@vantreeseba/drizzle-graphql 15.1.2 → 15.1.3

package/dist/index.js

@@ -2,7 +2,7 @@ import { Column, One, SQL, Table, aliasedTable, and, arrayContains, arrayOverlap
 import { MySqlAsyncDatabase, MySqlDate, MySqlDateString, MySqlDateTime, MySqlDateTimeString, MySqlInt, MySqlSerial, MySqlTable, MySqlTimestamp, MySqlTimestampString, getTableConfig } from "drizzle-orm/mysql-core";
 import { PgAsyncDatabase, PgDate, PgDateString, PgInteger, PgSerial, PgTable, PgTimestamp, PgTimestampString, PgUUID, getTableConfig as getTableConfig$1 } from "drizzle-orm/pg-core";
 import { SQLiteAsyncDatabase, SQLiteInteger, SQLiteTable, SQLiteTimestamp, getTableConfig as getTableConfig$2 } from "drizzle-orm/sqlite-core";
-import { GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLInputObjectType, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLScalarType, GraphQLSchema, GraphQLString, Kind, getArgumentValues } from "graphql";
+import { GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLInputObjectType, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLScalarType, GraphQLSchema, GraphQLString, Kind, getArgumentValues, getNamedType } from "graphql";
 import { GraphQLDateTime, GraphQLJSON, GraphQLUUID } from "graphql-scalars";
 import pluralize from "pluralize";
 //#region src/util/builders/common/errors.ts
@@ -1983,6 +1983,13 @@ const extractUniqueKeyFilter = (table, tableName, fieldName, members, value) =>
 */
 const narrowedCtxCache = /* @__PURE__ */ new WeakMap();
 /**
+* One alias counter per build, shared by every table's narrowed context. A statement can
+* combine subqueries compiled from different contexts — a relation filter on one table whose
+* target's scope is a filter object reaching through another relation, say — and nested
+* subqueries that drew the same alias from two separate counters would shadow each other.
+*/
+const aliasCounters = /* @__PURE__ */ new WeakMap();
+/**
 * Narrows the build-scoped relation filter context to the table a resolver is filtering.
 *
 * Cached rather than rebuilt: the base carries the build's whole `tables` and `relationMap`,
@@ -1996,7 +2003,7 @@ const narrowedCtxCache = /* @__PURE__ */ new WeakMap();
 * aliases only ever have to be unique *within* one statement, which a number that never
 * repeats gives more surely than one that restarts.
 */
-const relationFilterCtx = (base, tableKey) => {
+const relationFilterCtx = (base, tableKey, scope) => {
 	if (!base) return;
 	let byTable = narrowedCtxCache.get(base);
 	if (!byTable) {
@@ -2005,13 +2012,33 @@ const relationFilterCtx = (base, tableKey) => {
 	}
 	let ctx = byTable.get(tableKey);
 	if (!ctx) {
+		let aliases = aliasCounters.get(base);
+		if (!aliases) {
+			aliases = { n: 0 };
+			aliasCounters.set(base, aliases);
+		}
 		ctx = {
 			...base,
-			tableKey
+			tableKey,
+			aliases
 		};
 		byTable.set(tableKey, ctx);
 	}
-	return ctx;
+	return scope ? {
+		...ctx,
+		scope
+	} : ctx;
+};
+/**
+* The row-policy predicate a subquery over a relation's target applies: the target's scope
+* and soft-delete condition, in the `deleted` mode the relation field defaults to — so a
+* relation filter or a relation ordering sees exactly the rows the relation field returns.
