@vantreeseba/drizzle-graphql 7.0.0 → 7.2.0

package/dist/index.d.cts

@@ -239,7 +239,18 @@ declare const drizzleExecutorKey: unique symbol;
  * each dialect builder states it: `'nulls-largest'` for PostgreSQL, `'nulls-smallest'` for
  * MySQL and SQLite.
  */
-declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase) => RelationResolverFactory;
+declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor) => RelationResolverFactory;
+/** {@link BuildSchemaConfig.limits} resolved for one table. `undefined` means no policy. */
+type ResolvedLimitPolicy = {
+    defaultLimit: number | undefined;
+    maxLimit: number | undefined;
+    clampToMax: boolean;
+};
+/**
+ * Looks up the limit policy for a table by its Drizzle schema key. Built once per schema by
+ * `buildSchema`; `undefined` for a table the caller left unbounded.
+ */
+type LimitPolicyFor = (tableName: string) => ResolvedLimitPolicy | undefined;
 /**
  * Compiles an `orderBy` argument into ORDER BY expressions, highest priority first.
  *
@@ -760,6 +771,44 @@ type ComplexityConfig = {
      */
     aggregateCost?: number;
 };
+/**
+ * A limit policy: what a request without `limit` gets, and how large a `limit` may be.
+ * Every field is optional — an empty policy is the default unbounded behavior.
+ */
+type TableLimitPolicy = {
+    /** Applied when the client passes no `limit`. Capped by `maxLimit` when both are set. */
+    defaultLimit?: number;
+    /**
+     * The largest `limit` a client may ask for. Also bounds a request that passes no `limit` at
+     * all, since that means every row.
+     */
+    maxLimit?: number;
+    /**
+     * `false` (default) rejects a `limit` above `maxLimit` with a GraphQL error; `true` reduces
+     * it to `maxLimit` instead.
+     */
+    clampToMax?: boolean;
+};
+/** {@link BuildSchemaConfig.limits} — a global policy plus per-table overrides. */
+type LimitsConfig = TableLimitPolicy & {
+    /** Per-table overrides, keyed by the table's key in the Drizzle schema. */
+    tables?: Record<string, TableLimitPolicy>;
+};
+/**
+ * {@link BuildSchemaConfig.exclude} — tables and columns to keep out of the generated schema.
+ *
+ * Both lists are keyed by the Drizzle schema key, not the database name and not the generated
+ * GraphQL name.
+ */
+type SchemaExclusions = {
+    /**
+     * Tables that generate nothing at all: no object type, no queries, no mutations, and no
+     * relation fields on other tables that point at them.
+     */
+    tables?: string[];
+    /** Per-table column exclusions, keyed by the table's key in the Drizzle schema. */
+    columns?: Record<string, string[]>;
+};
 type BuildSchemaConfig = {
     /**
      * Determines whether generated mutations will be passed to returned schema.
@@ -911,6 +960,73 @@ type BuildSchemaConfig = {
         mode: 'auto';
         timeoutMs?: number;
     };
+    /**
+     * Bounds on the `limit` argument of list queries and to-many relation fields.
+     *
+     * Both knobs are off by default: without them a client can omit `limit` and pull a whole
+     * table, or pass `limit: 1000000` and do the same thing politely. Turning either on changes
+     * observable behavior for existing consumers, so nothing is applied unless asked for.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   limits: {
+     *     defaultLimit: 50,  // used when the client passes no `limit`
+     *     maxLimit: 500,     // anything above is rejected
+     *     tables: {
+     *       auditLog: { defaultLimit: 20, maxLimit: 100 },
+     *     },
+     *   },
+     * });
+     * ```
+     *
+     * - Applies to root list queries **and** to to-many relation fields — an unbounded relation
+     *   inside a bounded root is the same scan one level down. A relation field takes the policy
+     *   of the table it *targets*, so a table is bounded wherever it is reached from. Single-row
+     *   queries and aggregates take no `limit` and are unaffected.
+     * - A `limit` above `maxLimit` is rejected with a GraphQL error. Set `clampToMax: true` to
+     *   silently reduce it instead — honest paginating clients prefer the error, since a clamped
+     *   page looks like the end of the results.
+     * - `maxLimit` on its own also bounds the *omitted* case: no `limit` means every row, which
+     *   is above any maximum. `defaultLimit` is what a request without `limit` gets, capped by
+     *   `maxLimit` if both are set.
+     * - `tables` overrides per table, keyed by the Drizzle schema key. A table's entry replaces
+     *   the top-level value for whichever keys it sets.
+     * - Cursor pagination inherits the same policy — a keyset page needs a limit to be
+     *   meaningful, and `defaultLimit` is what makes `after`-only pagination well-formed.
+     * - The complexity hints price the *effective* limit, so cost estimation and enforcement
+     *   agree.
+     */
+    limits?: LimitsConfig;
+    /**
+     * Tables and columns to leave out of the generated schema entirely.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   exclude: {
+     *     tables: ['magicLinks', 'sessions'],
+     *     columns: { apiKeys: ['keyHash'] },
+     *   },
+     * });
+     * ```
+     *
+     * An excluded **table** generates nothing: no object type, no root queries or mutations, no
+     * aggregates, and no relation field on any other table that points at it. Filtering another
+     * table by a relation to it is gone too, so it is unreachable rather than merely unnamed.
+     *
+     * An excluded **column** disappears from every surface at once — the object type, the
+     * create/update/upsert inputs, the filter type, `orderBy`, the aggregate fields, the
+     * `distinct` and `groupBy` enums, and the upsert conflict targets. The exclusion is
+     * deliberately all-or-nothing: a column you can filter on but not select is an oracle, since
+     * `where: { keyHash: { eq: '…' } }` confirms a value without ever returning it.
+     *
+     * Excluding a `NOT NULL` column that has no default makes that table's inserts impossible to
+     * satisfy — `buildSchema` warns on the console when it sees this, and still builds, since a
+     * read-only table is a reasonable thing to want.
+     *
+     * Names that match nothing throw, so a renamed column fails the build instead of quietly
+     * un-hiding itself.
+     */
+    exclude?: SchemaExclusions;
     /**
      * Optional mapper from table key to singular/plural name pair.
      * When provided for a table, overrides the default (table key) naming for GraphQL type names,
@@ -1139,4 +1255,4 @@ declare const GraphQLDecimalString: GraphQLScalarType<string, string>;
 
