, options) => {
 	const { tables, relationMap, filterCtx } = contextFor(db);
 	if (!tables[table]) throw new Error(`Drizzle-GraphQL Error: '${table}' is not a table in the Drizzle schema.`);
 	if (!relationMap[table]) return;
+	const typeName = resolveObjectTypeName(table, typeNameMapper, resolveName);
+	const runtime = runtimeFor(info, db, typeName, "selectionToWith");
 	const parsed = parseInfo(info);
-	const params = extractRelationsParams(relationMap, tables, table, parsed, resolveObjectTypeName(table, typeNameMapper, resolveName), {
+	const params = extractRelationsParams(relationMap, tables, table, parsed, typeName, {
 		typeNameMapper,
-		filterCtx,
-		resolveName
+		filterCtx: runtime?.filterCtx ?? filterCtx,
+		resolveName,
+		scope: scopeFor(runtime, options, "selectionToWith"),
+		limits: runtime?.limits,
+		defaultOrderBy: runtime?.policies?.defaultOrderBy
 	});
 	return params && Object.keys(params).length ? params : void 0;
 };
@@ -8881,14 +9013,16 @@ const selectionToWith = (info, options) => {
 * This is what an override usually wants after it has done its own work:
 *
 * ```ts
-* const rows = await resolveSelection(info, { db, table: 'Users', where, executor: tx });
+* const rows = await resolveSelection(info, { db, table: 'Users', context, where, executor: tx });
 * ```
 *
 * Relation arguments and aggregate fields keep behaving as they do in the generated schema,
-* because it is the generated schema's own code path.
+* because it is the generated schema's own code path. So do the build's row policies: the
+* root table and every nested relation are scoped and soft-delete-filtered, and the limit
+* policy and default ordering apply. Pass `context` when the build configures `scope`.
 */
 const resolveSelection = async (info, options) => {
-	const { db, table: tableName, typeNameMapper, executor, single = false, where, orderBy, limit, offset, after } = options;
+	const { db, table: tableName, typeNameMapper, executor, single = false, where, orderBy, limit, offset, after, deleted } = options;
 	const resolveName = namingRuleOf(options);
 	const { tables, relationMap, filterCtx, primaryKeyOf } = contextFor(db);
 	const table = tables[tableName];
@@ -8898,25 +9032,34 @@ const resolveSelection = async (info, options) => {
 	const source = executor ?? db;
 	const queryBase = source.query?.[tableName];
 	if (!queryBase) throw new Error(`Drizzle-GraphQL Error: the executor passed to resolveSelection has no relational query builder for '${tableName}'.`);
+	const typeName = resolveObjectTypeName(tableName, typeNameMapper, resolveName);
+	const runtime = runtimeFor(info, db, typeName, "resolveSelection");
+	const scope = scopeFor(runtime, options, "resolveSelection");
+	const defaultOrderBy = runtime?.policies?.defaultOrderBy;
 	return runRelationalSelect({
 		queryBase,
 		tables,
 		tableName,
 		table,
 		relationMap,
-		typeName: resolveObjectTypeName(tableName, typeNameMapper, resolveName),
+		typeName,
 		typeNameMapper,
 		resolveName,
 		parsedInfo,
 		single,
 		where,
-		orderBy,
-		limit,
+		orderBy: withDefaultOrderBy({ orderBy }, tableName, defaultOrderBy).orderBy,
+		limit: single ? limit : applyLimitPolicy(limit, runtime?.limits?.(tableName)),
 		offset,
 		after,
-		filterCtx,
+		filterCtx: runtime?.filterCtx ?? filterCtx,
 		pkNames: primaryKeyOf(tableName),
-		db: source
+		db: source,
+		scope,
+		deleted,
+		limits: runtime?.limits,
+		defaultOrderBy,
+		nullOrdering: runtime?.nullOrdering
 	});
 };
 //#endregion