+*/
+const relationTargetPolicy = (ctx, relation, targetTableName, aliasedTarget) => {
+	const scope = ctx.scope;
+	if (!scope) return;
+	const mode = scope.relationDefault(targetTableName, is(relation, One) && relation.optional === false);
+	return scope.has(targetTableName, mode) ? scope.on(targetTableName, aliasedTarget, mode) : void 0;
 };
 /**
 * Correlates the parent row with the aliased target table using the relation's own join
@@ -2102,8 +2129,11 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	const throughTable = relation.throughTable;
 	let fromClause;
 	let joinCondition;
+	let junctionPolicy;
 	if (throughTable) {
 		const aliasedThrough = aliasedTable(throughTable, `dgql_rel_${aliases.n++}`);
+		const throughTableName = ctx.scope ? Object.keys(ctx.tables).find((name) => ctx.tables[name] === throughTable) : void 0;
+		if (throughTableName && ctx.scope.has(throughTableName)) junctionPolicy = ctx.scope.on(throughTableName, aliasedThrough);
 		const { correlation, junctionJoin } = buildThroughJoinConditions(parentTable, relation, aliasedThrough, aliasedTarget, relationName);
 		fromClause = sql`${getTableAsAliasSQL(aliasedTarget)} inner join ${getTableAsAliasSQL(aliasedThrough)} on ${junctionJoin}`;
 		joinCondition = correlation;
@@ -2113,6 +2143,7 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	}
 	const ownWhere = relationOwnWhere(relation);
 	const relationWhere = ownWhere ? relationsFilterToSQL(isRelationFilterReversed(relation) ? parentTable : aliasedTarget, ownWhere) : void 0;
+	const policy = and(relationTargetPolicy(ctx, relation, targetTableName, aliasedTarget), junctionPolicy);
 	const inner = innerFilters ? extractFilters(aliasedTarget, targetTableName, innerFilters, {
 		...ctx,
 		tableKey: targetTableName,
@@ -2120,9 +2151,9 @@ const buildRelationExists = (parentTable, relationName, relEntry, innerFilters,
 	}) : void 0;
 	if (mode === "every") {
 		if (!inner) return;
-		return sql`not exists (select 1 from ${fromClause} where ${and(joinCondition, relationWhere, not(inner))})`;
+		return sql`not exists (select 1 from ${fromClause} where ${and(joinCondition, relationWhere, policy, not(inner))})`;
 	}
-	const condition = and(joinCondition, relationWhere, inner);
+	const condition = and(joinCondition, relationWhere, policy, inner);
 	return mode === "none" ? sql`not exists (select 1 from ${fromClause} where ${condition})` : sql`exists (select 1 from ${fromClause} where ${condition})`;
 };
 /**
@@ -2648,12 +2679,14 @@ const extendRelationOrderChain = (parentTable, relationName, relEntry, ctx, chai
 	const joinCondition = buildRelationJoinCondition(parentTable, relation, aliasedTarget, relationName);
 	const ownWhere = relationOwnWhere(relation);
 	const relationWhere = ownWhere ? relationsFilterToSQL(isRelationFilterReversed(relation) ? parentTable : aliasedTarget, ownWhere) : void 0;
+	const policy = relationTargetPolicy(ctx, relation, relEntry.targetTableName, aliasedTarget);
 	return {
 		fromParts: [...chain?.fromParts ?? [], getTableAsAliasSQL(aliasedTarget)],
 		conditions: [
 			...chain?.conditions ?? [],
 			...joinCondition ? [joinCondition] : [],
-			...relationWhere ? [relationWhere] : []
+			...relationWhere ? [relationWhere] : [],
+			...policy ? [policy] : []
 		],
 		table: aliasedTarget
 	};
@@ -3883,10 +3916,10 @@ const extractRelationsParams = (relationMap, tables, tableName, info, typeName,
 		});
 		const relWhere = relationArgs?.where;
 		const relDeleted = relationArgs?.deleted ?? scope?.relationDefault(targetTableName, is(relEntry.relation, One) && relEntry.relation.optional === false);
-		thisRecord.where = relWhere || scope?.has(targetTableName, relDeleted) ? { RAW: (aliasedTable) => withScope(scope, targetTableName, aliasedTable, relWhere ? extractFilters(aliasedTable, relName, relWhere, relationFilterCtx(filterCtx, targetTableName)) : void 0, relDeleted) } : void 0;
+		thisRecord.where = relWhere || scope?.has(targetTableName, relDeleted) ? { RAW: (aliasedTable) => withScope(scope, targetTableName, aliasedTable, relWhere ? extractFilters(aliasedTable, relName, relWhere, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0, relDeleted) } : void 0;
 		const hasPagination = offset != null || limit != null;
 		const pkNames = targetPkNames ?? [];
-		thisRecord.orderBy = relationArgs?.orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, relationArgs.orderBy, relationFilterCtx(filterCtx, targetTableName), relWhere) : hasPagination && pkNames.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0;