 declare const buildSchema: <TDbClient extends AnyDrizzleDB<any>>(db: TDbClient, config?: BuildSchemaConfig) => GeneratedData<TDbClient>;
 
-export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };
+export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaExclusions, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };

package/dist/index.d.ts

@@ -239,7 +239,18 @@ declare const drizzleExecutorKey: unique symbol;
  * each dialect builder states it: `'nulls-largest'` for PostgreSQL, `'nulls-smallest'` for
  * MySQL and SQLite.
  */
-declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase) => RelationResolverFactory;
+declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor) => RelationResolverFactory;
+/** {@link BuildSchemaConfig.limits} resolved for one table. `undefined` means no policy. */
+type ResolvedLimitPolicy = {
+    defaultLimit: number | undefined;
+    maxLimit: number | undefined;
+    clampToMax: boolean;
+};
+/**
+ * Looks up the limit policy for a table by its Drizzle schema key. Built once per schema by
+ * `buildSchema`; `undefined` for a table the caller left unbounded.
+ */
+type LimitPolicyFor = (tableName: string) => ResolvedLimitPolicy | undefined;
 /**
  * Compiles an `orderBy` argument into ORDER BY expressions, highest priority first.
  *
@@ -760,6 +771,44 @@ type ComplexityConfig = {
      */
     aggregateCost?: number;
 };
+/**
+ * A limit policy: what a request without `limit` gets, and how large a `limit` may be.
+ * Every field is optional — an empty policy is the default unbounded behavior.
+ */
+type TableLimitPolicy = {
+    /** Applied when the client passes no `limit`. Capped by `maxLimit` when both are set. */
+    defaultLimit?: number;
+    /**
+     * The largest `limit` a client may ask for. Also bounds a request that passes no `limit` at
+     * all, since that means every row.
+     */
+    maxLimit?: number;
+    /**
+     * `false` (default) rejects a `limit` above `maxLimit` with a GraphQL error; `true` reduces
+     * it to `maxLimit` instead.
+     */
+    clampToMax?: boolean;
+};
+/** {@link BuildSchemaConfig.limits} — a global policy plus per-table overrides. */
+type LimitsConfig = TableLimitPolicy & {
+    /** Per-table overrides, keyed by the table's key in the Drizzle schema. */
+    tables?: Record<string, TableLimitPolicy>;
+};
+/**
+ * {@link BuildSchemaConfig.exclude} — tables and columns to keep out of the generated schema.
+ *
+ * Both lists are keyed by the Drizzle schema key, not the database name and not the generated
+ * GraphQL name.
+ */
+type SchemaExclusions = {
+    /**
+     * Tables that generate nothing at all: no object type, no queries, no mutations, and no
+     * relation fields on other tables that point at them.
+     */
+    tables?: string[];
+    /** Per-table column exclusions, keyed by the table's key in the Drizzle schema. */
+    columns?: Record<string, string[]>;
+};
 type BuildSchemaConfig = {
     /**
      * Determines whether generated mutations will be passed to returned schema.
@@ -911,6 +960,73 @@ type BuildSchemaConfig = {
         mode: 'auto';
         timeoutMs?: number;
     };
+    /**
+     * Bounds on the `limit` argument of list queries and to-many relation fields.
+     *
+     * Both knobs are off by default: without them a client can omit `limit` and pull a whole
+     * table, or pass `limit: 1000000` and do the same thing politely. Turning either on changes
+     * observable behavior for existing consumers, so nothing is applied unless asked for.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   limits: {
+     *     defaultLimit: 50,  // used when the client passes no `limit`