+		thisRecord.orderBy = relationArgs?.orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, relationArgs.orderBy, relationFilterCtx(filterCtx, targetTableName, scope), relWhere) : hasPagination && pkNames.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0;
 		thisRecord.offset = offset;
 		thisRecord.limit = limit;
 		thisRecord.with = extractRelationsParams(relationMap, tables, targetTableName, field, relTypeName, options);
@@ -3944,7 +3977,7 @@ const runRelationalSelect = async (opts) => {
 			tableName,
 			distinct,
 			pkNames: pkNames ?? [],
-			where: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0, deleted),
+			where: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, deleted),
 			orderBy,
 			limit: single ? 1 : opts.limit,
 			offset
@@ -3959,8 +3992,8 @@ const runRelationalSelect = async (opts) => {
 			allRelations: filterCtx?.relationMap
 		}),
 		offset: distinctKeys ? void 0 : offset,
-		orderBy: distinctKeys ? (aliasedTable) => [...orderBy ? extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName), where) : [], ...primaryKeyOrderExprs(aliasedTable, pkNames)] : cursorEntries ? (aliasedTable) => cursorOrderExprs(aliasedTable, cursorEntries) : orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName), where) : needsDefaultOrder && pkNames?.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0,
-		where: distinctKeys ? { RAW: (aliasedTable) => primaryKeyRestriction(aliasedTable, pkNames, distinctKeys) } : where || cursorValues || scope?.has(tableName, deleted) ? { RAW: (aliasedTable) => withScope(scope, tableName, aliasedTable, and(where ? extractFilters(aliasedTable, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0, cursorValues ? buildCursorCondition(aliasedTable, cursorEntries, cursorValues, opts.nullOrdering ?? "nulls-smallest") : void 0), deleted) } : void 0,
+		orderBy: distinctKeys ? (aliasedTable) => [...orderBy ? extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName, scope), where) : [], ...primaryKeyOrderExprs(aliasedTable, pkNames)] : cursorEntries ? (aliasedTable) => cursorOrderExprs(aliasedTable, cursorEntries) : orderBy ? (aliasedTable) => extractOrderBy(aliasedTable, orderBy, relationFilterCtx(filterCtx, tableName, scope), where) : needsDefaultOrder && pkNames?.length ? (aliasedTable) => primaryKeyOrderExprs(aliasedTable, pkNames) : void 0,
+		where: distinctKeys ? { RAW: (aliasedTable) => primaryKeyRestriction(aliasedTable, pkNames, distinctKeys) } : where || cursorValues || scope?.has(tableName, deleted) ? { RAW: (aliasedTable) => withScope(scope, tableName, aliasedTable, and(where ? extractFilters(aliasedTable, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, cursorValues ? buildCursorCondition(aliasedTable, cursorEntries, cursorValues, opts.nullOrdering ?? "nulls-smallest") : void 0), deleted) } : void 0,
 		with: relationMap[tableName] ? extractRelationsParams(relationMap, tables, tableName, parsedInfo, typeName, {
 			typeNameMapper,
 			filterCtx,
@@ -4542,7 +4575,7 @@ const generateWriteCount = ({ db, tableName, table, kind, setArgs, filterArgs, f
 				tableName,
 				table,
 				where,
-				relationCtx: relationFilterCtx(filterCtx, tableName),
+				relationCtx: relationFilterCtx(filterCtx, tableName, scope),
 				required: requireWhere,
 				deleted: hard ? "INCLUDE" : void 0
 			});
@@ -4948,7 +4981,7 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 			const executor = resolveExecutor(db, context);
 			const uniqueIds = [...new Set(parentIds)];
 			const scope = resolveScope(policies, context, filterCtx);
-			let whereCondition = withScope(scope, targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0, cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0), deleted ?? defaultDeleted);
+			let whereCondition = withScope(scope, targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0, cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0), deleted ?? defaultDeleted);
 			if (distinct) {
 				const keys = await selectDistinctKeys({
 					db: executor,
@@ -4973,10 +5006,10 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 				[PARENT_KEY]: groupCol
 			} : columns;
 			let rows;
-			if (limit != null || offset != null) rows = await batchedPaginatedRelationQuery(executor, targetTable, foreignCol, whereCondition, orderByArg, limit ?? null, offset ?? null, targetPkNames, selection, relationFilterCtx(filterCtx, targetTableName), whereArg, junction);
+			if (limit != null || offset != null) rows = await batchedPaginatedRelationQuery(executor, targetTable, foreignCol, whereCondition, orderByArg, limit ?? null, offset ?? null, targetPkNames, selection, relationFilterCtx(filterCtx, targetTableName, scope), whereArg, junction);
 			else {
 				let q = withJunction((selection ? executor.select(selection) : executor.select()).from(targetTable), junction, foreignCol).where(whereCondition);
-				const orderExprs = cursorEntries ? cursorOrderExprs(targetTable, cursorEntries) : orderByArg ? extractOrderBy(targetTable, orderByArg, relationFilterCtx(filterCtx, targetTableName), whereArg) : [];
+				const orderExprs = cursorEntries ? cursorOrderExprs(targetTable, cursorEntries) : orderByArg ? extractOrderBy(targetTable, orderByArg, relationFilterCtx(filterCtx, targetTableName, scope), whereArg) : [];
 				if (orderExprs.length) q = q.orderBy(...orderExprs);
 				rows = await q;
 			}
@@ -5656,6 +5689,7 @@ const resolveBuildConfig = (config, schema) => {
 			const normalized = {};
 			for (const [columnName, entry] of Object.entries(orderBy)) {
 				if (!columns[columnName]) throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy names '${columnName}', which is not a column of '${tableName}'.`);
+				if (config?.exclude?.columns?.[tableName]?.includes(columnName)) throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy names '${columnName}', which config.exclude.columns hides. A default ordering is encoded into every row's cursor, so it can only use columns the schema exposes.`);
 				const direction = typeof entry === "string" ? entry : entry?.direction;
 				if (direction !== "asc" && direction !== "desc") throw new Error(`Drizzle-GraphQL Error: config.defaults.${tableName}.orderBy.${columnName} must be 'asc', 'desc', or { direction, priority? }.`);
 				const priority = typeof entry === "string" ? void 0 : entry?.priority;
@@ -6036,7 +6070,8 @@ const generateAggregate = (db, tableName, table, typeName, fieldName, filterArgs
 				const request = parseAggregateRequest(info, target);
 				if (!Object.keys(request.selection).length) return {};
 				let query = resolveExecutor(db, context).select(request.selection).from(table);
-				const where = withScope(resolveScope(policies, context, filterCtx), tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0, args.deleted);
+				const scope = resolveScope(policies, context, filterCtx);
+				const where = withScope(scope, tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, args.deleted);
 				if (where) query = query.where(where);
 				const rows = await query;
 				return assembleAggregateRow(rows[0] ?? {}, request, target);
@@ -6113,7 +6148,8 @@ const createRelationAggregateFactory = (db, tables, cacheCtx, typeNameMapper, fi
 				const loader = getOrCreateLoader(context, loaderKey, async (parentIds) => {
 					const executor = resolveExecutor(db, context);
 					const uniqueIds = [...new Set(parentIds)];
-					const whereCondition = withScope(resolveScope(policies, context, filterCtx), targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0), deleted ?? defaultDeleted);
+					const scope = resolveScope(policies, context, filterCtx);
+					const whereCondition = withScope(scope, targetTableName, targetTable, and(inArray(groupCol, uniqueIds), ownCondition, whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName, scope)) : void 0), deleted ?? defaultDeleted);
 					const selected = executor.select({
 						[GROUP_KEY]: groupCol,
 						...request.selection
@@ -6329,7 +6365,8 @@ const generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs,
 					...request.selection
 				};
 				let query = resolveExecutor(db, context).select(selection).from(table);
-				const where = withScope(resolveScope(policies, context, filterCtx), tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0, args.deleted);
+				const scope = resolveScope(policies, context, filterCtx);
+				const where = withScope(scope, tableName, table, args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName, scope)) : void 0, args.deleted);
 				if (where) query = query.where(where);
 				query = query.groupBy(...keyColumns.map(([, column]) => column));
 				const havingCondition = buildHavingCondition(args.having, columns);
@@ -6368,6 +6405,54 @@ const generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs,
 	};
 };
 //#endregion
+//#region src/util/builders/common/build-registry.ts
+/**
+* Keyed by the `extensions.drizzle` object of every object type the build generated, rather
+* than by the type: a schema composed from `entities.types` keeps the types, and one rebuilt
+* by a schema-transforming tool (`mapSchema`, stitching) keeps their extensions.
+*/
+const runtimeByTypeMeta = /* @__PURE__ */ new WeakMap();
+/**
+* What is known about the builds of one drizzle instance, for a caller with no resolve info to
+* look its build up by. Only a lone build is kept — with two or more there is no telling which
+* one a selection belongs to — so rebuilding a schema repeatedly holds on to nothing extra.
+*/
+const buildsByDb = /* @__PURE__ */ new WeakMap();
+/** Whether a build changes what a read returns at all: a row policy, a limit or a default ordering. */
+const hasPolicies = (runtime) => !!(runtime.policies?.scope || runtime.policies?.defaultOrderBy || runtime.limits);
+/** Records a finished build against the object types it generated and the instance it read. */
+const registerBuildRuntime = (runtime, types) => {
+	for (const type of types) {
+		const meta = drizzleExtension(type);
+		if (meta) runtimeByTypeMeta.set(meta, runtime);
+	}
+	const previous = buildsByDb.get(runtime.db);
+	buildsByDb.set(runtime.db, previous ? {
+		count: previous.count + 1,
+		anyPolicies: previous.anyPolicies || hasPolicies(runtime)
+	} : {
+		count: 1,
+		only: runtime,
+		anyPolicies: hasPolicies(runtime)
+	});
+};
+/** The build that generated `type`, when one did. */
+const runtimeForType = (type) => {
+	const meta = type && typeof type === "object" ? drizzleExtension(type) : void 0;
+	return meta ? runtimeByTypeMeta.get(meta) : void 0;
+};
+/**
+* The build of `db` to use when no generated type identifies one: the only build, or none
+* when no build applies any policy. Throws when several builds exist and one of them would
+* change the read, since picking either could apply the wrong policies — or none.
+*/
+const runtimeForDb = (db, helper) => {
+	const builds = buildsByDb.get(db);
+	if (!builds) return;
+	if (builds.count === 1) return builds.only;
+	if (builds.anyPolicies) throw new Error(`Drizzle-GraphQL Error: ${helper} cannot tell which of the ${builds.count} schemas built over this database the selection belongs to, and at least one applies row policies (scope, softDelete, limits or defaults). Pass the resolver's \`info\` rather than a parsed selection tree, from a field whose type the build generated.`);
+};
+//#endregion
 //#region src/util/builders/nested-writes.ts
 const ALL_OPS = [
 	"create",
@@ -6860,7 +6945,7 @@ const createNestedWriteRuntime = (params) => {
 	* nothing is rejected: `connect: {}` would otherwise attach every row in the table.
 	*/
 	const conditionOf = (plan, filter, operation, scope) => {
-		const condition = extractFilters(plan.targetTable, plan.targetTableName, filter, relationFilterCtx(filterCtx, plan.targetTableName));
+		const condition = extractFilters(plan.targetTable, plan.targetTableName, filter, relationFilterCtx(filterCtx, plan.targetTableName, scope));
 		if (!condition) throw drizzleError(`Drizzle-GraphQL Error: '${operation}' on '${plan.relationName}' needs a filter that selects rows — it was given one that matches everything.`, { code: "DRIZZLE_NESTED_WRITE_INVALID" });
 		return withScope(scope, plan.targetTableName, plan.targetTable, condition);
 	};
@@ -7471,6 +7556,14 @@ const createSchemaBuilder = (adapter) => {
 			}
 			if (Object.keys(relResolvers).length > 0) fieldResolvers[tableName] = relResolvers;
 		}
+		registerBuildRuntime({
+			db: ctx.db,
+			filterCtx: ctx.filterCtx,
+			policies: ctx.policies,
+			scoped: !!ctx.tablePolicies?.scope,
+			limits: ctx.limits,
+			nullOrdering: adapter.nullOrdering
+		}, Object.values(ctx.outputs));
 		return {
 			queries: ctx.queries,
 			mutations: ctx.mutations,
@@ -7593,7 +7686,7 @@ const generateUpdate = (db, tableName, table, setArgs, filterArgs, fieldName, si
 		const input = stripContextValues(remapUpdateInput(set, table, tableName), policies?.contextValues?.(tableName));
 		if (!Object.keys(input).length) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
 		await before();
-		const relationCtx = relationFilterCtx(filterCtx, tableName);
+		const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 		const filters = scopedWhere({
 			scope,
 			tableName,
@@ -7639,7 +7732,7 @@ const generateUpdateMany$2 = (db, tableName, table, updateManyInput, fieldName,
 			if (!Object.keys(input).length) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
 			return {
 				set: input,
-				filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0)
+				filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0)
 			};
 		});
 		await executor.transaction(async (tx) => {
@@ -7682,7 +7775,7 @@ const generateDelete = (db, tableName, table, filterArgs, fieldName, single, req
 			const { where } = args;
 			const hard = canHardDelete && args.hard === true;
 			const scope = policies?.scope?.(context);
-			const relationCtx = relationFilterCtx(filterCtx, tableName);
+			const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 			const filters = scopedWhere({
 				scope,
 				tableName,
@@ -8024,7 +8117,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 						excludedRef: excludedColumnRef,
 						withTarget: true,
 						serverOwned: Object.keys(contextColumns ?? {}),
-						buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName))
+						buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope))
 					});
 					const runBatch = async (executor, { values: rows, plan }) => {
 						let query = executor.insert(table).values(rows).returning(returning);
@@ -8106,7 +8199,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 				const nestedOps = entry && nested.hasOps(entry.ops) ? entry.ops : void 0;
 				const input = stripContextValues(remapUpdateInput(entry ? entry.columns : set, table, tableName), policies?.contextValues?.(tableName));
 				if (!Object.keys(input).length && !nestedOps) throw drizzleError("Unable to update with no values specified!", { code: "DRIZZLE_NO_VALUES" });
-				const relationCtx = relationFilterCtx(filterCtx, tableName);
+				const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 				const filters = scopedWhere({
 					scope,
 					tableName,
@@ -8185,7 +8278,7 @@ const buildWriteResolvers = (primaryKeyPropNames) => {
 				await before();
 				const parsedInfo = parseResolveInfo(info, { deep: true });
 				const columns = extractSelectedColumnsFromTreeSQLFormat(parsedInfo.fieldsByTypeName[applyObjectTypeName(typeName, tableName, resolveName)], table, selectionCtx);
-				const relationCtx = relationFilterCtx(filterCtx, tableName);
+				const relationCtx = relationFilterCtx(filterCtx, tableName, scope);
 				const filters = scopedWhere({
 					scope,
 					tableName,
@@ -8636,7 +8729,7 @@ const createUpdateManyGenerator = (primaryKeyPropNames, runBatch = runUpdateMany
 					return {
 						set: input,
 						ops,
-						filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0)
+						filters: withScope(scope, tableName, table, where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName, scope)) : void 0)
 					};
 				});
 				const anyNested = entries.some((entry) => entry.ops);
@@ -8806,6 +8899,36 @@ const namingRuleOf = (options) => resolveGeneratedTypeNames({
 	typeNameSuffix: options.typeNameSuffix
 });
 /**
+* The build whose policies the read applies. Looked up through the generated types the
+* resolve info reaches — the field's return type, the root table's type in the executing
+* schema, the parent type — so a resolver over a generated type finds its own build. Without
+* resolve info (a parsed tree was passed), the instance's only build is used.
+*/
+const runtimeFor = (info, db, typeName, helper) => {
+	if (!("fieldsByTypeName" in info)) {
+		const candidates = [
+			info.returnType ? getNamedType(info.returnType) : void 0,
+			info.schema?.getType(typeName),
+			info.parentType
+		];
+		for (const candidate of candidates) {
+			const runtime = runtimeForType(candidate);
+			if (runtime && runtime.db === db) return runtime;
+		}
+	}
+	return runtimeForDb(db, helper);
+};
+/**
+* The request's row policies under `runtime`, bound to the context the caller passed. A build
+* with `scope` hooks cannot be read without that context: the hooks would be called with
+* nothing, and running the read unscoped is the leak the option exists to prevent.
+*/
+const scopeFor = (runtime, options, helper) => {
+	if (!runtime?.policies?.scope) return;
+	if (runtime.scoped && !("context" in options)) throw new Error(`Drizzle-GraphQL Error: the schema this selection belongs to configures \`scope\`, so ${helper} needs the request context to apply it. Pass the resolver's context as the \`context\` option.`);
+	return runtime.policies.scope(options.context);
+};
+/**
 * Reads the parsed selection tree out of a resolver's `info`, resolving fragments and
 * inline fragments. Accepts an already-parsed tree so a caller that has one (or is chaining
 * these helpers) does not pay for the walk twice.
@@ -8832,6 +8955,10 @@ const parseInfo = (info) => {
 * const row = await tx.query.Users.findFirst({ where: { id: { eq } }, with: withTree });
 * ```
 *
+* Every nested entry carries the build's row policies — `scope`, `softDelete`, `limits` and
+* `defaults.orderBy` — exactly as the generated `with:` clause does. The build is found
+* through the resolve info; pass `context` when it configures `scope`.
+*
 * Returns `undefined` when the selection asks for no relations, which is the value the
 * query builder wants for "no `with` clause".
 */
@@ -8841,11 +8968,16 @@ const selectionToWith = (info, options) => {
 	const { tables, relationMap, filterCtx } = contextFor(db);
 	if (!tables[table]) throw new Error(`Drizzle-GraphQL Error: '${table}' is not a table in the Drizzle schema.`);
 	if (!relationMap[table]) return;
+	const typeName = resolveObjectTypeName(table, typeNameMapper, resolveName);
+	const runtime = runtimeFor(info, db, typeName, "selectionToWith");
 	const parsed = parseInfo(info);
-	const params = extractRelationsParams(relationMap, tables, table, parsed, resolveObjectTypeName(table, typeNameMapper, resolveName), {
+	const params = extractRelationsParams(relationMap, tables, table, parsed, typeName, {
 		typeNameMapper,
-		filterCtx,
-		resolveName
+		filterCtx: runtime?.filterCtx ?? filterCtx,
+		resolveName,
+		scope: scopeFor(runtime, options, "selectionToWith"),
+		limits: runtime?.limits,
+		defaultOrderBy: runtime?.policies?.defaultOrderBy
 	});
 	return params && Object.keys(params).length ? params : void 0;
 };
@@ -8857,14 +8989,16 @@ const selectionToWith = (info, options) => {
 * This is what an override usually wants after it has done its own work:
 *
 * ```ts
-* const rows = await resolveSelection(info, { db, table: 'Users', where, executor: tx });
+* const rows = await resolveSelection(info, { db, table: 'Users', context, where, executor: tx });
 * ```
 *
 * Relation arguments and aggregate fields keep behaving as they do in the generated schema,
-* because it is the generated schema's own code path.
+* because it is the generated schema's own code path. So do the build's row policies: the
+* root table and every nested relation are scoped and soft-delete-filtered, and the limit
+* policy and default ordering apply. Pass `context` when the build configures `scope`.
 */
 const resolveSelection = async (info, options) => {
-	const { db, table: tableName, typeNameMapper, executor, single = false, where, orderBy, limit, offset, after } = options;
+	const { db, table: tableName, typeNameMapper, executor, single = false, where, orderBy, limit, offset, after, deleted } = options;
 	const resolveName = namingRuleOf(options);
 	const { tables, relationMap, filterCtx, primaryKeyOf } = contextFor(db);
 	const table = tables[tableName];
@@ -8874,25 +9008,34 @@ const resolveSelection = async (info, options) => {
 	const source = executor ?? db;
 	const queryBase = source.query?.[tableName];
 	if (!queryBase) throw new Error(`Drizzle-GraphQL Error: the executor passed to resolveSelection has no relational query builder for '${tableName}'.`);
+	const typeName = resolveObjectTypeName(tableName, typeNameMapper, resolveName);
+	const runtime = runtimeFor(info, db, typeName, "resolveSelection");
+	const scope = scopeFor(runtime, options, "resolveSelection");
+	const defaultOrderBy = runtime?.policies?.defaultOrderBy;
 	return runRelationalSelect({
 		queryBase,
 		tables,
 		tableName,
 		table,
 		relationMap,
-		typeName: resolveObjectTypeName(tableName, typeNameMapper, resolveName),
+		typeName,
 		typeNameMapper,
 		resolveName,
 		parsedInfo,
 		single,
 		where,
-		orderBy,
-		limit,
+		orderBy: withDefaultOrderBy({ orderBy }, tableName, defaultOrderBy).orderBy,
+		limit: single ? limit : applyLimitPolicy(limit, runtime?.limits?.(tableName)),
 		offset,
 		after,
-		filterCtx,
+		filterCtx: runtime?.filterCtx ?? filterCtx,
 		pkNames: primaryKeyOf(tableName),
-		db: source
+		db: source,
+		scope,
+		deleted,
+		limits: runtime?.limits,
+		defaultOrderBy,
+		nullOrdering: runtime?.nullOrdering
 	});
 };
 //#endregion