+     *     maxLimit: 500,     // anything above is rejected
+     *     tables: {
+     *       auditLog: { defaultLimit: 20, maxLimit: 100 },
+     *     },
+     *   },
+     * });
+     * ```
+     *
+     * - Applies to root list queries **and** to to-many relation fields — an unbounded relation
+     *   inside a bounded root is the same scan one level down. A relation field takes the policy
+     *   of the table it *targets*, so a table is bounded wherever it is reached from. Single-row
+     *   queries and aggregates take no `limit` and are unaffected.
+     * - A `limit` above `maxLimit` is rejected with a GraphQL error. Set `clampToMax: true` to
+     *   silently reduce it instead — honest paginating clients prefer the error, since a clamped
+     *   page looks like the end of the results.
+     * - `maxLimit` on its own also bounds the *omitted* case: no `limit` means every row, which
+     *   is above any maximum. `defaultLimit` is what a request without `limit` gets, capped by
+     *   `maxLimit` if both are set.
+     * - `tables` overrides per table, keyed by the Drizzle schema key. A table's entry replaces
+     *   the top-level value for whichever keys it sets.
+     * - Cursor pagination inherits the same policy — a keyset page needs a limit to be
+     *   meaningful, and `defaultLimit` is what makes `after`-only pagination well-formed.
+     * - The complexity hints price the *effective* limit, so cost estimation and enforcement
+     *   agree.
+     */
+    limits?: LimitsConfig;
+    /**
+     * Tables and columns to leave out of the generated schema entirely.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   exclude: {
+     *     tables: ['magicLinks', 'sessions'],
+     *     columns: { apiKeys: ['keyHash'] },
+     *   },
+     * });
+     * ```
+     *
+     * An excluded **table** generates nothing: no object type, no root queries or mutations, no
+     * aggregates, and no relation field on any other table that points at it. Filtering another
+     * table by a relation to it is gone too, so it is unreachable rather than merely unnamed.
+     *
+     * An excluded **column** disappears from every surface at once — the object type, the
+     * create/update/upsert inputs, the filter type, `orderBy`, the aggregate fields, the
+     * `distinct` and `groupBy` enums, and the upsert conflict targets. The exclusion is
+     * deliberately all-or-nothing: a column you can filter on but not select is an oracle, since
+     * `where: { keyHash: { eq: '…' } }` confirms a value without ever returning it.
+     *
+     * Excluding a `NOT NULL` column that has no default makes that table's inserts impossible to
+     * satisfy — `buildSchema` warns on the console when it sees this, and still builds, since a
+     * read-only table is a reasonable thing to want.
+     *
+     * Names that match nothing throw, so a renamed column fails the build instead of quietly
+     * un-hiding itself.
+     */
+    exclude?: SchemaExclusions;
     /**
      * Optional mapper from table key to singular/plural name pair.
      * When provided for a table, overrides the default (table key) naming for GraphQL type names,
@@ -1139,4 +1255,4 @@ declare const GraphQLDecimalString: GraphQLScalarType<string, string>;
 
 declare const buildSchema: <TDbClient extends AnyDrizzleDB<any>>(db: TDbClient, config?: BuildSchemaConfig) => GeneratedData<TDbClient>;
 
-export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };
+export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaExclusions, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };